A Peloton Flaw is Disclosed, Carnival Corp got Hacked AGAIN, and a South Korean Nuclear
Research Institute is also Hacked!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for June 22, 2021!
This is your weekly summary of the threats to our security, privacy and Internet freedom.
We have a bunch of security breaches and hacks to get into, so..
Onto the news!!
Peloton’s Bike+ and Tread line of products had a vulnerability that could give an attacker
full access to the device, it’s camera, and it’s microphone, if said attacker had
physical access.
McAfee’s Advanced Threat Research team discovered this flaw and Peloton released an update to
fix it after being notified by McAfee in March.
McAfee published an article about the vulnerability on June 15.
According to their post, the problem resided in the Android Verified Boot Process.
Researchers were able to bypass that boot process with a malicious boot image on a thumbdrive
and potentially compromise the Android OS that the bikes run off of.
Given that this requires physical access, chances are home users won’t be extremely
vulnerable.
But Peloton equipment is also found in hotels, spas, gyms, apartment complexes, and cruise
ships.
Home users should still update, though, because this could also affect equipment through the
supply chain - for example, if a bike was tampered with before delivery.
For public ones, an attacker could simply walk up to the machine in a gym and gain root
access.
Workouts could be recorded via the mic and camera, and credential harvesting could happen
using fake apps.
The flaw could allow an attacker to have unfettered access to the equipment.
They could establish a remote shell, giving themselves access long after they’ve physically
left the vicinity.
They don’t even need to unlock the device to boot a modified image, according to McAfee,
so there wouldn’t be a trace of any unauthorized access.
They could modify the OS, perform Man in the middle attacks, and sniff network traffic,
including SSL unpinning, allowing for capturing of SSL encrypted traffic.
A video demo shows the hack being performed to give the researchers remote access.
This serious issue was remedied by Peloton by nixing that boot command in the final user
build.
Users and businesses should check via the tablet installed on their bike to see if an
update is available.
According to a data breach notification letter, Carnival Corp, the worlds largest cruise ship
operator, was hit by a breach to a number of email accounts and portions of it’s IT
systems.
This breach appears to have occurred in Mid-March when an unauthorized third party gained access
to data.
Personal information for some guests, employees, and crew were affected - that includes names,
addresses, phone numbers, passport numbers, date of birth, health info, and few some folks
affected, social security numbers or national IDs.
It also included COVID testing data.
Carnival states evidence that shows a low likelihood of the data being misused.
Carnival Corps operates cruise lines including Carnival, Princess, Holland America, Seabourn,
and more.
Given how huge this business is and the large amount of data they collect on guests, it
comes as no surprise that they’re continually targeted.
Yes, this is not the first time.
The company has been in the news many times over the past year due to being a target in
cyberattacks - with two of those being ransomware related, four events total.
The timing of this attack is unsurprising as well, given people are now booking trips
now that cruise liners and airports are allowing more travel.
We do have questions about this attack though.
Carnival brands have 150,000 employees in 150 countries, and have 13 million guests
each year.
How many of those were affected?
While their letter says they detected this breach on March 19, it doesn’t disclose
how long the criminal had access during this Mid-March timeframe?
How is Carnival amping up their cybersecurity, given this is yet another time in the past
15 months they’ve been targeted?
That’s concerning.
Carnival Corp has stated they are “continuing to review security and privacy policies and
procedures and has been implementing changes as needed to enhance our information security
and privacy program and controls.”
Are they working with a third party cybersecurity org or investigating these breaches?
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos and for
the support.
And a quick shoutout to MrTidy and Jessica for joining the ThreatWire alliance and as
always, for supporting the show!!
- Patreon exclusive merch was unlocked last month as a new perk for the ThreatWire alliance,
so now’s a great time to join the team as you’ll get the first round of art designs
for this year.
Check the Patreon page for more details and don’t forget - Patrons get exclusive access
to an audio only podcast version of this show.
Onto the third news story.
A Nuclear Research Institute in South Korea was hacked by North Korean threat actors last
month using nothing more than a VPN vulnerability, and the institute in question originally denied
this attack happened when questioned by the media.
The South Korean media outlet Sisa Journal first reported on the attack, at which time
The Korea Atomic Energy Research Institute denied the claims.
It wasn’t until June 18th, when KAERI held a press conference and published a statement
that they actually confirmed there was an attack and they apologized for denying it.
KAERI found the attack happened on May 14 because of a VPN vulnerability which remains
undisclosed.
They fixed the problem by updating the VPN device, but the flaw still allowed 13 IP addresses
unauthorized access, including one that is tied to a hacking group out of North Korea
called Kimsuky (also known as Thallium, Black Banshee, and Velvet Collima).
That IP address was 27.102.114.89 and this group is rumored to be a part of the North
Korean Reconnaissance General Bureau intelligence agency.
KAERI is still investigating this attack.
This week on Morse Code I shared a look at my new studios electrical and wiring!
Subscribe to my channel - youtube.com/shannonmorse - for more of that kind of content.
And with that, don't forget to like and subscribe to this channel as well!
I'm Shannon Morse, I'll see you on the Internet!