Month: May 2017

May 2017 news roundup

Target is still paying for their 2013 data breach

Remember Target’s data breach from a few years ago? They are still paying for that. Target recently agreed to an $18.5 million settlement with 47 states and the District of Columbia. That NYT article mentions a $202 million total for “legal fees and other costs since the breach” (I tried reading the linked SEC statement about those payments and lost interest immediately). I don’t know if that $202 million includes this $18.5 million amount, but that’s an expensive mistake any way you look at it.

Breaking news: IoT still terrible

New research shows that Internet of Things (IoT) devices can divulge a lot of information about their owners. The researchers found that a passive network tap on a home network allowed them to monitor traffic rates for several IoT devices. Even if they couldn’t read the traffic itself, the researchers were able to infer a lot just by watching DNS queries and changes in the traffic rates of devices like sleep monitors, motion-activated security cameras, and an Amazon Echo. (This technique of traffic analysis has a long history.)

So imagine that your story’s character needs to spy on someone. If she can identify an exploit for the wireless router the target uses for his home network, she could potentially eavesdrop on the traffic going in and out of his home. If the sleep sensor tells her that he’s sleeping, or if a camera shows movement in one part of the house, that might tell her something useful.

BTW, the Amazon Echo inspired what has become my favorite XKCD entry.

Defeating security cameras

This one is a little older, so vendors have at least partially addressed these specific vulnerabilities, but it’s pretty interesting. Someone published exploits against several consumer-grade security cameras. These cameras have a similar setup process:

  • Mount the camera somewhere
  • Download a vendor-supplied app to your phone
  • Use the app to configure the camera via bluetooth (your phone talks directly to the camera)
  • Configure the camera to connect to your home’s wireless network
  • The camera sends image data to the cloud: the camera has no local storage

The researcher found ways to interrupt the operation of several camera models. Sending certain specially-crafted bluetooth messages to the camera would cause it to reboot, taking it briefly offline. Sending another kind of bluetooth message would tell the camera to connect to a different wireless network. If the attacker brings along a wireless access point (WAP) transmitting the same SSID specified in the bluetooth message, the camera will connect to that WAP, rendering the camera ineffective.

This latter exploit provides a more plausible version of the overused trope of splicing into a camera’s feed, recording a few minutes of boring footage, and replaying it endlessly for the security guard. If the camera only sends data to the cloud when it detects motion, then the absence of data implies the absence of motion. The attacker just needs some off-the-shelf hardware, some publicly-available exploit code, and physical proximity (bluetooth range) to the camera.

Recent ransomware campaign

I’ve been trying to come up with an interesting way to tie this weekend’s worldwide ransomware attack into fiction, but I’m coming up short. Maybe it’s just too depressing. It just seems like a bunch of uninspired jackasses trying to steal money.

This malware is a bit more sophisticated than most, in that in comes in on email, a user clicks it and runs it (thinking it’s a link to a cat video or some damn thing), and then it spreads via file-sharing protocols to all the PCs on the local network, laughing at perimeter firewalls as it encrypts everyone’s files. For you sportsball fans, this is like the quarterback doing a fake to get the golden snitch past the goalie before the shortstop even hears the starter pistol. That’s called a slam dunk, friends.

The story has a couple of interesting points. It seems there was an ill-conceived but convenient kill switch. And it looks like this was a known vulnerability hoarded by the US government, so thanks for that, guys.

British hospitals seem to have been hit particularly hard, so much so that some have had to turn away patients. Pretend you’re a hospital that years ago purchased an expensive MRI machine operated by software that only runs on Windows XP. The company that sold the device and the software has long since gone out of business, so there’s no way to migrate to a supported operating system. People still need MRIs, so it’s not like you can just not use the thing. That kind of thing is likely why Microsoft released a patch for some of the legacy versions of Windows, so that was right neighborly of them.

This is a good reminder to run updates on your computers. All of them.