Privacy, Security Archive
To most Americans, the name MarketScan means nothing. But most Americans mean everything to MarketScan. As a repository of sensitive patient information, the company’s databases churn silently behind the scenes of their medical care, scooping up their most guarded secrets: the diseases they have, the drugs they’re taking, the places their bodies are broken that they haven’t told anyone but their doctor. The family of databases that make up MarketScan now include the records of a stunning 270 million Americans, or 82% of the population. The vast reach of MarketScan, and its immense value, is unmistakable. Last month, a private equity firm announced that it would pay $1 billion to buy the databases from IBM. It was by far the most valuable asset left for IBM as the technology behemoth cast off its foundering Watson Health business. Imagine how easy it would be for companies to hire only people in tip-top health, and disregard anyone with even the smallest of preexisting conditions. This data is hugely valuable to just about anyone.
If you created an online account to manage your tax records with the U.S. Internal Revenue Service (IRS), those login credentials will cease to work later this year. The agency says that by the summer of 2022, the only way to log in to irs.gov will be through ID.me, an online identity verification service that requires applicants to submit copies of bills and identity documents, as well as a live video feed of their faces via a mobile device. That will go down well.
The EU’s police agency, Europol, will be forced to delete much of a vast store of personal data that it has been found to have amassed unlawfully by the bloc’s data protection watchdog. The unprecedented finding from the European Data Protection Supervisor (EDPS) targets what privacy experts are calling a “big data ark” containing billions of points of information. Sensitive data in the ark has been drawn from crime reports, hacked from encrypted phone services and sampled from asylum seekers never involved in any crime. Sometimes we need to be reminded that authorities illegally amassing huge troves of data on unsuspecting and innocent people is not something that only happens in the US. But it is also worth noticing how in EU we at least have institutions that are trying curb these blind mass surveillance tendencies. If that fight will have measurable effects in the long run is something that we can’t foresee.
At CES this week, Lenovo announced that their new Z-series laptops would ship with AMD processors that incorporate Microsoft’s Pluton security chip. There’s a fair degree of cynicism around whether Microsoft have the interests of the industry as a whole at heart or not, so unsurprisingly people have voiced concerns about Pluton allowing for platform lock-in and future devices no longer booting non-Windows operating systems. Based on what we currently know, I think those concerns are understandable but misplaced. As usual, Matthew Garrett does an excellent job explaining complex topics like this.
Google’s Project Zero describes a (now fixed) zero-click exploit in iMessage, and, well, it’s kind of insane. JBIG2 doesn’t have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That’s exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It’s not as fast as Javascript, but it’s fundamentally computationally equivalent. Mother of god.
Today we are going to share the result of a bit of investigation that started a few months ago on STH. The short version, it appears as though the Dell EMC S5200-ON series switches, the company’s high-end 25GbE-200GbE switches, have license/ royalty stickers that have a different company name on them than they should have. Instead of saying “American Megatrends”, they instead said “American Megatrands”. To give some perspective, this looks strange because it would be like buying a Dell notebook and getting a “Macrosoft Wandows” license sticker on it. Through a fairly rough October, we validated that indeed these stickers are in the wild. Ultimately, after we brought their existence to American Megatrends (AMI) and Dell’s attention (HPE did not care enough to investigate), we now have an artifact that says that American Megatrends is honoring the license stickers and will not pursue legal action against Dell’s customers or those using them. This may seem like something insignificant and innocuous, but supply chain security is a big, big deal, and the fact these clearly misspelled license/royalty stickers made their way from printing down to the end-user of not just corporate hardware but supercomputers for the US military is… Concerning, to say the least. It shows that tampering with hardware anywhere between production of the individual chips and components down to delivery by the delivery person might be a lot easier to do than we think.
Human rights activists, journalists and lawyers across the world have been targeted by authoritarian governments using hacking software sold by the Israeli surveillance company NSO Group, according to an investigation into a massive data leak. The investigation by the Guardian and 16 other media organisations suggests widespread and continuing abuse of NSO’s hacking spyware, Pegasus, which the company insists is only intended for use against criminals and terrorists. Pegasus is a malware that infects iPhones and Android devices to enable operators of the tool to extract messages, photos and emails, record calls and secretly activate microphones. Is anyone really surprised? Smartphones are the ideal tools for authoritarian regimes – cameras, microphones, GPS, and other sensors in one neat little package, always on the person, ready to be exploited. Of course criminal regimes are going to abuse them, and of course no smartphone is safe.
When you create standard RSA keys with ssh-keygen you end up with a private key in PEM format, and a public key in OpenSSH format. Both have been described in detail in my post Public key cryptography: RSA keys. In 2014, OpenSSH introduced a custom format for private keys that is apparently similar to PEM but is internally completely different. This format is used by default when you create ed25519 keys and it is expected to be the default format for all keys in the future, so it is worth having a look. An in-depth analysis of what’s inside the OpenSSH private key format and how it is different from the standard PEM format.
Remember that story from two years ago, about how China had supposedly infiltrated the supply chain of Supermicro? The story was denied by American intelligence agencies and the CEOs of Apple and Amazon, but today, Bloomberg posted a follow-up piece with more sources, both anonymous and named, that the story was, in fact, real, and probably a lot bigger, too. The article lists several attacks that have taken place, all using hardware from Supermicro. Each of these distinct attacks had two things in common: China and Super Micro Computer Inc., a computer hardware maker in San Jose, California. They shared one other trait; U.S. spymasters discovered the manipulations but kept them largely secret as tthey tried to counter each one and learn more about China’s capabilities. Bloomberg is clearly sticking by and expanding its story, so this means it’s their and their sources’ word against that of giant corporations and American intelligence agencies, and we all know giant corporations and American intelligence agencies never lie. Right?
I recently came across SerenityOS when it was featured in hxp CTF and then on LiveOverflow’s YouTube channel. SerenityOS is an open source operating system written from scratch by Andreas Kling and now has a strong and active community behind it. If you’d like to learn a bit more about it then the recent CppCast episode is a good place to start, as well as all of the fantastic videos by Andreas Kling. Two of the recent videos were about writing exploits for a typed array bug in javascript, and a kernel bug in munmap. The videos were great to watch and got me thinking that it would be fun to try and find a couple of bugs that could be chained together to create a full chain exploit such as exploiting a browser bug to exploit a kernel bug to get root access. You don’t get articles like this very often – exploiting a small hobby operating system? Sure, why not.
There are well documented security flaws in GSM, and publicly available tools to exploit them. At the same time, it has become considerably cheaper and easier to analyze GSM traffic over the past few years. Open source tools such as gr-gsm have matured, and the community has developed methods for capturing the GSM spectrum without the need for expensive SDR radios. With less than $100 and a weekend it’s possible to capture and analyze GSM traffic. With some extra effort it’s possible to decrypt your own traffic, and depending on how your mobile provider has set up their network it may even be possible for somebody else to illegally decrypt traffic they don’t own. GSM is terrifying.
The WhatsApp messaging service announced on Friday that it would delay changes to new business features after people around the world criticized the new policy. The Facebook-owned company said it is “going to do a lot more to clear up misinformation around how privacy and security works on WhatsApp.” Privacy rights activists heavily criticized the WhatsApp changes, saying it was the latest step showing Facebook’s poor handling of user data. The real issue was a far larger than expected exodus of users to services like Signal and Telegram. I doubt Facebook will actually make any meaningful changes – instead, we’ll see a different tone or wording.
How do you send a password over the internet? You acquire a SSL certificate and let TLS do the job of securely transporting the password from client to server. Of course it’s not as cut-and-dry as I’m making it out to be, but the gist of it holds true and stood the test of time. This hasn’t always been this way though, and one incredibly popular storefront on the world wide web prefers to add a little extra to this day. I’ll be discussing Steam’s unique method of logging in their users, and go down a deep rabbit hole of fascinating implementation details. Not exactly my cup of tea, but if there’s one thing I’ve learned over the years here at OSAlert, it’s that the most obscure stuff can generate a lot of interest. So, here you go.
When Apple unveiled major privacy upgrades at the WWDC 2020 for its iOS14, a battle royale broke out between the tech giant and Facebook. The social media giant claimed user data was critical to its ability to serve relevant ads and that Apple’s policies would stymie small business. As the world now grapples with Facebook’s privacy changes that require users to compulsorily share their Whatsapp data with the social media platform, Apple’s privacy labels update all but confirms what we always knew. That, data collected by Whatsapp and Facebook Messenger is far in excess of what its competitors do. Apple’s privacy labels are a great idea, and despite Google being a data-hungry company, I wouldn’t be surprised if they make their way to Android soon, too. I love how they make the contrast between various applications to incredible stark and clear. Good move by Apple.
The EU is often at the forefront of consumer protection when it comes to privacy laws like the GDPR. But now it looks like the Council of the European Union might undermine all of this with a move to cancel secure end-to-end encryption as we know it, the ORF (Austrian Broadcasting Corporation) reports. The ORF obtained an internal draft in which the Council argues that the motion is meant as a counteract against terrorism, pointing to last week’s Vienna shooting. However, it’s becoming increasingly clear that the terror attack could’ve been prevented without further surveillance powers if it wasn’t for egregious mistakes in the Austrian counterterrorism office. It seems like the attack is used as a pretense to gain public support. Throwing babies out with the bathwater under nebulous claims of “but terrorism!” isn’t just an American thing. For now, this is just a proposal by one cog in the EU government machine and it’s unlikely to go anywhere (for now!), but wheels are definitely in motion, and just like our friends in the US, we have to remain vigilant for politicians abusing terrorist attacks to erode our rights and freedoms.
The Supreme Court is considering whether to adopt a broad reading of the Computer Fraud and Abuse Act that critics say could criminalize some types of independent security research and create legal uncertainty for many security researchers. Voatz, an online voting vendor whose software was used by West Virginia for overseas military voters in the 2018 election, argues that this wouldn’t be a problem. “Necessary research and testing can be performed by authorized parties,” Voatz writes in an amicus brief to the Supreme Court. “Voatz’s own security experience provides a helpful illustration of the benefits of authorized security research, and also shows how unauthorized research and public dissemination of unvalidated or theoretical security vulnerabilities can actually cause harmful effects.” As it happens, we covered a recent conflict between Voatz and an independent security researcher in last Thursday’s deep dive on online voting. And others involved in that altercation did not see it the way Voatz did. This reminds me of TurboTax in the United States, who lobbies aggressively to keep filing taxes as difficult as possible as to protect its business.
As reported on CNET today: A huge proportion of internet-connected imaging devices at hospitals run outdated operating systems, according to research released Tuesday by Palo Alto Networks, a cybersecurity firm. The company found that 83% of these devices run on outdated software that can’t be updated even when it contains known vulnerabilities that hackers can exploit. This is such a serious issue, but most people are oblivious to the problem of critical legacy systems that cannot be upgraded. Most critics just make uniformed statements like “upgrade” to a modern OS, but it’s usually a cocktail of ageing hardware and legacy software requirements that will stop upgrades from happening.
For more than half a century, governments all over the world trusted a single company to keep the communications of their spies, soldiers and diplomats secret. The company, Crypto AG, got its first break with a contract to build code-making machines for U.S. troops during World War II. Flush with cash, it became a dominant maker of encryption devices for decades, navigating waves of technology from mechanical gears to electronic circuits and, finally, silicon chips and software. But what none of its customers ever knew was that Crypto AG was secretly owned by the CIA in a highly classified partnership with West German intelligence. These spy agencies rigged the company’s devices so they could easily break the codes that countries used to send encrypted messages. The article is behind a paywall, sadly, but I figured it’s important enough to link to.
I suspect that Wacom doesn’t really think that it’s acceptable to record the name of every application I open on my personal laptop. I suspect that this is why their privacy policy doesn’t really admit that this is what that they do. I imagine that if pressed they would argue that the name of every application I open on my personal laptop falls into one of their broad buckets like “aggregate data” or “technical session information”, although it’s not immediately obvious to me which bucket. Does Wacom have any competitors? Can you even vote with your wallet, or is this yet another market that isn’t really a market at all?
The real reason for Britain’s nonexclusion of Huawei was kept under wraps by its government: fear of retaliation. After Brexit, London sees itself as dependent on Beijing’s goodwill. In an interview with the Global Times on Jan. 20, the Chinese ambassador to Britain made it clear that an exclusion of Huawei would severely damage economic and political relations. And for Johnson, the threats from Beijing—a government with expansive control over its national economy—were more credible than those of U.S. President Donald Trump’s administration. Of course, fear isn’t much of an appealing public justification, especially for someone such as Johnson, who wants to project the image of a fearless leader. That’s why the government has come up with an extensive technical justification for the decision—an explanation that’s full of contradictions. Wait, you mean to tell me that going alone instead of being part of the biggest trade and power block after the US opens you up to manipulation and spying by and subservience to the likes of China and Russia? This should make it clear to the US and the EU that the UK should not be trusted with intelligence data.
Submitted by 
Submitted by