This Week In Security: Psychic Paper, Spilled Salt, And Malicious Captchas

Apple recently patched a security problem, and fixed the Psychic Paper 0-day. This was a frankly slightly embarrasing flaw that [Siguza] discovered in how iOS processed XML data in an application’s code signature that allowed him access to any entitlement on the iOS system, including running outside a sandbox.

Entitlements on iOS are a set of permissions that an application can request. These entitlements range from the aforementioned com.apple.private.security.no-container to platform-application, which tells the system that this is an official Apple application. As one would expect, Apple controls entitlements with a firm grip, and only allows certain entitlements on apps hosted on their official store. Even developer-signed apps are extremely limited, with only two entitlements allowed.

This system works via an XML list document that is part of the signed application. XML is a relative of HTML, but with a stricter set of rules. What [Siguza] discovered is that iOS contains 4 different XML parsers, and they deal with malformed XML slightly differently. The kicker is that one of those parsers does the security check, while a different parser is used for that actual permission implementation. Is it possible that this mismatch could contain a vulnerability? Of course there is.
Continue reading “This Week In Security: Psychic Paper, Spilled Salt, And Malicious Captchas”

Checking In On Relatives Using Old Android Tablets

With social distancing it can be harder to stay in touch with our relatives, especially those who are elderly and not particularly tech-savvy. Looking for a solution to that end for his own grandmother, [Steve] came up with the idea of using an inexpensive used tablet and a mobile data plan in order to mail her a “video phone” that works out of the box.

This method requires zero button presses in order to pick up a video call.

Since the tablet is configured to use cellular networks rather than WiFi, it requires no setup process at all to the recipient. And with the Android version of Skype, it’s possible to configure it so that calls are automatically picked up and video chat enabled. That way, whoever gets the tablet after it’s prepared doesn’t have to tap a single button on the screen in order to receive a call.

[Steve] has also developed the simple idea into a full-fledged easy-to-follow tutorial so that just about anyone is able to replicate the process for their own loved ones. And if you’re still having any trouble with it, there’s a team of volunteers right on the website who can help you with tech support. Just remember to disinfect whatever device you’re sending, since viruses can typically stick to surfaces like plastic and glass for longer.

Now, if showing up to your relatives as a disembodied video screen doesn’t cut it for you, then you might want to send them something more substantial like this cute little telepresence robot that can drive around on a desk.

GitHub On The Go

It is hard to find anyone that does any kind of software development that doesn’t have some interaction with GitHub. Even if you don’t host your own projects there, there are so many things to study and borrow on the site, that it is nearly ubiquitous. However, when you’ve needed GitHub on the run, you’ve probably had to turn to your phone browser and had a reduced experience. GitHub for Mobile is now out of beta and promises a more fluid phone-based GitHub experience.

In addition to working with tasks and issues, you can also review and merge pull requests. The app sends your phone notifications, too, which can be handy. As you might expect, you can get the app for Android or iPhone in the respective stores.

Continue reading “GitHub On The Go”

This Week In Security: More WhatsApp, Nextcry, Hover To Crash, And Android Permissions Bypass

There is another WhatsApp flaw, but instead of malicious GIFs, this time it’s malicious mp4 files. Facebook announced the vulnerability late last week. An update has been released, so first go make sure WhatsApp is updated. Facebook’s advisory is a bit light on the details, simply saying that a “stack-based buffer overflow” was possible as a result of “parsing the elementary stream metadata of an mp4 file”.

Shortly after the bug was announced, a GitHub repository popped up, with a claimed proof-of-concept mp4 file for CVE-2019-11931. (Thanks to [justtransit] on Reddit for the link.) I can’t easily test the PoC file, but we can take a look at it to see what the vulnerability is. What tools do we need to take a look? A hex editor is a good start. I’m using GHex, simply because it was available and easily installed on Fedora. Continue reading “This Week In Security: More WhatsApp, Nextcry, Hover To Crash, And Android Permissions Bypass”

This Week In Security: The Robots Are Watching, Insecure VPNs, Graboids, And Biometric Fails

A Japanese hotel chain uses robots for nearly everything. Check in, room access, and most importantly, bedside service. What could possibly go wrong with putting embedded Android devices, complete with mics and cameras, right in every hotel room? While I could imagine bedside robots ending badly in many ways, today we’re looking at the possibility that a previous guest installed an app that can spy on the room. The kiosk mode used on these devices left much to be desired. Each bot has an NFC reader, and all it takes is an URL read by that reader to break out of the kiosk jail. From there, a user has full access to the Android system underneath, and can install whatever software they wish.

[Lance Vick] discovered this potential problem way back in July, and after 90 days of inaction has released the vulnerability. More of these hotels are being rolled out for the 2020 Olympics, and this sort of vulnerability is sure to be present in other similar kiosk devices.

VPN Compromise

In March 2018, a server in a Finnish data center was compromised through a remote management system. This was probably a Baseboard Management Controller (BMC), which is as dangerous as it is useful. Most BMCs have their own Ethernet adapter, not controlled by the host computer, and allows a remote user to access the machine just as if they had a monitor and keyboard connected to it. This particularly server was one rented by NordVPN, who was apparently not notified of the data center breach.

So what was captured from this server? Apparently the OpenVPN credentials stored on that server, as well as a valid TLS key. (Document mirror via TechCrunch) It’s been noted that this key is now expired, which does mean that it’s not being actively exploited. There were, however, about 7 months between the server break-in and the certificate expiration, during which time it could have been used for man-in-the-middle attacks.

NordVPN has confirmed the breach, and tried to downplay the potential impact. This report doesn’t seem to entirely match the leaked credentials. An attacker with this data and root access to the server would have likely been able to decrypt VPN traffic on the fly.

Graboid

Named in honor of a certain sci-fi worm, Graboid is an unusual piece of malware aimed at Docker instances. It is a true worm, in that compromised hosts are used to launch attacks against other vulnerable machines. Graboid isn’t targeting a Docker vulnerability, but simply looking for an unsecured Docker daemon exposed to the internet. The malware downloads malicious docker images, one of which is used for crypto-currency mining, while another attempts to compromise other servers.

Graboid has an unusual quirk — the quirk that earned it the name: It doesn’t constantly mine or attempt to spread, but waits over a minute between bursts of activity. This was likely an attempt to mask the presence of mining malware. It’s notable that until discovered, the malicious Docker images were hosted on the Docker Hub. Be careful what images you trust, and look for the “Docker Official Image” tag.

Iran and Misdirection

Remember a couple weeks ago, when we discussed the difficulty of attack attribution? It seems a healthy dose of such paranoia might be warranted. The American NSA and British NCSC revealed that they now suspect Russian actors compromised Iranian infrastructure and deployed malware developed by Iranian coders. The purpose of this seems to have been redirection — to compromise targets and put the blame on Iran. To date it’s not certain that this particular gambit fooled any onlookers, but this is likely not the only such effort.

Android Biometrics

New Android handsets have had a rough week. First, the Samsung Galaxy S10 had an issue with screen protectors interfering with the under-the-screen fingerprint reader. This particular problem seems to only affect fingerprints that are enrolled after a screen protector has been applied. With the protector still in place, anyone’s fingerprint is able to unlock the device. What’s happening here seems obvious. The ultrasonic fingerprint scanner isn’t able to penetrate the screen protector, so it’s recording an essentially blank fingerprint. A patch to recognize these blank prints has been rolled out to devices in Samsung’s home country of South Korea, with the rest of the world soon to follow.

The second new handset is the Google Pixel 4, which includes a new Face Unlock feature. While many have praised the feature, there is trouble in paradise. The Pixel’s Face Unlock works even when the user is asleep or otherwise unmoving. To their credit, Apple’s Face ID also checks for user alertness, trying to avoid unlocking unless the user is intentionally doing so.

The humorous scenario is a child or spouse unlocking your phone while you’re asleep, but a more sobering possibility is your face being used against you unwillingly, or even while unconscious or dead. Based on leaks, it’s likely that there was an “eyes open” mode planned but cut before launch. Hopefully the bugs can be worked out of that feature, and it can be re-added in a future update. Until then, it’s probably best not to use Google’s Face Unlock on Pixel 4 devices.

Finally Run Useful Apps On A Windows Phone

Not every piece of technology or software can succeed, even with virtually unlimited funding and marketing. About the same number of people are still playing Virtual Boys as are using Google Plus, for example. In recent memory, the Windows Phone occupies the same space as these infamous failures, potentially because it was late to the smartphone game but primarily because no one wanted to develop software for it. But now, you can run Android apps on Windows Phones now. (Google Translate from German)

To be clear, this doesn’t support all Android apps or all Windows Phones, and it will take a little bit of work to get it set up at all. But if you still have one laying around you might want to go grab it. First you’ll need to unlock the phone, and then begin sending a long string of commands to the device which sends the required software to the device. If that works, you can begin loading Android apps on the phone via a USB connection to a PC.

This hack came to us via Windows Central and Reddit. It seems long and involved but if you have any experience with a command line you should be fine. It’s an interesting way to get some more use out of your old Windows Phone if it’s just gathering dust in a closet somewhere. If not, don’t worry; Windows Phones were rare even when they were at their most popular. We could only find one project in our archives that uses one, and that was from 2013.

Voice Chess Uses Phone, Arduino, And An Electromagnet

[Diyguypt] may be an altruist to provide the means for people who can’t manipulate chess pieces to play the game. Or he may just have his hands too busy with food and drink to play. Either way, his voice command chessboard appears to work, although it has a lot of moving parts both figuratively and literally. You can check out the video below to see how it works.

The speech part is handled by an Android phone and uses Google’s voice services, so if you don’t want Google listening to your latest opening gambit, you’ll want to pass this one up. The phone uses an app that talks to the Arduino via Bluetooth, which means the Arduino needs a Bluetooth module.

Continue reading “Voice Chess Uses Phone, Arduino, And An Electromagnet”