STE WILLIAMS

Scare-bnb: Family finds creeper cams hidden in their weekend rental by scanning Wi-Fi

A family staying at an Airbnb rental in Ireland made an unsettling discovery when they found their unit had a hidden camera livestreaming their stay.

The Barker Family of Auckland New Zealand were staying at a property in Cork as part of an extended trip through Europe when they spotted a hidden camera in the living room of the house.

The family of seven said the creeper cam was spotted when, shortly after arriving at the unit, father Andrew Barker (an IT security man by trade) ran a scan of the home’s Wi-Fi network and spotted a live feed taken from a camera concealed within a smoke detector.

baby

Don’t panic, but your baby monitor can be hacked into a spycam

READ MORE

According to mom Nealie Barker, the family tried to bring up the matter with both the host of the unit and Airbnb, only to have the rent-a-house site dismiss their complaint. They would eventually leave the creepcam-equipped home and opt instead to stay at a local hotel.

“The Airbnb safety team investigated our complaint (we provided photos and snapshot of video feed),” Barker said of the incident.

“Their ‘thorough’ investigation which didn’t include any follow-up with us exonerated the host, no explanation provided. The listing (with hidden camera not mentioned) is still on Airbnb.”

“The safety and privacy of our community – both online and offline – is our priority,” the home rental site told CNN.

“Airbnb policies strictly prohibit hidden cameras in listings and we take reports of any violations extremely seriously. We have permanently removed this bad actor from our platform. Our original handling of this incident did not meet the high standards we set for ourselves, and we have apologized to the family and fully refunded their stay.” ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/04/05/scarebnb_creeper_cams/

Advanced Persistent Threat: Dark Reading Caption Contest Winners

From sushi and phishing to robots, passwords and ninjas — and the winners are …

Mike Epplin (mepplin), Tampa, Fla., earns the top honors and a $25 Amazon gift card for his apt APT-related caption, inked below by cartoonist John Klossner. When not writing cartoon captions, Epplin’s day job is presales engineer at Respond Software.

Second place ($10 Amazon gift card) goes to Kristen Dean (Kristendean80), digital marketing director, PMark Inc., LaFargeville, NY, for her clever “Your ‘Low On Ink’ light is on again.”

Many thanks to everyone who entered the contest with all their puns and clever observations, and to our loyal readers who cheered the contestants on. Also, a shout out to the judges: John Klossner and the Dark Reading editorial team: Tim Wilson, Kelly Jackson Higgins, Sara Peters, Kelly Sheriden, Curtis Franklin, Jim Donahue, Gayle Kesten, Terry Sweeney, and yours truly.

If you haven’t had a chance to read all the entries, be sure to check them out today.

Related Content:

Marilyn has been covering technology for business, government, and consumer audiences for over 20 years. Prior to joining UBM, Marilyn worked for nine years as editorial director at TechTarget Inc., where she launched six Websites for IT managers and administrators supporting … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/advanced-persistent-threat-dark-reading-caption-contest-winners/a/d-id/1334330?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Ongoing DNS Hijack Attack Hits Consumer Modems and Routers

The attack campaigns have re-routed DNS requests through illicit servers in Canada and Russia.

An ongoing DNS hijacking campaign has taken aim at consumer modems and routers. Multiple waves of the campaign have changed settings in the residential devices, sending traffic through any of a series of addresses hosted on services known to be welcoming to hackers and criminals.

In a Bad Packets Report featuring research by Troy Mursch, the details of the three-part (so far) campaign, stretching from late December 2018 through late March of this year, were laid out. In each, the DNS server settings of the router were changed to addresses on services located in Canada or Russia.

According to the report, some 17,000 devices were found to be vulnerable in a BinaryEdge scan. Mursch reports that common reasons for DNS hijacking accounts include advertising fraud and reconnaissance for phishing attacks. In cases where remote enterprise workers are targeted, industrial espionage and IP theft can also come into play.

Mursch recommends that individuals keep devices current on patches and updates and occasionally check the DNS settings of their modems and routers to make sure that the DNS servers used are those provided by the ISP or authorized by the user.

For more, read here.

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/perimeter/ongoing-dns-hijack-attack-hits-consumer-modems-and-routers/d/d-id/1334355?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Phishing Campaign Targeting Verizon Mobile Users

Lookout Phishing AI, which discovered the attack, says it has been going on since late November.

Verizon is warning customers about a phishing campaign that is going specifically after mobile users.

Mobile devices have emerged as an effective attack vector, according to Jeremy Richards, principal security researcher at Lookout Phishing AI, which discovered the phishing kit. 

“Since many mobile devices lack traditional security, I expect we will continue to see these attacks increase alongside mobile device usage,” Richards wrote in a blog post earlier this week. “These attacks, when opened on a desktop, clearly look like a poorly made phishing domain, but on a mobile device, they look legitimate.”

When users open the phishing email on a mobile device, it looks like it’s from Verizon customer support, according to Richards. The campaign has, in fact, been going on since late November; to date, the attackers have registered some 51 Verizon customer phishing domains. Verizon has been made aware of the issue, Richards wrote, and has been suspending the domains.

Aaron Higbee, chief technology officer and co-founder at Cofense, says while it’s true that mobile phishing attacks are on the rise, he believes the attack Lookout reported largely focuses on consumer-side attacks.

“Most organizations keep devices up-to-date with [mobile device management],” Higbee says. “This kind of report gets people worried about mobile phishing threats … but mobile devices are more secure than desktop computers. These are mostly consumer fraud attacks, like an IRS scam for a Social Security number or a Netflix account. They are not primarily going after corporate credentials and business data.”

In an interview with Dark Reading, Lookout’s Richards disputes that notion, insisting that access to a user’s mobile Verizon account can become very valuable to an attacker.

“We see this as a crime of opportunity,” Richards says. “The attacker will assess who the user is. If it’s just a Netflix account, that’s one thing. But if the user is a CEO or CFO, they can monetize it much differently. Once they have access to a mobile phone account, the attackers can use the stolen credentials to launch business email compromises, fraudulent wire transfers, and ransomware.”

The Media Trust reports that mobile attacks are most certainly on the rise. For example, they report a 46% increase in mobile attacks (59% are mobile phishing) from just February to March alone.

“There’s no question that mobile attacks have increased significantly,” says Usman Rahim, digital security and operations manager at The Media Trust. “Companies may have a policy restricting the use of personal phones on the job, but there’s really no way to restrict it.”

Lookout’s Richards says user education has become paramount. His top tip: If a browser asks for your password, assume you are getting tricked. Best to bookmark a site and use that as a login.

“Users should also be suspicious of emails that drive a sense of urgency, that ask the user to bypass standard procedures and common sense,” he adds.

Related Content:

 

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/phishing-campaign-targeting-verizon-mobile-users-/d/d-id/1334358?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

New law will punish social media companies for users’ violent content

In the wake of last month’s massacre at two mosques in New Zealand, Australia has passed sweeping legislation (PDF) that threatens huge fines for social media companies and jail time for their executives if they don’t promptly remove “abhorrent violent material” from their platforms.

Such content includes videos depicting terrorist acts, murders, attempted murders, torture, rape or kidnap.

The Guardian reports that Labor opposition joined forces with the ruling Liberal-National Coalition to pass the law on Thursday, despite warning that, in spite of what the government is promising, the legislation – the Sharing of Abhorrent Violent Material Act – won’t allow for prosecution of social media execs.

The legislation stipulates that criminal penalties apply to content service providers that have “reasonable grounds to believe” they host such prohibited content if they don’t give police a heads-up about it “within a reasonable time after becoming aware of the existence of the material” or if they fail to “ensure the expeditious removal of the material from the content service.”

The penalties for individuals who “provide a hosting service” and fail to remove material can be up to three years in jail, a AUD $2.1m fine, or both. Labor believes these penalties won’t apply to social media execs because their companies, and not the individuals themselves, provide the service.

Corporate penalties range up to AUD $10.5m or 10% of annual turnover. But again, Labor says there don’t appear to be provisions for the law to punish executives for the actions of others in their social media companies.

The tech industry is strongly opposed to the law: they believe it may criminalize anybody in their companies for failing to promptly remove violent content.

Australia’s attorney general Christian Porter considers the act “most likely a world first.” It was rapidly drafted – not a good thing, according to critics, particularly given that it was written without much input from technology companies or experts – following the Christchurch terrorist attack.

The New York Times quoted Porter during a House of Representatives debate on the bill on Thursday:

These platforms should not be weaponized for these purposes. Internet platforms must take the spread of abhorrent violent material online seriously.

Edited versions helped it spread like wildfire

The alleged gunman in that attack—in which 50 Muslim worshippers were murdered and 39 were wounded—is believed to be an Australian white nationalist. He allegedly live-streamed what’s thought to be the single worst terrorist attack carried out by an Australian, according to ABC.

Video of his alleged attack spread faster on social media than it could be taken down.

On Friday, Facebook finally broke its silence on the killings when the New Zealand Herald published a letter from Facebook Chief Operating Officer Sheryl Sandberg.

In her letter, the COO said that in spite of being shared Live, the video spread mainly by people who shared it. The difficulty of stopping the viral spread was compounded by the fact that so many people re-edited it, which makes it harder for Facebook’s systems to identify and block content. Sandberg said that Facebook has identified more than 900 different videos showing portions of “those horrifying 17 minutes.”

“Your silence is an insult to our grief.”

Facebook, for one, stayed mute for two weeks after the attack, while politicians fumed at the failure of such platforms to keep themselves from being used to disseminate manifestos of hate and videos of horror.

From a letter written by New Zealand privacy commissioner John Edwards to Facebook executives following the massacre, as reported by the New Zealand Herald:

It would be very difficult for you and your colleagues to overestimate the growing frustration and anger here at Facebook’s facilitation of and inability to mitigate the deep, deep pain and harm from the live-streamed massacre of our colleagues, family members and countrymen broadcast over your network.

Your silence is an insult to our grief.

Sandberg said in her letter that Facebook is exploring live-stream video restrictions that could factor in things such as an individual’s history of Community Standard violations. As well, Facebook is investing in research to build better technology that could quickly identify edited versions of violent videos and images and prevent people from re-sharing them.

Tech strenuously objects

The Digital Industry Group, an advocacy group representing Google, Facebook, Twitter, Amazon and Verizon Media in Australia, has warned that the bill was passed without adequate industry input and that it threatens penalties against tech companies for content created by users. Managing director Sunita Bose:

This law, which was conceived and passed in five days without any meaningful consultation, does nothing to address hate speech, which was the fundamental motivation for the tragic Christchurch terrorist attacks.

With the vast volumes of content uploaded to the internet every second, this is a highly complex problem that requires discussion with the technology industry, legal experts, the media and civil society to get the solution right. That didn’t happen this week.

Richard Di Natale, a senator in the Australian Greens party, blamed both Australia’s conservative government and the opposition Labor Party for “ramming through” legislation that encompasses “some of the most significant changes to social media online regulation that we have ever seen.”

The law is also being criticized for the fuzziness of the standard of removing content “expeditiously” – a vague time table that the law says would be decided by a jury …which could well lead to protracted legal battles.

Scott Farquhar, the chief executive of Atlassian – an Australian enterprise software company:

Farquhar also said that as written, the law could send anybody to jail for three years if they work at a company that allows user-generated content, including news sites, social media sites, dating sites, and job sites.

Despite the law’s making an exception for journalists whose jobs include reporting on abhorrent violence, even mainstream media are up in arms over the legislation, Farquhar pointed out. The Australian on Wednesday reported that a spokeswoman for its publisher, News Corp Australia, said that holding digital platforms liable for what they disseminate was overdue, but this bill goes well beyond that and could lead to censorship and criminalization of journalism:

While we have worked with the government to try to minimize the impact, this law risks criminalizing news reporting and provides significant powers to the eSafety Commissioner to take down news content.

She called for an immediate review of the legislation following the election:

In the rush to pass this law it will not be subjected to any review. Given the known consequences of the legislation on news reporting we strongly recommend the government and the opposition agree that the bipartisan Parliamentary Joint Security on Intelligence and Security review this law immediately after the election.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/OrGYSdIpZl8/

Nvidia patches severe bugs in edge computing modules

Nvidia has released 13 patches targeting two low-end embedded computing boards. The processor company explained in a security advisory this week that the flaws could lead to code execution, denial of service, escalation of privileges, or information disclosure.

These security bugs won’t turn up in your gaming PC, but they could cause problems for your drone or smart internet facial recognition security camera. They affect the Nvidia Jetson TX1 and TX2 boards, each of which carries an Nvidia Tegra processor. Released in November 2015, the TX1 is a module the size of a pack of cigarettes designed to be integrated into IoT products. The TX2 is a higher-powered successor.

Described by Nvidia as a “supercomputer on a module”, these boards are designed for AI-powered applications like embedded deep learning and computer vision. These are the kinds of modules that put the ‘edge’ in edge computing. They’re supposed to be used in robots, 3D scanners and the like.

Vulnerability CVE‑2018‑6269 gets the highest base score (a CVSS score representing severity) in the security advisory. It is a flaw in the Tegra kernel driver’s input/output control handling for user mode requests. This is the only bug in the pack that could lead to potential code execution, according to the advisory.

This bug is also one of many that can lead to privilege escalation or denial of service. The next three highest-scoring bugs carry these risks.

CVE‑2017‑6278 is a bug in the kernel’s thermal driver that could allow an attacker to read or write after the end of a buffer. CVE‑2018‑6267 is a bug in the driver for OpenMax, which is a set of C-language programming interfaces for multimedia processing. It fails to validate metadata, which could allow an attacker to deny service or escalate their privileges by submitting malicious metadata. Another bug in that driver, CVE‑2018‑6271, improperly validates input, potentially affecting program control flow.

There are several information disclosure bugs. One of the most interesting to us is also the one with the lowest base score of the lot. It is a speculative execution and memory reading bug. Speculative execution tries to predict which instructions the system may need to run, and use some of their processor cores to prepare them while they wait for results from other cores.

The bug, CVE‑2018‑3639, may allow unauthorized disclosure of information to an attacker with the local user access via a side-channel analysis, the advisory said. Speculative execution bugs have plagued Nvidia rival Intel over the past 18 months, with the discovery of flaws like Spectre and, more recently, Spoiler.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/7AadSnl2LkQ/

Hoax! Nope, hackers aren’t posting invisible sexual videos on your wall

Should you “share, share, share” the “urgent warning” that hackers are “posting sexual videos and pictures on your walls” that are completely invisible to you?

No, you should not sharedy-sharedy-SHARE-share-share, because this latest viral Facebook copy-and-paste-me warning is just another social media sneeze, spreading its hoaxy germs in spite of the fact that it’s been around, growing hair and getting debunked multiple times, since 2011.

I caught this variant on Thursday morning:

And here’s a fancied-up one, archived from its Facebook original, which was made by somebody who evidently thinks that yellow type on a red background gives the message an aroma of truthiness:

URGENT WARNING

To all Facebook users!

Friends be careful!

This is serious!

Hackers are posting sexual videos and pictures on your walls! You don’t see them, but your friends do, then it seems as if you posted it. If you see any such garbage posted under my name, please let me know because

“I did not post it!”

Share this to protect yourself and your friends.

That post was picked up by Facebook’s false news bloodhound and reported on by Politifact, one of the fact-checking organizations that’s partnering with the social network to fight fake news.

It’s declaring the latest outbreak of invisible-to-you Facebook porn to be unsupported by credible evidence and that the warnings are vague and unsourced.

The alert is too vague to be a credible security warning and doesn’t detail how these hackers are getting into accounts, nor does it give any solution besides telling users to let someone know if they see this activity on others’ Facebook walls, which provides no permanent fix.

Gnarly old hoax

Snopes debunked a hoax that sounded very similar in August 2011. The current version has been improved upon by somebody or somebodies who’ve discovered that the caps lock on a keyboard can be turned off.

Here’s the verbose screamer that was making the rounds in 2011:

THE HACKERS ARE PUTTING SEXUAL VIDEOS TO YOUR NAME IN THE WALLS / PROFILES OF YOUR FRIENDS WITHOUT YOU KNOWING IT. YOU DONT SEE IT, BUT OTHER PEOPLE CAN SEE IT, AS IF THESE WERE A PUBLICATION THAT YOU MADE! ALSO, THEY’RE SENDING INBOX MSGS TO YOUR FRIENDS ASKING YOU TO CLICK A LINK. DON’T DO IT!! SO IF YOU RECEIVE SOMETHING FROM ME ABOUT A VIDEO OR A STRANGE INBOX MESSAGE, IT’S NOT ME! copy this in your wall. It is for the security of YOUR OWN IMAGE!!! And REPORT IT!!!!! ALSO IF U ARE ASKED TO VOTE ON A PICTURE. DO NOT GO VOTE: IT’S A HACKER!! POST THIS TO YOUR WALL FOR YOUR FRIENDS
ATTENTION:THE HACKERS ALREADY ENTERED IN FACEBOOK THEY ARE PUTTING PORNOGRAPHIC VIDEOS TO YOUR NAME IN THE WALLS OR PROFILES OF YOUR FRIENDS WITHOUT YOU KNOWING IT. YOU DON´T SEE IT, BUT OTHER PEOPLE CAN SEE IT, AS IF THESE WERE A PUBLICATION THAT YOU MADE! SO IF YOU RECEIVE SOMETHING FROM ME, IT’S NOT MINE! copy this in your wall. It is for the security of YOUR OWN IMAGE!

The surreptitious insertion of “invisible,” risqué films into other people’s Facebook accounts, unbeknownst to them but visible to friends, would turn out to be possible, but Snopes couldn’t find any verifiable samples of it with regards to that message above, which it deemed a hoax.

It did point out that images that appear to link to porno sometimes appear in compromised Facebook accounts, but they aren’t great at playing hide and seek: the posts are clearly visible to the account owners, Snopes said.

Those who are using social networking sites prudently therefore should not fear they’re about to unknowingly begin issuing porn video come-ons to their friends and family.

Just to confuse matters, in a separate, unrelated incident from mid-November 2011, Facebook users were hit by a for-real attack of hardcore porn, violence and animal abuse images showing up on their feeds, thanks to some clever social engineering and a browser bug.

What to do?

Given the lack of evidence, it would be a kindness were we all to tell people to stop posting, stop copying, stop pasting, and stop sharing this. Better still, please do ask people to delete these posts if they’ve fallen for the warning. As long as somebody’s posting them, they’re going to keep spreading, and who needs another eight years of this?

And while people are busy sharing fake news about made up problems, there are real threats to deal with.  Facebook accounts are valuable to crooks and face real dangers like credential stuffing, phishing and untrustworthy apps.

So, if you want to do something useful, make sure you have a strong password, enable multifactor authentication and take a few seconds to review your apps, like this:

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/j62rFQE7T5w/

Patch now! Magento e-commerce sites targeted by SQLi attacks

Cybercriminals are reportedly exploiting a critical flaw in the Magento e-commerce platform only days after it was made public by the researchers who discovered it.

Scoring a 9.0 on CVSS, the bug doesn’t yet have a CVE number to identify it but Magento refers to its patching list as PRODSECBUG-2198 (the number being the important bit).

It’s an SQL injection flaw which can be exploited with no authentication or privileges, which is why for admins tending sites using Magento it’s a stop what you’re doing and patch this now situation.

That’s not difficult as the Adobe-owned Magento patched this among several dozen other security flaws as part of a security update published last week. The affected versions are:

  • Version 1 before 2.1.17
  • Version 2.2 before 2.8,
  • Version 2.3 before 3.1
  • Magento Open Source before 9.4.1
  • Magento Commerce before 14.4.1

The patch for 2198 can be installed on its own but, ideally, sites should install the whole update. From Magento’s announcement:

To protect against this vulnerability and others, you must upgrade to Magento Commerce or Open Source 2.3.1 or 2.2.8. We strongly suggest that you install these full patches as soon as you can.

Among a total of 37 flaws covering Cross-Site Request Forgery (CSRF), and Cross-Site Scripting (XSS), there’s also a serious (CVSS 9.8) Remote Code Execution (RCE) flaw identified as PRODSECBUG-2192 deserving careful attention.

Devil take the hindmost

What of the attacks on Magento sites? This part of the story began on 25 March when little-known French Pentesting company Ambionics Security (which also revealed so-called Carpe Diem bug in Apache this week) tweeted the following:

True to its word, on 29 March, Ambionics published a blog looking at 2198 in more detail, including that it was paid a bounty by Magento for responsibly disclosing it last November.

The blog included a GitHub link to proof-of-concept (POC) exploit code without making it clear who developed this.

On the same day, Elgentos Ecommerce CTO Pete Jaap Blaakmeer tweeted that he’d noticed attacks based on the POC for 2198:

Separately, Blaakmeer confirmed this to a journalist.

Researchers making POC code public so soon after a patch becomes available is not unheard of but it’s contentious because it puts sites under huge pressure to update.

The other way of looking at this is to say that Magento admins should simply adjust themselves to the need to apply security updates as a major priority, in a matter of hours.

It’s not as if there haven’t been warnings that Magento and other platforms are being targeted.

Last August, the MagentoCore card skimming malware was discovered on thousands of Magento sites, some of which looked as if they’d been infected for months.

More recently, a report emerged that Magento sites were being used to test leaked credit cards using zero dollar transactions to see which might be vulnerable to fraud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/37MUCcuLYvw/

Serious Security: GPS week rollover and the other sort of “zero day”

I bet you’ve heard of GPS, short for Global Positioning System.

It’s owned and operated by the US government but it’s available for free to anyone in the world – and, boy, is it widely used.

GPS is a fantastic feat of science and engineering that is anything but simple in implementation, but that is fairly simply explained.

A number of orbiting satellites (31 are active at the moment) continuously broadcast both their position in space and the current time.

Radio receivers on earth listen out for these broadcasts, and as long as they can “hear” the signals from three different satellites at the same time, and have their own reliable way of measuring the time, they can solve a system of mathematical equations to compute their own position.

The calculations rely on the fact that the time it takes for the signal to travel from the satellite to the receiver determines its distance, and with three distances you can lock in your position uniquely in three dimensions.

The time from satellite to receiver pinpoints the distance reliably because radio waves travel at a constant speed, and distance = speed × time.

Radio waves, known collectively as EMR, short for electromagnetic radiation, travel at what’s commonly called the speed of light, because light is just a special type of radio wave in the right frequency range to set off the detectors in the human retina. This speed is denoted by c, as in the famous equation E = mc2, and is defined in the GPS standard as 299,792,458 metres per second.

Fascinatingly, GPS positional calculations need to take relativity into account.

The satellites are moving very fast relative to a receiver on earth, which makes their clocks seem to us to run a bit too fast – they effectively drift ahead by 7 millionths of a second each day.

The atomic clocks on the satellites therefore deliberately “tick” slightly too slowly to cancel out this discrepancy.

On the other hand, the fact that we’re much closer to the centre of the earth’s gravitational field than the GPS satellites means that our clocks seem to them to run a bit too slowly – they effectively fall behind by about 45 millionths of a second each day.

Those 45 microseconds have to be accounted for in the equations used by GPS receivers.

Four heads are better than three

GPS receivers actually lock onto four (or more) satellites simultaneously, instead of three, so they can solve equations that compute both their position and the current time, with astonishing accuracy.

This fourth satellite signal means that GPS receivers don’t need their own atomic clocks, so they can be made really small, and because they only need to listen in, never to transmit, they don’t consume a huge amount of power.

Indeed, modern GPS receivers are so small and energy-efficient that they can be packaged into a single chip as small as 5mm x 5mm, so that most modern phones can do GPS, as can bicycle speedos, smart watches, drones, along with lots of other consumer devices.

In fact, given their price, GPS receivers make fantastic reference clocks, even if the receiver is fixed to a building and you don’t care about measuring its position.

Absolute versus relative time

If all you need to know is how many seconds have passed since midnight on the previous Sunday morning, for example, because you can keep track of the date yourself, you never need to worry about numbers bigger than 604,800, which is the number of seconds in a week (60×60×24×7).

But that would mean every GPS receiver would need at least a basic clock of its own, albeit accurate only within half a week, that would keep running even if the receiver itself were powered down.

The GPS signal alone would only have enough information to decode the time relative to the current week.

So GPS includes a Week Number (WN) field that gives an absolute time reference, representing the number of weeks since the hour of midnight that kicked off the day of Sunday 06 January 1980 (1980-01-06T­00:00:00Z).

Thanks to the WN, you can, in theory, eliably denote time absolutely: WN = -5 would start on the second day of December 1979, for example, while WN = +4 is the first week of February 1980.

Your GPS receiver can therefore be self-contained, requiring only the GPS satellites as its external data source, and requiring no writable computer memory (RAM) that’s capable of retaining its data when the power is off.

The tyranny of distance

GPS relies on precise electronic devices, including atomic clocks, that are blasted into, and then operated in, outer space.

By convention, outer space starts just 100km above the surface of our planet; GPS satellites are about 20,000 km up, close to twice the diameter of the earth.

Space is a hostile environment for computers, so their performance is measured more in terms of durability than speed – there’s no point in having a multi-gigahertz CPU and a multi-megabit network link if they quickly end up running at speeds of zero.

Furthermore, GPS was invented and built during the 1970s and 1980s, when even terrestrial modems did well to send data at 1200 bits per second.

The GPS downlinks, therefore, send data to the billions of GPS receivers around the world at just 50 bits per second.

So every bit counts, and nothing can be wasted.

There’s no “pad this variable to the next 64-bit boundary” or “store this single character in a 32-bit DWORD” stuff going on in the GPS protocol.

As a result, the GPS standard had to make some storage compromises, one of which was that the WN field was allocated only 10 bits, so it can represent numbers from 0 to 1023, after which it wraps back to 0 and the count begins again.

1024 weeks is just under 20 years, and given that the GPS epoch – as such things are quaintly called in techie circles – started in 1980, GPS had its very own Y2K-type moment back in 1999.

In the simplest terms, the GPS “earth time” that immediately follows 1999-08-21T­23:59:59Z is not, as you might expect, 1999-08-22T­00:00:00Z.

Zero day revisited

At the rollover, the time advanced naturally enough, from one minute to midnight on to midnight itself, but the date wrapped around back to “zero day”, 06 January 1980, when the GPS epoch started.

Of course, you can code around this, up to a point, as some people did for Y2K, for example by assuming that the years 00 to 49 referred to AD2000 – AD2049, while the years 50 and onwards covered AD1950 to AD1999.

But for that sort of compromise to work, you have to be certain that you will never need to represent AD1949, because you can’t.

Wherever you redirect your Y2K zero day, you’re still stuck with an epoch that can’t last more than 100 years.

Similarly, you’re stuck with a maximum of 1024 weeks in GPS. (The most recent flavour of GPS will extend this to 8196 weeks, which is more than 150 years, but there’s still a hard limit on the epoch length.)

A trick you can use in GPS receivers that can’t receive data from anywhere but the satellites, and that don’t have any non-volatile RAM (memory that can survive a power outage), is to treat the release date of the product as an offset into the epoch, so you get 19.7 years of WN range from your own starting point.

Given that you can’t run your firmware code before you compile it, you can reliably burn the compile date into your firmware image as convenient epoch extender.

As long as you get a firmware update out to all your users at some point in the next 19 years, you can reset and re-run your own adjusted epoch again and again, and you’ll never make a mistake when converting raw GPS data into absolute earthly timestamps.

Déjà vu all over again

Guess what?

If you go forward another 1024 weeks, or 19.7 years, from GPS’s 1999 rollover moment, you end up at the stroke of midnight that divides…

…tomorrow from the next day!

That’s when Saturday 06 April 2019 turns into Sunday 07 April 2019.

What to do?

Should you panic?

Will your {bike computer, car satnav, mobile phone, drone, insert name of device here} go haywire on Sunday morning?

The answer is, “Very unlikely.”

Unless you have a GPS device that is very old and can’t get firmware updates, or you have a device that is more recent but you’ve never updated it, ever, you ought to be OK.

Time can’t go backwards, so any correctly programmed GPS device running firmware compiled after 1999 already knows that the date can’t suddenly rewind to 1999, and can detect and adjust for the rollover automatically.

Networked computers that synchronise their clocks from external sources aren’t likely to go haywire, either.

Firstly, most modern computers (with the notable popular exception of the Raspberry Pi series of computers, which always reboot in 1970) have backup clocks that are accurate enough to detect external time sources that are unreliably incorrect, and ignore them.

Secondly, most modern computers keep their clocks accurate using a protocol called NTP (short for Network time Protocol) that doesn’t depend on any single time source.

So you are unlikely to wake up and find Limp Bizkit on the radio, the Spice Girls on TV, and Apple stock at $1.50 (as splendid as at least one of those outcomes would be).

Still, you might as well check for satnav or other GPS-enabled device updates right now, just in case…

…and you might as well make sure you have your flux capacitor with you on Saturday night


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/_gufiTRdnEI/

Prepare to foil cybercriminals at SANS Krakow 2019

Promo Organisations can no longer afford to sit back and hope their security measures will protect them from determined and inventive adversaries who know how to get around most of today’s security and monitoring tools.

Training specialist SANS Institute is holding an event in Krakow from 27 May to 1 June that will help cybersecurity professionals at all levels to understand their organisation’s IT system vulnerabilities and prevent the bad guys from getting their hands on its precious data.

Two courses taught by leading cyber security practitioners are available, both offering the chance to gain GIAC Certification. SANS pledges that attendees will be able to apply their knowledge as soon as they return to work.

Advanced incident response, threat hunting, and digital forensics

The key is to be on constant lookout for attackers that get past security systems and catch their intrusions in progress rather than waiting for them to do their worst.

Learn how to detect breaches, identify compromised systems, perform damage assessments, contain and remediate incidents and build up your knowledge of threats and adversaries.

The course covers threat hunting techniques that use known adversary behaviours to identify data breaches and generate accurate intelligence that help you spot intrusions.

Network penetration testing and ethical hacking

Discover dozens of methods for gaining access to systems to measure business risk.

With comprehensive coverage of tools and techniques, this course will give you a thorough grounding for conducting high-value penetration testing projects end to end, with more than 30 challenging hands-on labs.

Start with planning, scoping and recon, then dive into scanning, target exploitation, password attacks and web app manipulation. You will learn to study a target’s infrastructure by mining blogs, search engines and social networking sites.

The course ends with a real-world penetration test scenario.

More information and registration details here.

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/04/05/prepare_to_foil_the_cybercriminals_at_sans_krakow_2019/