Apple Sues NSO Group, GoDaddy Discloses Another Hack, and Attackers Could Eavesdrop on Your
Phone Using a MediaTek Vulnerability!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for November 30, 2021!
This is your weekly summary of the threats to our security, privacy and Internet freedom.
THANK YOU to Brian for joining this week on Patreon.
Patreon.com/ThreatWire as always to keep this show ad free.
And if you want to support the show but don’t wanna join on Patreon, you can grab your own
ThreatWire merch for the holidays at the link below.
With that, onto the news!!
We learned in 2018 that NSO Group’s Pegasus spyware was being used for surveillance between
countries that have histories of violating human rights with spyware.
Back in August we learned from research firm Citizen Lab that the NSO Group’s exploit
called ForcedEntry was being used to install Pegasus spyware on targeted Apple devices.
These exploits and the Pegasus spyware are often used by state sponsored attackers to
target journalists, government officials, diplomats, activists and other high profile
targets that could potentially have access to proprietary information - data that if
stolen could lead to dangerous situations.
The exploits are zero-click, meaning the device owner wouldn’t need to do anything in order
for their device to get pwned.
Pegasus spyware is marketed as this tool that can be used to monitor criminals and terrorists,
but it’s allegedly used to violate privacy.
Now Apple is suing NSO Group for targeting and spying on Apple users, even though chances
are slim that your average consumer would be in this target group.
Their reasoning is because quote “For their own commercial gain, they enable their customers
to abuse those products and services to target individuals including government officials,
journalists, businesspeople, activists, academics, and even U.S. citizens.”
Apple’s official complaint was made in the northern district of California against NSO
Group Technologies Limited and parent company Q Cyber Technologies Limited.
Apple is seeking a jury trial and a permanent injunction to ban NSO Group from using any
Apple software, services or devices.
Apple has plans in motion to mitigate the practice of spying on their devices.
The company is also planning to start notifying individuals if they find they’ve been targeted
by the ForcedEntry exploit along with any users who are targeted by “state sponsored
spyware attacks in the future” and they are going to contribute $10 million to orgs
that do cyber surveillance research or advocacy.
If you’re worried you’ve been targeted with Pegasus Spyware, you can update your
iOS version to 14.8 or later, and download the iMazing app for mac or PC, which includes
a Mobile Verification Toolkit from Amnesty International.
This app detects any signs of Pegasus on a device and is completely free to use, you
don’t have to buy iMazing in order to use the test feature.
You connect your Apple device to the computer, click Detect Spyware, and follow the on screen
instructions.
Again, chances are low that you’d be targeted, so you’d likely just need to update to keep
your phone safe.
Props to Dan on my Patreon for sharing this story.
Last week GoDaddy announced via a publicized notification that data for 1.2 million customers
was exposed in a data breach.
This happened via GoDaddy’s Managed Wordpress hosting environment and was discovered on
November 17 but according to the report, attackers had access since September 6 at least.
The attacker gained access by using a compromised password for their provisioning system in
their “legacy code base for Managed Wordpress”.
GoDaddy identified the breach and blocked the unauthorized third party from accessing
their systems.
Impacted customers are being notified and GoDaddy hired an IT forensics firm to investigate
and they contacted law enforcement to report the breach.
So what did attackers gain access to?
This breach exposed 1.2 million customer email addresses and customer number, which could
potentially lead to phishing attacks.
It also exposed the OG WordPress Admin password set at time of provisioning, and if those
passwords were still in use, they were reset by GoDaddy.
For active customers, sFTP and database usernames and passwords were exposed, and the SSL private
keys for a subset of those customers were also exposed.
Passwords were reset by the company and new private key certificates are being issued
for those affected.
Two days later, GoDaddy updated their news to add that six different Managed Wordpress
service resellers were also affected by this attack, including TsoHost, Media Temple, 123Reg,
Domain Factory, Heart Internet, and Host Europe.
Each of these brands were also in the process of contacting affected customers.
I love it when y’all send me these adorable pictures of your pets so these are a few from
my hush puppy Patreon Alliance members.
You can always support this content and keep it ad free for as little as $2 / month, and
get a slew of perks at the same time!
Each alliance member gets over 10 perks as soon as you sign up at patreon.com/threatwire.
With that, now onto the third story.
MediaTek makes chips that go in well over 30% of all smartphones in the world, and four
vulnerabilities were recently found by Check Point that could’ve allowed an attacker
to eavesdrop on any Android phones that include these chipsets, including listening in on
calls, executing commands, or do a privilege escalation attack.
Some older devices will probably never get security updates as they’re no longer supported,
but devices that are still under their support cycle are receiving patches.
These vulnerabilities require no interaction from the user, so it’s important to update
as soon as you can.
Each of the flaws are being tracked - CVE-2021-0661, 0662, and 0663 were patched in the October
2021 MediaTek Security Bulletin.
CVE-2021-0673 will be patched next month.
Check Point reverse engineered the Android API used for audio comms, and found MediaTek
chips use a Digital Signal Processor for playback quality and performance.
Check Point found that an attacker could exploit flaws in how requests are made and potentially
run code on the DSP chip.
After CheckPoint disclosed the flaws, MediaTek mitigated the issues and sent out notices
to manufacturers.
They don’t believe these issues are being actively exploited but you should still updated
when possible since this news has now been publicly shared.
Want more hacker content?
Subscribe at youtube.com/ShannonMorse for some holiday videos coming up soon including
my annual hacker gift guide out this week.
Don't forget to like and subscribe to this channel as well!
Especially because at the end of the year I’ll be cancelling the video RSS feed for
ThreatWire due to costs to manage a video RSS and the low download numbers.
Podcast apps are moving towards audio and video file formats are not consistently working
in all of those apps anymore.
If you’re one of the few folks who downloaded the show via your own podcast app, you can
still watch it via Youtube every week and if you have youtube premium, you can download
it right here via our channel.
You can also use third party scripts to download youtube videos.
Also note that if you’re a patreon supporter, you have access to an audio RSS feed.
Thank you so much for the support.
I'm Shannon Morse, I'll see you on the Internet!