Rorschach, QNAP, We Got Hacked, SystemD, UTF-8, & Grub2 Music – PSW #779

Really neat camera hacking with Linux, nerdy firmware stuff.

Yes, we can open garage doors; there are several different methods. Don't lose site of the fact that its not just garage doors; vulnerabilities allow attackers in the case to control the entire system, which can incorporate a home security system, which could be disarmed.

"Debian" and "systemd" in the same sentence leads to "bad things". Great post!

"Near-Ultrasound Inaudible Trojan, that exploits vulnerabilities in smart device microphones and voice assistants to silently and remotely access smart phones and home devices." And this: "The attacks work by modulating voice commands into near-ultrasound inaudible signals so that humans can't hear them but the voice assistant will still respond to them. "

I love this so much: *"In a 2011 blog post Neal Krawetz provided a detailed explanation of some of the numerous variations on perceptual hashing, but they mostly look the same if you squint:

• Downsize the input image to a fixed size, ignoring aspect ratio (maybe 64×64)
• Convert the image to grayscale
• Convert the image pixel data into frequency domain, by using a discrete cosine or wavelet transform
• Apply a low-pass filter, throwing out high frequencies
• Summarize remaining values with respect to some property of the remaining values, like median value, to produce a fixed-size bitstring

These algorithms work surprisingly well on web page screenshots. By incorporating an off-the-shelf perceptual hash algorithm as part of Chariot’s external Attack Surface Management, we have seen around a 75x reduction in the number of images a Red Team needs to review. That’s a huge reduction!"*

I love how they unpack the firmware, copy netcat to the rootfs, then repack the firmware and upload it. Signature checking code needs more checking in this case. CVE reference for the vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2022-48194

Why bother updated firmware? "HP recommends immediately reverting to an earlier version of the firmware (FutureSmart version 5.5.0.3) and downgrading devices to that firmware version."

"I decided to use an emulated version of Grub2 in order to effectively capture the audio out without having to use a microphone. This blog post will describe how I went about setting up the Grub2 virtual instance and how I then generated some appropriately formatted numbers to achieve a semi-musical expression." - Also, great post to learn about emulation with Qemu.

Really interesting how we get here (byte arrays and UTF-8): "In this specific case, what we end up with is a hash collision vulnerability."

Keep in mind the author is only 14: "As for booting modified software, it is difficult but not impossible. Unfortunately, I bricked my echo by carelessly flashing the wrong file, but not before finding some useful information. All mediatek devices use something called a preloader. It is essentially a loader for the bootloader, a very low level piece of software that runs on the cpu each boot. If anybody successfully patches the preloader to bypass checks of the mediatek 'little kernel' (lk) and 'unlock_code', we can write zeros to the start of the preloader and boot from the patched version. However, this would mean using a computer every time you boot your echo. As the device runs fireOS, the command fastboot oem flags fos_flags:0x80 should work to disable dm-verity, which is used to verify the integrity of android images and allow us to run unsigned code. This would be very serious as it would allow devices to be modified to send data to an attacker instead of amazon." - Great hardware/firmware hacking here.

Why bother having a password? "This vulnerabilty allows an attacker to read configuration, including passwords for SNMP and Telnet, without authentication. These credentials can be abused in further attack steps, for example for switching off infrastructure that is powered by the PDU."

In short, use both: "Reports of Exploit-DB’s death were greatly exaggerated. After publishing almost no exploits for four months, Exploit-DB is alive and publishing new exploits with a vengeance. As collectors of exploits, we missed Exploit-DB (EDB) and we’re glad it's back. But while EDB was on hiatus, we found that 0day.today was a reliable stand-in. Now with both projects alive and kicking, we wanted to get a better understanding of these exploit databases, and how they differ." - Also, 0day.today has some methods to purchase exploits that I have not (yet) explored.

Based on the description you could pretty easily find the vulnerability and exploit it: "The specific flaw exists within the parsing of firmware images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer."

This is a very detailed and technical read, but I found it interesting that no one solved it in the CTF: "No one solved this challenge before the end of the CTF, after which its solution was published along the others. Hash_kitten basically explained that the file could be leaked via an error-based oracle. This blogpost details the several filter chain tricks involved in this attack, as well as some optimization from the original writeup."

They came close, but no cigar. Almost turned 3 Russian pilots.

Why bother signing things? "When a signed executable is modified, Windows will display a message stating that the "digital signature of the object did not verify." However, even though we know that the d3dcompiler_47.dll DLL was modified, it still showed as signed in Windows. After contacting Will Dormann, a senior vulnerability analyst at ANALYGENCE, about this behavior and sharing the DLL, we were told that the DLL is exploiting the CVE-2013-3900 flaw, a "WinVerifyTrust Signature Validation Vulnerability.""

Researchers from Check Point say they discovered what they suspect is a new ransomware strain dubbed "Rorschach" that includes improved capabilities in encryption speed, which the researchers assert makes the ransomware the fastest ransomware threat in existence today.

Rorschach ransomware only encrypts a portion of the file, which could largely account for the malware's alleged fast encryption speed.

After detecting an intruder Western Digital took several of its services offline. From the MyCloud Status page https://status.mycloud.com/os4 "Western Digital is currently experiencing a service outage impacting the following products: My Cloud, My Cloud Home, My Cloud Home Duo, My Cloud OS5, SanDisk ibi, SanDisk Ixpand Wireless Charger."

Google Threat Analysis Group researchers detailed several campaigns that used zero-day exploits alongside n-day exploits as part of Android and iOS exploit chains and “took advantage of the large time gap between the fix release and when it was fully deployed on end-user devices.”

China's "Pinduoduo" shopping app, which is used by more than 750 million users each month, can bypass users' cell phone security in order to monitor other apps' activity, check notifications, read private messages, and alter device settings. They are leveraging weaknesses/flaws in Android to access this information.

QNAP warns customers to update their network-attached storage (NAS) devices to address a high-severity Sudo privilege escalation vulnerability tracked as CVE-2023-22809.

The company states that the vulnerability affects QTS, QuTS hero, QuTScloud, and QVP (QVR Pro appliances) QNAP operating systems.

Bitcoin ATM manufacturer General Bytes says it is reimbursing its cloud-hosted customers that lost funds in a “security incident” in March that saw its customers’ hot wallets accessed.

For at least the last two weeks efile.com, the IRS authorized e-filing provider, website has been serving malicious ake "Browser Updates" to some of its users. This morning, efile.com finally removed the malicious code from their site.

Researchers from Proofpoint say that hackers are exploiting a known vulnerability in Zimbra Collaboration servers to steal email messages from diplomats, governments, military organizations, associated with the North Atlantic Treaty Organization (NATO). Zimbra released a patch for the cross-site scripting vulnerability (CVE 2022-27926) a year ago.

3CX began seeing reports that its app was being flagged as malicious seven days before acknowledging it was the victim of a supply chain attack. 3CX CEO Nick Galea said that they tested the app on VirusTotal after learning of the warnings and decided that they were false positives. Galea noted that they “only realize[d] the extent of the breach after Crowdstrike gave us full details.” The attack was detected by both SentinelOne and Crowdstrike.

Maybe consider human reported issues as more authoritative than VT?

Elementor Pro has released a patch to address a broken access control vulnerability in the WordPress plugin.

This issue impacts Elementor Pro when used with the WooComerce plugin through a flaw in their AJAX handler. You can exploit the vulnerability to create a new administrator account. The issue was reported to the authors on March 18th and an updated version (3.11.7) was released March 22nd.

Microsoft OneNote will automatically block certain file extensions that are often used to spread malware. Before the update, OneNote users attempting to open a file with a suspicious attachment would see a message warning of a potential security risk; after the update, OneNote will not open the suspicious file at all. The update will begin rolling out this month and should be ubiquitous by January 2024.

These file types will also be blocked in Excel, Word, PowerPoint and Outlook. This expands on the default blocking of macros from files with "the mark of the web" as that move resulted in hackers leveraging embedded files to deliver malware.

According to a report from the Government Accountability Office (GAO), the Department of Veterans Affairs failed provide evidence of CIO approval for more than 60 percent of the 11,644 new IT contract actions between March 2018 and the end of FY 2021.

The question - shouldn't the CIO (& CISO) be involved in IT contracts, like always?

North Korean hackers attacked voice-over IP software provider 3CX, in a “supply chain attack.” The number of companies affected by the harmful code remains unclear, but the supply-chain element of the hacking campaign has been effectively “neutered.” While cyber officials believe North Korea is improving its cyber capabilities, they’re not as sophisticated as the Russian hackers allegedly behind the SolarWinds campaign.

Since Ethereum moved to Proof-of-Stake, transactions are validated by "validator" services. They make money through MEV, "maximal extractable value," which is a method validators use to try to maximize their profits when they validate transactions by including, excluding or changing the order of transactions in a block. The attack happened all within one Ethereum block--a validator appeared to force a series of transactions into the block to steal funds the bot had planned to gain by front-running.

China has its own chip foundries, but they supply only low-end processors used in autos and appliances. The U.S. government is cutting off access to a growing array of tools to make chips for computer servers, AI and other advanced applications. China’s loudest complaint: It is blocked from buying a machine available only from a Dutch company, ASML, that uses ultraviolet light to etch circuits into silicon chips on a scale measured in nanometers, or billionths of a meter. Without that, Chinese efforts to make transistors faster and more efficient by packing them more closely together on fingernail-size slivers of silicon are stalled.

Google devices chief Rick Osterloh said he believes anyone "in proximity" of a microphone-fitted smart device like Google Nest or Amazon Echo should be informed the devices are in use.

Whatever we may "owe the future," it isn't a bizarre and dangerous ideology fueled by eugenics and capitalism. Longtermism is a quasi-religious worldview, influenced by transhumanism and utilitarian ethics, which asserts that there could be so many digital people living in vast computer simulations millions or billions of years in the future that one of our most important moral obligations today is to take actions that ensure as many of these digital people come into existence as possible.

It’s called the Mullvad browser, named after the Mullvad VPN company it’s partnered with. The Mullvad browser’s main goal is to make it harder for advertisers and other companies to track you across the internet. It does this by working to reduce your browser’s “fingerprint.”

Hackers are adding malicious functionality to WinRAR self-extracting archives that contain harmless decoy files, allowing them to plant backdoors without triggering the security agent on the target system.

Five high school students volunteered to help me test it by creating 16 samples of real, AI-fabricated and mixed-source essays to run past Turnitin’s detector. The result? It got over half of them at least partly wrong.

Academics in the US have developed an attack dubbed NUIT, for Near-Ultrasound Inaudible Trojan, that exploits vulnerabilities in smart device microphones and voice assistants to silently and remotely access smart phones and home devices. Apple's Siri, Google's Assistant, Microsoft's Cortana, and Amazon's Alexa are all vulnerable to NUIT attacks.

I discovered a series of critical vulnerabilities in Nexx’s smart device product line, which encompasses Smart Garage Door Openers, Alarms, and Plugs. These vulnerabilities enabled remote attackers to open and close garage doors, take control of alarms, and switch smart plugs on and off for any customer. Nexx has not replied to any correspondence from myself, DHS (CISA and US-CERT) or VICE Media Group. I have independently verified Nexx has purposefully ignored all our attempts to assist with remediation and has let these critical flaws continue to affect their customers.

When a Wi-Fi user disconnects temporarily from the network. access points often save up any reply packets that arrive for requests that were still unanswered at the time that the device powered down or went out of range. The researchers figured out various ways of tricking some access points into releasing those queued-up network packets, either without any encryption at all, or encrypted with a new session key that they chose for the purpose.

After Samsung Semiconductor let its fab engineers use ChatGPT for assistance, they started using it to quickly fix errors in their source code, leaking confidential information like notes from internal meetings and data related to fab performance and yields in the process. The company now plans to develop its own ChatGPT-like AI service for internal use. But for now, it limits the length of questions submitted to the service to 1024 bytes, reports Economist.

Volkswagen dealerships will put out collection bins for old consumer batteries. This is appealing because there's evidence that recycled battery materials can perform better than freshly processed ones and because recycling battery materials in the US satisfies the domestic sourcing of critical minerals requirement in the new clean vehicle tax credit.