A severe flaw was found in the RealTek SDK, national cybersecurity initiatives
happen at a government meeting, and that Razer privilege escalation flaw? Yeah,
it works with other devices too! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for August 31,
2021! This is your weekly summary of the threats to our security, privacy and
Internet freedom. We have some hacks and zero days to get into today so.. Onto the news!!
Hey Mirai is back! Well, sort of… It just keeps on going, and it’s targeting lots of devices that use
Realtek chipsets and a Realtek SDK. This affects lots of wifi routers and connected products from
several popular vendors including Belkin, Netgear, Logitech, Asus, D-Link, and more.
Over 200 products from 65 different vendors are affected,
which means this could be an issue for hundreds of thousands of products currently in use.
The CVE is 2021-35395 and it’s high severity given it affects anything from routers and gateways to
IP cameras, smart light hubs, and kids connected toys. This is an RCE - allowing for remote code
execution, so an attacker could potentially gain access to the management interface for devices
and run whatever code they deem fit. The realtek flaw is a supply chain problem,
as it affects so many devices made by so many different OEMs.
Realtek did patch this on August 13 which was just three days before it went public,
so chances are there’s a lot of vulnerable devices that haven’t been updated yet given OEMs
need to distribute patches. And a Mirai botnet is already taking advantage of this vulnerability.
It was found to be scanning the internet for unpatched devices on August 18,
according to security company SAM Seamless Network.
This same botnet is scanning for an authentication bypass vulnerability,
tracked as CVE-2021-20090, which impacts devices with Arcadyan firmware.
Given the attackers behind this botnet started doing a bunch of scanning in early 2021,
around February, it’s likely they are actively looking for vulnerabilities to exploit constantly.
National cybersecurity has been a major concern for the past several years so last week,
US President Joe Biden met with many CEOs of tech companies to discuss cybersecurity initiatives.
Business heads like Apple CEO Tim Cook, and Google CEO Sundar Pichai, were in attendance.
Also included were leaders from Amazon, ADP, JPMorgan Chase, Conoco Philips, Microsoft,
IBM and more. The goal of this meeting was to find ways that the private sector could
work with the government to improve national cybersecurity through critical infrastructure,
the cybersecurity workforce, and strengthening the industry as a whole.
The companies in attendance did offer to make improvements. For example, Google promised to
invest $10 B over five years into cybersec, focusing on supply chain and open source,
training 100,000 Americans in tech support and data analytics via the Google Career Certificate
program, and training 10 million Americans in basic to advanced digital skills by 2023.
IBM plans to also train 150,000 people for cybersec skills
and partner with historically black colleges and unis to grow a more diverse workforce.
Amazon will be offering free MFA devices to qualified AWS customers
along with offering free materials for cybersec training called Amazon Security Awareness.
Microsoft promised to invest $20 billion in security solutions over the next 5 years
and $150 million to help US agencies, along with expanding cybersec training partnerships.
The National Institute of Standards and Technology also announced they’ll be working with industry
partners to create framework to improve the security of the technological supply chain.
Several other industry organizations, such as Girls Who Code,
Resilience, and more, also announced their own initiatives.
This meeting follows several initiatives put in place earlier this year by the Biden
administration such as a 100-day cybersecurity improvement initiative for the electric sector
(which was just expanded to include natural gas pipelines), started in Spring. Then,
in May, President Biden signed an Executive Order to modernize gov’t defenses and improve
security technology. And in July, President Biden issued a National Security Memorandum
establishing voluntary cybersec goals for critical infrastructure. The Administration has also worked
internationally to update NATO cyber policies, the first time that’s happened in seven years,
and hold nations accountable if they harbor cybercriminals who are behind ransomware. We’ll
likely see a lot of the initiatives happen over the course of several years, not immediately.
I love it when y’all send me these adorable pictures of your pets so these are a few from
my hush puppy Patreon Alliance members. And also THANK YOU to Aubrey and Roy for joining. Patrons
are starting to receive their new merch rewards in the mail like mugs and stickers depending
on your perk level! You can always sign up at any time to get access to those perks!
Patreon.com/ThreatWire as always for that - OK, onto the third story.
To follow up with the Razer Windows 10 zero-day story from last week…
remember how we were thinking aloud that this could affect other devices too?
Not just Razer products? Because so many devices bundle some software installer when
you plug them in? In the Razer product case, you plug in a Razer peripheral,
and it prompts to download and install Synapse software from Razer, which also happens to
execute as SYSTEM, allowing for an elevated Powershell to be exploited and code to be ran.
The security researcher was offered a bounty and Razer stated they’ll be releasing a patch.
A second researcher, Lawrence Amer, found a privilege escalation vulnerability in
SteelSeries peripherals that allows for the same thing.
SteelSeries also responded and changed their installation process.
Microsoft responded saying “we’re investigating and this requires physical access”.
Ok, BUT, (and disclaimer, because Hak5 sells these in the Hak5 shop and manufactures these),
you could do the same thing without a peripheral… using a BashBunny or an OMG Cable. According
to MG, you can do this by spoofing the vulnerable devices USB ID, the VID OR PID,
of which there could potentially be 2500 possibly exploitable devices.
Yeah… the Hak5 crew was having a good time with this one!
As for consumers, minimize physical access to your machine, and don’t
plug random peripherals or cables into them - which you shouldn’t be doing anyways.
Now that the studio is finished I’m back to filming content at youtube.com/ShannonMorse.
Hit the subscribe button on that channel to see my upcoming review of the Pixel 5a 5G
along with the new Samsung foldables! There’s no ThreatWire episode next week since my recording
day falls on Labor Day so I’ll see you back here on the 14th! Don't forget to
like and subscribe to this channel as well! I'm Shannon Morse, I'll see you on the Internet!