Malicious actors are targeting flipper zero enthusiasts, Google Homes could spy on you,
and using ChatGPT for malware!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for January 10, 2023 - this is your summary
of the threats to our security, privacy and Internet freedom.
Hit up my shop at snubsie.com/shop to grab yourself a ThreatWire electronic board while
supplies last!
Let’s jump right into the news this week.
Heads up for Infosec folks and hackers - this one is for you, especially if you want a Flipper
Zero.
I just got to play with a Flipper Zero during CES and those things are seriously cool, but
there’s a new phishing campaign going around which targets these devices.
While the Flipper Zero has tons of tech built in like NFC cloning tools, a TV b gone, bluetooth,
RFID and more, but due to supply chain shortages, customs enforcement and payment platform issues,
getting one in hand can be a tough process.
Due to this, malicious actors are targeting hackers by creating fake shops pretending
to sell Flipper Zeros, a discovery made by security analyst Dominic Alvieri.
These fake sites have checkout pages which are used to phish victims.
After a buyer inputs their email, name, and shipping address, they can also purchase one
with either ethereum, litecoin or bitcoin by sending the total cryptocurrency to a wallet.
As with any online shopping - be wary of third party sellers, check and double check the
URL for the site you’re visiting and purchasing from, and only purchase products from reputable
sellers.
A researcher found an issue in the Google Home branded smarthome speakers that could
allow an attacker to listen to audio from the mic.
Specifically, a third party could add a new account to the Google Home and send commands
to it via a cloud API.
Researcher Matt Kunze found the issue on his own Google Home mini speaker.
He used an Nmap scan to find the local HTTP API port for Google Home, then he set up a
proxy to capture HTTPS traffic.
Kunze found that the device’s name, certificate and Cloud ID were required in order to create
new users.
This info would allow him to send a link request to the google server, so he created a Python
script to automate the process of grabbing the local device data and recreating the steps
to get the link request.
If an attacker wasn’t on the same Wifi connection as the Google home they wanted to attack,
they could listen to local wifi packets to look for a client matching Google’s MAC
address, which always starts with the same prefix, target the client and send deauth
packets to it to disconnect it from it’s local wifi connection, make it enter setup
mode then connect and request it’s local info (that being the name, certificate and
cloud ID).
Then, the attacker could use this device to link their own account, and spy on the victim
remotely.
Kunze’s blog explains the technical details and he also published three proof of concepts
on github.
If a rogue account is added to a google home speaker, not only could it listen to the mics,
but it could also be used to control any connected smarthome tech like cameras, switches, brute
forcing pins used to lock doors, and more.
An attacker could also set up a routine to call them and enable the speaker.
The researcher notified google in January 2021, and everything was patched by Google
in April 2021.
The update blocks new accounts via a new invite based feature, and if a Google Home is deauthed
from a local wifi network, this no longer allows for new accounts to be added.
Google added prevention techniques to stop remote call initiations.
Kunze was awarded over $100k for finding this vulnerability and responsibly disclosing it
to Google.
If you own a Google Home, make sure it’s running the newest firmware as these updates
have been fully patched.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to Joshua and Thunder beaver from thefreaks.club for being a part of the Alliance
at Patreon.com/threatwire.
This year I will be migrating all perks and early access content to my Morse Code patreon
and combining the two accounts to make releases and perks for yall more efficient.
You can get ahead of this change by moving your pledge to patreon.com/ShannonMorse.
You’ll still get all the perks associated with this Patreon, with the added benefits
of my Morse Code perks for the same membership prices.
Let me know if you have questions!
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials.
Last week I posted several videos from CES with more on the way!
Don't forget to like and subscribe to Hak5 as well!
Let’s finish out today’s episode with my last top story, about ChatGPT Malware!
CheckPoint researchers are diving deep into ChatGPT to see how this AI tool is being used
to write malware.
OpenAI released ChatGPT to the world at the end of November 2022.
It’s a free natural language processing tool that can be used to generate human-sounding
essays, emails, code, even things like poems have been generated using ChatGPT.
And while OpenAI have clearly specified in their terms of service that using ChatGPT
for generation of malware - defining this as ransomware, keyloggers, viruses or other
software intended to impose some level of harm - and of spam are banned on their platform,
that hasn’t stopped some curious parties from using it for just that.
CheckPoint analyzed data from hacking forums showing that many users are already doing
this, even with little or no previous knowledge of programming or development.
In one example, a user was able to use ChatGPT to create a Python based info stealer which
searches for common file types then uploads copies to an FTP server.
Java based malware was created as well, harnessing PowerShell to download and run other malware.
Another user claimed they were able to create their first script using ChatGPT, which could
be used to encrypt and decrypt files.
It’s not just python and java script, either.
Some users and researchers have been able to write fully automated workflows for attacks,
including convincing phishing emails.
Does this mean that ChatGPT is bad?
No.
Definitely not.
Any advanced technology could be used for both positive purposes as well as nefarious
ones, including many information security tools and software.
In each of these cases, the code generated is fairly rudimentary and would require some
adjustments to work efficiently, and ChatGPT has also been used to create defensive mechanisms
for detection of malicious URLS or code.
Since this is an AI tool, it could learn and create more advanced code overtime, though,
so watching these trends closely will be important to see how this changes the threat landscape.
This is such an interesting conversation, so feel free to continue it down below in
the comments.
I'm Shannon Morse, I'll see you on the Internet!