This group of car thieves stole cars without hacking key fobs, IoT Nutrition labels will
be a thing in 2023, and Microsoft discloses a breach!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for October 25 2022 - this is your summary
of the threats to our security, privacy and Internet freedom.
Let’s jump right into the news this week.
A car theft group in Europe figured out how to steal vehicles without the use of a physical
key fob, but were detained by law enforcement on behalf of France, Latvia, and Spain.
In total 31 suspects were arrested, with the EU Agency for Criminal Justice Cooperation
(or Eurojust for short) explaining how the group was able to steal cars.
Europol stated they “targeted keyless vehicles from two French car manufacturers” and they
used a “fraudulent tool marketed as an automotive diagnostic solution” online.
The tool replaces the software on vehicles which allows for the doors to be unlocked
and ignition to be started without the physical fob.
The malicious software was continually updated to combat patches made by manufacturers.
The information on which manufacturers were targeted and how this software works is vague
at most.
We’re familiar already with key fob relay attacks and being able to do packet captures
on the frequencies that key fobs and work on for remote keyless entry to vehicles, but
this sounds unique in the sense that it doesn’t require the fob.
Hopefully we’ll find out more as the case continues.
Last week, the White House met with government leaders, private sector businesses, and academic
institutions to discuss strengthening cybersecurity, and one of the core topics at this meeting
was securing smarthome devices, also known as “IoT” or “internet of things” products.
That can be as far reaching as internet connected baby monitors, kitchen appliances, smart tvs,
pet tech, anything that talks to the internet.
One main component of this meeting was creating a labelling program to offer consumers peace
of mind when choosing which technology is brought into their homes and to incentivize
manufacturers to meet higher cybersecurity standards.
Officials discussed creating a label that was globally recognized across borders, so
consumers could make more security and privacy focused and informed decisions.
Representatives included folks from Amazon, NIST, Comcast, the CTA, Google, Sony, Intel
and more.
The White House announced that, based on the meeting, they intend to start a rollout of
a labeling program to begin in Spring of 2023, which seems soon for government work, but
a system has been in the works for quite some time, with the US Cyberspace Solarium Commission
bringing this up in a March 2020 report.
No news yet on what this label would look like though we do have a template created
by Carnegie Mellon, or how ratings would be justified to consumers, but we do have some
general idea based on reporting from CyberScoop.
The White House has stated the ratings would be based on vulnerability remediation, amount
of information collected on consumers, whether data is encrypted, and interoperability with
other products.”
The US may look to Singapore as a template for the creation of these labels, since Singapore
already has one that is also recognized by Finland and Germany, with Germany announcing
this last week.
The countries rating system is already set up and used for consumer devices, with medical
devices to be included soon as well.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to my newest patrons including Boeyan for joining and Patrick for upgrading on Patreon.com/threatwire.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials including a whole slew of privacy videos this month..
Don't forget to like and subscribe to Hak5 as well!
Let’s finish out today’s episode with my last top story, about Microsoft!
According to a post made directly by Microsoft, the company disclosed a misconfigured storage
location server was accessible to the internet, which led to some customer sensitive information
being exposed.
This was due to an Azure Blob Storage misconfiguration to be precise, and affects ober 65,000 customers
from 111 countries, with data stored from 2017 to August 2022.
The issue was resolved and the server was secured after SOCRadar’s Cloud Security
Module and threat intelligence researchers disclosed the leak of data on September 24.
According to the cybersec firm, data included PoE’s, SoW’s, invoices and documents with
personally identifiable information, intellectual property of customers and more.
According to Microsoft, the leak included names, email addresses and content, company
names, phone numbers, and files belonging to businesses and customers.
SOCRadar created a portal called BlueBleed for companies to search for their own leaked
data to see if it was exposed and added this data pool to the portal.
The company believes the leak includes about 2.4 TB of data.
Microsoft requested that BlueBleed queries be suspended as of Oct 19.
Microsoft originally called SOCRadar’s scope reporting “greatly exaggerated”.
Microsoft notified affected customers but otherwise did not plan to notify data regulators
because this wasn’t required under GDPR.
Microsoft and SOCRadar are obviously not on the same page, here, but security experts
are criticizing Microsoft’s response.
Whatever data was leaked, organizations who use Microsoft products and could’ve been
exposed should be on alert for phishing attacks or potential exploits using the exposed data.
I'm Shannon Morse, I'll see you on the Internet!