A UEFI Flaw in Lenovo gets fixed, Google Pixels Suffer a Lockscreen Bypass, and Billions In
Bitcoin Get Seized by the US Government!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for November 15 2022 - this is your summary
of the threats to our security, privacy and Internet freedom.
Hit up my shop at snubsie.com/shop to grab yourself a ThreatWire electronic board while
supplies last!
Let’s jump right into the news this week.
If you own one of about 25 different models of Lenovo ThinkBook, IdeaPad, or Yoga laptops,
the brand just released two patches for some high severity vulnerabilities that could allow
for a malicious actor to deactivate the UEFI Secure Boot, run unsigned code, and modify
the bootloader.
This feature is used to verify code during the boot process before you load up your operating
system - it makes sure none of the code is malicious, but if it’s bypassed, that means
unsigned and unverified code could be run before the OS boots, which could lead to malware
or ransomware persistence, even if you reinstalled or wiped your OS.
This problem was reportedly disclosed by ESET Research, in which they found a development
driver was accidentally included by Lenovo that allows for changing secure boot settings
from the OS.
Since this was a dev driver, it wasn’t supposed to be included in the final production line.
In order to exploit these vulnerabilities, an attacker would need to create special NVRAM
variables - this is non volatile RAM which stores boot data.
The flaws are tracked as CVE 2022 3430 and CVE 2022 3431.
The first is an issue in the WMI Setup driver.
The latter is a vulnerability in the driver used during manufacturing that wasn’t deactivated.
Both could leave to elevation of privileges and Secure Boot modification by changing an
NVRAM Variable.
A third issue, tracked as CVE 2022 3432 affects the IdeaPad Y700-12 ISK but it’s End Of
Life so it won’t be fixed.
If you own one of these laptops, you can visit Lenovo’s Security Bulletin for more info
and patch the firmware for your model as listed.
The user friendly option is to run the update tool which comes preinstalled on Lenovo products,
otherwise you can use an Online Support Portal to find directions for updating.
A security researcher ran across a vulnerability on Android Pixel phones that could allow an
attacker to easily bypass a lock screen with just a few steps.
This is how it works: The attacker could input the wrong fingerprint 3 times which would
disable the biometric authentication option.
After this, hot swap to an attacker owned SIM card that they’ve previously set up
a PIN code on.
Enter the PIN code incorrectly 3 times, which will lock the SIM card.
Then, the Pixel will ask them to enter their SIMs Personal Unlocking Key or PUK code which
is an 8 digit number.
They can then enter a new PIN code for their SIM, and the smartphone will automatically
unlock to the home screen.
In essence, this is purposeful brute forcing with the intention of doing it wrong, in order
to bypass the lock screen.
The only thing an attacker would need to do ahead of time is set up their own SIM card
with a PIN and make sure they know the PUK code.
David Schutz reported the issue to Google back in June of 2022 and it was fixed in the
November 2022 Android patch.
It’s tracked as CVE 2022 20465, and is an incorrect system state.
Obviously an attacker would need physical access to the Android phone in order to hot
swap the SIM card - meaning they’d need to remove the old SIM card and input their
own while the device is on.
The researcher posted a video demoing the entire process.
Google awarded Schutz $70,000 for finding and reporting this vulnerability.
It affects Android 10, 11, 12, and 13, and was originally tested on a Pixel 5 and a Pixel
6.
From your Pixel phone, go to your system settings and check for updates.
The patch was released in early November.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to Ashley for being a part of the Alliance at Patreon.com/threatwire.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials.
Last week I posted a comparison of the Pixel 7 Pro vs 6 Pro..
Don't forget to like and subscribe to Hak5 as well!
Let’s finish out today’s episode with my last top story, about bitcoin!
Last week the US Department of Justice said it had seized about 50,000 bitcoin, or $3.36
Billion worth of cryptocurrency, from devices owned by defendant James Zhong in connection
with the Silk Road from 2012.
The Bitcoin was seized in November of 2021 after it was stolen back in 2012 from the
Silk Road dark web marketplace.
This marketplace was known as a place where criminals could sell illicit goods or services
and it was taken down in 2013.
The founder was sentenced to life in prison.
James Zhong in 2012 created several fake accounts on Silk Road, triggered 140 transactions,
and stole 50,000 bitcoin by taking advantage of a lag in the Silk Road’s transactional
system, which allowed him to withdrawal more than what he actually had.
He then used many wallets and transactions to hide the stolen Bitcoin.
The DOJ also recovered about $661,900 cash, gold and silver bars and more.
The DOJ said this came about after a search warrant was issued for Zhong’s house in
the state of Georgia in the USA.
They found keys to the tokens in an underground floor safe and a hidden SBC or Single Board
Computer - sounds like a raspberry pi or something similar.
Zhong pleaded guilty to committing wire fraud in September 2012 when he stole the Bitcoin
from Silk Road.
He did voluntarily surrender much of the bitcoin starting in March of 2022.
He could face 20 years in prison and will hear his sentence on February 22 2023.
You may have noticed my shirt this week, says Paloma.
Paloma is the wife of one of my tech youtube content creator friends named El Jefe - his
wife passed away and he made this design to honor her.
She was 2 years older than me and she was also super into Sailor Moon like I am, hence
the design, which is similar to Sailor Moon’s compact.
This Paloma shirt is available to purchase thru Beats4Hope, which is a non-profit and
100% of the profits for this design are donated to the Alameda County Community Food Bank
in California.
So far Paloma’s design has raised enough for over 300 meals, and counting.
It’s a great way to honor her memory, help people in need, and you get a dope shirt or
hoodie.
The link is down below if you want to support!
I'm Shannon Morse, I'll see you on the Internet!