Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for How else to detect h ...

 Privacy

In 2019, when a survey was carried out among travelers who make use of short-term rentals, 11% of participants said theyd found surveillance cameras in their rented accommodation. Moreover, about two-thirds of those surveyed worry that unscrupulous apartment owners may use hidden cameras. Just recently, we wrote about   show more ...  

how Apple AirTags can be used to stalk people and steal cars. The problem of covert filming in rental accommodation is similar in nature — the deployment of seemingly useful devices for nefarious purposes. The issue of covert surveillance isnt likely to go away soon; rather — just the opposite. First, a simple wireless video camera that transmits real-time data over Wi-Fi can be purchased for peanuts. Second, modern technology has advanced to the level where even cheap spy devices have become quite miniature and easy to hide amid an interior. There are several ways to find hidden cameras; the easiest of which is to scan a room in the dark with a phone camera to identify video cameras with an infrared light source (go here to read about this and other detection methods). However, the effectiveness of these methods leaves much to be desired, and the demand for more reliable ways to detect spy devices increases as they proliferate. Therefore, attempts are constantly being made to create more hi-tech anti-spy technologies. The most advanced system was recently proposed by researchers at Carnegie Mellon University in the U.S. They found a way that potentially allows anyone to detect hidden IoT devices in a rented room using a smartphone app. App-based spy detection The authors of the paper decided to implement the following scenario. The test guests are given the keys to a rented apartment. After checking in, they open the special Lumos app on their smartphone and wait for about half an hour. Then they walk around the perimeter of each room holding the phone, which determines the coordinates of detected transmitters. After that, the app not only shows a list of detected smart devices, but also indicates their location. IoT devices are displayed in augmented reality (AR): information about the location of smart devices is superimposed on the image from the phones camera. The researchers made a demo video of the app: Looks neat, but how does it work? The researchers assume that a typical landlord who rents out an apartment through Airbnb or a similar service will not spend time installing really sophisticated spy devices — this is both costly and, in most cases, redundant. Instead, theyre more likely to buy something cheap and simple from the local store. Its not hard to make a rough list of devices that could potentially be a privacy threat. The most obvious of them is a video camera that transmits image and sound over Wi-Fi. It might also be a smart speaker configured to constantly eavesdrop on conversations, a smart TV, or even a specialized security system — but home-grade, like Amazon Ring. Because all Wi-Fi-connected devices operate in a common frequency band they must coordinate data transmission with each other. Based on such open information, Lumos can find nearby wireless devices, identify their type (telling a webcam from a smart light bulb, for example), and even give an approximate location with an accuracy of 1.5 meters. The spy device detection system adds an AR visual aid to the smartphones camera image to indicate the presence of a wireless camera nearby. Source Lumos in detail Some of you are probably already thinking: Enough chit-chat, where can I download the thing?! Unfortunately, you cant for now. Whats more, in the prototypes it proved impossible to implement all the functionality using smartphones alone. Thats because Lumos has slightly higher requirements than typical smartphone Wi-Fi capabilities: its not enough for the system to simply connect to an access point and communicate only through that. Instead, Lumos has to scan all data packets transmitted over the air from all devices nearby. But the ability to sniff the airwaves is blocked in all smartphones. Theoretically, it can be done on a rooted Android device (that is, one on which the owner has superuser rights that give full access to the system), but the researchers went in a different direction. They built two test systems, the first consisting of a smartphone with a Raspberry Pi microcomputer connected to it, and the second being a laptop with a special camera. In the first case, the Raspberry Pi listened to the Wi-Fi transmission; in the second, the laptop did (such functionality is easier to implement on a full-fledged computer than on a smartphone). Accordingly, either the smartphone camera or the AR camera connected to the laptop was used for visual detection of hidden devices. How to find hidden Wi-Fi devices in an untrusted environment using your phone] Source Next, the researchers applied the technology that determines the type of device by its behavior. A simple example: a smart light switch might access the server once a minute and not show itself in any other way, while a webcam transmits streams of data and does so continuously. Using more than 50 such features and machine learning, the authors of the paper created digital fingerprints of typical IoT devices. As a result, theres no need to maintain and constantly update a database of suspicious devices in the app — Lumos will likely spot a Wi-Fi camera in your room by its characteristic behavior when transferring data, even if it has not seen the particular model before. Another example from the Lumos demo video: finding a smart speaker. Source Searching for IoT devices in augmented reality The most eye-catching part of the study is the information superimposed over the image from the smartphone camera. Lumos uses AR technology to embed virtual objects in the image of the real environment sent to the phones display from the camera. The approximate coordinates of located devices were overlaid on the image from the phones camera on an Apple smartphone using the standard ARKit library. This library uses various sensors of the phone to create a 3D model of the room. Along the way, the location of hidden connected devices is also determined. For this, the researchers used another feature of the Wi-Fi module: the continuous measuring of signal strength from both the nearest access point and other wireless modules. Hence, by walking around the premises, measuring the signal level at different points, and performing some not overly complicated calculations, the app can determine the position of hidden devices in the room. Indoor Wi-Fi device search map based on signal strength. Source Implementation difficulties We must stress again that this is scientific research — not the development of a commercial product; the authors are not trying to sell us anything. So its all the more interesting that theyve put together a full-fledged spy-device detection system, rather than just show a part of it and leave the reader to fill in the blanks. And the results are quite encouraging: The accuracy of determining device type was 95–98%. The chance of error is small. The location of IoT devices is determined with an accuracy of 1.5 meters — narrowing down the search area enough to find a hidden camera visually. The time it takes to discover nearby IoT devices is 30 minutes. For 27 of these minutes, the smartphone just lies there collecting data packets sent by surrounding devices. For the remaining three, the user has to walk around the room to determine the coordinates of the detected transmitters. This means that the system really may help uncover unpleasant surprises in rented accommodation or in a hotel. But there are limitations. Weve already noted the inability of a regular smartphone to scan the entirety of Wi-Fi traffic. Its unlikely that manufacturers will do anything about this any time soon. In addition, there are now lots of Wi-Fi devices in every home, and radio waves are quite good at passing through walls, especially if those arent made of reinforced concrete. This means you might accidentally find a camera installed in the neighbors place, or even on the outer wall of the building — and then falsely accuse the landlord of spying. And then, of course, attempts to detect a hidden camera are futile if the apartment owner/cybercriminal uses a wired connection or records the footage in the old-fashioned way to a flash drive. All this means that were unlikely to see commercial implementation of Lumos in the foreseeable future. Its too hackerish for that — any commercial company that took on the development would face a mountain of issues and complaints, both from users (a camera was there, but wasnt detected) and property owners (a camera wasnt there, but the app said otherwise). If it does get developed, itd most likely be a plaything for techies. It may even be necessary to buy a specially modified smartphone for it. However, should this less-than-ideal scenario arise, the system may well be free (not counting the price of this special smartphone), since the authors of the paper promise to make the prototype source code freely available.

image for Experian, You Have S ...

 A Little Sunshine

Twice in the past month KrebsOnSecurity has heard from readers who’ve had their accounts at big-three credit bureau Experian hacked and updated with a new email address that wasn’t theirs. In both cases the readers used password managers to select strong, unique passwords for their Experian accounts.   show more ...  

Research suggests identity thieves were able to hijack the accounts simply by signing up for new accounts at Experian using the victim’s personal information and a different email address. John Turner is a software engineer based in Salt Lake City. Turner said he created the account at Experian in 2020 to place a security freeze on his credit file, and that he used a password manager to select and store a strong, unique password for his Experian account. Turner said that in early June 2022 he received an email from Experian saying the email address on his account had been changed. Experian’s password reset process was useless at that point because any password reset links would be sent to the new (impostor’s) email address. An Experian support person Turner reached via phone after a lengthy hold time asked for his Social Security Number (SSN) and date of birth, as well as his account PIN and answers to his secret questions. But the PIN and secret questions had already been changed by whoever re-signed up as him at Experian. “I was able to answer the credit report questions successfully, which authenticated me to their system,” Turner said. “At that point, the representative read me the current stored security questions and PIN, and they were definitely not things I would have used.” Turner said he was able to regain control over his Experian account by creating a new account. But now he’s wondering what else he could do to prevent another account compromise. That’s because Experian does not offer any type of multi-factor authentication options on consumer accounts. “The most frustrating part of this whole thing is that I received multiple ‘here’s your login information’ emails later that I attributed to the original attackers coming back and attempting to use the ‘forgot email/username’ flow, likely using my SSN and DOB, but it didn’t go to their email that they were expecting,” Turner said. “Given that Experian doesn’t support two-factor authentication of any kind — and that I don’t know how they were able to get access to my account in the first place — I’ve felt very helpless ever since.” To be clear, Experian does have a business unit that sells one-time password services to businesses. But it does not offer this directly to consumers who sign up to manage their credit file at Experian’s website. Arthur Rishi is a musician and co-executive director of the Boston Landmarks Orchestra. Rishi said he recently discovered his Experian account had been hijacked after receiving an alert from his credit monitoring service (not Experian’s) that someone had tried to open an account in his name at JPMorgan Chase. Rishi said the alert surprised him because his credit file at Experian was frozen at the time, and Experian did not notify him about any activity on his account. Rishi said Chase agreed to cancel the unauthorized account application, and even rescinded its credit inquiry (each credit pull can ding your credit score slightly). But he never could get anyone from Experian’s support to answer the phone, despite spending what seemed like eternity trying to progress through the company’s phone-based system. That’s when Rishi decided to see if he could create a new account for himself at Experian. “I was able to open a new account at Experian starting from scratch, using my SSN, date of birth and answering some really basic questions, like what kind of car did you take out a loan for, or what city did you used to live in,’ Rishi said. Upon completing the sign-up, Rishi noticed that his credit was unfrozen. Like Turner, Rishi is now worried that identity thieves will just hijack his Experian account once more, and that there is nothing he can do to prevent such a scenario. For now, Rishi has decided to pay Experian $25.99 a month to more closely monitor his account for suspicious activity. Even using the paid Experian service, there were no additional multi-factor authentication options available, although he said Experian did send a one-time code to his phone via SMS recently when he logged on. “Experian now sometimes does require MFA for me now if I use a new browser or have my VPN on,” Rishi said, but he’s not sure if Experian’s free service would have operated differently. “I get so angry when I think about all this,” he said. “I have no confidence this won’t happen again.” In a written statement, Experian suggested that what happened to Rishi and Turner was not a normal occurrence, and that its security and identity verification practices extend beyond what is visible to the user. “We believe these are isolated incidents of fraud using stolen consumer information,” Experian’s statement reads. “Specific to your question, once an Experian account is created, if someone attempts to create a second Experian account, our systems will notify the original email on file.” “We go beyond reliance on personally identifiable information (PII) or a consumer’s ability to answer knowledge-based authentication questions to access our systems,” the statement continues. “We do not disclose additional processes for obvious security reasons; however, our data and analytical capabilities verify identity elements across multiple data sources and are not visible to the consumer. This is designed to create a more positive experience for our consumers and to provide additional layers of protection. We take consumer privacy and security seriously, and we continually review our security processes to guard against constant and evolving threats posed by fraudsters.” ANALYSIS KrebsOnSecurity sought to replicate Turner and Rishi’s experience — to see if Experian would allow me to re-create my account using my personal information but a different email address. The experiment was done from a different computer and Internet address than the one that created the original account years ago. After providing my Social Security Number (SSN), date of birth, and answering several multiple choice questions whose answers are derived almost entirely from public records, Experian promptly changed the email address associated with my credit file. It did so without first confirming that new email address could respond to messages, or that the previous email address approved the change. Experian’s system then sent an automated message to the original email address on file, saying the account’s email address had been changed. The only recourse Experian offered in the alert was to sign in, or send an email to an Experian inbox that replies with the message, “this email address is no longer monitored.” After that, Experian prompted me to select new secret questions and answers, as well as a new account PIN — effectively erasing the account’s previously chosen PIN and recovery questions. Once I’d changed the PIN and security questions, Experian’s site helpfully reminded me that I have a security freeze on file, and would I like to remove or temporarily lift the security freeze? How does Experian differ from the practices of Equifax and TransUnion, the other two big consumer credit reporting bureaus? When KrebsOnSecurity tried to re-create an existing account at TransUnion using my Social Security number, TransUnion rejected the application, noting that I already had an account and prompting me to proceed through its lost password flow. The company also appears to send an email to the address on file asking to validate account changes. Likewise, trying to recreate an existing account at Equifax using personal information tied to my existing account prompts Equifax’s systems to report that I already have an account, and to use their password reset process (which involves sending a verification email to the address on file). KrebsOnSecurity has long urged readers in the United States to place a security freeze on their files with the three major credit bureaus. With a freeze in place, potential creditors can’t pull your credit file, which makes it very unlikely anyone will be granted new lines of credit in your name. I’ve also advised readers to plant their flag at the three major bureaus, to prevent identity thieves from creating an account for you and assuming control over your identity. The experiences of Rishi, Turner and this author suggest Experian’s practices currently undermine both of those proactive security measures. Even so, having an active account at Experian may be the only way you find out when crooks have assumed your identity. Because at least then you should receive an email from Experian saying they gave your identity to someone else. In April 2021, KrebsOnSecurity revealed how identity thieves were exploiting lax authentication on Experian’s PIN retrieval page to unfreeze consumer credit files. In those cases, Experian failed to send any notice via email when a freeze PIN was retrieved, nor did it require the PIN to be sent to an email address already associated with the consumer’s account. A few days after that April 2021 story, KrebsOnSecurity broke the news that an Experian API was exposing the credit scores of most Americans. Emory Roan, policy counsel for the Privacy Rights Clearinghouse, said Experian not offering multi-factor authentication for consumer accounts is inexcusable in 2022. “They compound the problem by gating the recovery process with information that’s likely available or inferable from third party data brokers, or that could have been exposed in previous data breaches,” Roan said. “Experian is one of the largest Consumer Reporting Agencies in the country, trusted as one of the few essential players in a credit system Americans are forced to be part of. For them to not offer consumers some form of (free) MFA is baffling and reflects extremely poorly on Experian.” Nicholas Weaver, a researcher for the International Computer Science Institute at University of California, Berkeley, said Experian has no real incentive to do things right on the consumer side of its business. That is, he said, unless Experian’s customers — banks and other lenders — choose to vote with their feet because too many people with frozen credit files are having to deal with unauthorized applications for new credit. “The actual customers of the credit service don’t realize how much worse Experian is, and this isn’t the first time Experian has screwed up horribly,” Weaver said. “Experian is part of a triopoly, and I’m sure this is costing their actual customers money, because if you have a credit freeze that gets lifted and somebody loans against it, it’s the lender who eats that fraud cost.” And unlike consumers, he said, lenders do have a choice in which of the triopoly handles their credit checks. “I do think it’s important to point out that their real customers do have a choice, and they should switch to TransUnion and Equifax,” he added. More greatest hits from Experian: 2017: Experian Site Can Give Anyone Your Credit Freeze PIN 2015: Experian Breach Affects 15 Million Customers 2015: Experian Breach Tied to NY-NJ ID Theft Ring 2015: At Experian, Security Attrition Amid Acquisitions 2015: Experian Hit With Class Action Over ID Theft Service 2014: Experian Lapse Allowed ID Theft Service Access to 200 Million Consumer Records 2013: Experian Sold Consumer Data to ID Theft Service

 Security Products & Services

The software giant announced the change in February 2022 with a post that explained how macros written with Visual Basic for Applications are powerful, but offer a way for criminals to drop malicious payloads onto the desktop.

 Identity Theft, Fraud, Scams

Check Point warns against shopping scams as it observed a 37% increase in Amazon-related phishing attacks since the start of July, in the light of Amazon Prime Day 2022. In the weeks leading up to Amazon Prime Day last year, 2,303 new domains related to Amazon were discovered, and 78% of them were deemed hazardous.   show more ...  

Users are advised to check for misspellings of Amazon's site and avoid any malpractices to obtain higher discounts.

 Malware and Vulnerabilities

Fake copyright infringement complaints are targeting website owners to disseminate the IcedID, BumbleBee, and BazarLoader malware, using Yandex Forms. For a year, a threat group named TA578 has been carrying out these attacks where the attackers used a contact page of the website to send legal warnings to   show more ...  

people. Individuals are suggested to always stay vigilant whenever receiving such messages from unknown sources. 

 Breaches and Incidents

The recent data breach of PFC USA, which affected 657 healthcare entities, was the work of Quantum ransomware. The gang is related to Conti and moves laterally using Cobalt Strike. An investigation revealed that the attackers accessed files containing personal information such as names, addresses, accounts receivable balance, and payments made to accounts.

 Malware and Vulnerabilities

A security advisory for a flaw issued by MITRE was found inadvertently exposing links to remote admin consoles of several vulnerable IP devices, since at least April. The original source of the security mishap was a security writeup posted by Chinese security researchers on GitHub, where vulnerable links were added as examples in that write-up.

 Malware and Vulnerabilities

A new, undetected Linux malware, OrBit, was found to implement sophisticated evasion techniques and persistence on the compromised system, enabling attackers to gain remote access. OrBit is the fourth Linux malware that surfaced in the past three months. Leveraging threat intel services that bring you first-hand   show more ...  

information to identify new types of threats and understand their severity is recommended. Mitigation can be planned accordingly.

 Trends, Reports, Analysis

Many companies implementing MFA still seem to have done so haphazardly. Only 39% of those who offer MFA have a process for prioritizing critical hardware, software, and data, with 49% merely “encouraging the use of MFA when it is available.”

 Trends, Reports, Analysis

In terms of topics and techniques, text-based fraud campaigns can be divided into several types, including dating scams, 491 scams, blackmailing and extortion, and voice phishing attacks.

 Malware and Vulnerabilities

LockBit is one of the most prominent RaaS operations, which has constantly evolved since its emergence in 2019. In Q1 2022, LockBit accounted for 40% of ransomware attacks against the financial sector.

 Incident Response, Learnings

The data was exposed to the world from a non-password-protected web dashboard. And that public-facing Kibana-powered site had been left open since the end of 2020, according to LeakIX, a website that tracks exposed databases online.

 Expert Blogs and Opinion

Programming languages (and their assorted libraries) are not immune to security vulnerabilities. When these vulnerabilities do come up, a language version upgrade can be forced on you by the developers.

 Malware and Vulnerabilities

The new PennyWise infostealer can target over 30 browsers and cryptocurrency apps, including crypto browser extensions and cold crypto wallets. It pretends to be a Bitcoin mining app on YouTube. The malware detects a browser and extracts information saved on it, including login credentials, cookies, encryption keys, and master passwords.

 Trends, Reports, Analysis

A new study from Juniper Research suggests that total losses to online payment fraud will exceed $343 billion globally over the next five years, driven largely by fraudster innovation in areas such as account takeover fraud and identity theft.

 Feed

Ubuntu Security Notice 5507-1 - It was discovered that Vim incorrectly handled memory access. An attacker could potentially use this issue to cause the program to crash, use unexpected values, or execute arbitrary code. It was discovered that Vim incorrectly handled memory access. An attacker could potentially use this issue to cause the corruption of sensitive information, a crash, or arbitrary code execution.

 Feed

Ubuntu Security Notice 5479-3 - USN-5479-1 fixed vulnerabilities in PHP. Unfortunately that update for CVE-2022-31625 was incomplete for Ubuntu 18.04 LTS. This update fixes the problem. Charles Fol discovered that PHP incorrectly handled initializing certain arrays when handling the pg_query_params function. A remote   show more ...  

attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. Charles Fol discovered that PHP incorrectly handled passwords in mysqlnd. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 5506-1 - Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7 sequence. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. Ronald Crane discovered   show more ...  

that NSS incorrectly handled certain memory operations. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.

 Feed

GnuPG (the GNU Privacy Guard or GPG) is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such, it is meant   show more ...  

to be compatible with PGP from NAI, Inc. Because it does not use any patented algorithms, it can be used without any restrictions.

 Feed

GnuPG (the GNU Privacy Guard or GPG) is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such, it is meant   show more ...  

to be compatible with PGP from NAI, Inc. Because it does not use any patented algorithms, it can be used without any restrictions. This is the LTS release.

 Feed

Sysdig Falco is a behavioral activity monitoring agent that is open source and comes with native support for containers. Falco lets you define highly granular rules to check for activities involving file and network activity, process execution, IPC, and much more, using a flexible syntax. Falco will notify you when these rules are violated. You can think about falco as a mix between snort, ossec and strace.

 Feed

Sashimi Evil OctoBot Tentacle is a python script that exploits a vulnerability that lies in the Tentacles upload functionality of the cryptocurrency trading bot OctoBot which is designed to be easy to use and customizable. Versions 0.4.0beta3 through 0.4.3 are affected.

 Feed

Xen's _get_page_type() contains an ABAC cmpxchg() race, where the code incorrectly assumes that if it reads a specific type_info value, and then later cmpxchg() succeeds, the type_info can't have changed in between.

 Feed

The $540 million hack of Axie Infinity's Ronin Bridge in late March 2022 was the consequence of one of its former employees getting tricked by a fraudulent job offer on LinkedIn, it has emerged.  According to a report from The Block published last week citing two people familiar with the matter, a senior engineer at the company was duped into applying for a job at a non-existent company, causing

 Feed

The maintainers of the official third-party software repository for Python have begun imposing a new two-factor authentication (2FA) condition for projects deemed "critical." "We've begun rolling out a 2FA requirement: soon, maintainers of critical projects must have 2FA enabled to publish, update, or modify them," Python Package Index (PyPI) said in a tweet last week. "Any maintainer of a

 Feed

It's not a new concept that Office 365, Salesforce, Slack, Google Workspace or Zoom, etc., are amazing for enabling the hybrid workforce and hyper-productivity in businesses today. However, there are three main challenges that have arisen stemming from this evolution: (1) While SaaS apps include a host of native security settings, they need to be hardened by the security team of the organization

 Feed

GitHub Actions and Azure virtual machines (VMs) are being leveraged for cloud-based cryptocurrency mining, indicating sustained attempts on the part of malicious actors to target cloud resources for illicit purposes. "Attackers can abuse the runners or servers provided by GitHub to run an organization's pipelines and automation by maliciously downloading and installing their own cryptocurrency

2022-07
Aggregator history
Monday, July 11
FRI
SAT
SUN
MON
TUE
WED
THU
JulyAugustSeptember