40 Million Exposed In a UK cyber attack, Android 14 stops Stingrays, and CPUs across brands
are susceptible to hacks!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for August 15, 2023 - this is your summary
of the threats to our security, privacy and Internet freedom!
Let’s jump right into the news this week.
The UK Electoral Commission recently disclosed info on a massive data breach that exposed
the personal info of folks who registered to vote between 2014 and 2022.
The breach was actually detected way back in October 2022, but the attackers had already
been doing some recon on the Commission's systems since August 2021!
This cyberattack opened the door to the Commission's email servers, control systems, and even copies
of electoral registers.
And that’s not all!
This breach gave the threat actors access to names, addresses, email addresses, phone
numbers – you name it.
They even snagged personal images.
Hey, that’s creepy!
Anyone who registered to vote anonymously - you secrets are safe.
And if you're wondering, "did this mess with the election?"
Nope, it did not.
The electoral process and voter registration dodged the bullet, thankfully.
But here's where it gets interesting.
The Commission downplayed the issue, saying that much of that data is already publicly
available.
Certainly, some of it is public, like names and addresses.
But those email addresses and phone numbers?
That's prime bait for phishing attacks and identity theft as that data was not in the
public domain.
So, if you're a UK voter, brace yourself, phishing is coming.
Call up the organization and check if it's legit if you do get some suspect emails.
40 million people were impacted, and that's a whole lot of personal info floating around.
Why'd it take the Commission ten whole months to disclose this breach?
Well, they claim they had to investigate the intrusion, see just how bad the breach was,
and then lock down their digital systems.
This compromised data could be used with other public info to create accurate profiles of
folks.
They're saying it won't mess with the elections or your voter status.
But don't let your guard down just yet.
The Commission's urging anyone who registered to vote between 2014 and 2022, to stay sharp.
Watch out for your data being used or abused.
In the meantime, they've increased their defenses to block future cyber attacks.
Google's working on making the next iteration of Android, Android 14, more secure when connecting
to cellular networks.
Coming soon, this new feature for Android 14 compatible smartphones will allow you to
disable 2G network support and disable support for null-cipher (or unencrypted) connections
at the modem level.
This is a part of the Android Security Model, which works to prevent things like packet
injection, tampering, and eavesdropping by only allowing end to end encrypted connections.
As we’ve known for some time, 2G towers have got some weak encryption and lackluster
authentication, making them prime targets for attackers.
A great example of this is Stingrays - Those cell-site simulators that trick your phone
into connecting to a fake tower.
Stingrays can intercept your calls, your texts, even your data usage by using a Downgrade
attack to force the 2G connection.
The new Android 14 feature will block that from happening by preventing downgrades.
The ability to disable 2G at the modem level was originally introduced in early 2022 with
Android 12, as an option, and can be found under Settings - Network and Internet - SIMs
- Allow 2G.
The new setting will include an option to select your SIM but now device fleets like
those in enterprises or government agencies, will be able to restrict the entire set of
devices.
Disabling null cipher connections stops snooping on circuit switched voice calls and SMS messages.
The update will allow users to disable support for null cipher connections at the modem level
as well, if a device supports the newer radio hardware abstraction layer, also called HAL.
In both of these cases, emergency calls will still be able to downgrade to 2G or null cipher
so you’ll be able to contact emergency response if out of range of newer towers.
Biggest of shoutouts to my Patreon supporters, especially my Golden Smores and their fur
babies, for making this show possible since we don’t have ads on this show at all!
Become a part of the Smores at Patreon.com/shannonmorse.
That page gives you early access to these videos, a private discord group, a monthly
live streamed Q&A session and more.
If you’re currently a patron on the ThreatWire page, switch over to the new page so you don’t
lose access to your perks.
Let’s finish out today’s episode with my last top story, about CPU vulnerabilities!
These sound like movie titles but they’re vulnerabilities.
"Collide+Power," "Downfall," and "Inception".
Each of these attacks stems from a vulnerability in CPUs.
Modern processors are leading data through side channel attacks.
Downfall is the first one.
It targets a weakness in billions of Intel processors.
It’s tracked as CVE-2022-40982 and can allow a malicious app to snoop on and steal your
passwords, encryption keys, and more.
Even Intel's Software Guard eXtensions (SGX) can't keep this one out.
But how does it happen?
It's all about memory optimization in your processor.
Think of it like an unlocked door that lets one program sneak into another's space.
Two malicious processes built by the researcher, Gather Data Sampling and Gather Value Injection,
can be used to bypass isolation barriers and steal data from other programs.”Gather”
is a process that’s built into the CPU for memory optimization, but the researcher found
a vulnerability in this process allowing for them to perform an attack.
The research was disclosed to Intel and they're releasing a microcode update to patch this
leaky problem.
If you're using Alder Lake, Raptor Lake, or Sapphire Rapids, you're in the clear.
Other families of CPUs are vulnerable, specifically Skylake, Tiger Lake, and Ice Lake.
AMD CPUs are susceptible to kernel memory leaks due to “Inception”.
This is a transient execution attack tracked as CVE-2023-20569.
Inception tricks a CPU into taking the incorrect actions by leaking arbitrary kernel memory
at a rate of 39 bytes per second.
This affects all AMD Zen CPUs including the newest Zen 4 models, and AMD has provided
microcode patches and additional mitigations.
Lastly, meet "Collide+Power."
This attack is a software based method that can leak arbitrary code and can work on any
device powered by any processor, thanks to the way that shared CPU components combine
data from several applications, which results in a leaked signal in power consumption.
The attacker can force a collision between their own malware and the legit data on a
target machine in the CPU cached memory.
This is a concept but likely will not be used in the wild because the data retrieval is
slow.
I'm Shannon Morse, stay vigilant, stay secure, and I'll see you on the Internet!