This MacOS flaw can bypass security protections, Russia Accuses the US of hacking iphones,
and Amazon is hit with a fine for privacy violations!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for June 6, 2023 - this is your summary of
the threats to our security, privacy and Internet freedom!
Let’s jump right into the news this week.
We've got some news about a vulnerability in Apple's macOS that could have some serious
consequences.
Microsoft researchers recently discovered a flaw, codenamed Migraine, which allows attackers
with root privileges to bypass System Integrity Protection (SIP) and gain access to a victim's
private data.
This vulnerability, tracked as CVE-2023-32369, has been reported to Apple and has since been
patched in the latest macOS security updates, which were pushed on May 18.
Now, let's talk about SIP for a moment.
System Integrity Protection is a security mechanism in macOS that limits the root user's
ability to modify protected files and folders.
It's designed to ensure that only trusted processes, like Apple-signed software updates,
can make changes to critical components.
However, the researchers found a way for attackers with root access to bypass SIP by exploiting
the macOS Migration Assistant utility.
This utility, which is a built-in app, has a special entitlement called com.apple.rootless.install.heritable
that allows it to bypass SIP checks.
By automating the migration process using AppleScript, attackers could add a malicious
payload to SIP's exclusions list without needing to restart the system or boot from macOS Recovery.
This means that the malware could execute arbitrary code and bypass SIP's protective
measures.
The implications of such a bypass are quite serious.
Attackers could create SIP-protected malware that cannot be easily removed, expand the
attack surface, tamper with system integrity through kernel code execution, and potentially
install rootkits to hide their malicious activities from security software.
In addition to compromising SIP, this vulnerability also enables attackers to bypass Transparency,
Consent, and Control (TCC) policies.
By replacing TCC databases, they could gain unrestricted access to a victim's private
data.
Now, this isn't the first time Microsoft researchers have uncovered macOS vulnerabilities.
In 2021, they found a SIP bypass called Shrootless, allowing attackers to perform arbitrary operations,
escalate privileges, and potentially install rootkits on compromised Macs.
They also discovered the Achilles flaw, which enables malware deployment through untrusted
apps bypassing Gatekeeper execution restrictions.
And let's not forget powerdir, another macOS bug that allows attackers to bypass TCC and
access protected user data.
Thankfully, Apple has addressed this latest vulnerability and released security updates
for macOS Ventura 13.4, macOS Monterey 12.6.6, and macOS Big Sur 11.7.7.
So, if you're a macOS user, make sure you update your system to stay protected.
The Russian Federal Security Service or FSB has alleged that US state sponsored attackers
have targeted and hacked thousands of iOS devices.
Russian cybersecurity firm Kaspersky has reported that iPhones on its network were hacked using
an iOS vulnerability that exploited iMessage zero-click attacks.
These attacks deliver a message that triggers code execution without any user interaction.
The payload is then downloaded from the attackers' server, while the message and attachment are
wiped from the device.
The downloaded payload runs with root privileges, collecting system and user information and
executing commands sent by the attackers.
Kaspersky has named this ongoing campaign "Operation Triangulation" and is urging anyone
with more information to come forward.
They have analyzed the malware by creating filesystem backups of infected iPhones using
the Mobile Verification Toolkit.
The analysis revealed signs of infection as early as 2019, with the most recent infected
iOS version being 15.7.
It's worth noting that the latest iOS release, version 16.5, may have already fixed the vulnerability
used in these attacks.
The iMessage exploit triggers an unknown vulnerability in iOS, allowing code execution and fetching
subsequent stages from the attackers' server, including privilege escalation exploits.
Kaspersky has provided a list of 15 domains associated with this malicious activity, which
security admins can use to check historical DNS logs for signs of exploitation.
After escalating privileges, the malware downloads a fully-featured toolset that collects system
and user information, as well as additional modules from the command-and-control server.
It's important to note that the APT toolset dropped on the device does not have persistence
mechanisms, meaning a reboot would effectively stop it.
In a statement coinciding with Kaspersky's report, Russia's FSB intelligence and security
agency has accused Apple of deliberately providing the NSA with a backdoor that can be used to
infect iPhones in Russia with spyware.
The FSB claims to have found malware infections on iPhones belonging to Russian officials,
as well as staff from the embassies of Israel, China, and NATO member nations in Russia.
However, the FSB has provided no proof to support these allegations.
Kaspersky confirmed that the attack impacted its headquarters office in Moscow and employees
in other countries, but they cannot verify a link between their findings and the FSB's
report as they lack technical details of the government's investigation.
But Russia's CERT released an alert linking the FSB's statement to Kaspersky's report.
Biggest of shoutouts to my Patreon supporters, especially my Golden Smores and their fur
babies, for making this show possible since we don’t have ads on this show at all!
THANK YOU to TechMedic76, Jorg, Dennis, and Andreas for being a part of the Smores at
Patreon.com/shannonmorse.
That’s my new Patreon page for the show, where I’ll be posting all the perks for
patrons, including early access to this video.
If you’re currently a patron on the ThreatWire page, switch over to the new page so you don’t
lose access to your perks.
Let’s finish out today’s episode with my last top story, about Amazon!
Amazon is gonna be paying some hefty fines related to privacy violations involving their
Ring video doorbell and Alexa virtual assistant services.
The Federal Trade Commission (FTC) has accused Amazon's Ring home security camera subsidiary
of engaging in unlawful surveillance of customers and failing to prevent hackers from gaining
control of users' cameras.
As a result, Amazon will pay $30 million in fines to settle these allegations.
According to the proposed order, Ring will have to pay $5.8 million in refunds to consumers
and will be prohibited from profiting from unlawfully obtained consumer videos.
The complaint states that Ring compromised customers' privacy by giving employees and
contractors access to private videos.
It also failed to implement basic privacy and security measures, allowing hackers to
breach accounts and gain control of consumers' cameras and videos.
The FTC's complaint reveals that, prior to September 2017, Ring gave full access to every
customer video to every employee and hundreds of third-party contractors, even if they didn't
need the access to perform their job function.
There was also this instance where an Amazon employee viewed thousands of video recordings
of female users in private spaces without detection by the company's security team.
Another employee eventually discovered the issue and reported it.
Furthermore, Ring failed to implement safeguards like multifactor authentication (MFA) until
2019, despite many credential-stuffing attacks happening that targeted its customers in 2017
and 2018, of which Amazon was aware of.
In a separate case, Amazon was charged with violating children's privacy laws by the FTC
and the U.S. Department of Justice.
They failed to delete children's voice recordings and geolocation information upon their parents'
requests.
Under the proposed order, Amazon will pay $25 million in fines and will be required
to delete the children's data per their parents' requests.
Amazon will also be prohibited from using children's data to train its algorithms and
must delete inactive child accounts along with any linked voice recordings and geolocation
data.
I'm Shannon Morse, stay vigilant, stay secure, and I'll see you on the Internet!