We’re back! And while the column took a week off for Thanksgiving, the security world didn’t. The most pressing news is an issue in Owncloud, that is already under active exploitation.

The problem is a library that can be convinced to call phpinfo() and include the results in the page response. That function reveals a lot of information about the system Owncloud is running on, including environment variables. In something like a Docker deployment, those environment variables may contain system secrets like admin username and password among others.

Now, there is a bit of a wrinkle here. There is a public exploit, and according to research done by Greynoise Labs, that exploit does not actually work against default installs. This seems to describe the active exploitation attempts, but the researcher that originally found the issue has stated that there is a non-public exploit that does work on default installs. Stay tuned for this other shoe to drop, and update your Owncloud installs if you have them.

I'm talking about a "real" exploit, which is to my knowledge not public yet. The one you linked won't work.

— Charles Fol (@cfreal_) November 30, 2023

NXP

If we consider a chip manufacturer, who makes chips that get included in loads of devices, what’s the worst case security scenario? How about a skilled attacker in the corporate network for over two years before detection? That’s the reported situation at NXP from 2017 to 2020. The threat group Chimera managed to gain a foothold on an NXP employee workstation, and very methodically pushed deeper into the network.

First, there’s the obvious possibility that chip designs and source code was leaked for NXP products. An even more worrying scenario is that vulnerability reports were part of the data exfiltrated, possibly giving these attackers an early chance to use unpatched vulnerabilities. We could speculate about even more worrying possibilities, but at this point there is no evidence of any tampering or other supply chain attacks.

Chimera is almost certainly a professional Chinese Advanced Persistent Threat (APT), a bit of innuendo for a state-affiliated hacking group. This is hilariously evidenced by the clockwork precision in working hours, synced to Chinese office hours, lunch break included. There was even a telling break taken for Chinese Golden Week.

Too Many Secrets

So this one is weird. There are a pair of 0-day attacks in the wild, one against a popular router, the other against a Network Video Recorder. From the scant details in the Akamai report, we can conclude that the attacks depend on default username and password. Both detection rules mention NTP hostname, so this is likely a command injection flaw in both devices. But what devices? Akamai has opted not to specify.

That’s an unfortunate decision, as these exploits are already in the wild. The advantage is already given to the attacker, and Akamai has opted not to let the rest of us know what devices to even be worried about. The likely reason is that this is a trivial exploit, and the detection rules give away enough for anyone to reverse engineer the attack. It’s still a disappointing decision.

Fingerprints

Up next is a masterclass on hardware hacking from Blackwing Intelligence. A security team at Microsoft tasked the Blackwing researchers with trying to crack the fingerprint sensors used in several laptops for the Windows Hello login feature. These fingerprint readers all work using a Match on Chip (MoC) approach, where the fingerprint sensor itself is secure (theoretically) and trusted to do the actual fingerprint verification. To keep that safe, Microsoft has designed the Secure Device Connection Protocol (SDCP) to provide a way to verify the trustworthiness of the device and data being transferred.

That protocol actually seems pretty robust, using a good encryption and authentication scheme. To really dig in, our heroes took the Linux fingerprint scanner driver for one of the laptops, and used it to construct a Wireshark Dissector. And that’s when they discovered the first sign of trouble. The Linux authentication flow worked differently from that of Windows.

The real problem is that the fingerprint reader firmware accepts a less secure implementation of SDCP. To mitigate the danger this poses, the firmware expects to receive a configuration packet at the beginning of an authentication flow that specifies which driver is being used, with the firmware maintaining a separate database of users for each flow. That configuration packet just happens to be unauthenticated and in the clear. The hack that ended up working was to generate a spoofed user from Linux, reboot to Windows, and then inject a config packet telling the scanner to use its Linux driver database.

The device that had the simplest bypass just happened to be Microsoft’s own Surface Pro Type Cover. In a cringe-worthy oversight, this device doesn’t use SDCP at all. All an attacker has to do is unplug the Type Cover and plug in a malicious USB device that spoofs the cover’s ID. “My finger is my passport, verify me.”

BLUFFS

And because we didn’t have enough these past two weeks to keep us all on our toes, there’s a new novel attack against Bluetooth, the BLUetooth Forward and Future Secrecy attack, BLUFFS. The key idea here is making a Bluetooth connection to a target device with an intentionally weak key, breaking the cryptography of that session, and then manipulating the target into reusing the broken cryptography material for future sessions. See the PDF write-up for all the juicy details.

Bits and Bytes

A Cyberlink installer has been discovered containing malicious code. This installer is properly signed, and was hosted on Cyberlink infrastructure. The group behind this supply chain attack is believed to be Diamond Sleet, a North Korean APT. Microsoft has added this compromised certificate to its revocation list, and taken down the second-stage code from Github where it was being hosted.

Own a domain? Wonder if someone has ever tried to typosquat your domain? There’s now a service to check. Have I Been Squatted takes a given domain name and runs it through a few permuting tools, checking for registered domains based on typos, different TLDs, and even punycode tricks. See the announcement for more details.

And finally, remember the trope from cartoons and cheesy sci-fi episodes, where the nearly omniscient AI is defeated by triggering a paradox or endless loop? Our new AI overlords are similarly vulnerable. It turns out if you simply ask ChatGPT to repeat a given word forever, it will try to do so. For a while. Eventually the AI model breaks, and it starts spitting out raw training data. That’s non-ideal. But at least we know how to escape the clutches of an evil AI if we ever find ourselves there.