This new attack bypasses wifi encryption, the popular app 3CX is backdoored, and AI’s
risks and rewards!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for April 4, 2023 - this is your summary of
the threats to our security, privacy and Internet freedom!
Let’s jump right into the news this week.
Cybersecurity researchers have discovered a new vulnerability in the Wi-Fi iEEE 802.11
protocol that abuses a functionality called sleep mode.
This can break the wi-fi encryption and disrupt connections on WPA 2 and 3 networks.
The full technical details will be presented at BlackHat Asia next month, but here is a
summary of their findings.
This Wi-Fi standard has a power-saving function that queues or buffers wifi frames whenever
a device goes into sleep mode.
Network frames are bits of code that include a header, a data payload, and an ending with
data such as a client's MAC address, and the receiving device's MAC address.
If a client device goes into sleep mode, it will send one of these frames over to the
access point, telling it that the client is sleeping, and that it should queue up the
remaining frames til the client wakes up, at which time the buffered frames are encrypted
and transmitted like normal.
But while they’re in that sleep state, an attacker could potentially spoof a legit MAC
address, send that command to queue data frames, then force them to wake up and retrieve the
entire stack of frames.
An attacker could also send authentication frames to the access point that are usually
used to encrypt frames between devices on the same network - thus also allowing them
to retrieve frames in plaintext.
The protocol doesn’t require queued frame stacks to get purged or removed after any
set amount of time or after something changes in terms of security, so the frames can be
leaked.
This does require a specialized tool the researchers created and dubbed MacStealer, of which the
code has been shared on Github by the creators.
Products by Asus, Cisco, D-Link, HostAPD, Aruba, and Lancom are affected.
[[screenshot 6]] Cisco responded saying the attack is “opportunistic, and information
gained would be of minimal value in a securely configured network.”
While no real world attacks have used this vulnerability, Cisco recommends using TLS
to encrypt data, and use an enforcement policy along with restricting network access.
The video and voice calling desktop client 3CX is the target of a massive supply chain
attack brought on by attackers purportedly working for the North Korean government.
3CX is used by major companies and organizations, counting over 600k customers like AmEx, Mercedes
Benz and more.
The attackers distributed a trojanized version of the app, which was digitally signed by
3CX as well as OS manufacturers like Apple.
The attack is believed to stem from North Korea because an encryption key and the infrastructure
used in this attack match a campaign that happened on March 7 by a group called Labyrinth
Chollima, who happens to be a state sponsored threat actor group.
According to reports, the attackers planned and set up domains way back in February of
2022.
Oddities were reported by Sentinel One in March, and 3CX users posted about strange
“false-positives” detected in their apps by endpoint security software like SentinelOne.
Even though users were reporting these detections for a good week, 3CX did not take any immediate
actions to determine why their app was getting flagged by security software.
3CX discovered the issue in several versions of their Electron Windows and Mac Apps, in
which malicious payloads were bundled in the Git libraries they used.
The payloads were added via DLL Sideloading, encrypted, and hidden inside legitimate application
downloads.
In some cases, a second stage payload called Gopuram malware is administered if the victim
is a cryptocurrency company.
3CX recommends users check their networks for compromise, and security firm CrowdStrike
recommends users stop using 3CX for the time being.
Indicators of Compromised have been posted by Sophos.
Biggest of shoutouts to my Patreon supporters, especially my Golden Smores and their fur
babies, for making this show possible since we don’t have ads on this show at all!
THANK YOU to Martin, Steven, Ashley, Ben, Nick, Franklin and Jennifer!
for being a part of the Smores at Patreon.com/shannonmorse.
That’s my new Patreon page for the show, where I’ll be posting all the perks for
patrons, including early access to this video.
If you’re currently a patron on the ThreatWire page, switch over to the new page so you don’t
lose access to your perks.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials.
I’m about to hit 100k subscribers, so if you want to see more of my security content,
please do check out my channel.
Don't forget to like and subscribe to Hak5 as well!
Let’s finish out today’s episode with my last top story, about AI!
AI systems with human-competitive intelligence can pose profound risks to society and humanity,
as shown by extensive research and acknowledged by top AI labs.
That’s the opening statement in an open letter signed by over a thousand AI developers,
professors, and tech figures and founders.
The letter calls for a 6 month pause on AI development and training for anything more
powerful than GPT-4.
The reason for this call comes from the Future of Life organization, which believes risks
that reside in AI have not been carefully considered, such as job automation, systems
that outsmart humans, make humans obsolete, or could control civilization.
Much of this is due to AI uses we’re already seeing, raising ethical questions.
The open letter states that training on advanced AI should include strict oversight and management,
pauses should be verifiable and if AI training can’t be paused, governments should step
in.
The letter continues by targeting policy makers, asking them to create regulations around watermarking
to differentiate between fake and authentic material, assigning liability, and creating
audits by independent experts.
Future of Life optimistically adds that humanity can flourish with AI and we can reap the rewards
of AI, but society should be given a chance to adapt.
Society is currently experiencing a race to the top, so to speak, with many AI creators
competing for the number 1 spot.
The open letter brings up some reasoned concerns.
As a content creator myself, the need to adapt and use AI to further my career is definitely
at the forefront of my mind this year, and I also see the potential to use some of these
tools to prevent burnout or overwork.
But at what point does that convenience create obsolescence?
It’s a very heated subject, so if you comment on it, please do so respectfully.
I'm Shannon Morse, I'll see you on the Internet!