Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Ethernet, now broadc ...

 Business

At the Chaos Communication Congress late last year, researcher and radio amateur Jacek Lipkowski presented the results of his experiments involving exfiltration of data from an isolated network by means of the background electromagnetic radiation generated by network equipment. Lipkowski’s presentation may be   show more ...  

the latest, but it’s hardly the only one: New methods of exfiltrating information from computers and networks located beyond an air gap are discovered with disturbing regularity. Any wire can function as an antenna, and attackers infiltrating an isolated network and executing their code could, in theory, use such an antenna to transmit data to the outside world — they’d just have to modulate the radiation with software. Lipkowski decided to test the feasibility of using conventional Ethernet networks for that data transmission. A caveat right off the bat: The researcher mainly used the Raspberry Pi 4 model B in his experiments, but he says he is confident that the results are reproducible with other Ethernet-connected devices — or, at least, embedded ones. He used Morse code to transmit the data. It’s not the most efficient method, but it is easy to implement; any radio amateur can receive the signal with a radio and decipher the message by listening to it, making Morse code a fine option for demonstrating the vulnerability in question, which the author dubbed Etherify. Experiment 1: Modulating frequency Modern Ethernet controllers use the standardized media-independent interface (MII). The MII provides for data transmission at various frequencies depending on bandwidth: 2.5 MHz at 10 Mbit/s, 25 MHz at 100 Mbit/s, and 125 MHz at 1 Gbit/s. At the same time, network devices permit bandwidth switching and corresponding changes in frequency. Data transmission frequencies, which generate different electromagnetic radiation from the wire, are the “gear switches” that can be used for signal modulation. A simple script — using 10 Mbit/s interference as 0 and 100 Mbit/s interference as 1, say — can instruct a network controller to transmit data at one speed or another, thus, essentially, generating the dots and dashes of Morse code, which a radio receiver can easily capture from up to 100 meters away. Experiment 2: Transferring data Switching data transfer speed is not the only way to modulate a signal. Another way employs variances in background radiation from running network equipment; for example, malware on an isolated computer might use the standard networking utility for verifying connection integrity (ping -f) to load the channel with data. Transfer interruptions and resumptions will be audible from up to 30 meters away. Experiment 3: You don’t need the wire The third experiment was unplanned, but the results were still interesting. During the first test, Lipkowski forgot to connect a cable to the transmitting device, but he was still able to hear the change in the controller’s data transmission rate from about 50 meters away. That means, by and large, the data can be transferred from an isolated machine as long as the machine has a network controller, regardless of whether it is connected to a network. Most modern motherboards do have an Ethernet controller. Further experiments The Air-Fi method of data transmission is generally reproducible on office devices (laptops, routers), but with varying effectiveness. For example, the laptop network controllers Lipkowski used to try and reproduce the initial experiment established a connection a few seconds after each change in the data rate, substantially slowing the transmission of data using Morse code (although the researcher did manage to convey a simple message). The maximum distance to the equipment also depends heavily on specific models. Lipkowski continues to experiment in this field. Practical value Contrary to popular belief, isolated networks behind air gaps are used not only in top-secret laboratories and critical infrastructure facilities but also in regular businesses, which also often use isolated devices such as hardware security modules (for managing digital keys, encrypting and decrypting digital signatures, and other cryptographic needs) or dedicated isolated workstations (as local certification authorities, or CAs). If your company uses something of that kind, bear in mind the potential for information leaking from the system behind the air gap. That said, Lipkowski used a fairly inexpensive USB home receiver. Hackers endowed with significant resources can likely afford more sensitive equipment, increasing the receiving range. As far as practical measures to protect your company from such leaks, we must repeat a few obvious tips: Implement zoning and perimeter control. The closer a potential attacker can get to rooms containing isolated networks or devices, the more likely they are to intercept signals. Use metal to line any room in which critical equipment is stored, creating a Faraday cage to protect it. Shield network cables. Although not a perfect solution in theory, shielding the cables should greatly reduce the zone in which changes in electromagnetic oscillations can be received. Combined with zoning, this can provide sufficient protection. Install solutions for monitoring suspicious processes in the isolated systems. After all, attackers need to infect a computer before they can transmit its data outside. With the help of dedicated software, you can ensure critical systems remain free of malware.

image for Transatlantic Cable ...

 News

Welcome to the first episode of the Kaspersky Transatlantic Cable podcast of 2021. Unfortunately, COVID-19 is still here, but so are we (take that how you will). First, we have to pour one out for Adobe Flash. The much-maligned platform, which is almost as old as the Internet itself, has finally been put out to   show more ...  

pasture by Adobe. Please hold your applause as we take a moment of silence. From there, we turn to the world of music and a case of corporate espionage. This time, Dave and I argue about who is to blame more in this hacking and theft story involving Ticketmaster and an unnamed competitor. Now, we don’t do victim shaming here, but we do enjoy pointing out bad security operations. Our third story sits at another weird intersection — crime and the Internet of Things. In this tale, “hackers” (more likely script kiddies) are reusing leaked credentials to enlist IoT doorbells in their swatting efforts. Closing out the podcast, we stay in the IoT realm and look at an advisory from the UK’s National Cyber Security Centre on how to clean your devices before selling them or what you should do if you buy one used. If you liked the podcast, please consider subscribing and sharing with your friends. For more information on the stories that we covered, visit the links below: Adobe Flash Player is finally laid to rest Ticketmaster fined $10 million after staff hacked competitor to ‘choke off’ presale ticket business Hacked home cams used to livestream police raids in swatting attacks Erasing personal data from second-hand devices

 Companies to Watch

The funding round was led by NightDragon and global investment firm Francisco Partners. The fresh financing will be spent on supporting the company's "rapid growth" in a market it says is worth $25bn.

 Malware and Vulnerabilities

A new worm written in Golang turns Windows and Linux servers into XMRig Miner. Researchers say it may be preparing to target additional weak configured services in its future updates.

 Feed

Ubuntu Security Notice 4677-2 - USN-4677-1 fixed a vulnerability in p11-kit. This update provides the corresponding update for Ubuntu 14.04 ESM. David Cook discovered that p11-kit incorrectly handled certain memory operations. An attacker could use this issue to cause p11-kit to crash, resulting in a denial of service, or possibly execute arbitrary code. Various other issues were also addressed.

 Feed

This Metasploit module exploit BITS behavior which tries to connect to the local Windows Remote Management server (WinRM) every times it starts. The module launches a fake WinRM server which listen on port 5985 and triggers BITS. When BITS starts, it tries to authenticate to the Rogue WinRM server, which allows to   show more ...  

steal a SYSTEM token. This token is then used to launch a new process as SYSTEM user. In the case of this exploit, notepad.exe is launched as SYSTEM. Then, it writes shellcode in its previous memory space and trigger its execution. As this exploit uses reflective dll injection, it does not write any file on the disk. Vulnerable operating systems are Windows 10 and Windows servers where WinRM is not running. Lab experiments has shown that Windows 7 does not exhibit the vulnerable behavior.

 Feed

Ubuntu Security Notice 4682-1 - It was discovered that WavPack incorrectly handled certain WAV files. An attacker could possibly use this issue to execute arbitrary code or cause a crash.

 Feed

Ubuntu Security Notice 4681-1 - Ryan Hall discovered that the Intel 700 Series Ethernet Controllers driver in the Linux kernel did not properly deallocate memory in some conditions. A local attacker could use this to cause a denial of service. It was discovered that the console keyboard driver in the Linux kernel   show more ...  

contained a race condition. A local attacker could use this to expose sensitive information. Various other issues were also addressed.

 Feed

Zerologon is a vulnerability in Microsoft's Netlogon Remote Procedural Call (MS-NRPC) protocol. Specifically, this vulnerability occurs due to an incorrect implementation of the AES-128 Counter Feedback mode of operation. This vulnerability was given a CVSS score of 10 by Microsoft and can be carried out by anyone   show more ...  

with a foothold in the network. This paper aims to explain the detail and working of MS-NRPC protocol, its vulnerability, and finally cover how to exploit it, something which the original paper by Secura left out.

 Feed

Red Hat Security Advisory 2021-0028-01 - The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts are installed using a special build of Red Hat Enterprise Linux with only   show more ...  

the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Issues addressed include a buffer overflow vulnerability.

 Feed

Ubuntu Security Notice 4680-1 - It was discovered that debugfs in the Linux kernel as used by blktrace contained a use-after-free in some situations. A privileged local attacker could possibly use this to cause a denial of service. It was discovered that a race condition existed in the binder IPC implementation in the   show more ...  

Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4679-1 - It was discovered that the console keyboard driver in the Linux kernel contained a race condition. A local attacker could use this to expose sensitive information. Minh Yuan discovered that the tty driver in the Linux kernel contained race conditions when handling fonts. A local   show more ...  

attacker could possibly use this to expose sensitive information. Kiyin discovered that the perf subsystem in the Linux kernel did not properly deallocate memory in some situations. A privileged attacker could use this to cause a denial of service. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4678-1 - It was discovered that the AMD Running Average Power Limit driver in the Linux kernel did not properly restrict access to power data. A local attacker could possibly use this to expose sensitive information. Jann Horn discovered that the io_uring subsystem in the Linux kernel did not   show more ...  

properly perform reference counting in some situations. A local attacker could use this to expose sensitive information or possibly escalate privileges. Various other issues were also addressed.

 Feed

The U.S. government on Tuesday formally pointed fingers at the Russian government for orchestrating the massive SolarWinds supply chain attack that came to light early last month. "This work indicates that an Advanced Persistent Threat (APT) actor, likely Russian in origin, is responsible for most or all of the recently discovered, ongoing cyber compromises of both government and

 Feed

"Respect for your privacy is coded into our DNA," opens WhatsApp's privacy policy. "Since we started WhatsApp, we've aspired to build our Services with a set of strong privacy principles in mind." But come February 8, 2021, this opening statement will no longer find a place in the policy. The   show more ...  

Facebook-owned messaging service is alerting users in India of an update to its terms of service and 

 Feed

Cybesecurity researchers today revealed a new malspam campaign that distributes a remote access Trojan (RAT) by purporting to contain a sex scandal video of U.S. President Donald Trump. The emails, which carry with the subject line "GOOD LOAN OFFER!!," come attached with a Java archive (JAR) file called "TRUMP_SEX_SCANDAL_VIDEO.jar," which, when downloaded, installs Qua or Quaverse RAT (QRAT)

 Feed only

Graham Cluley Security News is sponsored this week by the folks at Recorded Future. Thanks to the great team there for their support! Recorded Future empowers your organization, revealing unknown threats before they impact your business, and helping your teams respond to alerts 10 times faster. How does it do this? By   show more ...  

automatically collecting and … Continue reading "Elite security intelligence at zero cost – use Recorded Future Express!"

2021-01
Aggregator history
Wednesday, January 06
FRI
SAT
SUN
MON
TUE
WED
THU
JanuaryFebruaryMarch