Hacking air-gapped machines with SATA, GPS trackers are vulnerable to serious attacks,
and ransomware in Rust!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for July 26 2022 - this is your summary of
the threats to our security, privacy and Internet freedom.
Special announcement!!!
I will be at DEF CON the weekend of August 12 for the entire convention filming a special
episode of ThreatWire… and I’m having a meetup!
More details to come soon so keep an eye on the patreon page and my social media (I’m
@ snubs on instagram and twitter) to hear about the announcement.
Thank you for supporting my content in whichever way you do it, and thank you for letting me
take a couple of weeks off to go visit my family.
I got home yesterday, yes, my hair is naturally curly, I was on a beach for a week so I’m
not even gonna fuss with it.
Let’s get started with today’s news.
I wanted to chat about some cool new hacks this week so that’s exactly what we’re
doing.
You’re likely familiar with SATA aka Serial ATA cables which stands for Serial Advanced
Technology Attachment.
These are used as a connection for PC components and I probably have 30 of these things laying
around from past builds.
The bus interface and IDE is quite standardized and very common for adding additional data
drives or optical drives to a machine as just a couple of examples.
Well turns out you can use these to hack air gapped machines, because the cable can be
used as a wireless antenna for radio signals at 6GHz.
This new air-gap hack was discovered by our favorite air-gap researchers from the Ben
Gurion University in Israel.
They published a paper describing this data exfiltration attack which is published online
now.
The researchers called this attack SATAn, and it takes advantage of SATA cables by using
electromagnetic signals and transferring very small amounts of data from secured machines
to a receiver no more than 1 meter away.
Any more than that and the data ends up having too many errors in it.
When conducting the experiments, they found that VMs had lower signal quality, and increasing
the distance between the air gapped machine and the receiver also affects that quality.
The air gapped machine would need to be infected via a rogue insider who has access to it,
using for example, a USB drive to plant malware.
Targeted data would be prepared by modulation and encoding.
The malware can hijack software processes to reflect data with specific read and write
functions.
The data generates electromagnetic signals, and could be captured via a radio receiver,
hidden away but somewhat near the machine, which can demodulate the data, decode and
send it to the attacker.
The researchers show a demo in their paper sending the word SECRET to the receiver.
For critical environments where air gapped machines are present, the researchers recommend
preventing unauthorized access to air gapped machines, using external RF monitoring to
detect anomalies at 6GHz, and polluting that frequency with random data if something out
of the ordinary is detected.
Data pollution though could increase the wear and tear of drives since disk usage would
also increase.
Even though air-gap hacks may not necessarily be something we all worry about with our home
pcs that are constantly connected, I do find this research really interesting as it always
shows us unique ways someone could intercept data from sensitive industries.
In early July, hackers shared that they can unlock and start Hondas with flawed key fobs.
Car hacks are pretty common, and we now have a second one for July!
CISA - the US Cybersecurity and Infrastructure Agency, published an advisory last week about
GPS trackers found in many automobiles could be hacked to gain control of the system, disable
vehicle alarms, impact fuel supply with fuel cutoff commands, or allow for locational surveillance
and routes used.
The six vulnerabilities affect about 1.5 million vehicles worldwide with the MiCODUS MV720
GPS tracker installed.
The advisory was posted as an Industrial Controls Systems Advisory, and CISA says it could allow
a remote attacker to gain control in a variety of ways.
The tracking devices only cost about $20 and are used in many industries including aerospace,
energy, nuclear plants and shipping.
Vehicles affected were found in several countries including but not limited to Chile, Australia,
Mexico, Ukraine, and more, including the US.
Many industries track their vehicles, including military and law enforcement and if a malicious
actor got access to that information, it could have major national security implications.
The six vulnerabilities include a hard coded master password, a broken authentication scheme,
and a cross site scripting flaw.
Severity ranges from 6.5 up to 9.8.
One of the flaws is a preconfigured default password of 123456 - I’m serious, I can’t
make that stuff up.
CISA recommends technicians and manufacturers check the security audit report from Bitsight
for mitigations.
No fix is available, so Bitsight recommends taking actions such as just disabling the
device altogether or replacing it with a non-vulnerable product.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to my newest patrons including Kirsten, Igor, Christopher, Krsone, and Poe Foon who
joins the alliance on Patreon.com/threatwire.
Let’s finish out today’s episode with my last top story, about some new cross platform
malware, which my patrons chose as a top story in a Discord poll.
Kaspersky security researchers have discovered a new ransomware family called Luna, which
can be used to attack not only Linux, but Windows and ESXi systems as well.
Also can I pronounce ESXi as E-sexy?
Servers = technolust so I’m using that term.
Luna is advertised on dark web ransomware forums to Russian speaking actors, and the
ad states that Luna only works with Russian speaking affiliates, so Kaspersky’s team
suggest that it was made by native Russian speakers.
Luna appears as a .luna extension and encrypts files but has some limited capabilities via
a CLI.
It uses a combination of Curve 25519, alongside AES for encryption.
The ransomware is written in Rust, which is pretty platform agnostic, which means they
didn’t have to make that many changes to the source code to port it to different platforms.
That also means it’ll evade static code analysis.
Very little is known about Luna victims but Kaspersky is actively monitoring their footstep
on the dark web.
This new ransomware discovery shows that a new trend is also brewing of malicious groups
using Rust and Golang to hit several platforms with the same ransomware.
The first two to use Rust were BlackCat and Hive, but this trend might grow in popularity
as more attackers develop ransomware in this programming language.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
I’ve got a Pixel 6a review in the works right now!
Don't forget to like and subscribe to Hak5!
I'm Shannon Morse, I'll see you on the Internet!