More Internet of Shit - WiFi Lightbulbs

Limited Results does a tear down of a LiFX WiFi lightbulb and finds username and passwords stored in plain text, allows insecure flashing, and exposed private key. This is all stored in the bulb firmware so if you ever throw it away you're giving the keys to your kingdom away.

LiFX WiFi Lightbulb

China's Social Credit System Starts to Flex it's Muscle

China has been developing their social credit system where each citizen's social and financial actions impacts their "social credit score". If you get caught jaywalking, you'll get a point against your social credit. Get enough dings and you won't be able to buy a airline ticket or get a loan.

A new app, that currently operates in Hebei province, will notify you  if you are within 500 meters of someone in debt. In the US, this app notification would be constant and deafening. Being in debt is the norm for US citizens. So, this app may not sound so scary but this is just an initial application. All this data is available for US citizens it just hasn't been used, publicly, by our government in this way. Yet.

From EveningStandard:

In China, things work a little differently. The country is gearing up to launch a social credit system in 2020, giving all citizens an identity number that will be linked to a permanent record.

Like a financial score, everything from paying back loans to behaviour on public transport will be included.

The app name translates to “map of deadbeat debtors”, and can be accessed via WeChat, China’s most popular instant-messaging platform. The idea is that it will allow people to “whistle-blow on debtors capable of paying their debts.”

Australian "Snooping" Laws Coming to a Country Near You

As smart phone developers start dealing with the Australian "snooping" laws, they may have to include backdoor code to be compliant. Once in it would be trivial for other countries, including the US, to mandate the same security bypasses. Another San Bernardino event could tip the scale.

From NYT:

SYDNEY, Australia — A new law in Australia gives law enforcement authorities the power to compel tech-industry giants like Apple to create tools that would circumvent the encryption built into their products.

The law, the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, applies only to tech products used or sold in Australia. But its impact could be global: If Apple were to build a so-called back door for iPhones sold in Australia, the authorities in other countries, including the United States, could force the company to use that same tool to assist their investigations.

Drone Shuts Down Newark Airport

More airport shutdowns due to drones. I expect this to become more common and more sophisticated.

From NYT:

All flights bound for Newark Liberty International Airport were halted on Tuesday evening after two pilots reported seeing a drone flying nearby, the Federal Aviation Administration said.

The drone was spotted about 3,500 feet over Teterboro Airport In New Jersey, a small airport about 17 miles north of Newark Liberty that handles private planes, the agency said. After the sightings, takeoffs from Newark were halted and inbound planes were held in the air.

Back to Blogging

Of course, when I'm overloaded with stuff to do I choose this time to restart my security blog. Mania can do great things and awful things

Security Checklist

SecurityCheckLi.st put out a good check list of things you can do to improve your security and safety on the Internet. I don't do all of these but even doing a few of them can make a difference. If you do them all you get a gold star ⭐

The list provides instructions for each of the following:

• Use a password manager
• Create a strong device passcode
• Use two-factor authentication
• Set up a mobile carrier PIN
• Encrypt your devices
• Freeze Your Credit
• Use 1.1.1.1 for DNS resolution
• Use a VPN
• Review the privacy of your physical space
• Use a privacy-first web browser
• Use a privacy-first search engine
• Use a privacy-first email provider
• Review location, camera, and other sensitive device permissions
• Review and remove metadata attached to photos you share
• Review your social media privacy settings
• Use encrypted messaging apps when sharing sensitive information
• Educate yourself about phishing attacks

Stingray stings again

Imagine if this guy had robbed a doughnut shop...

From The Register:

Police in Maryland, US, used controversial cellphone-tracking technology intended only for the most serious crimes to track down a man who stole $50 of chicken wings.

Police in Annapolis – an hour's drive from the heart of government in Washington DC – used a StingRay cell tower simulator in an effort to find the location of a man who had earlier robbed a Pizza Boli employee of 15 chicken wings and three sandwiches. Total worth: $56.77.

Deep Skimmers

It was generally thought that captive card readers were more secure because they had a motorized reader (card grabber) and shutter that wouldn't allow a skimmer to be inserted. Now there are "deep insert" skimmers that can bypass that mechanical obstruction.

From Krebs on Security:

ATM maker NCR Corp. says it is seeing a rapid rise in reports of what it calls “deep insert skimmers,” wafer-thin fraud devices made to be hidden inside of the card acceptance slot on a cash machine.

The value of a hack PC

For people who say that their PC has no value to a hacker - It does and you're still a target. Ransom attacks are on the rise.

From Krebs on Security:

A few years back, when I was a reporter at The Washington Post, I put together a chart listing the various ways that miscreants can monetize hacked PCs. The project was designed to explain simply and visually to the sort of computer user who can’t begin to fathom why miscreants would want to hack into his PC. “I don’t bank online, I don’t store sensitive information on my machine! I only use it to check email. What could hackers possibly want with this hunk of junk?,” are all common refrains from this type of user.

Samsung Smart Home flaws

I guess I'll be hanging my trusty lock picks and going digital now.

From Arstechnia:

Computer scientists have discovered vulnerabilities in Samsung's Smart Home automation system that allowed them to carry out a host of remote attacks, including digitally picking connected door locks from anywhere in the world.

Image from Arstechnia article

Security experts push for SWIFT update

Problem 1: The bank should have had a much better (anything would have been better!) protected network

From The Register:

Security vendors are pushing for a more comprehensive revamp of the SWIFT international inter-bank financial transaction messaging system beyond a update prompted by an $81m hack against Bangladesh's central bank.

The loss of $81m (part of an attempted $950m heist) in February’s Bangladesh cyber-heist – reckoned to be the biggest ever bank theft – has subsequently been linked to the bank’s use of second-hand $10 switches on its network and a lack of firewalls.

American Dental Association given malware USB drives

From SC Magazine:

Malware embedded on a USB drive was delivered to members of the American Dental Association (ADA).

The mailing contained a PDF file of dental procedure codes, but some of the drives also held code capable of redirecting recipients to a website known to host malicious code. If a user opened the file, the site downloaded code that could enable miscreants to gain control of a user's Windows computer.

German nuclear plant infected with computer viruses

They're infected with Conficker? Wow they must *never* update their systems. That just shouldn't happen. And they're Ok with this because the systems aren't connected to the Internet. Wow oh wow.

The nuclear power plant of Gundremmingen is pictured on March 11, 2012. (Reuters Image)

Another very interesting comment that in the article unrelated to the power plant:

"As an example, Hypponen said he had recently spoken to a European aircraft maker that said it cleans the cockpits of its planes every week of malware designed for Android phones. The malware spread to the planes only because factory employees were charging their phones with the USB port in the cockpit."

"Because the plane runs a different operating system, nothing would befall it. But it would pass the virus on to other devices that plugged into the charger"

Umm. That must not be just a USB charger then. It must be attached to a FAT file system of some sort. (Android won't mount and ext* file system out of the box)

The article is from Reuters:

"A nuclear power plant in Germany has been found to be infected with computer viruses, but they appear not to have posed a threat to the facility's operations because it is isolated from the Internet, the station's operator said on Tuesday."

"The Gundremmingen plant, located about 120 km (75 miles) northwest of Munich, is run by the German utility RWE"

Hospital Gets Hacked with Ransomware

It's been noted by a number of security specialists that this will be the year of medical hacks. Not only hacking medical devices but hospital IT infrastructure. I seems like a lot of victims are just paying up. This one is demanding about $1600 in bit coins. I guess that's not a lot to pay for a hospital to get back online if the attackers actually deliver with the decryption key. There's no guarantee that they won't  just encrypt the system again.

From CNBC:

Methodist Hospital, based in Henderson, Kentucky, is the victim of a ransomware attack in which hackers infiltrated its computer network, encrypted files and are now holding the data hostage, Krebs reported Tuesday.

Maybe

Thinking about moving the Insecure By Default blog over here since it would be easier to maintain and post to.