Our first story this week comes courtesy of the Pwn2own contest. For anyone not familiar with it, this event is held twice a year, and features live demonstrations of exploits against up-to-date software. The one exception to this is when a researcher does a coordinated release with the vendor, and the update containing the fix drops just before the event. This time, the event was held virtually, and the attempts are all available on Youtube. There were 23 attacks attempted, and only two were outright failures. There were 5 partial successes and 16 full successes.
One of the interesting demonstrations was a zero-click RCE against Zoom. This was a trio of vulnerabilities chained into a single attack. The only caveat is that the attack must come from an accepted contact. Pwn2Own gives each exploit attempt twenty minutes total, and up to three attempts, each of which can last up to five minutes. Most complex exploits have an element of randomness, and exploits known to work sometimes don’t work every time. The Zoom demonstration didn’t work the first time, and the demonstration team took enough time to reset, they only had enough time for one more try.
The build consists of a series of 3D printed linkages, with servos fitted in between. This allows the robot’s body to articulate and flex in much the same way as a real inch worm. By flexing the body up, shifting along, and flexing back down, the robot can slowly make its way along a surface. An Arduino Pro Mini is the brains of the operation, being compact enough to fit on the small robot while still having enough outputs to command the multiple servos required. Control is via a smartphone app, using MIT’s AppInventor platform and the venerable HC-05 Bluetooth module.
It’s a fun build, and we’d love to see it go further with batteries replacing the tether and perhaps some sensors to enable it to further interact with its environment. We’ve seen other creative 3D-printed designs before, too – like this spherical quadruped ‘bot. Video after the break.
If you think about building a moving machine, you probably will consider wheels or tracks or maybe even a prop to take you airborne. When [nwlauer] found an earthworm in the garden, it inspired a 3D-printed robot that employs peristaltic motion. You can see a video of it moving, below.
The robot uses pneumatics and soft plastic, and is apparently waterproof. Your printer’s feed path has to be pretty rigid to support flexible filament without jamming. There’s also some PVA filament and silicone tubing involved.
Anyone who worked in the tech field and lived through the Y2K bug era will no doubt recall it as a time seasoned with a confusing mix of fear and optimism and tempered with a healthy dose of panic, as companies rushed to validate that systems would pass the rollover of the millennium without crashing, and to remediate systems that would. The era could well have been called “the COBOL programmers full-employment bug,” as the coders who had built these legacy systems were pulled out of retirement to fix them. Twenty years on and a different bug — the one that causes COVID-19 — is having a similarly stimulative effect on the COBOL programmer market. New Jersey is one state seeking COBOL coders, to deal with the crush of unemployment insurance claims, which are killing the 40-year-old mainframe systems the state’s programs run on. Interestingly, Governor Phil Murphy has only put out a call for volunteers, and will apparently not compensate COBOL coders for their time. I mean, I know people are bored at home and all, but good luck with that.
In another throwback to an earlier time, “The Worm” is back. NASA has decided to revive its “worm” logo, the simple block letter logo that replaced the 50s-era “Meatball” logo, the one with the red chevron bracketing a starfield with an orbiting satellite. NASA switched to the worm, named for the sinuous shape of the letters and which honestly looks like a graphic design student’s last-minute homework assignment, in the 1970s, keeping it in service through the early 1990s when the meatball was favored again. Now it looks like both logos will see service as NASA prepares to return Americans to space on their own launch vehicles.
Looking for a little help advancing the state of your pandemic-related project? A lot of manufacturers are trying to help out as best they can, and many are offering freebies to keep you in the game. Aisler, for one, is offering free PCBs and stencils for COVID-19 prototypes. It looks like their rules are pretty liberal; any free and open-source project that can help with the pandemic in any way qualifies. Hats off to Aisler for doing their part.
And finally, history appears to have been made this week in the amateur radio world with the first direct transatlantic contact on the 70-cm band was made. It seems strange to think that it would take 120 years since transatlantic radio became reduced to practice by the likes of Marconi for this accomplishment to occur, but the 70-cm band is usually limited to line of sight, and transatlantic contacts at 430 MHz are usually done using a satellite as a relay. The contact was between stations FG8OJ on Guadaloupe Island in the Caribbean — who was involved in an earlier, similar record on the 2-meter band — and D4VHF on the Cape Verde Islands off the coast of Africa, and used the digital mode FT8. The 3,867-km contact was likely due to tropospheric ducting, where layers in the atmosphere form a refractive tunnel that can carry VHF and UHF signals much, much further than they usually go. While we’d love to see that record stretched a little more on each end, to make a truly transcontinental contact, it’s still quite an accomplishment, and we congratulate the hams involved.
Researchers from Exodus Intel recently published details on a flaw that exists on several Broadcom WiFi chipsets. It’s estimated to affect nearly 1 Billion devices, from Android to iPhone. Just to name a few in the top list:
Samsung Galaxy from S3 through S8, inclusive
All Samsung Notes3. Nexus 5, 6, 6X and 6P
All iPhones after iPhone 5
So how did this happen? And how does a bug affect so many different devices?
A smart phone nowadays is a very complicated mesh of interconnected chips. Besides the main processor, there are several other secondary processors handling specialized tasks which would otherwise clog up the main CPU. One of those is the WiFi chipset, which is responsible for WiFi radio communications — handling the PHY, MAC and MLME layers. When all the processing is complete, the radio chipset hands data packets over the kernel driver, which runs on the main CPU. This means that the radio chipset itself has to have some considerable data processing power to handle all this work. Alas, with great power comes great responsibility.
Friday saw what looked like the most dangerous ransomware infection to date. The infection known as WannaCry was closing down vital hospital IT systems across the UK canceling major operations and putting lives at risk.
It spread further around the world and almost became a global pandemic. Although machines are still encrypted demanding Bitcoin, one security blogger [MalwareTech] halted the ransomware by accident. As he was analyzing the code he noticed that the malware kept trying to connect to an unregistered domain name “iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com”. So he decided to register the domain to see if he could get some analytics or any information the worm was trying to send home. Instead much to his surprise, this halted the spread of the ransomware. Originally he thought this was some kind of kill switch but after further analysis, it became clear that this was a test hard-coded into the malware which was supposed to detect if it was running in a virtual machine. So by registering the domain name, the ransomware has stopped spreading as it thinks the internet is a giant virtual machine.
Why was the UK’s NHS Hit So Badly?
According to the [BBC] Information obtained by software firm Citrix under Freedom of Information laws in December suggest up to 90% of NHS trusts were still using Windows XP, However NHS Digital says it is a “much smaller number”. Microsoft has rolled out a free security update to Windows XP, Windows 8, and Windows Server 2003 “to protect their customers”. There was much warning about XP no longer receiving updates etc, the 2001 operating system just needs to die however so many programs especially embedded devices rely upon the fact that the OS running is Windows XP, This is a problem that needs sorted sooner rather than later. There is still obvious problems facing the NHS as all outpatients appointment’s have been canceled at London’s Barts Health NHS Trust which happens to be the largest in the country. However [Amber Rudd], Home Secretary, said 97% of NHS trusts were “working as normal” and there was no evidence patient data was affected. Let’s just hope they update their systems and get back to fixing people as soon as they can.
Where Else Was Hit?
There was quite a few other places hit as well as the UK’s NHS including The Sunderland Nissan Plant also in the UK, Spanish telecoms giant Telefonica along with some gas companies in Spain. In the US FedEx was affected, France has seen production in some of it’s Renault factories halted. Finally, Russia reported 1000 governmental computer systems has been hit.
So is this the end for ransomware?
No, this infection was stopped by accident the infected are either still infected or have paid up, had they not included the sloppy code in the first place then who knows what would have happened. Microsoft had rolled out patches but some people/organizations/Governments are lazy and don’t bother to apply them. Keep your computers up to date, Good luck because we think we will be seeing a lot more ransomware malware in the coming years.
[Update WannaCry v. 2.0 has been released without the “kill switch”, We wonder what will happen now. Probably not a lot as the media attention has been quite intense so it may not be that big an infection however there is always a few who live in the land where news doesn’t exist and will go a long their day until BAM! Ransom Ware installed and pockets emptied.]
[Symantec] Reports Hajime seems to be a white hat worm that spreads over telnet in order to secure IoT devices instead of actually doing anything malicious.
[Brian Benchoff] wrote a great article about the Hajime Worm just as the story broke when first discovered back in October last year. At the time, it looked like the beginnings of a malicious IoT botnet out to cause some DDoS trouble. In a crazy turn of events, it now seems that the worm is actually securing devices affected by another major IoT botnet, dubbed Mirai, which has been launching DDoS attacks. More recently a new Mirai variant has been launching application-layer attacks since it’s source code was uploaded to a GitHub account and adapted.
Hajime is a much more complex botnet than Mirai as it is controlled through peer-to-peer propagating commands through infected devices, whilst the latter uses hard-coded addresses for the command and control of the botnet. Hajime can also cloak its self better, managing to hide its self from running processes and hide its files from the device.
The author can open a shell script to any infected machine in the network at any time, and the code is modular, so new capabilities can be added on the fly. It is apparent from the code that a fair amount of development time went into designing this worm.
So where is this all going? So far this is beginning to look like a cyber battle of Good vs Evil. Or it’s a turf war between rival cyber-mafias. Only time will tell.