Hello world,
New Bluetooth exploits have been discovered which enable impersonation and man in the
middle attacks,
There’s a new Apple M1 vulnerability and it’s impossible to fix
And whatsapp sues India for mandating mass surveillance
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news. The first major bluetooth security flaws which
effectively break Bluetooth’s connection mechanisms have been uncovered. A French national
security agency has published a very detailed paper in which they discuss 7 new vulnerabilities
in bluetooth’s pairing process - the findings are being called BIAS, standing for bluetooth
impersonation attacks, catchy. These new vulnerabilities affect the bluetooth specification itself,
as opposed to implementation problems. Because they exploit bluetooth on an architectural
level - these new exploits affect pretty much every bluetooth device.
The vulnerabilities themselves allow for impersonation attacks as well as man in the middle snooping.
In one instance an attacker could listen in on 2 devices connecting to each other, then,
using a specially crafted series of responses it could determine each bit of the randomly
generated bluetooth passkey, once identified, the attacker can use these Passkey bits during
the same pairing session to pair with one of the devices it was listening in on.
In English - an attacker could figure out the key, impersonate a device and perform
an unauthorised connection.
These new attacks are particularly stealthy, because the Bluetooth standard does not require
notifying end users about the outcome of an authentication procedure, or the lack thereof
- meaning these new hacks can be performed silently.
This affects both bluetooth core and mesh specifications, core relates to the basic
bluetooth we’ve been using for years, but the mesh specification is used in IOT devices,
which allows for many bluetooth devices to connect to each other.
The researchers tested 31 devices including phones, laptops, tablets - all of them were
vulnerable to these hacks. However, in reality it’s unlikely you would fall victim to them,
an attacker would of course need to be within range of a device in order to exploit it,
so don’t panic. That being said, Android has assessed this issue as High severity for
Android OS and will be issuing a patch for this vulnerability in an upcoming Android
update.
You can expect the larger manufacturers to come out with fixes soon. However there will
be a good number of devices which will probably never see an update, some older phones perhaps
and those pesky IOT devices. There are 7 vulnerabilities in total here, they’re all explained in
detail within the researcher paper - which I’ll link below if you want to be confused.
This video is sponsored by a super cool new YouTube channel “SumSub,” they’re all
about helping you defend yourself in what they call “the online jungle.” Their focus
is on protecting your identity, personal data, and wallet from the many scammers, fraudsters,
and hackers that lurk online.
In one video they go in depth on online verification services—showing you how they work (and
how they can be fooled). To do this, they took on the role of an online fraudster—creating
a fake identity, along with a fake passport, and trying to get verified with a number of
these services.
The Sumsub channel is made up of real-life digital security professionals fighting against
money laundering, terraced financing, and online fraud. These guys build powerful identity
verification solutions, including liveness technology and forgery-detection tools and
in their spare time provide you with some serious insider knowledge that you certainly
won’t find elsewhere.
In a recent video they explore how Breaking Bad’s Walter White could have laundered
the money made from his mesh business via bitcoin instead of a car wash. They cover
in detail how OTC brokers, sham contracts and bitcoin mixers are used by criminals to
launder bitcoin.
Subscribe to the Sumsub YouTube channel. They release new content every week and they’re
linked in the description. A vulnerability in Apple’s new M1 processors
has been discovered, and it’s impossible to fix. The flaw also exists in Apple’s
A14 chips because it’s very similar to the M1. The vulnerability allows two applications
to covertly exchange data between themselves without using any OS level features like files
or sockets, this is known as a covert channel vulnerability.
It works by utilising read/write access to an ARM system register, by writing to it with
one application and simply reading from it with another. The proof of concept uses little
more than a dozen lines of code, so it’s fairly simple.
Hector, the guy who figured all this out explained this vulnerability was introduced because
“Apple decided to break the ARM spec by removing a mandatory feature, because they
figured they'd never need to use that feature for macOS. And then it turned out that removing
that feature made it much harder for existing OSes to mitigate this vulnerability”.
He’s called this find, “Miracles” or “M1-iracles” - get it, “M1, miracles,
M1-ircles” - anyway, because this flaw is baked into the M1 and A14 chips themselves,
it can’t simply be fixed with an OS update, but rather the chip itself would have to be
redesigned. Given Apple will likely already have their M2 chip well on the way, we might
not see a fix for this until M3.
So should you be worried? Should you burn your M1 mac, crush your A14 iphone? No, whilst
yes, this is a vulnerability it’s not necessarily a very valuable one. This exploit only allows
two nefarious applications already installed on your computer to communicate covertly,
even if you had a couple of malicious programs installed, this exploit isn’t really that
useful on Mac OS, as Hector explains there are already different methods of doing this
on every system, and even then what would the reason for the covert communication be?
Advertisers could abuse this for cross-app tracking, but the practical uses are limited.
There is a but.
It’s a different story on IOS which inherently has stricter privacy protections. “For example,
keyboard apps are not allowed to access the internet, for privacy reasons. A malicious
keyboard app could use this vulnerability to send text that the user types to another
malicious app, which could then send it to the internet.” Though given Apple screens
apps before allowing them into the store, it wouldn’t take much for them to block
access to these registers, so we’re probably ok.
Whatsapp is suing the Indian government over a new law which would effectively force them
to implement mass surveillance - this law is pretty spooky from a privacy perspective,
it all centers around traceability, the government wants the ability to trace the origins of
any given message. In a blog post Whatsapp explains just how awful an idea this is - this
isn’t just a case of a government wanting to be able to identify a particular user,
it’s a whole lot worse.
WhatsApp explains: Traceability is at odds with how law enforcement usually investigates
crimes. “In a typical law enforcement request, a government requests technology companies
provide account information about a known individual’s account.” But “With traceability,
a government would provide a technology company a piece of content and ask who sent it first.”
They have this tree diagram to illustrate the problem, one person could send something
- some text, an image, anything. Then a million people could share that same message, however
it’s the original sender which would have their details sent to authorities if the message
turned out to be problematic, even if they didn’t mean any harm for sharing it. The
result of a particular piece of information being shared to an unlimited number of people
could be blamed on the original sender.
Not only is this a bad idea conceptually, but the law would mean whatsapp would have
to create a database of every single message sent via their service, and provide access
upon request from law enforcement. Whatsapp has 530 million users in India, it’s their
largest market - they’re suing the Indian government on the basis the law “violates
Indian’s constitutional right to privacy”. And they’re not alone, “Mozilla”, the
“Electronic Frontier foundation” among others have all made statements in support
of WhatsApp’s efforts.
There’s a lot of moving parts in this issue, it seems to be a larger part of the Indian
government’s feud with social media, throughout the pandemic the Indian government has forced
Facebook and Twitter to take down hundreds of posts critical of the government’s handling
of coronavirus.
The new law applies to companies with over 5 million users, but neither Facebook, Instagram
or twitter have appointed officers to deal with these new government requests, as required
by law, so they’re stuck in a kind of limbo as the deadline for compliance was a few days
ago - we can’t really say what’ll happen from here, apart from wait and see I suppose.
Though I can’t help but sense a bit of irony reading Whatsapp’s blog post on the issue,
they say this new law would mean “Companies would be collecting more information about
their users at a time when people want companies to have less information about them”, but
WhatsApp is owned by Facebook, who’s very existence is predicated on amassing as much
data on their users as possible. Didn’t WhatsApp recently change their terms of service,
upping the mandatory level of data they share with Facebook - and telling everyone who didn’t
like it to stop using the app? Hmmmm, part of me wants to be charitable and assume whatsapp
is fighting the good fight based on principle, what’re your thoughts? Let me know in the
comments.
Make sure to visit today’s sponsor, the sumsum youtube channel, they make very highly
produced videos which are definitely worth a watch.
If you want to see more of this kind of video make sure to let me know in the comments and
turn those sub notifications so you don’t miss any hacking news.
For behind the scenes footage do follow me on instagram. As always sources will be linked
in the description, stay tuned for more hacking videos, have a good one.