Blog – Page 29

WiFi Sync on iOS Vulnerable To TrustJacking

May 10, 2018 by Joseph Martin

Owners of Apple devices have a new attack vector to worry about, called “TrustJacking.” Symantec researchers recently stumbled across a pair of scenarios that take advantage of Wi-Fi syncing of various Apple devices. These are scenarios that also take advantage of the trust users have in the security of their own devices, allowing hackers to take complete control over those devices.

The flaw is a consequence of the way that iTunes Wi-Fi Sync is designed. The vulnerability manifests when a device is connected and the user selects the “sync” feature. This creates an opening which could potentially allow a hacker to take complete control over the device.

The first issue manifests like this: With the “sync” setting enabled, the device owner has access to both that device and a paired iPhone over a wireless connection, even after the device is disconnected from the syncing service. That sets up part one.

Part two of the first scenario requires a bit of social engineering, where a hacker tries to trick the device owner to click on a malicious link that will install malware of the hacker’s choosing on the vulnerable system.

The second part of the second scenario targets users who are traveling. A hacker could take control of a free airport charging station. In order to make use of those free charging stations, users are required to trust the device. As soon as that happens, the hacker controlling the charging station can remotely issue a command to connect to iTunes, and then enable the sync command.

Once those two steps are completed, even when the victim disconnects from the charging station, the hacker can still access the compromised device remotely, gaining access to most (if not all) of the user’s private information.

Unlike similar, recently discovered vulnerabilities in Apple products, this one distinguishes itself by allowing the hacker permanent access to the device, making it a dangerous vulnerability indeed.

New Malware Takes Screenshots and Steals Your Passwords

May 8, 2018 by Joseph Martin

Recently, a new strain of malware called “SquirtDanger” has been found by researchers at Palo Alto Networks Unit 42, and it’s a particularly nasty one for a couple of reasons. First and foremost, the owner of the malware isn’t orchestrating campaigns himself, but rather, selling his product as a commodity on the Dark Web.

That has troubling implications because the malware is quite advanced, and since it’s being sold to a broad cross-section of hackers, odds are excellent that it will be used in numerous campaigns that could affect a number of industries.

As for the software itself, it gives the hackers who purchase it a vast array of tools. It communicates back to its controller every minute, giving the hackers who use the malware a tremendous amount of useable data.

Among other things, SquirtDanger can take live-action screen shots of an infected device, steal passwords, and send, receive, or delete files on the target system. It can also swipe directory information and drain the contents of cryptocurrency wallets, making it something of a “Jack-of-All-Trades” malware.

Also, there’s no single attack vector being used to infect machines with SquirtDanger. According to the research team, the most common means of infection is that the malware is disguised as a piece of legitimate software and installs when the poisoned executable file is run.

Researchers from Unit 42 had this to say on the matter: “Being infected with any type of malware represents significant danger to an individual or victim. However, because of the large list of capabilities this malware family includes, it would certainly be very bad for the victim.”

At latest count, the researchers have discovered 1,277 unique SquirtDanger samples in the wild, tied to 119 unique command and control servers that were widely geographically dispersed. Odds are, there are many more samples that have yet to be discovered. Be on your guard, it doesn’t appear that this threat will abate anytime soon.

Are Lasers The Answer To Completely Wireless Computing And Charging?

May 7, 2018 by Joseph Martin

Researchers at the University of Washington just might change the face of computers and computing forever. It may seem like the stuff of science fiction, but based on their research, the day may soon be coming when computing devices are completely un-tethered, requiring no wires for either power or recharging.

The team was able to successfully charge a smartphone from across a room using nothing more than lasers. Right now, their approach has an effective range of about forty feet. Devices are detected by way of acoustic “chirps” which occur below the threshold of human hearing. Once a target device is located, the laser charging system sends power to them using laser light, with no damage to the target device.

Right now, the power transfer is limited to just a couple of watts. However, the researchers don’t see any obstacles that would prevent scaling of the power transfer, meaning it could easily be modified to power PCs.

Wireless Power Transfer (WPT) is not a new idea. In fact, it’s in use today in such things as smartphones and electric toothbrushes. The problem, at least until now, has been a matter of range, which has been virtually nonexistent until the University’s game-changing experiments.

The big breakthrough wasn’t in sending power to a device via laser. Scientists have known that was possible for quite some time. The issue though, was that when lasers (or microwaves) were used to send power, they were invariably hazardous to humans in the area. In addition, they often fried the electronics they were attempting to power. The research team seems to have solved for both of those problems.

While the technology is still quite some distance from being commercially available, this is a huge leap forward. This could forever change the way we interact with our computing devices, and that change could come much sooner than anyone ever imagined.

Bank Employee Steals Info On Over A Million Customers

May 5, 2018 by Joseph Martin

Atlanta-based SunTrust Bank is the 12th largest bank in the US. They have a major problem, and so do roughly a million and a half of its customers. According to CEO William Rogers, an unidentified employee of the firm printed a vast amount of private customer information, including their names, addresses, phone numbers and account balance information.

Rogers stressed that social security numbers, account numbers, driver’s license numbers, user IDs, and passwords were not exposed. In a recent press release, he had the following to say:

“In conjunction with law enforcement, we discovered that a former employee while employed at SunTrust may have attempted to print information on approximately 1.5 million clients and share this information with a criminal third party.

We and third parties have done forensic analysis on these accounts and we have not identified significant fraudulent activity regarding the effect of the accounts.”

Even so, this is a blow to the company’s image, and the lost trust won’t be easily regained. It also underscores how vulnerable companies are to internal threats.

In response to the attack, SunTrust is offering ongoing IDnotify identity protection (offered through Experian) to all its current and new clients at no cost.

The company’s handling of the issue so far has been about as good as can be expected. The unfortunate reality is that there aren’t many good ways of stopping a rogue employee from making off with sensitive customer data or proprietary company information. Better auditing protocols and controls can help, but only to a certain extent. While those kinds of policies make it easier to detect when an internal theft has occurred, they do nothing to actually prevent them.

This puts management in a tricky spot. Employees have to be trusted with sensitive data in order to do their work, which also increases risk. There aren’t many good solutions here beyond better vetting of employees, but of course, that is by no means a magic bullet either.

Apple Recall Affects Some Macbook Pro Batteries

May 4, 2018 by Joseph Martin

If you recently bought a 13-inch MacBook Pro (without a Touch Bar), you’ll want to head to Apple’s website. The company didn’t make a big announcement, but they’ve quietly introduced a battery replacement program that impacted what the company described as a “limited number” of laptops.

The company didn’t provide many details, but apparently, on certain machines an unknown component failure can cause the built-in battery to swell. There’s no danger of an explosion and no fire hazard associated with the failure, but the company is playing it safe and offering to replace the batteries on any affected laptop, free of charge.

According to details on Apple’s website, the laptops in question were manufactured between October 2016 and October 2017. If you visit the webpage, you can enter your machine’s serial number to see if your machine is affected, and thus eligible for the free replacement.

At this time, it’s unclear precisely how many machines this issue has impacted. But clearly, Apple wants to put this issue to rest as quickly as possible.

Battery swelling is a strange symptom, but surprisingly, this is not the first time Apple products have suffered from similar issues. Not long ago, Apple’s 42mm Smart Watches suffered a similar problem, prompting the company to issue a similar recall. The company also recently extended their warranty on first-gen Apple Watch models by two years, offering free battery replacements for up to three years after the date of purchase.

These recent moves have caused iPhone owners to cry foul. On the heels of the Apple “Throttling” drama last year, the company offered a discounted battery replacement program to help bring older iPhones with failing batteries back to full speed. While Apple’s $29 discounted battery price is a significant savings over the regular price of $79, some users argue that the batteries should have been free for these products as well.

Researchers Find Major Vulnerabilities In Banking Apps

May 3, 2018 by Joseph Martin

Do you do your banking online? If so, there’s bad news in the form of a report recently released by the security firm “Positive Technologies.”

The company tested a variety of websites using a proprietary tool they developed in-house, which scans websites for security flaws. While flaws were found across a wide range of industries, literally every banking site Positive Technologies tested was found to have serious security flaws.

The particulars varied from one bank to the next, but the security flaws included:

XML external entity errors

Arbitrary file reading and modification flaws

Expired or nonexistent SSL certificates

Poor or nonexistent encryption

Some banking websites were so flawed that a hacker could execute a ‘man in the middle’ attack and execute malicious code to infect the user’s machine. They could potentially make off with all their money and with more than enough information to steal their identity.

Some 80 percent of sites tested were found to be vulnerable to XSS (cross-site scripting) attacks.

Regardless of the specific vulnerability, the big, terrifying takeaway from the Positive Technologies report is simply this: Of the financial sites they tested, 100 percent of them were found to have vulnerabilities.

These are the people who are tasked with safeguarding your money, and they’re obviously not doing enough to keep their websites secure.

Firewalls and basic detection protocols are simply not enough. The hackers of the world have matured and gotten better at what they do, and security professionals simply haven’t been improving as quickly. This is the reason we’re seeing such a massive spike in high profile data breaches. The reason is that each year is a new, record-breaking year, beating out the one before, often by a wide margin.

Until that changes, everyone is at risk. Given how important the internet has become to international commerce and modern life, that’s simply unacceptable.

Major Server Ring Distributing Malware Taken Down

May 2, 2018 by Joseph Martin

Score one for the good guys. A researcher from BrilliantIT was recently able to figure out how infected computers would connect to EITest’s command and control server, and using that information, was able to bring down their entire network.

If you haven’t heard of EITest before, the true significance of that statement might not be registering.

EITest first appeared in 2011. In its original incarnation, it was little more than an annoyance. It was a collection of compromised servers used to direct web traffic to poisoned websites, where the owners could infect unsuspecting users with their homegrown malware.

In 2013, EITest’s owners got savvy, relentlessly grew their network to more than 52,000 compromised machines and started renting their network out to hackers around the world to drive traffic to their poisoned websites. This unleashed a torrent of wildly destructive malware. Ever since, it’s been a thorn in the side of IT professionals everywhere.

Using the crack discovered by BrilliantIT, researchers were able to redirect all traffic to a sinkhole, effectively shutting the network down altogether.

Since then, it appears that the hackers have made one halfhearted attempt to regain control of their network, and then apparently gave up on the idea.

While this is undeniably good news, EITest isn’t the only traffic distribution network on the Dark Web, and even if the hackers have given up on the idea of recovering access to their old network, there’s nothing stopping them from building a whole new one. That’s not to undercut the significance of the victory here, but rather, merely to point out that it’s a temporary win and reprieve, at best. They’ll be back. They always come back.

Good news is rare on the security front, and when it is found, we should all take a moment to celebrate. Kudos to the team at BrilliantIT!

Hacked Routers Being Used To Spread Malware

April 30, 2018 by Joseph Martin

Beware of compromised routers spreading malware. This is according to both Kaspersky Labs and a recently released government report.

Using hacked routers to spread malware is nothing new. Security insiders have known about it for years. However, since 2008, the number of instances where routers are being used to push malicious code has been steadily increasing. Researchers are observing marked increases in their use by APTs (Advanced Persistent Threat) around the world.

APTs are nothing new either, although their ranks have been growing in recent years. Many are state-sponsored hacking groups with virtually unlimited resources. Some are simply tight-knit groups of hackers banding together under a single banner.

Many people view hackers as lone wolves and that there are millions of lone wolves hacking networks across the globe. Increasingly though, these are becoming minor actors on the world stage. The real threat is now well-organized groups of hackers who can execute highly coordinated globe-spanning attacks and create botnets comprised of tens, or even hundreds of thousands, of compromised computers.

In addition to identifying and calling attention to a little-known attack vector, the recent announcement underscores an important weakness in current cybersecurity thinking. Most people are still laboring under the faulty assumption that they’re facing individual hackers operating out of a dark room in someone’s basement.

While those types of threats are no doubt present, it’s false to assume that’s where the biggest danger lies. If you get hacked, it’s just as likely (perhaps even more likely) that you’re actually facing a well-organized group who may have more resources at their disposal than your entire IT department. While you’re preparing to fight a skirmish, the barbarians are coming to your gates with an army. Most people are simply planning to fight the wrong type of battle, and that could prove to be a devastating mistake.

Panera Bread Customer Accounts Exposed To Threats

April 25, 2018 by Joseph Martin

Panera Bread company is the latest to find itself in hot water. Recently, security researcher Dylan Houlihan discovered that the company had failed to encrypt (or otherwise protect) a file containing usernames, email addresses, physical addresses, phone numbers and loyalty account numbers for a staggering thirty-seven million of its customers.

The file was found stored as plain text, and accessible to anyone who bothered to go looking for it. The good news is that no one appears to have absconded with the data, so odds are that even if you’re a Panera customer, you’re not at risk. The bad news is that Panera’s handling of the incident to this point has been dreadful, to say the least.

First, the company was slow to even acknowledge that there was a problem, and when they did, they attempted to downplay the number of users the oversight impacted. Second (the truly disturbing part of the ongoing story), even when the company did acknowledge the scope and scale of the incident, they left the plain text file on the website. It was completely unsecured until the security professional (Houlihan) contacted them a second time.

To date, their most detailed response has been that the investigation into the matter is ongoing.

There’s a harsh lesson here for any business owner. This is a textbook example of how not to respond to an incident like this. There are so many different things Panera could have done to make this a non-issue. The first of which would have been to immediately take the file down or secure it. Next, to immediately notify all the customers on the list (just in case the file had been downloaded by hackers). Lastly, issue a detailed action plan that assured customers that the company was taking steps to make sure something like this would happen in the future. Sadly, exactly none of that has happened.

No Spectre Fix For Certain Intel Processors

April 24, 2018 by Joseph Martin

The bad news just doesn’t seem to stop where Intel and the Speectre vulnerability are concerned. The latest bit of news comes directly from Intel, as the company admits that it’s just not possible to address the Spectre vulnerability in some of its older hardware. This means that nine families of chips and more than 230 models of computers (mostly manufactured between 2007 and 2011) will remain vulnerable to Spectre forever.

The company has stopped Spectre mitigation development on the following families of chips:

Bloomfield

Clarksfield

Gulftown

Harpertown Xeon

Jasper Forest

Penryn

SoFIA 3GR

Wolfdale

Yorkfield

A company spokesman had this to say about the recent announcement:

“We’ve now completed the release of microcode updates for Intel microprocessor products launched in the last 9+ years that required protection against the side-channel vulnerabilities discovered by Google. However, as indicated in our latest microcode revision guidance, we will not be providing updated microcode for a select number of older platforms for several reasons, including limited ecosystem support and customer feedback.”

It’s unfortunate, but not entirely unexpected. If you have any older Intel equipment still in service at your company, have your IT group check the processor family. If it’s one of the above, it’s well worth marking those systems high priorities for upgrades, and limiting their use until you can.

Spectre is a devastating flaw, and it’s just not worth the risk to leave exposed systems connected to your network and in service. This is especially true now that it’s official that no help is coming for certain older systems.

Even worse, AMD chips, which are not impacted by Spectre and Meltdown, have since been found to have their own critical security flaws. While not as bad or as pervasive as the two Intel is facing, they will nonetheless require the company to issue its own microcode updates, which they are currently scrambling to do.

The long and the short of it is that there really are no safe harbors anymore.