Posts Tagged

security

Tricking Apple Customers With A Fake Download

Elizabeth Technology May 21, 2024

Apple’s pretty famous for being difficult to write viruses for. Essentially, for something to get into an Apple device, it has to be so small and so powerless that it’s worthless as a virus. Apple takes pride in this. It’s very rare for a virus to infect so many devices before Apple notices and puts a stop to it!

What Happened?

A virus dubbed “Silver Sparrow” by tech company Red Canary snuck onto devices via “update” download requests. Essentially, it tricked victims into believing that they couldn’t view certain content without updating their flash player. The ad helpfully provided the download so they could update right then and there. This was not a flash update – it was a .pkg file masquerading as one! This is a common trick, but it’s not the only way these ‘updates’ end up on machines. If a box pops up asking you for permission to download something even though you didn’t click anything requesting an update, don’t allow it. Legitimate programs will never do that!

Red Canary also notes that ads and malicious search results may have had a hand in the virus’s extreme reach – unsecured websites can carry viruses in images and ads, so if a hacker figures out a site will host ads for anybody, they can use that as a launch gate.

Besides “how”, Silver Sparrow right now is non-specific malware, an activity cluster. This just means that a set of files contain the code to carry out the attack, but they don’t fall neatly into one category over others. Identification only goes as far as “not adware” right now, but this may change as more is learned about the virus!

Reason to Fear?

It doesn’t actually look like the new virus did anything. Yet. Unfortunately, viruses like these are usually used to set up a wide-scale attack at a later date. The goal is to infect as many computers as possible without firms like Red Canary noticing, and then kill or encrypt the infected all at once. They don’t yet know exactly if this is what Silver Sparrow was going to do, but it certainly seems a little odd that this incredibly quiet virus was installing itself in places just to sit there indefinitely.

Alternatively, this could have been a sort of ‘test run’. Whoever made Silver Sparrow included a self-destruct that should have triggered by itself. It’s possible the creators were looking to gather some numbers before actually launching a more dangerous malware that could deliver a payload. Red Canary currently has an estimate of just under 30,000 Apple devices infected, but the number may grow as new infection indicators are discovered. After all, something with a self-destruct will occasionally manage to get it right!

Once Apple was alerted of the problem, they revoked the certificates Silver Sparrow had been using illegitimately and began developing an action plan to keep viruses like this one out in the future. Revoking those certificates should be enough to keep Silver Sparrow from infecting more devices. Red Canary currently recommends a solid anti-malware tool on top of what Apple’s OS already has to prevent copycat viruses, and boost security.

The virus is still pretty scary, even though it didn’t do much more than sit quietly. It’s compatibility with the M1 chip, evading the Apple MRT, and it’s high infection rate are all reasons to keep an ear to the ground if you’re a Mac owner.

Define “High-Stealth”

The virus had a self-destruct function built in, but it seems like it didn’t actually get to activate it in a lot of cases. The virus was supposed to come into contact with a different part of the library that would contain the code it was looking for to trigger the self-destruct. It’s possible the thing was hiding a little too well, to its own detriment.

Notably, it runs on the M1 chip, something malware’s not supposed to be able to do. That may have contributed to how difficult it was to identify. The chip itself is pretty young, and researchers have determined that the virus may have begun infecting devices as early as three years ago, meaning Silver Sparrow is part of a very exclusive club right now.

No activity that triggered the built in antivirus + self-destruct + small size = high stealth!

What Is MRT?

An MRT, or Malware Removal Tool, is designed to remove threats to the computer in the background without the user noticing. This can create problems with CPU usage, and it means there’s less flexibility in downloading files than Windows gives, but the security the tool gives consumers is worth it. Especially for folks who don’t know computers all that well, and may not understand how to browse the web safely. The MRT has a library of known viruses, and combines that knowledge with programming designed to combat new and unknown ones.

As said before, Apple’s pretty difficult to write viruses for. The MRT certainly contributes, but the OS itself boosts this difficulty to a point that hackers and cyber criminals don’t even try. It’s not impossible, but malware is custom-fitted for Macs. Windows viruses are just easier to make, and there’s more Windows devices than Macs, especially in the business world.

Don’t Click Random Ads – And Don’t Download Things

It’s unfortunate, but if a website’s not supporting ads from a large, trusted vendor like Google, they likely can’t vet every ad they sell space to. Anti-virus should help protect devices against ad intrusions, but what about everything else?

For other issues, like clicking links, the unfortunate answer is that it comes down to ‘street smarts’. It’s something employees and regular computer users need some training on. What looks suspicious to one user may not seem suspicious at all to another! Free-to-play games, for instance, might trick a child, while “recipe.exe” sent forward from chainmail might catch an older adult who doesn’t know what different file extensions mean.

What you can do if you’re struggling to separate good links from bad is listen to your device and carefully review the download. Is it what it says it should be (i.e recipe.pdf instead of recipe.exe)? Does the publisher’s credentials match the site you got it from? And does your computer throw a fit when you try to download it? Or warn you that the file may be from an unverified third party?

When in doubt, you can always Google the alert you’re getting – and err on the side of caution!

Sources:

https://www.sentinelone.com/blog/apples-malware-removal-mrt-tool-update

https://www.businessinsider.in/tech/news/over-30000-apple-macs-have-been-infected-with-a-high-stealth-malware-and-the-company-has-no-idea-why/articleshow/81145708.cms

Over 30,000 Apple Macs have been infected with a high-stealth malware, and the company has no idea why
byu/bartturner intechnology

https://www.cnn.com/2021/02/21/tech/mac-mysterious-malware/index.html

https://www.cnn.com/2020/11/10/tech/apple-silicon-chips-mac/index.html

https://redcanary.com/blog/clipping-silver-sparrows-wings

What is Air Gapping?

Elizabeth Technology May 9, 2024

You might have heard it in the Matrix, or in a heist movie: what does “air gapping” mean?

Normal Devices, IoT devices, etc.

 In today’s age, many devices have internet capabilities. Your washer, dryer, your coffee machine, your fish tank equipment, things like glucose monitors and portable speakers, are all now capable of internet connection. Is it efficient? Sure, if you want those features – they wouldn’t still be made with WiFi enabled if they didn’t provide some use to the end consumer that was greater than the annoyance of getting it all set up. Is it safe?

No! Generally speaking, IoT devices are poorly defended and often don’t even come with passwords to prevent unauthorized parties accessing their internal computers. This can then act as a gateway to other parts of the network – your home computer, with it’s tax documents, or your business computer that shares a network with the coffee machine, to see valuable internal documents. One unlucky casino had their devices infected with ransomware after a fishtank thermometer allowed an unsavory agent to connect to it (learn more here on Forbes: https://www.forbes.com/sites/leemathews/2017/07/27/criminals-hacked-a-fish-tank-to-steal-data-from-a-casino/?sh=4be5c0832b96 ).

It’s unfortunate, but many networks are not as totally protected as they need to be, even without an IoT device providing an easy door in. Even crucial networks can be manipulated. The only way to truly secure a computer from outside threats is to not allow it any access to the outside at all.

Locked Away in a Tower

An airgapped computer may still be part of a network with other computers on it, but every part of an airgapped network is kept in physical isolation from the outside world, or any computers that are allowed to touch the internet at large.

It has no network interfaces: other devices cannot see the air gapped ones wirelessly. It will not receive updates, it will not be exposed to the online threats that a lack of updates can present. If data must be transferred to an airgapped system, it must be done via a physical data device like a thumbdrive, or disk. You may see an issue there – a malicious party could gain access and deliver a virus or malicious program on a device to infect the air gapped computer, so physical access must be tightly controlled as well. Famously, a nuclear reactor in Iran was infected with a virus known as Stuxnet via a thumbdrive, which caused a significant setback to operations in the plant by damaging centrifuges.

System requiring less protection can use things like data diodes to filter their incoming information – an unclassified computer can talk to a classified one, but only if the data is determined to be safe coming in, and only if the data leaving the classified system is carefully monitored to prevent exactly the situation such devices are used for in the first place.

Vulnerabilities

As mentioned above, the easiest way to get into an air gapped network is to somehow get close to the system physically with a portable data device like a thumbdrive. But a number of other methods to steal or transmit data exist too! A couple of researchers found success by transmitting acoustic signals, or using a cellphone to broadcast at certain frequencies – the computer was contacted and internal equipment was manipulated into behaving like an antenna, transmitting data back to the phone. Furthermore, if someone does get into the system, viruses are often able to spread much faster than they would be on other networks, because air gapped systems are not updated as frequently thanks to their lack of internet connection. Security holes not present in other systems might still be found in air gapped ones!

Please Share Less Info With TikTok

Elizabeth Technology April 25, 2024

TikTok is a terrifying place. Users regularly show their entire face, cons that they’ve attended, and personal stories with too much detail to their audience. They show the inside of their apartment building and their unit number. They tag their small towns. Distinctive, unique tattoos get shown off to thousands of people, as well as the view from their front yard and what stores they can walk to. Some of the TikToks that came out of the pandemic were about remote learning, with the teacher visible on the screen. License plates and unblurred faces abound.

Even the tiniest detail can be used to turn someone’s life upside down, especially if they’re underage.

The worst part? It doesn’t have to happen immediately! Sometimes a ticking time bomb isn’t noticed until it’s already gone off. Kids posting a video of themselves violating school rules weeks later can still be shuffled up front on the feed. Ticked off a more anonymous user somehow? You’ll never know how the school found out you broke a rule. Videos of dance trends that kids wouldn’t want their parents seeing are getting sent to their parents based off of information gathered over weeks or months of posts. All of it’s online. Video is an incredibly information-rich format, and when each video is under a minute long, any one person could look through them all.

It’s no surprise people are getting their own details shoved in their face when they’re posting this much about themselves!

The easy solution? Just don’t. Don’t download the app. If you do, don’t make videos. Of course, this isn’t going to happen, so the second-best option is to always film indoors away from windows, or in generic buildings like Targets or chain grocery stores. Don’t film yourself in a distinctive school uniform or in an identifying area of said school, because sometimes all it takes is specific colors. In Las Vegas, many of the school buildings look the same, but the colors are totally distinct to each school. If a kid has posted about living in Vegas before, those colors narrow down their location dramatically.

Shia LeBeouf’s flag, and 9Gag’s ‘meme hieroglyph’

It’s dangerous to attract too much attention from certain forums. 4Chan in particular is notorious for finding the unfindable, triangulating exact locations based off of things like truck honks and light positioning. See the saga of Shia LeBeouf’s flag project, where the flag was found over and over until he was forced to put it in a featureless white room.

9Gag put a limestone pillar covered in ‘hieroglyphs’ (which were really just old memes carved into the surface) underground for future archeologists to find. 4Chan and other forums found it by cross-referencing information in the background (Spanish writing on a truck) with available limestone mines and open fields in Spanish-speaking countries and found its exact coordinates based off of that little information. They couldn’t do much about it, because it was a 24-ton piece of limestone, but they found it.

Crimes

If you post things online, someone may be able to find you given time and determination no matter what you do. The best thing you can do to avoid that determination is fade into the background, as hard as you can, and don’t post crimes or social misconducts to TikTok or social media. Even if you’re not planning on committing crimes, you should set accounts to private, don’t overshare, and don’t do things that get you online attention for the wrong reasons. Once again, TikTok is terrifying because small accounts may think they’re sharing with their friends, only to end up trending unintentionally!

Maskless groups of friends posting videos at the beginning of the pandemic were scolded for being maskless, and because interaction makes videos more likely to appear on the ‘For You’ page, those maskless videos were getting thousands of people’s worth of harassment. If they were lucky, it stopped there – if they weren’t, they’d find that their school or place of work were being told about their conduct. Post something dumb? Algorithm catches it juuuust right? Previously anonymous posts then get a glance from hundreds to thousands of people! Suddenly, it matters a lot if you’ve ever posted videos that looked bad with no context.

And More Crimes

If you’ve seen posts that said “help me find her!” with some sob story about a missed connection, this is one way of finding people who don’t necessarily want to be found. Sure, it might be legit. It might also be a particularly clever stalker using a sad story about ‘I was out of swipes on Tinder!’ to get unsuspecting ‘good Samaritans’ to help him chase some woman’s Facebook profile down. Missed Connections on Craigslist is one thing – that’s pretty anonymous, and it doesn’t usually come with a picture or video attached showing everyone what the other person looked like. Posting a missed connection to thousands of people on Reddit or TikTok is an entirely different thing. It’s effectively setting a mob after that person to get them to respond to the poster. Imagine dramatic music – this is a horror story. The same goes for Missing Persons posts – if the number is anything but a police department’s number, you should be wary of trying to help, because sometimes people run away for good reason.

Sources: https://www.dhs.gov/sites/default/files/publications/How%20to%20Prevent%20Online%20Harrassment%20From%20Doxxing.pdf

https://dataprivacylab.org/projects/identifiability/paper1.pdf

Your IoT Devices Are Opening Doors For Hackers

Elizabeth Technology April 4, 2024

Internet of Things items are convenient, otherwise they wouldn’t be selling. At least not next to regular, non-wifi-enabled items. They don’t even have to be connected to the internet, and they should stay that way!

An Internet of Things item, or an IoT item, is a device that has a WiFi- or network-enabled computer in it to make the consumer’s use of it easier. This includes things like WiFi-enabled/networked washing and drying machines, ovens, fridges, mini-fridges, coffee makers, lamps, embedded lights, etc. anything can be an IoT item, if it’s got WiFi capability.

Network Entry Point

Internet of Things items, when connected to WiFi, represent a weak link in the chain. They’re poorly protected, they’re designed to favor user friendliness over all else, and they’re usually always on. You likely don’t unplug your fridge or washing machine when you go to bed – that device’s computer may sleep, but it’s not off. You probably don’t disconnect the internet when you go to bed, either. Some devices take advantage of this, and only schedule updates for late at night so you don’t notice any service interruptions. Unfortunately, their strengths are their weaknesses, and an always-open port is a dream for hackers.

Outdated Password Policies

Internet of Things items are rarely password protected, and if they are, many users don’t bother actually changing the password from the factory default. This makes them excellent places to start probing for weaknesses in the network!

Assuming someone’s hacking into a place to ding it with ransomware, there are a number of worthy targets: corporate offices, nuclear facilities, hospitals, etc. are all staffed by people, and people like their coffee. A well-meaning coworker bringing in an internet-enabled coffee machine for his coworkers is suddenly the source of a critical network vulnerability, an open port in an otherwise well-defended network!

If the coffee machine, or vending machine, or the lights are IoT items, they need to be air-gapped and separated from the main network. They don’t need to be on the same network supplying critical data within the center. The devices are simply unable to protect themselves in the same way a PC or phone is! There’s no way to download a suitable antivirus onto a coffeemaker. If something gets past a firewall, and that password is still the default or nonexistent, there’s no second layer of protection for IoT devices.

Malware

For example, hacking into a fridge is not nearly as hard as hacking into an old PC. Even great antivirus can struggle with traffic coming from inside the network. Even worse, IoT devices are often missed in security checkups anyway. When McAfee or Norton or Kaspersky recommends you scan your computer, are they offering to scan your lightbulbs as well?

Once they’re in, the entire network is vulnerable. Ransomware events with no obvious cause, malware that’s suddenly deleted all the files on a server, stolen data and stolen WiFi – all of it’s possible with IoT devices. There’s more to gain than just bots for the botnet, which is why hackers keep going after these IoT items.

IoT devices are also much easier to overwhelm to gain access, even with firewalls and effective load balancing. DoSing an IoT item can be as simple as scanning it. No, really. A team in the UK found that they could shut down turbines in a wind farm by scanning them. The computers inside weren’t equipped to handle both a network scan and their other computing duties at the same time. Many user devices are in the same spot or worse!

Security

Besides turbines, items like cameras and door locks probably shouldn’t be connected to the internet just yet. A terrifying string of hacks let strangers view doorbell and baby monitoring cameras, for example. The cameras themselves were difficult to defend even though the network was protected by a router. This is terrible for obvious reasons and class action suits were filed soon after. It even happened accidentally; Nest users would occasionally end up viewing other people’s cameras unintentionally, a bug in the system that was only fixed after complaints were made.

A consistent pattern is forming here: security patches are only issued after vulnerabilities are discovered by the consumer! Any other type of programming wouldn’t get away with this without some public outcry. You shouldn’t have to become a victim of a security flaw as large as “someone else is viewing the inside of my house” to get it fixed.

And then there’s things that physically interact with the security features of a house, like electronic locks. There’s nothing wrong in theory with a password lock. However, electronics are not inherently more secure than physical locks, and adding in WiFi only gives lockpickers another ‘in’. Hacking the lock could lead to being locked out of your own home, or worse. Besides, a regular lock will never unlock itself because its battery died, or because you sat down on the fob while getting on your bike or into your car. If you do want a password lock, it’s better to get one that’s not network enabled.

We aren’t quite at the point where hacked self-driving cars are a legitimate issue, although the danger is growing on the horizon. Cars are also poorly protected, computer wise.

BotNets

The fridge doesn’t need a quadcore processor and 8 GB of RAM to tell you that it’s at the wrong temperature, or that the door’s been left open and you should check the milk. The voice-controlled lightbulbs only need enough power to cycle through colors. IoT items are weak. But not too weak to be used for things like Botnets, even if your main PC wards off botnet software.

Botnets are networks of illegitimately linked computers used to do things like DDoSing, brute-forcing passwords, and all other kinds of shenanigans that a single computer can’t do alone. By combining the computing ability of literally thousands of devices, a hacker can turn a fridge into part of a supercomputer. No one ant can sustain an attack on another colony, but an entire swarm of ants can!

This is another reason tech experts are worried about IoT items becoming widely used. Their basic vulnerabilities give skilled hackers the ability to ding well-protected sites and fish for passwords even if the network they’re targeting doesn’t have any IoT items on them. It’s a network of weaponizable computers just waiting to be exploited. Remember, password protect your devices, and leave them disconnected if you can!

Source:

https://eandt.theiet.org/content/articles/2019/06/how-to-hack-an-iot-device/

https://danielelizalde.com/iot-security-hacks-worst-case-scenario/

https://cisomag.eccouncil.org/10-iot-security-incidents-that-make-you-feel-less-secure/

https://www.courtlistener.com/docket/16630199/1/orange-v-ring-llc/

How To Handle A Hack: Blizzard in 2012

Elizabeth Technology April 2, 2024

In 2012, game developers were beginning to experiment with a principle known as “always on”. “Always on” had many potential benefits, but the downsides keep the majority of games from ever attempting it. Many of the notable standouts are games that require team play, like Fall Guys or Overwatch. Others without main-campaign team play tend to fall behind, like Diablo 3 and some of the Assassin’s Creed games. Lag, insecurities, perpetual updating, etc. are all very annoying to the end user, so they’ll only tolerate it where it’s needed, like those team games. It’s hard to say that this hack wouldn’t have happened if Blizzard hadn’t switched to an “always on” system… but some of their users only had Battle.net accounts because of the always-on.

Blizzard’s account system was designed with their larger team games in mind. It was forwards facing, and internet speeds were getting better by the day. Users were just going to have to put up with it, they thought. Users grumbled about it, but ultimately Blizzard was keeping data in good hands at the time. You wouldn’t expect Battle.net accounts created purely to play Diablo 3 to lose less data than the user profiles in the Equifax breach, right? Blizzard kept the ball here! What did Blizzard do right to prevent a mass-meltdown?

Hacker’s Lament

The long and the short of it was that Blizzard’s storage had multiple redundancies in place to A) keep hackers out and B) make the info useless even if it did end up in the wrong hands. Millions of people had lost data in similar events before, and security experts were more and more crucial to keeping entertainment data safe. Blizzard was preparing for the worst and hoping for the best, so even when the worst struck here, they weren’t left floundering telling people they lost their credit cards.

The actual hack was defined by Blizzard as ‘illegal access to our internal servers’. It released the listed emails of players (excluding China), the answers to security questions, and other essential identifying information about accounts into the wild. However, due to Blizzard’s long-distance password protocol, the passwords themselves were scrambled so much that the hackers might as well have been starting from scratch. This is still a problem, but it’s not a world-ending, ‘everyone has your credit card’ problem. Changing the password on the account and enabling 2FA was considered enough to shore up security.

Potential Issues

Lost email addresses aren’t as big of a problem as lost passwords, but they can still present an issue. Now that the hacker knows an email address was used on a particular site, it’s possible to perform a dictionary attack, or regular brute forcing! This strategy will eventually work, but the longer and more complicated the password is, the less likely it is to succeed on your account in particular.

A secondary problem is the lost security questions. Those are a form of 2FA. Depending on the question asked, guessing something that works or brute forcing it again is dangerously easy. Sparky, Rover, and Spot are very popular names for American dogs, for example. If the hacker is able to identify that the player’s American, and then guess the name of their first dog, they’re in! They can change the password to keep the legitimate player out. (Part of Blizzard’s response is forcing users to change their security questions for this reason). 2FA that uses email or mobile is generally preferred.

Battle.net acted as an overarching account for all the games, and made the stakes higher for an account breach. All the online Blizzard games went through Battle.net. Losing access could mean losing access to hundreds of hours of game progress. Or worse: credit card data and personal info.

Online, Always, Forever

The event provided ammo for anti-always-on arguments. There was no option to not have a Battle.net account if you wanted to just play Diablo’s latest game. Some users were only vulnerable as a result of the always-online system. If they’d simply been allowed to play it offline, with no special account to maintain that always-online standard, there wouldn’t have been anything to hack! Previous Blizzard games didn’t require Battle.net. People who stopped at Diablo 2 seem to have gotten off scot-free during the hack. This is annoying to many users who only wanted to play Diablo 3. They might not find value in anything else about the Battle.net system. Why bother making users go through all this work to be less secure?

When discussing always online, there’s good arguments to be made for both sides. Generally, always on is better for the company, where offline gaming is better for the consumer. Always on helps prevent pirating, and it gives live data. Companies need data on bugs or player drop-off times, which can help them plan their resources better and organize fixes without disrupting the player experience.

On the other hand, consumers with poor internet are left out, as lag and bugs caused by poor connection destroy their gaming experience. As games move more and more to pure digital, buying a ‘used game’ only gets more difficult for the consumer. Companies treat purchased games as a ticket to a destination, rather than an object the consumer buys. Games used to be objects, where anybody could play the game on the disc even though save data stayed on the console. Buying access to Diablo 3 via Battle.net means that there’s no way to share that access without also allowing other people to access the Battle.net account, which stores the save data. It’s the equivalent of sharing the console, not just the disc.

Handling

The response to the stolen, scrambled passwords was for Blizzard to force-reset player passwords and security questions, just in case the hackers somehow managed to unscramble them.

2FA is always a good idea, and Blizzard strongly recommended it too. 2FA will do a better job of alerting you than the default email warning  ‘your password has been changed’ will after the fact. After you’ve received that email, the hacker is already in. Depending on when you noticed, they could have already harvested all the data and rare skins they wanted by the time you get your support ticket filed! Setting up 2FA first means that you’re notified before that happens.

All in all, Blizzard handled this particular incident well! Companies are required to inform their users about potential online breaches, but some companies do this with less tact than others. Formally issuing an apology for the breach isn’t part of their legal requirements, for example. What made this response possible in the first place was Blizzard’s competent security team, alongside a set of policies that were strictly followed. Logs and audits in the system ensured that Blizzard knew who accessed what and when, which is critical when forming a response. Blizzard was able to determine the extent of the problem and act on it quickly, the ultimate goal of any IT response.

Sources:

https://us.battle.net/support/en/article/12060

https://us.battle.net/support/en/article/9852

https://www.forbes.com/sites/erikkain/2012/08/09/its-official-blizzard-hacked-account-information-stolen/?sh=2ecadbc955d1

Blizzards Gaming Server Has Been Hacked

https://medium.com/@fyde/when-too-much-access-leads-to-data-breaches-and-risks-2e575288e774

https://www.bbc.com/news/technology-19207276

Internet Of Things Items Can Create Vulnerability

Elizabeth Technology January 23, 2024

Internet of Things items are convenient, otherwise they wouldn’t be selling. At least not next to regular, non-wifi-enabled items. They don’t even have to be connected to the internet, and they should stay that way!

An Internet of Things item, or an IoT item, is a device that has a WiFi- or network-enabled computer in it to make the consumer’s use of it easier. This includes things like WiFi-enabled/networked washing and drying machines, ovens, fridges, mini-fridges, coffee makers, lamps, embedded lights, etc. anything can be an IoT item, if it’s got WiFi capability.

Network Entry Point

Internet of Things items, when connected to WiFi, represent a weak link in the chain. They’re poorly protected, they’re designed to favor user friendliness over all else, and they’re usually always on. You likely don’t unplug your fridge or washing machine when you go to bed – that computer may sleep, but it’s not off. You probably don’t disconnect the internet when you go to bed, either. Some devices take advantage of this, and only schedule updates for late at night so you don’t notice any service interruptions. Unfortunately, their strengths are their weaknesses, and an always-open port is a dream for hackers.

Outdated Password Policies

Internet of Things items are rarely password protected, and if they are, many users don’t bother actually changing the password from the factory default. This makes them excellent places to start probing for weaknesses in the network!

Assuming someone’s hacking into a place to ding it with ransomware, there are a number of worthy targets: corporate offices, nuclear facilities, hospitals, etc. are all staffed by people, and people like their coffee. A well-meaning coworker bringing in an internet-enabled coffee machine for his coworkers is suddenly the source of a critical network vulnerability, an open port in an otherwise well-defended network!

If the coffee machine, or vending machine, or the lights are IoT items, they need to be air-gapped from the networks supplying critical data within the center (or cut off from the network completely), the same way outside computers are. The devices are simply unable to protect themselves in the same way a PC or phone is – there’s no way to download a suitable antivirus. If something gets past a firewall, and that password’s still default or nonexistent, there’s effectively no second layer of protection for IoT devices.

Malware

For example, hacking into a fridge is not nearly as hard as hacking into an old PC. Even great antivirus can struggle with traffic coming from inside the network, and IoT devices are often missed in security checkups. After all, when McAfee or Norton or Kaspersky recommends you scan your computer, are they offering to scan your lightbulbs as well?

Once they’re in, the entire network is vulnerable. Ransomware events with no obvious cause, malware that’s suddenly deleted all the files on a server, stolen data and stolen WiFi – all of it’s possible with IoT devices. There’s more to gain than just bots for the botnet, which is why hackers keep going after these IoT items.

IoT devices are also much easier to overwhelm to gain access, even with firewalls and effective load balancing. DoSing an IoT item can be as simple as scanning it. No, really. A team in the UK found that they could shut down turbines in a wind farm by scanning them. The computers inside weren’t equipped to handle both a network scan and their other computing duties at the same time. Many user devices are in the same spot or worse!

Security

Besides turbines, items like cameras and door locks probably shouldn’t be connected to the internet just yet. A terrifying string of hacks let strangers view doorbell and baby monitoring cameras, for example, because the cameras themselves were difficult to defend even though the network was protected by a router. This is terrible for obvious reasons and class action suits were filed soon after. It even happened accidentally; Nest users would occasionally end up viewing other people’s cameras accidentally, a bug in the system that was only fixed after complaints were made. A consistent pattern is forming, here: security patches are only issued after vulnerabilities are discovered by the consumer! Any other type of programming wouldn’t get away with this without some public outcry – you shouldn’t have to become a victim of a security flaw to get it fixed.

And then there’s things that physically interact with the security features of a house, like electronic locks. There’s nothing wrong in theory with a password lock. However, electronics are not inherently more secure than physical locks, and adding in WiFi only gives lockpickers another ‘in’. Hacking the lock could lead to being locked out of your own home, or worse. Besides, a regular lock will never unlock itself because its battery died, or because you sat down on the fob while getting on your bike or into your car. If you do want a password lock, it’s better to get one that’s not network enabled.

We aren’t quite at the point where hacked self-driving cars are a legitimate issue, although the danger is growing on the horizon. Cars are also poorly protected, computer wise.

BotNets

The fridge doesn’t need a quadcore processor and 8 GB of RAM to tell you that it’s at the wrong temperature, or that the door’s been left open and you should check the milk. The voice-controlled lightbulbs only need enough power to cycle through colors. IoT items are weak. However, that doesn’t mean they can’t be used for things like Botnets, even if your main PC wards off botnet software.

Botnets are networks of illegitimately linked computers used to do things like DDoSing, brute-forcing passwords, and all other kinds of shenanigans that a single computer can’t do alone. By combining the computing ability of literally thousands of devices, a hacker can turn a fridge into part of a supercomputer. No one ant can sustain an attack on another colony, but an entire swarm of ants can!

This is another reason tech experts are worried about IoT items becoming widely used. Their basic vulnerabilities give skilled hackers the ability to ding well-protected sites and fish for passwords even if the network they’re targeting doesn’t have any IoT items on them. It’s a network of weaponizable computers just waiting to be exploited. Remember, password protect your devices!

Source:

https://eandt.theiet.org/content/articles/2019/06/how-to-hack-an-iot-device/

How to Protect Your IoT Product from Hackers

https://cisomag.eccouncil.org/10-iot-security-incidents-that-make-you-feel-less-secure/

https://www.courtlistener.com/docket/16630199/1/orange-v-ring-llc/

A Phishing Refresher

Elizabeth Technology December 14, 2023

How To Avoid it in the First Place

There are a few key tips that give away phishing scams. Firstly, is there a sense of urgency? Your utility companies aren’t going to call and say they’ll shut off your water without at least a few mailed reminders that your bill is due! The same goes for your bank. If they demand that you resolve a problem right then, right there, out of the blue, it’s probably a phishing scam (if you’re nervous it’s not a scam, call the alleged company using their number off of their real website). This goes for both phone and email phishers.

 If it’s an email or a text, ask yourself if you were expecting an email or a text from that company. If you get a Fedex text update that you didn’t sign up for, it might be a phishing scam. If you got a notification from Walgreens that your photos have finished printing, and you didn’t print any photos, it might be a phishing scam. They want you to click or tap the links they include to see what’s going on. Spelling errors are also a common tell – it’s not impossible for a company to make spelling errors in their communications with you, but they won’t be littering the page with them! Phishing scams do that to weed out people who know better so they won’t waste time on targets that won’t crack. Note that not every phishing scam comes with typos, even though they are common.

You should also check the sender of the email! Spoofing is a technique that attaches a real name that you might know to an email address or phone number that definitely doesn’t belong to them. Anyone can set their name to George Smith or Big Company Customer Service in Gmail, but they can’t change the email address they’re sending from. If it’s [email protected] and not [email protected], for example, it’s probably a phishing scam.

The same goes for caller ID, although it’s getting harder and harder to tell real calls from fake ones – scammers can set their name to something like “Hospital” or “School” to make it more likely you’ll pick up. Some more sophisticated operations can even make it look like they’re calling from a different number altogether, using VOIP technology to match the area code of the caller to the person being called. Just like in the urgency tip, you should be able to call a legitimate company or organization like a school back from the number they have on their website, or the number you know to reach them at. If they’re really resistant to you hanging up and calling back for reasons that don’t make sense, it might be phishing. Unfortunately, some scam calls are really tough to pick up on, and the FCC can’t do much to stop them if they’re not in the US. Many people today don’t answer their phone unless they were explicitly expecting a call as a result, and phone companies themselves sometimes offer up call and text screening.

How to Better Protect Your Accounts

Luckily, there are a few tips that can make your information safer in the face of trickier scams! Firstly, don’t re-use passwords. If a password you were using for multiple accounts gets stolen, then multiple accounts are at risk, not just one. We recommend a password manager like BitWarden – it makes it much easier to store and create unique, strong passwords for every site!

Secondly, you’ll be better protected if you use two-factor authentication on every website that has the option to. If you do fall for a phishing scam, the scammer won’t have the code necessary to get in! Of course, some scams are sophisticated enough to think of that beforehand: Craigslist, for example, had a bad rash of scammers a while back who would “text a code” to a seller “to make sure they were a real person”. The seller then gives them the code, and the scammer now has a Google Voice number with the seller’s phone number as the verified number behind it! They just social-engineered their way into bypassing 2FA. This is why you should never give out verification codes – especially if you didn’t request them. Instead, it might be time to reset the password of the account that verification email came from. Just don’t click any links in those verification emails, either: go straight to the home page of the site instead to log in. The verification email might be a phishing attempt all by itself, hoping you’ll click a fake link to the website!

Using Biometrics: Is It Really Better?

Elizabeth Technology November 9, 2023

Some phones allow users to use their biometric data as 2FA, or as a password by itself – how does it measure up to PINs?

Cons

1) Your Face Looks Like Your Family’s

Every single service using face unlock handles this a different way – they all use different programs, and those different programs handle similarities differently. Apple, which uses state-of-the-art hardware and code to see faces, still sometimes mixes it up. For Apple, the program that reads your features and unscrambles this information is constantly updating itself and adding to its library of what you look like. If it didn’t, a sunburn or a new eyeliner shape would trip it up and lock you out for looking different.

The problem is that it’s allegedly doing that by looking at the person holding the device when it’s unlocked (using a passcode or otherwise), which is usually you but sometimes isn’t. People who look similar enough and who may be holding your phone enough (like family) can sometimes trick FaceID into opening for them by accident. While this is getting better, there’s no way to rule out a twin unlocking your phone without also sometimes locking you out too.

2) Law Enforcement

Most police forces have the right to collect some of your biometric data if you are ever arrested – your face and fingerprints go into their records. The legality of using that to unlock your mobile device pre-subpoena varies from state to state; some states will allow you total freedom to decline an un-subpoena’d unlock request no matter how your device is secured, while others won’t let you decline at all, but some states depend on the type of lock. Certain biometric data is not legally protected in the same way passcodes or PINs are. Look it up for your state!

3) Nefarious Children

A much more common unwanted-unlock scenario is a child getting hold of your phone during a nap and holding it up to your face to buy Robux. While face-unlock adapted, and many smartphones don’t let you attempt an unlock with closed eyes anymore, fingerprints stay the same even if you’re asleep. Still pictures of the target tend to trick older Face ID as well, although that is improving with each new generation of phones.

Pros

1) When Done Right, It’s Really Tough to Beat

Barring the similarity issues above, when biometric data is used correctly, it’s pretty darn good at keeping unwanted people out. Collecting fingerprints to unlock a device or account is often more difficult than it’s worth, and deters bad actors from trying. Strangers will generally not have photos of the phone’s owner good enough to unlock it on-hand – more recent phones use infrared too, so pictures don’t even work on new phones anymore. Cracking biometric locks takes a lot of coincidences or a lot of effort, not just a computer stuffing passwords.  

You also can’t write down your face and lose it somewhere like you might for a password, and (at least for phones) you can’t have it breached in the same way as a written password.

2) When Done Right, It’s Faster

You’d need to wait for a sent 2FA code, but you don’t need to wait for a fingerprint or a face unlock.

3) As Long As Policies Stay the Same, The Data Doesn’t Leave The Phone

As of the writing of this article, Pixel and Apple devices state that the mathematical representation of your face which the phone uses to unlock will not leave the device it’s being used on. Apple even goes a step further and separates the computer that handles facial recognition from the computer that does everything else inside the phone!

The caveat of course is if those policies stay the same – companies make promises and then go back on them all the time. American privacy laws are fairly lax compared to other countries, so any privacy policy not written into law needs an eye kept on it for changes.

What is a Browser Cookie?

Elizabeth Technology October 31, 2023

A browser cookie is a little snippet of data that the browser stores while the user is browsing. Websites use cookies for their ‘remember me’ functions, for example – if you tick the box under your log in and ask the website to remember you, it will, using a cookie.

The same goes for online shopping – when you’re logged in, the website remembers what you have in your cart by saving that information elsewhere. However, even when you’re not logged in, the page remembers what you’ve added to the cart, sometimes (depending on your browser and the website’s settings) even after you’ve left the page, closed the browser, and shut down the computer. Coming back a day later, the website will still have those items in your cart even though you’re still not logged in. That’s the convenience of a cookie!

It may not be immediately apparent, but this actually has quite a few security implications.

The Good

Websites use cookies to figure out if they should show you certain pages. If you’ve logged out in one tab, switch to another, and keep trying to shop, the website will put a hold on things before checkout (as long as checkout’s a separate page. It is on most websites).

The Bad

The downside to having cookies that keep you logged in is that if someone else gets their hands on your device, they can access everything that the browser has stored password cookies for. Example: You don’t log out of Facebook, but you close the browser. You let a friend use your computer to look something up real quick, but they notice Facebook pops up in the web bar. Suddenly they have access to your Facebook.

Or, logging in to Amazon on a friend’s device to order something, and then leaving without logging out, makes it possible for that friend to buy something on your account completely accidentally!!

Additionally, cookies can be ‘read’ by hackers and public WiFi providers like Starbucks or McDonald’s, but that security issue isn’t exclusive to cookies.  Tracking cookies and other such shenanigans are usually used for advertising purposes, but that can be a security concern too, if privacy is a part of your security considerations.

These aren’t all the security risks of cookies, but they’re the most obvious, and the most likely to trip up a user.

Mixed Considerations

Cookies have more functions than simply recording logins. Some can take your device’s diagnostic data, some can recall settings you set the last time you visited a webpage, and some can track you. Tracking cookies are exactly what they sound like: cookies that track you as you travel along the web. These cookies can be used to form a long-term record of a user’s browsing history, which is obviously a concern – most people would be creeped out by someone following them through the mall, watching what stores they go into and what items they come out with. The same goes for cookies. Why does CarMods.com want to see what I’m buying for my tropical fish?

Any website that has something to gain from knowing what websites you visit, your potential interests, what kind of recipes you save, what kind of sports you watch or political sites you follow – they can use that to sell you something, and that something can be ideas.

Blocking Them

Cookies aren’t an enemy, and many just set out to make your life easier.

However, if you’re interested in keeping cookies from following you, for good or for bad, there are many options on the market. Some browser extensions like adblockers will also block cookies, and there are many third-party extensions built exclusively to keep websites from tracking the end user (you should always research the company you’re downloading from beforehand). Simply browsing in incognito mode or regularly erasing cookies along with your browsing history don’t require you to touch anything third-party if you don’t want to, as well!

How Does A Hacker Use Public WiFi?

Elizabeth Technology October 26, 2023

Ads for VPNs give their two biggest benefits as often as they can: that you can watch shows blocked in your home country using one, and that hackers using the same public WiFi network can’t steal your data as long as you’re encrypting it with a VPN.

The first one is relatively easy to understand, but how does the second trick work? 

1) Simply Saying They Are Something Else

One of the easier methods of tricking a connection is to simply create a hotspot near a public wifi source, and name it the same thing as the legitimate source. If there are two ‘Starbucks Café 9812’ Wifi channels available, the duplicate may catch out users. After that, the hotspot’s creator can intercept any data sent over the connection.

2) Using Specialty Tools

Unsecured Wifi is dangerous in multiple ways – loose, unencrypted packets of data travelling over the Wifi connection can be caught by a hacker and decoded into readable information using something called a WiFi sniffer. Information that your computer will not pick up by default can be found this way, and with it, data sent over that unsecured connection.

Using a WiFi channel with a password is generally good enough to prevent that from happening, however.

3) Hoping For Poor Security Practices

If a public spot’s router is not set up correctly, it might be possible for a bad actor to get into it as an administrator, with all of the permissions that entails. If the router is still using a default dictionary password, a dictionary attack might crack it, and give the bad actor those admin privileges that way. And, if a bad actor got onto the network legitimately, they may be able to execute a man-in-the-middle attack where they trick the target computer and the router into sending potentially sensitive data through them first.

 VPNs

VPNs, or Virtual Private Networks, add an extra layer of security via encryption to information as it passes from the user’s computer, to the router, to the VPN’s server where it is unencrypted, to the website where the request was directed, back to the VPN’s server so it can be re-encrypted, and then back to the router and ultimately the device, where the information is unencrypted.

That’s good for protecting the user from many of the security issues associated with Public Wifi, but it’s not the be-all end-all of security – you must pick a VPN carefully if you intend to use one, because using a VPN means putting all of that data in their hands instead.

‹  Older posts