Internet Security, Abuse, Data Harvesting, Etc.

[LFC]

OOF! Serious rookie error.

Microsoft has released a fix for a harebrained Exchange Server bug that shut down on-premises mail delivery around the world just as clocks were chiming in the new year.

The mass disruption stemmed from a date check failure in Exchange Server 2016 and 2019 that made it impossible for servers to accommodate the year 2022, prompting some to call it the Y2K22 bug. The mail programs stored dates and times as signed integers, which max out at 2147483647, or 231 - 1. Microsoft uses the first two numbers of an update version to denote the year it was released. As long as the year was 2021 or earlier, everything worked fine.

“What in the absolute hell Microsoft?”

When Microsoft released version 2201010001 on New Year’s Eve, however, on-premises servers crashed because they were unable to interpret the date. Consequently, messages got stuck in transport queues. Admins around the world were left frantically trying to troubleshoot instead of ringing in the New Year with friends and family. All they had to go on were two cryptic log messages that looked like this:

[pnwguy]

Another interesting scam for exploitation. I was just in Austin using their parking meters last month.

www.pcmag.com/news/scammers-stick-fraudulent-qr-codes-on-texas-parking-meters

[LFC]

Chrome is moving towards plugging a major route used to infect servers.

For more than a decade, the Internet has remained vulnerable to a class of attacks that uses browsers as a beachhead for accessing routers and other sensitive devices on a targeted network. Now, Google is finally doing something about it.

Starting in Chrome version 98, the browser will begin relaying requests when public websites want to access endpoints inside the private network of the person visiting the site. For the time being, requests that fail won't prevent the connections from happening. Instead, they'll only be logged. Somewhere around Chrome 101—assuming the results of this trial run don't indicate major parts of the Internet will be broken—it will be mandatory for public sites to have explicit permission before they can access endpoints behind the browser.

[LFC]

You can download everything Amazon knows about you, not that you can do anything about it. The trove of personal data they keep is filled with the expected but they collect more than you probably expect.

The issue with Amazon, however, is the extent to which they collect and archive your data. Just about everything you do on, with, and around an Amazon product or service is logged and recorded. Sure, you might not be surprised to learn that when you visit Amazon’s website, the company logs your browsing history and shopping data. But it goes far beyond that. Since Amazon owns Whole Foods, it also saves your shopping history there. When you watch video content through its platforms, it records all of that information, too.

Things get even creepier with other Amazon products. If you read books on a Kindle, Amazon records your reading activity, including the speed of your page turns (I wonder if Bezos prefers a slow or fast page flip); if you peered into your Amazon data, you might find something similar to what a Reuter’s reporter found: On Aug. 8 2020, someone on that account read The Mitchell Sisters: A Complete Romance Series from 4:52 p.m. through 7:36 p.m., completing 428 pages. (Nice sprint.)

And THIS is why I refuse to have a voice assistant in my home.

If you have one of Amazon’s smart speakers, you’re on the record with everything you’ve ever uttered to the device: When you ask Alexa a question or give it a command, Amazon saves the audio files for the entire interaction. If you know how to access you data, you can listen to every one of those audio files, and relive moments you may or may not have realized were recorded.

Another Reuters reporter found Amazon saved over 90,000 recordings over a three-and-a-half-year period, which included the reporter’s children asking Alexa questions, recordings of those same children apologizing to their parents, and, in some cases, extended conversations that were outside the scope of a reasonable Alexa query.

[LFC]

Google must have figured out that having tracking turned off hits profits badly. Now they're turning it back on even for paid corporate customers.

Starting on March 29, Google is changing its infamous "Web & App Activity" controls for paid users of Google Workspace. That feature is now being split up into two settings, one still called "Web & App Activity" and another called "Search history." The big news is that Google is taking advantage of this settings split to re-enable some tracking features, even if users have previously opted out.

Google has started emailing Workspace administrators about the change (thanks, Hacker News), and a support page gives some details about what's going on. Both the email and support page are incredibly confusing—even Google's own employees have a hard time parsing Google's privacy controls—but we'll try to shed some light on the situation.

The support page begins, "Starting March 29, 2022, the Web & App Activity Admin console setting is going away." "Web & App Activity" is one of the two main Google privacy settings (along with "Location History") that saves everything you do on your Google account. You might remember these settings from several lawsuits about how confusing and poorly labeled they were. Leaving these settings on means that features like autocomplete work better, but it also means that Google gets to keep all your activity.

Note that this line says the Admin control for the Web & App Activity setting is going away, not the entire setting itself. Google is saying the Web & App Activity feature will no longer be centrally controllable by your administrator. The crux of those earlier privacy lawsuits was that having privacy settings bizarrely split across two switches was unnecessarily confusing. Now, with Search History, privacy settings are split across three switches.

I struggle to give Google the benefit of the doubt here since the end result of all these changes just happens to be "more user tracking." The organization-wide control for Web & App Activity is leaving the admin panel, and the switch for that control will now be up to each individual user. Google would probably argue that the switch for Web & App Activity doesn't belong in the admin panel since it no longer affects specifically "Workspace" products. But we're still talking about a Workspace account, and leaving the setting up to less tech-savvy users will result in fewer of them finding and understanding it.

The new Search History setting also isn't in the administrator panel. Google is leaving this up to users and taking the incredible step of turning on data retention even for users who have previously opted out of the tracking this covers. Every individual user who already said they don't want this will have to hunt down the setting again. Admins who don't want this will have to hound each individual user to shut it off.

There is already widespread confusion in the Hacker News thread and other places about these changes, and Google's communication in the email and support page is nowhere near as clear as it should be. To quote one of the Googlers cited in Arizona's location-history lawsuit, Google's settings and communication feel like they are "designed to make things possible, yet difficult enough that people won't figure it out."

"Do no harm" is waaaaayyyyy back in the rear view mirror.

[LFC]

NSO, the spyware group out of Israel, apparently tried to buy access to cellular networks with "big bags of cash."

A whistleblower alleges that the scandal-ridden spyware firm NSO Group once offered a telecom security company “bags of cash” to buy access to its cellular networks, ostensibly so its clients could track specific mobile users within the United States.

The claims come from Gary Miller, a cybersecurity professional who previously served as a vice president at network security firm Mobileum. Miller, who has since left the company, said that during a 2017 conference call between the firm and NSO representatives, one of the spyware executives pushed for access to SS7—an insecure networking protocol that has been known to allow for covert surveillance of unsuspecting phone users. When queried as to how such a transaction would occur, NSO co-founder Omri Lavie is reputed to have told Mobileum officials: “We drop bags of cash at your office.”

Miller claims that he originally reported this encounter to the FBI via an online tip portal back in 2017 but never heard back. Then, last year, amidst an ongoing DOJ investigation into NSO, he formally handed over his claims again—this time directly to the Justice Department. He says he has also provided detailed information about the incident to both the Securities and Exchange Commission and the Federal Communications Commission.

SS7 has reportedly been a vector for shady surveillance for years. The protocol has well-known security flaws that hackers can use to listen in on phone calls and track devices. The Saudi and Chinese governments, as well as Israeli hacker-for-hire firms, have been accused of using these security flaws to hack unsuspecting mobile users—including Americans. In December, a global messaging contractor, Mitto AG, was similarly accused of selling SS7 access to private security firms which, in turn, would allegedly sell it to law enforcement agencies.

[AnBr]

Remember when Google started their motto was "Do no evil"?

[LFC]

NSO isn't the only Israeli firm with iPhone hacking software.

As surveillance controversies have raged in connection with Israeli spyware vendor NSO Group, another, lesser known spyware firm from Israel has also apparently been helping hack iPhones all over the world.

Reuters reports that the company QuaDream is a smaller, “lower profile” surveillance vendor that nevertheless boasts similar hacking capabilities to NSO and, in fact, was partially founded by two former NSO employees. Apparently based in Tel Aviv, the firm hasn’t had much exposure in the American press until now but, like NSO, QuaDream has similarly exploited “many of the same vulnerabilities” in Apple’s software to help its clients hack iPhone users, Reuters reports.

QuaDream reportedly sells a “zero-click” exploit—a sneaky cyberattack that can silently compromise phones without any need for phishing. That exploit, cheerfully dubbed REIGN, is thought to be almost identical to FORCEDENTRY, a fearsome NSO cyber exploit that is reputed to be “one of the most technically sophisticated exploits” ever produced, according to the Google researchers who analyzed it.

Similarly, QuaDream’s spyware seems to have frightening capabilities that can completely and utterly invade a person’s digital life. Reuters writes that REIGN has the capability to:

...take control of a smartphone, scooping up instant messages from services such as WhatsApp, Telegram, and Signal, as well as emails, photos, texts and contacts, according to two product brochures from 2019 and 2020 which were reviewed by Reuters. REIGN’s “Premium Collection” capabilities included the “real time call recordings”, “camera activation - front and back” and “microphone activation”, one brochure said.

Turns out Israel is a major hub for cyberweapon companies.

Israel has a thriving surveillance industry and is reportedly one of the biggest hubs for cyberweapons distribution in the world. Four other Israeli surveillance firms, including CobWebs Technologies, Bluehawk CI, Cognyte, and Black Cube, were all kicked off of the company formerly known as Facebook’s platforms in December after it was revealed they had been engaged in ongoing espionage activities targeted at tens of thousands of users.

[LFC]

Awesome.

About 500 e-commerce websites were recently found to be compromised by hackers who installed a credit card skimmer that surreptitiously stole sensitive data when visitors attempted to make a purchase.

A report published on Tuesday is only the latest one involving Magecart, an umbrella term given to competing crime groups that infect e-commerce sites with skimmers. Over the past few years, thousands of sites have been hit by exploits that cause them to run malicious code. When visitors enter payment card details during purchase, the code sends that information to attacker-controlled servers.

Sansec, the security firm that discovered the latest batch of infections, said the compromised sites were all loading malicious scripts hosted at the domain naturalfreshmall[.]com.

“The Natural Fresh skimmer shows a fake payment popup, defeating the security of a (PCI compliant) hosted payment form,” firm researchers wrote on Twitter. “Payments are sent to https://naturalfreshmall[.]com/payment/Payment.php.”

[LFC]

You don't have to be particularly sophisticated to be effective. From the School of If At First You Don't Succeed...

Researchers on Tuesday revealed a new threat actor that over the past five years has blasted thousands of organizations with an almost endless stream of malicious messages designed to infect systems with data-stealing malware.

TA2541, as security firm Proofpoint has named the hacking group, has been active since at least 2017, when company researchers started tracking it. The group uses relatively crude tactics, techniques, and procedures, or TTPs, to target organizations in the aviation, aerospace, transportation, manufacturing, and defense industries. These TTPs include the use of malicious Google Drive links that attempt to trick targets into installing off-the-shelf trojans.

But what the group lacks in sophistication, it makes up for with a tenacity and persistence that allows it to nonetheless thrive. Since Proofpoint began tracking the group five years ago, it has waged an almost unending series of malware campaigns that typically deliver hundreds to thousands of messages at a time. A single campaign can impact hundreds of organizations all over the world, with an emphasis on North America, Europe, and the Middle East.

“Often, campaigns contained several hundred to several thousand email messages to dozens of different organizations,” company researchers Selena Larson and Joe Wise wrote in a report published on Tuesday. “Although Proofpoint has observed TA2541 targeting thousands of organizations, multiple entities across aviation, aerospace, transportation, manufacturing, and defense industries appear regularly as targets of its campaigns.”

[LFC]

Yet more victims. It really doesn't feel like we're taking computer security all that seriously. It feels like there are multiple architecture issues and that the track record warrants thinking about distributed computing in a whole new way.

A couple of days after the FBI warned that a ransomware group called BlackByte had compromised critical infrastructure in the US, the group hacked servers belonging to the San Francisco 49ers football team and held some of the team’s data for ransom.

Media representatives for the NFL franchise confirmed a security breach in an emailed statement following a post on BlackByte’s dark web site, on which the hacker group attempts to shame and scare victims into making big payouts in exchange for a promise not to leak the data and to provide a decryption key that allows the data to be recovered. The recent post made available for download a 379MB file named “2020 Invoices” that appeared to show hundreds of billing statements the 49ers had sent partners including AT&T, Pepsi, and the city of Santa Clara, where the 49ers play home games.

[snip]

“As of November 2021, BlackByte ransomware had compromised multiple US and foreign businesses, including entities in at least three US critical infrastructure sectors (government facilities, financial, and food and agriculture),” the advisory stated. “BlackByte is a Ransomware as a Service (RaaS) group that encrypts files on compromised Windows host systems, including physical and virtual servers.”

[LFC]

I'm going with "abuse" on this one. It's just creepy.

Online test takers around the country are reportedly getting tricked into using fake answer sites surreptitiously snitching on them to universities, a sneaky practice some education advocates claim amounts to entrapment. In one case, prolific remote proctoring company Honorlock reportedly had around 12 of these “seed sites” linked to its service, with five still active.

Those honeypot sites—first detected by University of Central Florida computer science student Kurt Wilson and detailed in a recent Markup report—lure students in with what appears to be, at first glance, the answer to a plethora of wide-ranging college exam questions. The still-active sites which include “gradepack.com” and “quizlookup.com,” present the visitors with two large buttons saying “show answer” or “hide answer.” Students who click either of these buttons annoyingly aren’t awarded an answer but instead receive a strange digital beeping sound. Dejected, most users will then quickly exit the page in frustration, not knowing the brief interaction served as a spying tool.



The linked honeypot sites can reportedly collect a visitor’s IP address to serve as proof they were trying to search for a test answer online, according to a Honorlock patent seen by The Markup and student media at Arizona State University. Additionally, an analysis of the site’s source code conducted by The Markup determined Honorlock can view a visitor’s mouse movements, what they entered into the site’s search bar, and evidence of where they may have clicked.

If you wanted to indoctrinate an entire generation into mistrust of authority this is a GREAT way to train 'em up.

The sudden shift to distance learning brought on by the pandemic has ushered in a tidal wave of interest in remote monitoring throughout education. A report released last year by the Center for Democracy and Technology found that 81% of teachers surveyed said their school or school district used some form of surveillance software. That uptick disproportionately affects lower-income students who have no choice but to rely on devices provided by school districts, the report adds.

Regardless of how prevalent monitoring software actually is, students overwhelmingly believe they are being monitored. Nearly 60% of students surveyed by the CDT said they do not share their true thoughts or ideas because they believe they are being monitored, while another 80% said they were more careful about what they searched online.

[pnwguy]

I listened to this re-run yesterday, and it had a lot of scary information from a cyber-security expert and journalist. It was an interview conducted by The Lincoln Project's Reed Galen, with NY Times writer Nicole Perlroth.

open.spotify.com/episode/2ldNWwfffwMCEPiEyAVTba

[andydp]

Looks like Amazon Web Services is down again.

[andydp]

Actual serious question for the membership:

Do any of you know of an answering machine/cordless phone system that has a battery backup ?  (This would be for a land line - we're fuddy duddis so yes we still have one.)

Last night we had about a five second power blip (on/off/on) aside from having to reset our clocks, micowave etc, I also have to reprogram the answering machine. Do any of you know an answering system that has a battery backup or "memory save" function eliminating the need to reprogam every time we get a power "event" ?

[pnwguy]

Feb 23, 2022 13:40:30 GMT andydp said:

Actual serious question for the membership:

Do any of you know of an answering machine/cordless phone system that has a battery backup ?  (This would be for a land line - we're fuddy duddis so yes we still have one.)

Last night we had about a five second power blip (on/off/on) aside from having to reset our clocks, micowave etc, I also have to reprogram the answering machine. Do any of you know an answering system that has a battery backup or "memory save" function eliminating the need to reprogam every time we get a power "event" ?

There are small battery backup UPS devices with a 110 volt inverter for around $50.  That would power more than just the tiny load of a phone/answering machine.  

[LFC]

Another day, another expensive security breach.

The world's largest automaker is suspending production at a third of its factories, according to Reuters. Toyota says it will temporarily stop making cars at its Japanese factories after one of its suppliers was hacked.

The company in question is called Kojima Industries, which makes composite and plastic parts for Toyota, both for car interiors and also parts for Toyota's hybrid and fuel cell electric vehicles. Reuters quotes a Toyota spokesperson who described the event as a "supplier system failure."

Consequently, on March 1, Toyota will halt 28 production lines at 14 factories across Japan.

[Bact PhD]

This made me go, Hmmm.

www.cnbc.com/2022/03/01/why-companies-are-moving-to-a-zero-trust-model-of-cyber-security-.html

The latest catchphrase in cyber security might as well be “don’t trust anyone — or anything.”

The zero trust model of security, which takes the approach that no users or devices are to be trusted without continuous verification, continues to gain momentum as organizations look to stay ahead of bad actors and avoid breaches.


Given what’s going on in Ukraine, the accompanying world tensions, and the constant concerns about Russian-sponsored hackers, the time for such an approach to cyber security seems especially fitting.

The term “zero trust” has taken on multiple meanings as vendors scramble to take advantage of the high interest level. But the definition the National Institute of Standards and Technology (NIST) puts forth is likely the most accepted: “Zero trust is the term for an evolving set of cyber security paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources. Zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location.”

[LFC]

This is like hearing how certain fault lines are primed and due to cause massive destruction, just on a digital level. At what point does somebody, especially somebody like Putin, show how they can flex their muscles?

Last August, academic researchers discovered a potent new method for knocking sites offline: a fleet of misconfigured servers more than 100,000 strong that can amplify floods of junk data to once-unthinkable sizes. These attacks, in many cases, could result in an infinite routing loop that causes a self-perpetuating flood of traffic. Now, content-delivery network Akamai says attackers are exploiting the servers to target sites in the banking, travel, gaming, media, and web-hosting industries.

These servers—known as middleboxes—are deployed by nation-states such as China to censor restricted content and by large organizations to block sites pushing porn, gambling, and pirated downloads. The servers fail to follow transmission control protocol specifications that require a three-way handshake—comprising an SYN packet sent by the client, an SYN+ACK response from the server, followed by a confirmation ACK packet from the client—before a connection is established.

This handshake limits the TCP-based app from being abused as amplifiers because the ACK confirmation must come from the gaming company or other target rather than an attacker spoofing the target’s IP address. But given the need to handle asymmetric routing, in which the middlebox can monitor packets delivered from the client but not the final destination that’s being censored or blocked, many such servers drop the requirement by design.

[snip]

The researchers said at the time that they had no evidence of middlebox DDoS amplification attacks being used actively in the wild but expected it would only be a matter of time until that happened.

On Tuesday, Akamai researchers reported that day has come. Over the past week, the Akamai researchers said, they have detected multiple DDoSes that used middleboxes precisely the way the academic researchers predicted. The attacks peaked at 11Gbps and 1.5 million packets per second.

While small when compared to the biggest DDoSes, both teams of researchers expect the attacks to get larger as DDoSers begin to optimize their attacks and identify more middleboxes that can be abused (the academic researchers didn’t release that data to prevent it from being abused).

Kevin Bock, the lead researcher behind last August’s research paper, said DDoSers had plenty of incentives to reproduce the attacks his team theorized.

“Unfortunately, we weren’t surprised,” he told me upon learning of the active attacks. “We expected that it was only a matter of time until these attacks were being carried out in the wild because they are easy and highly effective. Perhaps worst of all, the attacks are new; as a result, many operators do not yet have defenses in place, which makes it that much more enticing to attackers.”

[LFC]

This one falls under "abuse" in the subject line. This action by Samsung is just slimy but I guess you have to coral people into your own apps and make them want to by new phones somehow.

Samsung is once again in hot water over how it treats benchmark apps. This time, the company is accused of throttling 10,000 Android apps—but not benchmark apps. It sounds like the scheme OnePlus was caught running last year. Instead of boosting the SoC speeds when a benchmark app is running, Android OEMs are now turning down phone performance any time a benchmark app isn't running. It's like benchmark cheating but in reverse.

Samsung's throttling app is called the "Game Optimizing Service." Users of the Korean message board Clen.net found wildly different benchmark scores depending on whether benchmark apps had their original names or not. By changing the package names of popular benchmark apps—thereby making the "Game Optimizing Service" treat a benchmark app like a normal app—scores dropped anywhere from 13 to 45 percent on the Galaxy S10, S20, S21, and the new S22. Normally, the throttling behavior is not user-controllable, but the users are tricking the service by modifying apps.

John Poole, the lead developer of Geekbench, was able to reproduce the wild performance changes based on whether the S22 thought it was running a benchmark or a game. Poole changed Geekbench's package name to that of Genshin Impact, a popular game, and saw benchmark scores plummet. The Snapdragon Galaxy S22 dropped its single-core score 46 percent, while the multi-core score was down 35 percent. Poole confirmed that this behavior exists on the Exynos S10 as well.

Clen.net forum user "squiny" was nice enough to post the full database of apps targeted by Samsung's throttling app, and we gave it a quick audit. This "game optimizing" applies to more than just games. The database actually flags apps into "game" and "non-game" categories, with only 3,200 of the 10,000 apps actually categorized as games. The rest are normal, everyday apps.

[LFC]

If you have a Samsung phone you might want to worry a little.

Samsung confirmed on Monday that a cybersecurity attack exposed sensitive internal data including source code for Galaxy smartphones.

The group claiming responsibility for the attack, Lapsus$, is the same hacking outfit that breached Nvidia last week and leaked employee credentials and proprietary information onto the internet. In the Samsung hack, the group purportedly posted a 190GB torrent file to its Telegram channel, claiming it contains algorithms for biometric login authentication and bootloader—code that could be used to bypass some operating system controls.

Samsung disclosed the breach but didn’t confirm the identity of the hackers or the materials stolen. The company said personal data belonging to employees and customers had not been compromised.

“There was a security breach relating to certain internal company data,” Samsung told Bloomberg. “According to our initial analysis, the breach involves some source code relating to the operation of Galaxy devices but does not include the personal information of our consumers or employees.”

[LFC]

I'd be interested to know the real story on this one. Google has left their "do no harm" mantra waaaay back in the rear view.

Google is being sued by a Florida restaurant group alleging that the tech company has been setting up unauthorized pages to capture food orders rather than directing them to the restaurant’s own site.

Google uses “bait-and-switch” tactics to get customers to place takeout or pickup orders through “new, unauthorized, and deceptively branded webpages,” according to the lawsuit, filed on behalf of Left Field Holdings, a restaurant company that runs Lime Fresh Mexican Grill franchises. On those pages, customers are prompted with large buttons to order with food delivery companies like GrubHub, DoorDash, or Seamless.

Before the “Order Online” button appeared, Google search result pages for restaurant queries looked like many others do—a list of organic results accompanied by text ads. Then, in 2019, Google started rolling out the new button, which appears prominently in what the company calls the Business Profile, a collection of information about a business that appears alongside search results.

When users click the “Order Online” button, they’re directed to a page that in many cases contains large links to food delivery companies, complete with their logos. The restaurant’s own site gets a link as well, though it’s a small, generic “website” button. In some cases, Google provides an interface for assembling an order, complete with prices and descriptions of the menu items. Companies that have completed the “Order Online” setup with Google can also direct customers to their own online ordering services. Yet because many restaurants’ ordering sites are run by third parties, those links may not contain a restaurant’s name. In the case of Cambridge, Massachusetts, cafe Flour Bakery, for example, the option to order directly appears as “thelevelup.com”.

If restaurants haven’t completed the setup, Google appears to create a page anyway. It’s unclear how that happens, though it’s possible that a restaurant’s appearance in a delivery app is what triggers it. That isn’t always a sign of a business relationship between the restaurant and food delivery company, though. Many food delivery companies have been sued for adding restaurants without their consent.

“Google’s ‘Order Online’ button leads to an unauthorized online storefront—one owned and controlled by Google—wherein consumers can place orders for the restaurant’s products, all under the restaurant’s tradename,” the lawsuit says. “Google prominently features the restaurant’s tradename at the top of the page, above the restaurant’s address and menu, to give the user the distinct impression that the storefront and products are authorized and sponsored by the restaurant, when they are not.”

If the restaurant has a relationship with the food delivery company, it gets charged a fee. These fees can be so high—15 to 30 percent in many cases—that the restaurant has no hope of making a profit from the order. “A restaurant's motivation to partner with a Delivery Provider is almost never to make a profit on orders received from the Delivery Provider,” the complaint says. “Rather, a restaurant’s usual goal is to capture new customers that may later place orders with the restaurant outside of the Delivery Providers’ expensive platforms.”

But, the lawsuit says, because of the way Google’s “Order Online” feature is designed, it limits restaurants’ chances of taking orders directly.

[LFC]

Sounds like they've snagged two bad actors, one fleeing from Ukraine.

Federal prosecutors extradited two suspected ransomware operators, including a man they said was responsible for an intrusion that infected as many as 1,500 organizations in a single stroke, making it one of the worst supply chain attacks ever.

Yaroslav Vasinskyi, 22, was arrested last August as he crossed from his native country of Ukraine into Poland. This week, he was extradited to the US to face charges that carry a maximum penalty of 115 years in prison. Vasinskyi arrived in Dallas, Texas, on March 3 and was arraigned on Wednesday.

In an indictment, prosecutors said that Vasinskyi is responsible for the July 2, 2021, attack that first struck remote-management-software seller Kaseya and then caused its infrastructure to infect 800 to 1,500 organizations that relied on the Kaseya software. Sodinokibi/REvil, the ransomware group Vasinskyi allegedly worked for or partnered with, demanded $70 million for a universal decryptor that would restore all victims’ data.

On Thursday, US prosecutors reported a second ransomware-related extradition, this one against a Canadian man accused of participating in dozens of attacks pushing the NetWalker ransomware.

Sebastien Vachon-Desjardins, 34, of Gatineau, Quebec, Canada, was arrested in January 2021 on charges that he received more than $27 million in revenue generated by NetWalker. The Justice Department said the defendant has now been transferred to the US, and his case is being handled by the FBI’s field office in Tampa, Florida.

NetWalker was an advanced and prolific group that operated under a RaaS—short for "ransomware as a service"—model, meaning core members recruited affiliates to use the NetWalker malware to infect targets. The affiliates would then split any revenue generated with the organization. A blockchain analysis revealed that between March and July of 2020, the group extorted a total of $25 million. Victims included Trinity Metro, a transit agency in Texas that provides 8 million passenger trips annually, and the University of California, San Francisco, which ended up paying a $1.14 million ransom.

[LFC]

FYI if you have one of these model Android phones.

A researcher has successfully used the critical Dirty Pipe vulnerability in Linux to fully root two models of Android phones—a Pixel 6 Pro and Samsung S22—in a hack that demonstrates the power of exploiting the newly discovered OS flaw.

The researcher chose those two handset models for a good reason: they are two of the few—if not the only—devices known to run Android version 5.10.43, the only release of Google's mobile OS that's vulnerable to Dirty Pipe. Because the LPE, or local privilege escalation, vulnerability wasn't introduced until the recently released version 5.8 of the Linux kernel, the universe of exploitable devices—whether mobile, Internet of Things, or servers and desktops—is relatively small.

But for devices that do package affected Linux kernel versions, Dirty Pipe offers hackers—both benign and malicious—a platform for bypassing normal security controls and gaining full root control. From there, a malicious app could surreptitiously steal authentication credentials, photos, files, messages, and other sensitive data. As I reported last week, Dirty Pipe is among the most serious Linux threats to be disclosed since 2016, the year another high-severity and easy-to-exploit Linux flaw named Dirty Cow came to light.

Android uses security mechanisms such as SELinux and sandboxing, which often make exploits hard, if not impossible. Despite the challenge, the successful Android root shows that Dirty Pipe is a viable attack vector against vulnerable devices.

[LFC]

They hacked a major security protection service.

Hacker group LAPSUS$ posted screenshots Monday night claiming it had achieved administrator access to Okta, a user authentication and data management company. If that’s true, it’s potentially bad for a number of large firms that use Okta’s services, as the hackers could worm their way into other companies’ networks using passwords stored in Okta.

“Just some photos from our access to Okta.com Superuser/Admin and various other systems,” the hacking group wrote on its Telegram channel. “For a service that powers authentication systems to many of the largest corporations (and FEDRAMP approved) I think these security measures are pretty poor.”

The hacker group went on to post in all caps explaining that they didn’t access or steal any databases from Okta itself. “Our focus was ONLY on Okta customers,” the hacker group explained.

The screenshots include a timestamp from January of this year, suggesting the hackers have had access to Okta’s systems for months, if the screenshots themselves are authentic. It’s unclear whether the hackers still have that access. For its part, Okta claims the hackers only made limited incursions into its networks, and only then through a subcontractor.