VMWare patches 10 flaws, one of ‘em is critical, math breaks post quantum encryption using
a single core pc, and the emergency alert system can be hacked!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for August 9 2022 - this is your summary of
the threats to our security, privacy and Internet freedom.
Special announcement!!!
I will be at DEF CON this weekend filming a special episode of ThreatWire… and I’m
having a meetup!
The meetup is happening at BeerHaus on Sat the 13th at 7pm.
I’m not booking space, so just show up if you wanna hang out.
If anything changes I’ll post about it on my social media so keep an eye on my twitter
and Instagram for details - I’m @ snubs on both platforms.
Also: If you are a Happy Waffle tier patron, check your Patreon DMs for details on a VIP
private meetup just for y’all.
I haven’t posted details on that yet but will send y’all a direct message once that
meetup has been confirmed.
Thank you for supporting my content in whichever way you do it, I seriously cannot wait to
meet yall at DEF CON.
Let’s get started with today’s news.
VMWare is recommending users update products ASAP to fix 10 flaws that have CVE scores
between 9.8 (critical) down to 4.7 (moderate).
These all have separate CVEs and they affect a variety of VMWare products, including Workspace
ONE Access, Access Connector, Identity Manager, VRealize Automation, Cloud Foundation, the
Identity Manager Connector and the vRealize Suite Lifecycle Manager.
The issues include a few local privilege escalation bugs which would require an attacker to have
local access, but could give them root credentials.
One of the flaws is a reflected cross site scripting vulnerability, and this could allow
for improper user sanitization, leading to malicious Javascript code to be inputted.
Of all of these, the critical score goes to an authentication bypass vulnerability for
local domain users.
This could lead to an attacker gaining admin rights if they have network access.
Three of the flaws are RCEs.
As far as VMWare knows, there aren’t aware of any active exploitation of these vulnerabilities
in the wild, but mitigation is very important now that they’ve published the CVEs and
patches.
Researchers warn these flaws could be used in an exploit chain, and a proof of concept
is coming from the researcher who first discovered the flaw.
In some news that makes me wanna say “oof, that hurts”, a potential post quantum encryption
standard is now basically DOA due to an attack that used 1 hour of time and a single core
PC to recover it’s encryption keys.
Ironically, the name of this encryption algorithm is called SIKE.
It’s short for Supersingular Isogeny Key Encapsulation and it’s very fascinating
how it works.
SIKE works on SIDH, which is short for Supersingular Isogeny Diffie Hellman.
It used one step to generate the encryption key, and SIKE’s co inventor, David Jao,
told ArsTechnica that the attack that broke it uses mathematics from the 1990’s and
2000’s.
The attack uses genus 2 curves to attack elliptic curves, which was unexpected.
SIKE could potentially be made to take two steps instead of one to prevent this attack.
Jao explained that this is definitely a blow to SIKE, and was very transparent about their
understanding of cryptography but not the mathematics involved to recognize this kind
of potential attack.
This attack came to light during the US Dept of Commerce’s National Institute of Standards
and Technology or NIST’s campaign to find post quantum computer encryption algorithms
that could replace the current algos that include RSA, Diffie Hellman, and elliptic
curve DH.
NIST already chose four replacements called CRYSTALS Kyber, CRYSTALS Dilithium, FALCON,
and SPHINCS+.
NIST also chose four more as potentials for further testing, and SIKE was one of those.
From there, researchers from the Computer Security and Industrial Cryptography group
at KU Leuven published a paper explaining how they broke the encryption using math!
The paper is called An Efficient Key Recovery Attack on SIDH.
Microsoft also published a bounty for breaking this encryption, which could reward up to
$50,000 - meaning the researchers who found this flaw could win the money.
NIST has been working to find replacement algorithms for 5 years, and had started with
69 candidates.
Now in round four, there are 3 finalists left.
With one of the encryption techniques being broken so far into the campaign, many researchers
believe the standardization process should proceed conservatively, since it’s possible
others could be found vulnerable to flaws as well.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to my newest patrons Peter and Matt for joining the alliance on Patreon.com/threatwire.
Let’s finish out today’s episode with my last top story, about hacking the emergency
broadcast system.
The United States Emergency Alert System encode and decoder devices could be exploited to
send out fake alerts via TV and radio networks.
The EAS is used to send out alerts about weather, major threats, and AMBER alerts, along with
nationwide alerts should it be necessary, so it’s a crucial part of public safety.
As such, these alerts are often sent in multiple formats to be seen by the biggest potential
audience, be it cable and broadcast television, satellite, and radio AM and FM.
You’ve probably seen these kind of alerts if you live in places where hurricanes or
tornadoes are present, just to name a few.
The DHS issued a warning about this on August 1 after finding out about some critical security
vulnerabilities in unpatched devices.
FEMA send the advisory through the Integrated Public Alert and Warning System.
Security researcher Ken Pyle at CYBIR.com demonstrated the exploit and may present it
at DEF CON this weekend.
Pyle discovered the issue in the Monroe Electronics R189 OneNet DASDEC EAS device.
Pyle explained they can get credentials and certs, they can exploit the web server and
send fake alerts.
They could also lock out legit users and disable responses.
The lack of technical information about the flaws is intentional, as Pyle is mainly concerned
with mitigation.
Now, this vulnerability is public knowledge so FEMA is asking EAS system admins to mitigate
the issue by updating to the most recent software versions and security patches, setting up
firewall protection, and initiating monitoring and audit logs for unauthorized access.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
I’ve got a Pixel 6a review in the works!
Don't forget to like and subscribe to Hak5!
I'm Shannon Morse, I'll see you on the Internet!