STE WILLIAMS

The algorithms that check for a user’s ‘liveness’ have blind spots that can lead to vulnerabilities.

BLACK HAT USA 2019 – Las Vegas – The multifactor authentication that some have touted as the future of secure authentication is itself vulnerable to hacks as complex as injected video streams and as simple as tape on a pair of eyeglasses. That was the message delivered by a researcher at Black Hat USA earlier today.

Researchers Yu Chen, Bin Ma, and Zhuo (HC) Ma of Tencent Security’s Zuanwu Lab were scheduled to speak here at Black Hat USA, but Visa denials left HC Ma alone on the stage. He said his colleagues had begun the research to find out how biometric authentication was being implemented and, specifically, how the routines designed to separate a living human from a photo or other fake were put into practice.

“Previous studies focused on how to generate fake audio or video, but bypassing ‘liveness detection’ is necessary for a real attack,” Ma said, citing some of the techniques researchers and fiction authors have used to do so.

Most liveness detection is based on a variety of factors, from body temperature (for fingerprint scans) and playback reverberation (for voice recognition) to focus blur and frequency response distortion in facial recognition.

During his presentation, Ma focused on facial recognition as the most complex of the techniques. In the first demonstration, he showed a method the team developed for injecting a video stream into an authentication device between the optical sensor (camera) and processor. This technique, he said, had to consider issues like latency – too much will trigger the system’s defense mechanisms –information loss, and remaining sufficiently “transparent” to avoid detection by the system’s defenses.

While this injection is certainly possible, Ma said it is not a practical attack method because it involves so many pieces, from capturing video of the user to physical possession of the authentication device.

This realization led to further research; Ma said a breakthrough occurred when the team looked at the specifics of live facial recognition algorithms.

Part of the test for facial liveness involves checking for a 3D image — essentially, making sure the face is on a rounded skull. The researchers found that when glasses are worn, the area within the lens of the glasses is evaluated as a 2D image. And on that flat plane lay the vulnerability.

Eyes, it turns out, are merely white dots on a dark patch. The dark patch serves as the eye’s retinas, and the white dot represents highlights indicating the eyes are looking at the camera. If you put pieces of black tape on the center of eyeglass lenses, then put a small piece of white tape on the black, the facial recognition system sees attentive human eyes.

In a humorous demo, Ma showed someone gently sliding eyeglasses onto a supposedly sleeping victim, then picking up a phone and holding it up to the victim to unlock the device. Realistic practice would take more effort, but the point was made — the liveness test is vulnerable.

This vulnerability exists, Ma said, because system designers must walk a tightrope between tight security and user friendliness. He suggested that sliding down that tightrope in the direction of security may be necessary to prevent criminals from finding more easily implemented hacks to unlock devices secured by multifactor authentication.

Related Content:

• Security the Infinite Capacity to Rationalize
• When Perceived Cybersecurity Risk Outweighs Reality
• Fighting Back Against Mobile Fraudsters
• Farewell, Dear Password? The Future of Identity and Authorization
• 3 Takeaways from the First American Financial Breach

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/researchers-show-vulnerabilities-in-facial-recognition/d/d-id/1335471?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In his Black Hat USA keynote, Square’s Dino Dai Zovi discussed lessons learned throughout his cybersecurity career and why culture trumps strategy.

BLACK HAT USA 2019 – Las Vegas – Cybersecurity no longer has to worry about getting attention, said Black Hat founder Jeff Moss in his introduction to the keynote that kicked off the conference’s twenty-third year. Business management and political leaders recognize the importance of security; now, the infosec community must learn how to handle the spotlight.

“Not only have we got the attention, we’re struggling with what we do with it – how we communicate,” said Moss of the industry’s present-day challenge. “The quality of communication now determines a lot of our outcomes.” And while communications problems can be fixed, Moss said, doing so will require reordering the way we think and convey ideas.

His sentiment was echoed in the keynote by Dino Dai Zovi, head of mobile security at Square, who spoke about lessons learned in his career that emphasize the weight of security culture. At a time when every company is driven by software, the responsibility of security goes far beyond one team. Software teams must own security just as security must also focus on software.

Dai Zovi illustrated this idea with the story of when he started working at Square, a time he referred to as “my unfrozen caveman hacker period.”

“I had no idea the depth of things I didn’t know,” he said.

One of those things was a cultural shift: At Square, unlike other firms, security engineers had to code like everyone else. “Because the security team wrote code like the rest of the company, there was a lot more collaboration,” Dai Zovi explained. “That, I think, was really powerful.”

It was one of many lessons he learned that changed the way he viewed how security influenced an organization. In his keynote, Dai Zovi outlined three additional principles for attendees to consider.

Work Backward from the Job
Before a security team can start on a project, it must first talk to internal customer teams to better understand why they’re doing it in the first place. Security pros must first understand the business’ struggles, what is easy for them and what adds friction, and when and why they “hired” security to do something. What are their hiring criteria? What is important to them? Just as significant is their firing criteria. What would cause them to seek an alternative solution?

“You can think about everything security does as offering a product or service to the rest of the company,” Dai Zovi said. Asking these questions helps ensure security adds value rather than implements a tool or service that people didn’t ask for, don’t need, and likely won’t use.

Seek and Apply Leverage
Many cybersecurity experts have a deep pride in being subject matter experts, Dai Zovi said, describing his second point. But this typically small group of people can have a broad impact.

“There’s not enough of us,” he explained, pointing to fuzzing as an example of how automation can help scale security. Making fuzzing easier for developers drives the benefit, he added, because there are more developers than there are security pros.

Dai Zovi also emphasized the importance of feedback loops. Cybercriminals have natural feedback loops; they immediately know whether things work or don’t work. Defenders have to explicitly build their feedback loops, but if they do this right, they can measure attackers probing their systems, identify them learning, see them hacking, and see when they succeed.

Culture Strategy Tactics
“Culture is way more powerful than strategy, which is way more powerful than tactics,” Dai Zovi stressed. Both operations and developers enable the business, and the business requires change. “We must allow change to happen,” he added.

Businesses should move toward a model where risks are shared. Instead of security being security’s job alone, organizations that can reinforce security is everyone’s job can adopt a more risk-sharing culture. This is the environment Dai Zovi described at Square, where developers would write new features and go to the security team for feedback and guidance. Instead of being perceived as the “no” department, security can share their responsibility.

“Instead of saying ‘no,’ start with ‘yes’ and say, ‘This is how I can help,'” Dai Zovi advised. This mindset can drive collaboration with other departments rather than isolating the security team.

“If we can create security culture change in every team, we can scale way more powerfully than we can if security is only our responsibility,” he said.

Related Content:

• 7 Stats That Show What It Takes to Run a Modern SOC
  
• Securing DevOps Is About People and Culture
• Boeing 787 On-Board Network Vulnerable to Remote Hacking, Researcher Says
• New Speculative Execution Vulnerability Gives CISOs a New Reason to Lose Sleep

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/risk/black-hat-2019-security-culture-is-everyones-culture/d/d-id/1335472?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Black Hat IBM’s X-Force hacking team have come up with an interesting variation on wardriving – you know, when you cruise a neighborhood scouting for Wi-Fi networks. Well, why not try using the postal service instead, and called it “warshipping,” Big Blue’s eggheads suggested earlier today.

To demonstrate this approach, the X-Force team built a low-power gizmo consisting of a $100 single-board computer with built-in 3G and Wi-Fi connectivity and GPS. It’s smaller than the palm of your hand, and can be hidden in a package sent out for delivery to a target’s business or home.

Once it arrives, it can be activated remotely over the internet, or when it detects it is near its destination using GPS. It can be instructed to scan for vulnerable networks to infiltrate – a la the TJX wireless hacking in the mid-2000s – or spoof nearby legit wireless networks to harvest passphrases from those connecting, or get up to other mischief over the air.

Any obtained information can be relayed back to base, over the internet, and it can be commanded to drill further into any networks it is able to break into, installing spyware as it goes. This widget is potentially potent as it passes through a business on its way to someone’s desk.

“Think of the volume of boxes moving through a corporate mailroom daily,” said Charles Henderson of IBM X-Force Red on Wednesday, just in time for this year’s Black Hat USA conference in Las Vegas. “Or consider the packages dropped off on the porch of a CEO’s home, sitting within range of their home Wi-Fi. Using warshipping, X-Force Red was able to infiltrate corporate networks undetected.”

Henderson continued, describing how the gizmo could be deployed:

With our warship device, we could also launch other active wireless attacks, such as a deauthentication attack or “evil twin” Wi-Fi attack. By launching an evil twin Wi-Fi network, we could then set up a rogue Wi-Fi network with the warship device and coax our target to join our new decoy network. Our target would then divulge their true credentials (including username and password). This would provide us with further access that could be used for follow-up attacks against the enterprise wireless network.

Once we broke in via the Wi-Fi access, we could then seek to pivot by exploiting existing vulnerabilities to compromise a system, like an employee’s device, and establish a persistent foothold in the network. With this ability to get back into a compromised network, attackers can move through it, steal sensitive employee data, exfiltrate corporate data or harvest user credentials

Bottom line: In this warshipping project, we were, unfortunately, able to establish a persistent network connection and gain full access to the target’s systems.

This warshipping has a number of advantages for hackers. For one thing, there’s no need to suspiciously cruise a location; just send a box anonymously instead and control it from the comfort of your own home, er, cafe Wi-Fi via Tor.

So far, this gadget is only at the proof-of-concept stage, though in the future IBM predicts it could become popular with crafty snoops. We can well assume Big Blue is not the first to come up with this sort of idea: a cheap rooted Android phone could work just as well as the above described single-board computer – if not better because a smartphone is unlikely to raise many suspicions.

In any case, the IT titan recommends banning employees from shipping personal packages to their offices, thus easily allowing all parcels to be intercepted, and checking deliveries with a suitable radio frequency scanner. ®

Sponsored:
Balancing consumerization and corporate control

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/07/ibm_warshipping_wifi_package/

Black Hat Black Hat founder Jeff Moss opened this year’s shindig in Las Vegas with tales of quite how odd the hacking culture in China is.

You see, Moss also founded the DEF CON conference series, and has started running DEF CON events for nerds in China – which makes sense given the sizable reservoir of infosec and computer science talent in the Middle Kingdom. However, he said, when talking to folks over there, he realized quite how different black-hat culture is in Asia.

“I’d assumed internet crime in China was just like over here,” he said. “I was wrong.”

For a start, identity theft is virtually unknown, Moss said. There’s no point in hacking systems to steal strangers’ identities to use for nefarious purposes, because it’s easy to obtain a legitimate identity direct from someone, and assume their persona. Hackers and their ilk simply go into the farming belt and find someone willing to sell their identity, with a typical price around $3,000 per ID. That’s about the annual wage of a low-income person in China, which, don’t forget, is home to about 1,400,000,000 people.

This approach, however, has a few problems, mainly that the same person may sell their identity to multiple hackers. So the first thing anyone using a bought ID does is to check that the same credentials aren’t being used in that geographical locale.

Huawei website ████ ██████ security flaws ██████ customer info and biz operations at risk: ███████ patched

READ MORE

Denial-of-service attacks within China also work slightly different. Miscreants can bribe Chinese companies to send overwhelming amounts of network traffic to victims’ systems to knock them offline. These requests can be routed to go out through the nation’s Great Firewall, and back in again, obfuscating the source of the packets, apparently. Moss said this technique was surprisingly effective.

There’s also a small headache with content distribution in China, he said, besides, presumably, the government-mandated censorship. There are four ISPs in the country, two dominate the field, and the pair barely talk to each other’s networks. While there are small interconnects, neither internet provider feels the need to expand the bandwidth between them. This forces companies to set up data centers dedicated to each ISP so that all broadband subscribers, regardless of which ISP they want, can smoothly reach those companies’ websites and other online services. This extra gear increases the security and technical burden on system admins.

Admittedly, online organizations in America and other countries tend to spread out their content distribution over national and global networks for reliability, connectivity, and redundancy purposes, though in China it appears to be more of a minimum necessity rather than a luxury due to the lack of cooperation between ISPs.

Turning to IT security in general, Moss said if you want to get things done, you need more than just your boss and your boss’s boss or boss’s boss’s boss onboard – you need the highest level of the company to agree that defending computer networks is a critical must, and not a set of expensive bells and whistles. And that requires clear communication.

“Now we have management’s attention on security we need to know how to communicate with the board,” he said. “Communicate well, and you can get more budget. Do it badly, you could get fired. The quality of communications really matters for security.” ®

Sponsored:
Balancing consumerization and corporate control

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/07/black_hat_keynote/

Boeing disputes IOActive findings ahead of security firm’s Black Hat USA presentation.

BLACK HAT USA – Las Vegas – IOActive industrial cybersecurity expert Ruben Santamarta last fall discovered an Internet-exposed Boeing Co. server housing firmware specifications for the aviation manufacturer’s 787 and 737 airplane networks.

Intrigued, Santamarta dug into the firmware for the 787, Boeing’s highly networked plane. He meticulously reverse-engineered the binary code and analyzed configuration files – uncovering multiple security vulnerabilities that could allow an attacker to remotely gain access to the sensitive avionics network of the aircraft, also known as the crew information systems network.

“It turns out the firmware I was analyzing is part of the aircraft that is segregating between the different networks,” he told Dark Reading prior to publicly disclosing his findings here today. The firmware belongs to a core network component in the 787’s network and was riddled with buffer overflow, memory corruption, stack overflows, and denial-of-service flaws that he says could be exploited by a hacker to remotely reach the aircraft’s sensitive crew information systems network module.

The flawed firmware Santamarta found, a VxWorks-based system from Honeywell known as the 787’s Crew Information System File Server/Maintenance System Module (aka the Network Interface Module), could be abused by a remote attacker who could then wrest control of that system, according to Santamarta’s findings.

But Boeing maintains that its network defenses would thwart the attack cases IOActive is presenting, arguing that an attacker couldn’t reach its avionics systems via these methods.

“IOActive’s scenarios cannot affect any critical or essential airplane system and do not describe a way for remote attackers to access important 787 systems like the avionics system,” a Boeing spokesperson said. “After working with IOActive to understand its research, Boeing and its partners tested their findings in integrated environments, both in labs and on an airplane. Our extensive testing confirmed that existing defenses in the broader 787 network prevent the scenarios claimed.”

The 787 has a core network cabinet system on-board that includes multiple network modules that segregate and provide network interfaces among the sensitive avionics network, the passenger information and in-flight entertainment system, and the aircraft maintenance system used by engineers, crew, and airline employees.

Boeing’s 787 models come with various communications channels, including satellite devices and wireless connections for when the plane lands and connects to GateLink, an airline network that downloads information about the plane’s arrival; it’s also used by airlines or vendors to push firmware updates to the plane’s network components, for example. The planes also have a wired port for maintenance operations while parked at the airport.

An attacker could hack into the network via the Internet or another network link to the plane, such as its wireless terminal that connects the plane to the airline’s wireless network, Santamarta says.

Another possible attack could sabotage maintenance systems by running rogue tests or giving the maintenance engineer false information about a system function.

Santamarta also spotted two cases where proxy servers used by airlines to communicate with their 787 aircrafts on the ground via GateLink were exposed on the public Internet. “So it was possible to compromise those servers,” which could allow an attacker to reach the plane’s network over the Internet, he says.

But Santamarta is careful to emphasize that he didn’t perform any live tests against a 787 aircraft: All of his research was conducted in a lab setting. “These airport networks are exposed on the Internet. We analyzed those systems and networks, but at a very high level, and didn’t perform any aggressive testing,” he notes.

At the heart of the firmware issue, according to Santamarta, is that the Honeywell firmware was based on a version of VxWorks that was not certified for use in avionics. That left the systems vulnerable to flaws that then could be used to wage an attack on sensitive avionics systems, he says.

Just how much damage or danger an attacker could execute remains unknown without actually hacking a 787, he says. “We don’t have a 787. Basically, you need a 787 to determine the impact of these vulnerabilities,” he says. “We know they can be exploited; we don’t know what we can do after exploiting those vulnerabilities.”

Boeing Pushes Back
IOActive’s Sheehy helped coordinate the firmware vulnerability disclosure process with Boeing, which he says removed the exposed firmware files within 24 hours of IOActive alerting them about finding the server online. Once Santamarta had identified the Honeywell device on the Boeing network, IOActive then worked with the vendor to study and troubleshoot the vulnerabilities. Sheehy says IOActive, Boeing, and Honeywell since have been meeting weekly about the issues.

But Boeing disputes IOActive’s research conclusions.

“IOActive reviewed only one part of the 787 network using rudimentary tools, and had no access to the larger system or working environments,” Boeing said in a statement provided to Dark Reading. “IOActive chose to ignore our verified results and limitations in its research, and instead made provocative statements as if they had access to and analyzed the working system. While we appreciate responsible engagement from independent cybersecurity researchers, we’re disappointed in IOActive’s irresponsible presentation.”  

The Boeing 787 core network security controls includes IP table-filtering in the Ethernet gateway module of the core network, where different rules determine which traffic goes from the open data network to the internal data network, for example. The aircraft also runs a firewall packet-filtering function based on a VxWorks library and employs system rules in the network interface module that help isolate the networks, Santamarta says.

Santamarta says that both Boeing and Honeywell confirmed the flaws in the 787 firmware. “However, Boeing did not share with IOActive the version of the CIS/MS firmware they were using in their testing, despite the fact that this information was requested several times. So technically, all of the 787 currently in production contain the vulnerabilities, but Boeing denies those vulnerabilities are exploitable,” he says.

Boeing’s 787 Dreamliner, which has been plagued with manufacturing quality control and safety issues since it first went live in 2013, remains one of the most electronic-enabled and networked airplanes.

Related Content:

• Researcher Successfully Hacked In-Flight Airplanes – From the Ground 
• Planes, Tweets Possible Hacks From Seats
• The Coolest Hacks Of 2014
• No Fixes In Sight For Satellite Terminal Flaws

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/boeing-787-on-board-network-vulnerable-to-remote-hacking-researcher-says/d/d-id/1335463?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

New research shows that criminals are evolving ransomware attacks against servers, network hosts, and IaaS cloud assets in search of bigger payoffs from businesses.

Ransomware attacks against individual endpoints are so passé. According to reports out this week from two security research teams, financially motivated cybercriminals are updating their ransomware playbooks in search of bigger payoffs from their victims. Increasingly, they’re making more money by putting bigger game in the crosshairs, namely networked business assets such as file shares, servers, network hosts, and infrastructure-as-a-service cloud infrastructure.

A new study from researchers at Vectra shows that the biggest threat to enterprises from ransomware today is malicious encryption of shared network files. Whereas ransomware attacks against isolated endpoints should be no big deal to recover from with any modicum of backup procedures, ransomware targeting of file shares is much more likely to trigger “all-hands-on-deck” emergencies. First of all, attackers are able to do a lot more damage with minimal action by taking advantage of the scale of share volume availability to numerous local systems. It takes only a single access point to lock access to documents across numerous departments or divisions at a targeted organization.

“In a volume-sharing system, a single infected host could encrypt an entire networked volume, resulting in a global impact on the target organization’s business and systems,” the report explains.

What’s more, in many instances, these shared volumes are themselves used as a part of backup procedures for other systems so recovery can become quite tricky without offline backups.

“The files must be recovered from the most recent cold backup if the ransom is not paid,” the report says. “Backup systems attached to a network are also at risk, which is why cold offline backups are critical for recovery.”

The potential risk — and payout for extortionary criminals — increases tremendously when ransomware attackers can successfully target cloud provider infrastructure and storage shares. The Vectra report points to several high-profile attacks against cloud hosting firms DataResolution.net and iNSYNQ as examples of the dynamic at play.

“The fallout from ransomware attacks against cloud service providers is far more devastating when the business systems of every cloud-hosted customer are encrypted,” says Chris Morales, head of security analytics at Vectra. “Today’s targeted ransomware attacks are an efficient, premeditated criminal threat with a rapid close and no middleman.”

According to Vectra’s study, the volume of these attacks is on the decline, but that could simply be a factor of criminals getting more discriminating and more effective with ransomware targeting. There are plenty of new and effective ransomware techniques and malware families deluging enterprises with these network-centric attacks. For example, in the past month, there have been two waves of attacks specifically targeted against enterprise storage devices from QNAP Network and Iomega.

And just this Monday, the industry saw more evidence of the evolution of the ransomware strain MegaCortex, which targets important files on servers and network hosts and is tied to attacks that have asked for as much as $5.8 million from large organizations. New analysis out from researchers with Accenture iDefense shows a version 2 of MegaCortex floating around that shifts this from a very manual ransomware tool to something with automated self-execution features.

“The authors of MegaCortex v2 have redesigned the ransomware to self-execute and removed the password requirement for installation. The changes suggest that the malware authors traded some security for ease of use and automation,” writes Leo Fernandes, senior manager for malware analysis and countermeasures at Accenture iDefense. “Potentially, there could be an increase in the number of MegaCortex incidents if actors decide to start delivering it through email campaigns or dropped as a secondary stage by other malware families.

Related Content:

• Ransomware Used in Multimillion-Dolalr Attacks Gets More Automated 
• Destructive Malware Attacks Up 200% in 2019
• LockerGoga, MegaCortex Ransomware Share Unlikely Traits
• 8 Head-Turning Ransomware Attacks to Hit City Governments
  

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/enterprises-must-be-wary-of-ransomware-targeting-network-file-shares-andcloud-assets/d/d-id/1335466?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In theory, all Android monthly security patches are of equal importance. But sometimes some end up being more equal than others.

A good example is the August 2019 security bulletin, which features a modest 26 CVE-level flaws, made up of 5 marked critical, and 20 rated high priority.

That’s a considerably lighter patch load than recent months. However, closer study reveals that two of the critical flaws could allow an attacker to compromise the Android system kernel over the air (OTA) via numerous System-on-a-Chip (SoC) WLAN interfaces from Qualcomm, including those on the popular 835 and 845 parts.

‘QualPwn’

Normally, Android users are offered the patch and little else by way of explanation. This month, however, the company that discovered the issues, Tencent’s Blade Team, has decided to publicise them under the name ‘QualPwn’.

The two important ones are identified as CVE-2019-10539 and CVE-2019-10540. The first of these could in some circumstances allow an attacker to “compromise the WLAN and Modem over-the-air,” while the second allowed a kernel compromise over the same interface.

These are dangerous because they could be exploited by sending vulnerable devices a specially crafted file without the need for user interaction.

A third flaw, CVE-2019-10538, is rated as less severe but could also make possible a kernel compromise.

The mitigating factor is that the attacker would need to carry out an attack via the same Wi-Fi network as the target which is to say they can’t be exploited remotely on the internet.

Tencent said it had discovered the issues in March 2019, and Google told vendors in early June 2019.

Who is affected?

Devices running a Qualcomm SoC account for a large percentage of higher-end devices over the last couple of years, including the 845 Samsung’s Galaxy S9, Google’s Pixel 3 line, plus models from OnePlus, Xiaomi, LG, Asus, and Sony, and several others (older but equivalent models for the same vendors, for example the Google Pixel 2, will probably be running the 835).

However, while Tencent said it hadn’t tested all Qualcomm SoCs, Qualcomm itself has since issued an advisory that lists numerous SoC parts that appear to cover a large part of the market.

Tencent said it wouldn’t disclose details of the critical flaws until:

We’re informed that the flaws are fixed and consumers have time to install security updates on their devices.

Confusingly, Tencent also says it plans to reveal more about the flaws in a Black Hat presentation this week, followed by something similar at next week’s Paris DEF CON 27.

Because non-Google Android devices can take months to receive released fixes, you could be waiting a while for this update to roll out to you, unless any exploits are noticed in the meantime (which, so far, none have).

Checking for updates

Depending on the version of Android, a device’s patch level (2019-07-01 or 2019-07-05) can be determined in Settings About phone Android security patch level. 

For Android 9 it’s Settings System Advanced System updates.

If you’re running a Google Pixel device, you should see that the last updates were applied in early July 2019. For other devices, it could be as far back as early 2019.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/m81QAZNMBuw/

When is a secure PIN not a secure PIN? When you accidentally store it in your log files.

That’s what happened to digital native bank, Monzo, which was left grovelling to customers over the weekend after its security blunder.

Monzo is one of the new breed of ‘challenger banks’ that uses financial technology (fintech) systems to subvert older, more established banks. One way of doing that is to abandon boring old brick-and-mortar branches in favour of shiny new smartphone apps. This lets them provide online-only services that can adapt quickly to meet customer demands.

UK-based Monzo bank, started in 2015 through a crowdfunding campaign, serves its customers with an iOS and Android app, along with a debit card that is still usable at ATM machines. Unfortunately, its sophisticated software-driven business model let it down last week. On Sunday, it admitted that it hadn’t been as careful as it could have been with the PINs that customers use to access their account.

Engineers had access to customers’ PINs

The bank explained that it stored these PINs in a secure part of its infrastructure. Unfortunately that wasn’t the only place where it was storing them. An oversight meant that it had also been storing the PINs in the log files that its software engineers use to understand what’s happening in its systems.

Although the log files were encrypted, they were still insecure. The company explained:

Engineers at Monzo have access to these log files as part of their job.

Up to 100 engineers had the right to access those log files, meaning that one bad apple could have stolen them and used them to commit fraud.

That didn’t happen, according to Monzo, which said that it had checked:

No one outside Monzo had access to these PINs. We’ve checked all the accounts that have been affected by this bug thoroughly, and confirmed the information hasn’t been used to commit fraud.

Monzo found the problem on Friday evening, and rushed to solve it. According to the blog post, it updated its mobile apps by 5:25am UK time the following morning. It had deleted all of the erroneously stored PIN data by the time it posted its announcement on Sunday.

PINs for around 20% of customers – that’s around 480,000 – made their way into the log files, according to the bank. Anyone who had asked for a reminder of their card number or cancelled a standing order would have been affected.

Monzo has already informed the affected customers, and said that they should change their PINs at ATM machines. Monzo explains how:

You can do this by putting your Monzo card into the cash machine, entering your old PIN and choosing ‘PIN services’. Then choose ‘Select a new PIN’ and change it to a new number.

As with any data breach involving your bank details, you should monitor your statements closely, and inform your bank if you notice anything unusual. Monzo says you can do that through its in-app chat or by ringing the phone number listed on your debit card.

It also emphasises that customers should take precautions, even if they’ve not been told by Monzo that they’ve been directly affected:

If we haven’t emailed you, you haven’t been affected. But you should still update your app to the latest version.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Wotqwks5g38/

Two years ago, we asked this question: Will the Equifax pain ever end?

We can now say that the answer is “Nope, probably not”.

The Federal Trade Commission (FTC) last week said that just one week after it put up a site for people to check whether their data was exposed in the 2017 mega-breach, e-scum have put up bogus Equifax settlement claim sites.

At the legitimate FTC site, people can file a claim for benefits available under the settlement that the FTC and others reached with Equifax. An estimated 147 million potential claimants may be eligible for up to $425 million in compensation from the settlement.

The FTC says that in order to make sure you’re not handing over your personal data to crooks, start your claim at the official website: ftc.gov/Equifax.

Beware of fake websites claiming to be the Equifax settlement claims website. To be sure you are going to the legit… twitter.com/i/web/status/1…

—
  (@FTC) July 29, 2019

Important notes from the FTC: You never have to pay to file a claim to get benefits from the settlement, so if somebody tries to call and talk you into filing a fee for a claim, they’re a scammer for sure.

Once you’re on the official settlement website, you can determine if you’re an eligible claimant. You might shudder at having to hand over personal details, but you will have to enter your last name and the last six digits of your Social Security number (SSN). If the site tells you your personal information was affected by the data theft, you can go ahead and file a claim.

Take note of the URL for the administrator’s site to make a claim for compensation and upload supporting documents: it’s https://www.equifaxbreachsettlement.com/. That’s the only official website.

You can mail your claim, if you prefer: download and print the designated form, fill it out and send it with any supporting documents to:

Equifax Data Breach Settlement Administrator
c/o JND Legal Administration
P.O. Box 91318
Seattle, WA 98111-9418

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/E1M2UWw-AqY/

There are a lot of boxes to tick off to let a dating site know who you want to get cozy with.

Gay? Hetero? Tall? Short? Left-wing, right-wing, dairy-intolerant, beard-abhorring?

And now, a rising trend: there are more and more suitors looking to tick off a box that would read “mule” if it were that easy to find lovelorn patsies to launder money or run drugs for them. And by “suitors,” I mean romance-scamming crooks, of course.

The FBI’s online crime division – the Internet Crime Complaint Center (IC3) – on Monday issued a warning about the rising number of faux lover-boys and -girls who are turning to online dating sites to run what are known as romance or confidence frauds.

We’ve seen plenty of these scams in past years: FBI numbers show that in 2017, more than 15,000 people filed complaints with the IC3, alleging that they were victims of romance/confidence frauds and reporting losses of more than $211 million. The following year – 2018 – that number skyrocketed by more than 70%: the number of victims filing complaints increased to more than 18,000, and they reported more than $362 million in losses.

Based on the number of victims, this type of fraud was the seventh most commonly reported scam last year. Money-wise, it was the second costliest scam in terms of losses reported by those victims. It’s ensnaring every type of victim, regardless of age, education or income bracket, the FBI says, though the most targeted demographics are the elderly, women, and widows or widowers.

Modus operandi

This is how these swindles go: First, the conman or woman gets their victim’s trust. Then, they try to convince them to send money, whether it’s for an airfare to visit, to ostensibly bail them out when they claim to have gotten arrested en route, to prove they can be trusted, to buy a home for the heartthrob they’ve never met, or for any other of an endless litany of sob stories.

It works. It works far too often.

Last year, we saw a romance scam victim who not only sent money to the conman posing as her beau; she also allegedly plotted to kill her own mother for cash to send to him/them/whoever was conning her.

Eager mules

There are scads of similar stories. An example of the rising trend of recruiting mules from dating sites is that of a woman who met somebody on a dating site who convinced her that he was a civil engineer. He promised her a job working at his side. He’d secured a very lucrative contract for a job, he said, but he needed somebody trustworthy to bring it to fruition. Would the love of his life be up for traveling to South America to pick up the contract and carry it to him in London?

She Googled the company, and it checked out. Her “boyfriend” said the company would pay for her airfare. He didn’t ask her for money, so there was no reason for a red flag to go up about being financially gouged.

But when she got there, there was no contract. There was, instead, a suitcase containing what she thought was a thick contract with lots of trade secrets in it. The suitcase was delivered to her hotel. It actually contained three bags of cocaine sewn into the lining. Customs agents found the drugs at the airport, and she wound up spending the next 2.5 years in prison.

The poor woman’s story fits what the FBI is seeing more of: an actor spends a few months building a relationship with a victim, then asks for money or electronics … or to open a bank account under the guise of sending or receiving funds, in the case of recruiting unsuspecting mules.

In other words, the conmen are grooming victims on dating sites or other online venues, working on developing a trust relationship so they can convince their marks to conduct fraudulent activity on their behalf. Then, the accounts are used to launder money from criminal enterprises, whether it’s from stolen credit cards or a large assortment of other crimes. If the financial institution flags the account, it may be closed, in which case the conman either tells the victim to open a new account or turns to the next victim to groom.

Another scenario in recruiting mules: the conman claims to be a European citizen or an American living abroad. After a few months of grooming, they’ll tell the victim about a lucrative business opportunity – like that once-in-a-lifetime contract that turned into a suitcase full of cocaine, for example.

There are investors waving money around, eager to fund the project, but they need a US bank account to receive funds, the story goes. Could the victim please open a bank account or register a limited liability company in their own name? … and then receive and send money from that account to other accounts controlled by the supposed sweetheart?

It’s not a good way to meet a lover, unless your taste runs to fellow inmates.

Protect yourself: Search that sucker’s mug

The FBI has some helpful tips to save yourself from being swindled and/or turned into a mule. One such: most crooks don’t use their own photographs online, instead stealing an image from a social media account and passing it off as their own.

You can sometimes ferret out those hoodwinks by doing a reverse image search. That will show if the photo is being used somewhere else on the internet, and on which websites. Sometimes, you’ll also find pages that have reported scams or victims associated with that image.

How to do a reverse image search on a profile photo:

• Simply right-click on the image and select “Search for image.”
• Or, right-click and select “Save image as” to save the photo to your device. Then using a search engine like Google, choose the small camera icon to upload the saved image into the search engine.

What to do if you already got snookered?

If your internet honey makes off with your money, don’t delay in reporting the crime: that will just give the crooks more time to get at your money and less time for banks to freeze the transfers. The FBI recommends taking these steps immediately:

• In the US, report the activity to the IC3, your local FBI field office, or both. Contact the IC3 at www.ic3.gov. Local FBI field offices can be found online at www.fbi.gov/contact-us/. Alternatively, call the FBI at 1-800-CALL-FBI.
• If you’re in the UK, you can report the crime to Action Fraud.
• Canadians can turn to the Anti-Fraud Centre.
• Contact your financial institution as soon as you discover any fraudulent or suspicious activity, and tell them to stop or reverse the transactions.
• Ask your bank to contact the financial institution to which the money was sent. They might be able to claw at least some of the money back. Case in point: the North Carolina county that got back at least some of the $2.5m it transferred to crooks posing as a general contractor building a new school. Time is of the essence: act fast to close the window during which the crooks can withdraw the cash or stash it in untraceable accounts.
• Report the activity to the website where you first met the scoundrel.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/_sg1QMO7X-s/