Stealing audio through LEDs, is Apple’s new CSAM scanning tech
privacy invasive? and Synology warns of botnet malware! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for August 10,
2021! This is your weekly summary of the threats to our security, privacy and Internet freedom.
We have a bunch of privacy news to get into so.. Onto the news!!
Ben Gurion University never lets us down with their air gapped attacks!
This week they’ve found another novel way to spy on electronic conversations,
this time… with an attack they’ve dubbed Glowworm. It can look for teeny tiny
fluctuations in the power LEDs on your speaker or USB hubs and convert that into audio signals.
A team of researchers at Ben Gurion analyzed several PC speakers, IoT smart speakers,
and USB hubs and found the power indicator LEDs would fluctuate a minute amount whenever audio
signals were fed through the attached speakers.
Normally, with your own human eye, you can’t see these changes in the LED - but
a photodiode and an optical telescope can! It’s a perceptible flicker whenever the speakers have
a change in electrical current. This is converted into an electrical signal and
that can be converted with an analog digital converter then played back.
Since this happens via visual cues, air gapping wouldn’t necessarily work as a countermeasure,
and a victim wouldn’t likely expect this kind of ‘off network’ attack to happen. To note, though,
Glowworm only works for voices or audio coming over a speaker, not for folks or
audio in the physical vicinity of the speaker. So if you’re making a call to someone over a speaker,
their voice could be captured by Glowworm, but yours wouldn’t.
You can also circumvent this attack by hiding the power LEDs - or putting blackout tape over them.
Glowworm works over long distances, as much as 35 meters, but needs that clear
line of sight to an LED. Manufacturers could also decouple LEDs from the power line on a product,
and stick it on a GPIO port of a microcontroller instead, for example, or by adding a capacitor
in parallel to the LED as a low pass filter. It’s also important to note that this couldn’t be done
using a video camera because cameras have limited FPS rates and audio sampling rates.
The researchers included a video showing the attack
as well as audio results that you can listen to on their website,
linked via my Patreon and RSS feeds. Unsurprisingly, the farther you get away
from the speaker, the harder it is to understand the audio. Also of note, some of the audio is
easier to pick up on certain products than others. Manufacturers have been notified of this attack.
This is gonna be a long one. Trigger warning for CSAM, which stands for well youtube might flag
this video so we’ll just say it’s sensitive pictures of kids. On Thursday of last week,
Apple announced a new feature they’re bringing to iOS, iPadOS, WatchOS, and MacOS in an effort
to limit the spread of CSAM here in the United States. After this news broke, there have been a
lot of hot takes on this controversial topic - one taking the approach of privacy should be a right,
the other side of the coin arguing that “privacy isn’t a thing in 2021, you have a smartphone,
so you have no privacy anyways” which... that is definitely an opinion.
On the surface, this doesn’t sound that controversial. Most companies DO scan for
CSAM here in the US anyways, and they have to turn over information in legal warrants. Apple
does already do this in the iCloud, and other tech giants do as well for their cloud storage
options. But Apple in particular is planning to do this on the client side as photos are
uploaded to iCloud, as well as using on-device machine learning to vet iMessage content
that is sent or received by minors under the age of 13, to warn parents of explicit photos.
On the not-so-controversial side, Apple is also going to introduce an update to both Siri and
Search that displays an “intervention” if a user tries to search for CSAM related topics.
This would alert the user that interest in this topic is harmful or problematic.
So first is the iMessage update. This machine learning analyzes image attachments.
While apple did not originally go into detail on the technical properties of this feature,
they mentioned that Apple doesn’t get access to the message, and that it’s going to be an
Opt-In setting that parents have control of through the Family Sharing feature.
If a child receives a sensitive or explicit photo, it’ll be blurred and the child will be warned,
along with given options to proceed with viewing the photo and prompted
that parents will also get a notification. The same applies if a child wants to send a photo.
The photo would be saved to the parental controls section for
parents to review. Kids between 13-17 will also get a warning but no parental notification.
For the CSAM scanning, Apple is using image hashes provided by the National Center for Missing and
Exploited Children along with other child safety orgs to scan photos with “NeuralHash” which works
using the cryptographic protocol Private Set Intersection or PSI - that determines if there’s
a match without revealing the result. Side note: Google also uses the PSI protocol for Password
Checkup in Chrome. Scanning is automatic though it only works when iCloud photo sharing is enabled.
The hash itself is stored locally on the users device. To quote Apple, “The device creates
a cryptographic safety voucher that encodes the match result along with additional encrypted data
about the image. This voucher is uploaded to iCloud Photos along with the image.”
To interpret the hashes, Apple is using another cryptographic technology,
this one called Threshold Secret Sharing, to see if an iCloud Photo account crosses a threshold
of known imagery. This then gets manually reviewed for human confirmation, then the user's account
is disabled and the material is reported to NCMEC and law enforcement. Again to quote Apple
“the system ensures the contents of the safety vouchers cannot be interpreted by Apple unless the
iCloud Photos account crosses a threshold of known CSAM content. The threshold is set to provide an
extremely high level of accuracy and ensures less than a one in one trillion chance per year of
incorrectly flagging a given account.“ If a user is incorrectly flagged, they can file an appeal.
As an auntie to three adorable little nieces, their protection is important to me and I’m sure
others relate to that. But also, privacy advocates and researchers worry that this could be expanded
to detect other kinds of content, or it could be used to frame innocent people.
While not widely discussed, the iMessage update will hopefully - not - be influenced
by any gender bias from the machine learning, and will hopefully be able
to distinguish between innocent photos or actual sensitive content. I could imagine
parents getting tons of false flags after a birthday party at a pool in the summertime.
Many are concerned that this is basically Apple building a backdoor into their device encryption.
While Apple themselves have advocated for end to end encryption, even battling government agencies
on user’s privacy rights, this seems to muddy those waters. This is very well intentioned;
we all know this, but does this run afoul of their own encryption stances.
Should laws change, or Apple be required to do so,
this machine learning could be expanded to look for additional types of photos
or sensitive content. Now to that regard, Apple pushed back with an FAQ saying that they will
“not accede to any government’s request to expand it”. Apple also mentioned that the hashes will not
be expanded by Apple and the list of hashes is the same across all of their platforms.
OR maybe Apple added the CSAM detection before upload because they’ll add end to end encryption
in the icloud - who knows? At this time, any predictions are plausible, but not fact.
This will roll out in the US in iOS 15 and MacOS Monterey in the coming months. If you’re concerned
about this new scanning technology and want to make your voice heard, you can sign an
open letter at appleprivacyletter . com. I love it when y’all send me these adorable
pictures of your pets so these are a few from my hush puppy Patreon Alliance members.
And also THANK YOU to all of my newest patrons this week for joining. I did this
super fun video call last week with my patrons and got to show y’all my new studio and
we chatted about DEF CON and all sorts of stuff. That’s a monthly perk and I
have another one coming up in a week or two. Patreon.com/ThreatWire as always for that - as
soon as you sign up you get access to those perks. OK, onto the third story.
I have three Synology NAS boxes (yes, I know it’s overkill but I gotta manage
my 4k video files and my Plex server somehow!), so a viewer sent this
story to me! Synology is warning customers about a botnet called StealthWorker that’s
targeting NAS devices in a brute force campaign. This can also lead to ransomware, so listen up!
Synology released a security advisory detailing the attacks. After infecting Synology NAS boxes,
StealWorker targets other Linux systems on a network. It’ll use already-infected
devices to go on and target other devices by guessing common administrative credentials.
If successful, it’ll install the malicious payload which may include ransomware. Any infected devices
could carry out additional attacks on other Linux devices including on Synology NAS’s.
Synology explains that you can protect against these attacks by changing weak admin credentials,
enable account protection, and auto block, and set up MFA whenever possible. If you have multiple
users, apply password strength rules for all users. Disable the system default “admin” account.
Auto Block can be enabled from the control panel to block IP addresses if they have too many failed
login attempts. And you can run Security Advisor to check for weak passwords on your system.
You can also enable Firewall in the control panel and only allow public ports when necessary.
Snapshot is an additional feature than can keep your
NAS system immune to encryption based ransomware.
This isn’t the first time StealthWorker has been in the news. It was first seen about
two years ago when it was used to exploit vulnerabilities in Magento, phpMyAdmin,
and cPanel to deploy skimmers on payment pages and sites.
I’m pretty excited because my tech channel - youtube.com/ShannonMorse, just hit 60,000
subscribers can you believe it? I can’t. But I know a lot of y’all watch my security content on
both channels so THANK YOU!!! You are awesome! And with that, don't forget to like and subscribe to
this channel as well! I'm Shannon Morse, I'll see you on the Internet!