This Week In Security: ACME.sh, Leaking LEDs, And Android Apps

June 16, 2023 by Jonathan Bennett 3 Comments

Let’s Encrypt has made an enormous difference to the landscape of the web. The protocol used for authenticating and receiving certificates, ACME, has spawned quite a few clients of various flavors. Some are written in Rust, some in Python or Go, and a few in straight Bash shell script. One of those last ones, acme.sh, was doing something odd when talking to a particular “Certificate Authority”, HiCA. This pseudo-CA only supports acme.sh, and now we know why. The folks behind HiCA found an RCE exploit in acme.sh, and decided to use that exploit to do certificate issuance with more “flexability”. Oof.

The nuts and bolts here is that HiCA was working as a CA-in-the-Middle, wrapping other CA’s authentication services. Those services don’t support ACME authentication at all, and HiCA used the acme.sh vulnerability to put the authentication token in the place SSL.com expected to find it. So, just a good community member offering a service that ACME doesn’t quite support, right?

Well, maybe not so innocent. The way it appears this works, is that the end user sends a certificate request to HiCA. HiCA takes that information, and initiates a certificate request off to SSL.com. SSL.com sends back a challenge, and HiCA embeds that challenge in the RCE and sends it to the end user. The end user’s machine triggers the RCE, which pushes the challenge token to the well-known location, and bypasses the ACME protection against exactly this sort of CA-in-the-middle situation.

The last piece of the authentication process is that the signing server reaches out over HTTP to the domain being signed, and looks for the token to be there. Once found, it sends the signed certificates to HiCA, who then forward them on to the end user. And that’s the problem. HiCA has access to the key of every SSL cert they handled. This doesn’t allow encryption, but these keys could be used to impersonate or even launch MitM attacks against those domains. There’s no evidence that HiCA was actually capturing or using those keys, but this company was abusing an RCE to put itself in the position to have that ability.

The takeaway is twofold. First, as an end user, only use reputable CAs. And second, ACME clients need to be hardened against potentially malicious CAs. The fact that HiCA only supported the one ACME client was what led to this discovery, and should have been a warning flag to anyone using the service. Continue reading “This Week In Security: ACME.sh, Leaking LEDs, And Android Apps” →

The FPGA board in question which was programmed to run the algorithm. (Source: iranintl)

Iran’s Military Quantum Claim: It’s Only 99.4% Ridiculous

June 15, 2023 by Maya Posch 19 Comments

When Iran recently announced a quantum processing algorithm (Google translation) that would help its military to detect water surface disturbances, the instant response from Western media was one of ridicule, based on the displayed hardware. The hardware in question was the Digilent ZedBoard Zynq-7000 hybrid SoC/FPGA development board, which can be yours for less than $600.

Seems absurd, and the claim about any realistic military use absolutely is. But buried deep, deep down, there may be a tiny kernel of truth: because quantum computers are inherently parallel, FPGAs can make a good fit for small-scale quantum simulations.

Does this mean that the Iranian Navy would be better off simulating quantum circuits on an FPGA board than on a GPU or even a used laptop? Probably not. Will this hardware serve the proposed military application in the forseeable future? Absolutely not! Was this a misleading and ridiculous photo op? Yup. 100%.

But is emulating qubits in FPGA fabric a real thing? Turns out it is! Let’s have a look.

Continue reading “Iran’s Military Quantum Claim: It’s Only 99.4% Ridiculous” →

Raspberry Pi Pico W Now Supports Bluetooth

June 15, 2023 by Tom Nardi 11 Comments

What’s the best kind of upgrade a piece of consumer technology can get? A free one that doesn’t require you to do anything other than accept a new version of the software it’s running.

That’s precisely what every current (and future) owner of the Raspberry Pi Pico W just got with the addition of Bluetooth support to SDK 1.5.1. This is possible because the CYW43439 radio chipset used on the wireless version of the Pi Pico has always had Bluetooth capabilities, they just weren’t officially accessible from the C or MicroPython environments until now. In a corresponding blog post, [Eben Upton] explains that part of the delay was due to difficulties in getting both WiFi and Bluetooth connections to work simultaneously over the three-pin SPI bus that links the two chips on the board.

One thing that struck us as particularly interesting here is the use of BlueKitchen’s BTStack to provide support for both Bluetooth Classic and Low Energy profiles. This library is released under a modified version of the BSD 3-Clause license that otherwise specifically forbids commercial usage. That would be a problem for anyone who wanted to sell a gadget built around the Pico W, so Raspberry Pi Ltd negotiated — and presumably paid for — a special dispensation so commercial use is in the clear.

We should note that technically Bluetooth support was available in a beta state previously, albeit without this new license agreement made with BlueKitchen. Though anyone with a keen eye knew Bluetooth support was coming well before that, our own [Elliot Williams] called it when he first set eyes on the Pi Pico W back in 2022.

Diagram of the Sun. (Credit: Kelvinsong)

Parker Solar Probe’s Confirmation Of Interchange Reconnection Being The Source Of Fast Solar Wind

June 14, 2023 by Maya Posch 4 Comments

Although experimental verification is at the heart of the scientific method, there is quite a difficulty range when it comes to setting up such an experiment. Testing what underlies the formation of the fast solar winds that are ejected from coronal holes in the Sun’s corona is one of these tricky experimental setups. Yet it would seem that we now have our answer, with a newly published paper in Nature by S. D. Bale and colleagues detailing what we learned courtesy of the Parker Solar Probe (PSP), which has been on its way to the Sun since it was launched in August of 2018 from Earth.

Artist rendition of the Parker Solar Probe. (Credit: NASA)

The Sun’s solar wind is the name for a stream of charged particles which are ejected from the Sun’s corona, with generally two types being distinguished: slow and fast solar winds. The former type appears to originate from the Sun’s equatorial belt and gently saunters away from the Sun at a mere 300 – 500 km/s with a balmy temperature of 100 MK.

The fast solar wind originates from coronal holes, which are temporary regions of cooler, less dense plasma within the corona. These coronal holes are notable for being regions where the Sun’s magnetic field extends into interplanetary space as an open field, along which the charged particles of the corona can escape the Sun’s gravitational field.

These properties of coronal holes allow the resulting stream to travel at speeds around 750 km/s and a blistering 800 MK. What was unclear up till this point was exactly what powers the acceleration of the plasma. It was postulated that the source could be wave heating, as well as interchange reconnection, but with the PSP now close enough to perform the relevant measurements, the evidence points to the latter.

Essentially, interchange reconnection is the reestablishing of a coronal hole’s field lines after interaction with convection cells on the Sun’s photosphere. These convection cells draw the magnetic field into a kind of funnel after which the field lines reestablish themselves, which results in the ejection of hotter plasma than with the slow solar wind. Courtesy of the PSP’s measurements, measured fast solar winds could be matched with coronal holes, along with the magnetic fields. This gives us the clearest picture yet of how this phenomenon works, and how we might be able to predict it.

(Heading image: Diagram of the Sun. (Credit: Kelvinsong) )

Google Home Scripting

June 14, 2023 by Al Williams 14 Comments

It is always controversial to have home assistants like the ones from Google or Amazon. There are privacy concerns, of course. Plus they maddeningly don’t always do what you intend for them to do. However, if you do have one, you’ve probably thought about something you wanted to do that would require programming. Sure, you can usually do a simple list, but really writing code wasn’t on the menu. But now, Google Home will allow you to write code. Well, at least script using a YAML file.

The script language is available in the web app and if you opt in on the mobile app as well. There’s a variety of ways you can trigger scripts and many examples you can start with.

Continue reading “Google Home Scripting” →

NASA Team Sets New Space-to-Ground Laser Communication Record

June 9, 2023 by Joseph Long 13 Comments

[NASA] and a team of partners has demonstrated a space-to-ground laser communication system operating at a record breaking 200 gigabit per second (Gbps) data rate. The TeraByte InfraRed Delivery (TBIRD) satellite payload was designed and built by [MIT Lincoln Laboratory]. The record of the highest data rate ever achieved by a space-to-Earth optical communication link surpasses the 100 Gbps record set by the same team in June 2022.

TBIRD makes passes over an ground station having a duration of about six-minutes. During that period, multiple terabytes of data can be downlinked. Each terabyte contains the equivalent of about 500 hours of high-definition video. The TBIRD communication system transmits information using modulated laser light waves. Traditionally, radio waves have been the medium of choice for space communications. Radio waves transmit data through space using similar circuits and systems to those employed by terrestrial radio systems such as WiFi, broadcast radio, and cellular telephony. Optical communication systems can generally achieve higher data rates, lower loses, and operate with higher efficiency than radio frequency systems. Continue reading “NASA Team Sets New Space-to-Ground Laser Communication Record” →

This Week In Security: Minecraft Fractureiser, MOVEit, And Triangulation

June 9, 2023 by Jonathan Bennett 2 Comments

Modded Minecraft is having a security moment, to match what we’ve seen in the Python and JavaScript repositories over the last few months. It looks like things started when a handful of burner accounts uploaded malicious mods to Curseforge and Bukkit. Those mods looked interesting enough, that a developer for Luna Pixel Studios (LPS) downloaded one of them to test-run. After the test didn’t pan out, he removed the mod, but the malicious code had already run.

Where this gets ugly is in how much damage that one infection caused. The virus, now named fractureiser, installs itself into every other Minecraft-related .jar on the compromised system. It also grabs credentials, cookies, cryptocurrency addresses, and the clipboard contents. Once that information was exfiltrated from the LPS developer, the attacker seems to have taken manual actions, using the purloined permissions to upload similarly infected mod files, and then marking them archived. This managed to hide the trapped files from view on the web interface, while still leaving them exposed when grabbed by the API. Once the malware hit a popular developer, it began to really take off.

It looks like the first of the malicious .jar files actually goes all the way back to mid-April, so it may take a while to discover all the places this malware has spread. It was first noticed on June 1, and investigation was started, but the story didn’t become public until the 7th. Things have developed rapidly, and the malware fingerprints has been added to Windows Defender among other scanners. This helps tremendously, but the safe move is to avoid downloading anything Minecraft related for a couple days, while the whole toolchain is inspected. If it’s too late and you’ve recently scratched that voxel itch, it might be worth it to take a quick look for Indicators of Compromise (IoCs).

Continue reading “This Week In Security: Minecraft Fractureiser, MOVEit, And Triangulation” →