Picture it: you’re on the treadmill, running through a forest, sweating like a pig, and the doorbell rings because a package is being delivered. Would you even hear it? Chances are, if you’re rocking out to music on headphones and your treadmill is as noisy as [Antonio]’s, you wouldn’t, and you’d once again face the dreaded ‘we’ll try later’ slip.

What you need is something that thing listens for the doorbell and flashes a giant 20 mm red LED to alert you. Could this be done with a 555? Yes, in fact, [Antonio] used a pair of them in the form of the 556 on the alert side.

The first 555 is wired up in astable mode to control the tempo of the flashing light, and the second timer is in monostable mode to control the length of time the light flashes. Power comes from the doorbell’s 9V, which is wired up through an existing Ethernet jack.

Now whenever the doorbell rings, [Antonio] has 60 seconds of flashing light in order to react, stop the treadmill, and jump off to answer the door. To conserve power when [Antonio] is relaxing, there’s an on/off switch.

I ricercatori di sicurezza informatica hanno scoperto un nuovo downloader dannoso, SquidLoader, che si diffonde attraverso campagne di phishing rivolte alle organizzazioni cinesi.

Secondo LevelBlue Labs , che per primo ha rilevato questo codice dannoso alla fine di aprile 2024, SquidLoader utilizza metodi per evitare l’analisi statica e dinamica e, in definitiva, il rilevamento.

Le catene di attacco utilizzano e-mail di phishing con allegati che si mascherano da documenti Microsoft Word ma in realtà sono file binari che attivano l’esecuzione di codice dannoso. Questo codice viene utilizzato per scaricare la seconda fase del malware da un server remoto, incluso Cobalt Strike.

Il ricercatore di sicurezza Fernando Dominguez osserva che i downloader dispongono di sofisticati meccanismi di evasione e di esca che li aiutano a rimanere inosservati e li rendono difficili da analizzare. Lo shellcode fornito viene caricato nello stesso processo per evitare che il malware venga scritto su disco e quindi evitarne il rilevamento.

SquidLoader utilizza varie tecniche di evasione come l’utilizzo di segmenti di codice crittografati, codice spazzatura che rimane inutilizzato, offuscamento del grafico del flusso di controllo (CFG), rilevamento del debugger ed esecuzione di chiamate di sistema dirette invece di chiamate API di Windows NT.

I downloader di malware sono diventati popolari tra gli aggressori che cercano di fornire ed eseguire payload aggiuntivi su dispositivi compromessi, aggirando le protezioni antivirus e altre misure di sicurezza.

L’evoluzione delle minacce informatiche richiede vigilanza e adattamento costanti. Le organizzazioni non dovrebbero solo rafforzare gli aspetti tecnici della protezione, ma anche formare i dipendenti a riconoscere gli attacchi di phishing, poiché anche i sistemi di sicurezza più avanzati possono essere aggirati a causa di un errore umano.

L'articolo Sei distratto online? Ti meriti SquidLoader! proviene da il blog della sicurezza informatica.

Secondo un nuovo rapporto dei ricercatori Symantec, dei gruppi di spionaggio informatico legati alla Cina sono coinvolti in una lunga campagna per hackerare diversi operatori di telecomunicazioni in un paese asiatico a partire dal 2021.

L’azienda non ha specificato quale Paese sia stato attaccato, ma ha precisato che l’attività dannosa consisteva nell’implementazione periodica di backdoor nelle reti delle organizzazioni prese di mira con successivo furto di credenziali.

Gli strumenti utilizzati nella campagna corrispondono a quelli utilizzati negli ultimi anni dai gruppi cinesi di spionaggio informatico come Mustang Panda, RedFoxtrot e Naikon. Questi strumenti includono backdoor appositamente progettati COOLCLIENT, QUICKHEAL e RainyDay, in grado di acquisire dati sensibili e stabilire una comunicazione con un server C2.

Sebbene il metodo esatto di accesso iniziale agli obiettivi non sia ancora noto, questa campagna dannosa si distingue per l’utilizzo di strumenti per scansionare le porte e rubare credenziali scaricando il contenuto del registro di Windows. Il collegamento di tutti questi strumenti con tre diversi gruppi di criminali informatici porta i ricercatori alle seguenti ipotesi mutuamente esclusive:

• gli attacchi vengono effettuati indipendentemente l’uno dall’altro;
• lo stesso aggressore utilizza strumenti acquistati da gruppi diversi;
• diversi gruppi cooperano tra loro all’interno della stessa campagna dannosa.

Anche lo scopo principale delle intrusioni non è chiaro in questa fase, anche se in generale i gruppi cinesi prendono di mira abbastanza spesso il settore delle telecomunicazioni in tutto il mondo. Così, nel novembre 2023, Kaspersky Lab ha identificato una campagna che utilizzava il malware ShadowPad contro una delle società di telecomunicazioni nazionali del Pakistan sfruttando vulnerabilità note in Microsoft Exchange Server.

L’incidente esaminato da Symantec evidenzia la necessità di una vigilanza continua e di un miglioramento della sicurezza informatica nel settore delle telecomunicazioni. La sofisticatezza e la durata degli attacchi dimostrano che le minacce odierne richiedono non solo soluzioni tecniche, ma anche cooperazione internazionale per combattere la criminalità informatica. È importante sviluppare una cultura della sicurezza informatica in cui ogni dipendente comprenda il proprio ruolo nella protezione delle infrastrutture critiche.

L'articolo Campagna di Spionaggio Cinese: Gli Hacker Attaccano le TELCO Asiatiche dal 2021 proviene da il blog della sicurezza informatica.

I Funzionari del Massachusetts hanno affermato che un firewall difettoso di proprietà di Comtech ha causato un’interruzione dei sistemi di chiamata di emergenza in tutto lo stato questa settimana.

Il sito web di Comtech afferma di avere più di 25 anni di esperienza nella tecnologia della sicurezza pubblica e che “i fornitori di servizi, gli stati e i governi locali di tutto il paese fanno affidamento sul suo portafoglio di prodotti e servizi mission-critical”.

Secondo un’indagine preliminare del dipartimento statale dei servizi di emergenza sanitaria e di Comtech, l’interruzione è stata causata da un firewall che per qualche motivo “non consentiva alle chiamate di raggiungere i centri di spedizione dei servizi di emergenza”.

Comtech sottolinea che le interruzioni non sono state il risultato di un attacco di hacker o di un’irruzione, ma afferma che “il motivo esatto per cui il firewall ha impedito alle chiamate di raggiungere i centri di distribuzione non è stato ancora determinato” e l’indagine sull’incidente è ancora in corso.

In totale, le interruzioni delle chiamate di emergenza sono durate circa due ore. Poco dopo l’inizio dell’interruzione, il dipartimento locale dei servizi di emergenza sanitaria ha avvisato le forze dell’ordine e ha emesso un avviso di emergenza ai residenti nello stato, consigliando loro di chiamare direttamente le linee di pubblica sicurezza locali in caso di emergenza.

“Anche se alcune chiamate potrebbero non andare a buon fine, il sistema consente ai centri di spedizione di determinare il numero di telefono del chiamante e di richiamarlo. Non abbiamo ricevuto alcuna segnalazione di emergenze verificatesi durante l’interruzione”, affermano i funzionari statali.

L'articolo Le Chiamate in Emergenza dello stato del Massachusetts bloccate per due ore per un Firewall guasto proviene da il blog della sicurezza informatica.

Nuovo disco per il gruppo italo svizzero degli Houstones, dal titolo "A + C", in uscita per Soppressa Records, Collettivo Dotto e Entes Anomicos. @Musica Agorà

iyezine.com/houstones-a-c

Houstones - A + C

Houstones - A + C - Nuovo disco per il gruppo italo svizzero degli Houstones, dal titolo "A + C", in uscita per Soppressa Records, Collettivo Dotto e Entes Anomicos. - Houstones

^{Massimo Argo (In Your Eyes ezine)}

Way back in 2020, I actually read the proposed US legislation known as EARN IT, and with some controversy, concluded that much of the criticism of that bill was inaccurate. Well what’s old is new again, except this time it’s the European Union that’s wrestling with how to police online Child Sexual Abuse Material (CSAM). And from what I can tell of reading the actual legislation (pdf), this time it really is that bad.

The legislation lays out two primary goals, both of them problematic. The first is detection, or what some are calling “upload moderation”. The technical details are completely omitted here, simply stating that services “… take reasonable measures to mitigate the risk of their services being misused for such abuse …” The implication here is that providers would do some sort of automated scanning to detect illicit text or visuals, but exactly what constitutes “reasonable measures” is left unspecified.

The second goal is the detection order. It’s worth pointing out that interpersonal communication services are explicitly mentioned as required to implement these goals. From the bill:

Providers of hosting services and providers of interpersonal communications services that have received a detection order shall execute it by installing and operating technologies approved by the Commission to detect the dissemination of known or new child sexual abuse material or the solicitation of children…

This bill is careful not to prohibit end-to-end encryption, nor require that such encryption be backdoored. Instead, it requires that the apps themselves be backdoored, to spy on users before encryption happens. No wonder Meredith Whittaker has promised to pull the Signal app out of the EU if it becomes law. As this scanning is done prior to encryption, it’s technically not breaking end-to-end encryption.

You may wonder why that’s such a big deal. Why is it a non-negotiable for the Signal app to not look for CSAM in messages prior to encryption? For starters, it’s a violation of user trust and an intentional weakening of the security of the Signal system. But maybe most importantly, it puts a mechanism in place that will undoubtedly prove too tempting for future governments. If Signal can be forced into looking for CSAM in the EU, why not anti-government speech in China?

This story is ongoing, with the latest news that the EU has delayed the next step in attempting to ratify the proposal. It’s great news, but the future is still uncertain. For more background and analysis, see our conversation with the minds behind Matrix, on this very topic:

youtube.com/embed/00Dg0vRc2Zg?…

Bounty or Extortion?

A bit of drama played out over Twitter this week. The Kraken cryptography exchange had a problem where a deposit could be interrupted, and funds added to the Kraken account without actually transferring funds to back the deposit. A security research group, which turned out to be the CertiK company, discovered and disclosed the flaw via email.

Kraken Security Update:

On June 9 2024, we received a Bug Bounty program alert from a security researcher. No specifics were initially disclosed, but their email claimed to find an “extremely critical” bug that allowed them to artificially inflate their balance on our platform.

— Nick Percoco (@c7five) June 19, 2024

All seemed well, and the Kraken team managed to roll a hotfix out in an impressive 47 minutes. But things got weird when they cross referenced the flaw to see if anyone had exploited it. Three accounts had used it to duplicate money. The first use was for all of four dollars, which is consistent with doing legitimate research. But additionally, there were more instances from two other users, totaling close to $3 million in faked transfers — not to mention transfers of *real* money back out of those accounts. Kraken asked for the details and the money back.

According to the Kraken account, the researchers refused, and instead wanted to arrange a call with their “business development team”. The implication is that the transferred money was serving as a bargaining chip to request a higher bug bounty payout. According to Kraken, that’s extortion.

There is a second side to this story, of course. CertiK has a response on their x.com account where they claim to have wanted to return the transferred money, but they were just testing Kraken’s risk control system. There are things about this story that seem odd. At the very least, it’s unwise to transfer stolen currency in this way. At worst, this was an attempt at real theft that was thwarted. The end result is that the funds were eventually completed.

There are two fundamental problems with vuln disclosure/bounty:
#1 companies think security researchers are trying to extort them when they are not
#2 security researchers trying to extort companies t.co/I7vnk3oXi5

— Robert Graham 𝕏 (@ErrataRob) June 20, 2024

Report Bug, Get Nastygram

For the other side of the coin, [Lemon] found a trivial flaw in a traffic controller system. After turning it in, he was rewarded with an odd letter that was a combination of “thank you” and your work “may have constituted a violation of the Computer Fraud and Abuse Act”. This is not how you respond to responsible disclosure.

I received my first cease and desist for responsibly disclosing a critical vulnerability that gives a remote unauthenticated attacker full access to modify a traffic controller and change stoplights. Does this make me a Security Researcher now? pic.twitter.com/ftW35DxqeF

— Lemon (@Lemonitup) June 18, 2024

Emoji Malware

We don’t talk much about malware in South Asia, but this is an interesting one. DISGOMOJI is a malware attributed to a Pakistani group, mainly targeting government Linux machines in India. What really makes it notable is that the command and control system uses emoji in Discord channels. The camera emoji instructs the malware to take a screenshot. A fox triggers a hoovering of the Firefox profiles, and so on. Cute!

Using Roundcube to break PHP

This is a slow moving vulnerability, giving that the core is a 24-year old buffer overflow in iconv() in glibc. [Charles Fol] found this issue, which can pop up when using iconv() to convert to the ISO-2022-CN-EXT character set, and has been working on how to actually trigger the bug in a useful way. Enter PHP. OK, that’s not entirely accurate, since the crash was originally found in PHP. It’s more like we’re giving up on finding something else, and going back to PHP.

The core vulnerability can only overwrite one, two, or three bytes past the end of a buffer. To make use of that, the PHP bucket structure can be used. This is a growable doubly-linked list that is used for data handling. Chunked HTTP messages can be used to build a multi-bucket structure, and triggering the iconv() flaw overwrites one of the pointers in that structure. Bumping that pointer by a few bytes lands in attacker controlled data, which can land in a fake data structure, and continuing the dechunking procedure gives us an arbitrary memory write. At that point, a function pointer just has to be pointed at system() for code execution.

That’s a great theoretical attack chain, but actually getting there in the wild is less straightforward. There has been a notable web application identified that is vulnerable: Roundcube. Upon sending an email, the user can specify the addresses, as well as the character set parameter. Roundcube makes an iconv() call, triggering the core vulnerability. And thus an authenticated user has a path to remote code execution.

Bits and Bytes

Speaking of email, do you know the characters that are allowed in an email address? Did you know that the local user part of an email address can be a quoted string, with many special characters allowed? I wonder if every mail server and email security device realized that quirk? Apparently not, at least in the case of MailCleaner, which had a set of flaws allowing such an email to lead to full appliance takeover. Keep an eye out for other devices and applications to fall to this same quirk.

Nextcloud has a pair of vulnerabilities to pay attention to, with the first being an issue where a user with read and share permissions to an object could reshare it with additional permissions. The second is more troubling, giving an attacker a potential method to bypass a two-factor authentication requirement. Fixes are available.

Pointed out by [Herr Brain] on Hackaday’s Discord, we have a bit of bad news about the Arm Memory Tagging Extensions (MTE) security feature. Namely, speculative execution can reveal the needed MTE tags about 95% of the time. While this is significant, there is a bit of chicken-and-egg problem for attackers, as MTE is primarily useful to prevent running arbitrary code at all, which is the most straightforward way to achieve a speculative attack to start with.

And finally, over at Google Project Zero, [Seth Jenkins] has a report on a trio of Android devices, and finding vulnerabilities in their respective kernel drivers. In each case, the vulnerable drivers can be accessed from unprivileged applications. [Seth]’s opinion is that as the Android core code gets tighter and more secure, these third-party drivers of potentially questionable code quality will quickly become the target of choice for attack.

Today EU governments will not adopt their position on the EU regulation on “combating child sexual abuse”, the so-called chat control regulation, as planned, which would have heralded the end of private messages and secure encryption. The Belgian Council presidency postponed the vote at short notice. Once again the chat control proposal fails in Council. Pirate Party MEP, digital freedom fighter and negotiator for his group in the European Parliament, Patrick Breyer, cheers:

“Without the commitment and resistance of countless individuals and organizations in Europe, the EU governments would have decided today in favour of totalitarian indiscriminate chat control , burying the digital privacy of correspondence and secure encryption. A big thanks to all who have contacted politicians and spoken out in the past few days. The fact that we have prevented the orwellian chat control for the time being should be celebrated!

For now the surveillance extremists among the EU governments and Big Sister Ylva Johansson have failed to build a qualified majority. But they will not give up and could try again in the next few days. When will they finally learn from the EU Parliament that effective, court-proof and majority-capable child protection needs a new approach?

Now the critical governments should finally do their homework and agree on a joint list of requirements. It is not enough to defend encryption. The indiscriminate, error-prone screening of private messages is the most toxic part of the draft regulation, but the problems go far beyond that. We therefore need a new approach that focuses on preventive child protection instead of mass surveillance and paternalism! The last ‘compromise proposal’ put forward by the Council Presidency needs to be fundamentally revised in at least 4 points:

1) No indiscriminate chat control: Instead of blanket message and chat control, the judiciary should only have the power to order searches in the messages and uploads of suspects. This is the only way to avoid a disproportionate mass surveillance order inevitably failing in court and achieving nothing at all for children.

2) Protect secure encryption: So-called client-side scanning to infiltrate secure encryption must be explicitly ruled out. General declarations of support for encryption in the text of the law are worthless if scanning and extraction take place even before encryption. Our personal devices must not be perverted into scanners.

3) Protect anonymity: Remove mandatory age verification by all communications services to save the right to communicate anonymously. Whistleblowers risk being silenced if they have to show ID or face to the communications service before leaks.

4) No app censorship and digital house arrest for young people: It is completely unacceptable to exclude young people from apps such as Whatsapp, Instagram or games in order to protect them from grooming. Instead, the default settings of the services must become more privacy-friendly and secure.

The push for indiscriminate chat control is unprecedented in the free world. It divides child protection organizations, abuse victims, other stakeholders and governments. It’s time for a fresh start that relies on consensus, as proposed by the European Parliament. I am convinced that we can protect children and all of us much better.”

Background:

According to the latest text proposal users of apps and services with chat functionalities wouldbe asked whether they accept the indiscriminate and error-prone scanning and, if necessary, leaking of their privately sent images, photos and videos. Previously unknown images and videos would also be screened using “artificial intelligence”. If a user objects to the scanning, they would no longer be able to send or receive any images, photos, videos or links (Article 10). Despite paying lip service to encryption, end-to-end encrypted services would have to implement chat control by installing monitoring functions that are to take effect “before data transmission” (so-called client-side scanning, Article 10a). The scanning of text messages for indications of grooming, which has hardly been used to date, has been removed from the proposal, as was the scanning of voice communication. The chats of employees of security agencies and the military would be exempted from the error-prone chat control scanners.

At a meeting on 24 May, the Council’s Legal Service made it clear that mass chat monitoring without suspicion is still being proposed and remains a violation of fundamental rights.

On 16 June it has been revealed by Der SPIEGEL that most of the chats leaked voluntarily by US-based Big Tech companies are not criminally relevant.

Further information:

The wording of today’s voting proposal:
patrick-breyer.de/wp-content/u…

The European Parliament’s approach to protecting children online:
patrick-breyer.de/en/posts/cha…

How we would be affected by chat control:
patrick-breyer.de/en/posts/cha…

Myths/arguments in favour of chat control debunked:
patrick-breyer.de/en/posts/cha…

Arguments against chat control:
patrick-breyer.de/en/posts/cha…

Why message and chat control is particularly harmful to children and victims of abuse:
patrick-breyer.de/en/posts/cha…

Alternatives to chat control:
patrick-breyer.de/en/posts/cha…

patrick-breyer.de/en/chat-cont…

Uno scritto davvero interessante, prepotente e sincero senza freni e rivelatore, per uno scrittore fra i più interessanti dello spaghetti weird. @L’angolo del lettore

iyezine.com/michele-borgogni-t…

Michele Borgogni - Terror Supermarket

Michele Borgogni - Terror Supermarket - Terror Supermarket: Michele Borgogni iper realista e descrive cosa potrebbe succedere in un supermercato se cadessero le flebili barriere ipocrite - Terror Supermarket

^{Massimo Argo (In Your Eyes ezine)}