iOS Bounties, Android Auto-root, and Guy Fawkes Day – WSWiR Episode 168

Nowadays, each week has more information security news that we used to have each month. If you find yourself falling behind, and need a shortcut to stay informed, this is the weekly video for you. Every Monday, I summarize our daily security video from last week.

Today’s episode covers a new Android malware variant, an iOS zero day that’s bad for the industry, a couple hacktivism campaigns, and more. Watch the YouTube video for all the details, and check out the references below to learn more.

(Episode Runtime: 13:13)

Direct YouTube Link: https://www.youtube.com/watch?v=z7Xgnd8CHQ8

EPISODE REFERENCES:

• Monday: 000Webhost has 000 Security – Daily Security Byte EP. 169
  • 13M+ password leaked from popular web hosting company – Forbes
  • Original blog disclosing the 000webhost breach – Troy Hunt
  • 000Webhost’s breach due to outdated PHP – Computer Weekly
• Tuesday: Claimed iOS Bounty is Bad News – Daily Security Byte EP. 170
  • Vulnerability researchers claim a $1M iOS 9.1 hack bounty – Motherboard
  • iOS bounty claimed, but Apple won’t be informed – Wired
  • The original iOS 9 hack bounty – Zerodium
• Wednesday: vBulletin Breach and 0day – Daily Security Byte EP. 171
  • vBulletin’s site and forum software hacked – Ars Technica
  • vBulletin asks users to reset password – vBulletin
  • vBulletin released patch for forum software – vBulletin
  • Researcher discloses his vBulletin RCE vuln – Twitter
    • His actual Pastie disclosure – Pastie
  • Hacker claims responsibility for breach – The Admin Zone
  • Coldzer0 attempts to sell vBulletin 0day – oday.today
  • Video demonstrating the vBulletin exploit –  YouTube
• Thursday: Auto-rooting Android Malware – Daily Security Byte EP. 172
  • Three Android malware families quietly roots phones and digs in – Ars Technica
  • Researcher’s blog post describing these new Android threats – Lookout
• Friday: Guy Fawkes Day Hacktivism – Daily Security Byte EP. 173
  • Anonymous Doxxes 1000 alleged KKK members as part of #OpKKK – ZDNet
  • Anonymous threatens #OpKKK on Nov. 5th: Epic fail – USA Today
  • CWA doxxed more government employees – Motherboard
  • CIA Director hackers break into arrest database – Wired
  • Information about Guy Fawkes night – Wikipedia

EXTRAS:

• 11yr old girl will give you a secure password for $2 – The Telegraph
• CISA passes the Senate despite privacy issues – Wired
• Big tech companies don’t like CISA either – CNN
• EFF unveils vulnerabilities in automatic license plate readers – EFF
• Can humanity build a computer security AI? – TechCrunch
• BGP is still a security risk (nothing new here) – SC Magazine
• Nice article on man-in-the-middle attacks – Network World
• Millions of passwords leaked from a free web hoster – Forbes
• Lots of issues with SSL certificate revocation systems – Phys
  • Google warns Symantec to clean up certificates – Ars Technica
• More browser vulnerabilities allow for zombie cookies –  Ars Technica
• Duuzer trojan seems to target South Korean manufacturing industry – Computer World
• Strengthen your security with passive DNS – Network World
• It’s ok to hack stuff you own for research – Wired
• NSA director says state sponsored attacks increasing – Time
• Tennis star recommends affirmations as passwords – Wired
• Chipped cards get hacked too – Network World
• DARPA keeping an eye on security researchers – Motherboard
• A third of stolen cars in France were hacked – Telegraph
• UK to ban strong encryption on social sites – The Telegraph
• No three arrested in association with the TalkTalk hack – Dark Reading
• Citrix patches some serious (and old) Xen vulnerabilities – The Register
• Researchers collect the $1M iPhone root vulnerability bounty – Forbes
• Zerodium to pay a $1M iOS hack bounty – Motherboard
• Apple doesn’t approve security conference app because of hacking talks – The Register
• Fascinating piece on ex-employees of The Hacking Team – Motherboard
• Will ransomware threaten to disclose your files publicly? – Tripwire Blog
• DMCA exemptions allow hacking for security research – SC Magazine
• British Gas data breach affects 2200 customers – IBTimes
• UK national arrested in association with DroidJack – BBC
• Cyber criminals suck at information security too – The Register
• CCTV (or Linux) botnet DDoSes victims – Incapsala
• Anti-adblocker CDN hijacked and served malicious fake Flash update – The Register
• KeeFarce targets popular password manager – Ars Technica
• Latest Android update fixes 23 vulns including another “Stagefright” – Forbes
• Researchers find new Windows flaw that bypasses EMET – Threatpost
• Cryptowall’s revenue may go to one criminal group – PC World
• Backdoor found in Chinese iOS ad SDK – Threatpost
• UK government wants to increase surveillance – The Intercept
• Tinba still spreading, and targeting Japanese and Russian banks – Threatpost
• FBI is budging a bit on back doors. Servants to the people – Ars Technica
• Longest DDoS attack lasted 320 hours – IT Pro
• Signing malware with valid certs has become an underground service – The Register
• XcodeGhost still lurking, this time on US Appstore – Dark Reading
• Google’s project Zero found 11 vulnerabilities in latest Samsung phone – The Inquirer
• White House reveals the Cybersecurity Strategy Implementation Plan (CSIP) – WhiteHouse.gov
• U.S. Officials targeted by cyber attacks after Iranian hacker’s arrest – Reuters
• Hackers pull heist on a heist video game over microtransactions – Motherboard
• Details surface about two older gambling payment processor breaches – Forbes
• Like the NSA, MI5 uses hacking for investigations – Motherboard
• 14yr old Japanese boy arrested for having the Zeus trojan (video) – NBC News
• Apparently, CIA Director’s email hackers are targeting others – Motherboard
• Good article asking if we learned from Stuxnet – Dark Reading
• Proton email suffers DDoS and pays extortionists $6000 in bitcoin – Forbes
• A look at the person modeled for the CSI:Cyber character – Telegraph
• Finfisher government spyware company still alive and well – Motherboard

— Corey Nachreiner, CISSP (@SecAdept)

YiSpecter iOS Malware – Daily Security Byte EP.154

Another piece of iOS malware is affecting Chinese and Taiwanese users. It works against non-jailbroken devices and uses Apple’s private APIs to hide its malicious activities. Watch today’s video to learn more about it, and what users should do to avoid it.

(Episode Runtime: 3:17)

Direct YouTube Link: https://www.youtube.com/watch?v=1lAUaPeiHCo

EPISODE REFERENCES:

• Detailed YiSpecter iOS malware blog post – Palo Alto Networks
• iOS malware targeting Chinese and Taiwanese users – Wired

— Corey Nachreiner, CISSP (@SecAdept)

XcodeGhost Pwns App Store – Daily Security Byte EP.147

A booby-trapped version of Xcode—Apple’s development toolkit—is spreading on Chinese forums, and adding a malicious backdoor to any app made with it. Watch today’s video to learn more about XcodeGhost, and what developers and users should do to avoid it.

(Episode Runtime: 2:30)

Direct YouTube Link: https://www.youtube.com/watch?v=BC_oyFg7AnA

EPISODE REFERENCES:

• Palo Alto’s posts on XcodeGhost
  •  Original XcodeGhost post – Palo Alto
  • At least 39 App Store apps infected – Palo Alto
  • Malicious XcodeGhost apps can phish and steal passwords – Palo Alto
• What you need to know about Xc0deGhost – Forbes
• Apple removes 344 XcodeGhost apps – Geek
• UPDATE: Apple emails devs to share how to validate Xcode – Apple
• UPDATE 2: Now up to 4000 affected apps in the App Store – BBC

— Corey Nachreiner, CISSP (@SecAdept)

Adult Ransomware and Hacked WhatsApp – WSWiR Episode 164

Do you have little time for security news, but wish you could keep abreast of the latest threats? In that case, our weekly summary video can help. Every Monday, we summarize last week’s infosec news for you, often in under ten minutes.

This week’s show includes Microsoft and Adobe patches, some adult-themed mobile ransomware, and a sneaky new malware command and control technique. Watch the episode below, and don’t forget to glance at the Reference section if you are interested in other news.

(Episode Runtime: 8:44)

Direct YouTube Link: https://www.youtube.com/watch?v=mnJivvR7nRw

EPISODE REFERENCES:

• Monday: N/A
  • Happy Labor Day!
• Tuesday: September Patch Day – Daily Security Byte EP.138
  • Microsoft September Patch Day summary post – Microsoft
  • Quick SANS summary of Microsoft Patch Day – SANS
  • Adobe’s Shockwave Advisory – Adobe
• Wednesday: WhatsApp Hacked – Daily Security Byte EP.139
  • Researcher finds critical flaw in WhatsApp web client – Checkpoint
  • Article describing the WhatsApp vulnerability (best headline) – The Register
• Thursday: Adult Mobile Ransomware – Daily Security Byte EP.140
  • Security group finds adult-themed mobile ransomware – Zscaler
  • Article describing the porn app ransomware – BBC
• Friday: Satellite C&C Channel – Daily Security Byte EP.141
  • Russian attackers use satellite internet to hide C&C – Wired
  • Kaspersky’s research on Satellite-based C&Cs – SecureList

EXTRAS:

• Apple pushes back against US gov. request for user data – NY Times
  • More news on Apple refusing DoJ order to decrypt data – TechDirt
• CopperheadOS: An open source “secure” android distro – Liliputing
• Grey hat researcher wants payment for FireEye 0day flaws – The Register
  • FireEye’s response to new flaws [PDF] – FireEye
  • Cluley’s comments on the FireEye 0day – Graham Cluley Blog
  • FireEye sues researcher to prevent disclosure – Ars Technica
• Using old email clients for security (don’t recommend) – Motherboard
• Researcher discloses critical vulnerability in Kaspersky AV – PC World
• James Clapper thinks the next state threat is data manipulation – The Guardian
• Group finds flaw that allows them to crack Ashley Madison passwords – CynosurePrime
  • Article on how the flaw allows faster bcrypt cracking – Ars Technica
• North Korea allegedly hacked popular South Korean word processor – Business Insider
• An “APT” group used a leaked criminal botnet – PC World
• Researcher hacks the sensors on self-driving cars – Techspot
• Major vulnerabilities in Seagate wireless hard drives – The Inquirer
• Health insurer loses 10M member records – Reuters
• Ashley Madison CTO is suing Krebs for claiming he hacked competitor – TechDirt
• John McAfee is running for president!?! WTH! – The Inquirer
  • His video campaign announcement – YouTube
  • More on why McAfee is running for president – Digital Trends
• Spear phishing is a big threat. Train your employees – Ars Technica
• Akamai reports an increase in DDoS from a particular gang – SC Magazine
• CoreBot includes banking crime modules – ZDNet
• GM took five years to fix an Onstar flaw – Business Insider
• Does GHCQ want simple passwords so they can crack them? – The Guardian
• Get your Google Nexus security updates for September – Android Police

— Corey Nachreiner, CISSP (@SecAdept)

Adult Mobile Ransomware – Daily Security Byte EP.140

Ransomware like Cryptolocker and Cryptowall are already bad enough, costing victims millions in losses. It’s about to get worse… Now there’s ransomware that targets your smartphone and takes embarrassing pictures of you associated with an adult-themed app. The good news is it’s easy to avoid. Watch today’s video to learn more.

(Episode Runtime: 1:46)

Direct YouTube Link: https://www.youtube.com/watch?v=y7CdGQ5yLqI

EPISODE REFERENCES:

• Security group finds adult-themed mobile ransomware – Zscaler
• Article describing the porn app ransomware – BBC

— Corey Nachreiner, CISSP (@SecAdept)

iOS KeyRaider – Daily Security Byte EP.135

The bad news is a new iOS malware variant has stolen the iCloud credentials of 225,000 users. The good news is it only affects jailbroken iOS users. Watch today’s video to learn more about this new threat, and how to avoid it.

(Episode Runtime: 2:07)

Direct YouTube Link: https://www.youtube.com/watch?v=WgouWbav3jA

EPISODE REFERENCES:

• KeyRaider iOS malware targets jailbroken devices – PC World
• Article on iCloud pirates stealing hundreds of thousands of accounts – The Register
• Original researcher blog post on iOS KeyRaider threat – Palo Alto Networks
• How to tell if you’re a KeyRaider victim – BGR

— Corey Nachreiner, CISSP (@SecAdept)

StageFright Affects Most Androids – Daily Security Byte EP.119

Stagefright is a new Android vulnerability that’s serious enough to deserve its fancy marketing name. As one security pundit said, “It’s the Heartbleed of mobile vulnerabilities.” Attackers can leverage this dangerous flaw against 95% of Android devices simply by sending you a text message with a specially crafted file. You don’t even have to interact with the message for the attack to succeed. Watch today’s video to learn what you should do about this issue.

(Episode Runtime: 2:22)

Direct YouTube Link: https://www.youtube.com/watch?v=U9hg5Hx3wRI

EPISODE REFERENCES:

• StageFright: Zimperium discloses a major remote Android vulnerability – Zimperium Blog
• One way to mitigate the StageFright vulnerability – PC World
• How to protect Lollipop devices from StageFright – PC Authority

— Corey Nachreiner, CISSP (@SecAdept)

PowerOffHijack’s a Dud – Daily Security Byte EP.30

Everyone’s hair is on fire about PowerOffHijack, the Android malware that spies on you when you phone is supposed to be off. Guess what? It’s not nearly as bad as it sounds. Check out the video to learn why.

(Episode Runtime: 2:08)

Direct YouTube Link: https://www.youtube.com/watch?v=LPgNZIs9Iq4

EPISODE REFERENCES:

• PowerOffHijack spies when you phone is “off” – Slashgear
• AVG’s source research on PowerOffHjiack – AVG
• The Android PowerOffHijack isn’t as bad as it sounds – Tech Republic

— Corey Nachreiner, CISSP (@SecAdept)

TurboTax Security Scare – Daily Security Byte EP.23

It’s tax time in the US and cyber attackers are already carrying out electronic tax fraud. Learn to protect yourself in today’s video.

(Episode Runtime: 2:13)

Direct YouTube Link: https://www.youtube.com/watch?v=2WyrvBRMZx0

EPISODE REFERENCES:

• Attackers hijack TurboTax accounts to file fake returns – WTVR
• TurboTax investigation the filing fraud reports – Intuit
• TurboTax resumes efiling after finding no breach – Intuit
• News report on TurboTax incident – YouTube

— Corey Nachreiner, CISSP (@SecAdept)

Forbes Forces Malware – Daily Security Byte EP.22

Did you know the Forbes website was serving up targeted malware last December, by exploiting two zero day vulnerabilities? If not, watch the video to learn more.

(Episode Runtime: 2:14)

Direct YouTube Link: https://www.youtube.com/watch?v=nj-S6ss8-dw

EPISODE REFERENCES:

• Targeted Forbes infection went after specific visitors – Reuters
  • iSight blog post on the Forbes watering hole attack – iSight Partners
  • Invincea blog post on the Forbes watering hole – Invincea
• Chained 0day used in Forbes attack (Flash and IE) – Ars Technica

— Corey Nachreiner, CISSP (@SecAdept)