STE WILLIAMS

Pitney Bowes, the US stamping meter maker, has been infected with ransomware, leaving customers unable to top-up their equipment with credit nor access the corporate web store.

“At this time, the company has seen no evidence that customer or employee data has been improperly accessed,” it said in a statement today.

“Our technical team is working to restore the affected systems, and it is working closely with third-party consultants to address this matter. We are considering all options to expedite this process and we appreciate our customers’ patience as we work toward a resolution.”

Massachusetts city tells ransomware scumbags to RYUK off, our IT staff will handle this easily

READ MORE

Users of the manufacturer’s SendPro postage meter products will still be able to use their kit for US mailings if they have credits pre-loaded, but won’t be able to refill them once they run out, because account access has been locked down amid the malware intrusion. Using Sendpro to print delivery forms for shipments to the UK and Canada is not available for the moment.

The venerable franking business has been supplying postage charge and shipping label printers for over a century, and has millions of customers around the world. In the last decade it has been trying to reinvent itself as a global e-commerce enabler and shifting more of its business online. Today’s news won’t help that.

The quandary Pitney Bowes now finds itself in is to pay or not to pay – and that depends on the extent of the infection and the state of the IT department’s preparations. The FBI is now taking a softer line on paying off crooks who unleash file-scrambling extortionware on networks. Pitney Bowes will no doubt be keen to avoid the $300m loss made by shipping goliath Maersk when it was hit with the NotPetya ransomware. ®

Sponsored:
Technical Overview: Exasol Peek Under the Hood

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/10/14/pitney_bowes_ransomware/

Responding to concern that its Safari browser’s defense against malicious websites may reveal the IP addresses of some users’ devices to China-based Tencent, Apple insists that Safari doesn’t reveal a different bit of information, the webpages Safari users visit.

Apple may deny users in China VPN protection, it may deny Hong Kong democracy protesters an app used to avoid police, and it may remove references to Taiwan in localized versions of iOS 13 for the Chinese-controlled Hong Kong and Macau.

But it’s not giving up website visits – readily available to authorities by monitoring ISPs, DNS, and reportedly by backdooring Android apps [PDF] like the Communist Party of China’s “Study the Great Nation” – through browser telemetry.

Since February at least and perhaps longer, Safari’s Safe Browsing framework has been receiving hash prefixes of known malware sites from Google Safe Browsing database, or for users in mainland China, Tencent’s Safe Browsing database.

A 32-bit hash prefix like “ba7816bf” would represent the first eight characters of a 256-bit, 64-character SHA256 digest of a full URL.

Before it loads a requested website, Safari, like other browsers that implement a safe browsing lookup system, will hash the URL of the website to be visited and compare its hash prefix to the received hash segments of malicious sites.

In the event of a match – and there may be several given that hash prefixes aren’t necessarily unique, Safari asks the API provider – Google or Tencent – for all the URLs that match the hash prefix.

Using that fetched list, Safari can then determine whether the intended destination matches anything on the list of malicious websites and present a warning if necessary. And it will do so unless the on-by-default “Fraudulent Website Warning” is disabled using the appropriate iOS or macOS settings menu.

Nothing to see here

And this, Apple contends, is nothing to worry about. In a statement emailed to The Register (!), an Apple spokesperson said:

“Apple protects user privacy and safeguards your data with Safari Fraudulent Website Warning, a security feature that flags websites known to be malicious in nature,” it commented.

“When the feature is enabled, Safari checks the website URL against lists of known websites and displays a warning if the URL the user is visiting is suspected of fraudulent conduct like phishing. To accomplish this task, Safari receives a list of websites known to be malicious from Google, and for devices with their region code set to mainland China, it receives a list from Tencent.”

In a touching show of solidarity with the NBA and Blizzard, Apple completely caves to China on HK protest app

READ MORE

“The actual URL of a website you visit is never shared with a safe browsing provider and the feature can be turned off.”

That said, there’s still the issue of user IP addresses, which Tencent would see for those using devices with mainland China settings. That’s a privacy concern, but its one among many given that other Chinese internet companies – ISPs, app providers, cloud service providers, and the like – can be assumed to collect that information and provide it to the Chinese surveillance state on demand.

In a blog post on Sunday, Matthew Green, associate professor of computer science at the Johns Hopkins Information Security Institute, pointed out some potential privacy problems in safe browsing APIs like Google’s.

The privacy community, he said, has mostly come to terms with the privacy trade-off that comes with Google’s Safe Browsing API, figuring the security gains are worth the risk.

“But Tencent isn’t Google,” he said. “While they may be just as trustworthy, we deserve to be informed about this kind of change and to make choices about it. At very least, users should learn about these changes before Apple pushes the feature into production, and thus asks millions of their customers to trust them.” ®

Sponsored:
Technical Overview: Exasol Peek Under the Hood

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/10/14/apple_china_tencent/

It’s only Monday, and we already have a contender for the bug of the week.

Linux users who are able to run commands as other users, via the sudoer mechanism, though not as the all-powerful root user, can still run commands as root, thanks to a fascinating coding screw-up.

This security vulnerability, assigned CVE-2019-14287, is more interesting than scary: it requires a system to have a non-standard configuration. In other words, Linux computers are not vulnerable by default.

However, if you’ve set up Sudo in a rather imaginative way – letting users run commands as others except root – then you will probably will want to pay attention. Because your users can bypass that non-root restriction using -u#-1 on the command line.

The best way to describe the problem is to use an example. Let’s say you’ve set up the user bob as a sudoer on the server mybox so that they can run the text editor Vi as any user except root. You might trust bob to oversee the files and activities of other users, but they’re not allowed any superuser access.

Your sudoers file would have the line:

mybox bob = (ALL, !root) /usr/bin/vi

That should allow bob to run Vi as anyone but root. However, if bob runs this command:

sudo -u#-1 vi

That -u#-1 will bypass the above restriction, and run Vi as root for bob. Now bob can change any file on the system. Oops.

This happens because, say, -u#1234 can be used on the command line with Sudo to run the command, Vi in this case, as user ID 1234. This user ID value is passed to the setresuid and setreuid system calls by Sudo to change the effective user ID of the command.

Thus, -u#-1 passes -1 to those calls to change the effective ID to -1. However, these system calls treat -1 as a special case: it means do not change the user ID. And seeing as Sudo runs as root initially, -1 means continue running as root. So, in the above case, Vi runs as root. Also, amusingly, the user ID 4294967295 will bypass the restrictions because, as a signed 32-bit integer, it equals -1.

This programming gaffe was found and reported by Joe Vennix of Apple security, and fixed today in Sudo 1.8.28. Update your Linux systems as normal to pick up the patch: a fix was already available for your vulture’s preferred distro – Debian, naturally – while writing this piece.

If you’re interested, to plug the security hole, Sudo was tweaked to block -1 as a user ID. ®

Sponsored:
Technical Overview: Exasol Peek Under the Hood

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/10/14/linux_sudo_security_bug/

The feature, designed to block unauthorized changes to security features, is now generally available.

Microsoft today announced the general availability of tamper protection for Defender ATP customers, following a preview period among members of the Windows Insider community.

Temper protection is meant to block unauthorized changes to device security settings and help users mitigate malware and other threats that try to disable security features. Some of the services protected from these changes include cloud-delivered protection, behavior monitoring, security intelligence updates, IE Downloads and Outlook Express Attachments initiated (IOAV), and real-time protection, which is the core antimalware scanning component of Defender ATP.

Like other endpoint security settings, tamper protection can be deployed and managed via Microsoft Intune. Admins can enable the feature for specific device and user groups or for the entire organization. For this release, any changes to the tamper protection state may only be made through Intune and not through any other methods such as group policy, registry key, or WMI. 

When an admin enables a policy in Intune, the tamper protection policy is digitally signed on the back end before it’s delivered to endpoints. Each endpoint verifies the validity of the policy, ensuring it’s a signed package only personnel within Microsoft Intune have rights to control. If a third party tries to tamper with an endpoint, admins get an alert in Defender’s Security Center.

Home users will see tamper protection enabled by default. Microsoft is gradually enabling the feature, so some users will begin to see the new “tamper protection” setting on their devices.

Read more details here.

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/tamper-protection-arrives-for-microsoft-defender-atp/d/d-id/1336081?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The attack does not appear to have endangered customer data, but it has had an impact on orders for supplies and postage refills.

Pitney Bowes has been hit by a ransomware attack, according to a statement released today from the mailing services company. There is no evidence that any customer account data has been impacted, it says.

The company has released very few details about the attack, but says it is working with third-party consultants to perform forensics and remediation. Pitney Bowes pointed out in the release that its postage meter and SendPro products can be used safely, but that clients are unable to refill postage, upload transactions, order supplies, or manage their accounts. It does not believe clients are at risk. 

Read more here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/pitney-bowes-hit-by-ransomware/d/d-id/1336083?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Beijing likely saved a lot of time and billions of dollars by copying components for its C919 plane from others, a new report from CrowdStrike says.

When China’s domestically built C919 airplane becomes commercially available sometime in the next few years, many of the components in the plane will be based on designs and intellectual property that were likely copied from other manufacturers around the world.

That assessment from CrowdStrike is based on information pieced together from multiple recent US Department of Justice indictments and from the security vendor’s own tracking of Turbine Panda, a China government-backed cyber espionage group that has been targeting aerospace companies since 2010.

The narrow-body C919 twinjet airliner is China’s first homemade commercial jet and represents part of a broader “Made in China 2025” initiative that is designed to make the country self-reliant in several key industries. The plane completed its maiden voyage in 2017 and is expected to hit the market at about half the cost of competitive products from the Western aerospace duopoly of Boeing and Airbus.

At least some of that will be because Turbine Panda and several other operatives helped its manufacturer — the Commercial Aircraft Corporation of China (COMAC) and the Aviation Industry Corporation of China (AVIC) — cut corners.

China is not unique in targeting aerospace companies in the US and elsewhere. Adam Meyers, vice president of intelligence at CrowdStrike, says his firm is currently tracking 40 active threat groups targeting the sector including those from China, Russia, India, Iran, and North Korea.

“This is a complex problem,” to address he says. Campaigns involving theft of IP and trade secrets can involve cyber operations, human intelligence, and support from national level intelligence services. “There is no easy short answer,” Meyer says. “It needs to be addressed across public and private sector stakeholders.”

According to CrowdStrike, its own intelligence and information in US DOJ indictments against key Chinese operatives in 2017 and 2018 suggest that one area where China appears to have especially benefited from outside IP is the C919’s engine.

Soon after plans for the C919 were announced back in 2010, COMAC and AVIC were tasked with developing an indigenously built turbofan engine for the plane comparable to LEAP-X, an engine from GE Aviation and French aerospace company Safran. The resulting CJ-1000AX engine, which underwent formal tests last year, has multiple similarities to LEAP X, including in its dimensions and turbofan blades, CrowdStrike says.

“It is difficult to assess that the CJ-1000AX is a direct copy of the LEAP-X without direct access to technical engineering specifications,” CrowdStrike said in a report this week stitching together the DOJ information and its own research.  But it is “highly likely” that its makers benefited significantly from Turbine Panda’s cyber espionage efforts on behalf of the Jiangsu Bureau of China’s Ministry of State Security (MSS), the vendor said.

The information that Turbine Panda and others collected from companies that have technologies pertaining to the LEAP-X engine has helped China knock off years in development time, and potentially billions of dollars in research in developing the CJ-1000AX engine, according to CrowdStrike.

Signs of Turbine Panda Activity

Signs of Turbine Panda’s involvement go back to 2010 when China first announced plans for the C919 commercial jet. DOJ documents show soon after the announcement, Turbine Panda was involved in a cyberattack on Capstone Turbine, a Los Angeles-based gas turbine manufacturer. In a February 2014 blog, CrowdStrike then drew a connection between a Turbine Panda attack on French aerospace firm Safran and one against Capstone Turbine in 2012. The blog exposed some of Turbine Panda’s operations prompting the group to take evasive action, says Meyers.

Between 2010 and 2015 Turbine Panda and others working for the Jiangsu Bureau of the MSS targeted a variety of aerospace-related organizations. Among those targeted were Honeywell, Ametek, and Safran. In many of the attacks, the China-based cyber operatives used the PlugX, Winnti, and Sakula remote-access Trojans to try and steal from victims, CrowdStrike said.

In addition to the cyber efforts, Beijing operatives were engaged in a massive human intelligence (aka humint) campaign focused on stealing information that could help with the C919 project. While one arm of China’s intelligence apparatus identified key technology gaps in the C919 program, another focused on efforts to obtain those technologies via cyber and humint efforts, CrowdStrike said.

The human intelligence efforts included one by a now-indicted MSS intelligence officer to recruit an insider at LEAP-X manufacturer General Electric. The same officer also recruited a China-born US Army reservist who was an expert at assessing turbine engine schematics.

So far, at least four individuals have been arrested in connection with China’s campaign targeting aerospace companies. Among them is Xu Yanjun, the MSS officer who was allegedly in charge of recruiting insiders at targeted aerospace firms, and Yu Pingan, the developer of the Sakula RAT who was arrested while attending a security conference in the US. Yu’s arrest prompted the MSS to issue strict orders to security researchers in the country not to attend overseas conferences or Capture the Flag events, CrowdStrike reported.

Though Xu’s arrest in particular is likely especially significant, it is unlikely to deter China’s attempts to leap-frog development in technology areas the country perceives as being of strategic importance, CrowdStrike said.

Related Content:

• Public Exposure Does Little to Slow China-Based Thrip APT
• Chinese Group Built Advanced Trojan by Reverse Engineering NSA Attack Tool
• APT3 Threat Group a Contractor for Chinese Intelligence Agency
• 7 Signs of the Rising Threat of Magecart Attacks in 2019

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “A Murderers’ Row of Poisoning Attacks.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/cyber-theft-humint-helped-china-cut-corners-on-passenger-jet/d/d-id/1336082?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Sophos’ board of directors plans to unanimously recommend the offer to the company’s shareholders.

The endpoint security market today saw the start of another acquisition with private equity firm Thoma Bravo offering to acquire Sophos for $7.40 per share, or about $3.9 billion. Sophos’ board of directors plans to “unanimously recommend” the offer to its shareholders.

Thoma Bravo has more than $35 billion in investor commitments and has acquired more than 200 software and technology companies. In recent years it has tightened its focus on security with acquisitions of Barracuda, Veracode, Imperva, and LogRhythm. In 2017 it bought a minority stake in McAfee as part of its spinout from Intel and was rumored to buy the company. The private equity firm has also invested in Blue Coat, ConnectWise, Digicert, and Entrust.

Now it has eyes on UK-based endpoint security firm Sophos, which offers security tools for endpoint protection, managed services, firewall, and public cloud to a customer base of 400,000 businesses. Its recent acquisitions include Rook Security, DarkBytes, and Avid Secure.

Thoma Bravo approached Sophos in June, and the two companies have been in talks since, Sophos CEO Kris Hagerman said in an interview with Dark Reading. If all goes as planned, the acquisition should be complete and the deal closed sometime in the first quarter of 2020.

“We feel that given Thoma Bravo’s track record in cybersecurity, and experience and knowledge in that space, they’re in a great position to accelerate Sophos’ leadership in next-gen endpoint security,” Hagerman says. “I think in many ways we see this as an exciting validation of Sophos’ strategy, our position in the market, and our future opportunity.”

The Endpoint Evolution

The Sophos acquisition is one of many transactions affecting the endpoint security market, which is undergoing transformative change as its many players begin to consolidate. “There are probably too many vendors coming at this market in different ways, so a degree of simplification is in order,” says Rik Turner, principal analyst at Ovum, of the ongoing shift.

Among some of the notable endpoint deals thus far are VMware’s acquisition of Carbon Black, Blackberry’s purchase of Cylance, and HP’s acquisition of Bromium, for example.

Sophos, to its credit, has at least sought to break out of endpoint into other offerings, Turner notes. Its portfolio includes network security and cloud security tools. It does not need this acquisition to survive, Turner points out, but to prosper. Sophos has been stuck without massive visibility compared with its competitors in the endpoint security market likely because it never had a consumer business, for one, and it started as a UK company, Turner explains.

Is this a sign of endpoint consolidation? Potentially, he says, if Sophos is merged into another endpoint outfit. However, it now seems the company is going private to accelerate. Private equity firms are taking businesses private to grow and potentially go public again in the future.

“There’s a big shift going on in the cybersecurity market,” says Hagerman, as customers shift to cloud-enabled products and the next wave of advanced threats. He believes the market is seeing a greater gap between companies focused on new tech, and those falling behind.

“My view is that what you’re seeing is a further separation of the companies who are embracing and driving that shift to next-gen cybersecurity,” he explains, noting how this acquisition could enable Sophos to remain competitive moving forward.

Related Content:

• 8 Ways Businesses Unknowingly Help Hackers
  
• When Using Cloud, Paranoia Can Pay Off
• 7 SMB Security Tips That Will Keep Your Company Safe
• Close the Gap Between Cyber-Risk and Business Risk

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/endpoint/sophos-for-sale-thoma-bravo-offers-$39b/d/d-id/1336084?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A hacker has stepped through a hole in vBulletin web software to steal all email addresses from a Dutch website for prostitution and escort customers and for sex workers themselves, Hookers.nl.

According to local news outlet NOS, the total number of accounts whose email addresses were exposed is 250,000. Besides the email addresses, the hacker also got at user names, IP addresses and passwords, NOS reports.

The passwords are reportedly encrypted. We don’t have details of exactly how they’re encrypted, but as we reported in June, vBulletin is one of the content management systems (CMSes) that are properly securing passwords. That means that it’s doing hashing right – hashing being one part of the encrypting/hashing/salting recipe for securing passwords – by using bcrypt, a password hashing function that’s resistant to GPU-based parallel computing cracks.

(Here’s a primer on how to securely store users’ passwords that delves into the details.)

On Thursday, the site’s main moderator announced the breach and advised users to change their login details, in spite of passwords apparently not being affected.

According to the notification, Hookers.nl found out about the breach from its external software supplier, vBulletin, which reported that a software error was discovered in its software that gave access to the site’s database.

Hookers.nl said that vBulletin took action “as quickly as possible,” releasing a software patch that the site tested and promptly implemented.

The Hookers.nl moderator said that the hacker has put the email addresses up for sale online. NOS said that they’re asking $300.

Visitors to Hookers.nl swap experiences and tips on the site. Prostitution is legal, and heavily regulated, in the Netherlands. But that doesn’t mean that visitors to Hookers.nl want their association with the industry to be publicly broadcast, be they sex workers or clients.

Although many, if not most, Hookers.nl users avoid using their main email address on the site, instead using an alias email account in order to keep their visits private, NOS has viewed a sample of the data up for sale and says that many forum members use an email address from which their real name can be derived. As well, IP addresses can be used to indicate at least rough geographic location of users.

Ashley Madison all over again

One of the main risks of the breach is that forum visitors may be blackmailed, be they prostitutes, escorts, or clientele whose partners are unaware of their activity.

If Ashley Madison’s breach is any indication, blackmail attempts or public shaming could result from the Hookers.nl breach. That’s what happened after the adulterer hook up site was breached in 2015, with the subsequent exposure of names, email addresses and sexual fantasies of nearly 40 million users.

The fallout was nasty and prolonged as the culprits kept turning the screws on victims it dismissed as “cheating dirtbags.” Unsurprisingly, extortion attempts followed, as did at least one suicide confirmed as being linked to the breach.

NOS talked to Arda Gerkens, of Helpwanted.nl, which assists young victims of sex-related abuse:

Membership in such a forum is certainly something that can be extorted with. Some people are not secretive about their prostitution visit, but it is certainly when people use a nickname that they want to remain anonymous.

NOS, which broke this story, talked to the hacker. They hadn’t sold the stolen data yet, but they said they were sure that it wouldn’t be hard to do:

Certainly people want to buy it, bro.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ohkoUzZ8kvQ/

Old passwords never die – they just become easier to decode. That’s the message from a tight-knit community of tech history enthusiasts who have been diligently cracking the passwords used by some of the original Unix engineers four decades ago.

On 3 October, an enthusiast on the Unix Heritage Society mailing list asked a question about cracking passwords stored in old Unix systems. The source code for various revisions of Unix from the seventies onward is available online for anyone to download, and these revisions store the passwords for various staff members in the etc/passwd file.

Unix hashed these passwords by running them through an algorithm called descrypt (also known as crypt(3)), which used the original DES encryption algorithm and limited the password length to eight characters. This was good enough to stop people recovering the password from the original hashes at the time, but 40 years on, computers are a little bit faster.

Developer Leah Neukirchen replied that she’d cracked several of them contained in a version of the BSD operating system from January 1980. However, she still hadn’t managed to crack Ken Thompson’s password. Thompson is one of the fathers of Unix. His original work on its predecessor Multics formed the basis for much of the operating system.

Neukirchen complained:

I never managed to crack Ken’s password with the hash ZghOT0eRm4U9s, and I think I enumerated the whole 8 letter lowercase + special symbols key space.

Thompson, who now works at Google where he developed the Go programming language, also worked on early chess programs including a VAX PDP-11 program called Belle. Perhaps his password should come as no surprise, then. Forum contributor Nigel Williams posted on 8 October that he’d finally cracked it:

ken is done:

ZghOT0eRm4U9s:p/q2-q4!

The hash is the part before the colon, and the plaintext is the part afterwards. q2-q4 is a description of an opening chess move in descriptive notation. Thompson shot back a quick message:

Congrats.

Cracking the password took at least four days on an AMD Radeon Vega64, according to Williams, who administers a retro computing website in Tasmania. He was running the popular password cracking program hashcat.

Thompson’s password might have been short, but it was sneaky, not using obvious things like dictionary words or keys that were sequential on the keyboard (hint: never use the password ‘qwerty’). Other passwords cracked by these enthusiasts showed that many early engineers preferred convenience over security. Some examples that Neukirchen had cracked years ago include:

• Stephen Bourne, creator of the bourne command line shell often used to control Unix:

bourne (cue jokes about the Bourne Identity)

• Eric Schmidt, software engineer and now executive chair of Alphabet:

wendy!!! (this is his wife’s name).

• Canadian computer scientist and Unix contributor Brian Kernighan:

/.,/., (this is the easiest thing to type on a keyboard, as the three characters are next to each other).

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/_6ksZGv5hWM/

The tiny ATtiny85 chip doesn’t look like the next big cyberthreat facing the world, but sneaking one on to a firewall motherboard would be bad news for security were it to happen.

In fact, this has already happened as part of a project by researcher Monta Elkins, designed to prove that this sort of high-end hardware hack is no longer the preserve of nation-states.

Elkins soldered the 5mm x 5mm ATtiny85 chip from an Arduino board to his test firewall’s circuit board just in front of the system’s serial port.

After reading his account of the proof of concept in Wired, it’s not hard to grasp why soldering tiny chips to circuit boards is a threat – they’re impossible to see let alone detect once they’re installed inside equipment.

The proof of concept is also cheap, requiring little more than some knowhow, access to the supply chain of current products, and a few hundred dollars for parts.

Rumours of secret chips, or secret interfaces on legitimate chips, have long been the stuff of legend, but the implication of Elkin’s work is that anyone could now do this.

The admin will serial you now

The hack that can be achieved by Elkin’s chip is simple but powerful.  When the firewall boots up:

It impersonates a security administrator accessing the configurations of the firewall by connecting their computer directly to that port. Then the chip triggers the firewall’s password recovery feature, creating a new admin account and gaining access to the firewall’s settings.

With that level of access, a firewall would be putty in the paws of an attacker, who could configure it to allow remote access or disable security.

Even it that access was detected, the fact it depends on hardware might make it impossible to get rid of short of disabling the serial port or removing the chip itself.

It’s not a kind of attack that would scale well, requiring hackers to physically solder chips to boards for every compromised device they wanted to subvert.

Then again, one firewall – the right firewall – is all it would take to aid a major network incursion.

Supermicro

As Wired reminds us, the story echoes Bloomberg’s allegation last year that the Chinese Government had inserted spying chips inside equipment made by Supermicro.

No evidence has yet been found to stand up Bloomberg’s claim, but it did at least underline the possibility that someone might try to do such a thing.

Elkins, meanwhile, will give more detail on his POC at this month’s CS3sthlm conference.

Is it likely that the average firewall has an Elkins-style spy chip in it? Almost certainly not, mainly because there are so many other easier ways to compromise equipment, for example by exploiting misconfiguration, software vulnerability, or using credential theft.

But if that possibility comes to pass, stopping it won’t be easy, requiring as-yet-to-be invented hardware authentication at firmware level.

Just what admins need – another layer of security to watch over.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/I8hFrWixXu4/