Security

Link

Trump Cybersecurity Advisor Rudy Giuliani Probably Doesn't Know Much About Cybersecurity

Andrew Orr ·

I think it’s a safe assumption that Rudy Giuliani, named as Trump’s cybersecurity advisor, probably doesn’t know anything about cybersecurity. My evidence? He forgot the passcode to his own iPhone.

Giuliani showed up at the San Francisco store after being locked out of his iPhone, just 26 days after Trump named him cybersecurity adviser, NBC News reported Thursday, citing interviews with two sources and an internal Apple Store memo.

The former New York mayor had entered his passcode incorrectly 10 times and went to the store for help — a troubling move that suggests a sloppy approach to cybersecurity for someone so close to the president, experts said.

Link

NordVPN Falls Victim to Credential-Stuffing Attack

Andrew Orr ·

About 2,000 NordVPN users have fallen victim to credential-stuffing attacks that let third-parties access their accounts.

While it’s likely that some accounts are listed in multiple lists, the number of user accounts easily tops 2,000. What’s more, a large number of the email addresses in the list I received weren’t indexed at all by Have I Been Pwned, indicating that some compromised credentials are still leaking into public view. Most of the Web pages that host these credentials have been taken down, but at the time this post was going live, at least one remained available on Pastebin, despite the fact Ars brought it to NordVPN’s attention more than 17 hours earlier.

NordVPN emailed all the publishers that have reported on its hack. In my opinion the company has been trying to downplay it. We’ll see if its recent security measures will improve the service, or if it’s lip service.

Link

Corellium Strikes Back Saying it Makes iPhones Safer

Andrew Orr ·

Apple filed a lawsuit against a company called Corellium. This company runs virtualization software that lets it emulate iOS. It responded to Apple’s lawsuit on Monday and said it makes iPhones safer. Oh, and it claims Apple owes it US$300,000.

Corellium’s key argument lies on the assumption that Corellium’s customers are looking for bugs with the intention of alerting Apple of their existence…For now, however, that is only an assumption…When Motherboard asked today whether they ever reported a bug in iOS found using Corellium, Mark Dowd, the founder of Azimuth, said: “no.”

That “no” is a pretty damning answer. If you claim that your software helps fix iOS bugs, you should probably also report those iOS bugs to Apple. At least if you also claim to make iPhones safer, because selling those bugs on the black market doesn’t do that.

Link

New iOS Security Suite Helps Developers Protect Apps

Andrew Orr ·

The iOS Security Suite is a brand new platform for developers. It helps them detect if their apps are running on a secure iOS device. What ISS detects:

Jailbreak (even the iOS 11+ with brand new indicators!)

Attached debugger

If an app was run in emulator

Common reverse engineering tools running on the device

Link

Apple Patents Discuss Digital Government ID

Andrew Orr ·

Two new Apple patents discuss methods for replacing paper documents with a digital government ID, and how they could be verified.

US Patent applications numbered 20190325125 and 20190327228, both titled “Identity Credential Verification Techniques,” follow previous reports of Apple hoping to make iPhones central to ID security.

The two new patent applications separate out the functions of such systems into the creation or collection of a user’s identity details, the later authentication of that ID, and then the user’s ability to provide this detail on request.

I’m normally all about privacy but personally I look forward to the day when such documents are digital.

Link

Travel Platform Autoclerk Just Leaked 179GB of Military Data

Andrew Orr ·

Hosted on AWS servers, Autoclerk leaked 179GB of military data containing sensitive personal data of users and hotel guests.

The most surprising victim of this leak wasn’t an individual or company: it was the US government, military, and Department of Homeland Security (DHS). Our team viewed highly sensitive data exposing the personal details of government and military personnel, and their travel arrangements to locations around the world, both past and future. This represented a massive breach of security for the governmentagencies and departments impacted.

Link

Firefox 70 Brings Enhanced Tracking Protection Today

Andrew Orr ·

Mozilla released Firefox 70 today and one of the new features is Enhanced Tracking Protection turned on by default on all platforms.

More privacy protections from Enhanced Tracking Protection:

Social tracking protection, which blocks cross-site tracking cookies from sites like Facebook, Twitter, and LinkedIn, is now a standard feature of Enhanced Tracking Protection.

The Privacy Protections report shows an overview, with details, of the trackers Firefox has blocked. It provides consolidated reports from Monitor and Lockwise.

Link

Trend Micro Apps Caught Harvesting User Browser History

Andrew Orr ·

Several Trend Micro apps were removed from the Mac App Store after they were found collecting user browser history.

Dr Cleaner, Dr Antivirus, and App Uninstall – utilities owned by the Japan-headquartered security house and distributed on the Mac App Store – are no longer available for download…Mac security guru Patrick Wardle noted last week that in addition to the advertised functions of removing adware and malware from Macs, the software also collected people’s personal data including their browsing history, then transmitted that data as a password-protected archive to a server on the internet.

As of this writing Dr. Antivirus is still in the MAS.

TMO Deals

Samsung Galaxy S10's Finger Print Sensor Easily Bypassed

Bryan Chaffin ·

So it turns out the fingerprint sensor on the Samsung Galaxy S10 can be circumvented by a $3.47 screen protector. The BBC had that report, but it was John Gruber’s commentary I thought was spot on:

When the iPhone 5S debuted with Touch ID, we were inundated with news stories about “easy” ways to spoof it that were, in fact, not easy at all. Now we learn that Samsung’s flagship phone’s fingerprint sensor can in fact be spoofed trivially — and… crickets.

In a word, yup.

Link

New York City Partners With Cellebrite to Hack iPhones

Andrew Orr ·

Documents reveal that New York City law enforcement has a partnership with Cellebrite to hack iPhones.

Previously, if law enforcement wanted to get into newer devices, they had to send the phones to one of Cellebrite’s digital forensics labs, located in New Jersey and Virginia. But Cellebrite’s new UFED Premium program gave law enforcement the ability to “unlock and extract data from all iOS and high-end Android devices” on their own, using software installed on computers in their offices.

I’ve always wondered if eventually Apple will remove the Lightning port from the iPhone once wireless charging becomes the norm. Side effects may include better waterproofing and worsened hacking.

Link

Microsoft says Iranian 'Phosphorus' Group Tried to Hack U.S. Presidential Campaign

Andrew Orr ·

In a blog post today Microsoft says that Iranian hackers attacked a U.S. presidential campaign, current and former U.S. government officials, journalists covering global politics and prominent Iranians living outside Iran.

Four accounts were compromised as a result of these attempts; these four accounts were not associated with the U.S. presidential campaign or current and former U.S. government officials. Microsoft has notified the customers related to these investigations and threats and has worked as requested with those whose accounts were compromised to secure them.

No word yet on what time President Trump asked Iran to interfere with our elections.

Link

One Year Later: Bloomberg Hasn't Retracted its iCloud Spy Chip Story

Andrew Orr ·

This story doesn’t need me piling on, but I think it’s astounding that a media organization with integrity, gravitas, etc. etc. still hasn’t retracted its debunked theory one year later. And the journalists who wrote the story are now in charge of Bloomberg‘s cybersecurity division. If by some miracle we learn that there really are spy chips I will most certainly apologize. But with zero evidence, I think that probability is low.

There’s been a lot of smoke, but no firings. Quite the opposite. It’s been a year since Bloomberg Businessweek published an extensively debunked story claiming that companies including Apple and Amazon had been hacked. Yet since then, all of Bloomberg‘s few responses and actions have only doubled down on how this publication lacks credibility on the topic.

Link

Hacker Claims New 'checkm8' Exploit Can Lead to Permanent Jailbreak

Andrew Orr ·

Twitter use axi0mX posted about how a new iOS exploit called checkm8 could lead to a “permanent unpatchable bootrom exploit” for iPhone 4s to iPhone X.

What I am releasing today is not a full jailbreak with Cydia, just an exploit. Researchers and developers can use it to dump SecureROM, decrypt keybags with AES engine, and demote the device to enable JTAG. You still need additional hardware and software to use JTAG.

I’m sure governments around the world will be in touch.

Link

macOS Mojave 10.14.6 Patches a Security Hole

Andrew Orr ·

Along with iOS 12.4.2 Apple is releasing macOS Mojave 10.14.6, a second supplemental update with security fixes.

If you’re running an earlier version of macOS then you will instead find Security Update 2019-005 for macOS High Sierra and Security Update for macOS Sierra available as system software updates.

The security issue as shared here fixes CVE-2019-8641: A remote attacker may be able to cause unexpected application termination or arbitrary code execution.

Link

Be Cautious of AltStore, the New Alternative App Store

Andrew Orr ·

There are reports of an alternative App Store that doesn’t require jailbreaking. It’s called AltStore, and it lets you download these alternative apps via a server you install on your Mac. While the developer says that the code for AltStore is open source, that doesn’t mean the apps within are. I urge caution about installing unknown apps outside of the App Store. If they can’t make it through the app review team, there’s probably a reason for that. For example, this quote from the blog:

From the beginning, AltStore was intended to serve as a way for developers to distribute entirely new apps that push the boundaries of iOS in ways not possible with Apple’s app review system.

Hopefully, “pushing the boundaries” doesn’t include apps full of malware.

Link

White House Blocks Audit of its Offensive Hacking Strategy

Andrew Orr ·

The White House is blocking an audit by Congress for its offensive hacking policy it has already used for cyberattacks against Russia and Iran.

The policy, which loosened the reins on military strikes against U.S. adversaries, has been withheld for more than a year from lawmakers — even those who regularly review classified material. Lawmakers from both parties are concerned the Trump administration could plunge the country into a cyberwar without congressional approval or oversight, or at the very least, provoke retaliation that causes serious damage at home.

The White House hacking strategy is: “Russia, if you’re listening, I hope you’re able to find the 30,000 emails that are missing.“