Oktacron - Cyber Security RSS Feeds History

LED data exfiltration | Kaspersky official blog

kaspersky Jun 28, 2023 Business

Researchers from universities in both the U.S. and Israel have published a paper describing a video-based cryptanalysis method. This term is far from easy-to-understand, as is the paper itself. But, as always, well try to explain everything in plain language. Video-based cryptanalysis attack Lets imagine a real attack show more ...

using this technology. It might go as follows. Intruders gain access to the video surveillance system in a corporate building. One of the cameras is pointed at the door of a high-security storage room for, say, secret documents. On the door is a smart card reader. A company employee approaches the door and inserts their card; the lock opens. The smart card contains a microchip that talks to the reader. To verify the key encoded in the smart card against the data in the reader, the latter performs a cryptographic algorithm — that is, a series of calculations. In a normal situation, its extremely difficult to make a copy of such a key — even if you manage to get hold of the original. But theres a vulnerability: the readers LED. This indicates that the device is working, changing color from red to green when a visitor is authorized and the door can be opened. The brightness of the indicator, which depends on the load on the readers systems, changes during the cryptographic operation: for example, when the readers processor is busy with calculations, the LED brightness dips slightly. By analyzing these slight alternations, its possible to reconstruct the private key and thus create a smart card that opens the door to the secret room. If intruders have access to a video camera and can get video footage of the readers LED, in theory, they can then hack into the buildings security system. Practical difficulties Putting theory in papers such as this one into practice is never easy. The above scenario is unlikely to be implemented in practice any time soon. And for hardware-security pros, this vulnerability is nothing new. Its a case of a classic side-channel attack: data leakage through some non-obvious process in a devices operation. A traditional, decades-old method of attacking smart cards and other devices that use data encryption algorithms is to measure the voltage on the device. During the calculations, this voltage changes slightly. By observing these slight changes, an attacker might be able to reverse-engineer the algorithm: for example, by linking a voltage drop with a certain value being processed. A feature of this kind of side-channel attack is that the calculations are very fast. To reconstruct the encryption key, one would have to measure the voltage hundreds or even thousands of times per second. But the LED is a part of the overall power-supply circuit of the device, which means that its brightness varies with the voltage. Check out the progress: the attack no longer requires complex and expensive equipment. No need to take the device apart and solder wires to the circuit board. Just point the video camera at the LED, make a recording, analyze it and get the result. Video analysis features When analyzing video footage in practice, the authors of the paper encountered numerous difficulties. A regular camera shoots video at 60 frames per second, while an advanced one — no more than 120. For an attack on an encryption algorithm, thats way too low. To improve the method, the researchers exploited an inherent flaw in any digital camera that manufacturers typically struggle to overcome: the so-called rolling shutter. When we press the shutter button, the cameras image sensor doesnt take an instantaneous snapshot. What happens is that the sensors pixels are scanned sequentially, line by line, from top to bottom. If we photograph an object moving at high speed, this can produce artistic effects. Think of the rotating blades of a helicopter. While the digital camera sequentially reads data from the image sensor, the propeller has time to shift. The result is a distorted image. Source The researchers proceeded as follows: they moved the camera closer to the LED so that it filled almost the entire area of the frame. Then they measured the brightness, not of the whole frame, but of each line. Hence, the measurement frequency — and thus the accuracy — got a massive boost: up to 61,400 times per second in the case of the iPhone 14 camera. Curiously, in this rather atypical camera usage scenario, the iPhone got the better of Samsung in terms of the amount of data recorded. Testing smartphones ability to capture small changes in LED brightness at a certain frequency. Source The above screenshot shows the result of this improved configuration: the researchers made the LED blink at a certain frequency, gradually increasing it. The switching on and off of the LED is clearly visible by measuring the power fluctuations (top left). The change in LED brightness can be seen clearly when using a specialized photosensor (top right). The test used two smartphones as video cameras (bottom row). As we can see, they recorded the blinking of the LED at a fairly low frequency; higher frequency changes in brightness were lost. But at the base frame-rate (60 or 120 times per second), even these results would be out of reach. This improvement turned out to be sufficient for a successful attack. Attack results To prove the possibility of a video attack in practice, the researchers showed how a private encryption key can be exfiltrated from various smart card readers. In each of the five experiments, the LED was made to blab its secrets. In theory, its not even necessary for the smartphone or video camera to be near the device; under certain conditions, the signal can be recorded from up to 60 meters away. The team also found that the presence of other light sources (a sun-lit room, for example) impacted the measurement accuracy. This complicates the attack by adding noise to the useful signal, but is not critical to the outcome. But thats not all. The researchers attacked a Samsung Galaxy S8, which was running the SIKE data encryption algorithm. Exfiltrating secret data from a smartphone. Source A smartphone has no LED that lights up when the device is turned on. But the researchers got crafty: they took the phone and connected portable speakers that did have an LED! Because the speakers were powered by the smartphone, the scenario whereby LED brightness depends on processor load was replicated. The result was a Hertzbleed attack on the phone (see here for details), confirming that processors based on ARM architecture are also at risk of this type of attack (the original paper covered only vulnerabilities in Intel and AMD chips with x86 architecture). Were now talking about a wholly theoretical experiment, not about stealing any actual encryption keys in use. Cryptographic calculations were triggered on the smartphone according to a certain algorithm. By measuring the brightness of the LED on the speakers connected to the phone, the researchers managed to capture the operation of the algorithm and recover the private key. Since a smartphone is far more complex than a smart card reader, the noise level in the measurements was much higher. Nevertheless, the experiment was successful. On the usefulness of this scientific research This study will unlikely be applied in practice any time soon. The attack is highly complex, and its hard to find a realistic use case for it. As is often the case, the interest value of such papers does not lie in the practical exploitation of discovered vulnerabilities. Perhaps the key takeaway of this study is that the specialized equipment once needed for side-channel attacks has been replaced with off-the-shelf devices. We often post about data exfiltration through non-obvious channels, such as a desktop PC speaker. But in all these cases, malware must already be installed on the victims computer. This paper hints at the possibility of exfiltrating sensitive information without prior hacking, simply by observing a power LED. And that makes it an important contribution to our general knowledge of side-channel attacks. We can only hope that manufacturers of vulnerable devices take note and improve the design of new models — before such security holes become exploitable in practice. After all, as the paper rightly points out, its quite simple to make an LED that doesnt reveal secret information: for example, add a dirt-cheap capacitor to the power supply circuit, and the problems solved. And measures to counteract side-channel attacks can be implemented at the software level too. Finally, why not ditch the LED altogether? Would anyone really miss it?

Open Source LLM Projects Likely Insecure, Risky to Use

darkreading Jun 28, 2023 Feed

New LLM-based projects typically become successful in a short period of time, but the security posture of these generative AI projects are very low, making them extremely unsafe to use.

UCLA, Siemens Among Latest Victims of Relentless MOVEit Attacks

darkreading Jun 28, 2023 Feed

Cl0p ransomware group uses its Dark Web leak site to identify five new victims of MOVEit cyberattacks.

NPM Plagued With 'Manifest Confusion' Malware-Hiding Weakness

darkreading Jun 28, 2023 Feed

The popular package manager for software developers has been vulnerable to this attack vector for a while, and negligent in fixing the problem, according to a former employee.

3 Strategies for Bringing Rigor to Software Security

darkreading Jun 28, 2023 Feed

With the National Cybersecurity Strategy planning to add real teeth into enforcement actions, software vendors have extra incentive to reduce applications' security debt.

Social Engineering Adds Depth to Red Team Exercises

darkreading Jun 28, 2023 Feed

Because social engineering usually succeeds, companies need to test whether their defenses can block adversaries that gain employees' trust.

Saudi Arabia's Cyber Capabilities Ranked Second Globally

darkreading Jun 28, 2023 Feed

Saudi Arabia is one of the world's leaders in cybersecurity development and preparedness, according to the latest rankings.

6 Ways Cybersecurity Is Gut-Checking the ChatGPT Frenzy

darkreading Jun 28, 2023 Feed

Generative AI chatbots like ChatGPT are the buzziest of the buzzy right now, but the cyber community is starting to mature when it comes to assessing where it should fit into our lives.

LetMeSpy Phone-Tracking App Hacked, Revealing User Data

darkreading Jun 28, 2023 Feed

With at least 13,000 compromised devices in the data leak, it is still unknown who the threat actor is or whether or not victims will be personally notified.

Protecting Small Businesses From Ransomware on a Budget

darkreading Jun 28, 2023 Feed

One ransomware attack can be devastating for a small to midsize business. Here are some survival tips to ensure it's not a disaster.

Cequence Security Adds Generative AI to API Security

darkreading Jun 28, 2023 Feed

Cequence’s latest updates to the Unified API Protection platform help organizations reduce the time needed to create API security testing plans.

Generative AI Projects Pose Major Cybersecurity Risk to Enterprises

darkreading Jun 28, 2023 Feed

Developers' enthusiasm for ChatGPT and other LLM tools leaves most organizations largely unprepared to defend against the vulnerabilities that the nascent technology creates.

Jscrambler Launches JavaScript Scanner for PCI DSS 4.0 Compliance

darkreading Jun 28, 2023 Feed

The free tool aims to help organizations meet the requirements of the new version of the payment standard, which takes effect in March 2024.

New Ongoing Campaign Targets npm Ecosystem with Unique Execution Chain

cyware Jun 28, 2023 Breaches and Incidents

"The packages in question seem to be published in pairs, each pair working in unison to fetch additional resources which are subsequently decoded and/or executed," software supply chain security firm Phylum said in a report released last week.

Malvertising Campaigns on the Rise: Anatsa Malware Targets over 600 Banking Applications

cyware Jun 28, 2023 Malware and Vulnerabilities

The Anatsa Android banking trojan is being distributed via the Google Play Store, with over 30,000 installations recorded. The trojan collects financial information and performs on-device fraud. The malware has already amassed over 30,000 installations. mobile users need to exercise caution with app installations; they must carefully proceed to download apps.

Critical SQL Injection Flaws Expose Gentoo Soko to Remote Code Execution

cyware Jun 28, 2023 Malware and Vulnerabilities

The two issues, which were discovered in the search feature of Soko, have been collectively tracked as CVE-2023-28424 (CVSS score: 9.1). They were addressed within 24 hours of responsible disclosure on March 17, 2023.

SolarWinds says SEC investigation ‘progressing to charges’

cyware Jun 28, 2023 Incident Response, Learnings

SolarWinds — the technology firm at the center of a December 2020 hack that affected multiple U.S. government agencies — said its executives may soon face charges from the Securities and Exchange Commission (SEC) for its response to the incident.

UAE, Israel create ‘Crystal Ball’ platform to fight hackers

cyware Jun 28, 2023 Govt., Critical Infrastructure

The mission is to “design, deploy and enable regional intelligence enhancement” through collaboration and knowledge-sharing to combat national-level cyberthreats, according to a presentation by Mohamed Al Kuwaiti, UAE head of cybersecurity.

State and local governments grapple to mitigate cyber risks

cyware Jun 28, 2023 Trends, Reports, Analysis

State and local governments face increased challenges amid a rising threat landscape due to malicious ransomware attacks and sophisticated nation-state threat actors, according to a report released Monday from Moody’s Investors Service.

Update: MOVEit vulnerability ensnares more victims

cyware Jun 28, 2023 Trends, Reports, Analysis

At least 108 organizations, including seven U.S. universities, have been listed by Clop or disclosed as having been impacted thus far, according to Brett Callow, a threat analyst at Emsisoft.

Mario Meets Malware: An Unwanted Power-Up

cyware Jun 28, 2023 Malware and Vulnerabilities

Researchers spotted a trojanized version of the Super Mario 3: Mario Forever installer spreading Windows malware called Umbral Stealer. The installer is being promoted on gaming forums and social media groups. Researchers recommend users check their system performance and CPU usage regularly and implement proper cybersecurity hygiene to stay safe.

Swiss intelligence warns of fallout in cyberspace as West clamps down on spies

cyware Jun 28, 2023 Geopolitical, Terrorism

Switzerland’s Federal Intelligence Service (FIS) explained that this cyber espionage was a “compensatory measure … where there has been a reduction in the number of intelligence staff deployed in the target countries.”

New Fast-Developing ThirdEye Infostealer Pries Open System Information

cyware Jun 28, 2023 Malware and Vulnerabilities

The newly discovered malware is designed to collect various information from compromised machines, such as BIOS and hardware data, and send it to a command-and-control server.

BeeKeeperAI raises $12.1 million to accelerate AI development on privacy protected healthcare data

cyware Jun 28, 2023 Companies to Watch

The Series A round was led by Sante Ventures, with participation from the Icahn School of Medicine at Mount Sinai, AIX Ventures, Continuum Health Ventures, TA Group Holdings, and UCSF.

Astrix Security, which uses ML to secure app integrations, raises $25M

cyware Jun 28, 2023 Companies to Watch

Astrix Security, a platform that helps companies manage and secure third-party app integrations, today announced that it closed a $25 million Series A funding round led by CRV with participation from Bessemer Venture Partners and F2 Venture Capital.

NPM Registry Found to be Vulnerable to 'Manifest Confusion' Abuse

cyware Jun 28, 2023 Malware and Vulnerabilities

The npm Public Registry, a database of JavaScript packages, fails to compare npm package manifest data with the archive of files that data describes, creating an opportunity for the installation and execution of malicious files.

Ukraine Cracks Down on Investment Scams, Raids Call Centers

cyware Jun 28, 2023 Incident Response, Learnings

Ukrainian cyber police raided and closed over a dozen fraudulent call centers last week, saying the operations were running fake investment scams that involved stealing cryptocurrency and payment card details from European and Central Asian citizens.

Victim Count in Ransomware Attack at Maryland Healthcare Provider Jumps Fivefold to 137,000

cyware Jun 28, 2023 Breaches and Incidents

A Berlin, Maryland-based hospital recently told regulators that a ransomware breach discovered in January had compromised the sensitive information of nearly 137,000 patients, about five times the number of people originally estimated to be affected.

Cyera Raises $100M to Bring Data Protection to Hybrid Cloud

cyware Jun 28, 2023 Companies to Watch

The startup, founded by longtime Israeli Military Intelligence leaders, landed the Accel-led $100 million Series B funding to support the cloud and on-premises data protection needs of hybrid organizations.

8Base Ransomware Spikes in Activity, Threatens U.S. and Brazilian Businesses

cyware Jun 28, 2023 Malware and Vulnerabilities

VMware said 8Base is "strikingly" similar to that of another data extortion group tracked as RansomHouse, citing overlaps in the ransom notes dropped on compromised machines and the language used in the respective data leak portals.

Numerous Devices Discovered Violating CISA's BOD

cyware Jun 28, 2023 Trends, Reports, Analysis

Censys has recently analyzed the attack surfaces of over 50 FCEB organizations and detected several hundred devices to be publicly exposed to a variety of cybersecurity threats. They are not secured according to CISA’s latest Binding Operational Directive (BOD). Moreover, software programs such as MOVEit Transfer, GoAnywhere MFT, and SolarWinds Serv-U managed file transfer were hosted across exposed servers.

Submarine Cables At Risk Of Nation State Sabotage, Spying

packetstormsecurity Jun 28, 2023 headline,government,privacy,data loss,sp

SMBs Plagued By Exploits, Trojans, And Backdoors

packetstormsecurity Jun 28, 2023 headline,flaw,backdoor

Microsoft Teams Hit By Widespread Outage

packetstormsecurity Jun 28, 2023 headline,microsoft,denial of service