Blog – Page 25

Bluetooth Vulnerability Allows Hackers To Access Devices

August 1, 2018 by Joseph Martin

There’s a new Bluetooth security vulnerability to be aware of, tracked as CVE-2018-5383, and it’s a nasty one.

It’s a cryptographic vulnerability that affects firmware or operating system software drivers from a number of major vendors, including Qualcomm, Broadcom, Intel and Apple. At this point, the implication of the bug on Linux, Android, and Google are unknown.

The flaw is related to two important Bluetooth features: BR/EDR implementations of Secure Simple Pairing in device firmware and Bluetooth Low Energy (BLE) of Secure Connections Pairing in OS system software.

It was discovered by researchers operating out of Israel’s Institute of Technology. They discovered that the Bluetooth specification recommends (but critically does not mandate) that devices supporting the two features make any effort to validate the public encryption key received during secure pairing.

Since the specification is optional, it’s hardly a surprise that some vendors producing Bluetooth products do not take sufficient steps to validate the parameters used to generate public keys during the exchange.

This allows a would-be hacker the possibility of executing a man-in-the-middle attack to obtain the cryptographic key used by the device. This would give them the opportunity to not only spy on the device’s owner, but also to inject malware that could allow the hacker to take full control over the device.

SIG (the Bluetooth Special Interest Group which maintains the technology), had this to say about the flaw:

“For an attack to be successful, an attacking device would need to be within wireless range of two vulnerable Bluetooth devices that were going through a pairing procedure.

The attacking device would need to intercept the public key exchange by blocking each transmission, sending an acknowledgement to the sending device, and then injecting the malicious packet to the receiving device within a narrow time window. If only one device had the vulnerability, the attack would not be successful.”

Bluetooth SIG has now updated the specification to require products to validate public keys received as part of the public key-based security procedures. Of the manufacturers mentioned above, Apple and Intel have both released patches. Broadcom has made fixes available to its OEM customers who are responsible for providing them to end-users. There has been no word yet from Qualcomm.

Girl Scouts Can Now Earn New Badges For High Technical Skills

July 31, 2018 by Joseph Martin

The girl scouts have officially moved into the 21st century.

The Girl Scouts of America recently announced the creation of a whole raft of new badges that address (in the organization’s words) “some of society’s most pressing needs.”

A total of 30 new badges will be available exclusively for girls between the ages of five to eighteen for efforts and advocacy in the following areas:

Computer Science

Cybersecurity

Environment

Robotics

Space Exploration

Badges are awarded on the basis of completing specific tasks. So, for instance, when a girl learns how to code and completes a small project, she could be awarded with the new computer science badge, and when she builds a simple robot, the robotics badge would be awarded.

This is part of an ongoing effort to boost interest and participation in fields where women are generally under-represented.

According to the Girl Scouts USA CEO, Sylvia Acevedo:

“Whether they are fighting cybercrime, exploring how engineers solve problems, or advocating for issues affecting their community, Girl Scouts are learning how to proactively address some of the foremost challenges of today, while also building skills that will set them up for a lifetime of leadership.”

In recent years, the Girl Scouts have struggled to maintain enough membership nationally to remain viable. This is at least one of the reasons why the Boy Scouts of America announced in October 2017 that they would begin accepting girls into their program.

It remains to be seen whether the move to modernize the badges available to girls in the organization will be enough to boost membership and ensure the organization’s long-term viability. Even if it’s not, it’s a fantastic idea and long overdue. Kudos to Girl Scouts’ leadership for taking innovative action, and to all the girls who earn these new badges!

Hackers May Set Their Sights On Your GPS Next

July 30, 2018 by Joseph Martin

If you’re like most people, you probably rely heavily on the GPS function of your phone. Type in an address and your phone helpfully guides you, turn by turn, to your destination. It’s one of the most often utilized features of a smartphone, and of course, the hackers are very interested in interfering with it.

Until now though, hackers have been unable to fool humans into driving to the wrong destination by hacking their GPS, because their instructions often make no sense given the prevailing terrain features the humans are seeing on the road. For instance, nobody is going to turn left into a Jiffy Lube parking lot or a corn field just because GPS says to (unless your destination was Jiffy Lube, of course).

That’s changing, thanks to researchers from Virginia Tech and the University of Electronic Science and Technology of China.

The team has devised a way to hack into a GPS system and spoof the results well enough to fool humans, giving bogus driving directions that seem to make sense given local conditions, and as such, don’t raise red flags.

Accomplishing the task was no small feat, involving the creation of an algorithm that works in something close to real time. This along with a portable device for spoofing GPS that can be attached to the car of your target or placed in a trailing car. Its effective range is about fifty meters.

Once the equipment is in place, the algorithm crafts GPS inputs that follow the real world road network, allaying suspicion in 95 percent of the team’s test cases, while still ultimately sending the target to the wrong destination.

There are any number of ways this exotic type of attack could be used, but the two primary use cases would be to intentionally steer the target into hazardous road conditions, or to lure them to an isolated area where a physical attack could be carried out.

Unfortunately, in the months and years ahead, we can probably count on seeing both.

New Report Shows 32 Percent Increase In Cyber Attacks

July 28, 2018 by Joseph Martin

Positive Technologies has just released a new report that paints a grim picture for IT professionals. If your sense is that the number of cyberattacks are increasing, you’re not wrong. In fact, it’s probably worse than you realize.

So far this year, we’ve seen a staggering 32 percent increase in the total number of cyberattacks in the first quarter of 2018, compared to the same period last year. Even worse, malware attacks have increased by a mind-bending 75 percent since the first quarter of 2017.

Individuals were far and away the most frequent target (28 percent), but government agencies came in a reasonably close second (16 percent), with business in the healthcare, finance, and IT sectors rounding out the top five (8 percent, 7 percent, and 5 percent, respectively).

Of the malware deployed against targets this year, spyware was by far the most common, with stealth cryptocurrency mining software not far behind.

Leigh-Anne Galloway, the cyber security resilience lead at Positive Technologies explains in more detail:

“Our research shows that 63 percent of attacks included use of malware. Spyware, in particular, is used most often because it allows obtaining not only personal information and corporate secrets, but credentials for the services and systems needed to attack internal corporate infrastructure.”

Long story short, the prevalence of spyware seen in this report is likely to have cast-off effects in the future. Hackers will gain a sufficient level of access and information, courtesy of their successful spyware attacks, to launch even more harmful attacks against both individuals and government/corporate institutions in the future.

Positive Technologies warns that the number of attacks is likely to continue to escalate, and that there’s no clear end in sight.

The report is dark news if you’re in the digital security business. If your business hasn’t been hit yet, it seems that it’s just a matter of time.

Survey Shows Businesses Feel Prepared For A Data Breach

July 27, 2018 by Joseph Martin

A majority of business owners from around the world (68 percent) feel that they’re better prepared to ward off a cyberattack and prevent a data breach than their competitors. This is a figure which is up 8 percent over last year’s statistic for the same question. This, according to a recent survey by FICO.

In the US, power and industrial companies were the most confident, with 86 percent of companies from these sectors rating their firms as either above average, or top-tier in terms of their preparedness. The US financial firms were the least confident, with only 60 percent rating their firms as either above average or top-tier.

Telecommunications companies fell somewhere in the middle, with 72 percent of respondents ranking themselves above average or top-tier.

It may be premature to break out the champagne.

Maxine Holt, a research director on the team conducting the survey says:

“IT leaders have greater funding than ever to protect organizations from the continuously evolving threat landscape and meet complex compliance demands.

These same IT leaders are undoubtedly keen to believe that the money being spent provides their organization with a better security posture than any other – but the rapid pace of investment, often in point solutions, rarely takes an organization-wide view of security.”

In short, the increase in confidence might be illusory. The risk is that if too much is read into these numbers, it may lead to overconfidence, which could lead to an under-investment in security in subsequent years. This can ultimately set these companies (or at least some of them) up for failure and disappointment when their expensive security measures prove not to be nearly as effective as they initially believed.

Even if you didn’t participate in the recent survey, it bears asking the question: How would you rate your company’s ability to fend off an attack, relative to your competition?

World Cup Avoided Nearly 25 Million Cyber Attacks This Year

July 26, 2018 by Joseph Martin

According to the Kremlin, Russia prevented almost twenty five million cyber-attacks during the World Cup this year.

President Vladimir Putin praised the nation’s digital security forces by saying the following:

“I expect that your close and constructive interaction will continue and will contribute to ensuring the security of our states and our citizens in the future.”

Given the high-profile nature of the event, it was hardly a surprise that it would be a tempting target. In a survey by Lastline, in the weeks leading up to the World Cup, a staggering 72 percent of security professionals believed that an attack was likely.

The Russians took the threat seriously. In addition to beefing up their own security personnel, they also opened a “Cooperation Center” which was staffed by law enforcement officers from 34 different countries.

Some security professionals have cast doubt on the Kremlin’s figures, while others have at least unwillingly admitted that the figures weren’t out of the question.

David Grout (the Southern Europe Technical Director of FireEye) had this to say:

“Vladimir Putin’s statement that government security services have thwarted 25 million cyber-attacks linked to the FIFA World Cup may seem like a surprisingly high number, but not necessarily for those who work in the field. Every major event, whether sporting, political or otherwise, is likely to attract cyber-attacks. The 2018 World Cup is no exception. Before the competition had even started, there was evidence of Phishing attacks.

This included phishing attacks that started several weeks before the tournament and carried on throughout. These campaigns use several levers such as low-cost ticket offers, the chance to win a trip to Russia, promotions for items related to the World Cup (national team jerseys, mugs featuring players etc.). The main goal in this type of attack is to recover your banking information and force you to go through with the transaction to get the card number information, expiration date and also CCV.”

Even if the numbers are somewhat inflated, kudos to Russia for their deft handling of the event!

Clinic Employee Learns That Traveling Increases Data Theft Risk

July 25, 2018 by Joseph Martin

On May 14th, the Billings Clinic in Montana issued a breach notification statement, which explained that they detected unusual activity within one of its employee’s email accounts.

The employee in question was traveling overseas on a medical mission when the email account was compromised.

“As a result of the forensics investigation, we learned that an unauthorized individual had access to emails and attachments within that one account, some of which included patient information.”

As for scope and scale, information on more than 8,400 individuals was exposed. While the data varied from one patient to the next, the data included patient names, dates of birth, contact information, medical record numbers, internal financial control numbers, diagnoses, and some information about medical services received.

The incident highlights a common, but often overlooked problem.

As analyst Rebecca Herold explains:

“It is very common for data and devices to be hacked while traveling and for those who were hacked to not even realize it. People are often unaware of what is going on around them when they are travelling. They are using any charger station they can find, they speak loudly, and they use free Wi-Fi.

Shoulder surfing is also still very common; it’s a decades-old tactic that still works effectively today. The skimmers on charging stations are increasing in use. Don’t think that if you are in a frequent flyer lounge that these things do not happen there; they happen in those exclusive lounge areas possibly more than in other places.”

The bottom line is, any time your employees are away from your office, the risks of hacking increase. While there are no simple solutions, it bears making your employees aware of the added risks any time they’re travelling. It’s far from a perfect solution, but it’s a good place to start.

Thermal Imaging Could Help Thieves Steal Your Passwords

July 24, 2018 by Joseph Martin

As if there weren’t enough ways for hackers to steal your passwords, now, there’s thermal imaging. If that sounds like something straight out of a science fiction movie, think again.

Researchers from the University of California at Irvine recently discovered and demonstrated a technique that involves the use of a thermal imaging camera to capture heat traces left by human fingertips as they type passwords into a keyboard. In fact, their technique is effective for up to thirty seconds after the user removes his hands from the keyboard.

Per the researchers, “Although thermal residue dissipates over time, there is always a certain time window during which thermal energy readings can be harvested from input devices to recover recently entered, and potentially sensitive information.”

The team tested their technique using off the shelf technologies, and on four different keyboards. Their findings indicated that a full password could be obtained by scanning for thermal residues on those keyboards, provided that the scan was taken within thirty seconds of the first key being pressed. After a full minute, it was still possible to obtain partial passwords.

They used an FLIR camera on a tripod set two feet from the keyboards being tested, and the results of their findings were published in a paper called simply, “Thermanator.”

FLIR makes a number of different camera models that can capture heat. Their most basic model, the FLIR One Pro is a $400 accessory available as a smartphone attachment. Some phones (like the CAT S61) ship with the FLIR module embedded in the technology.

The team noted that the ease with which a password could be detected in this manner had a lot to do with the typing style of the target being monitored. Passwords entered by “hunt and peck” typists could be gleaned between 19.5 and 31 seconds, while passwords entered by touch typists took upwards of 50 seconds to be gleaned.

Obviously, this is a fairly exotic form of attack. Although it utilizes off the shelf technology, it would require an extraordinary level of access to set the equipment up, and an extraordinary lack of vigilance on the part of security personnel not to detect the equipment in relatively short order. Even so, it’s certainly within the realm of possibility, and one more thing to be on guard against.

Massive Breach Affects 21 Million Users Of Timehop App

July 23, 2018 by Joseph Martin

Do you use Timehop? If you’re not sure what that is, it’s a popular, clever little app that reminds social media users about posts they’ve made in the past. It can be quite handy, especially if you’re active on numerous social media accounts.

Unfortunately, the bloom is off the rose for Timehop. Recently, the company announced that it had suffered a breach on the Fourth of July, which gave the hackers virtually unfettered access to the company’s cloud servers for more than two hours. During that time, the hackers were able to make off with the names, email addresses and other account details of more than twenty-one million users.

Nearly five million of the records stolen (4.7 million) had phone numbers in the data. As bad as that sounds, it gets worse. Because of what Timehop is and how it works, it’s got hooks into all of the social media accounts of every member who uses the app.

Timehop uses tokens to access social media information. Tokens that are now in the hands of the hackers, who could use them to view and/or “scrape” social media content (including private posts) uploaded by every one of the 21 million impacted users. In short, even if you keep tight control over who can see your social media content, if you’re one of the impacted users, the cat is officially out of the bag.

The company says that they deactivated all tokens shortly after the incident was detected, but there was still a small window of time in which they could have been used.

As is the norm in cases like these, Timehop has issued an apology, is in the process of informing all affected users, and is working with law enforcement and an outside agency to assist with the forensic investigation. This incident, however, underscores how easily it is to lose control of one’s data.

It’s not enough to simply exercise caution and be mindful of security on the social media channels you frequent. You’ve also got to be mindful of what third parties you allow to access those channels, because any one of them could provide an inroad for a hacker.

Malware Created Using Stolen Legitimate Security Certificate From D-Link

July 21, 2018 by Joseph Martin

Researchers from the digital security firm ESET have recently spotted a new malware campaign with a nasty twist. It was created using a legitimate security certificate stolen from D-Link.

The malware appears to be the work of an Advanced Persistent Threat group known as BlackTech, which primarily targets high profile users and firms in Asia, with a

particular emphasis on Japan, Hong Kong and Taiwan.

BlackTech is responsible for two different malware families, PLEAD and the DRIGO exfiltration tool, both of which have been found to be using the stolen certificate. ESET has also found the compromised certificate in the source code of a password stealer designed to scrape passwords from Google Chrome, Internet Explorer, Mozilla’s Firefox, and Microsoft Outlook.

ESET reported their findings to D-Link, and company officials opened a formal investigation into the matter. They ultimately discovered not one, but two compromised certificates, both of which were revoked immediately.

Even so, this latest discovery underscores one of the dangers of our current global security architecture. Any central point is a source of weakness. In this case, certificates are issued by a central body to provide a layer of trust. Software developers use certificates to demonstrate that they are legitimate pieces of code.

That system works well, right up until the point where a hacker manages to steal one of the “trusted” certificates. Then, the weakness of the security paradigm is revealed.

This is just one of many areas of global network security that needs a top-to-bottom rethink and overhaul. The old methods of securing our vast oceans of data just aren’t working any more. Until something is done to change the game in the favor of security personnel, the hackers are going to have an increasingly easier time breaking in.

As ever, vigilance, however imperfect, is the best defense.