Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for How to glean passwor ...

 Business

In at least two of our previous posts, we touched upon the topic of side-channel attacks. These are attacks in which a certain confidential information (a password, encryption key, or just data that needs securing) is extracted in a certain non-trivial way. For example, instead of directly cracking an encryption   show more ...  

system, an attacker can reconstruct the key based on ever so slight changes in the power consumption of the device. Instead of secret data being extracted from the processor cache, it can be restored based on indirect signs: a complex chain of unsuccessful attempts to access the data runs a fraction slower or faster, suggesting the presence of a zero or one in the section of data of interest. Thats a complex example of a side-channel attack. But there are simpler variants, which well talk about today Whats the simplest attack there can be on a computer system? Shoulder surfing: when thieves steal your password by looking over your shoulder. They then enter the password and gain access to your data, without hacking any computer or software. And theres an equally simple defense against shoulder surfing: just cover the keys with your hand, or make sure theres no one behind you when you log in. But what if an attacker could steal your password after youve typed it, by reading thermal fingerprints on the keyboard? Thermal imaging and ATMs Thermal imaging attacks (aka thermal attacks) have been on researchers radars for more than 15 years. One of the earliest studies in this area explores the most common real-life scenario: attacks on ATMs. It works like this. Lets take a standard ATM keypad: A typical ATM keypad. Source. You go to an ATM, insert your card, enter your PIN, take your cash, and walk off. But unbeknown to you, an attacker sidles up to the same ATM a few moments later, and takes a picture of the keypad using a thermal imager, or thermovisor: ATM keypad captured by a thermovisor. Source. If the image is taken within 30 seconds after the PIN is entered, theres a 50% chance of recovering the sequence. The thermovisor creates an infrared image in which bright and dark areas represent high and low temperatures, respectively. The original purpose of a thermovisor is for checking a buildings walls or windows to determine where pesky drafts are coming from. And now it seems it can be harnessed to steal PINs — although its worth remembering that were talking about research here, and not (yet) about real-life attacks. Early thermovisors used to cost tens of thousands of dollars, while for some time now theyre generally priced at a few hundred dollars. And today they can vary in their level of sensitivity (ability to distinguish between small temperature differences). For example, The photo above (taken with an expensive professional device) shows not only which buttons were pressed, but in which order: the warmer the button, the later it was pressed. Using a thermovisor on an ATM keypad isnt all that simple. The image needs to be taken as soon as possible. The example above was done almost immediately after the PIN was entered. The maximum delay between input and imaging is around 90 seconds. And even then theres no guarantee of success. For example, the potential victim could be wearing gloves, so the buttons wont heat up at all. Or one – or two – of the PIN digits might be repeated, which would complicate the process. By the way, what PIN was entered in the above image, do you think? Test your own powers of deduction! The correct answer is 1485. The researchers carried out a full 54 experiments, slightly varying the parameters of each. Thermal fingerprints were analyzed both manually and with automated systems (the latter were slightly better). In about half of cases it was possible to find out the buttons pressed, but not the correct sequence. The exact PIN was recovered in less than 10% of the experiments. A four-digit code out of any of all available 11 digits gives 10,000 potential combinations. If we know all the numbers, but not the sequence, there are 24 combinations to try out. But thats still more than the number of attempts allowed: after three incorrect attempts, the bank card is often blocked. The above-mentioned 2011 study thus expanded our knowledge of thermal spying, but didnt give us any meaningful results. But it wasnt the last study… Thermal imaging and smartphones Smartphones are also susceptible to thermal attacks. This was demonstrated clearly in a 2017 study, contains this revealing image: Real PINs and patterns for smartphone unlocking, and their heat traces. Source. As before, the success of an attack depends on how quickly the thermal image is taken after input of the PIN or secret combination. Taking an image is somewhat trickier in this case, since, unlike with an ATM, folks carry their smartphones around with them. Nevertheless, its not so far-fetched to imagine a scenario where it might be possible to take an image at the right moment. By 2017, data analysis technologies had improved, and the overall success rate was higher than in the ATM experiments of 2011: up to 89% of PINs were correctly garnered through timely thermal imaging. 78% of the codes were cracked when an image was taken 30 seconds after phone was unlocked, and 22% — when researchers waited 60 seconds. Incidentally, pattern locks are harder to unravel using this method. But theres another problem with those: it was shown back in 2010 that these combinations are quite easy to guess from the finger smudges left on the screen (which stay there much longer than do thermal prints). Thermal imaging and keypads What do ATMs and smartphones have in common? Not many buttons! In both cases, were dealing with the input of short combinations of digits. To really test the possibilities of thermal spying, its best to try it out on real alphanumeric passwords entered on a real keyboard. And thats exactly what a team of researchers from University of Glasgow in Scotland did. See here for the results of their work. A full-fledged keyboard through a thermovisor looks something like this: Heat traces from pressing keys on a PC keyboard. Source. The bright dots indicate traces of key presses. This study, like others, tested the reliability of password recovery after a certain time: the thermal snapshot was taken at intervals of 20, 30, and 60 seconds. A new variable appeared in the shape of password length, which can be arbitrary. Most importantly, the researchers applied machine-learning (ML) algorithms. In experiments that involve extracting useful data from noise, these are indispensable. ML algorithms that were trained on hundreds of images of keyboards paired with known combinations have shown excellent results in recovering passwords. Below is a table summarizing their performance: How password recovery depends on the time between input and imaging, as well as on password length. Source. Surprisingly, in half of cases even a long password of 16 characters was recoverable. From the examples above, you can appreciate the complexity of recovering the sequence of key presses based on tiny temperature differences. The study has one major takeaway, which you and I know already: passwords should be long and preferably generated by special password manager software. There were also some unexpected findings. The effectiveness of the method depends on the type of plastic: some warm up less than others. And whether the keyboard is backlit is also a factor. In general, any extraneous heating of the buttons — be it from built-in LEDs or the CPU located under the keyboard in a laptop — destroys the thermal footprint. And one other point: the faster the password is entered, the less likely it is to reveal itself to thermal imaging. How realistic are these attacks? Theres no universal answer to this question. Is the data on your phone valuable enough for someone to follow you around with a thermal camera? Is such a scenario plausible? Fortunately, most people are not affected by such attacks — theyre simply too complicated. Thermal spying seems to pose the biggest threat to digital locks, which require a code to be entered; for example, at the entrance to an office building. The code in this case almost never changes, and the locks are often located in public places. A potential spy will have lots of time and plenty of attempts to guess the correct access code. In other cases, the method is doable only as part of a targeted attack on particularly valuable information. The solution, as per the usual method of defeating most side-channel attacks, is to drown the sensitive data in noise. You can enter your PIN wearing thick gloves, rendering an attack impossible. You can use a backlit keyboard, and the cybercriminals will be scratching their heads. When entering your password, you can press, or simply touch, extra keys, making it almost impossible to recover the correct sequence. 2022 saw the release of a meta-analysis of thermal attack studies, whose aim was to try to assess how realistic a threat thermal imaging attacks are. The authors reported that such attacks are both implementable and affordable — and need to be factored in when building a threat model. Were not convinced that the problem will become serious any time soon. But the meta-analysis does draw one important conclusion: a password can only be stolen if it is actually entered! So, in a roundabout way, weve arrived at the topic of password death. The threat of thermal attacks is, of course, a highly exotic reason to discard them. But just think: when your phone recognizes you by your face or fingerprint, you dont enter a password. When you use a hardware security key, you dont enter a password. A whole layer of potential attacks (and years of research) becomes irrelevant if no password is entered. Sure, alternative authentication methods have their weaknesses too, but ordinary passwords tend to have more. Modern password-less authentication systems make life almost impossible for phishers. There are many advantages to ditching traditional passwords. And now we have one more: no one will be able to sneak up on you with a thermal imaging camera and steal your secret code. That is, we repeat, if you do not enter it.

image for Patch Tuesday, Novem ...

 Time to Patch

Let’s face it: Having “2022 election” in the headline above is probably the only reason anyone might read this story today. Still, while most of us here in the United States are anxiously awaiting the results of how well we’ve patched our Democracy, it seems fitting that Microsoft Corp. today released   show more ...  

gobs of security patches for its ubiquitous Windows operating systems. November’s patch batch includes fixes for a whopping six zero-day security vulnerabilities that miscreants and malware are already exploiting in the wild. Probably the scariest of the zero-day flaws is CVE-2022-41128, a “critical” weakness in the Windows scripting languages that could be used to foist malicious software on vulnerable users who do nothing more than browse to a hacked or malicious site that exploits the weakness. Microsoft credits Google with reporting the vulnerability, which earned a CVSS score of 8.8. CVE-2022-41073 is a zero-day flaw in the Windows Print Spooler, a Windows component that Microsoft has patched mightily over the past year. Kevin Breen, director of cyber threat research at Immersive Labs, noted that the print spooler has been a popular target for vulnerabilities in the last 12 months, with this marking the 9th patch. The third zero-day Microsoft patched this month is CVE-2022-41125, which is an “elevation of privilege” vulnerability in the Windows Cryptography API: Next Generation (CNG) Key Isolation Service, a service for isolating private keys. Satnam Narang, senior staff research engineer at Tenable, said exploitation of this vulnerability could grant an attacker SYSTEM privileges. The fourth zero-day, CVE-2022-41091, was previously disclosed and widely reported on in October. It is a Security Feature Bypass of “Windows Mark of the Web” – a mechanism meant to flag files that have come from an untrusted source. The other two zero-day bugs Microsoft patched this month were for vulnerabilities being exploited in Exchange Server. News that these two Exchange flaws were being exploited in the wild surfaced in late September 2022, and many were surprised when Microsoft let October’s Patch Tuesday sail by without issuing official patches for them (the company instead issued mitigation instructions that it was forced to revise multiple times). Today’s patch batch addresses both issues. Greg Wiseman, product manager at Rapid7, said the Exchange flaw CVE-2022-41040 is a “critical” elevation of privilege vulnerability, and CVE-2022-41082 is considered Important, allowing Remote Code Execution (RCE) when PowerShell is accessible to the attacker. “Both vulnerabilities have been exploited in the wild,” Wiseman said. “Four other CVEs affecting Exchange Server have also been addressed this month. Three are rated as Important, and CVE-2022-41080 is another privilege escalation vulnerability considered Critical. Customers are advised to update their Exchange Server systems immediately, regardless of whether any previously recommended mitigation steps have been applied. The mitigation rules are no longer recommended once systems have been patched.” Adobe usually issues security updates for its products on Patch Tuesday, but it did not this month. For a closer look at the patches released by Microsoft today and indexed by severity and other metrics, check out the always-useful Patch Tuesday roundup from the SANS Internet Storm Center. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: AskWoody.com usually has the lowdown on any patches that may be causing problems for Windows users. As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.

 Malware and Vulnerabilities

Cyble took the wraps off of a phishing campaign aimed at South Korean mobile users through a fake Google Play Store page to deliver Fakecalls Android malware. The malware is designed to steal sensitive details from victims’ Android devices, including contact details, call logs, SMS, and network operator and device location. 

 Trends, Reports, Analysis

Cybersecurity researchers continue to discover new software supply chain attacks resulting from Python Package Index (PyPI). Some PyPI packages were injected with W4SP Stealer with the aim of infecting developers’ machines. All in all, these malicious packages were downloaded more than 5,700 times

 Incident Response, Learnings

A Nigerian influencer who attracted millions of followers on Instagram by showing off luxury cars and high-end clothing was sentenced on Monday to 11 years in prison for his role in business email compromise schemes and money laundering.

 Breaches and Incidents

Justice Blade threat actor released data from outsourcing IT vendor Smart Link BPO Solutions. The vendor works with relatively bigger organizations and government agencies in the Kingdom of Saudi Arabia and other countries in the GCC. It is said that cybercriminals may have stolen CRM records, personal information, contracts, account credentials, and email communications.

 Malware and Vulnerabilities

A LockBit 3.0 ransomware operator has been observed dropping the Amadey Bot to take control of a device and encrypt devices via phishing emails. In October, the ASEC analysis team identified Amadey Bot masquerading as a popular Korean messenger program. In July, a new version of Amadey was found spreading via a SmokeLoader campaign. 

 Govt., Critical Infrastructure

The U.S. Department of Defense’s zero-trust strategy will be published in the coming days, giving the public a fresh look at its plan to achieve a new level of cybersecurity.

 Feed

Ubuntu Security Notice 5719-1 - It was discovered that OpenJDK incorrectly handled long client hostnames. An attacker could possibly use this issue to cause the corruption of sensitive information. It was discovered that OpenJDK incorrectly randomized DNS port numbers. A remote attacker could possibly use this issue   show more ...  

to perform spoofing attacks. It was discovered that OpenJDK did not limit the number of connections accepted from HTTP clients. An attacker could possibly use this issue to cause a denial of service.

 Feed

Ubuntu Security Notice 5720-1 - It was discovered that Zstandard was not properly managing file permissions when generating output files. A local attacker could possibly use this issue to cause a race condition and gain unauthorized access to sensitive data.

 Feed

Red Hat Security Advisory 2022-7885-01 - The kpatch management tool provides a kernel patching infrastructure which allows you to patch a running kernel without rebooting or restarting any processes. Issues addressed include privilege escalation and use-after-free vulnerabilities.

 Feed

Red Hat Security Advisory 2022-7887-01 - The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Issues addressed include a buffer overflow vulnerability.

 Feed

Ubuntu Security Notice 5717-1 - It was discovered that PHP incorrectly handled certain gzip files. An attacker could possibly use this issue to cause a denial of service. It was discovered that PHP incorrectly handled certain cookies. An attacker could possibly use this issue to compromise the data It was discovered   show more ...  

that PHP incorrectly handled certain image fonts. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.10, and Ubuntu 22.04 LTS.

 Feed

Debian Linux Security Advisory 5274-1 - Jihwan Kim and Dohyun Lee discovered that visiting a malicious website may lead to user interface spoofing. Dohyun Lee discovered that processing maliciously crafted web content may lead to arbitrary code execution. Abdulrahman Alqabandi, Ryan Shin and Dohyun Lee discovered that processing maliciously crafted web content may disclose sensitive user information.

 Feed

Debian Linux Security Advisory 5273-1 - Jihwan Kim and Dohyun Lee discovered that visiting a malicious website may lead to user interface spoofing. Dohyun Lee discovered that processing maliciously crafted web content may lead to arbitrary code execution. Abdulrahman Alqabandi, Ryan Shin and Dohyun Lee discovered that processing maliciously crafted web content may disclose sensitive user information.

 Feed

Ubuntu Security Notice 5718-1 - Maddie Stone discovered that pixman incorrectly handled certain memory operations. A remote attacker could use this issue to cause pixman to crash, resulting in a denial of service, or possibly execute arbitrary code.

 Feed

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek has successfully bridged   show more ...  

the traditional gap between academia and operations since its inception. Today, it is relied upon operationally in particular by many scientific environments for securing their cyber-infrastructure. Zeek's user community includes major universities, research labs, supercomputing centers, and open-science communities. This is the source code release.

 Feed

Red Hat Security Advisory 2022-7896-01 - Debezium is a distributed platform that turns your existing databases into event streams, so applications can see and respond immediately to each row-level change in the databases. Debezium is built on top of Apache Kafka and provides Kafka Connect compatible connectors that   show more ...  

monitor specific database management systems. Debezium records the history of data changes in Kafka logs, from where your application consumes them. This makes it possible for your application to easily consume all of the events correctly and completely. Even if your application stops unexpectedly, it will not miss anything: when the application restarts, it will resume consuming the events where it left off. Issues addressed include a denial of service vulnerability.

 Feed

VMware has patched five security flaws affecting its Workspace ONE Assist solution, some of which could be exploited to bypass authentication and obtain elevated permissions. Topping the list, are three critical vulnerabilities tracked as CVE-2022-31685, CVE-2022-31686, and CVE-2022-31687. All the shortcomings are rated 9.8 on the CVSS vulnerability scoring system. CVE-2022-31685 is an

 Feed

Microsoft's latest round of monthly security updates has been released with fixes for 68 vulnerabilities spanning its software portfolio, including patches for six actively exploited zero-days. 12 of the issues are rated Critical, two are rated High, and 55 are rated Important in severity. This also includes the weaknesses that were closed out by OpenSSL the previous week. Also separately 

 Feed

The Russia-linked APT29 nation-state actor has been found leveraging a "lesser-known" Windows feature called Credential Roaming as part of its attack against an unnamed European diplomatic entity. "The diplomatic-centric targeting is consistent with Russian strategic priorities as well as historic APT29 targeting," Mandiant researcher Thibault Van Geluwe de Berlaere said in a technical write-up.

 Feed

A number of phishing campaigns are leveraging the decentralized Interplanetary Filesystem (IPFS) network to host malware, phishing kit infrastructure, and facilitate other attacks. "Multiple malware families are currently being hosted within IPFS and retrieved during the initial stages of malware attacks," Cisco Talos researcher Edmund Brumaghin said in an analysis shared with The Hacker News.

 Feed

The Keksec threat actor has been linked to a previously undocumented malware strain, which has been observed in the wild masquerading as an extension for Chromium-based web browsers to enslave compromised machines into a botnet. Called Cloud9 by security firm Zimperium, the malicious browser add-on comes with a wide range of features that enables it to siphon cookies, log keystrokes, inject

 Feed

There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business.  Why so? Because these myths are widening your security gaps. This is making it easier for attackers to abuse APIs. And API attacks are costly. Of course, you will have to bear financial losses. But there are other consequences too:  Reputational damage  Customer attrition

 Feed

An updated version of a malware loader codenamed IceXLoader is suspected of having compromised thousands of personal and enterprise Windows machines across the world. IceXLoader is a commodity malware that's sold for $118 on underground forums for a lifetime license. It's chiefly employed to download and execute additional malware on breached hosts. This past June, Fortinet FortiGuard Labs said

2022-11
Aggregator history
Wednesday, November 09
TUE
WED
THU
FRI
SAT
SUN
MON
NovemberDecemberJanuary