Attackers could listen to audio convos, a Lenovo bug affects over 100 laptop models,
and zero days and disclosure are on the rise! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for April 26 2022 - this is your
summary of the threats to our security, privacy and Internet freedom. Hey let’s learn about
audio codecs.
Does your android device run on a Qualcomm or MediaTek chipset? It most likely does,
as these are a couple of the biggest chip makers for smartphones in the world. This
May, researchers will share new findings at CanSecWest showing how these chipsets are
vulnerable to remote code execution attacks all because of a flaw in ALAC, which is the
Apple Lossless Audio Codec, which is supported on Android phones since it was open sourced
back in 2011 by Apple.
Security fixes are released from time to time for open sourced audio codecs but that doesn’t
mean that third party vendors will apply these patches to devices that support them. And
Apple has not supplied any updates to their open source code, which is available on GitHub.
And according to Check Point Research, this means ⅔ of Android users could be affected
by an easy to exploit flaw they discovered. Check Point explains that an attacker could
use this hack, dubbed ALHACK, to get access to media and audio conversations.
Researchers discovered this could also allow an attacker to execute malicious code, execute
malware, escalate privileges, and stream data from a compromised devices camera, alongside
snooping on conversations. While technical details are sparse until CanSecWest, we do
know that these issues cause out-of-bounds reads and writes, validation issues with audio
frames, information disclosure and elevation of privileges.
The researchers also mention these vulnerabilities could be exploited if an attacker sent a media
file (like a song) to a victim. When played, code injection could occur.
Check Point disclosed their findings to Qualcomm and MediaTek, and both vendors assigned CVEs
and patched the issues. You can find the CVEs as CVE-2021-0674, 0675, and 30351. Since all
are patched, updating your devices to at least the December 2021 security patch is advised
and don’t play media files from unknown sources.
Apple has updated their proprietary codec, but not the open source one. Qualcomm and
MediaTek have been using these open source codecs. So this begs the question: are there
other open source codecs with undiscovered vulnerabilities too? It’s entirely plausible
given these findings.
Lenovo has their Unified Extensible Firmware Interface (AKA UEFI) available on 100+ laptop
models and these are vulnerable to three problems which were discovered by ESET researchers
and responsibly disclosed to Lenovo in October of 2021. The issues were patched in security
updates. This could potentially affect millions of Lenovo customers since their list of affected
devices includes popular models such as IdeaPads, Legion laptops, Yogas and more.
The first two flaws stem from a couple of firmware drivers called SecureBackDoor and
SecureBackDoorPeim, which are used during manufacturing, introduced into production
models. CVE-2021-3971 is caused by a driver that is used in older manufacturing processes
making it’s way into consumer Lenovo notebook devices. This was mistakenly included in the
BIOS image and could allow for privilege escalation and the ability for an attacker to modify
firmware protection.
The second flaw is CVE-2021-3972, which also is a manufacturing driver that shouldn’t
have been in consumer notebooks. This one wasn’t deactivated and could allow an attacker
to gain privilege escalation to modify secure book settings.
The third problem is CVE-2021-3970. This one could give a local attacker privilege escalation
and the ability to execute arbitrary code. In all three flaws, an attacker could gain
persistence so their attack could survive through a system reboot.
UEFI flaws are important because they’re harder to detect and operating system mitigation
techniques are generally useless against them because the UEFI sets up boot processes before
it hands control over to the operating system for the user.
Lenovo recommends users update system firmware versions from the support page manually for
their device or by using Lenovo tools to update system drivers from within the OS.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos and for
the support. THANK YOU to Ash for joining the alliance on Patreon.com/threatwire. I
have a fourth story to cover, which is only available to the Patreon Alliance so check
that out if you’re interested. Let’s finish out today’s episode with my last top story,
about zero days.
Two studies came out last week within days of each other explaining current analysis
of Zero Days being used in attacks. These reports came from Google’s Project Zero
and Mandiant. Both studies work together to mold an image of where zero days currently
stand in the threat group economy so I’m including both of them in this segment.
Mandiant explained in their report, posted on the 21st, that zero day exploitation is
on the rise, with them seeing an all time high of 80 zero days exploited in 2021. Previously,
the most they’d seen in a one year time was 32 in 2019, and 30 in 2020. They’re
also seeing more diversity in usage, with more financially motivated attackers using
zero days over just state sponsored espionage motivated attacker groups.
Mandiant noted that Chinese groups continue to exploit the most zero days, and state sponsored
groups are still the primary actors. But the proportion they’re seeing of financially
motivated attackers is rising, now at about 1 in 3. Microsoft, Apple, and Google products
were the most frequently attacked, no surprise since those are all huge companies in the
tech sector.
Mandiant suspects this growth is caused by several factors. There are more zero days
available to be used, because of a rise in new devices and systems connected to the internets.
Exploit brokers are shifting resources towards research and development of zero days. And
better defense means detection will be better, so companies are able to ‘see’ these attackers
at a greater rate, with better visibility.
With that diversification of attackers, that means the scope of attacks is expanding, so
more industries and locales should be increasing their defenses. Discovery of zero days is
dynamic, so updates to their research could be included in the future.
Google’s Project Zero also showed 2021 to be a record year for zero days, with them
seeing 58 disclosed. That doubled from the previous report of 25 in 2020. Project Zero
also attributes this increase to better detection and disclosure, not just more usage.
Project Zero also points out that in most cases, attackers are using old techniques
to exploit vulnerabilities, meaning they don’t have to put money into designing and developing
new method if they don’t have to. So zero days aren’t necessarily costly to use or
buy for attackers, which could be one of the reasons we’re also seeing more financially
motivated groups using them.
Want to see more tech videos from me? Check out my youtube channel - youtube.com/ShannonMorse
for everything from tech reviews to security tutorials, like my recent video about malware
and tax season scams. And with that, don't forget to like and subscribe to Hak5! I'm
Shannon Morse, I'll see you on the Internet!