Hello world,
Apple is handing over control of user data to China,
A bug in anker security cameras has caused a little mayhem,
Google will start, automatically changing your passwords for you,
Cybercrime group “kek”sec introduces the “sims” botnet,
And technology detection dogs sniff out usb sticks
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
Apple often brags about how great they are at privacy and security, one example is their
resilience to government agencies invading user privacy. In 2015 Apple went to great
lengths to prevent the FBI from forcing them to unlock a terraced iPhone 5c, they made
a big deal about it, and the case went to court. Apple got their way and wasn’t forced
to unlock the device, though the FBI did eventually manage to break into it with the help of a
third party. The whole saga even has its own wikipedia page.
So, good guy apple I suppose? Not so fast, a new report from the New York Times, citing
leaked Apple documents, and interviews with Apple employees throws Apple’s goodwill
into doubt, and makes their stance on security and privacy look more like some kind of convenient
marketing ploy. That they’re pro privacy and security in the west, because it’s the
new cool thing and that it’s a business decision rather than based on principle.
The reasoning here is derived from just how much control of user data Apple has handed
over in China. In 2016 China passed a law requiring personal data collected in China
to be stored in China, that includes pretty much all iCloud data. Apple acquiesced to
these demands, but they were also forced to store the decryption keys to this data in
China - something which in their defence they did protest.
It’s not unusual for countries to determine where their citizens' data is stored. The
problem here, is the scary level of concessions Apple has made to the Chinese government,
compared to their public stance on privacy in the West - their actions in China couldn’t
be more diametrically opposed.
According to the New York Times, in China, Apple has made the strange move of transferring
the legal ownership of its user data, to a Chinese company. Meaning that, if the Chinese
government wanted to pilfer user data, they could completely bypass Apple and retrieve
it from the other company. This, so says the New York Times, is Apple’s way of circumventing
a US law saying Apple can’t hand over data to Chinese law enforcement. In fact, Apple’s
new China data center isn’t even controlled by Apple, but rather by Chinese state employees
according to the New York Times.
The good news is, Apple’s Chinese servers will be isolated from the rest of the iCloud
network, so unless you live in China, your data shouldn’t touch those servers at all.
The overarching point to all of this, is that I’m finding it increasingly hard to trust
the reputation a business has on security and privacy, as companies seem to go whichever
way the wind is blowing on these issues. It makes me think that the shift towards privacy
and security we have in the West, is just some kind of facade, that companies could
turn on a dime, if for whatever reason it ever became convenient.
This is a topic I’m interested to hear your guys’ opinion on, are you worried about
the direction this is heading? Or are you more indifferent, that realistically speaking
Apple didn’t have a choice here but to bend to the whims of the Chinese government, or
face being shut down in China. Can Apple really be blamed per se? Let me know your thoughts
in the comments.
A bug in certain Anker security cameras has caused a little, mayhem. These security cameras
utilise an app to display a live feed and recordings, but a dodgy server side update,
caused the wrong cameras to become linked, with the wrong accounts.
Meaning people were opening the app to find a switcheroo had taken place. That they were
watching live feeds of the insides of other people’s homes and had access to all their
recordings, and that presumably someone else had access to their cameras.
One “cosmik_gg” posted details of the issue on reddit, that he checked the app like
he always does, to see on his security feed a woman he doesn’t know walking through
a garage that he doesn’t own. As you can imagine, people were rightly shocked by the
whole incident, after all this is a security camera company.
To clarify, the company itself is eufy - I think that’s how you pronounce it, but the
parent company which runs the show is Anker. On eufy’s website they allege that “privacy
is our priority” - they also say that they employ “end to end encryption”, and that
only you have the key to decrypt and watch the footage. Obviously they haven’t implemented
this encryption in any meaningful way.
A creepy new Google feature will automatically change your passwords, for you. Idea being
if chrome detects one of your stored passwords for some website has been included in a data
breach, it’ll ask you if you want it changed, upon accepting, it’ll change the password
for you to something random and save it in chrome so you don’t have to go through the
hassle of doing it all yourself.
Dare I ask, what could go wrong? At first you won't necessarily have to completely trust
chrome, because upon accepting a request, chrome will spawn a zombie browser tab that’ll
change your password in front of you, moving the mouse and typing your new password autonomously
- you’ll have the option to stop it at any point if you thought it was, going wrong.
Kind of like Tesla autopilot, you’re in the driving seat and have the ability to take
over if needs be, simply because all websites are different and chrome won’t necessarily
be familiar with how all of their password reset procedures work.
Lastpass has had a similar feature called ‘autochange’ for a while now - I haven’t
used it though, so can’t vouch for it. This new chrome feature does of course require
you to store your passwords within chrome though, a big downside.
The cybercrime group “kek”sec has spawned a new botnet, which they’re calling “sims”.
I’m only reporting on this particular story because it’s not everyday you come across
a botnet called ‘sims’. This new botnet is focused on carrying out DDoS attacks, and
uses code from the infamous Mirai botnet for its DDoS functionality.
It infects IOT devices vulnerable to certain remote code execution vulnerabilities. The
uptycs’ threat research team have just published a deep dive on this botnet, though upon receiving
a bunch of unwanted attention the group privated a youtube video they had made to advertise
their “sims” botnet.
In this ad, which I was quick to download before it went dark, the botnet uses a funky
command line interface - they also demoed the capabilities of it by DDoSing logan paul’s
website for 20 seconds - that was an interesting surprise.
A discord server linked with the group contained users named “urmommy” and... “this”
- which is an md5 hash, don’t go searching rainbow tables to see what this maps to, it’s
rather... uncouth.
You’ve heard of drug detection dogs, but have you ever seen a technology detection
dog? Apparently these doggos have been a thing for over a decade, but it's news to me. They
can sniff out USB sticks, SIM cards, mobile phones, and it’s all down to the fact that
electronics leak a small amount of a chemical called triphenylphosphine oxide, which is
a coating commonly applied to electronics.
The Australian Federal Police have just announced an almost $6 million investment to train up
more of them. Typically these doggos are used for sniffing out electronics hidden by kiddy
fiddlers, extremists and other degenerates.
As for things which aren’t degenerate, Maltronics is a website, run by myself where you can
find an array of super cool pentesting products, our gear is used in over 100 countries and
you can get 10% off with code seytonic. Trusted by hobbyists, pentesters and educational institutions
you can learn more at maltronics.com
If you want to see more of this kind of video make sure to let me know in the comments and
turn those sub notifications so you don’t miss any hacking news. I’m really happy
with this new format, and according to the analytics you guys are too - which is great.
Though if there’s anything you think I could be doing better, anything at all please let
me know in the comments, I do try to read through as many comments as I can, so I’ll
do my best to respond to you.
For behind the scenes footage do follow me on instagram. As always sources will be linked
in the description, stay tuned for more hacking videos, have a good one.