2020 was a tough year for a lot of reasons, not least of which were breaches and hacks that visited pain on end users, customers, and the organizations that were targeted. The ransomware menace dominated headlines, with an endless stream of compromises hitting schools, governments, and private companies as criminals demanded ransoms in the millions of dollars. There was a steady stream of data breaches as well. Several mass account takeovers made appearances, too.

What follows are some of the highlights. For good measure, we’re also throwing in a couple notable hacks that, while not actively used in the wild, were impressive beyond measure or pushed the boundaries of security.

The SolarWinds hack

2020 saved the most devastating breach for last. Hackers that multiple public officials say are backed by the Russian government started by compromising the software distribution system of SolarWinds, the maker of network monitoring software that tens of thousands of organizations use. The hackers then used their position to deliver a backdoored update to about 18,000 customers. From there, the hackers had the ability to steal, destroy, or modify data on the networks of any of those customers.

It’s going to take time for investigators to assess the damage. That’s because not everyone who installed the malicious update received follow-on attacks. So far, security firm FireEye has said the hackers sought information about its government customers and also stole red-team tools used to test customers’ security defenses. US officials, meanwhile, have said that dozens of Treasury Department email accounts have also been hacked.

While the full effects of the breach won’t be known for another few months, it’s already clear the SolarWinds hack is one of the most damaging espionage hacks visited on the US in the past decade, if not of all time. It was carried out by attacking a software supply chain that’s vital to some of the biggest companies and government agencies in the world. Attackers then used that pipeline to burrow deep into the networks of the most interesting entities.

Besides the loss of so much valuable data, the SolarWinds hack is notable for the top-tier tradecraft it used. The attackers, according to Yahoo News, had control of SolarWinds update system no later than October 2019. They started pushing out malicious updates in March. The industry-wide compromise came to light not by government agencies tasked with uncovering such things, but rather because of the investigation FireEye did.

Mass compromises of Twitter, Nintendo accounts

In July, Twitter lost control of its internal systems to hackers pushing a Bitcoin scam. The breach was notable because it compromised accounts belonging to politicians, celebrities, and business executives, many with millions of followers.

While the damage was modest—about $100,000 in phony Bitcoin promotion payments and some personal data stolen from some account holders—a hack like this could have been used to do much worse things (think an announcement from government or business leaders that manipulates the stock market or stokes geopolitical tensions).

Another thing that made this breach significant was the people who perpetrated it and the tactics they used. Authorities charged a 17-year-old, a 19-year-old and a 22-year-old with using a spear phishing attack that stole an administrative password from a Twitter employee working from home during the COVID-19 pandemic.

A runner up for another hack that led to the mass compromise of accounts was the one that hit Nintendo in April.

Ransomware attacks on Dusseldorf University Hospital, Garmin, and Foxconn

These are separate breaches, but together they underscore the cost ransomware attacks are exacting, not only on the targeted organizations but the millions of people who rely on them.

During an outage that hit one of the hospitals near Dusseldorf, Germany, a patient seeking life-saving treatment was turned away and died as she tried to obtain services from a more distant facility. It’s possible or even likely that the patient would have died anyway, but the compromise nonetheless illustrates the potentially fatal role ransomware and other types of damaging hacks can have.

The Garmin attack, meanwhile, caused a four-day outage that knocked out GPS services to millions of people, some of them aircraft pilots doing flight planning and mapping.

Another ransomware attack that attracted attention was the breach of electronics giant Foxconn. Attackers demanded $34 million for the return of the data, making it the highest ransom ever sought.

Data breaches hitting Marriott and EasyJet

These were also separate hacks, but they led to compromise of personal data belonging to hundreds of millions of individuals.

For Marriott, the loss of information for 5.2 million guests was the second time in three years it had sustained a hack of that magnitude. A breach of EasyJet affected nine million passengers.

An iPhone zero-click exploit and the extraction of an Intel CPU crypto key

Not all hacks are bad. More often than not, they’re done by the good guys. And occasionally, they’re so elegant that you just have to admire them for the ingenuity that went into them.

This year’s most impressive hack came from Ian Beer, a member of Google’s Project Zero vulnerability research team. He devised an attack that, until Apple issued an update, gave him full access to every iPhone within range of his malicious Wi-Fi access point.

His attack didn’t require the iPhone user to do anything, and it was wormable, meaning exploits could spread from one nearby device to another. The exploit is one of the most impressive hacking feats in recent memory and shows the damage that can result from a single garden-variety vulnerability. Apple patched a buffer overflow flaw after Beer privately reported it.

Another top hack this year was the extraction of a secret key used to encrypt microcode on an Intel CPU—a first in the annals of security and reverse engineering.

The key makes it possible to decrypt the microcode updates Intel provides to fix security vulnerabilities and other types of bugs. Having a decrypted copy of an update may allow hackers to reverse-engineer it and learn precisely how to exploit the hole it’s patching. The key may also allow parties other than Intel—say a malicious hacker or a hobbyist—to update chips with their own microcode, although that customized version wouldn’t survive a reboot.

There’s an old saying in security circles that attacks only get better. 2020 proved the saying to be true once again, and no doubt 2021 will do the same.

https://arstechnica.com/?p=1731509

Three dozen journalists had their iPhones hacked in July and August using what at the time was an iMessage zero-day exploit that didn’t require the victims to take any action to be infected, researchers said.

The exploit and the payload it installed were developed and sold by NSO Group, according to a report published Sunday by Citizen Lab, a group at the University of Toronto that researches and exposes hacks on dissidents and journalists. NSO is a maker of offensive hacking tools that has come under fire over the past few years for selling its products to groups and governments with poor human rights records. NSO has disputed some of the conclusions in the Citizen Lab report.

The attacks infected the targets’ phones with Pegasus, an NSO-made implant for both iOS and Android that has a full range of capabilities, including recording both ambient audio and phone conversations, taking pictures, and accessing passwords and stored credentials. The hacks exploited a critical vulnerability in the iMessage app that Apple researchers weren’t aware of at the time. Apple has since fixed the bug with the rollout of iOS 14.

More successful, more covert

Over the past few years, NSO exploits have increasingly required no user interaction—such as visiting a malicious website or installing a malicious app—to work. One reason these so-called zero-click attacks are effective is that they have a much higher chance of success, since they can strike targets even when victims have considerable training in preventing such attacks.

In 2019, Facebook alleges, attackers exploited a vulnerability in the company’s WhatsApp messenger to target 1,400 iPhones and Android devices with Pegasus. Both Facebook and outside researchers said the exploit worked simply by calling a targeted device. The user need not have answered the device, and once it was infected, the attackers could clear any logs showing that a call attempt had been made.

Another key benefit of zero-click exploits is that they’re much harder for researchers to track afterward.

“The current trend towards zero-click infection vectors and more sophisticated anti-forensic capabilities is part of a broader industry-wide shift towards more sophisticated, less detectable means of surveillance,” Citizen Lab researchers Bill Marczak, John Scott-Railton, Noura Al-Jizawi, Siena Anstis, and Ron Deibert wrote. “Although this is a predictable technological evolution, it increases the technological challenges facing both network administrators and investigators.”

Elsewhere in the report, the authors wrote:

More recently, NSO Group is shifting towards zero-click exploits and network-based attacks that allow its government clients to break into phones without any interaction from the target, and without leaving any visible traces. The 2019 WhatsApp breach, where at least 1,400 phones were targeted via an exploit sent through a missed voice call, is one example of such a shift. Fortunately, in this case, WhatsApp notified targets. However, it is more challenging for researchers to track these zero-click attacks because targets may not notice anything suspicious on their phone. Even if they do observe something like “weird” call behavior, the event may be transient and not leave any traces on the device.

The shift towards zero-click attacks by an industry and customers already steeped in secrecy increases the likelihood of abuse going undetected. Nevertheless, we continue to develop new technical means to track surveillance abuses, such as new techniques of network and device analysis.

Citizen Lab said it has concluded with medium confidence that some of the attacks it uncovered were backed by the government of the United Arab Emirates and other attacks by the government of Saudi Arabia. The researchers said they suspect the 36 victims they identified—including 35 journalists, producers, anchors, and executives at Al-Jazeera and one journalist at Al Araby TV—are only a small fraction of people targeted in the campaign.

NSO responds

In a statement, an NSO spokesperson wrote:

This memo is based, once again, on speculation and lacks any evidence supporting a connection to NSO. Instead it relies on assumptions made solely to fit Citizen Lab’s agenda.

NSO provides products that enable governmental law enforcement agencies to tackle serious organized crime and counterterrorism only, and as stated in the past we do not operate them.
However, when we receive credible evidence of misuse with enough information which can enable us to assess such credibility, we take all necessary steps in accordance with our investigation procedure in order to review the allegations.

Unlike Citizen Lab, which only has ‘medium confidence’ in their own work, we KNOW our technology has saved the lives of innocent people around the world.

We question whether Citizen Lab understands that by pursuing this agenda, they are providing irresponsible corporate actors as well as terrorists, pedophiles, and drug cartel bosses with a playbook for how to avoid law enforcement.

NSO, meanwhile, will continue to work tirelessly to make the world a safer place.

As noted earlier, zero-click zero-days are difficult if not impossible to prevent even by users with extensive security training. As potent as these exploits are, their high cost and difficulty in procuring them means that they’re used against only a small population of people. That means the vast majority of mobile device users are unlikely to ever be targeted by these types of attacks.

In a statement, Apple representatives wrote, “At Apple, our teams work tirelessly to strengthen the security of our users’ data and devices. iOS 14 is a major leap forward in security and delivered new protections against these kinds of attacks. The attack described in the research was highly targeted by nation-states against specific individuals. We always urge customers to download the latest version of the software to protect themselves and their data.”

An Apple spokesman said the company has not been able to independently verify the Citizen Lab findings.

Researchers have yet to determine the precise iOS vulnerability used in these attacks, but Citizen Lab says the exploits don’t work against iOS 14, which was released in September. Anyone still using an older version should upgrade.

https://arstechnica.com/?p=1731271

Cisco has patched its Jabber conferencing and messaging application against a critical vulnerability that made it possible for attackers to execute malicious code that would spread from computer to computer with no user interaction required. Again.

The vulnerability, which was first disclosed in September, was the result of several flaws discovered by researchers at security firm Watchcom Security. First, the app failed to properly filter potentially malicious elements contained in user-sent messages. The filter was based on an incomplete blocklist that could be bypassed using a programming attribute known as onanimationstart.

Messages that contained the attribute passed directly to DOM of an embedded browser. Because the browser was based on the Chromium Embedded Framework, it would execute any scripts that made it through the filter.

With the filter bypassed, the researchers still had to find a way to break out of a security sandbox that’s designed to keep user input from reaching sensitive parts of the operating system. The researchers eventually settled on a function called CallCppFunction, which among other things Cisco Jabber uses to open files one user receives from another.

In all, Watchcom reported four vulnerabilities, all of which received patches at the same time they were disclosed in September. On Thursday, however, the Watchcom researchers said fixes for three of them were incomplete.

In a blog post, company researchers wrote:

Two of the vulnerabilities are caused by the ability to inject custom HTML tags into XMPP messages. The patch released in September only patched the specific injection points that Watchcom had identified. The underlying issue was not addressed. We were therefore able to find new injection points that could be used to exploit the vulnerabilities.

One of these injection points is the filename of a file sent through Cisco Jabber. The filename is specified by the name attribute of a file tag sent over XMPP. This attribute is displayed in the DOM when an incoming file transfer is received. The value of the attribute is not sanitized before being added to the DOM, making it possible to inject arbitrary HTML tags into the file transfer message by manipulating it.

No additional security measures had been put in place and it was therefore possible to both gain remote code execution and steal NTLM password hashes using this new injection point.

The three vulnerabilities, along with their descriptions and common vulnerability scoring system ratings are:

• CVE-2020-26085: Cisco Jabber Cross-Site Scripting leading to RCE (CVSS 9.9)
• CVE-2020-27132: Cisco Jabber Password Hash Stealing Information Disclosure (CVSS 6.5)
• CVE-2020-27127: Cisco Jabber Custom Protocol Handler Command Injection (CVSS 4.3)

The researchers recommended that the updates be installed as soon as possible. Until all employees are patched, organizations should consider disabling all external communications. The vulnerabilities affect all currently supported versions of the Cisco Jabber client (12.1 through 12.9). Cisco has details here.

https://arstechnica.com/?p=1729160

Dozens of radiology products from GE Healthcare contain a critical vulnerability that threatens the networks of hospitals and other health providers that use the devices, officials from the US government and a private security firm said on Tuesday.

The devices—used for CT scans, MRIs, X-Rays, mammograms, ultrasounds, and positron emission tomography—use a default password to receive regular maintenance. The passwords are available to anyone who knows where on the Internet to look. A lack of proper access restrictions allows the devices to connect to malicious servers rather than only those designated by GE Healthcare. Attackers can exploit these shortcomings by abusing the maintenance protocols to access the devices. From there, the attackers can execute malicious code or view or modify patient data stored on the device or the hospital or healthcare provider servers.

Aggravating matters, customers can’t fix the vulnerability themselves. Instead, they must request that the GE Healthcare support team change the credentials. Customers who don’t make such a request will continue to rely on the default password. Eventually, the device manufacturer will provide patches and additional information.

The flaw has a CVSS severity rating of 9.8 out of 10 because of the impact of the vulnerability combined with the ease of exploiting it. Security firm CyberMDX discovered the vulnerability and privately reported it to the manufacturer in May. The US Cyber Security and Infrastructure Security Agency is advising affected healthcare providers to take mitigation steps as soon as possible.

In a statement, GE Healthcare officials wrote:

We are not aware of any unauthorized access to data or incident where this potential vulnerability has been exploited in a clinical situation. We have conducted a full risk assessment and concluded that there is no patient safety concern. Maintaining the safety, quality, and security of our devices is our highest priority.

We are providing on-site assistance to ensure credentials are changed properly and confirm proper configuration of the product firewall. Additionally, we are advising the facilities where these devices are located to follow network management and security best practices.

Affected devices include:

• Advantage Workstation & Server
• Optima
• Innova
• LightSpeed Pro 16
• LightSpeed RT 16
• BrightSpeed, Discovery and Optima
• Revolution EVO
• Revolution Frontier
• Discovery IQ
• Odyssey
• Discovery
• Xeleris
• SIGNA HD/HDxT 3.0T
• Bravo 355/Optima 360
• Seno 2000D, DS, Essential
• Senographe Pristina
• Definium, Brivo, and Discovery
• Logiq
• Voluson

The devices contain an integrated computer that runs a Unix-based operating system. Proprietary software that runs on top of the OS perform various management tasks, including maintenance and updates performed by GE Healthcare over the Internet. The maintenance requires the machines to have various services turned on and Internet ports open. Services and ports include:

• FTP (port 21)—used by the modality to obtain executable files from the maintenance server
• SSH (port 22)
• Telnet (port 23)—used by the maintenance server to run shell commands on the device.
• REXEC (port 512)—used by the maintenance server to run shell commands on the device.

CyberMDX said device users should implement network policies that restrict the ports to listening mode only for device connections.

https://arstechnica.com/?p=1728265

The National Security Agency says that Russian state hackers are compromising multiple VMware systems in attacks that allow the hackers to install malware, gain unauthorized access to sensitive data, and maintain a persistent hold on widely used remote work platforms.

The in-progress attacks are exploiting a security bug that remained unpatched until last Thursday, the agency reported on Monday. CVE-2020-4006, as the flaw is tracked, is a command-injection flaw, meaning it allows attackers to execute commands of their choice on the operating system running the vulnerable software. These vulnerabilities are the result of code that fails to filter unsafe user input such as HTTP headers or cookies. VMware patched CVE-2020-4006 after being tipped off by the NSA.

A hacker’s Holy Grail

Attackers from a group sponsored by the Russian government are exploiting the vulnerability to gain initial access to vulnerable systems. They then upload a Web shell that gives a persistent interface for running server commands. Using the command interface, the hackers are eventually able to access the active directory, the part of Microsoft Windows server operating systems that hackers consider the Holy Grail because it allows them to create accounts, change passwords, and carry out other highly privileged tasks.

“The exploitation via command injection led to installation of a web shell and follow-on malicious activity where credentials in the form of SAML authentication assertions were generated and sent to Microsoft Active Directory Federation Services, which in turn granted the actors access to protected data,” NSA officials wrote in Monday’s cybersecurity advisory.

For attackers to exploit the VMware flaw, they first must gain authenticated password-based access to the management interface of the device. The interface by default runs over Internet port 8443. Passwords must be manually set upon installation of software, a requirement that suggests administrators are either choosing weak passwords or that the passwords are being compromised through other means.

“A malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account can execute commands with unrestricted privileges on the underlying operating system,” VMware said in an advisory published on Thursday. “This account is internal to the impacted products and a password is set at the time of deployment. A malicious actor must possess this password to attempt to exploit CVE-2020-4006.”

The active attacks come as large numbers of organizations have initiated work-from-home procedures in response to the COVID-19 pandemic. With many employees remotely accessing sensitive information stored on corporate and government networks, software from VMware plays a key role in safeguards designed to keep connections secure.

The command-injection flaw affects the following five VMware platforms:

• VMware Access 3 20.01 and 20.10 on Linux
• VMware vIDM 5 3.3.1, 3.3.2, and 3.3.3 on Linux
• VMware vIDM Connector 3.3.1, 3.3.2, 3.3.3, 19.03
• VMware Cloud Foundation 4.x
• VMware vRealize Suite Lifecycle Manager 7 8.x

People running one of these products should install the VMware patch as soon as possible. They should also review the password used to secure the VMware product to ensure it’s strong. Both the NSA and VMware have additional advice for securing systems at the links above.

Monday’s NSA advisory didn’t identify the hacking group behind the attacks other than to say it was composed of “Russian state-sponsored malicious cyber actors.” In October, the FBI and the Cybersecurity and Infrastructure Security Agency warned that Russian state hackers were targeting the critical Windows vulnerability dubbed Zerologon. That Russian hacking group goes under many names, including Berserk Bear, Energetic Bear, TeamSpy, Dragonfly, Havex, Crouching Yeti, and Koala.

Post updated to correct affected products.

https://arstechnica.com/?p=1728157

Android apps with hundreds of millions of downloads are vulnerable to attacks that allow malicious apps to steal contacts, login credentials, private messages, and other sensitive information. Security firm Check Point said that the Edge Browser, the XRecorder video and screen recorder, and the PowerDirector video editor are among those affected.

The vulnerability actually resides in the Google Play Core Library, which is a collection of code made by Google. The library allows apps to streamline the update process by, for instance, receiving new versions during runtime and tailoring updates to an individual app’s specific configuration or a specific phone model the app is running on.

A core vulnerability

In August, security firm Oversecured disclosed a security bug in the Google Play Core Library that allowed one installed app to execute code in the context of any other app that relied on the vulnerable library version.

The vulnerability stemmed from a directory traversal flaw that allowed untrusted sources to copy files to a folder that was supposed to be reserved only for trusted code received from Google Play. The vulnerability undermined a core protection built into the Android operating system that prevents one app from accessing data or code belonging to any other app.

Here’s an image that illustrates how an attack might work:

Google patched the library bug in April, but for vulnerable apps to be fixed, developers must first download the updated library and then incorporate it into their app code. According to research findings from Check Point, a nontrivial number of developers continued to use the vulnerable library version.

Check Point researchers Aviran Hazum and Jonathan Shimonovich wrote:

When we combine popular applications that utilize the Google Play Core library, and the Local-Code-Execution vulnerability, we can clearly see the risks. If a malicious application exploits this vulnerability, it can gain code execution inside popular applications and have the same access as the vulnerable application.

The possibilities are limited only by our creativity. Here are just a few examples:

• Inject code into banking applications to grab credentials, and at the same time have SMS permissions to steal the Two-Factor Authentication (2FA) codes.
• Inject code into Enterprise applications to gain access to corporate resources.
• Inject code into social media applications to spy on the victim, and use location access to track the device.
• Inject code into IM apps to grab all messages, and possibly send messages on the victim’s behalf.

Seeing is believing

To demonstrate an exploit, Check Point used a proof-of-concept malicious app to steal an authentication cookie from an old version of Chrome. With possession of the cookie, the attacker is then able to gain unauthorized access to a victim’s Dropbox account.

Check Point identified 14 apps with combined downloads of almost 850 million that remained vulnerable. Within a few hours of publishing a report, the security firm said that developers of some of the named apps had released updates that fixed the vulnerability.

Apps identified by Check Point included Edge, XRecorder, and the PowerDirector, which have combined installations of 160 million. Check Point provided no indication that any of these apps had been fixed. Ars asked developers of all three apps to comment on the report. This post will be updated if they respond.

https://arstechnica.com/?p=1727577

Google’s project zero says that hackers have been actively exploiting a Windows zeroday that isn’t likely to be patched until almost two weeks from now.

In keeping with long-standing policy, Google’s vulnerability research group gave Microsoft a seven-day deadline to fix the security flaw because it’s under active exploit. Normally, Project Zero discloses vulnerabilities after 90 days or when a patch becomes available, whichever comes first.

CVE-2020-117087, as the vulnerability is tracked, allows attackers to escalate system privileges. Attackers were combining an exploit for it with a separate one targeting a recently fixed flaw in Chrome. The former allowed the latter to escape a security sandbox so the latter could execute code on vulnerable machines.

CVE-2020-117087 stems from a buffer overflow in a part of Windows used for cryptographic functions. Its input/output controllers can be used to pipe data into a part of Windows that allows code execution. Friday’s post indicated the flaw is in Windows 7 and Windows 10, but made no reference to other versions.

“The Windows Kernel Cryptography Driver (cng.sys) exposes a \Device\CNG device to user-mode programs and supports a variety of IOCTLs with non-trivial input structures,” Friday’s Project Zero post said. “It constitutes a locally accessible attack surface that can be exploited for privilege escalation (such as sandbox escape).”

The technical write up included a proof-of-concept code people can use to crash Windows 10 machines.

The Chrome flaw that was combined with CVE-2020-117087 resided in the FreeType font rendering library that’s included in Chrome and in applications from other developers. The FreeType flaw was fixed 11 days ago. It’s not clear if all programs that use FreeType have been updated to incorporate the patch.

Project Zero said it expects Microsoft to patch the vulnerability on November 10, which coincides with that month’s Update Tuesday. In a statement, Microsoft officials wrote:

Microsoft has a customer commitment to investigate reported security issues and update impacted devices to protect customers. While we work to meet all researchers’ deadlines for disclosures, including short-term deadlines like in this scenario, developing a security update is a balance between timeliness and quality, and our ultimate goal is to help ensure maximum customer protection with minimal customer disruption.

A representative said that Microsoft has no evidence the vulnerability is being widely exploited and that the flaw can’t be exploited to affect cryptographic functionality. Microsoft didn’t provide any information on steps Windows users can take until a fix becomes available.

Project Zero technical lead Ben Hawkes defended the practice of disclosing zerodays within a week of them being actively exploited.

The quick take: we think there’s defensive utility to sharing these details, and that opportunistic attacks using these details between now and the patch being released is reasonable unlikely (so far it’s been used as part of an exploit chain, and the entry-point attack is fixed)

The short deadline for in-the-wild exploit also tries to incentivize out-of-band patches or other mitigations being developed/shared with urgency. Those improvements you might expect to see over a longer term period.

There are no details about the active exploits other than it’s “not related to any US election related targeting.”

https://arstechnica.com/?p=1718587

One of the most critical Windows vulnerabilities disclosed this year is under active attack by hackers who are trying to backdoor servers that store credentials for every user and administrative account on a network, a researcher said on Friday.

Zerologon, as the vulnerability has been dubbed, gained widespread attention last month when the firm that discovered it said it could give attackers instant access to active directories, which admins use to create, delete, and manage network accounts. Active directories and the domain controllers they run on are among the most coveted prizes in hacking because once hijacked, they allow attackers to execute code in unison on all connected machines. Microsoft patched CVE-2020-1472, as the security flaw is indexed, in August.

On Friday, Kevin Beaumont, working in his capacity as an independent researcher, said in a blog post that he had detected attacks on the honeypot he uses to keep abreast of attacks hackers are using in the wild. When his lure server was unpatched, the attackers were able to use a powershell script to successfully change an admin password and backdoor the server.

Something more problematic than sophisticated

In an interview, Beaumont said that the attack appeared to be entirely scripted, with all commands being completed within seconds. With that, the attackers installed a backdoor allowing remote administrative access to devices inside his mock network. The attackers—who set up an account with the username sdb and the password jinglebell110@—also enabled Remote Desktop. As a result, the attackers would continue to have remote access if CVE-2020-1472 is later patched.

https://arstechnica.com/?p=1715441

Google and Intel are warning of a high-severity Bluetooth flaw in all but the most recent version of the Linux Kernel. While a Google researcher said the bug allows seamless code execution by attackers within Bluetooth range, Intel is characterizing the flaw as providing an escalation of privileges or the disclosure of information.

The flaw resides in BlueZ, the software stack that by default implements all Bluetooth core protocols and layers for Linux. Besides Linux laptops, it’s used in many consumer or industrial Internet-of-things devices. It works with Linux versions 2.4.6 and later.

In search of details

So far, little is known about BleedingTooth, the name given by Google engineer Andy Nguyen, who said that a blog post will be published “soon.” A Twitter thread and a YouTube video provide the most detail and give the impression that the bug provides a reliable way for nearby attackers to execute malicious code of their choice on vulnerable Linux devices that use BlueZ for Bluetooth.

“BleedingTooth is a set of zero-click vulnerabilities in the Linux Bluetooth subsystem that can allow an unauthenticated remote attacker in short distance to execute arbitrary code with kernel privileges on vulnerable devices,” the researcher wrote. He said his discovery was inspired by research that led to BlueBorne, another proof-of-concept exploit that allowed attackers to send commands of their choice without requiring device users click any links, connect to a rogue Bluetooth device, or take any other action short of having Bluetooth turned on.

BleedingTooth is a set of zero-click vulnerabilities in the Linux Bluetooth subsystem that can allow an unauthenticated remote attacker in short distance to execute arbitrary code with kernel privileges on vulnerable devices.

— Andy Nguyen (@theflow0) October 13, 2020

Below is the YouTube video demonstrating how the exploit works.

[embedded content]

Intel, meanwhile, has issued this bare-bones advisory that categorizes the flaw as privilege-escalation or information-disclosure vulnerability. The advisory assigned a severity score of 8.3 out of a possible 10 to CVE-2020-12351, one of three distinct bugs that comprise BleedingTooth.

“Potential security vulnerabilities in BlueZ may allow escalation of privilege or information disclosure,” the advisory states. “BlueZ is releasing Linux kernel fixes to address these potential vulnerabilities.”

Intel, which is a primary contributor to the BlueZ open source project, said that the most effective way to patch the vulnerabilities is to update to Linux kernel version 5.9, which was published on Sunday. Those who can’t upgrade to version 5.9 can install a series of kernel patches the advisory links to. Maintainers of BlueZ didn’t immediately respond to emails asking for additional details about this vulnerability.

https://arstechnica.com/?p=1714918

With the name Smarter, you might expect a network-connected kitchen appliance maker to be, well, smarter than companies selling conventional appliances. But in the case of the Smarter’s Internet-of-things coffee maker, you’d be wrong.

As a thought experiment, Martin Hron, a researcher at security company Avast, reverse engineered one of the $250 devices to see what kinds of hacks he could do. After just a week of effort, the unqualified answer was: quite a lot. Specifically, he could trigger the coffee maker to turn on the burner, dispense water, spin the bean grinder, and display a ransom message, all while beeping repeatedly. Oh, and by the way, the only way to stop the chaos was to unplug the power cord. Like this:

“It’s possible,” Hron said in an interview. “It was done to point out that this did happen and could happen to other IoT devices. This is a good example of an out-of-the-box problem. You don’t have to configure anything. Usually, the vendors don’t think about this.”

What do you mean “out-of-the-box”?

When Hron first plugged in his Smarter coffee maker, he discovered that it immediately acted as a Wi-Fi access point that used an unsecured connection to communicate with a smartphone app. The app, in turn, is used to configure the device and, should the user choose, connect it to a home Wi-Fi network. With no encryption, the researcher had no problem learning how the phone controlled the coffee maker and, since there was no authentication either, how a rogue phone app might do the same thing.

That capability still left Hron with only a small menu of commands, none of them especially harmful. So he then examined the mechanism the coffee maker used to receive firmware updates. It turned out they were received from the phone with—you guessed it—no encryption, no authentication, and no code signing.

These glaring omissions created just the opportunity Hron needed. Since the latest firmware version was stored inside the Android app, he could pull it onto a computer and reverse engineer it using IDA, a software analyzer, debugger, and disassembler that’s one of a reverse engineer’s best friends. Almost immediately, he found human-readable strings.

“From this, we could deduce there is no encryption, and the firmware is probably a ‘plaintext’ image that is uploaded directly into the FLASH memory of the coffee maker,” he wrote in this detailed blog outlining the hack.

Taking the insides out

To actually disassemble the firmware—that is, to transform the binary code into the underlying assembly language that communicates with the hardware, Hron had to know what CPU the coffee maker used. That required him to take apart the device internals, find the circuit board, and identify the chips. The two images below show what he found:

With the ability to disassemble the firmware, the pieces started to come together. Hron was able to reverse the most important functions, including the ones that check if a carafe is on the burner, cause the device to beep, and—most importantly—install an update. Below is a block diagram of the coffee maker’s main components:

Hron eventually acquired enough information to write a python script that mimicked the update process. Using a slightly modified version of the firmware, he discovered it worked. This was his “hello world” of sorts:

Freak out any user

The next step was to create modified firmware that did something less innocuous.

“Originally, we wanted to prove the fact that this device could mine cryptocurrency,” Hron wrote. “Considering the CPU and architecture, it is certainly doable, but at a speed of 8MHz, it doesn’t make any sense as the produced value of such a miner would be negligible.”

So the researcher settled on something else—a machine that would exact a ransom if the owner wanted it to stop spectacularly malfunctioning the way shown in the video. With the benefit of some unused memory space in the silicon, Hron added lines of code that caused all the commotion.

“We thought this would be enough to freak any user out and make it a very stressful experience. The only thing the user can do at that point is unplug the coffee maker from the power socket.”

Once the working update script and modified firmware is written and loaded onto an Android phone (iOS would be much harder, if not prohibitively so because of its closed nature), there are several ways to carry out the attack. The easiest is to find a vulnerable coffee maker within Wi-Fi range. In the event the device hasn’t been configured to connect to a Wi-Fi network, this is as simple as looking for the SSID that’s broadcast by the coffee maker.

Beachhead

Once the device connects to a home network, this ad hoc SSID required to configure the coffee maker and initiate any updates is no longer available. The most straightforward way to work around this limitation would be if the attacker knew a coffee maker was in use on a given network. The attacker would then send the network a deauthorization packet that would cause the coffee maker to disconnect. As soon as that happens, the device will begin broadcasting the ad hoc SSID again, leaving the attacker free to update the device with malicious firmware.

A more opportunistic variation of this vector would be to send deauthorization packet to every SSID within Wi-Fi range and wait to see if any ad hoc broadcasts appear (SSIDs are always “Smarter Coffee:xx,” where xx is the same as the lowest byte of the device’s MAC address).

The limitation of this attack, it will be obvious to many, is that it works only when the attacker can locate a vulnerable coffee maker and is within Wi-Fi range of it. Hron said a way around this is to hack a Wi-Fi router and use that as a beachhead to attack the coffee maker. This attack can be done remotely, but if an attacker has already compromised the router, the network owner has worse things to worry about than a malfunctioning coffee maker.

In any event, Hron said the ransom attack is just the beginning of what an attacker could do. With more work, he believes, an attacker could program a coffee maker—and possibly other appliances made by Smarter—to attack the router, computers, or other devices connected to the same network. And the attacker could probably do it with no overt sign anything was amiss.

Putting it in perspective

Because of the limitations, this hack isn’t something that represents a real or immediate threat, although for some people (myself included), it’s enough to steer me away from Smarter products, at least as long as current models (the one Hron used is older) don’t use encryption, authentication, or code signing. Company representatives didn’t immediately respond to messages asking.

Rather, as noted at the top of this post, the hack is a thought experiment designed to explore what’s possible in a world where coffee machines, refrigerators, and all other manner of home devices all connect to the Internet. One of the interesting things about the coffee machine hacked here is that it’s no longer eligible to receive firmware updates, so there’s nothing owners can do to fix the weaknesses Hron found.

Hron also raises this important point:

Additionally, this case also demonstrates one of the most concerning issues with modern IoT devices: “The lifespan of a typical fridge is 17 years, how long do you think vendors will support software for its smart functionality?” Sure, you can still use it even if it’s not getting updates anymore, but with the pace of IoT explosion and bad attitude to support, we are creating an army of abandoned vulnerable devices that can be misused for nefarious purposes such as network breaches, data leaks, ransomware attack and DDoS.

There’s also the problem of knowing what to do about the IoT explosion. Assuming you get an IoT gadget at all, it’s tempting to think that the, uh, smarter move is to simply not connect the device to the Internet at all and allow it to operate as a normal, non-networked appliance.

But in the case of the coffee maker here, that would actually make you more vulnerable, since it would just broadcast the ad hoc SSID and, in so doing, save a hacker a few steps. Short of using an old-fashioned coffee maker, the better path would be to connect the device to a virtual LAN, meaning a separate SSID that’s partitioned from the one used normally.

Hron’s write-up linked above provides more than 4,000 words of rich details, many of which are too technical to be captured here. It should be required reading for anyone building IoT devices.

Listing image by Avast

https://arstechnica.com/?p=1709889