Always strive to learn something useful. --Sophocles

Ignoring the fiasco of Friday's Oval Office meeting between the weird old felon, Mascara Lad, and the Honorable President of Ukraine, the Secretary of Trying To Claim He's SoberDefense just gave Putin a lap dance and the cyber keys to the USA.

He ordered the U.S. military Cyber Command to ignore attacks and incursions from Russia. Allegedly the order states that they are to “stand down from all planning against Russia, including offensive digital actions.”

So that's it. With the exception of the NSA, the nation has no cyber defense against Russian attack.

If we ever needed any proof that there are traitors to the nation in the highest echelons of government, you don't have to look any further.

Benedict Arnold, we've got three new names to join you in infamy.

https://gizmodo.com/trumps-defense-secretary-hegseth-orders-cyber-command-to-stand-down-on-all-russia-operations-2000570343

We first need to define what an air-gapped computer is. This is a computer with no external network connection: no ethernet cable (going to an outside connection, could have an internal network that has no outside connections), no modem, no WiFi, odds are that the mouse and keyboard are hard-wired rather than Bluetooth. And it's probably kept in a room that is hardened against radio signal penetration and with no windows.

Secure, right?

Ask the Iranians if their centrifuge facility was secure against IT intrusion.

A nation state actor, most likely Russia, figured out an attack against air-gapped PCs. The vector? USB drives. This is why if you want to really secure your network, you take a tube of epoxy to USB and other ports. The attack was first observed launched against a South Asian embassy in Belarus in 2019. It was since been used against an EU agency in 2022. The toolset is known as GoldenJackel.

The basics are quite simple. Infect a computer of someone whom you know works with the secure system that you want in to. Infect every USB device that they plug in, trusting that eventually said USB flash drive will be plugged into the secure system to transfer information to/from. The air-gapped system now gets infected. Information gets mapped out, written to a USB drive, exfiltrated via a non-secure computer, analyzed by the controllers, and they can plot what to exfiltrate next.

It's an interesting write-up, though it can get a little deep in the weeds. It once again proves that computer security is very hard, and trying to keep ultra-secure environments secure is probably even harder. I'm not sure how you'd improve the security in this scenario, you're going to have to move information in and out of the secure air-gapped system for it to be useful, it's a thorny issue.

There's a joke that the only secure computer has no network connection, no power, and is encased in a block of concrete. Very hard to hack that one!

https://arstechnica.com/security/2024/10/two-never-before-seen-tools-from-same-group-infect-air-gapped-devices/

Because of the age of the vulnerability, there's a good chance that it /may/ have been used in the wild. However, it's not an easy attack to implement. It's more suited for non-home networks as it requires inserting a second DHCP server into the network and implementing a DHCP Option 121, which lets you divert non-encrypted VPN traffic onto the network of your choice. You receive the clear traffic, the person on the VPN sees their traffic as still being on the VPN.

Very interesting!

Even more interesting, Android is the only OS immune to it! Baked in to its DHCP system, it ignores changes to its option 121, so it cannot be spoofed in this manner. Linux, Windows, MacOS, iOS are all potentially vulnerable. Linux users/admins can avoid this apparently by using Network Namespaces, I know nothing about this as I'm pretty minimally fluent when it comes to *nix.

To install an additional DHCP server, you need a proverbial evil admin, and it's probably going to be tricky to hide a second DHCP server from network audits. For home users, unless your WiFi router has been compromised, I don't think there's anything to worry about.

https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/

This is very bad.

SSH is one of the fundamental underpinnings that makes the internet and world wide web fundamentally secure. Well, we now know that it has some serious weaknesses.

What it boils down to is compatibility. There's lots of ways to implement SSH. Think of them as a whole bunch of switches, and each switch is a different implementation. Some are strong, some are not. They're all out there so that if I use Switch A and you use Switch B, we can still talk. Very convenient, but also a bit problematic. What happens if Switch C has some weaknesses to it?

The problem is that in lots of SSH implementations, Switch C is left turned on for ease of compatibility. And unless people know and specifically turn Switch C off, and all the other known weak switches off, then there are exploitable weaknesses.

The bad news? LOTS of systems are vulnerable. From the article: "A scan performed by the researchers found that 77 percent of SSH servers exposed to the Internet support at least one of the vulnerable encryption modes, while 57 percent of them list a vulnerable encryption mode as the preferred choice."

77% support the vulnerable mode and 57% PREFERRED IT? YIKES!

The good news is that it requires a Man In The Middle attack (MITMs), and those are not easy to carry out - but they can be done. The even better news is that the security researchers have released a scanner to let server administrators know if they are vulnerable. Some SSH packages have been patched to fix this issue, others I'm sure are in process. But there is also a likelihood that some implementations are not, or that some servers are not being updated for various reasons and will continue to be vulnerable.

I don't think this represents much of a problem for users, so much as for network administrators. Unless you're a very valuable person and likely to be targeted by hackers or world powers, you're not likely to have the resources to pull this off moved against you. As I said, MITMs are not easy to pull off, and if you're not Pentagon R&D level sort of stuff, you're probably safe. But I expect Apple and Microsoft and the various Linux distros will be patching their SSH bundles to make sure everything is good in the very near future, just to make sure.

Warning about the article: it gets REALLY deep into the SSH weeds, so don't bother with it if you're not already wise into the subject.

https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/

This is starting out with a warning: this article is really, REALLY deep computer security stuff, DO NOT dig into it if you don't have a minimal understanding of network encryption, SSH, RSA, etcetera! YOU WILL BE LOST!

RSA is a pretty much a deprecated encryption technique. While it was good in its day, it's somewhat broken and has been superseded by better methodologies, both because technology moves ever onward and because it's broken. Apparently it's mainly in use in old systems where companies haven't bothered to replace it: 'If it ain't broke, leave it alone', and just haven't budgeted the funds and time to get it done.

People who try to break computer security have found an interesting way to break RSA even worse. They monitor and sit and wait. The first thing that happens when establishing an SSH connection (and other secure types of connections) is a handshake - the computers send a few packets back and forth, exchange keys (encryption certificates), and get to know each other (proverbially). This handshake process is supposed to be encrypted and secured and not easily spied upon. Except sometimes it isn't.

Computers make mistakes. Sometimes the process that encrypts the handshake fails, it can be a memory bit failure, and this can reveal part of one of the private keys that provides the encryption to the handshake. These keys are generated by multiplying very large prime numbers. If you recover one of the keys, you can then recover the other key by dividing by great whomping big prime numbers. Once you break that, you have access to the certificates that created the secure connection and you can now sit in the middle and impersonate all traffic of either host.

This is what people in computer security call BAD.

OpenSSH applied fixes to try to prevent it, but some major vendors, including Cisco, roll their own code and had some pretty bad vulnerabilities to this problem. They might have fixed it, but when you're running closed-source software (where you've written your own code), rather than relying on an open software where there are tons of eyes looking for problems and testing, it's often weaker than the open source version such as OpenSSH.

Interesting times.

No real solid information as to whether or not this has been exploited in the wild as it's really hard to detect interception attacks like this.

https://arstechnica.com/security/2023/11/hackers-can-steal-ssh-cryptographic-keys-in-new-cutting-edge-attack/

This is excellent news. Most of Windows is written in C and C++. Those languages have memory problems. Let's use a simple example. There's a programming construct known as an array, it's sort of an indexed list. Let's say we have an array called MyList(10). It has ten elements to it, what's in them doesn't really matter. What happens when you try to reference element 11?

Usually in the C family of languages, you access the memory 'above' the tenth element and what is returned is undefined: we don't know what it will contain. Maybe it overlaps with the password cache, perhaps it has your banking account number in it.

Now, to be fair to C (personally I hate the C/C++ languages, but I firmly believe in 'to each their own'), later versions have better protection against accessing outside array boundaries and things like that which can cause information to leak.

A while back another programming language came to town, Rust. And it is designed, from the clear page, to have memory protection that will prevent access to element 11 and other buffer/memory issues. Which means that code, properly developed! (always a big problem), will theoretically be safer/more secure than C family languages.

Microsoft is now rewriting some subsystems in the Windows operating system into Rust!!!

This is excellent news. The ability to improve security is always a good thing, and this is the first step in doing it. You simply cannot rewrite the entirety of Windows in Rust in one swell foop, but you can rewrite portions of it - letting you see how it works - and progressively get the whole thing redone eventually!

This is now in an Insider edition of Windows 11, meaning it will eventually see the light of day to all users, and should be completely transparent.

In other Rust news, Linux has started rewriting SUDO into Rust. Sudo is a program that lets an account that does not have administrative permission run admin commands if they have the password for it. A fundamental rule of network security, and computer security in general, is to NEVER let your users run their local machines as administrator! Aside from the fact that it gives them far too much control to utterly screw their machine over - and I've seen it! - if your account with admin permissions gets taken over by malware, that's a leverage point to get into the entire network and subvert it!

Speaking as a system administrator, we see far too many programs that won't work if the user is not an administrator on the machine. The normal vendor solution? Make the user an admin. Usually this is caused by the bad coding practice of the developers having admin access on their computers, which really ticks me off. If a software package only runs as administrator, then it's badly written. We can usually develop some selective permissions to make such software work without giving the user admin, but it's always a PITB.

https://www.thurrott.com/windows/windows-11/282995/first-rust-code-shows-up-in-the-windows-11-kernel

Did you know that the latest in cars have built-in computer networks? It's called a CAN, a Controller Area Network. And thieves have figured out how to exploit it to steal cars!

It's a lot like IOT, the Internet Of Things. Even the headlights in a car can be intelligent devices, I don't want to think about how much those cost to replace! Anyway, thieves have figured out that if they can get access to the CAN, they can tell it to unlock the car, disable the anti-theft interlocks like engine immobilizers, and they are away!

The basic problem is the exact same problem that the Internet has. When the Internet was being developed back in the early days, the engineers trusted in the better angels of humankind, and didn't accept the fact that the world has a ridiculously large number of people who are shitgibbons and enjoy destroying nice things that everyone could enjoy. This resulted in a huge number of exploitable weaknesses in the original internet as every device that connected to it was trusted to be well-behaved and no malice behind it. It didn't take long for that assumption to be disproven and the engineers have been forever trying to make the Internet more secure.

Same problem with CANs. Every device in the car that plugs into it is trusted. No code-signing, no security certificates, so anything that connects to it has full access to the control computer, which probably doesn't have much in the way of security precautions built-in. Override or trick the computer, and you're in.

https://www.theregister.com/2023/04/06/can_injection_attack_car_theft

A group dummied up two simple computer breaks that would not require snooping into a laptop's contents and took it in for repairs after setting up hidden key and mouse loggers to see what the techs did, i.e. were they trustworthy custodians of your data. Half of the 'secret shoppers' were men, half women.

The results weren't terribly encouraging. Granted, the number of shops tested was a very small number.

https://arstechnica.com/information-technology/2022/11/half-of-computer-repairs-result-in-snooping-of-sensitive-data-study-finds/

The upshot is that if you must take your computer in for repairs, your best way to defend your data would be to encrypt your user data or documents directory. Many of these shops "required" or tried to brow beat you into giving them your account credentials - even on a battery replacement, which does not require log-on access to the computer!

If you're not comfortable with encryption, and I can't blame you, it's not risk-free, copy all your data to an external hard drive or two (or a cloud account), delete it, empty the recycle bin or trash can or equivalent, then run a disk compression or empty space wiper to make sure they can't get in and try to recover any photos from your system.

Of course, if your computer is completely borked and will not boot reliably enough for you to boot it to encrypt it or clean it, you're screwed and at the mercy of the shop.

Social media programs are tricky. Lots of people have their browsers remember their logins, so just logging out of the account and closing the browser isn't enough. You can export your bookmarks easily to an external device or even email them to yourself, I'm not sure if you can export remembered passwords and then purge them and later re-import them.

Me, I exclusively use web mail like Gmail or Outlook. Those are easy to sign out from, but you then need to delete cookies and have the browser delete the cookies, and that's mildly tricky for the uninitiated. If you're using an actual email client program, then you need to either encrypt your mail bag and close the program so that a password is required, or remove the data and program entirely.

There's two other ways to go. Create a dummy account with no data in it that has no admin capability. That doesn't do you any good if they need to do a malware cleanup or install system-level software for you - then they need an admin account. If you have to give them an admin-level password, then all your data is compromised regardless. You can simply say "I want to stand here and watch you work, I will enter the password as needed." Or you can say, "Screw you, I'm taking my business elsewhere" and leave.

Requiring a password to change a battery is massively beyond ridiculous.

The first one was a doozie. A guy from Nigeria - actually from Nigeria, but he was no prince, created a ransomware scheme where he tried to recruit disgruntled employees to deploy ransomware from INSIDE corporate networks for a cut of the ransom! He was a student who wanted to create his own social media company but had no money and no job, thus no resources to start the operation.

So why not kickstart the money through a crime spree!

He's been arrested by Nigerian authorities. Another problem with having no money is the inability to pay off cops to avoid arrest.

Now, here's the really funny bit. Brian Krebs, former Washington Post reporter, who now solely writes about cybercrime and computer security, wrote about this guy when he launched his scheme. His identity wasn't known at that point. Krebs' web site is Krebsonsecurity.com. This scammer accused him of defaming his operation calling him Mister Krebson. :-) I thought that was hilarious! Guy clearly didn't do his homework on the people investigating him. He apparently wasn't difficult to take down.

https://krebsonsecurity.com/2021/11/arrest-in-ransom-your-employer-email-scheme/


The second story is quite good, but I just have to ask: WHY THE [BLEEP BLANKETY-BLANK] DIDN'T YOU IDIOTS DO THIS TWENTY YEARS AGO? I knew default passwords were a bad idea then, why are you just now coming around to this idea?!!!

The UK Parliament is passing an act that will require most, not all, devices that connect to the internet to not have weak/embedded passwords. Basically, when you get a device (WiFi router, web cam, thermostat, whatever) you MUST change the password on it and it cannot be reset to a factory default password.

Why?

Aside from the fact that it's a stupid and easily-prevented security hole, a British internet provider sent out thousands of WiFi routers with the same simple password, trusting that the users would change it when they set it up. Yeah, right. So rectal haberdashers went around, using these free WiFi hotspots (once you knew what the password was and how to find hotspots where the SSID is not broadcasted) to download childporn, leading to a lot of innocent people being raided by the police because their router was insecure.

From the article:
The Product Security and Telecommunications Infrastructure Bill lays out three new rules:

-easy-to-guess default passwords preloaded on devices are banned. All products now need unique passwords that cannot be reset to factory default
-customers must be told when they buy a device the minimum time it will receive vital security updates and patches. If a product doesn't get either, that must also be disclosed
-security researchers will be given a public point of contact to point out flaws and bugs

That last item will be a pain to implement, it's something that has been clamored for in the security community for ages. There's no standard for that so the implementation is going to be very uneven if it's not codified AND regularly updated! I've seen stories on Krebs and Schnier.com where security researchers have found proof, not just evidence, that a company's network has been compromised, but they haven't been able to reach anyone in the company's IT department to report it!

There are specific exceptions to the act of certain types of devices that are exempt. Still, progress!

https://www.bbc.com/news/technology-59400762


I do some computer installation work for a couple of very small companies in my area, people who are too intimidated to replace their own router. And that's fine, I'm happy to help them, and I make a few bucks on the side. I give them a strong password, it's written down for them, and I record the password in a protected file on my phone so when I'm working with them again later, I've got records in my pocket.

For the iPhone, I use a program called mSecure. I think it cost me $5-10 to buy, it has very strong encryption. If it's not available for the Android universe, I'm sure there's something similar.

This is quite amusing and interesting.

Their bitcoin stash was seized and emptied. Their DDoS operation was seized: they used this to throw denial of service attacks at people whom they'd already hit with ransomware attacks who weren't paying up. Basically their infrastructure was taken from them and destroyed. No information who did this.

They closed up shop, and if I'm reading this article correctly, they released the decrpyt keys to everyone they'd encrypted but who hadn't paid yet.

Very strange things afoot.

One thing the article mentions is the "REvil Ransomware-as-a-service Platform." That's right, if you have the connections and the money, you can become a ransomware entrepreneur and go around perpetuating this shit and become rich and infamous. It is possible that the REvil people said 'No, you do not screw with major infrastructure, bad boys!' and had the means to tear them apart, or dropped a dime to law enforcement and turned them in. REvil is a pretty big org, and they certainly have the means to tear apart one of their franchise operators.

https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/


Colonial paid a $5,000,000 ransom shortly after the incident happened to try and restore service as soon as they could. And they received a working de-crypt key promptly. The problem is, with the high levels of encryption that these ransomware packages apply, decryption of vast levels of data take a long time, so Colonial also started doing restores from backup while also decrypting, attacking the problem from two points at the same time.

There are multiple problems with ransomware, paying it or not. If you don't pay it, you have to rebuild your infrastructure from scratch and hope your backups are good. Smart people in IT have a saying that we're fond of that that if you don't test your backups by doing a restore, then you don't have a backup. And a lot of companies that get hit by ransomware all of a sudden find out that they don't have backups. I worked with one such company that got hit by ransomware: turns out they'd been having backup problems and just couldn't be bothered trying to resolve them, too busy.

Plus, the criminals have developed another layer to their model. They have to infiltrate your network to place the encryption software and launch it. So while they're there, they hit your email server and documents directories and exfiltrate that information, they also look for corporate secret stuff like blueprints and things. Lots of companies have secrets that they would rather were not exposed to the light of day, like that $1,000 gadget that everyone is buying that only costs $75 to make, or the CEO's perversity for 14 year olds? Things like that. So if the company doesn't pay the ransom and starts rebuilding, they then come back and double the ransom demand and threaten to dump this dirty laundry in the open press.

And then there's the problem with those that pay and become the victim of poor-quality criminals. They don't hear from the criminals and don't receive a decrypt key or program, or the key will not work, or they demand another ransom and it turns into escalating extortion.

The REvil people try to keep the criminals using their service operating professionally so that if you're hit by a REvil ransomware infection, you know that if you pay the ransom, you'll get your data back. I think it's a good chance that REvil took down DarkSide or dropped a dime and provided critical information for DarkSide's downfall.

We might know some day.


I'm not writing a lot about cybercrime because it's just too damn common. I could spend all my waking hours writing about it, just like I could spend all my time writing about politics. It's just not worth it. I quit working in IT, and I'm staying quit, though I'm still keeping abreast of some of the better blogs and web sites.