Oktacron - Cyber Security RSS Feeds History

Wi-Peep: locating Wi-Fi devices | Kaspersky official blog

kaspersky Dec 16, 2022 Business

In November 2022, researchers at universities in the U.S. and Canada demonstrated a method of Wi-Fi device localization using inexpensive and easy-to-find equipment. The attack proof-of-concept was dubbed Wi-Peep, as it can be used to peep on devices communicating with each other via Wi-Fi. The research offers new show more ...

insight into certain features of Wi-Fi networks, and the potential risks of device-localization. We should start by saying that the risks arent too high — an attack looks like something out of a Bond movie. But that doesnt make the research any less interesting. Wi-Peep attack features Before looking at the report in detail, lets consider a real-life attack. Attackers fly a mini-quadcopter with the most inexpensive microcomputer on board around a target building, collecting data to obtain a map of wireless devices inside with reasonable accuracy (±1.5 meters under ideal conditions). But why would they? Well, lets imagine its a bank or a top-secret laboratory whose security systems are equipped with Wi-Fi modules. And theres your why: their location could be of huge practical interest to attackers planning physical penetration. Simplified Wi-Peep attack scheme. Source. So how do researchers imitate something like that? The Wi-Peep attack exploits two important features of absolutely any Wi-Fi device, from ancient wireless modules from 20 years ago to the most modern. The first is the power-saving mechanism in Wi-Fi devices. The Wi-Fi module, say, in a smartphone can preserve battery by shutting down the wireless receiver for short periods of time. A wireless access point needs to consider this mode of operation: your router can accumulate data packets for a specific device, then transmit them all at once when it signals its ready again to receive a transmission. For a successful attack, a potential spy would need to obtain a list of MAC addresses — unique device IDs whose locations would be determined later. Devices in the same home, office, or hotel are usually connected to a shared Wi-Fi network, the name of which is no secret. It turned out that its possible to send a fake data packet, ostensibly from this shared wireless network, informing all connected devices that the access-point buffer has accumulated some data destined for them. In reply to this signal, the devices send responses which, when analyzed, reveal the unique MAC addresses of all network devices almost instantly. But theres a simpler way: eavesdrop on wireless radio traffic; however, this takes more time: according to the researchers you need to accumulate data in passive mode for 12 hours. The second exploitable feature of wireless data exchange was provisionally named Wi-Fi Polite. That name was assigned by the authors of an earlier 2020 study. In a nutshell, the essence of the feature is this: a wireless device always responds to an address request from another device, even if theyre not connected to a shared Wi-Fi network, and even if the request isnt encrypted or is malformed. In response, the Wi-Fi module sends a simple confirmation (Data from you received), but that turns out to be sufficient to determine the distance to the responding device. The response time for receipt of such a packet is strictly regulated, and is 10 microseconds. A potential attacker can measure the time between sending a request and receiving a response, subtract those 10 microseconds, and get the time taken for the radio signal to reach the device. What does that give? Moving around a stationary wireless device, we can determine its coordinates with a fairly high degree of accuracy, knowing our own location and the distance to the object of interest. Much of the research is devoted to overcoming the many difficulties of this method. The signal from the Wi-Fi radio transmitter is constantly reflected by walls and other obstacles, making it difficult to calculate the distance. In fact, that standardized response time should be 10 microseconds, but it actually varies from device to device — ranging from 8 to 13 microseconds. The geolocation accuracy of the attackers Wi-Fi module itself also has an effect: it turns out that even the precision of geopositioning systems (GPS, GLONASS, etc.) isnt always enough. Although the resulting data contains a lot of noise, if enough measurements are made, relatively high accuracy can be achieved. That means if you make tens of thousands of readings, you get a positioning accuracy with an error in the range of 1.26 to 2.30 meters — on the horizontal plane. On the vertical, the researchers were able to determine the exact floor in 91% of cases, but nothing more. Low-cost sophisticated attack Although the system for determining the coordinates of wireless devices turned out to be not very accurate, its still of interest — not least because the equipment used by the researchers is dirt-cheap. Theoretically, an attack can be carried out by a potential spy in person, simply by slowly walking around the target object. For added convenience, the researchers used a cheap quadcopter fitted with a microcomputer based on the ESP32 chipset and a wireless module. The total cost of this reconnaissance kit (excluding the cost of the quadcopter) is less than US$20! Whats more, the attack is virtually impossible to trace on the victims device. It uses the standard capabilities of Wi-Fi modules, which cannot be disabled or at least modified in terms of behavior. If communication between the victims device and the attackers microcomputer is possible in principle, the attack will work. The practical range of data transmission over Wi-Fi is tens of meters, which in most cases will suffice. Fuzzy implications If we assume the attack is doable in real life, is the data obtained of any use? The researchers propose several scenarios. First and most obviously, if we know the MAC address of the smartphone of a specific individual, we can roughly track their movements in public places. This is possible even if their smartphone is not connected to any wireless networks at the time of the attack. Second, creating a map of wireless devices in a secure building (a competitors office, bank premises) for a subsequent physical attack is an entirely realistic scenario. For example, attackers can determine the approximate location of surveillance cameras if these use Wi-Fi for data transmission. There are also less obvious benefits from collecting such data. You could, for instance, collect information about the number of Wi-Fi devices in a hotel to estimate how many guests there are. Such data may be of interest to competitors. Or, knowing the number of wireless devices could help determine if potential victims are at home. Even the MAC addresses themselves — without coordinates — are of some use: for collecting statistics about smartphone usage in a public place. In addition to spying and burglary, such methods are a threat to peoples privacy. However, the immediate risk of such a method being deployed in practice is still quite low. This applies to all potential attacks and data collection methods for which you have to get close to the target object. Its quite labor-intensive for one thing, meaning that few would do it on a mass scale, and for targeted attacks — other methods may be more effective. At the same time, scientific research helps to understand how minor features of complex technologies can be harnessed for malicious purposes. The researchers themselves note that the real benefit of their work will be if this small security and privacy risk is eliminated in future versions of wireless data transmission technologies. For the time being, all we can recommend is to use an anti-drone system. It wont help against Wi-Peep, but it will at least guard against being spied on from the air.

NIST Finally Retires SHA-1, Kind Of

darkreading Dec 16, 2022 Feed

SHA-1 was deprecated in 2011. NIST has set the hashing algorithm's final retirement date to Dec. 31, 2030.

Cyber Threats Loom as 5B People Prepare to Watch World Cup Final

darkreading Dec 16, 2022 Feed

The 2022 FIFA Men's World Cup final in Qatar will be the most-watched sporting event in history — but will cybercriminals score a hat trick off its state-of-the-art digital footprint?

Researcher Bypasses Akamai WAF

darkreading Dec 16, 2022 Feed

Patched several months ago, researcher reports how they used Spring Boot to sneak past Akamai's firewall and remotely execute code.

New Botnet Targeting Minecraft Servers Poses Potential Enterprise Threat

darkreading Dec 16, 2022 Feed

Microsoft warns enterprises should pay attention to a new botnet used to launch DDoS attacks on private Minecraft Java servers.

Chinese APT Group MirrorFace Interferes in Japanese Elections

darkreading Dec 16, 2022 Feed

The MirrorFace group has deployed popular malware LodeInfo for spying and data theft against certain members of the Japanese House of Representatives.

Iran-Backed Charming Kitten APT Eyes Kinetic Ops, Kidnapping

darkreading Dec 16, 2022 Feed

The not-so-charming APT's intelligence-gathering initiatives are likely being used by the Iranian state to target kidnapping victims.

Live From London: Next-Gen Cybersecurity Takes Stage at Black Hat Europe

darkreading Dec 16, 2022 Feed

Check out our slideshow detailing the emerging cybersecurity trends in cloud, creating a defensible Internet, malware evolution, and more that lit up audiences in London.

FBI: Criminals Using BEC Attacks to Scavenge Food Shipments

darkreading Dec 16, 2022 Feed

Cybercriminal rats are at play: Several food suppliers and distributors have experienced hundreds of thousands of dollars in losses after fulfilling fraudulently placed orders for food and ingredient shipments.

Compliance Is Not Enough: How to Manage Your Customer Data

darkreading Dec 16, 2022 Feed

Effective customer data management helps companies avoid data breaches and the resulting cascade of issues. From validating "clean" data to centralized storage and a data governance strategy, management steps can help keep data safe.

Organizations Unprepared for Upcoming Data Privacy Regulations

darkreading Dec 16, 2022 Feed

A comprehensive data privacy program requires involvement from all parts of the business that deal with personal data.

With SASE Definition Still Cloudy, Forum Proposes Standard

darkreading Dec 16, 2022 Feed

Even without an overarching dictionary of common definitions, the concept of a secure access service edge (SASE) has spread, but a standard could help cloud services work better together.

GAO Highlights Interoperability Challenges With Zero Trust

cyware Dec 16, 2022 Govt., Critical Infrastructure

A zero-trust architecture is one designed to require authorization from a central point—often referred to as a trust algorithm—for individuals or devices trying to access specific resources throughout a network.

Lego fixes dangerous API vulnerability in BrickLink service

cyware Dec 16, 2022 Malware and Vulnerabilities

The Lego Group has moved swiftly to fix a pair of API security vulnerabilities that existed in its BrickLink digital resale platform, after they were identified by Salt Labs, the research arm of API specialist Salt Security.

AgentTesla Remains Most Prolific Malware in November, Emotet and Qbot Grow

cyware Dec 16, 2022 Trends, Reports, Analysis

According to findings from Check Point, Emotet has returned as one of the most prevalent malware after a quiet summer. Additionally, Qbot made the list for the first time since 2021, and the Raspberry Robin worm has had a notable influx in use.

Not-so-Charming Kitten targets orgs for espionage and worse

cyware Dec 16, 2022 Threat Actors

An Iranian cyber-espionage gang has learned new methods and phishing techniques, and aimed them at a wider set of targets – including politicians, government officials, critical infrastructure, and medical researchers – according to Proofpoint.

Protect AI lands a $13.5M investment to harden AI projects from attack

cyware Dec 16, 2022 Companies to Watch

Seeking to bring greater security to AI systems, Protect AI today raised $13.5 million in a seed-funding round co-led by Acrew Capital and Boldstart Ventures, with participation from Knollwood Capital, Pelion Ventures, and Aviso Ventures.

Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government

cyware Dec 16, 2022 Breaches and Incidents

Threat activity tracked as UNC4166 likely trojanized and distributed malicious Windows operating system installers which drop malware that conducts reconnaissance and deploys additional capability on some victims to conduct data theft.

NIST calls time on SHA-1, sets 2030 deadline

cyware Dec 16, 2022 Security Tips and Advice

The US National Institute of Standards and Technology (NIST) says it's time to retire Secure Hash Algorithm-1 (SHA-1), a 27-year-old weak algorithm used in security applications.

Android Malware Campaign Leverages Loan Scam Apps to Blackmail Victims

cyware Dec 16, 2022 Malware and Vulnerabilities

While Flutter has been a game changer for application developers, malicious actors have also taken advantage of its capabilities and framework, deploying apps with critical security and privacy risks to unsuspecting victims.

Why 2023 Could be Another Turbulent Time for Cybersecurity

cyware Dec 16, 2022 Expert Blogs and Opinion

Much like its recent predecessors, 2022 was a bumper year in cybersecurity. A slew of high-profile data breaches, attacks on essential infrastructure, and targeted cyber warfare upped the ante in an already sophisticated threat landscape.

Facebook Infrastructure Used in 'Meta-Phish' Phishing Attack Chain

cyware Dec 16, 2022 Identity Theft, Fraud, Scams

A successful Meta-Phish attack could result in the loss of PII, login credentials, and Facebook profile links. Instead of a phishing link to an external landing page, the mail sample is crafted with a link that points to an actual Facebook post.

How Our Behavioral Bad Habits Are a Community Trait and Security Problem

cyware Dec 16, 2022 Expert Blogs and Opinion

There is a "pattern of vulnerability" in human behavior extending far beyond end users into more complex IT functions. Finding evidence of these patterns can give hackers an upper hand and speed the timeline of compromise.

Backdoor Targets FreePBX Asterisk Management Portal

cyware Dec 16, 2022 Malware and Vulnerabilities

During a recent investigation, Sucuri researchers came across a simple piece of malware targeting FreePBX’s Asterisk Management portal which allowed attackers to arbitrarily add and delete users, as well as modify the website’s .htaccess file.

Low-code/no-code security risks climb as tools gain traction

cyware Dec 16, 2022 Trends, Reports, Analysis

Organizations are looking for ways to reduce their application development costs, but automated coding can usher in some quality of code, monitoring, third-party security, and application security issues if you're unprepared.

Akamai WAF bypassed via Spring Boot to trigger RCE

cyware Dec 16, 2022 Malware and Vulnerabilities

Security researcher Peter H, aka ‘pmnh’, said the attack used Spring Expression Language (SpEL) injection. The bounty hunter found the bypass with the assistance of Synack pentester Usman Mansha during an engagement with a private Bugcrowd program.

Google drops TrustCor certificates as questions loom

cyware Dec 16, 2022 Computer, Internet Security

Google joined Mozilla and Microsoft in removing support for TrustCor Systems certificates following a Washington Post report on TrustCor's connections to spyware vendors.

FuboTV Confirms World Cup Streaming Outage Caused by Cyberattack

cyware Dec 16, 2022 Breaches and Incidents

FuboTV has not provided any details on the attack but did state that a lack of bandwidth did not cause the outage, indicating that this was not a distributed denial-of-service (DDoS) attack.

NSA cyber director warns of Russian digital assaults on global energy sector

cyware Dec 16, 2022 Expert Blogs and Opinion

National Security Agency Cyber Director Rob Joyce said Thursday he remains concerned about significant cyberattacks from Russia, warning that Moscow could unleash digital assaults on the global energy sector in the coming months.

Microsoft Warns of 'MCCrash' Cross-Platform DDoS Botnet With Unique Propagation Mechanism

cyware Dec 16, 2022 Malware and Vulnerabilities

A majority of the infections have been reported in Russia, and to a lesser extent in Kazakhstan, Uzbekistan, Ukraine, Belarus, Czechia, Italy, India, and Indonesia. The company did not disclose the exact scale of the campaign.

GitHub to require all users to enable 2FA by the end of 2023

cyware Dec 16, 2022 Security Products & Services

Today, the 2FA requirement is expanded to the entire user base, covering approximately 94 million users. While GitHub had announced this decision previously, it has now shared more details about how it will implement the new measure.

Hackers Leak Personal Information Allegedly Stolen From 5.7M Gemini Users

cyware Dec 16, 2022 Breaches and Incidents

Gemini crypto exchange announced this week that customers were targeted in phishing campaigns after a threat actor collected their personal information from a third-party vendor.

Want to Know What’s in That Online Mystery Box? NOTHING AT ALL

cyware Dec 16, 2022 Identity Theft, Fraud, Scams

Shoppers have been flocking to sites selling return pallets looking for great deals on holiday purchases. And as you might expect, scammers and bad actors have also seized on this trend.

Social Blade Confirms Breach After Hacker Posts Stolen User Data for Sale

cyware Dec 16, 2022 Breaches and Incidents

Social Blade is an analytics platform that provides statistical graphs for YouTube, Twitter, Twitch, Daily Motion, Mixer, and Instagram accounts, allowing customers to see estimated earnings and projects.

Senate Approves Bill Banning TikTok From US Government Devices

cyware Dec 16, 2022 Govt., Critical Infrastructure

Despite passing the Senate vote, the bill still needs to receive approval from the US House of Representatives before the end of the current congressional session. Only then will it be presented to President Joe Biden for approval.

Agenda Ransomware Uses Rust to Target More Vital Industries

cyware Dec 16, 2022 Malware and Vulnerabilities

The new Rust-based variant of Agenda ransomware has also been seen using intermittent encryption, one of the emerging tactics that threat actors use today for faster encryption and detection evasion.

Meta takes down surveillance-for-hire firms, calls for government action against the industry

cyware Dec 16, 2022 Computer, Internet Security

Meta revealed its latest actions in a report released Thursday that was accompanied by a policy paper offering 13 recommendations for confronting the surveillance-for-hire industry.

Critical IP spoofing bug patched in Cacti

cyware Dec 16, 2022 Malware and Vulnerabilities

The vulnerability resides in a PHP file in Cacti that allows remote agents to run different actions on the server. The only safeguard this file offered was to check whether requests were coming from an authorized IP address.

Microsoft Discovers Windows / Linux Botnet Used In DDoS Attacks

packetstormsecurity Dec 16, 2022 headline,microsoft,denial of service

Elon Musk Bans Journalists After Reinstating Literal Nazis

packetstormsecurity Dec 16, 2022 headline,fraud,twitter

Meta Warns Spyware Still Being Used To Target People On Social Media

packetstormsecurity Dec 16, 2022 headline,privacy,spyware,facebook,social

Scientists May Have Found The First Water Worlds

packetstormsecurity Dec 16, 2022 headline,space,science