Keyloggers are alive and well, Teslas can be hacked… again, and will this new CFAA
policy actually protect ethical hackers?!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for May 24 2022 - this is your summary of
the threats to our security, privacy and Internet freedom.
Low stock alert!
I sell ThreatWire swag on an online store and I’m running super low on these ThreatWire
stickers.
I won’t be restocking these or the t-shirts (I only have size small left), so get ‘em
while you can because these items are officially being retired from my personal shop at snubsie.com/shop.
Thank you for supporting my content in whichever way you do it, let’s get started with today’s
news.
HP’s Wolf Security has found a new PDF malware campaign using a keylogger called Snake to
infect PCs and steal data.
Snake was originally discovered back in November of 2020, so it’s fairly new.
It’s both a keylogger and a credential stealer.
In this case, an attacker would email a malicious PDF that includes an embedded word document.
The pdf is called Remittance Invoice.
When opened, Adobe warns the user with a popup explaining that the word document embedded
within could contain viruses or harmful macros.
But, the word doc is named “has been verified.
However, PDF Jpeg XLS, .docs” so the popup reads “The file 'has been verified.
However PDF, Jpeg, xlsx, .docs' may contain programs, macros,” etc etc.
So this naming could trick a user into thinking the file has already been verified as legit.
If the word doc is opened without Protected View on, then word downloads an RTF or rich
text format file, and downloads an external object which exploits an older RCE vulnerability.
Within this object is a shellcode which downloads and executes “fresh.exe” which is actually
the snake keylogger.
Snake then can steal saved credentials, keystrokes, it can take screenshots of the screen, copy
clipboard data etc.
Here’s the funny part.
That older remote code execution vulnerability is tracked as CVE-2017-11882.
Microsoft patched it in 2017… but it had actually existed long before that.
It’s 22 years old.
So apparently it’s still effective enough to be included in active attacks, and what’s
the moral of this story?
Don’t open weird file attachments.
Ok, I love car hacks.
They are so fun and play off of one of my favorite hacking techniques - RF or radio
frequency hacking.
In this case, we have a new bluetooth hack, which targets vehicles that use bluetooth
proximity to unlock.
As an example, to unlock a Tesla, your phone and the car speak to each other via Bluetooth
to determine their proximity to each other and as you move closer, it’s supposed to
unlock.
Your phone isn’t supposed to transmit your key over bluetooth unless it’s within range
of the car.
Researchers at the security firm NCC Group found a way to unlock a Tesla and many other
vehicles and devices without the need for local proximity using a relay attack, which
in itself isn’t new but this implementation is.
The relay attack requires two attackers, with one being close to the car, and one being
close to the phone while the phone and car are far away from each other.
The two attackers communicate with each other via an internet connection, with the first
attacker impersonating the phone, sending signals to the car, which prompts the car
to send back an authentication request.
The request is captured, sent to the second attacker, and they forward that request to
the phone, which in turn responds with the key.
This is sent back to attacker 1 and they can unlock the car with that key.
This could also be done by using a device drop, hidden near the phone and listening
for authentication info.
Again, relay attacks aren’t new, and manus have set up mitigation techniques to protect
against these attacks, but NCC Group built upon this by attacking on a different layer
of the protocol.
Instead of focusing on the Generic Attribute Profile layer, they went to the link layer,
which is the lowest level of the bluetooth stack and is used for storage of the encrypted
credentials.
The attack uses BLE or Bluetooth Low Energy to unlock the vehicle doors, operate the vehicle,
and also gain access to laptops and other BLE enabled devices.
It’s confirmed to work against Model 3s and Model Ys along with Kevo Kwikset and Weiser
smart locks.
There’s no CVE for this flaw since it has to do with Bluetooth low energy implementation,
but brands and manufacturers could mitigate this by adding an authentication technique
on top of just supposed proximity.
They could require user input or the accelerometer could be used to ascertain movement.
While the Bluetooth Special Interest Group did acknowledge the relay attacks they believe
it’s a small risk though more accurate ranging mechanisms are being worked on.
Users could disable the feature altogether or switch to alternative methods for authentication.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to Blustery Decay and Hunter for joining the alliance on Patreon.com/threatwire.
Y’all helped us hit 813 Patreon Alliance members this week, all of whom get access
to a fourth story, check that out if you’re interested.
Let’s finish out today’s episode with my last top story, about the CFAA.
Hey, we have some good news for once.
Although it’s been a gray area for years, the US Department of Justice finally made
a revision to the CFAA to specifically clarify that they will not prosecute ethical hackers,
with a new “good faith” argument added.
According to the updated CFAA guidelines, which is the Computer Fraud and Abuse Act,
a very old federal law that was passed in 1986, things like software testing, investigations
and corrections of flaws or vulnerabilities, analysis of security flaws, and breaches which
are intended to promote better security and safety for the devices targeted will not be
prosecuted in federal court.
The DOJ defines good faith security research to clearly demonstrate what would fall within
this newly revised area.
If a security researcher “conducts security research” but then uses their findings to
extort a company or target, that would not be covered under this new clause.
In other words, blackmailing a company wouldn’t slide, nor would publicly leaking exposed
data.
As such, each case would be critiqued to determine the ethical cause of the actions.
Hopefully any cases that fall into a legal gray area would be scrutinized by political
prosecutors who have a decent understanding of security and privacy.
But for security researchers and ethical hackers who have joined bug bounty programs or do
vulnerability research, this update should bring some better protections.
On the other hand, some folks do think this isn’t enough.
Senior staff attorney at the EFF Andrew Crocker explained in a Vice article that this doesn’t
bind courts and it could be rescinded by a future administration.
This policy goes into effect immediately for all federal prosecutors.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
Don't forget to like and subscribe to Hak5!
I'm Shannon Morse, I'll see you on the Internet!