Hello, World!
Is google home spying on you?
Why does twitter keep getting hacked?
And has China finally broken encryption with quantum computers?
That’s all coming up in today’s roundup of cyber security tech news.
Smart speakers spying on you, might just be a bit of a meme - but a newly discovered bug
in Google home devices, makes this meme a reality.
A security researcher discovered a vulnerability which allows hackers to remotely gain full
access to a google home device, allowing them to… well - do anything they want, including
listen in on your conversations.
The researcher behind this discovery explains he was “messing with [his] Google Home and
noticed how easy it was to add new users to the device from the Google Home app.”
I mean - it’s as straightforward as entering an email address - simple, really.
But this simplicity tickled our white hat hacker the wrong way.
So he investigated…
after capturing HTTP traffic from the device he analysed how the process of adding a new
user really works.
Discovering that, after entering an email address, the app sends a HTTP request to Google’s
servers, asking them to add the new user.
The request is authenticated with three pieces of information, your “device name, certificate,
and “cloud ID””.
So, theoretically if an attacker was able to get their hands on these 3 pieces of information
- unique to your Google home, they could give themselves full access to your device.
And it turns out, that getting this trio of information, is as simple as just asking the
device for it.
As long as you know a Google home’s IP address you can just request the information from
it, using it’s built in API.
But the catch of course being a hacker would need to be on the same WiFi network as the
Google home in order to send this request - and hacking into a WiFi router is a whole
challenge in of itself, so this is a fairly big caveat.
But this is when our researcher made yet another discovery, it’s possible to remotely force
a Google home to spawn its own unprotected WiFi hotspot that an attacker can connect
to and use to send the query.
This is done using what’s known as a WiFi deauthentication attack, or deauth attack
for short, something we’ve seen quite a bit of on this channel.
This attack exploits a flaw in the WiFi protocol that allows a bad actor to kick devices off
a WiFi network and prevent them from reconnecting, it’s basically a denial of service attack.
At this point, the Google home basically becomes kinda confused, and so, it’ll enter setup
mode - spawning its own WiFi network.
An attacker can connect to this, and then use that it to query the API, get those 3
pieces on information, and then send a request to Google, giving them full control over the
Google home.
But, what then?
I mean, it’s difficult to see how this could be abused on a mass scale by financially motivated
cyber criminals.
Rather this kind of vulnerability would be more useful for targeted attacks, I imagine
it’s the kind of thing that our friends at the CIA might be interested in - and whilst
that might sound like just pure speculation, we know for a fact that CIA hackers have more
than a passing interest in smart home devices.
In 2017 the Vault7 leaks courtesy of wikileaks exposed the existence of something the CIA
calls “weeping angel” - a tool which turns certain models of smart TVs into surveillance
devices for the purpose of intelligence gathering.
One way a Google home device could similarly be turned into a surveillance tool, is by
using the legitimate Google home feature “Routines” - after gaining full access a bad actor could
set up a Google home to call a certain phone number at a predefined time, with the miscreant
muting their own microphone and, listening in.
But luckily, the security researcher who discovered this bug, responsibly disclosed it to Google,
and it’s now been patched.
For his efforts Google awarded the bug hunter $107,000 dollars.
Over the past few weeks you will have seen reports of multiple Twitter hacks.
But all is not as it seems, and there’s a lot of confusion here, so let’s investigate.
The first thing that kicked off this drama was news over Christmas of a Twitter data
leak comprising the details of 400 million users.
If true this would be the largest Twitter leak of all time.
It was initially posted on breachforums with the leaker claiming “it includes emails
and phone numbers of celebrities, politicians, companies, [and] normal users”, with the
poster suggesting Elon Musk should pay up now, to avoid being fined millions by governments.
Someone who claims to have spoken to the hacker said they were asking for $50k, which is rather
believable.
And - just on a sidenote, this is the first time a leaker themselves has given me a shout
out in the comments.
So that’s cool I guess…
I’m not sure how to respond to that, but anyway…
They did post a bunch of sample data to prove the breach - so it all looked rather legit.
But just days later the forum thread disappeared.
Turns out the leaker had been banned for the reason “Suspected Lying about Record count”.
You see, the figure of 400 million was ever so slightly off, by about a couple hundred
million.
Another breach forums user, who’s account was created just days ago - so it’s probably
the same guy, reposted the leak with duplicate entries removed.
This time only 200 million users are affected - I say only but this is still the biggest
leak in Twitter history, one that is now public for anyone to download, with the miscreant
reneging on the $50k demand.
There’s also no phone numbers in this dump, just names, handles and email addresses, no
doubt much to the disappointment of sim swappers.
And this second post is what’s caused some confusion, with some news websites reporting
the 2 posts as being separate incidents…
making it look like Twitter was under some multi pronged coordinated attack with 600
million people being hacked.
Which isn’t the case, but regardless 200 million is still a pretty big number, so where
did all this data come from?
For that we have to go back in time to January of last year when a vulnerability reported
to Twitter’s bug bounty program exposed how it was possible for an attacker to exploit
Twitter’s API to obtain the “Twitter ID … of any user by submitting a phone number
[or email address]”.
This bug would’ve allowed a bad actor to test already public email and phone number
lists against Twitter’s API, matching them against Twitter IDs.
And well, it did, because before this bug could be fixed by Twitter it had already been
exploited.
The first known instance which came to light last August being a dump of 5.4 million accounts,
and now we have this latest dump of 200 million accounts, with potentially more breaches currently
unknown.
And whilst all these breaches must’ve been perpetrated over a year ago by this point,
I mean - the bug that made all this possible was fixed last January, the bad actors will
have likely spent the last year using - or well, should I say… abusing the dumps for
their own personal gain before finally leaking them publicly.
To make things worse for Twitter, they’re already being investigated by the Irish data
protection commission, for that initial dump of 5.4 million users, adding a further 200
million to that number is pretty bad news.
Because Facebook - which fell victim to a similar data scraping incident in which 533
million users details were leaked, was eventually fined a quarter of a billion dollars by the
same government agency which is now investigating Twitter.
I should point out though that the Facebook leak was quite a bit worse, in addition to
names and phone numbers, it also included miscellaneous data like “genders, occupations,
locations, and marital statuses” - data which might seem kinda benign, but would be
very useful for bad actors launching phishing campaigns.
It remains to be seen if Twitter will suffer a similar fine, but let me know in the comments…
did you receive a ‘have I been pwned’ notification?
Chinese researchers claim to have found a way to break encryption using quantum computers,
if true this would have major security implications.
I mean - It’s been long known that quantum computers pose a significant threat to asymmetric
encryption - the kind that uses a public and private key.
But this was meant to be years away, so for researchers to claim they’ve now managed
to break 2048 bit RSA encryption - the kind which underpins things like SSL certificates,
is a big deal.
But luckily the truth is a little more complicated.
And I mean, complicated - so here’s my brief and very high level overview of what’s going
on.
When news of this research paper first broke, some very respected computer scientists were
taking it rather seriously.
But now that the dust has settled, the paper has more or less been dismissed as radically
overhyped.
The paper essentially claims that researchers have discovered a new way to factor massive
numbers very quickly, thereby making it possible to break 2048 bit RSA encryption within a
timeframe relevant to humans, as in a lot quicker than the age of the universe.
To do this they’ve taken an algorithm (Schnorr) and enhanced it with quantum technology.
Thing is the researchers only tested their hypothesis on a quantum computer with 10 qubits,
nowhere near the 372 qubits that the paper says are required to actually break encryption.
And whilst their test on that 10 qubit quantum computer did work, the algorithm they’re
using is notorious for falling apart and just not working on larger scales.
Leading some computer scientists to comment that “this is one of the most actively misleading
quantum computing papers [they’ve ever seen]”.
And whilst quantum computers that exceed the 372 qubit minimum are right around the corner,
this isn’t expected to make a difference.
There are some other things that just don’t add up.
If this paper was undeniably correct, wouldn’t the Chinese government be quick to censor
this research and keep it for themselves?
I mean Beijing has a history of not being very happy when landmark exploits aren’t
reported to them first.
Take log4shell, after Alibaba responsibly disclosed the vulnerability to the apache
foundation, the government responded by suspending Alibaba from an important information-sharing
partnership with the government.
Regardless of this latest paper, quantum computers do pose a real risk to certain cryptographic
algorithms, but in reality to break RSA it’d probably require millions of qubits rather
than hundreds, and those machines are still a way off.
Having working code only to find out that the version it runs on is going end-of-life
is frustrating, you would have to quickly migrate to the latest version, with a bunch
of code refactoring and rewriting.
But not with TuxCare, they help you plan the transition with their Extended Lifecycle Support,
which covers a range of linux distros, as well as PHP and Python.
With TuxCare you can keep your existing codebase and still receive security updates and patches
for deprecated versions.
This means that if your codebase still meets your operational requirements, it can still
meet your security targets, giving you time to plan your next move.
Learn more about TuxCare’s Extended Lifecycle support by clicking on the link in the video
description.
As always, thanks for watching and I’ll see you in the next video, have a good one.