July 12, 2020

this week in security — july 12 edition

|MC_PREVIEW_TEXT|

~this week in security~ a cybersecurity newsletter by @zackwhittaker (https://twitter.com/zackwhittaker)

volume 3, issue 28

View this email in your browser (|ARCHIVE|)

~ ~

** THIS WEEK, TL;DR

U.S. tech giants halt Hong Kong police help (https://www.wsj.com/articles/whatsapp-to-suspend-processing-law-enforcement-requests-for-user-data-in-hong-kong-11594034580) Wall Street Journal ($): Google, Facebook, Microsoft, Twitter, and TikTok have all suspended processing government demands for user data from Hong Kong authorities, a week after the Beijing-imposed national security law went into effect. The law, among other things, gives Hong Kong police new powers (https://twitter.com/factal/status/1280157212070023168?s=21) to conduct warrantless searches of user data. But one noticeable outlier (https://fortune.com/2020/07/09/apple-hong-kong-new-security-law/) is Apple, which relies on China to build its phones and laptops. Apple said it was “assessing the new law.” One might ask, what’s to assess? More: Fortune (https://fortune.com/2020/07/09/apple-hong-kong-new-security-law/) | TechCrunch (https://techcrunch.com/2020/07/06/facebook-whatsapp-hong-kong-data/)

U.S. Cyber Command backs ‘urgent’ patch for F5 security flaw (https://www.cyberscoop.com/cyber-command-f5-security-flaw/) Cyberscoop: Here’s a major bug in widely used networking gear which, if you haven’t patched your enterprise environment, you’re probably already a victim, according to @CISAKrebs (https://twitter.com/CISAKrebs/status/1279851810094800902) . A bug in F5 Networks’ BIG-IP gear could result in a “complete system compromise,” which also means a compromise of your network. Wired ($) (https://www.wired.com/story/f5-big-ip-networking-vulnerability/) called it a “five-alarm bug,” indicating its severity. More: Wired ($) (https://www.wired.com/story/f5-big-ip-networking-vulnerability/) | US-CERT (https://us-cert.cisa.gov/ncas/current-activity/2020/07/04/f5-releases-security-advisory-big-ip-tmui-rce-vulnerability-cve) | @CISAKrebs (https://twitter.com/CISAKrebs/status/1279851810094800902)

Smartwatch hack could send fake pill reminders to patients (https://www.bbc.com/news/technology-53333633) BBC News: Filed under “how a smartwatch could kill you” — seriously! One popular white-label smartwatch is designed to help elderly people and dementia patients, but the watch’s back-end system was a hot mess and flawed in a number of ways. Worst case, anyone with access to the hardcoded token(!) in the source code and the API could send spoofed “take pills” alerts to the phone as many times as they wanted. The researchers got the bugs fixed amid fears that “an overdose could easily result.” More: Pen Test Partners (https://www.pentestpartners.com/security-blog/hacking-smart-devices-to-convince-dementia-sufferers-to-overdose/) Police are buying access to hacked website data (https://www.vice.com/en_us/article/3azvey/police-buying-hacked-data-spycloud?) Motherboard: In what’s been described as an “end-run around the usual legal process,” police are buying gobs of breached data — passwords, email addresses and more — to help investigative leads. The source of that data is SpyCloud, a company that claims it is “turning the criminals’ data against them.” SpyCloud claims the data can be used to “unmask specific criminals and their personas.” Democratic senator Ron Wyden says he’s planning (https://www.vice.com/en_us/article/889m4b/senator-wyden-stop-agencies-buying-data-warrant) to introduce a new law to make this kind of unwarranted access unlawful. More: Motherboard (https://www.vice.com/en_us/article/889m4b/senator-wyden-stop-agencies-buying-data-warrant)

Microsoft seized domains used in COVID-19-themed cyberattacks (https://techcrunch.com/2020/07/07/microsoft-domains-covid-19-attacks/) TechCrunch: A U.S. federal court has allowed Microsoft to seize and take over a number of malicious domains used in a large-scale business email compromise (BEC) attack targeting victims in dozens of countries. These BEC hacks are simple but effective — break into an email of someone important in a company and then send an email impersonating the email account owner to trick staff to reroute wire transfers or send along employee W-2 tax forms. It’s a $1.7 billion business, according to the FBI. Microsoft took control (https://blogs.microsoft.com/on-the-issues/2020/07/07/digital-crimes-unit-covid-19-cybercrime/?=monday-july-6-2020) of the domains and sinkholed them to collect information about the operation. (Disclosure: I wrote this story. More: Microsoft (https://blogs.microsoft.com/on-the-issues/2020/07/07/digital-crimes-unit-covid-19-cybercrime/?=monday-july-6-2020) | Complaint [PDF] (https://www.documentcloud.org/documents/6982255-Microsoft-BEC-complaint.html)

Police spied on protests using Twitter-owned startup Dataminr (https://theintercept.com/2020/07/09/twitter-dataminr-police-spy-surveillance-black-lives-matter-protests/) The Intercept: Police used Dataminr, a startup owned and run by Twitter, which flags newsworthy tweets about current events, to snoop on protesters’ tweets. Journalists use Dataminr all the time for spotting breaking news. But cops were also using the service, including the embattled Minneapolis Police Department, to track tweets from protests sparked in the wake of the death of George Floyd. Many of the tweets were flagged as “peaceful protests.” More: @matt_cagle (https://twitter.com/Matt_Cagle/status/1281652677173145600) ~ ~ SUPPORT THIS NEWSLETTER

A big thank you to everyone who reads this newsletter! If you can spare $1/month (or more for perks (https://www.patreon.com/posts/mugs-are-on-way-32666051) !), it helps to maintain its upkeep. Contribute to the Patreon here (https://www.patreon.com/thisweekinsecurity) ! ~ ~

** THE STUFF YOU MIGHT’VE MISSED

L.A. transport boss accused of hiding messages for controversial tracking program (https://www.dailynews.com/2020/07/05/ladot-general-manager-used-encrypted-messaging-for-controversial-tracking-program/) Los Angeles Daily News: The general manager for L.A.’s transportation division is accused of using Signal, which has an option to auto-delete messages, while planning a controversial vehicle tracking program across the city, one that has Uber and the ACLU suing the city. The paper said the use of Signal, although secure, isn’t compatible with the city’s data retention and public records laws. It’s a pretty interesting article and raises a lot of questions about public records — one that most folks don’t think about.

Robocall ban stands, Supreme Court rules (https://www.politico.com/news/2020/07/06/robocall-ban-supreme-court-349840) Politico: The U.S. Supreme Court ruled this week that a ban on unsolicited robocalls to cell phones can stand, defeating political consultants and the debt collection industry who challenged the law. The Supreme Court said that the carveout that let debt collectors make unsolicited calls was unconstitutional, so the justices ripped that out of the law and kept the rest of the ban in place. Harsh, but fair.

The hidden trackers in your phone, explained (https://www.vox.com/recode/2020/7/8/21311533/sdks-tracking-data-location) Recode: I know a ton of us know that our personal data gets sucked up by the apps on our phones and sent to advertisers, but do you really know how it works and what you can do to mitigate that massive data collection? Recode’s @SaraMorrison (https://twitter.com/SaraMorrison?) has a great in-depth and detailed look at the hidden trackers in your phone and how those apps spy on you.

How to ‘unc0ver’ a zero-day in four hours or less (https://googleprojectzero.blogspot.com/2020/07/how-to-unc0ver-0-day-in-4-hours-or-less.html) Google Project Zero: Within hours of the unc0ver jailbreak (https://techcrunch.com/2020/05/23/hackers-iphone-new-jailbreak/) for iOS 13.5 dropping online, Google’s elite hacking and security research unit pulled the vulnerability used to carry out the jailbreak apart. Within a few hours, the researchers reported it to Apple, which fixed it a few days later. This highly technical blog post details how the bug was found.

Signal’s new PIN feature worries cybersecurity experts (https://www.vice.com/en_us/article/pkyzek/signal-new-pin-feature-worries-cybersecurity-experts) Motherboard: Signal has a new PIN feature, which aims to help move Signal away from cellphone numbers as a means of contacting people. It also means that users can recover their contacts, settings, and conversations quicker. But cybersecurity experts say this is a bad move for privacy, and could potentially be used by police to extract data from Signal’s servers. @lorenzoFB (https://twitter.com/lorenzofb) does a good job of dissecting the issue and what it means for users. Also check out Signal founder @moxie (https://twitter.com/moxie/status/1281353114063257600) ‘s tweets on the matter. ~ ~

** OTHER NEWSY NUGGETS

Clearview AI bounces from Canada amid investigation (https://priv.gc.ca/en/opc-news/news-and-announcements/2020/nr-c_200706/) Controversial facial recognition startup Clearview AI is pulling out of Canada “in response” to an investigation launched by the Office of the Privacy Commissioner, which oversees the country’s privacy legislation. The company had an existing contract with the Royal Canadian Mounted Police. But the Commissioner’s investigation will continue on, as it looks into whether the company collected and used personal information without consent.

Dozens of experts and companies write open letter opposing anti-encryption bill (https://www.globalencryption.org/open-letter-against-laed-act/) Over 75 global cybersecurity experts, civil society organizations, companies, and trade associations have signed on to an open letter against the new U.S. anti-encryption bill, the Lawful Access to Encrypted Data (LAED) Act, introduced a couple of weeks ago.

Another day, another Zoom security issue found (https://www.cyberscoop.com/zoom-zero-day-windows-7-acros/) Zoom users on Windows 7 beware: a new, previously undiscovered bug that could allow a hacker to remotely take control of an affected computer. Details of the bug can be found here (https://blog.0patch.com/2020/07/remote-code-execution-vulnerability-in.html) . Update your Zoom app, as a fix is available. ~ ~

** THE HAPPY CORNER

Some good news from the week:

The Electronic Frontier Foundation (congrats on your 30th birthday, by the way) has announced new members (https://www.eff.org/deeplinks/2020/07/coalition-against-stalkerware-expands-membership) to its Coalition Against Stalkerware, a group of companies that are fighting the mobile spyware industry. “The coalition is especially excited about adding organizations in India and Uganda, because stalkerware is a global problem that requires global solutions beyond the countries and regions represented by the coalition’s founding organizations,” writes @evacide (https://twitter.com/evacide) .

Four years ago, @Tarah (http://twitter.com/tarah) wrote Women In Tech (https://www.amazon.com/Women-Tech-Practical-Inspiring-Stories-ebook/dp/B010ZZYJSI/ref=as_li_ss_tl?ie=UTF8&linkCode=sl1&tag=tarwhevanvlas-20&linkId=e7c7c916cdc573fcc13e3afe3e9c5a0c&language=en_US) , a book with stories and advice on how to grow your career. It also came with a ton of hidden puzzles and codes, which have finally been cracked. She explains more (and the answers!) in her latest blog post (https://medium.com/@tarah/yes-there-was-a-hidden-epic-cryptographic-puzzle-story-inside-my-book-women-in-tech-9ad6f2f43dbf) .

Riot Games, which makes League of Legends, buried an Easter Egg (https://www.vice.com/en_us/article/4ayne3/valorant-riot-games-hidden-message-anti-cheat-code-recruiting-hackers?) in its anti-cheat system in an effort to try to recruit hackers. And finally, if you ever wanted to learn (or needed to check) an HTTP status code but also like cats, HTTP Cats (https://http.cat/) is the site for you. Pretty sure 408: Request Timeout (https://http.cat/408) is my favorite. If you want to nominate some good news from the week, feel free to reach out (mailto:this@weekinsecurity.com?subject=Good%20news%20for%20your%20newsletter) . ~ ~

** THIS WEEK’S CYBER CAT

This week’s cyber cat is Misty. According to her human, Misty is still new to her family but certainly uses social engineering techniques to maximum effect when she wants belly rubs or treats. You make us proud, Misty. A big thanks to @NoTheOtherNick (https://twitter.com/NoTheOtherNick) for the submission! Please keep sending in your cyber cats! We’re low on supply! You can email them in here (mailto:this@weekinsecurity.com?subject=Cyber%20Cat%20submission&body=Please%20include%20a%20JPG%20of%20your%20cyber%20cat%2C%20their%20name%2C%20and%20also%20your%20name%20and%20Twitter%20handle%20if%20you%20want%20credit.) . ~ ~

** SUGGESTION BOX

And that’s a wrap. A big thanks as always for reading. Please keep any feedback you might have — you can drop it in the suggestion box (https://docs.google.com/forms/d/e/1FAIpQLSebkpf8z8TvMJoixuSzmrR-CTLcOv_ufF7voso1HZBI_f5zrw/viewform) . Have a happy and healthy week, folks. See you Sunday.

============================================================ |IFNOT:ARCHIVE_PAGE| |LIST:DESCRIPTION|

Our mailing address is: |LIST_ADDRESS| |END:IF| You can update your preferences (|UPDATE_PROFILE|) or unsubscribe from this list (|UNSUB|) .