Hello world, I thought we’d start the year with a classic Seytonic flip flop.
In my mission to figure out what kind of content appeals best to YouTube's mysterious AI, and
of course you, I am again bringing back the weak web in its original format.
It is tempting to split news stories into shorter videos, which is what I have been
doing the past couple months, however - oftentimes especially with certain topics, there just
isn’t enough information in the public domain to create an interesting, juicy standalone
video.
So I figured aggregating shorter stories into one longer video is probably the best thing
to do - but I of course reserve the right to change my mind and pull another flip flop,
which lets be honest is probably inevitable.
Also, you guys seem to like the story time, and explainer videos, so I plan to make more
of those.
This year I want to do deep dives into various hacker groups and dark web hosters - things
no one has really done before on the youtubes.
Anyhow, here’s the first weak web of 2022.
Some severe security vulnerabilities have been discovered in a remake of everyone’s
favourite anthropomorphic toy phone.
I’m sure you’ve had countless hours of fun as a toddler with one of these, though
the boomers among us will remember them as looking more like this.
It’s a toy phone, well kinda, these things never really did anything - the wire may deceptively
look like some high quality braided cable, but no, it’s just some blue shoelace.
These “chatter telephones” have been around since 1961, there’s some pretty strong nostalgia
here - with hundreds of millions of adults having played with them as kids, and so the
company behind them - Fisher price, decided to capitalise on that nostalgia and launched
a remake, sticking a bluetooth module inside so you can connect it to your actual phone,
and receive real phone calls through it.
Sounds like a smart easy cash grab, and their launch video is really well done, and I almost
get matrixy vibes from it.
The phone ringing at the end interlaced with synthy sci-fi music almost makes me feel like
Neo is about to jump through the screen and grab the thing.
Fisher price launched the new bluetooth chatter telephone in time for Christmas, hoping to
make it a bit of a meme, and it worked, they completely sold out!
However a report by pentest partners reveals that this gadget, far from being a wholesome
shot of nostalgia, is actually a creeper’s wet dream in disguise.
You see, it uses bluetooth classic, with no secure pairing process.
In other words, it will happily connect to any device that requests to pair with it.
So if, say for example you had a neighbour using one of these things, you could take
over the device by simply pairing with it because the device is constantly in pairing
mode looking for a phone to connect to.
To make matters worse, the “chatter telephone” will automatically answer calls when the handset
is off the hook, so it’s pretty easy to use as a bug.
Just connect your phone to the device via bluetooth, then call that phone with another
phone, and there you are, instant covert 2 way communication, allowing you to listen
in to conversations.
And realistically speaking, the novelty factor of having one of these things on your desk
is going to wear off pretty quickly so there’s a good chance they’ll end up with children
at some point, making these vulnerabilities a whole lot more creepy - because even if
the handset is on the hook, a curious child is probably going to answer a ringing toy
phone.
China is not happy at all with Alibaba over log4shell, so much so that they’ve suspended
Alibaba’s cybersecurity partnership with the government for a whole 6 months.
So, Alibaba’s cloud team discovered the vulnerability in log4j on November 24th and
responsibly disclosed it to Apache, the organisation which is responsible for developing log4j.
However, Alibaba’s cloud team neglected to report the exploit to, and this is a mouthful,
China’s “Ministry of Industry and Information Technology's cyber security threat and vulnerability
information sharing platform”.
You see, as per Chinese law, anyone who stumbles across a zero day is obliged to report it
to the “relevant product provider immediately” - in this case Apache.
But also to the Chinese government, “within 2 days”, which is something Alibaba did
not do.
There are multiple ways to interpret exactly why China is pissed off about this - and I
imagine it runs a bit deeper than general saltiness over the rules not being followed
as per protocol, the official narrative is that by not reporting the exploit, Alibaba
“did not effectively support the Ministry of Industry and Information Technology to
carry out cyber security threats and vulnerability management.”
- in English that means, the Chinese government will themselves have been running a lot of
vulnerable code which they would have wanted patched immediately instead of waiting for
a public disclosure like everybody else.
The other, more cynical interpretation is that by not disclosing this to the Chinese
government, Alibaba was effectively denying the government a juicy exploit which could
have been used by their state backed hacker groups to do espionage.
And given how widely log4j is used, a lot of espionage was possible with log4shell,
and they would have had 2 whole weeks to do it, as even after disclosing the exploit to
apache, a fix wasn’t released until 2 weeks later.
To put this theory into perspective, even though China learned of the vulnerability
along with everyone else, not wanting to miss out on the fun, Chinese state backed hacker
group “Aquatic Panda '' has recently been utilising log4shell to attack academic institutions.
So it’s not a stretch of the imagination to say had they known of the exploit before
everyone else they would have arrived at the party much sooner, before companies and governments
even had a chance to patch their systems.
Whether Alibaba’s slipup here was mere incompetence, or deliberate we will never know.
This next one really is nightmare fuel.
Over the past few weeks, gamers using a certain asus motherboard have discovered that it came
with an undocumented incendiary feature.
In other words, they have been quite literally catching fire.
A bunch of reports started popping up on reddit of people explaining how they built their
dream gaming PC - keep in mind, the “Asus Z690 Hero Motherboard” costs about $900,
it ain't cheap.
People explained how they put their new PC together only for it to randomly burst into
flames a few hours later.
From the pictures of the damage I saw, in every case people got real lucky in that the
damage only occured in one small area of the motherboard, as opposed to literally burning
houses down.
What could have caused this?
Well, it turns out that Asus soldered on this capacitor the wrong way around, the cap is
meant to have this stripe on the right side, but during manufacturing it was accidentally
rotated 180 degrees.
Some components don’t mind being soldered the wrong way around, resistors for example,
but do it with certain components and the results can be explosive, in this case it
blew up the component itself, and anything connected to it, these 2 components to the
right here being the collateral damage.
As for how something so ridiculous like this could happen, it’s possible there was a
mistake in a certain file that pick and place machines use to place components, the mistake
being quite simply a wrong rotation value on the capacitor.
Alternatively, the assembler may have somehow loaded the pick and place machine wrong, which
is more likely given that only a single batch of these motherboards are affected.
Asus thankfully acknowledged the problem, and they now have a tool where you can enter
your serial number to see if you’re affected - if you are then you can of course get a
replacement.
On the bright side, the undocumented incendiary feature doesn’t seem to damage other components
like RAM, CPU or the graphics card.
So this year I’m switching from windows 10 to linux mint, I’m still keeping a windows
installation around for when I need to use anything adobe related, but for everything
else, linux it is.
Whilst installing drivers and things like that I’ve found myself copying commands
from random obscure websites - and whilst I have enough knowledge to figure out whether
the command I’m copying is malicious, I came across an article which kinda throws
that into doubt and explains how you could get hacked simply by copy and pasting vanilla
looking commands into a terminal.
They have an example here, an innocent looking shell command.
But all is not what it seems, if we copy and then paste it into a terminal, instead of
the command we expected, it’ll download a malicious script and then run it.
It even executes the command as soon as you paste it, I didn’t press enter here, I just
paste it and it runs.
This is just an example, the address is obviously incomplete, thankfully, so nothing really
ran.
To do all of this the website uses some fancy javascript to copy arbitrary text to your
clipboard when it detects you’re trying to copy something, it even appends a line
break character, which is how they get the automatic execution after you paste it.
It’s pretty crafty and could definitely catch me out.
Certain news websites also use this method to try and stop you from stealing their content,
for example if you copy some random text from a financial times article you’ll get a copyright
notice prepended to the output.
I thought this was a good PSA to put out there, and if you are dubious about a command you
can always stick a hash before you go to paste which will reveal any hidden command without
having it run.
That’s all for this video, you know the drill, mutilate the like button, scrub and
scribe, all that fun stuff.
Follow me on the instagrams for behind the scenes content, sources are linked in the
description, and I’ll see you in the next video.