This was a very busy week for infosec. Buckle up!
WhatsApp Discovers 'Targeted' Surveillance Attack
BBC News: WhatsApp fixed a bug that allowed malware developed by NSO Group and bought by governments to spy on a target's device. First reported by the Financial Times ($), at least one known target was a U.K. lawyer, according to @iblametom. Panic ensued — even there was little need — but users should update their apps if they haven't already. The buffer overflow bug was triggered by making several dropped phone calls to a device. WhatsApp said the attack "has all the hallmarks of a private company reportedly that works with governments to deliver spyware."
More: Facebook | @rmac18 | Forbes
A Cisco Router Bug Has Massive Global Implications
Wired ($): As if that news wasn't bad enough, @lilyhnewman scored a great scoop on how security researchers broke the secure boot in Cisco routers. That's a major problem — how do you even patch if you can't trust the firmware? The researchers called the flaw "Thangrycat." Cisco released a patch for a separate remote code execution bug needed to exploit the secure boot flaw, but said secure boot patches could be months away. "Given Cisco's ubiquity, the potential fallout would be enormous," wrote Newman. Yeah, and then some.
More: Thangrycat | Cisco Security Advisory
New Secret-Spilling Flaw Affects Almost Every Intel Chip Since 2011
TechCrunch: Tuesday became the busiest day. Security researchers and Intel released a new set of speculative execution bugs affecting pretty much every Intel processor since 2011. Great! Dubbed "ZombieLoad" (yes, there's a website), a successful attack can obtain secrets from the processor in real-time, like passwords and secret keys. It also transcends virtual machine boundaries, and affects cloud systems, too. Is it easy to exploit? Hell no. But it's an interesting bug nonetheless. Microcode and OS-level software updates are out, so patch your stuff. (Disclosure: I wrote this story.)
More: TechCrunch | ZombieLoad
Microsoft Patches Windows XP To Try To Head Off 'Wormable' Flaw
ZDNet: Just after two years after WannaCry hit, another wormable Windows flaw is all we need. If you thought the ZombieLoad bug sounded bad, this latest RDP attack is so much worse and more likely to affect you. Microsoft has more on CVE-2019-0708 and @GossiTheDog has a mega tweet thread on the bug. In short, the bug if exploited can take remote control of a system or install malware on a system with RDP exposed to the internet. Many are older Windows XP boxes, hence Microsoft jumping to patch a near-two decade old operating system. Dragos also had a great impact assessment on the flaw.
More: Dragos | Microsoft TechNet
Trump Signs Order Setting Stage To Ban Huawei from U.S.
Politico: President Trump signed an executive order all but banning Huawei from the U.S. on grounds of national security. The 5G tech giant has ties to China's military, sparking worries in the U.S. that the equipment could be used for spying. Huawei wasn't named in the order but it's the strongest signal yet that the tech giant could be forced to sit 5G out — in the U.S. at least.
More: Ars Technica | White House
Ransomware Recovery Firms Often Just Pay The Hackers
ProPublica: This reporting — excellently done as always on ProPublica — will make your blood boil. Two data recovery firms said they can recover files but all they did was paid the ransom and charge the organizations a premium for it. There's no law against paying ransoms, even though the FBI asks people not to ever pay up. But this kind of shady dealings is the reason why you should always have a backup plan.
More: Ars Technica
Radio Navigation Systems In Planes Can Be Hacked
Ars Technica: Almost every aircraft flown in the past 50 years is aided by radios to safely land at airports, particularly in bad weather or heavy fog. But these systems aren't secure — at all — and can be tricked with radio-replay attacks. Using a $600 software defined radio, researchers can spoof signals used in these airport landing systems to trick a plane into thinking its going off-course, potentially causing accidents.
More: Paper (PDF)
|
|
THE STUFF YOU MIGHT'VE MISSED
|
|
How to brick a Samsung phone
Medium: Baptiste Robert, who goes by the online handle Elliot Alderson, found a bug in most Samsung phones that if triggered can cause a local denial-of-service condition. In his proof-of-concept code, he built a Locker app that effectively trips the device into a loop.
SHA-1 collisions now a lot easier to carry out
ZDNet: New research out this week showed it's much easier (and cheaper) to carry out successful SHA-1 collision attacks. SHA-1 is deprecated but it's still in wide use, particularly in file and document verification. The first collision attack was a breakthrough but now they're far easier to carry out. @kennwhite, everyone's favorite crypto expert, had an interesting mini tweet thread on the new findings. As @campuscodi writes: "What this means is that SHA-1 collision attacks aren't a game of roulette anymore, and now, threat actors can forge any SHA-1-signed documents they want, ranging from business documents to TLS certificates." The paper can be read here (via @ProfWoodward).
EFF wins national security letter lawsuit
EFF: Great news from the EFF: the secretive world of FBI-issued national security letters are about to get a hearty dose of sunlight after it won a lawsuit in San Francisco. More than 500,000 have been issued since 2001 when NSL powers first came out after 9/11. NSLs come with gag orders, but are occasionally lifted when they're no longer necessary. Now, the EFF hopes, it'll have a better idea of when and how gag orders are lifted. That could make it easier to fight them in future.
Russians accessed two Florida voting databases
Associated Press: Russian hackers gained access to voter databases in two Florida counties ahead of the 2016 presidential election, according to Florida governor Ron DeSantis. A hacker got in through a spearphishing email. Data wasn't manipulated and election results weren't compromised. Florida votes statewide on paper ballots, according to the AP.
Over two-dozen government ransomware attacks in 2019 alone
Recorded Future: A new report out this week gives an insight into the state-of-the-union of ransomware in government. The research shows there were 53 ransomware attacks in 2018, and close to half that for the first four months of 2019, indicating an upward trend. SamSam, Ryuk, WannaCry and CryptoLocker seem to be the biggest hitters in local and state governments, according to the report.
AV makers confirm (and deny) network breaches
Gizmodo: This was dogged reporting by @dellcam and clearly wasn't easy. He found the three most likely culprits of previously reported breaches at three large antivirus makers: Symantec, Trend Micro, and McAfee. Hackers reportedly broke into the AV makers' systems, according to a Russian research outfit, but there's still a lot of mystery around exactly how they were breached — if at all. It's a story to watch, for sure.
CloudCMS, Picreel websites hacked, hitting thousands of customers
Willem de Groot: de Groot found two supply chain attacks underway this week: marketing software @Picreel and @CloudCMS had their sites hacked and data exfiltrating code installed on their websites. That affected their downstream customers — more than 4,600 customers in the end. According to de Groot, data was being siphoned off to a server in Panama. Less than a day later, the companies removed the malicious code.
Hack into school lunch company website leads to arrest of competitor
San Francisco Chronicle: This is hilarious: the lede alone had me cracking up. "Heated competition" between two Bay Area school lunch firms turned criminal after a top executive at one of the companies allegedly hacked into the other's website. The chief financial officer was arrested on two counts of hacking. The Register has more. The things people do when they're hangry...
|
|
Europol, DOJ take down GozNym banking malware
Six countries, including the U.S. and with help from Europol, took part in the takedown of the GozNym malware network. Prosecutors on both sides of the pond said the malware attempted to steal $100 million from business bank accounts. Five defendants remain wanted by the FBI. The DOJ said in a statement that the "cybercrime as a service" was taken down following the earlier dismantling of the Avalanche crime network. (Disclosure: I also wrote this story.)
Google recalls and replaces Titan security keys
Welp — a little embarrassing — but better full disclosure than not. Google said its Bluetooth security keys had a flaw that allowed an attacker within a close proximity to communicate with the key or the device it's connected to. Google said anyone with a T1 or a T2 security key is eligible for a free replacement. Ars Technica explains the situation in more detail. Props to Google for coming clean but definitely bruising.
OGUSERS forum hacked by another hacker
Props to @lorenzoFB for getting "hack" three times in his subhed for this story. The forum, OGUSERS, known for trading stolen Instagram and Twitter accounts, was itself hacked. "Motherboard obtained a copy of the database and verified that the data within it was real by searching for two accounts that our reporters registered," he wrote. Source code, website data, and private messages were all stolen, along with emails and IP addresses. Someone at the FBI is having a really good week.
Hospitals push device makers to improve security
From the Wall Street Journal ($), this was an insider's look at how hospitals are trying to ensure the devices they use are protected and secured. Hospitals are red teaming to try to find flaws and asking device makers to identify issues — and rejecting bids for devices that don't contain security features. Healthcare companies and hospitals have reported close to 150 hacks exposing health data in the last year alone. Given most hospitals are private enterprises, it's a financial decision as much as it is for the protection of their patients.
Twitter snafus iOS location data again
In case you missed it: Twitter revealed this week it exposed iOS users' location data with one of its partners in some cases. "If you used more than one account on Twitter for iOS and opted into using the precise location feature in one account, we may have accidentally collected location data when you were using any other account(s) on that same device for which you had not turned on the precise location feature," wrote the disclosure. The data was deleted by the partner, Twitter said.
Hackers abuse Asus' cloud service again to install backdoors
Asus customers just can't catch a break. This week, Eset researchers say they discovered router man-in-the-middle attacks that exploit HTTP connections between users and Asus' servers. By exploiting this insecure update mechanism, attackers installed malware that backdoored networks, coupled by a lack of code-signing. The latest security lapse lands two months after hackers pushed a malicious software update to hundreds of thousands of Asus PC owners.
Aussie medicare data sold on the dark web — two years after breach
Details "of any living Australian citizen" have been available on a dark web marketplace since September 2018, according to The Guardian. It comes two years after an apparent breach of Australian Medicare data.
|
|
And breathe. Here's some good news:
Congrats to @josephmenn, who finally showed off his new book, Cult of the Dead Cow, about one of the most prolific hacktivist groups on the internet. Earlier this year revealed that presidential candidate Beto O'Rourke was a long-time member. Also congrats to @a_greenberg for his book reveal this week about the Russian hacker group Sandworm. Really excited to read both.
And in dog-related infosec news, @MalwareJake meets a cute airport therapy dog, and @maassive shows off his dog sporting some fancy anti-facial recognition sunglasses.
And for anyone wondering why this newsletter is late this week — well, duh! Have you seen how busy it's been this week? Thanks to @lorenzoFB for empathizing.
|
|
|
If you want to nominate some good news from the week, feel free to reach out: zack.whittaker@gmail.com.
|
|
|
Extremely handsome cybercat alert! This week's cybercat is Marty, who wants to remind everyone to encrypt their data in transit. A big thanks to Marty's human, Robert Meineke, for this week's submission. (You may need to enable images in this email.)
|
|
Another regular call to send in your cybercats! All I need is a name, a photo, and an optional caption and they will always be featured in an upcoming newsletter. You can submit your cybercats here. |
|
|
And that's it for now. Wow, what a week. As always you can leave your suggestions and feedback here. See you next Sunday.
|
|
|
|
