Bluetooth and WiFi still deliver on hacks, PACMAN attacks M1 Chips, and somebody hacked
telcos!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for June 14 2022 - this is your summary of
the threats to our security, privacy and Internet freedom.
New merch alert!
This is a ThreatWire SAO Totem board - it’s an electronic board powered by micro USB that
can be used to power these tiny devices called Simple Add Ons.
These are limited edition and once they sell out they’re gone for good.
So get ‘em while you can from my personal shop at snubsie.com/shop.
Thank you for supporting my content in whichever way you do it, let’s get started with today’s
news.
Two recent studies on smartphone signals by two separate universities this week have shown
how the data transmitted can be used to obtain info about phones that the owners aren’t
aware are being broadcasted.
The first of these is a study on WiFi by the University of Hamburg in Germany, which found
that when capturing probe requests from phones of random people passing nearby, they could
obtain additional information about those phones.
The researchers conducted this experiment in November with six antennas in a busy pedestrian
area in Germany.
They captured over 250,000 probe requests in a period of three hours, with about 46%
of that being 2.4Ghz, and 54% being 5Ghz.
They also captured over 58,000 SSIDs that were broadcasted, some of which included strings
of numbers that were likely initial passwords of home routers that were never changed.
What are the implications of SSID broadcasts like this?
There’s the obvious - Wifi Pineapples, malicious hotspots, and persistent tracking, and device
manufacturers have implemented MAC address randomization to help with this.
The researchers found that there is still a large percentage market share of older mobile
OS’s which did not have MAC randomization for every communication request and response.
As such, older models are more vulnerable to tracking.
Users can upgrade their OS or hardware if software upgrades are no longer available.
Remove old SSIDs no longer in use or needed from your Wifi settings, and disable auto
joining networks.
Advanced network settings also allow for silencing of probe requests, but the drawback is slower
connections, problems discovering hidden networks and higher battery consumption.
If all of this sounds familiar, well, that's because it is.
The WiFi Pineapple and Darkmatter’s Wifi Kraken have done extremely similar studies
many times.
The second study is on bluetooth.
In this study, researchers at the University of California San Diego discovered they could
track device owners based on unique fingerprinting obtained through Bluetooth signals.
The attacker in this case would need an SDR to sniff Bluetooth low energy beacons, which
transmit from mobile devices at 500 beacons per minute, which allows for user features
like finding a lost device.
Within the BLE signal, the researchers focused on two values called the Carrier Frequency
Offset or CFO, and the IQ.
They claim these two values vary from device to device, as slight imperfections in timing
for the packets can be calculated and matched up to a MAC address.
This is due to unique physical layer fingerprints that happen during manufacturing of bluetooth
chipsets.
The good part is out of 600+ unique devices tested against, they were able to find about
47% with unique fingerprints, so this wouldn’t work against all devices.
There are a lot of factors that make this hard to pull off, such as proximity, temperature,
transmission power for the beacons, quality of the SDR, etc.
To mitigate, redesigning Bluetooth could be necessary, but the researchers are looking
into device firmware fixes, as well as hardware level defenses.
Researchers at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL)
discovered a way to attack the Pointer Authentication in Apple’s M1 Chip to gain arbitrary code
execution on Macs.
This attack would require physical access and a memory bug that would first be blocked
by PAC but then escalated into a severe issue by bypassing those PAC defenses.
The Pointer Authentication sets up a cryptographic signature called a pointer authentication
code or PAC to detect and block strange changes to a system that could lead to data leaks
or compromised Macs.
But in this case, the pointer authentication code is triggered then bypassed leading to
the arbitrary code execution.
The trigger created something called a PAC Oracle, which tells if the authentication
code matches up to a specified pointer.
This Oracle can’t crash if the match is incorrect, but the researchers then brute
force any possible values using that Oracle.
In a tweet, the researchers stated that this was a way to defeat pointer authentication
and forge kernel pointers from userspace.
Apple won’t be able to patch this issue.
According to the company, it doesn’t present a danger since it depends on other vulnerabilities
to work.
But keeping a device updated with patches will help protect against this since the attack,
dubbed PACMAN, uses bugs that could be exploited to trigger the pointer authentication.
So on it’s own PACMAN can’t compromise your machine, but it builds upon other bugs
to cause further issues.
The MIT researchers will be presenting their findings at the International Symposium on
Computer Architecture on June 18.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to everyone who joins the alliance on Patreon.com/threatwire.
Let’s finish out today’s episode with my last top story, about hackin telcos.
About a week ago I saw a cryptic tweet from a reputable security researcher that simply
said “hey, everyone, please update your routers.”
And everyone’s reaction was “well, I guess I’m working overtime tomorrow.”.
So it turns out the NSA, FBI, and CISA are alerting US industries about 16 different
flaws in networking devices from 10 different brands that are being used by state sponsored
attackers from China to steal and manipulate network traffic.
The brands affected include Cisco, Fortinet, Netgear, MikroTik, Pulse Secure, Citrix, Draydek,
D-Link, QNAP, and Zyxel.
All of the flaws being exploited are publicly known problems that were disclosed anytime
between 2018 to 2021, mostly rated as critical.
The PRC or People’s Republic of China has used these flaws to attack networks since
at least 2020.
They’ve used them to target both VPN services as well as public facing applications.
In most cases, the government agencies found that small business routers, NAS devices,
and enterprise VPNs were targeted the most, but even more critical is the attackers compromise
of telecommunications companies and network service providers specialized equipment.
Telcos were attacked using SQL commands to dump admin creds from databases on RADIUS
servers.
Cisco and Juniper routers were hit with automated scripts that would set up a secure shell and
execute commands.
The smaller equipment like routers and NASs are being used for routing of traffic for
command and control.
The attackers also used routers to exfiltrate and manipulate traffic.
How can admins mitigate?
Updating devices, isolating compromised ones, replacing EOL hardware, disabling open and
unused port access and enabling MFA for users are all recommended steps.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
Don't forget to like and subscribe to Hak5!
I'm Shannon Morse, I'll see you on
the Internet!