Category Archives: privacy

The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies – Bloomberg

Bloomberg’s big story on alleged China hacking through server hardware implants. If true, it would be an absolutely incredible feat, equivalent in terms of impressiveness to the Stuxnet worm.

The attack by Chinese spies reached almost 30 U.S. companies by compromising America’s technology supply chain.

Source: The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies – Bloomberg

At the moment, Bloomberg seems to double-down on its story with the following statement:

“Bloomberg Businessweek’s investigation is the result of more than a year of reporting, during which we conducted more than 100 interviews,” a spokesperson told BuzzFeed News in response to a series of questions. “Seventeen individual sources, including government officials and insiders at the companies, confirmed the manipulation of hardware and other elements of the attacks. We also published three companies’ full statements, as well as a statement from China’s Ministry of Foreign Affairs. We stand by our story and are confident in our reporting and sources.”

It’ll be interesting to see who’s telling the truth as the story develops. Meanwhile, governments and companies around the world should be in panic mode, as they try to figure out if they are using Supermicro servers, and if so, whether they are affected by the so-called hacking.

(2018-Oct-04) Apple and Amazon both issued strong denials to the claims of the article.

(2018-Oct-04) Separately, Apple and Amazon both issued even stronger statements on their website to set the record straight on the matter.

(2018-Oct-05) Buzzfeed’s coverage of the story also seem to indicate that even senior staff in Apple doesn’t know about the alleged hacks.

(2018-Oct-20) Apple CEO Tim Cook Is Calling For Bloomberg To Retract Its Chinese Spy Chip Story

(2018-Oct-23) Amazon cloud chief Jassy follows Apple in calling for retraction of Chinese spy chip story

Turn Off Your Fitbit, Garmin, Apple Watch GPS NOW!

IOW, location data can be mined for valuable information. The proliferation of sensors in everyday devices and the rapid adoption of IoT has put the spotlight on the problem.

This was all sparked when reports surfaced earlier this year of a fitness-tracking company, Strava, publishing maps showing where users jog, bike and exercise. Since many of its users are members of the military, their jogging routes and other exercises showed exactly where the US has service members around the world, as well as showing their running routes.

Source: Turn Off Your Fitbit, Garmin, Apple Watch GPS NOW!

SingHealth cyberattack: MAS orders financial institutions to tighten customer verification – Channel NewsAsia

Good pre-emptive measure to prevent possible misuse of information from the SingHealth hack.

“With immediate effect, all financial institutions should not rely solely on the types of information stolen (name, NRIC number, address, gender, race, and date of birth) for customer verification,” MAS said in a statement.

“Additional information must be used for verification before undertaking transactions for the customer. This may include, for instance, One-Time Password, PIN, biometrics, last transaction date or amount, etc.”

Source: SingHealth cyberattack: MAS orders financial institutions to tighten customer verification – Channel NewsAsia

Singapore health system hit by ‘most serious breach of personal data’ in cyberattack; PM Lee’s data targeted

This is indeed the most serious cybersecurity breach in Singapore so far. 1.5 million records were exfiltrated. If this were to happen to a private company, the fine for breaching PDPA would surely be significant. While cyber attacks are not uncommon or unexpected, having it happen in a way that affects so many people will surely bring pause to many ongoing and upcoming IT projects in the pipeline.

Source: Singapore health system hit by ‘most serious breach of personal data’ in cyberattack; PM Lee’s data targeted

Maersk Reinstalled 45,000 PCs and 4,000 Servers to Recover From NotPetya Attack

A heroic effort by the IT team from Maersk. But this just goes to show the huge impact that randomware can have on today’s businesses.

The world’s largest container shipping company —A.P. Møller-Maersk— said it recovered from the NotPetya ransomware incident by reinstalling over 4,000 servers, 45,000 PCs, and 2500 applications over the course of ten days in late June and early July 2017.

Source: Maersk Reinstalled 45,000 PCs and 4,000 Servers to Recover From NotPetya Attack

WDMyCloud Multiple Vulnerabilities

Either terrible security practices or malicious intent. Some security research firm found serious backdoor in a range of Western Digital MyCloud devices aimed at personal home or office users.

Several serious security issues were uncovered during my research. Vulnerabilities such as pre auth remote root code execution, as well as a hardcoded backdoor admin account which can NOT be changed. The backdoor also allows for pre auth remote root code execution on the affected device.

WDMyCloud Multiple Vulnerabilities

Related:

Critical flaws revealed to affect most Intel chips since 1995 | ZDNet

Another huge blow for Intel. The critical flaws in Intel processors allow attackers to gain access to the entire memory space, meaning it could read in-memory contents of running apps like password managers, browsers etc.

Most Intel processors and some ARM chips are confirmed to be vulnerable, putting billions of devices at risk of attacks. One of the security researchers said the bugs are “going to haunt us for years.”

Source: Critical flaws revealed to affect most Intel chips since 1995 | ZDNet

Experts can hack most CPUs since 2008 over USB by triggering Intel Management Engine flaw

Gaining full privileged access to the CPU just by plugging in a USB device? This is as serious as it sounds.

Positive Technologies plans to demonstrate at the next Black Hat conference how to hack over USB into Intel Management Engine of most CPUs since 2008.

Source: Experts can hack most CPUs since 2008 over USB by triggering Intel Management Engine flaw

Key Reinstallation Attacks – Breaking WPA2 by forcing nonce reuse

A serious weakness in WPA2 can cause sensitive information transmitted over Wifi to be read. KRACK attack is especially bad news for Android and Linux users.

This website presents the Key Reinstallation Attack (KRACK). It breaks the WPA2 protocol by forcing nonce reuse in encryption algorithms used by Wi-Fi.

via Key Reinstallation Attacks Breaking WPA2 by forcing nonce reuse