- Vulnerable U
- Posts
- 🎓️ Vulnerable U | #042 - Don't Panic!
🎓️ Vulnerable U | #042 - Don't Panic!
Bruce Schneier on AI and Trust, Supply chain attack on Ledger crypto package, Cox Marketing Group claims to be able to target ads based on listening to your conversations, Google kills ability to fulfill broad location based warrants, and more!
Matt Johansen
December 15, 2023
Read Time: 9 minutes
Howdy friends!
I hope you all had a good Hanukkah if that is your jam, and it ended last night. I, for one, am still not done Christmas shopping. Last weekend, I walked into an Ulta makeup store, and the employees looked at me like an adorable lost puppy. The number of “Is there anything I can help you with?” approaches I got with the saddest look in their eyes told me they knew I was swimming way out of my element.
This week, I had some thoughts about Obsession and challenged us all to ask ourselves, “What are we obsessed with?” I started writing a blog on the topic but didn’t get to finish it this week, so let’s all do the thought exercise this week, and I’ll expand on it soon. Are you currently working on what you are obsessed with? If you create content of any kind, are you creating about what you are obsessed with, or are you focused on what an audience might want?
ICYMI
🖊️ Something I wrote: Covered this NXP chip manufacturer hack in the newsletter but expanded on it over on Twitter this week and it’s getting more attention.
🎧️ Something I heard: I’m an Ali Abdaal fan, but this latest video was one of my favorites of his. He genuinely reflected on what he was spending time on and asked an interesting question, “What would you be doing if money were no object?”
🎤 Something I said: Don’t steal source code. And then definitely don’t share your screen with the company you stole it from, showing them what you stole.
🔖 Something I read: “How many newsletters have you printed out and put on your bookshelf?”
Vulnerable News
When Bruce Schneier writes, I read it. Not many have been thinking and writing about cybersecurity longer than he has, so his perspective is always welcome. This is a must-read piece on AI and trust.
“We will make a fundamental category error. We will think of AIs as friends when they’re really just services. [And] the corporations controlling AI systems will take advantage of our confusion to take advantage of us.“
Bruce talks about what he thinks we should be worrying about with AI and makes a strong case for how we can only trust it through well-informed government regulation. “Many countries are contemplating AI safety and security laws—the EU is the furthest along—but I think they are making a critical mistake. They try to regulate the AIs and not the humans behind them.”
"It will act trustworthy, but it will not be trustworthy. We won’t know how they are trained. We won’t know their secret instructions. We won’t know their biases, either accidental or deliberate." (read more)
This one hits all the buzzwords. Supply chain! crypto! phishing!
TL;DR - an ex-Ledger employee was phished and still had access to the npm account, which let the attackers publish a malicious version of the app that got updated to a ton of crypto projects out there. The malicious version worked by siphoning off funds to the hacker’s wallet - totaling over $600k during the few hours the attack was live.
Above is the timeline as put out by Ledger's official Twitter account. (read more)
You know how we’ve all been saying for a few years if you have a conversation about something, you get an ad about it later that day? “Man, I haven’t talked about that in years, and we just talked about it this week, and here it is on Instagram.”
And you know, after all that, we’ve been told it is impossible, and nobody is listening to us?
Well, a marketing company is saying the quiet part out loud and claiming they have this capability. “What would it mean for your business if you could target potential clients actively discussing their need for your services in their day-to-day conversations? No, it's not a Black Mirror episode—it's Voice Data, and CMG has the capabilities to use it to your business advantage.”
I’m not sure about this story since, up until this point, we’ve had no evidence that our devices are sending ambient conversation data to “phone home.” But while searching around, I’ve seen a few folks saying this CMG marketing company has been trying to sell this capability recently.
Not that this is proof of anything, but a Reddit thread from 3 months ago talked about how a salesperson from Cox called and was trying to sell data from “active listening” capabilities on people’s Amazon, Apple, and Google device microphones.
What do you think about this one? Legit or an overzealous sales group? (read more)
We will file this under a “business logic vulnerability.” Or maybe just a scam. The business logic here, instead of manipulating some parameters on a website, is manipulating a fulfillment center employee to mark an item as returned even though it wasn’t.
An organization named REKK would either social engineer, bribe, or phish employees to get their privileged access, marking items as returned and issuing refunds. “REKK advertised its services to shoppers in a Telegram channel with 30,000 followers, taking payment as a part of the item’s original price and then manipulating the system to log a return, which never happened.” (read more)
We discussed this story a few months back when a study came out about exactly how much location data Google shared with law enforcement. Specifically, we were concerned about how much that data was related to people not accused of wrongdoing.
Well, now it seems they’re snipping their capability to comply with these warrants from law enforcement, which is a privacy cause to celebrate.
“The repository of everyone’s location data dating back months or years was a hazard, and Google is trying to clean up that hazard,”
Google will still comply with requests, but this change limits the potential splash damage.
“The change doesn’t prevent the government from getting information on a specific user by demanding their full account details, the Google employee said. But investigators can no longer hand over some coordinates and a timeframe, and compel Google to give it either identifying data or metadata on all users within those parameters.” (read more)
We continue to see the need for more prolific secrets scanning to ensure you don’t push your API keys to GitHub. My friends at Truffle make an open-source tool that makes this super easy, and I’ve launched them personally on several repos.
With some slight regex gymnastics, this report from Lasso talks about how they found 1681 valid HuggingFace tokens publicly on GitHub. They even gained full access to Meta-Llama, Bloom, Pythia, and HuggingFace repositories. (read more)
Speaking of my friends at Truffle, they found a big one recently. This post breaks down an absolute whale of a repo found to be used in a crypto mining scheme. I learned a lot I didn’t know in this one, specifically about how the Chia crypto network works.
“Mining Chia coins, unlike Bitcoin (which uses Proof of Work) or Ethereum (which uses Proof of Stake), uses Proof of Space and Time. In other words, it’s not just about how fast you can compute or how many coins you already have; the Chia network requires a massive amount of storage space for a miner to be competitive.”
Also interesting, “A threat report from Google in 2023 states that 70% of compromised GCP assets were used to mine cryptocurrency. It’s an easy way to quickly monetize compromised assets, but the way that this repo was structured suggests that it more than likely used legitimate (not compromised) Google credentials for abuse.” (read more)
BACK IN MY DAY… I shout from a rocking chair on my porch. Ok, but seriously, I was really good at finding this particular combination of bugs. I had a helluva career at WhiteHat, building their AppSec research team. Most of my bugs weren’t public, but one was and got a BlackHat and DEFCON talk about it.
Enough about me, but understand I LOVE the combo of XSS and CSRF. The crux of why this combo is excellent is that it can create a worm. Do you remember the Samy worm that took down Myspace? (I’m still in my rocking chair, showing my age) - That was an XSS CSRF combo as well.
In short, you’re executing malicious javascript in a victim’s browser and then using CSRF to get them to post the same malicious javascript to their profile, which then spreads the worm.
The linked thread is an example of this in action for a bug bounty on Twitter, so we can read about it and get a great video POC. I’m not sure this one is wormable and might be CSRF-like functionality in an account takeover way. Check it out! (read more)
Remember when that guy shared classified documents in a Discord server to impress his gaming buddies? We just got the investigative report on what they found as it went public this week. TL;DR - he acted alone, but a series of systematic failures allowed it to happen.
Solo Act with Systemic Issues: Teixeira acted alone in leaking documents but was enabled by systemic security oversights.
Warning Signs Overlooked: Multiple incidents where Teixeira displayed suspicious behavior were ignored or inadequately addressed.
Leadership Accountability: The breach resulted in disciplinary actions against multiple Air National Guard leaders, including high-ranking officers.
Policy Reforms Enacted: The USAF has revised its need-to-know and classified data access standards in response to the breach. (read more)
Say it with me! No! More! Drivers! - That’s right, Microsoft is finally moving away from drivers for using a printer with a Windows machine. I’m not sure what is more surprising: Microsoft making the printing experience better and more secure for users or that anyone still prints anything.
I remember being shocked when the startup I was working for got bought by a big bank, I went to their NYC headquarters and realized how many people still printed out so many things to bring into a conference room. I hadn’t used a printer since college at that point so it was strange to see the culture still existed.
Anyway, kudos to MS on this move. I feel like some folks who support large Windows networks are about to breathe a sigh of relief as the 3rd party driver attack surface slips into the sunset. (read more)
This article interested me because of the prevalence of the word “electronic warfare.” Not cyberwar, electronic. It seems Ukraine has successfully used radio jammers to keep Russian drones grounded and maintain air superiority. There is hesitation to say it could keep it up, but I’m surprised at how well this jamming technology has been working here. (read more)
I know you’re sick of hearing about this security incident and I’m kind of sick of talking about it. But besides the last few weeks learning about number of victims we’re now learning of a TOS update that is trying to cover them from a class action lawsuit related to any data breaches.
“Following a hack that potentially ensnared 6.9 million of its users, 23andMe has updated its terms of service to make it more difficult for you to take the DNA testing kit company to court, and you only have 30 days to opt out.” (read more)
I included this one because it was rare that an EOL product would receive a patch like this. It seems this is due to the importance of patching in the face of active exploitation. (read more)
Miscellaneous mattjay
Drawing inspiration from ransomware
Parting Thoughts:
Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.
Stay safe, Matt Johansen
@mattjay