Flaws in a DNA Sequencer could lead to hacks, Magecart is back with some shiny upgrades,
and Cloud backups of 2FA codes?
Better make sure they’re encrypted!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for May 2, 2023 - this is your summary of
the threats to our security, privacy and Internet freedom!
Big news!
If you haven’t seen recent ThreatWire episodes, I’m about to hit 100,000 subscribers on
my main channel, as I’m recording this I’m about 100 away!!
My channel is youtube.com/ShannonMorse.
Help me hit that goal by subscribing to my channel, where I post tons of security and
privacy content.
Let’s jump right into the news this week.
CISA and the FDA posted an advisory about Illumina’s Universal Copy Service, which
is a DNA sequencing device used in medical labs all across the world.
The UCS has two vulnerabilities that could allow for remote code execution and malicious
uploads, along with admin level controls.
Since these devices are used in 140 countries for DNA sequencing, including in clinical
and research settings, biotech, and pharmaceuticals, an attack on these systems could have major
consequences.
One of the vulnerabilities has a CVE marked at the highest severity, 10 out of 10.
An attacker could listen to network traffic and pivot to other vulnerable machines on
the same network; they could modify settings, access proprietary data, and elevate their
privileges.
They could impact genomic data results used for clinical diagnosis to provide incorrect
or altered results.
The two CVEs are tracked as CVE-2023-1968 and 1966.
Admins should update their products, configure account credentials, close firewall ports,
isolate networks and use VPNs for remote access.
Magecart is back and it had an upgrade.
In this new campaign, Magecart, a term used to define criminal groups who use online skimming
to steal customer information and payment data from online retailers, is using very
realistic looking checkout and payment screens to steal payment data from users.
In some cases, these new skimmers look more legitimate than the actual retailer sites.
This is because Magecart is being deployed as a modal, or a part of the main checkout
page, instead of redirecting users to a third party payment processor site.
Using these kinds of forms creates more trust from the user because it looks like you’ve
never left the retailers site at all.
The malicious payment pages use Javascript scripts to capture data that is entered by
a customer.
The fake page siphons the credit card data, then a fake error is displayed to the user
saying their payment was canceled or declined.
Wait a few seconds and the page refreshes to the actual website checkout page, where
they can then enter their details once more and the payment is successful.
The attackers also use session cookies to mark the user's session as being completed.
So if a user chooses to go back and try to pay for something on that site a second time,
they’ll just see the legitimate cart as the malicious screen will not display a second
time.
The attackers appear to be using different domains with different deployments for each
store.
MalwareBytes researchers discovered the modals were deployed across a variety of e-commerce
sites and in a variety of languages.
They listed indicators of compromise in their blog post for admins.
Biggest of shoutouts to my Patreon supporters, especially my Golden Smores and their fur
babies, for making this show possible since we don’t have ads on this show at all!
THANK YOU to KTWarez Dot Com, Daniel, Xi, Yuri, and Alfred! for being a part of the
Smores at Patreon.com/shannonmorse.
That’s my new Patreon page for the show, where I’ll be posting all the
perks for patrons, including early access to this video.
If you’re currently a patron on the ThreatWire page, switch over to the new page so you don’t
lose access to your perks.
Let’s finish out today’s episode with my last top story, about Google Authenticator!
Shoutout to Joel this week for sharing this story.
For years I’ve recommended Google Authenticator for 2 Factor Authentication codes, and if
you want some up to date videos about 2FA and why it’s still highly recommended in
2023, check out my channel, Morse Code.
Google Authenticator has never had a ton of fancy features, but the app now supports Google
Account Syncing, which means you’ll have the ability to backup your one-time codes
to your Google Account.
For years, if you lost a device that you used to generate 2FA codes with the Google Authenticator
app, you ran the risk of locking yourself out of your accounts unless you stored backup
codes somewhere safe.
But now, that’s not the case.
So, should you turn this on?
Maybe not yet.
This update means you can snag those codes from any device where you’re signed into
that same Google Account.
Cloud backup of 2FA codes is optional and has to be manually turned on by the user.
As such, someone who is worried about their Google Account being accessed by an attacker
may not want to enable this feature, since allowing a malicious actor access to Google
Authenticator means they’d have all of your one time codes in their fingertips.
Another problem that arose is the lack of end to end encryption for these backups.
Researchers with Mysk and Sophos shared posts about these concerns after analyzing network
traffic.
They found that the QR code for 2FA setup is viewable when uploaded, which also means
Google could see which websites you use with 2FA and be able to read data like your account
details.
There are no passphrases to encrypt the data before it leaves your phone.
Google stated the Google Authenticator data is encrypted in transit and at rest.
And they do plan to enable E2EE for Google Authenticator “soon”.
How soon is soon?
Well, we don’t know, but if they offer encryption before the code backups are sent to the cloud
aka someone else’s computer, then it will be convenient.
E2EE is available in the alternative app called Authy, and requires a passphrase to upload
backups to the cloud.
Google should be enabling something similar, but the caveat is if you lose your encryption
passphrase, you could also lose access to your 2FA code recovery via backups.
I'm Shannon Morse, I'll see you on the Internet!