Amazon Sidewalk is LIVE - Opt Out NOW, The CFAA gets some clarification thanks to the
Supreme Court, REvil Beefs Up Attacks on Supply Chains! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for June 8,
2021! This is your weekly summary of the threats to our security, privacy and Internet freedom.
We have a bunch of security updates and legislation to get into, so.. Onto the news!!
Happy Amazon Tuesday! Starting today, Amazon is introducing their new Amazon Sidewalk service.
It allows for your Echo or Ring devices to be used to share internet
with your neighbors. Since that means that your bandwidth as well as your home
internet connection will also be shared with neighbors, this raises a whole slew of concerns.
Amazon announced this a while back but Amazon Sidewalk basically treats Echo or Ring devices
as bridges which are used to create a network of low bandwidth wireless devices. Your Echo
or Ring would allow for a small portion of your network bandwidth to be shared with a pool of
other devices - and that internet connection is only accessible by other compatible Amazon
Sidewalk devices. Currently, it’s compatible on a long list of Echo and Ring devices
including the Spotlight Cam Wired, Echo Dots and Echos, Echo Shows and more.
So if your internet goes down, the theory is your Ring or Echo devices will remain
up with this Sidewalk network and it’ll also help with finding things like Tile trackers,
like if you put one on your pet and your pet gets out. In this case your neighbors
could choose to turn on a feature called “community finding” which will share the
approximate location of their device, not just the bandwidth. It’s totally free of charge as well.
The max bandwidth shared is 500MB per month, and 80Kbps at a time, so it’s definitely minimal.
But even when it’s just a small amount of data, it’s still an area of concern for folks who have
data caps and for privacy. Amazon states that the data shared across Sidewalk is encrypted
and Amazon doesn’t have the ability to decrypt this information, and they also state the data is
anonymized. But this brings up countless questions about the encryption itself, how it’s transmitted,
data at rest and storage security, how the data is sanitized and anonymized, etc.
Amazon released a white paper about Sidewalk, and it does state that endpoint users won’t
have access to gateway info, and the network server “rolls” or changes transmission IDs
and sidewalk gateway IDs every 15 minutes to prevent tracking or association of devices
to users. They also make mention to the use of Ephemeral Elliptic Curve Diffie Hellman
key agreement handshakes. The white paper does include a lot of positives in terms of security.
BUT under their Q&A section, they also point out that just like with any other WiFi devices,
you can look at signal strength to triangulate the location of a device on the Sidewalk
network. At launch, there won’t be any third party apps running on Sidewalk but Amazon is
open to the idea and intends to release terms of service for third party devs.
Amazon will be running Sidewalk on their own new Wifi protocol using the 900MHz spectrum,
supposedly this will increase the wifi signal range,
but any new protocols could also come with new vulnerabilities, especially wireless ones.
But a big red flag with Amazon Sidewalk…? It’s Opt-Out. All users with compatible devices will be
opted in already. You have to go into the Amazon ALEXA
or Ring apps to opt out. To do so, open the ALEXA app,
click more at the bottom right hand side, click Settings, Account Settings, Amazon Sidewalk,
and switch the toggle to Disabled then close. In the Ring app, tap the sandwich 3-line menu button,
click Control Center, then Amazon Sidewalk and switch the toggle to Disabled then close.
Do the benefits outweigh the cons? Even though I don’t have Amazon devices,
it’s something I’ll tell my family to opt out of. I’d rather they be late adopters to this tech so
infosec professionals have time to do some warwalking and find out more about the network.
Ethical hacking just got a win after being very concerned about the outcome of an important case
for a long time now. A former Georgia police sergeant named Nathan Van Buren
accessed a police database to get information on a license plate. In exchange for this information,
he was paid $6000 in cash. Van Buren used the computer in his police vehicle to access
Georgia’s Crime Information Center. Van Buren was a cop, so he used his own creds to access
this information but it had nothing to do with any ongoing investigations or duties
that he had to perform as a cop, so he was using his power for personal gain. The person
who wanted the information from him had previous ties to criminal activity and paid him the cash.
So the US District Court for the Northern District of Georgia
convicted him for violating policy by obtaining info for personal use, and violating CFAA by using
a PC on that network for something other than his duties as a police officer. He got 18 months.
This was appealed and eventually made it to the Supreme Court. The Supreme Court ruled
that his actions did NOT violate CFAA, which is the Computer Fraud and Abuse Act of 1986,
in a 6-3 decision. The Supreme Court decided that because he used his own credentials,
that wouldn’t be within the scope of violating CFAA.
The dissenters were Chief Justice Clarence Thomas, Justice Samuel Alito and Justice John Roberts.
The reason why this was lauded as a win by the EFF
and ethical hackers is because the CFAA is incredibly broad and could be misinterpreted.
This ruling affirms that services can’t invoke it because you use their service to
collect evidence on security vulnerabilities, for example. So this ruling could be used for future
cases as precedent when security researchers are taken to court over ethical hacking.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos and for the
support. And a quick shoutout to Harley for joining the ThreatWire alliance and as always,
for supporting the show!! - Patreon exclusive merch was unlocked last month as a new perk for
the ThreatWire alliance, so now’s a great time to join the team as you’ll get the first round
of art designs for this year. Check the Patreon page for more details and don’t forget - Patrons
get exclusive access to an audio only podcast version of this show. Onto the third news story.
Another week another ransomware attack against a supply chain. The world’s largest meat producer,
JBS, had to halt operations in some locations in the US, Canada, and Australia due to being
targeted in a cyberattack, affecting servers at their North American and Australian IT operations.
All five of JBS’s biggest plants in the US had to stop processing, along with plants
in Brooks, Alberta. Their Canadian plant processes about a third of Canada’s beef,
while the US plants process about a fourth of the American supply of beef.
JBS stated they do have backup servers and those aren’t affected, so it should get back
to production as soon as possible. They also mentioned that no customer or employee data was
compromised and an investigation is ongoing. As of June 4, JBS is fully operational again,
sooner than expected due to the fact their backup servers weren’t compromised.
They prioritized production critical systems in order to not affect the food supply chain.
Deputy Press Secretary Karine Jean Pierre stated this was a ransomware attack and they did receive
a ransom demand though we don’t know the total, and the attack likely stemmed from
a group in Russia. The FBI later announced that REvil was the group behind this attack.
REvil, AKA Sodinokibi (guys can we please stick to one name for these groups?)
started up in April of 2019 and were likely also behind the ransomware attack on Fujifilm which
also happened recently. We do not currently know -how- REvil was able to plant ransomware
nor how much they asked for. We also don’t know if JBS paid the ransom,
though not likely given they were able to get back up and running with their backups.
Given the swift action taken by JBS though, your summer BBQs are likely to not be affected.
This week on Morse Code I’m starting my series all about finishing an
unfinished basement and turning it into a youtube studio! I’ll be running 10 gig ethernet and
building my very first networking rack! Subscribe to my channel - youtube.com/shannonmorse - for
more of that kind of content. And with that, don't forget to like and subscribe to this
channel as well - we just hit 700,000 subscribers and I’m just overwhelmed with all the kind words
y’all have been sending to the team! I'm Shannon Morse, I'll see you on the Internet!