Tag: security

Intel Planning To End Legacy BIOS Support By 2020, Report Says

Michael Larabel, writing for Phoronix: Intel is planning to end “legacy BIOS” support in their new platforms by 2020 in requiring UEFI Class 3 or higher. Making rounds this weekend is a slide deck from the recent UEFI Plugfest. Brian Richardson of Intel talked about the “last mile” barriers to removing legacy BIOS support from systems. By 2020, they will be supporting no less than UEFI Class 3, which means only UEFI support and no more legacy BIOS or CSM compatibility support mode. But that’s not going to force on UEFI Secure Boot unconditionally: Secure Boot enabled is considered UEFI Class 3+. Intel hasn’t removed legacy BIOS / CSM support yet due to many customers’ software packages still relying upon legacy BIOS, among other reasons. Removing the legacy BIOS support will mitigate some security risks, needs less validation by vendors, allows for supporting more modern technologies, etc. Read more of this story at Slashdot.

View the original here:
Intel Planning To End Legacy BIOS Support By 2020, Report Says

Apple pushes out iOS 11.1.1 to fix annoying autocorrect bug

Apple gave its mobile software a facelift when it released iOS 11 back in September, but bugs led the company to push out an 11.1 update a month later to protect user security from that WPA2 Krack vulnerability. Turns out that version introduced another set of squirrely issues, which has led Apple to release iOS 11.1.1 today. You can finally say goodbye to that stupid autocorrect bug switching out the letter ‘i’ for all manner of gibberish. The update also addresses an issue where the ‘Hey Siri’ feature occasionally stops working. And…that’s it. Even the security content is the same as the 11.1 release, meaning Apple pushed this update out just to fix these two issues. Consider your outrage heard, given that Apple could have waited to fix until the forthcoming 11.2 update; Reportedly, some GPS issues with the iPhone 8 and iPhone X are fixed in the 11.2 beta. Via: Ars Technica Source: Apple

See original article:
Apple pushes out iOS 11.1.1 to fix annoying autocorrect bug

Linux Has a USB Driver Security Problem

Catalin Cimpanu, reporting for BleepingComputer: USB drivers included in the Linux kernel are rife with security flaws that in some cases can be exploited to run untrusted code and take over users’ computers. The vast majority of these vulnerabilities came to light on Monday, when Google security expert Andrey Konovalov informed the Linux community of 14 vulnerabilities he found in the Linux kernel USB subsystem. “All of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine, ” Konovalov said. The 14 flaws are actually part of a larger list of 79 flaws Konovalov found in Linux kernel USB drivers during the past months. Not all of these 79 vulnerabilities have been reported, let alone patched. Most are simple DoS (Denial of Service) bugs that freeze or restart the OS, but some allow attackers to elevate privileges and execute malicious code. Read more of this story at Slashdot.

View article:
Linux Has a USB Driver Security Problem

MINIX: Intel’s Hidden In-chip Operating System

Steven J. Vaughan-Nichols, writing for ZDNet: Matthew Garrett, the well-known Linux and security developer who works for Google, explained recently that, “Intel chipsets for some years have included a Management Engine [ME], a small microprocessor that runs independently of the main CPU and operating system. Various pieces of software run on the ME, ranging from code to handle media DRM to an implementation of a TPM. AMT [Active Management Technology] is another piece of software running on the ME.” At a presentation at Embedded Linux Conference Europe, Ronald Minnich, a Google software engineer reported that systems using Intel chips that have AMT, are running MINIX. So, what’s it doing in Intel chips? A lot. These processors are running a closed-source variation of the open-source MINIX 3. We don’t know exactly what version or how it’s been modified since we don’t have the source code. In addition, thanks to Minnich and his fellow researchers’ work, MINIX is running on three separate x86 cores on modern chips. There, it’s running: TCP/IP networking stacks (4 and 6), file systems, drivers (disk, net, USB, mouse), web servers. MINIX also has access to your passwords. It can also reimage your computer’s firmware even if it’s powered off. Let me repeat that. If your computer is “off” but still plugged in, MINIX can still potentially change your computer’s fundamental settings. And, for even more fun, it “can implement self-modifying code that can persist across power cycles.” So, if an exploit happens here, even if you unplug your server in one last desperate attempt to save it, the attack will still be there waiting for you when you plug it back in. How? MINIX can do all this because it runs at a fundamentally lower level. According to Minnich, “there are big giant holes that people can drive exploits through.” He continued, “Are you scared yet? If you’re not scared yet, maybe I didn’t explain it very well, because I sure am scared.” Also read: Andrew S. Tanenbaum’s (a professor of Computer Science at Vrije Universiteit) open letter to Intel. Read more of this story at Slashdot.

View original post here:
MINIX: Intel’s Hidden In-chip Operating System

Student Charged By FBI For Hacking His Grades More Than 90 times

An anonymous reader shares a report: In college, you can use your time to study. Or then again, you could perhaps rely on the Hand of God. And when I say “Hand of God, ” what I really mean is “keylogger.” Think of it like the “Nimble Fingers of God.” “Hand of God” (that makes sense) and “pineapple” (???) are two of the nicknames allegedly used to refer to keyloggers used by a former University of Iowa wrestler and student who was arrested last week on federal computer-hacking charges in a high-tech cheating scheme. According to the New York Times, Trevor Graves, 22, is accused in an FBI affidavit of working with an unnamed accomplice to secretly plug keyloggers into university computers in classrooms and in labs. The FBI says keyloggers allowed Graves to record whatever his professors typed, including credentials to log into university grading and email systems. Court documents allege that Graves intercepted exams and test questions in advance and repeatedly changed grades on tests, quizzes and homework assignments. This went on for 21 months — between March 2015 and December 2016. The scheme was discovered when a professor noticed that a number of Graves’ grades had been changed without her authorization. She reported it to campus IT security officials. Read more of this story at Slashdot.

Continued here:
Student Charged By FBI For Hacking His Grades More Than 90 times

New VibWrite System Uses Finger Vibrations To Authenticate Users

An anonymous reader quotes a report from Bleeping Computer: Rutgers engineers have created a new authentication system called VibWrite. The system relies on placing an inexpensive vibration motor and receiver on a solid surface, such as wood, metal, plastic, glass, etc.. The motor sends vibrations to the receiver. When the user touches the surface with one of his fingers, the vibration waves are modified to create a unique signature per user and per finger. Rutgers researchers say that VibWrite is more secure when users are asked to draw a pattern or enter a code on a PIN pad drawn on the solid surface. This also generates a unique fingerprint, but far more complex than just touching the surface with one finger. During two tests, VibWrite verified users with a 95% accuracy and a 3% false positive rate. The only problem researchers encountered in the live trials was that some users had to draw the pattern or enter the PIN number several times before they passed the VibWrite authentication test. Besides improvements to the accuracy with which VibWrite can detect finger vibrations, researchers also plan to look into how VibWrite will behave in outdoor environments to account for varying temperatures, humidity, winds, wetness, dust, dirt, and other conditions. This new novel user authentication system is described in full in a research paper entitled “VibWrite: Towards Finger-input Authentication on Ubiquitous Surfaces via Physical Vibration.” Read more of this story at Slashdot.

View post:
New VibWrite System Uses Finger Vibrations To Authenticate Users

Kaspersky Admits To Reaping Hacking Tools From NSA Employee PC

Kaspersky has acknowledged that code belonging to the US National Security Agency (NSA) was lifted from a PC for analysis but insists the theft was not intentional. From a report: In October, a report from the Wall Street Journal claimed that in 2015, the Russian firm targeted an employee of the NSA known for working on the intelligence agency’s hacking tools and software. The story suggested that the unnamed employee took classified materials home and operated on their PC, which was running Kaspersky’s antivirus software. Once these secretive files were identified — through an avenue carved by the antivirus — the Russian government was then able to obtain this information. Kaspersky has denied any wrongdoing, but the allegation that the firm was working covertly with the Russian government was enough to ensure Kaspersky products were banned on federal networks. There was a number of theories relating to what actually took place — was Kaspersky deliberately targeting NSA employees on behalf of the Kremlin, did an external threat actor exploit a zero-day vulnerability in Kaspersky’s antivirus, or were the files detected and pulled by accident? According to Kaspersky, the latter is true. On Wednesday, the Moscow-based firm said in a statement that the results of a preliminary investigation have produced a rough timeline of how the incident took place. It was actually a year earlier than the WSJ believed, in 2014, that code belonging to the NSA’s Equation Group was taken. Read more of this story at Slashdot.

Read the original post:
Kaspersky Admits To Reaping Hacking Tools From NSA Employee PC

Kaspersky says it briefly possessed classified NSA files

Earlier this month, reports surfaced that classified NSA documents detailing how US agencies defend their cyber networks and how they breach foreign ones were stolen by Russian hackers in 2015. Those reports noted that the files were spotted through Kaspersky security software used by an NSA contractor who had saved the classified documents on a home computer. Well, Kaspersky has now provided some more information about the incident and it has acknowledged that it did in fact have classified NSA materials in its possession, the Associated Press reports. The company’s founder, Eugene Kaspersky, said that in 2014, Kaspersky analysts informed him that their software had plucked some classified files from an NSA contractor’s computer. Kaspersky said it was immediately clear what needed to be done — the materials had to be deleted. And so they were. However, whether the files in question were obtained purposefully or as a result of normal functions of the security software is still up in the air. As Kaspersky tells it, the company was already tracking a team of hackers called the Equation Group, which was later revealed to be part of the NSA. The NSA contractor that exposed the files had run Kaspersky software on his computer after infecting it with a bootleg copy of Microsoft Office and while the software cleaned up the viruses, it was also triggered by the Equation Group materials stored on the contractor’s computer. Those were then sent to Kaspersky headquarters for evaluation and as soon as analysts saw that the files were classified NSA documents, they alerted Eugene Kaspersky and subsequently deleted the files. Releasing this information is part of Kaspersky Lab’s recent push towards transparency as mistrust in the US has mounted over the past few months. Best Buy pulled Kaspersky software from its shelves last month and the US government banned the software in all federal agencies. Earlier this year, the FBI was reportedly discouraging private companies from using Kaspersky products, which have been a focus in government investigations of late and an interest of both the Senate and House of Representatives . Earlier this week, in order to regain some trust, Kaspersky announced that it would allow its source code to be reviewed by third parties and would open three “transparency centers” around the world. Jake Williams, a cybersecurity expert and former NSA analyst, told the AP that because Kaspersky was trying to woo US government clients at the time, it made sense that it would have chosen to delete the files. “It makes sense that they pulled those up and looked at the classification marking and then deleted them, ” he said. “I can see where it’s so toxic you may not want it on your systems.” However, he added the fact that an NSA employee put classified material on an already compromised home computer was “absolutely wild.” Source: Associated Press

Link:
Kaspersky says it briefly possessed classified NSA files

Worker who snuck NSA malware home had his PC backdoored, Kaspersky says

Enlarge (credit: Kaspersky Lab) An NSA worker who reportedly snuck classified materials out of the agency stored them on a home computer that was later infected by a malicious backdoor that allowed third-parties to remotely access the machine, officials with Moscow-based antivirus provider Kaspersky Lab said. The NSA worker—described in some published reports as a contractor and in others as an employee—installed the backdoor after Kaspersky AV had first detected never-before-seen NSA malware samples on his computer. The backdoor was part of a pirated software package that the worker downloaded and installed. To run the pirated software, he first had to disable the AV program on his computer. After being infected, the worker re-enabled the AV program and scanned his computer multiple times, resulting in Kaspersky developing detections for new and unknown variants of the NSA malware. The NSA worker’s computer ran a home version of Kaspersky AV that had enabled a voluntary service known as Kaspersky Security Network . When turned on, KSN automatically uploads new and previously unknown malware to company Kaspersky Lab servers. The setting eventually caused the previously undetected NSA malware to be uploaded to Kaspersky Lab servers, where it was then reviewed by a company analyst. Read 9 remaining paragraphs | Comments

View article:
Worker who snuck NSA malware home had his PC backdoored, Kaspersky says

Millions of high-security crypto keys crippled by newly discovered flaw

Enlarge / 750,000 Estonian cards that look like this use a 2048-bit RSA key that can be factored in a matter of days. (credit: Steve Jurvetson ) A crippling flaw in a widely used code library has fatally undermined the security of millions of encryption keys used in some of the highest-stakes settings, including national identity cards, software- and application-signing, and trusted platform modules protecting government and corporate computers. The weakness allows attackers to calculate the private portion of any vulnerable key using nothing more than the corresponding public portion. Hackers can then use the private key to impersonate key owners, decrypt sensitive data, sneak malicious code into digitally signed software, and bypass protections that prevent accessing or tampering with stolen PCs. The five-year-old flaw is also troubling because it’s located in code that complies with two internationally recognized security certification standards that are binding on many governments, contractors, and companies around the world. The code library was developed by German chipmaker Infineon and has been generating weak keys since 2012 at the latest. The flaw is the one Estonia’s government obliquely referred to last month when it warned that 750,000 digital IDs issued since 2014 were vulnerable to attack . Estonian officials said they were closing the ID card public key database to prevent abuse. Last week, Microsoft , Google , and Infineon all warned how the weakness can impair the protections built into TPM products that ironically enough are designed to give an additional measure of security to high-target individuals and organizations. Read 18 remaining paragraphs | Comments

Read the original post:
Millions of high-security crypto keys crippled by newly discovered flaw