DOUG. Honeypots, patches and the passing of an icon.
All that and extra on the Bare Safety podcast.
[MUSICAL MODEM]
Welcome to the podcast, all people.
I’m Doug Aamoth; he’s Paul Ducklin.
Paul, how do you do?
DUCK. Very nicely, Douglas.
Welcome again out of your trip!
DOUG. It’s good to be again… I do have a bit of shock for you.
We begin the present with the This Week in Tech Historical past phase, and a few weeks there are such a lot of doable matters to select from (just a bit peek backstage for everybody) that we have now to shuttle and resolve which one we’re going to decide on.
So I took the freedom of constructing a Subject Wheel that we will spin, and no matter subject it lands on…
…that’s the subject we talk about.
On the wheel this week, we have now a ton of matters.
We’ve acquired the primary laptop conference, the Altar Conference in 1976; we’ve acquired the Melissa virus from 1999; we’ve acquired the primary lengthy distance telephone name in 1884; the invention of the phototransistor in 1950; the revealing of the UNIVAC in 1951; the primary metropolis to go to full electrical lighting in 1880; and Microsoft Bob in 1995.
So I’m simply going to provide the wheel a spin, and wherever it lands – that’s the subject.
[SPINS WHEEL]
[FX: Click-click-click-click]
DUCK. That is Wheel of Fortune stuff, is it?
DOUG. Sure.
Wheel is spinning…
[FX: Click-click-click (gradually slowing down)]
DUCK. I do know the place I need it to cease, Doug!
DOUG. And it has landed on [EXCITED] the Melissa virus!
[FX: Dramatic chord]
It’s proper in our wheelhouse….
DUCK. I used to be secretly hoping for Microsoft Bob.
As a result of we have now spoken about it earlier than, and it was an important alternative for me to have a really slight rant/grievance, and to introduce Clippy.
However I can’t point out both of these once more, Doug.
DOUG. Alright, nicely, the wheel has spoken.
This week, in 1999, the world felt the wrath of the Melissa virus, a mass-mailing macro virus concentrating on Microsoft Phrase and Outlook customers.
The message emailed itself, together with a poisoned Phrase doc, to the primary 50 folks within the sufferer’s Outlook contact record, whereas on the similar time disabling protecting options of each packages.
The Melissa virus was finally related to David L. Smith of New Jersey, who spent 20 months in federal jail and paid a $5,000 high-quality.
And Paul, you have been there, man.
DUCK. [SIGHS] Oh, expensive, sure.
This wasn’t the primary mailing malware – we’ve already spoken about CHRISTMAS EXEC haven’t we, which was 10 years earlier than that, on IBM mainframes.
However this was an indication that now we have been all related, and lots of us have been utilizing Microsoft Phrase with its macro programming language, and we have been relying closely on e mail…
…issues may go a bit pear-shaped if there was a virus.
The issue was it wasn’t 50 folks, it was the primary 50 *addresses*.
Most individuals ,someplace shortly after Aamoth, Doug and Aardvark, Christopher had any person known as, for instance, All Customers, or one thing to that impact.
[LAUGHTER]
So, sure, it was a completely large factor.
It had a Bart Simpson reference, didn’t it?
DOUG. Sure… KWYJIBO. [FAKE SCRABBLE WORD ONCE USED BY BART SIMPSON]
DUCK. Often it could really stick that right into a doc, wouldn’t it?
David Smith fell foul of the regulation as a result of he fairly merely ought to have predicted the extent of disruption that it prompted.
So, as you say, 20 months in federal jail, and the start of a dramatic period of mass-mailing malware.
DOUG. Alright, let’s transfer from macros to Moore.
Relaxation in peace, Gordon Moore, 94 years younger, Paul.
In Memoriam – Gordon Moore, who put the extra in “Moore’s Legislation”
DUCK. Sure.
I had an odd dialog over the weekend once I ran into somebody over espresso they usually mentioned, “Oh, what have you ever been doing on the weekend thus far?”
I mentioned, “Really, I’ve simply been at work; I used to be writing an RIP, an In Memoriam piece for a really, very well-known particular person within the IT business. Gordon Moore has died at 94.”
And this particular person checked out me and mentioned, “Oh, I’ve by no means heard of him.”
DOUG. [LOUD GASP OF DISBELIEF]
DUCK. And I mentioned, “However you’ve heard of Moore’s Legislation?”
“Oh, sure, in fact. Moore’s Legislation, I learn about that.”
And I mentioned, “Nicely, similar Moore.”
And so I hope they rushed off to learn the article!
I republished the graphs that he put in his unique little piece that led to Moore’s Legislation.
That was earlier than he based Intel, really.
DOUG. Sure, he was a lot… extra, if you happen to catch my drift.
DUCK. [NOT QUITE AS AMUSED AS DOUG HOPED] Sure.
It’s an interesting little paper.
It was printed in… primarily in a well-liked journal as a brief piece – only a few pages in Electronics journal in 1965.
It was virtually jocular in that he was saying, “You understand what we’ve observed at Fairchild?” [COMPANY CO-FOUNDED BY MOORE BEFORE INTEL]
In 1962-63-64-65, if you happen to take the variety of transistors on the chips that we’re constructing every time (the chips are roughly the identical dimension), and you’re taking the logarithm base 2 of the variety of transistors, and also you draw a graph, you get a straight line.
Which implies exponential progress.
In different phrases, you may’t simply preserve making the chips larger and greater and greater as a result of they begin failing…
..it’s a must to discover ways to change the manufacturing course of as nicely, so you may principally get extra transistors in there.
And the paper is known as Cramming extra Parts onto Built-in Circuits. [LAUGHTER]
Actually cramming extra in.
And also you see that, by 1975, 10 years into the longer term, it could recommend that you simply might need single circuits that would have as many as 65,000 (or 216) transistors on them, Douglas.
Unbelievable.
That was his idea about how we’d innovate.
It didn’t fairly work out like that… by 1975, he mentioned, “It doesn’t seem like the doubling yearly goes to proceed, however it might be roughly doubling each two years.”
And though we haven’t fairly doubled each two years, we’re not far off.
As a result of if you happen to go from 1978, when the 8086 got here out, that had about 215 transistors on it.
And 22 doublings (44 years) later, the Apple M2 chip got here out, so that ought to have roughly 237 transistors on it, which is nicely over 100 billion.
Isn’t that not possible?
Not far off: 20 billion transistors on an Apple M2 chip.
Amazingly prescient, Doug.
DOUG. Certainly.
Alright. The Home windows 10 Snip & Sketch app has been patched, and the Home windows 11 Snipping Software has been patched.
Microsoft assigns CVE to Snipping Software bug, pushes patch to Retailer
DUCK. Simply to revisit, in case you missed this story, this began with a bug within the Google Pixel picture cropping instrument.
You can crop a picture (a photograph or a screenshot that you simply already had on the telephone), and simply hit [Save] over the unique, and also you’d get the model new file…
…adopted by the leftover content material from the earlier picture.
Which you wouldn’t discover once you loaded the picture again, as a result of inside the information that was written again over the outdated file is a marker that claims, “You may cease right here.”
So a tester who cropped a file and loaded it again would discover that it regarded right, however it doubtlessly had left-over cropped information.
So it’s precisely the bug you don’t need, isn’t it?
Google Pixel telephones had a critical information leakage bug – right here’s what to do!
And, in fact, the bug was nothing particular to Google, or Pixel telephones, or Android programming, or Java run-time libraries.
It seems that some Home windows picture and screenshot cropping instruments had precisely the identical bug, albeit for various causes.
What we don’t know, Doug, is what number of *different* apps of this kind (they is probably not picture editors; they is perhaps video editors or audio editors, or no matter) have an identical type of downside.
If you happen to go to Microsoft Retailer and also you go and replace your Snipping Software, you’re going to get a model that not behaves this manner.
And in case you have Home windows 10, what’s it known as there, Doug?
DOUG. Snip & Sketch.
I’m completely happy to report I do use the Snipping Software on a regular basis, and I’m completely happy to report that mine has been up to date.
I didn’t do it manually, so it both acquired rolled right into a earlier replace or was up to date routinely.
But it surely’s all the time good to test.
DUCK. Sure, we put a hyperlink to Microsoft’s article about it, together with the brand new model numbers to search for, within the Bare Safety article.
As a result of, Doug, I didn’t fairly agree with Microsoft’s evaluation of this.
I don’t know what you thought…
They mentioned it was a low severity bug as a result of, and I’m quoting, “Profitable exploitation requires unusual consumer interplay and several other components exterior of an attacker’s management”.
And the issue to me with that assertion is that this isn’t about somebody attacking you or attempting to trick you into revealing a picture that you simply didn’t intend to.
The issue is that you simply’re enhancing the picture particularly to take away one thing that you simply don’t need in there, and the information that you simply visibly had eliminated *didn’t get eliminated*.
DOUG. Talking of eradicating issues, we have now one thing known as [GRUFF VOICE] Operation PowerOFF.
Is it truthful to name this a DDoS honeypot?
Cops use faux DDoS providers to take goal at wannabe cybercriminals
DUCK. I feel it’s, Doug.
It’s a multinational factor – so far as I do know, a minimum of the FBI, the Dutch police, the German Bundeskriminalamt, and the UK’s Nationwide Crime Company are concerned on this.
So far as I do know, he concept is to try to present what you may name “excessive stress discouragement” to children who suppose it could be cool to hang around on the fringes of cybercrime. [LAUGHTER]
It appears fairly nicely established that numerous children who wish to dip their toes within the water of working on the Darkish Aspect are inclined to get drawn in direction of what are known as DDoS (or booter, or stresser) providers.
And these are pay-as-you-go providers run by different crooks, the place you may primarily take vengeance on somebody’s web site.
You don’t fling malware at it; you don’t try to hack into it; you don’t try to steal information.
So it seems like a really low degree of criminality: “I’m simply paying to have a complete load of random computer systems world wide gang up on an internet site, ask for the homepage all on the similar time and it gained’t have the ability to cope. And that’ll train them.”
And so, as you say, what Operation PowerOFF was about… was primarily a honeypot.
“Hey, are you interested by entering into booting and stressing? Are you toying on the fringes of cybercrime? Enroll right here!”
And naturally, you weren’t signing up with cybercrooks; you have been really signing up with the cops.
And after a short while, when sufficient folks have signed up, then the positioning abruptly goes lifeless and then you definately get contacted…
…and also you get to have, how can I put it, a “particular dialogue” [LAUGHTER], which I feel is supposed to dissuade you from doing this.
As humorous because it might sound to you, neither the proprietor of the positioning, nor the police, nor the magistrates are going to seek out it amusing if you happen to get hauled into courtroom, as a result of it does have an effect on folks’s companies and their livelihoods.
And the opposite factor that the cops say that they’re eager to do is basically stitching some form of discord among the many cybercrime group.
Once you join one among these darkish net providers, how are you aware whether or not you’re signing up with fellow criminals, or with undercover cops?
DOUG. That is the hazard of when folks hear about botnets or zombie networks…
…perhaps an outdated laptop I’ve that’s unpatched, that’s turned on in my closet or no matter and I’m not likely listening to.
If it may be leveraged right into a bot community or a zombie community, it may be used for issues like this.
Despite the fact that I don’t imply to, and I don’t wish to take any website down, if I’ve an contaminated laptop, it may be used for stuff like this.
DUCK. Completely.
That’s why, if you happen to’re nonetheless operating XP, if you happen to haven’t patched your own home router for 3 years…
…you’re a part of the issue, not the answer.
As a result of your laptop or your router might be used on this means.
DOUG. With reference to time-wasting, lest you suppose penetration testing is a waste of time, we’ve acquired a penetration testing win for e-commerce big WooCommerce.
WooCommerce Funds plugin for WordPress has an admin-level gap – patch now!
DUCK. Sure – luckily, that’s the best way spherical it labored.
They haven’t disclosed any actual particulars concerning the bug, for apparent causes, as a result of then anybody who hasn’t patched… you’d be making a gift of the key for folks to leap in.
It seems like an unauthenticated distant code execution the place you would set off some PHP script, and whilst you have been about it, you would seize admin privileges on the positioning.
Now, if somebody’s breaking into your WordPress website they usually may then abruptly begin placing up bogus hyperlinks or printing faux information, that’s unhealthy sufficient.
However when the WordPress website you’re speaking about is the truth is one which offers with on-line funds, which is what WooCommerce is all about, then it will get very critical certainly!
As you say, luckily this was disclosed responsibly, and it was patched.
WordPress and the Automattic group (the individuals who run WordPress) have been knowledgeable, and for most individuals, patches have been pushed out routinely.
But it surely’s actually vital, if you happen to run a WooCommerce website, that you simply go and ensure you’re updated.
As a result of if you happen to aren’t, there’s a chance that crooks might come searching for this backdoor gap that permits them to get admin entry.
And, in fact, as soon as they’re in, they’ll get all kinds of stuff, together with hashed login passwords, and what are referred to as API keys or authentication tokens.
In different phrases, these magic strings of characters that you could put in future net requests that mean you can work together with the positioning as if you happen to have been pre-authorised.
DOUG. And the way will we really feel concerning the verbiage?
These passwords have been salted and hashed, so “it’s unlikely that your password was compromised”.
How does that make the hair on the again of your neck?
Is it standing up or is it nonetheless mendacity down?
DUCK. You set it extra dramatically than I used to be prepared to do in print within the article, Doug… [LAUGHTER]
…however I feel you’ve hit the nail on the top.
DOUG. Sure, I’m going to alter my password simply in case.
DUCK. Sure, they type of mentioned, “Nicely, the passwords have been hashed.”
They didn’t say precisely how, they usually didn’t give any particulars of how laborious it is perhaps to crack them by attempting a large dictionary towards them.
They usually mentioned, “So that you most likely don’t want to alter your password.”
Certainly this can be a superb motive to alter your password?
The thought of hashing passwords is that if they get stolen, the truth that the hashes do want cracking first, and that may take days, weeks or months and even years…
…it offers all people time to go and alter their passwords.
So I might have thought they’d simply say, “Go and alter your password.”
The truth is, I used to be virtually anticipating to see these bizarre phrases “out of an abundance of warning”, Doug!
DOUG. Sure, precisely. [LAUGHTER]
DUCK. So I don’t agree with that.
I feel that is *precisely* the type of motive why you’ll go and alter your password.
And, as you’ve gotten mentioned many occasions, in case you have a password supervisor and also you solely have to alter one password, it actually needs to be fairly a fast course of.
The one factor WooCommerce did say, and this you completely should do, is that this: you do have to go and invalidate all these so known as API keys.
It is advisable to do away with these and regenerate them for all of the software program that you simply use that interacts along with your WooCommerce accounts.
And WooCommerce have recommendation on how to try this; we’ve put the hyperlink within the Bare Safety article.
DOUG. OK.
And final, however actually not least… I get nice pleasure out of once you do that in a headline; you simply say “Apple patches all the things”, and also you imply all the things.
This features a zero-day repair for iOS 15 customers, as nicely.
Apple patches all the things, together with a zero-day repair for iOS 15 customers
DUCK. Sure, that was the curious a part of it.
There are fixes for the three supported variations of macOS: Huge Sur, Monterey, and Ventura.
There are patches for tvOS and for watchOS.
There’s even a patch, Doug, for the Apple Studio Show…
DOUG. [LAUGHING] After all!
DUCK. …which is a cool, groovy display screen, as a result of it’s not only a display screen, it’s acquired a webcam and every kind of stuff in there.
It’s a must to plug the display screen in with a view to apply the patch.
It principally downloads the firmware into your display screen.
The bug within the firmware on the display screen may permit a criminal to achieve into the working system in your Mac and really get kernel degree code execution entry.
DOUG. Oooh, that’s unhealthy.
DUCK. That’s fairly bizarre, isn’t it? [LAUGHS]
However the outlier, or the super-important replace, was for iOS 15.
These of you’ve gotten older iPhones and iPads: their updates embrace a WebKit zero-day, a distant code execution assault that some crooks, someplace, are already exploiting.
So if you happen to’ve acquired an older iPhone and also you’re operating iOS 15, completely it’s “Don’t delay/Do it right this moment”.
However I might advocate that for something you’ve acquired that has the Apple brand on it.
As a result of, once you have a look at the vary of bugs that they’ve (luckily) proactively fastened, they do cowl a variety of sins.
So that they embrace issues like (as we mentioned with the show) kernel degree distant code execution; information stealing; the flexibility to ship a boobyptrapped Bluetooth packet that then lets the attacker snoop in your different Bluetooth information; the flexibility to bypass Apple obtain quarantine checks; and an intriguing bug that simply says “Unauthorized entry to your Hidden Images album”.
I’ve not used the Hidden Images album, however I think about they’re the pictures that you simply want to preserve, however you undoubtedly don’t need anybody else to see!
DOUG. [IRONIC] In all probability, sure. [LAUGHTER]
DUCK. The trace’s within the identify, Doug. [LAUGHTER]
And likewise a bug regarding luring you to a booby-trapped web site, after which your shopping habits is perhaps tracked on-line.
So, a number of good causes to use the patches.
DOUG. Alright, and we’ve acquired a really highly effective but succinct remark, because it’s time to listen to from one among our readers on the Bare Safety podcast.
And at first I used to be very tickled by this remark, however then I acquired to pondering, “In case you have a bunch of various Apple units; if you happen to’re an Apple particular person… it’s really laborious to trace all these bugs.”
Paul, you do an excellent job of simply getting them multi function place for folks to see.
And on this Apple article, Bare Safety reader Bart feedback, and I quote: “Thanks.”
DUCK. I want to consider that remark figuratively, if not actually, as being two phrases, as a result of it’s “Thanks. Excalamtion mark.”
DOUG. [LAUGHS] I did depart that out of the quote…
DUCK. As you say, all of it will get a bit bitty on Apple’s website, since you click on on one hyperlink and also you suppose, “Oh, golly, I ponder what’s the vital stuff right here?”
So the explanation for writing them up on Bare Safety is to try to distill that info, of which there’s pages and pages and pages, into an inventory of hyperlinks multi function place that really offers you the model quantity you want after you’ve finished the replace (so you may confirm that you simply’ve acquired it) *and* one thing that tells you, “Listed below are the actually, actually vital issues; listed here are the bugs that the crooks are already exploiting; these are the bugs that the crooks may have discovered, however luckily, if you happen to patch, you will get forward.”
DOUG. Alright, thanks very a lot, Bart, for sending that in.
And in case you have an fascinating story, remark or query or… I suppose, on this case, an interjection you’d wish to submit, we’d like to learn on the podcast.
DUCK. [DELIGHTED] That’s *precisely* the a part of speech that it’s, isn’t it?
DOUG. It’s… an interjection!
It reveals pleasure or emotion. [LAUGHS]
DUCK. Or each!
DOUG. Or each. [LAUGHS]
You may e mail suggestions@sophos.com, you may touch upon one among our articles, or hit us up on social: @nakedsecurity.
That’s our present for right this moment; thanks very a lot for listening.
For Paul Ducklin, I’m Doug Aamoth, reminding you till subsequent time to…
BOTH. Keep safe.
[MUSICAL MODEM]