Hello, World!
What cyber security disaster has led to Linus boycotting the worlds most famous power bank
brand?
“You heard it hear first, we’re done with Anker”.
A new study suggests 50% of computer repair shops are run by creeps, and researchers crash
a botnet accidentally.
That’s all coming up in today’s roundup of cyber security tech news.
Anker has been sponsoring Linus Tech Tips for years, but after what can best be described
as a cyber security nightmare, LTT has cut ties with them entirely.
“You heard it here first, we’re done with Anker”.
What could have possibly caused this?
Well - the story revolves around one of Anker’s sub brands, “Eufy” - which sells a range
of smart home devices.
Now, when it comes to iot security cameras, privacy is a pretty important and sensitive
topic.
So Eufy decided they’d take the principled stance of only storing recordings locally
on your device.
“No clouds” they proclaim on their website, “this means that no one has access to your
data but you”.
Good - I suppose!
And this made Eufy really quite popular, especially in a world where creepy headlines regularly
pop up surrounding other Smart home devices.
Eufy is often recommended by privacy enthusiasts.
On Eufy’s “privacy commitment” page they proudly state that “Your privacy is
our priority”.
But the page looks only half complete, with some placeholder text, grammatical mistakes
and bad formatting - perhaps mirroring their actual commitment to privacy, because their
promises on the topic seem to have been largely… lies.
Enter “Paul Moore” - a security researcher who bought a Eufy doorbell - and using the
handy tool “F12” - he found that not only were images taken by his doorbell uploaded
to Eufy’s servers, but any faces captured were tagged with a unique facial recognition
id, which would enable someone to be tracked across all Eufy camera feeds.
And even after manually deleting his account the images remained on Eufy’s servers.
He also found the encryption key Eufy uses for video footage being used in plaintext
within an API call, and the same key was later found to have been floating around in a public
github repository for 3 years.
It was also found that people could watch camera streams using VLC, without any encryption
or authentication.
And whilst all of this is y’know, not, great - arguably the worst part of it is Eufy’s
reaction to the whole thing.
At first customer support completely misunderstood the entire situation, emailing him “I totally
understand your disappointment when you notice that the dual doorbell doesn’t support cloud
storage”.
Though eventually the problem did reach a “Eufy customer service engineer, specialised
in safety and privacy”, but, they somehow managed to come up with an even worse response,
justifying uploading images to the cloud, by saying “If all the resources are saved
in the user’s mobile, it will take up the majority of your mobile storage.
In this case, the app needs to communicate with the cloud server in real-time to gain
the resources more efficiently”.
From a company that makes privacy and security such a big selling point, reading this line
at first, made me a bit speechless, then I interpreted it as some kind of attempt to
deflect from the actual problem here and just explain things away.
But then I was reminded of that one quote “Don't attribute to malice what can be explained
by stupidity”.
Eufy just doesn’t understand the mess they’ve created.
There is further evidence of this, Eufy says they “plan to quickly encrypt the API between
the browser and the server to avoid plaintext url display” - but this will only stop people
from seeing that Eufy is storing their data in their cloud, and prevent them from pulling
those URLs from API calls, it does nothing to address the fact that the images are still
being stored on their server the first place.
After Paul sent Eufy a letter telling them he’d be taking legal action, Eufy… offered
him a job.
But something tells me, he’s probably not going to take them up on that offer… because
he responded by running over all his Eufy devices.
And to their credit, the doorbell held up surprisingly well, you can even hear it ring
when he runs over it.
I mean, Anker is known for making physically durable products, but perhaps that’s what
they should stick to.
Because this sub-brand of theirs has gotten them into a proper mess.
Not only are there a whole array of GDPR violations likely going on here.
But Anker, is a Chinese company, so they’re on double damage when it comes to privacy
and security violations.
Just a few days ago, the US banned importing security cameras made by certain Chinese companies.
Anker wasn’t on the list, at least not this time.
Let’s say you break your laptop and take it to a local repair shop, how likely is it
that the guy fixing it will use the opportunity to search through your files, exploring your
browsing history, financial information, or even noods?
I mean, if you Google the very idea of this, you’ll find various stories of “Phone
shop workers ‘[stealing] naked photos from devices”.
And these stories aren’t limited to small, questionable repair shops, “Apple - [payed]
millions” in compensation” after their technicians stole explicit photos from phones
sent in for repair.
But are these just just one off cases, or evidence of a larger problem?
Well - a new research paper aims to answer this question, and their findings are actually
really quite disturbing.
So, Canadian computer scientists came up with a simple plan, after buying 6 new windows
10 laptops they enabled ‘Windows Audit Policy’ and ‘Steps Recorder’ to secretly record
every action that was performed on the devices.
Then they purposely disabled each laptop’s audio drivers, and took the laptops to repair
shops on the pretext that the speakers were ‘broken’.
The researchers used a mix of 16 national, regional and local computer repair shops.
And given a lot of the stories surrounding snooping of files revolve around noods - they
used both men and women to drop off the laptops to see if that influenced things.
So let’s get to the disturbing results.
So, half of the shops were completely in the clear, as in they just fixed the laptop without
exploring its contents, great!
But the remaining 8 repair shops engaged in questionable activities.
The results table shows the kinds of privacy violations, like accessing documents, browsing
history, or “revealing pictures” - yes the researchers did actually create a noods
folder.
These are compared against the type of repair shop and the gender of the person bringing
the laptop in for repair.
So, 4 Repair shops accessed documents and pictures, and as for that ‘noods’ folder,
5 shops accessed it, that’s over 30% of the 16 shops surveyed, which is incredibly
high - and unsurprisingly technicians were most interested in the laptops brought in
by women.
1 shop accessed the ‘finance’ folder, and two accessed browsing history.
And shockingly 2 Shops even went so far as to copy the customer’s data to an external
drive.
Of course none of this is necessary to fix malfunctioning speakers, I mean - if we were
talking about data recovery then maybe there’s some plausible deniability, but definitely
not here.
And then, there’s the section on ‘covering tracks’, 3 repair shops attempted to do
this by clearing “Quick Access” and 2 shops cleared the laptop’s logs entirely,
meaning the researchers have no idea what they got up to.
To say these results are alarming is a bit of an understatement, and sadly it does look
like local repair shops are significantly creepier than national or regional chains.
That being said there are some problems with this research, that our friendly neighbourhood
repair man has weighed in on.
Firstly, 16 repair shops that by the way were all located in Ontario Canada is hardly a
representative sample.
Also, the researchers don’t expose which repair shops they used - so we have no way
of knowing whether these are reputable businesses, or 1 star hell holes that are obviously not
to be trusted.
Let me know down below, have you had any run ins with dubious repair shops?
Next up, security researchers have accidentally crashed a botnet, liberating all its infected
computers.
The “Kmsdbot” botnet was only discovered earlier last month by researchers at Akamai,
after it infected one of their honeypots.
This botnet preys on weak SSH credentials, targeting windows and Linux machines.
The botnet’s primary function is DDoSing, its “targets [include] the gaming industry,
technology industry, and luxury car manufacturers.”
- in one case the researchers observed it attacking modded GTAV servers.
I did read about this botnet weeks ago, but didn’t cover it because there’s nothing
particularly interesting or unusual about it.
But that changed a few days ago when the researchers posted an update.
So, in an attempt to further probe this botnet, the researchers edited its code, changing
the address of the command and control server, to an ip they controlled.
Then they infected a virtual machine with the modified malware, and since the “C2
communicates in clear text”, “sending the malware commands can be done [simply]
using Netcat”.
However the researchers made a typo, in a command they didn’t include a space between
the website and port.
This basic error led them to the discovery that the botnet’s developer hadn’t accounted
for syntax errors, and the bot crashed.
In fact “This malformed command likely crashed all the botnet code that was running on infected
machines and talking to the C2 — essentially, killing the botnet.”
And given the malware doesn’t have “any functionality for persistence on an infected
machine, the only way to recover is to re-infect and rebuild the botnet from scratch.”.
Though, I will admit, I am a little confused as to how the entire botnet was nuked when,
as I understand it, it was just one bot listening to the researcher’s server.
But they are adamant that they did dismantle the entire botnet, rather than just crashing
one machine in particular, so perhaps there’s some peer to peer function where the bad command
was perpetuated throughout the network, or maybe there’s something else that’s just
going over my head - I just thought I’d make that clear, and if I get an update I’ll
pin it in the comments.
This video is sponsored by PCBWay, the complete solution for all your PCB Fabrication and
on demand 3D printing needs.
From standard PCBs to the more advanced varieties, PCBWay provides granular control over every
element of your PCB.
With superfast turnaround times you’ll be spending more time creating and less time
waiting on packages.
PCBWay also offers on demand machining, from CNCing and sheet metal cutting to 3d printing
and injection molding, there’s an array of materials to choose from, and of course,
superfast turnaround times.
Sign up now using the link in the description to get a $5 coupon, which can be used site
wide.
As always, thanks for watching and I’ll see you in the next video have a good one.