It’s still high season for security news, with the last days of DEF CON 22 luring out the best in the business - and causing controversy (as, of course, it should).
The biggest draw was a hack which knocked out the “ultra-private” encrypted Blackphone in just five minutes - although there was much discussion of the techniques used. Silent Circle, creators of the PGP encryption standard, took a secure, dignified response.
They patched - fast - and admitted their errors, saying, “No hard feelings — things get fixed by being found.”
Android versus RAT: Rodent wins
Android users in Russia were offered a bundle of free apps - with one catch. Each had been tweaked to hide malware - a RAT built to steal information. Remote Access Trojans (found on both PCs and Adroid devices) allows an attacker access to data - in the case of Android/Spy.Krysanec, GPS location, contacts lists, web history, contacts lists and more.
This backdoor trojan, which ESET detects as Android/Spy.Krysanec, was found as a malicious modification of MobileBank (a mobile banking app for Russian Sberbank), 3G Traffic Guard (an app for monitoring data usage) and a few others, including our own ESET Mobile Security. Naturally, it was shared through third-party app stores and social sites - not Google Play.
The malware was found to be distributed through several channels, including a typical filesharing (think Warez) site or a Russian social network.
ESET’s Robert Lipovsky says: “users should download not only our ESET Mobile Security but any application only from trustworthy sources, such as the official Google Play store. And even there, exercise caution by carefully examining the permissions requested by the app.”
Wi-Fi: The skies are safe once more
The good news - your aeroplane will not plunge from the skies thanks to hackers armed with iPads - and the idea of hacking planes via Wi-Fi is silly. The bad news: things ARE getting worse.
Black Hat is no stranger to world-changing hacks – but Ruben Santamarta’s talk was described by CNET as “the hacking presentation that will get the most attention”, claiming that plane security could be hacked wirelessly, by Wi-Fi or even SMS.
The debunking didn’t take long. Dr Phil Polstra of Bloomsburg University has the credentials – he holds 12 aviation ratings, all current, including aircraft mechanic and avionics technician, thousands of hours of flight time, and has worked on on the development of avionics found in modern airliners. He also recruited an even more qualified but anonymous pilot to help.
Short answer: planes cannot be hacked wirelessly - any model ever built. Strict rules prevent avionics systems from being accessible via wireless – except in Boeing aircrafts, which use a system “harder to hack” he says.
Several companies have already said wireless hacks were “impossible”, and that access to wired systems restricted: “In the aviation and maritime markets we serve, there are strict requirements restricting such access to authorized personnel only,” said one.
Polstra warned, however, that “increasing automation” may lead to problems in the future.
Security news: Your router is a time bomb
No wonder cybercrime gangs target routers - yet another "live fire" test against the devices proved they were packed with vulnerabilities. More than a dozen were found in the challenge at DEF CON - and one router-hunter found 11 on his own.
PC World described the devices – the portal into most home networks - as “insecure as ever” as hackers romped through challenges against big-brand devices from Linksys, Netgear, D-Link, Belkin and others.
Once again, the routers proved weak foes - and a second challenge, to extract information from the devices, proved equally easy for the contestants.
Cyberjacking: It’s a word, and it’s happening (soon)
Two researchers who have previously demonstrated hacks against cars declared a new threat this week - in-car web browsers.
In an exhaustive analysis of top car brands, the researchers found that while it WAS possible to compromise systems, the results were limited. A BlueTooth hack, for instance, would not compromise the vehicle - but allow attackers to ‘pair’ devices.
Charlie Miller and Chris Valasek in their paper A Survey of Remote Automotive Attack Surfaces conclude that the danger of “hackable” cars is expanding – but is about to grow rapidly, as web browsers are added to cars.
“Once you add a web browser to a car, it’s open. I may not be able to write a Bluetooth exploit, but I know I can exploit web browsers.” The recent reported hack against the Tesla Model S relied on its connected control panel.
A SlashDot user claims to have found a hidden port on the Tesla Model S, and used it to prove the car ran a modified version of Firefox.
Two-factor security: We want it now!
Millions of Americans were directly affected by the breach at Target - and as cybercriminals increasingly take aim at POS terminals, similar tragedies look likely in future.
A report found that two-factor security was STILL not on offer at major banks such as Citibank, Capital One and for AmEx cards, when it came to online banking. Many other banks require customers to opt in.
The reason, the NYT claims, is economy – for the banks, “Companies have gone back and forth about whether to even allow their customers to sign up for that second factor and require the company to generate a one-time code to be entered in addition to a username and password.”
“While such precautions add to the consumer’s security, they can also increase the company’s tech support needs.”
An ESET video explains what two-factor is, and why it works, here.
One of the more disquieting aspects of the NYT report was that 2FA protection was offered only to some customers – and banks were not clear as to why.
