Spyware was found on government employee phones, several popular routers are riddled with flaws,
and cryptocurrency scams are on the rise! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for December 7,
2021! This is your weekly summary of the threats to our security, privacy and
Internet freedom. THANK YOU to Markus912, CosmicDisaster, and Hector for joining this
week on Patreon. Patreon.com/ThreatWire as always to keep this show ad free.
And if you want to support the show but don’t wanna join on Patreon, you can grab your own
ThreatWire merch for the holidays at the link below. With that, onto the news!!
News broke on December 3 that at least 9 US State Department employees were targeted by spyware
made by the Israeli firm NSO Group, the company that Apple recently sued for abuses against their
users due to the Pegasus spyware. Another report stated this affected at least 11 individuals.
Apple informed the US government that iphones of
these employees were targeted - all of whom were focusing on Ugandan efforts or concerns,
some of whom were based in that country. NSO Group claimed they didn’t know anything about this,
but they did shut down access for some customers while investigating. They also stated that if a
customer was found to be doing this with their tools, they would be terminated permanently
and legal actions would take place. NSO Group did not publicly name any customers as being involved
and also claimed they don’t have any knowledge of how their products are used by customers.
This was disclosed shortly after the Commerce Department decided to put NSO Group on a known
entity list which bans any US company from doing business with them. All parties involved
didn’t offer any additional comments, and we don’t know if these two actions are related.
Apple notified the affected individuals and discovered they’re government employees due
to their .gov email addresses. They were able to determine the infections because in every case,
the phone was attacked through a graphics processing vulnerability
that Apple learned of and fixed in September. The iOS exploit was called ForcedEntry and
is used to deploy Pegasus spyware. While NSO Group has said they have rules in place so
US citizens can’t be targeted, like blocking numbers starting with +1 country
codes, but in this case the employees had foreign phone numbers registered on the iphones.
NSO Group has continually argued that their tools help to combat terrorism and crimes
and their customers are vetted.
Shoutout to David on my Patreon for recommending this story.
Nine different routers have a total of 226 potential vulnerabilities affecting them,
including some of which that are fully updated to the latest firmware. These include brands like
Asus, DLink, Netgear, TP Link, Synology, Linksys, AVM, and Edimax. The TP Link Archer AX6000 has
32 of the flaws, and Synology’s RT-2600AC has 30 flaws. Netgears Nighthawk AX12 has 29 issues.
The ASUS ROG Rapture has 25. The DLink box has a vulnerability that allowed the researchers to gain
local privileges and get shell access, eventually allowing them to extract the AES encryption key.
The vulnerabilities were discovered by IoT Inspector researchers
in a partnership with CHIP magazine, and focused on small business and home
user routers. In each case, a router was provided by the manufacturer, fully updated,
and CHIP and IoT Inspector checked for 5000 CVEs and security flaws. They found many were still
vulnerable to attacks including many attacks considered high risk. The problems associated
with these vulnerabilities were common - problems like the router using an outdated linux kernel,
using weak passwords for default, like Admin, having hardcoded creds in plain text.
In each manufacturers case, the brand did respond swiftly by offering fixes via firmware updates.
In the case of Synology, the updates should also benefit other connected Synology devices.
There are several ways you can circumvent potential attacks using these vulnerabilities
(or any for that matter in terms of routers in general). Applying available security updates,
enabling auto update, changing default passwords,
disabling remote access, and disabling UPnP and WPS are recommended.
I love it when y’all send me these adorable pictures of your pets so these are a few from
my hush puppy Patreon Alliance members. You can always support this content and
keep it ad free for as little as $2 / month, and get a slew of perks at the same time!
Each alliance member gets over 10 perks as soon as you sign up at patreon.com/threatwire.
With that, now onto the third story.
Several cryptocurrency scams and thefts have been on the rise lately.
BitMart, a large scale cryptocurrency trading platform, had a security breach that led to more
than $150 million in cryptocurrency stolen. This affects two hot wallets on the Ethereum blockchain
and Binance smart chain with the total loss being closer to around $200 million. This happened due
to a stolen private key, and BitMart suspended withdrawals after discovering the issue. They
plan to resume operations today, December 7. BitMart disclosed the breach and stolen funds,
promising to use it’s own funds to compensate affected users.
This news comes on the heels of another crypto theft of $119 million from BadgerDAO, another
blockchain based decentralized finance platform. In this case, the platform received reports from
users of unauthorized withdrawals, totalling about 2100 Bitcoin and 151 Ethereum. It was discovered
this attack happened against BadgerDAOs Cloudflare account, and BadgerDAO paused all smart contracts.
According to team members, an unknown attacker injected a malicious script
into the company’s front end by way of a compromised API key for their cloudflare account.
Attackers have tried new ways to scam users out of their cryptocurrency too. For example, as reported
by a Solidity developer named Shegenerates, a scam is being used in the real world to trick
individuals into going to a website that claims to be a decentralized exchange.
In this scheme, the scammer airdrops tokens supposedly worth $30,000 in cryptocurrency,
but is in fact a useless token used to phish victims into granting access
to a Metamask crypto wallet. Shegenerates recommends users not interact with randomly
sent tokens and don’t go to custom sites for those specific tokens as it could be this phishing scam.
If your cryptocurrency does get stolen it would be hard to retrieve. Some platforms
offer protection but not all. Experts recommend moving funds out of “hot wallets” and into
“cold wallets” that aren’t connected to the internet. Changing your email accounts and
updating your passwords are important if you’ve been affected by a theft.
Some platforms may offer to freeze your funds if your wallet is under attack.
Reporting thefts can help as well since you could take part in potential future lawsuits.
Want more security content? Subscribe at youtube.com/ShannonMorse for some
holiday videos including my annual hacker gift guide I posted last week. Don't forget to like
and subscribe to this channel as well! I'm Shannon Morse, I'll see you on the Internet!