STE WILLIAMS

Records on more than 20 million individuals in Ecuador have leaked from an unsecured database in Miami, Florida, containing a mix of official citizen registration data and personal banking details.

The data is reported to contain “a large amount of sensitive, personally identifiable information at the individual level”, according to a research team at VPN comparison site vpnMentor, led by noted infosec bods Noam Rotem and Ran Locar.

Although the server appears to be owned by Ecuadorian consulting company Novaestrat, the leak is described as containing what look like Ecuadorian government entries, vehicle information from an automotive association and data relating to Ecuadorian national bank Bless (El Banco del Instituto Ecuatoriano de Seguridad Social).

Rotem and Locar’s team found they could look up a random 10-digit number to emulate an Ecuador citizen national ID number, and obtain a personal record containing such information as name, date of birth, addresses, phone numbers, level of education, gender and marital status.

Bless data included account status, current balances, branch contact and credit financing details.

We were planning on making a joke along the lines of “What a shame the Ecuadorian government didn’t have any in-house embassy staff on hand with experience in dealing with data leaks”, but we were beaten to it by the oopsie itself. If you want to know what one of the leaked records looks like, here’s part of Julian Assange’s:

Click to enlarge

The Register is unable to contact Julian Assange and ask him what he thinks about this because he is currently a Category B prisoner at Her Majesty’s Prison Belmarsh, London, until his extradition battle with the US gets started.

Another head-scratcher is how the 18GB database can leak records on 20 million Ecuador citizens when only 17.4m Ecuadorians actually exist. On this, vpnMentor is a little vague: “Some of the data seems to involve individuals who are already deceased.”

This explanation hints that the data is several years out of date: at least, 15 per cent of Ecuadorians probably don’t snuff it annually with no new blood to replace them. Another possibility is that the leaked data contains a large number of duplicates, although how many vpnMentor does not say.

Also unclear is whether or not the leaked records have been misused. “The highest profile data breaches in the last couple of years have been from misconfigured cloud storage,” said Tim Erlin, VP, product management and strategy at Tripwire. “These are not generally targeted attacks, but opportunistic, and exposing data doesn’t necessarily mean that it was compromised.”

Hugo van den Toorn, manager offensive security at Outpost24, mused: “This is a typical example of a misconfigured system. It should have never been possible for anyone on the Internet, especially without authentication, to access the data stored in the database.”

The hole was closed on 11 September. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/16/ecuador_big_old_data_leak_includes_assange/

Lazarus Group, Bluenoroff, and Andariel were named and sanctioned by the US Treasury for ongoing attacks on financial systems.

Today, three North Korean state-sponsored malicious cyber groups were sanctioned by the U.S. government for their role in North Korea’s malicious cyber activity on critical infrastructure. Lazarus Group, Bluenoroff, and Andariel were identified as “agencies, instrumentalities, or controlled entities of the Government of North Korea” by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) in documents announcing the sanctions.

The announcement of sanctions includes specific campaigns, attacks, and actions that the U.S. government has attributed to the three groups. According to Dmitri Alperovitch, CrowdStrike CTO and co-founder, “This is yet another indication of how forward-leaning US government’s position has become in a relatively short period of time on doing attribution of malevolent cyber actors. A few years ago, this type of action would have been unprecedented.”

According the Department of the Treasury, the groups have targeted financial systems, financial institutions, and government agencies in their campaigns. The activities have largely been responsible for hard currency returns to North Korea’s government. John Hultquist, director, intelligence analysis for FireEye says, “The sheer scale [of the campaigns] suggests that they are a financial lifeline for a regime that has long depended on illicit activities to fund itself. It’s important to remember that this activity appears to be very lucrative, and the choice for the cash-strapped regime to give it up will be a hard one.”

For more, read here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Escaping Email: Unlocking Message Security for SMS, WhatsApp.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/us-sanctions-3-cyberattack-groups-tied-to-dprk/d/d-id/1335805?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The safety of our digital lives is at stake, and we need to all do our part in raising awareness of these issues.

June — Post-Traumatic Stress Disorder (PTSD) Awareness Month — has come and gone, but mental health is a topic that needs to be continuously talked about throughout the year. The condition is often associated by the public with veterans and first responders, but it can afflict someone from any walk of life.

PTSD can occur when someone experiences or witnesses a traumatic event, and its symptoms include acute anxiety, flashbacks, and intrusive thoughts. This condition isn’t always understood properly by the medical community or general population, and it is important to raise awareness about the issues that individuals face when struggling with PTSD. Throughout the entire year, we need to help raise awareness about the many different forms of the disorder and help seek treatment options for those affected.

Cybersecurity PTSD and Burnout
While not as serious as PTSD for the likes of veterans recovering from war, cybersecurity professionals can face a different type of PTSD. Many are firsthand witnesses to cyberattacks that leave lasting damage to the organizations they help protect and can carry over into their work in the future as a reminder of the worst that can happen. Panic can set in when security pros see signs that remind them of past incidents. It’s’s best to deal with these issues and stress before they become lasting problems that keep them from doing their best work.

Cybersecurity burnout and job fatigue are both a reality, and they are a growing, troubling problem that our industry faces on a daily basis. When compounded with the current cybersecurity skills shortage and the constantly growing threat landscape, burnout is amplified.

As the CEO of a major cybersecurity organization myself, it’s important for me to face these issues head-on by creating a culture of individual well-being and self-care. It’s imperative to have a close relationship with my team members to help evaluate their state of mind and provide them with support. Support must come from many different areas, such as implementing counseling and stress-relief programs.

Organizational leadership starts with the CEO, and it is my goal to consistently show team members that we care about them and empathize with their daily struggles by constantly making an effort to invest in their well-being. This doesn’t always need to come in the form of hands-on training and team building; it sometimes can mean simply listening to the team members to make sure they understand that their contribution is valued and that their work has a purpose.

Cybersecurity Mental Health
Possible issues like depression and anxiety aren’t new in cybersecurity, and stress is often rampant. Infosec professionals work long hours and are under constant pressure to protect critical networks from the latest in digital threats.          

As the pace of cybercrime continues to grow, demand is outpacing the supply of security professionals who can help combat the ever-increasing threats. Cybersecurity Ventures estimates the total of unfilled security jobs will reach 3.5 million by 2021. With these global staffing shortages, some departments may only have 10 staffers when the number to adequately do their jobs should really be teams of 15 or 20, directly leading to increased stress levels.

The Effect on Us
The skill shortages represent a widespread threat to the security of all of us. Not having enough trained workers for the organizations that we trust to protect our data leaves us all vulnerable in one way or another. Furthermore, the organizations that are adequately equipped with enough cybersecurity professionals tend to still be overworked, highly stressed, and prone to burnout.

Anecdotal evidence also suggests a high prevalence of mental health concerns in the cybersecurity community, perhaps heightened by the hacker subculture attracting people from a variety of backgrounds, some of which may involve pre-existing mental health conditions.

This topic is extremely personal to me as well. As a teenager, my son suffered a horrific event that left him struggling with PTSD for two years. I saw the effects PTSD had not just on my son but his friends and family, including myself. PTSD is very real with the impacts reaching far and wide. With treatment there is hope, and with compassion and understanding we can help someone affected by PTSD get on a path to recovery.

What to Do Next
Burnout in cybersecurity will likely never completely go away, but it’s currently causing our industry to lose out on too many hardworking professionals. Thankfully, by becoming more cognizant of the mental health struggles the industry faces, and with a little more attention to detail, we’ll fight back against burnout. Please join me in talking to cybersecurity professionals, whether you are a CEO of a leading organization or simply a friend or family member of someone who works in the industry. The safety of our digital lives is at stake, and we all need to do our part in raising awareness of these issues.

If you or someone you know needs help, contact ADAA, a nonprofit national organization committed to the prevention, treatment, and cure of anxiety and mood disorders, including PTSD.

Related Content:

• The State of IT Operations and Cybersecurity Operations
• Security Spills: 9 Problems Causing the Most Stress
• Why Cybersecurity Burnout Is Real (and What to Do About It)
• To Improve Security, We Must Focus on Its People
• CISO Pressures: Why the Role Stinks and How to Fix It

 

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Escaping Email: Unlocking Message Security for SMS, WhatsApp.”

Craig Hinkley joined WhiteHat Security as CEO in early 2015, bringing more than 20 years of executive leadership in the technology sector to this role. Craig is driving a customer-centric focus throughout the company and has broadened WhiteHat’s global brand and visibility … View Full Bio

Article source: https://www.darkreading.com/risk/preventing-ptsd-and-burnout-for-cybersecurity-professionals/a/d-id/1335750?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

An unsecured database containing 18GB of data exposed more than 20 million records, most of which held details about Ecuadorian citizens.

Researchers have discovered a misconfigured database containing 18GB of information, including 20.8 million personal records. Most of the individuals affected are in Ecuador, which to put the leak into context, has a population of only 16.6 million; 6.7 million are children.

The difference between the number of records and Ecuador’s population can be attributed to duplicate and older information, which includes data of deceased individuals. Noam Rotem and Ran Locar, both researchers with vpnMentor, discovered the unprotected database on an Elasticsearch server, which appear to be owned by Ecuadorian consulting company Novaestrat.

It seems the database held information pulled from outside sources including Ecuadorian government registries, the Aeade automotive association, and the Biess Ecuadorian bank. Data taken from both public sources and private databases was collected in the unsecured database.

Researchers unearthed a range of personal data belonging to Ecuadorian citizens: full name, gender, birthdate, place of birth, home and email address, phone numbers (work, home, and mobile), marital status, level of education, date of marriage, and date of death, if applicable. Individuals are identified by a ten-digit national identification number called a “cédula.”

An investigation to validate the data led researchers to financial data linked to accounts held with Biess, including account status, balance, credit type, amount financed, and the location and contact information for the person’s local Biess branch, vpnMentor explains in a blog post.

What the team found particularly concerning is the extent of detailed family information stored in the database. Researchers were able to view the full names of the mother, father, and spouse, as well as the cédula for each person. They found 6.7 million entries for children under the age of 18, including name, cédula, place of birth, gender, and home address, ZDNet reports.

Further, the leak exposed detailed employment data: employer name and location, employer tax identification number, job title, salary information, and the start and end dates for each position. Researchers also found automotive records that could be linked to car owners through their taxpayer ID number; leaked data includes the car’s make, model, license plate number, date of purchase, most recent registration date, and other technical data about the car.

Companies Exposed, Too

On top of the troves of personal data exposed, the leak compromised potentially sensitive information belonging to Ecuadorian companies. Researchers were able to view many businesses’ Ecuadorian taxpayer identification number, address, and contact details, as well as each firm’s legal representative and their contact information.

VpnMentor and security industry experts worry about the long-term privacy implications for those affected by the incident. As the team points out, the personally identifiable information compromised in this leak could put people at risk of phishing attacks and phone scams; the extent of data exposed could put organizations at risk of corporate espionage or fraud.

While the industry is no stranger to cloud mishaps and data leaks, some are concerned about the extent of records compromised. As Javvak Malik, security awareness advocate at KnowBe4, points out, this is another in “a very long list” of cloud-based databases leaking information.

“But this is particularly significant due to the number of records and the sensitivity of the data,” he adds. “Most troubling perhaps being the data of children being stolen,” which can be used to set up fake identities or take out loans. Before creating such large databases, he says, companies and governments should ask whether such a collection is necessary or legal. They should determine if they can properly secure it and assess the impact of a potential leak.

Related Content:

• 7 Steps to Web App Security
• Escaping Email: Unlocking Message Security for SMS, WhatsApp
• 6 Questions to Ask Once You’ve Learned of a Breach
• Security Leaders Share Tips for Boardroom Chats

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Escaping Email: Unlocking Message Security for SMS, WhatsApp.”

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/cloud/data-leak-affects-most-of-ecuadors-population/d/d-id/1335814?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

US appeals court said a company can legally use publicly available LinkedIn account information.

If you make data public online, can someone be prevented from using it? HiQ Labs (a data analytics company) said “no,” LinkedIn said “yes,” and now a federal court has agreed with HiQ in the latest courtroom round of a case that could have significant implications for securing enterprise data.

HiQ Labs scrapes information from LinkedIn profiles that users have set to be viewable to the Internet at large. It then combines that data with public data gleaned from other websites, and sells the results to employers looking for more insight into potential employees.

LinkedIn reportedly at first appeared to have no problem with the practice, but after launching its own somewhat similar service, served HiQ with a cease-and-desist letter which the smaller company has fought.

According to a report by Vice LinkedIn claimed that access to this public data violated the Computer Fraud and Abuse Act (CFAA). The Ninth Federal Circuit Court of Appeals ruled that, because the data belongs to the individual LinkedIn user and those users obviously intended it to be widely available, HiQ is breaking no laws in finding and using the data.

At its heart, the legal issue is over the definition of “authorized use” of data — something that security professionals must consider in many cases of deciding whether legal remedies can be sought for individuals and companies accessing data that is available through a Web interface. LinkedIn is likely to appeal this verdict.

For more, read here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/court-rules-in-favor-of-firm-scraping-public-data/d/d-id/1335815?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

More than a compliance mandate, privacy impact assessments can also spot risks early in the product development cycle.

Privacy impact assessments (PIAs) purport to examine privacy protections, but they serendipitously turn up deeper insights into an organization’s risk exposure, improving governance and the organization’s overall security posture, experts say.

More than a diagnostic tool or compliance checklist, PIAs are essentially templated questionnaires that help organizations identify their privacy risks are with information they collect, use, or store, says Rebecca Herold, CEO of the Privacy Professor, a security consultancy. PIA templates typically have some combination of multiple choice and open-ended questions. While often administered quarterly, PIAs can be done more frequently or after a breach or suspicious incident.

But mostly, PIAs help expose potential privacy issues that may get overlooked in the rush to market. Herold recalls an organization she worked with that developed a saliva test to detect concussions. Unlike doctors and hospitals that are subject to federal privacy protections, this organization was HIPAA-exempt and hadn’t really thought through the ramifications of the data it wanted to collect. 

Not surprisingly, consumers became concerned about who’d be able to access the saliva test results. “The original intent was good, but it was unclear who was getting the data – colleges, employers, insurance companies,” Herold explains.

PIAs help ensure such concerns, and vulnerabilities get addressed sooner in the product development cycle. And with technologies like artificial intelligence and the Internet of Things in ascendance – and the market pressure to roll out products before they’ve been fully vetted – PIAs can smooth the introduction of that teddy bear with the camera in it, for example.

In that respect, PIAs not only offer a clearer view of where privacy risks are, but they also help organizations understand how personal information they collect is being used or transmitted, as well as where potential vulnerabilities are, Herold explains. And all that is enormously helpful as organizations measure their risks, then move to mitigate them, she adds.

Some industry sectors require regular PIAs. All federal agencies, for example, must perform annual PIAs for their systems, which are then posted online. At the invitation of the National Institute of Standards and Technology (NIST), Herold herself performed a PIA on the agency’s plan for smart grids in 2009. 

The EU’s General Data Protection Regulation (GDPR) also has a provision for something called a data protection impact assessment (DPIA), which is a type of PIA, Herold says. And any organization with access to personal data of EU citizens is legally required to perform a DPIA.

In addition to demonstrating an organization’s due diligence, PIAs can be a market differentiator in highly competitive fields, Herold explains. “I wish more application and device companies would do PIAs right at the start of their engineering plans because it would eliminate and mitigate many problems we have with privacy breaches,” she says.

Medical device manufacturers, in particular, get hyper-focused on a device’s basic functionality. “I’m always trying to get them to realize they need to go beyond getting it to work consistently,” Herold says.

Another sector with ongoing security challenges is education. School environments are historically hard to secure because they’re open areas, Herold says. And laptops that monitor students are just the tip of the privacy iceberg. “More educators are addressing privacy because there are so many gadgets that tech companies want to provide schools,” she adds.

Factor in cloud-based learning apps, the proliferation of student smartphones, and social networks, and you have a privacy quagmire. 

“Any process that’s completely automated and had no human intervention is going to have some pieces missing with regard to privacy,” Herold says. “You need critical thinking,” and PIAs help encourage that objective analysis.

Related Content:

• To Manage Security Risk, Manage Data First
• Privacy 2019: We’re Not Ready
• Unmixed Messages: Bringing Security Privacy Awareness Together
• Privacy: The Dark Side of the Internet of Things

 

Terry Sweeney is a Los Angeles-based writer and editor who has covered technology, networking, and security for more than 20 years. He was part of the team that started Dark Reading and has been a contributor to The Washington Post, Crain’s New York Business, Red Herring, … View Full Bio

Article source: https://www.darkreading.com/edge/theedge/how-a-pia-can-cya/b/d-id/1335807?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The Republic of the Marshall Islands (RMI) is forging ahead with its plans to issue a blockchain-based, national currency – the Marshallese sovereign (SOV). This is in spite of naysayers (including the US government) predicting that it will be unstable, and/or will crash the local telecom system of this tiny Pacific island nation, and/or that it will be used for money laundering and/or to fund terrorism.

On Wednesday, the digital currency project announced at Coindesk’s Invest: Asia cryptocurrency conference in Singapore that the plan is to do a token pre-sale: it will introduce the SOV through a sale over an extended period of time in what’s being called a Timed Release Monetary Issuance (TRMI).

Once the currency is officially launched – within an estimated 18 to 24 months – the units sold during the pre-sale can be exchanged for SOVs.

Also on Wednesday, Coindesk published a post written by David Paul, the minister in-assistance to the president and environment of the Marshall Islands. Paul said in the post that the currency will be based on blockchain technology, that its growth will be “predetermined and tamper proof,” and that compliance will be “baked into the currency protocol itself,” while maintaining privacy for individuals.

Anyone, regardless of location, can register for the pre-sale on the newly launched website of the SOV Development Foundation: a nonprofit set up to oversee the country’s national digital currency.

So how is a TRMI different from the unregulated fundraising technique with a dodgy reputation called an initial coin offering (ICO)?

ICOs are used by blockchain companies where cyptocurrencies like Bitcoin and Ethereum are used to purchase “tokens” from a startup: if the company takes off, they’ll theoretically be worth something. If not, then you get something along the lines of exit-scamming Prodeum, the fruit and vegetable tracking blockchain figment of some swindler’s imagination that left us with nothing but the word “penis” on its site.

No, RMI has no intention of leaving you stuck with an eggplant, Paul said. He told Coindesk that a primary reason for doing the pre-sale is to get a sense of the levels of liquidity and market interest in the SOV cryptocurrency:

TRMI is really another way of doing an [ICO] but in a more responsible and methodical manner. That’s really the TRMI. You have to look at how to establish liquidity. When you do TRMI, you’re looking at the appetite for the product and how it’s going to [behave] in the markets.

The SOV is a blockchain-based cryptocurrency that will be circulated and operated by the RMI government and will be used as a medium-of-exchange along with the US dollar.

But why?

Imagine for a moment that you’re in the government of a tiny island nation.

With 29 coral atolls comprising 1,156 individual islands and islets and peopled by something like 53,158 inhabitants, you’re facing a number of worries: rising seas due to global warming, being cut off from the rest of the world financially, facing the pullout of the only bank that still cashes your people’s paychecks or conducts international money transfers, and a population that’s been poisoned by fallout from 67 US nuclear tests.

That’s The Marshall Islands, and it’s why, in 2018, it voted to stop begging for foreign aid by launching its own cryptocurrency.

As Bloomberg tells it, the US Treasury was not pleased, and its leaders didn’t mince words.

“I don’t like it. I will never support it,” Treasury Assistant Secretary for Terrorist Financing Marshall Billingslea reportedly said when he kicked off a meeting with Marshallese representatives who’d traveled to Washington for the 2018 annual meeting of the International Monetary Fund and the World Bank.

The concerns of the US, along with the international banking community: What if the price of the SOV, issued by the RMI government and built on a specially developed blockchain – is so volatile that it makes it impossible to use in the real world?

What if it crashes the local telecom system – one that already suffers frequent outages?

What if it’s used for money laundering or to finance terrorism? The RMI is already seen as an iffy place by the US Department of State, which deemed it a Jurisdiction of Concern in its 2016 International Narcotics Control Strategy Report (INCSR). The report found that in spite of a low rate of domestic crime, “suspicious transaction reports” suggest “tax evasion, smuggling, prostitution, embezzlement, counterfeit financial instruments, check fraud, and narcotics trafficking on the islands could be predicate offenses for money laundering.”

That, in fact, is why First Hawaiian Bank told The Marshall Islands that it was going to close down services: because of a stricter regulatory environment, due diligence has been heightened on customers, and that makes compliance procedures more costly: costly enough that maintaining a correspondent banking relationship (CBR) isn’t worth it. Around the world, CBRs are similarly being withdrawn, especially in the Caribbean, Middle East and North Africa. First Hawaiian has reportedly said that it would wait until RMI has another CBR set up, though it hasn’t welcomed the notion of the SOV as a sensible way forward for the nation.

Saved by blockchain

Paul said in his essay that blockchain has “opened up a world of opportunity” for small nations such as RMI.

Relying on traditional fiat currency, the Marshall Islands has only fragile links to the wider world of international finance, and compliance is extremely resource intensive. Many of our citizens send or receive money using remittance services, paying fees of up to 10% per transaction. Even simple things like acquiring and installing ATMs become complicated when you’re in the middle of the Pacific Ocean!

This move is going to save the nation all sorts of expense, he said. Not only are blockchain transactions “fast, simple, and cheap,” the only infrastructure needed is the network itself. There’s no need to create a central bank, and no need to print and process real money.

It’s also going to save on the burden of compliance, he said, enabling the RMI to actually contribute to the fight against money laundering and terrorism financing:

Post 9/11, money laundering and financing of terrorism are major threats that the global community is fighting together. But without our own currency, and beholden to existing systems, it is hard for us to contribute much to this fight beyond basic compliance. With a digital currency based on blockchain, we can automate much of the compliance burden and take a proactive role on the international stage.

Paul said that the SOV will close down the “loopholes” that terrorists and crooks are now exploiting:

Every individual using SOV must be identified by an approved verifier of their choice, such as a bank or an exchange. This will close the secrecy and anonymity loopholes exploited by criminals and terrorists.

…while still maintaining privacy of individual users, he emphasized:

It is crucial that individual users should have a reasonable expectation of privacy – specifically, the ability to choose when to disclose your information, what exactly to share, and with whom. We are committed to providing this privacy with SOV.

Welcome to the blockchain club

The RMI’s SOV plan is just one of a slew of other digital currencies that are in the works. In June 2019, Facebook announced its own Libra cryptocurrency, for one.

China’s central bank is also gearing up to launch a state-backed cryptocurrency in the coming months – one that it’s reportedly going to issue to Alibaba, Tencent and a handful of other financial giants and financial technology players.

Even Bank of England governor Mark Carney recently suggested that the US dollar could be swapped out by a global digital alternative, saying that its dominance has resulted in a savings glut, with a decade of low inflation and ultra-low interest rates.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/LvYhpd-UdBw/

The shadowy world of phone-surveillance-for-hire became a little clearer last week following the discovery of a phone exploit called Simjacker.

The exploit, discovered by mobile carrier security company ActiveMobile Security, allows attackers to remotely exploit a phone simply by sending a text message. From the report:

The main Simjacker attack involves an SMS containing a specific type of spyware-like code being sent to a mobile phone, which then instructs the SIM Card within the phone to ‘take over’ the mobile phone to retrieve and perform sensitive commands.

The message won’t even display to the user, it said. Furthermore, because the attack is independent of phone brand, around a billion phone users are vulnerable.

AdaptiveMobile Security found people using the exploit, which researchers speculated about as far back as 2011. In a report on the technology, the company said:

We believe this vulnerability has been exploited for at least the last two years by a highly sophisticated attacker group.

The attack works using a legacy browser technology embedded in the SIM card on many mobile phones. Called the S@T Browser, it is normally used for browsing through the phone’s SIM card, but it can also receive specially crafted messages sent by the carrier network. These are not regular messages; they’re binary code, used to process special instructions.

The browser was normally used to send things like promotional messages but the attackers used it to process invisible requests for the phone’s location data and its International Mobile Equipment Identity (IMEI), which is an ID unique to every mobile phone. They’d send a message to the S@T browser asking it for this information, which it would then retrieve and store on the SIM card. The attacker could then retrieve it by sending another message.

The S@T browser is a great tool for attacking a phone via SMS message because the specially crafted messages it receives don’t alert the user in any way. The request, and the phone’s response, is silent. This means attackers can use it to spy on a phone’s user by sending messages repeatedly to the phone, requesting its location without them being any the wiser.

AdaptiveMobile Security used its own threat analytics system to correlate the pattern of the attack with the attackers already in its database, and appears to have found a hit. It continued:

… we can say with a high degree of certainty, that the source is a large professional surveillance company, with very sophisticated abilities in both signalling and handsets.

The group has also tested other attacks using the same mechanism, including spreading malware and call interception.

Phone surveillance is becoming big business, with several companies offering to hack high-profile targets. While these solutions are usually sold as crime-fighting or anti-terrorism technologies there have been concerns that some governments are using them for human rights abuses.

Now that AdaptiveMobile has shone a light on Simjacker, it’s up to carriers to fix the problem, it warned. The exploit works because many operators aren’t checking the source of these binary messages. They could block it by configuring the firewall technology in their networks, it advised.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/QZ2DMZ452TM/

Google has discovered a serious flaw in a Chromebook security feature which allows owners to press their device’s power button to initiate U2F two-factor authentication (2FA).

Known as the ‘built-in security key’, the experimental feature was first enabled for Google PixelBooks last summer. Since then, it has quietly been embedded on numerous Chromebooks that have the necessary H1 CR50 chip inside them, including many made by Dell, HP, Acer, Samsung, Asus and Lenovo. A full list of affected devices is available on Google’s website.

We say ‘quietly’ because it’s unlikely many owners beyond developers have even heard of the feature, let alone used it to authenticate themselves when logging into a website.

For those who have, the feature is appealing – instead of waiting for an SMS onetime 2FA code, or generating one using an app, or even plugging in a hardware security key such as Google’s own Titan, Chromebook users can achieve the same with a short press of the power button.

Unfortunately, a vulnerability has been discovered in the system that makes this work, specifically the generation of an Elliptic Curve Digital Signature Algorithm (ECDSA) signature by H1 chips running v0.3.14 firmware and earlier. Google said:

We confirmed that the incorrect generation of the secret value allows it to be recovered, which in turn allows the underlying ECC private key to be obtained.

Which means that an attacker could work out the private key, completely undermining what is supposed to be a fundamental security feature.

Google believes the chances of this happening when users have logged into real websites is small given that communication with the website should have happened over HTTPS. However, that doesn’t rule out that weakly generated signatures might have been stored in a vulnerable state on Chromebooks themselves.

Ironically, Google thinks that the one thing that stands in the way of such a second factor compromise is the security of the first factor, namely the password and username.

While true, it’s hardly a ringing endorsement of Google’s technology that it can be rescued by passwords.

What to do

Chrome OS v75 will automatically install version 0.3.15 of the firmware, which contains the fix for this issue. If you don’t use the built-in security key feature, that’s all you have to do.

If do use the security key feature, then you have some work to do after updating the operating system.

Old key pairs generated before the update are still vulnerable, so you have to de-register the built-in security key from every website on which it’s being used for authentication, and then re-register it with a fresh key pair.

Should you trust this feature going forward?

Not everyone thinks it’s a good idea to build the U2F security function into devices in this way when there is a proven secure alternative – use a separate hardware key. That said, 2FA provides such a significant boost to security over simply using usernames and passwords that even flawed or imperfect 2FA solutions are much better than no 2FA at all.

Google says it is improving the security of the technology, which is still in the test phase of its development.

Graveyard shift

This vulnerability dovetails interestingly with that other Chromebook controversy of the moment – Chrome OS end of life.

Recently, owners who bought their Chromebooks between 2013 and 2016 have started seeing the following unexpected message after an update:

This is the last automatic software and security update for this Chromebook.

Google calls this moment ‘Auto Update Expiration’, a 2017 rebranding of the previous and more explicit description, Chromebook ‘end of life’.

It often comes as a shock to owners, who hadn’t realised that Chromebooks only receive software for a maximum of 6.5 years, that they might have to stop using their perfectly functioning computer or continue using it in an increasingly insecure state.

The clock starts ticking not when the Chromebook was bought but when the platform on which it is based first appeared on the market, which might be years before purchase, and in some cases a while before the specific model appeared.

The issue here is what would happen if a big flaw such as built-in security key vulnerability was discovered in a Chromebook beyond its end of life at some point in the future.

The lesson is clear – carefully check the lifespan of any Chrome OS device before buying it.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/wxhr_hHEAl8/

Mr. Lockscreen Bypass has done it again.

Spanish security sleuth José Rodríguez on Friday posted a YouTube video of his most recent iOS lock-screen bypass: one that allows an iPhone to be tricked into showing its address book without the need to unlock the screen.

The researcher told The Register that he found this bypass in July, in what was then the beta of iOS 13.

As the video shows, the bypass involves receiving a call and opting to respond with a text message, and then changing the “to” field of the message, which you can do via voice-over. The “to” field pulls up the phone’s contacts list, thus enabling randoms to paw through your contact list without needing to first unlock your phone.

This isn’t a terribly serious bug. To exploit it, snoops have to get their hands on a victim’s device, and then they need to call it from another phone.

It’s also reportedly pretty easy to prevent: as a reader tweeted after The Register posted its story, you just need to go to Face ID Passcode settings Allow access when locked and toggle off the Reply with Message option. That feature is reportedly enabled by default in iOS 13.

@TheRegister @hackerfantastic And yet, seemingly mitigated by toggling the attached option. Was not able to reprodu… twitter.com/i/web/status/1…

—
Andrew Maxey (@andrewmaxey) September 13, 2019

Plus, the lockscreen workaround was found in a beta, which doesn’t really count as much as would a bug in a live product. That’s apparently why Apple reportedly reneged on its initial promise to pay Rodríguez the “gift” that he asked for.

According to the researcher, he wanted a $1 Apple Store card. He told the Register that he wanted it as a trophy. First Apple said yes, Rodríguez said, then it said no:

I contacted Apple asking for a gift in thanks for reporting a passcode bypass, Apple agreed to give me a gift.

I reported the security problem and then Apple retracted, apologized and told me that it was not allowed to thank by giving gifts for security reports during beta period.

OK… rules are rules… but… really? We’re talking about a serial lockscreen hacker, here. Doesn’t he deserve a little something?

Even if his latest isn’t terribly concerning from a security standpoint, his track record is kind of amazing. Here’s the timeline I put together of his successful exploits leading up to this one. If you know of others, let me know:

• Mid-October 2018: he comes up with a new iPhone iOS 12.0.1 lockscreen bypass that exposed your photos…
• As in, the iOS 12.0.1 that Apple had released a week prior, to address a range of issues that had cropped up with iOS 12, including two separate lock screen bypass flaws Rodríguez published in late September 2018. One of iOS 12’s biggest draws when it launched in mid-September was supposed to be the way it tightened up security. Ouch!
• He’d already built a reputation for finding other iOS lock screen bypasses too. In 2016, Rodríguez found a Siri bug that allowed someone to bypass the lockscreen and gain access to contacts and photos. And before that…
• In 2015, he found an earlier bug in Siri that made the lockscreen in iOS 9 unsafe: again, the bug allowed anyone to see your photos and contacts. But wait, there’s more:
• In 2013, he had found (yet again) a lockscreen bug in iOS 6.1.3 that let unauthorized people bypass the lockscreen on an iPhone 4 using nothing more than a paperclip.

The Register reports that as of Friday, Apple hadn’t addressed the latest vulnerability.

Granted, if you decide to make only some things available when an iPhone is locked, rather than enforcing a strict boundary, then problems like this are probably quite hard to stop. It certainly looks that way, when you eyeball the long list of bypasses Rodríguez has come up with, some within mere weeks of when Apple has tackled whatever bypass he came up with before the update.

But after all, under normal circumstances, everything on your phone is linked together for usability and convenience (phone, SMS, contacts, etc.), and movement between apps is supposed to be slick and easy.

Still and all, at this point, you wonder why Apple doesn’t just give Rodríguez the damn phone as part of their standard testing procedure.

C’mon Apple, just give him the phone! and the $1 coupon – framed so he can hang it on his wall!

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ItkiemPxojs/