Search This Blog

Showing posts with label Apple. Show all posts

Apple's Find My Network: Can be Abused to Leak Secrets Via Passing Devices

 

Apple's Find My network, which is used to track iOS and macOS devices – as well as more recently AirTags and other kits – has been revealed to be a possible espionage tool. 

In brief, passing Apple devices can be used to send data over the air from one location to another, such as a computer on the other side of the world, without the need for any other network connection. 

Using Bluetooth Low Energy (BLE) broadcasts and a microcontroller designed to act as a modem, Fabian Bräunlein, co-founder of Positive Security, invented a way to send a limited amount of arbitrary data to Apple's iCloud servers from devices without an internet connection. A Mac application can then download the data from the cloud. He dubbed his proof-of-concept service Send My in a blog post on Wednesday. 

When activated in Apple devices, the Find My network acts as a crowdsourced location-tracking system. Participating devices transmit over BLE to other nearby Apple devices, which then relay data back to Cupertino's servers via their network link. Authorized device owners can then use the company's iCloud-based Find My iPhone or iOS/macOS Find My app to get location reports on enrolled hardware. 

Researchers from Germany's Technical University of Darmstadt – Alexander Heinrich, Milan Stute, Tim Kornhuber, and Matthias Hollick – released an overview of Apple's Find My network's protection and privacy in March, uncovering a few issues along the way. 

Bräunlein's aim was to see if the Find My network could be exploited to send arbitrary data from devices that didn't have access to the internet. "Such a technique could be employed by small sensors in uncontrolled environments to avoid the cost and power consumption of mobile internet," he states. "It could also be interesting for exfiltrating data from Faraday-shielded sites that are occasionally visited by iPhone users." Since he didn't find any rate-limiting mechanism for the number of location reports devices can send over the Find My network, he theorizes that his strategy may be used to deplete smartphone users' data plans. 

With each report being more than 100 bytes, broadcasting a large number of unique public encryption keys as part of the Find My protocol would increase the amount of mobile traffic sent. Bräunlein used an ESP32 microcontroller with OpenHaystack-based firmware to transmit a hardcoded default message and listen for new data on its serial interface for his data exfiltration scheme. These signals will be picked up by nearby Apple devices that have to Find My broadcasting switched on and transferred to Apple's servers. 

In order to satisfy Apple's authentication criteria for accessing location data, obtaining data from a macOS computer necessitates the use of an Apple Mail plugin that runs with elevated privileges. To view the unsanctioned transmission, the user must also install OpenHaystack and run DataFetcher, a macOS app created by Bräunlein.

Apple Covered a Mass Hack on 128 Million iPhone Users in 2015

 

Apple and Epic are now embroiled in a legal dispute, and as a result, some shocking material has surfaced on the internet. Epic recently demonstrated Apple's desire to conquer the industry by deciding not to unleash the iMessage platform on Android. Now, according to a recent email filed in court, Apple decided not to alert 128 million iPhone users of its first-ever mass hack. This was back in 2015 when the iPhone 6s series was first introduced. 

The massive hack was first discovered when researchers discovered 40 malicious App Store applications, which quickly grew to 4,000 as more researchers looked into it. The apps included malware that turned iPhones and iPads into botnets that stole potentially sensitive user data. 

According to an email filed in court last week in Epic Games' litigation against Apple, Apple managers discovered 2,500 malicious apps on September 21, 2015, that had been downloaded a total of 203 million times by 128 million users, 18 million of whom were in the United States. 

“Joz, Tom, and Christine—due to the large number of customers potentially affected, do we want to send an email to all of them?” App Store VP Matthew Fischer wrote, talking to Apple's Greg Joswiak, senior vice president of worldwide communications, and Tom Neumayr and Christine Monaghan, who work in public relations. 

The email continued: "If yes, Dale Bagwell from our Customer Experience team will be on point to manage this on our side. Note that this will pose some challenges in terms of language localizations of the email, since the downloads of these apps took place in a wide variety of App Store storefronts around the world (e.g. we wouldn’t want to send an English-language email to a customer who downloaded one or more of these apps from the Brazil App Store, where Brazilian Portuguese would be the more appropriate language)." 

Bagwell talks about the complexities of notifying all 128 million impacted customers, localizing updates to each user's language, and "accurately including the names of the applications for each client" about 10 hours later. 

Unfortunately, it seems that Apple never carried out its plans. There was no indication that such an email was ever sent, according to an Apple spokesperson. Apple instead released only this now-deleted article, according to statements the representative submitted on background—meaning I'm not allowed to quote them.

'XcodeGhost' Malware Infected Around 128M iOS Users

 

In a recent malware attack over 128 million iOS customers have been targeted. The malware employed by the attackers goes by the name "XcodeGhost" which first came into the public domain in 2015. This attack is responsible for injecting malware into several Apple devices' app stores including iPhone and iPad apps that were subsequently uploaded to the App Store. 

During the Epic Games vs Apple trial, the internal Apple emails have warned that almost 128 million users downloaded approximately 2,500 apps that were infected by the malware which came into existence from the fake copy of Xcode. 

While Motherboard has also reported on the same issue saying over 2,500 infected apps have been downloaded over 203 million times in the App Store. 

Some employer has disclosed that around 55 percent users are Chinese and also 66 percent of downloads relates to China. According to the report, many developers have downloaded the infected Xcode as Apple’s servers were slow, hence they were looking for alternative download links. 

Notably, some of the widely popular apps have also been infected by this malware, including the game ‘Angry Birds 2′. 

When the malware was identified, Apple suggested developers immediately revise their apps with a legal version of Xcode, the report added. 

In the wake of the security incident, Apple has taken several security measures to fix the attack including malware scanning and the security of the Xcode execution process while submitting apps to the App Store. As the legal battle was going on between Apple and Epic Games in the USA this week, new technical details have surfaced, disclosing that Epic Games CEO Tim Sweeney had suggested Apple CEO Tim Cook open their devices to other app stores as early as 2015. 

An Award-Winning iPhone Hack Used by China to Spy on Uyghur Muslims

 

According to a recent article, the Chinese government used an award-winning iPhone hack first uncovered three years ago at a Beijing hacking competition to spy on the phones of Uyghur Muslims. The government was able to successfully tap into the phones of Uyghur Muslims in 2018 using a sophisticated tool, according to a study published Thursday by MIT Technology Review. 

For years, the US government and other major technology firms have recognized that China has been waging a violent campaign against ethnic minorities using social media, phones, and other technologies. The movement also attacked journalists and imitated Uyghur news organizations. 

According to MIT Technology Review report the hacking vulnerability was discovered during the Beijing competition. The Tianfu Cup hacking competition began in November 2018 in China as a way for Chinese hackers to discover vulnerabilities in popular tech software. According to the paper, the competition was modeled after an international festival called Pwn2Own, which attracts hackers from all over the world to show technical bugs so that marketers can discover and patch defects throughout their goods. 

However, China's Tianfu Cup was designed to enable Chinese hackers to show those vulnerabilities without exposing them to the rest of the world. According to the paper, this will enable the Chinese government to use those hacking methods found at the event for their own purposes. 

The very first event took place in November of 2018; Qixun Zhao, a researcher at Qihoo 360, won the top prize of $200,000 for demonstrating a remarkable chain of exploits that helped him to easily and reliably take control of even the newest and most up-to-date iPhones. He discovered a flaw in the kernel of the iPhone's operating system, originating from inside the Safari web browser. 

What's the end result? Any iPhone that accessed a web page containing Qixun's malicious code might be taken over by a remote intruder. It's the type of hack that could be traded on the black market for millions of dollars, allowing hackers or governments to spy on huge groups of people. It was given the name "Chaos" by Qixun. 

Apple patched it two months later, but an analysis revealed that it had been used by the Chinese government to hack Uyghur Muslims' iPhones in the interim. After US surveillance found it and confirmed it to Apple, the company released a low-key press release acknowledging it, but the full scale of it wasn't understood until now.

App Census Study Reveals that Android Devices Leak User Data Stored in Contact Tracing Applications

 

According to security experts, hundreds of third-party applications on Android devices have access to confidential information collected by Google and Apple API contact-tracking devices. The Department of Homeland Security provided about $200,000 to App Census, a U.S. start-up that specializes in data protection practices in Android applications, earlier this year for testing and validating the reliability of contact tracking apps. 

The researchers of the business observed that the primary contact tracking information inside the device's system logs are recorded by Android Phones logging data from applications that use Google and Apple's Exposure Notifications System (ENS), that is used for collecting details, and usually where applications receive usage analytics and malfunction reports data. 

In an effort to assist medical authorities around the globe to develop contact tracing apps associated with the data protection requirement underlying the Android and iOS ecosystems, Google and Apple jointly launched ENS last year. API built by Apple and Google allows governments to build decentralized Bluetooth-based contact tracking software. 

The app-equipped devices send confidential, regularly changing IDs, known as RPIs, that are diffused via Bluetooth in such a way that nearby telephones that also use the application can be "heard". 

The observations of App Census reveal that the two Tech Giants' privacy pledge has certain deficiencies. Both transmitted and heard RPIs can indeed be identified in the machine logs of Android phones – as well as the device even records the existing Bluetooth MAC address of the destination server on RPIs that have been heard. Thus App Census found many ways of using and computing datasets to conduct data protection attacks since the RPI and the Bluetooth MAC addresses are unique and anonymized.

"Of course, the information has to be logged somewhere to do the contact-tracing, but that should be internally in the ENS," Gaetan Leurent, a researcher at the French National Institute for Research in Digital Science and Technology (INRIA), stated. "It is unsettling that this information was stored in the system log. There is no good reason to put it there." 

The RPIs could have been used along with different pieces of datasets to determine that whether users checked for COVID-19 positively, whether they had contacted an infectious individual or whether two persons met each other with access to device registers from multiple users. It is meant to preserve privacy in the contact tracing process, and precisely this type of data should be avoided. Therefore, the entire defense which should form the foundation of this protocol is defeated. 

A Google spokesperson told: "We were notified of an issue where the Bluetooth identifiers were temporarily accessible to some pre-installed applications for debugging purposes. Immediately upon being made aware of this research, we began the necessary process to review the issue, consider mitigations and ultimately update the code." 

The spokesman added that these Bluetooth identifications neither disclose the location of a customer nor provide any other identifying details, and also they are not aware that they were used in any manner. As per Google, roll started many weeks ago with the upgrade on Android devices and is due to be completed in the coming days. Previous publications of the researcher have shown that irrespective of implementation, the use of digital technology for contact tracking would necessarily present a risk to privacy.

Hackers Attack Apple Prior to Launch Event, Demand Ransom

 

On the day when Apple was ready to declare a new series of products at its Spring Load Event, there happened a leak from an unexpected quarter. The infamous cybercrime gang REvil took the responsibility for stealing data and schematics from Apple's supplier 'Quanta computer' relating unreleased products. The gang also threatened to sell the data to the highest bidder if the target failed to pay a ransom of $50 Million. For the credibility of the attack, the hackers release caches of docs relating to upcoming MacBook Pros. iMac schematics have also been added since the last attacks. 

The suspenseful timing and links to Apple raise controversy about the attack. However, it is also a reflection towards the rising no of disturbing ransomware incidents that appear today. Hackers have evolved through years of developing their mass data encryption techniques to log targets out of their own devices. Presently, these gangs are more focused towards data theft and extortion as their primary means of attacks, while demanding hefty ransoms in the process. 

"Our team is negotiating the sale of large quantities of confidential drawings and gigabytes of personal data with several major brands. We recommend that Apple buy back the available data by May 1," said REvil in the stolen data post. Since the start, ransomware attacks have involved capturing the victim's device, encrypting files, and then demanding ransom through simple transactions, in return for providing the decryption key. 

Now, however, hackers have moved towards a unique approach, along with encrypting the files, they steal files and threaten to leak them, this gives them leverage over their victim, assuring ransom payment. Even if the victim recovers his data, the risk of a hacker leaking his data still persists. The Wired reports, "and in the past couple of years, prominent ransomware gangs like Maze have established the approach. Today incorporating extortion is increasingly the norm. And groups have even taken it a step further, as is the case with REvil and Quanta, focusing completely on data theft and extortion and not bothering to encrypt files at all."

Apple will pay $100 million to Russian hackers for leaking data on new products

Apple's database was hacked due to cybersecurity deficiencies of the Taiwanese equipment manufacturer. The stolen information is estimated at $50 million, and the Russian hacker group is to be blamed.

Quanta, which produces MacBooks and peripherals for Apple, reported hacking of its own system and theft of engineering, production schemes of current and future products. We are talking, in particular, about the Air 2020, M1 2020 model of laptops and an unreleased copy with additional ports.

The group, described as the most dangerous in global cyberspace, REvil, sent an extortion message to Apple with samples of stolen technical files. The hackers are demanding a ransom of $50 million if Quanta pays the full amount by April 27. After that date, the amount will double to $100 million. The message was distributed through the Tor anonymous network connection, protected from eavesdropping.

According to profile portal Bleeping Computer, by Saturday, April 24, REvil had published more than a dozen schematics and diagrams of laptop components on its Darknet leak site. However, no links were found to the fact that the data relate to Apple products.

Quanta confirmed that its servers had been hacked. As Bloomberg reported, Quanta Computer's information security team is working with outside IT experts to review several cyberattacks on a few Quanta servers. The manufacturer says the hack will not significantly affect the company's future operations

The company also said that it has not yet figured out the extent of the leak. The images that leaked to the Net include the schematics of the redesign of the iMac just presented by Apple, which until this situation has not been seen by anyone outside of Apple's sphere of influence. This confirms the fact that the documents are indeed accurate.

Recall that REvil's largest illegal extortion profit was $18 million. The money was anonymously cashed and laundered through a cryptocurrency exchange.

Leaked Apple Schematics & Extortion Threats Removed From Dark Web

 

According to MacRumors, the ransomware group that stole schematics from Apple supplier Quanta Computer last week and threatened to release the trove of documents has mysteriously deleted all references to the extortion attempt from its dark web blog. 

Last Tuesday, the ransomware group REvil claimed that it had gained access to Quanta's internal computers and obtained some photographs and schematics of unreleased Apple products. The group requested $50 million from Quanta in order to retrieve the data. However, according to a statement posted on the hacker group's website on April 20, Quanta declined to pay the ransom, which led the criminals to turn their attention to Apple. 

The hackers publicly posted a handful of images depicting unreleased product schematics, including in total, 21 images showing different features of an alleged upcoming MacBook Pro, an SD card slot, HDMI slot, and a MagSafe charger, to prove they had hacked into Quanta's servers and to increase the pressure on Apple. 

Unless Apple paid the $50 million ransom demand in return for removing the files, the group threatened to publish new data every day leading up to May 1. The extortion attempt was timed to coincide with Apple's "Spring Loaded" digital event on April 20, at which the company unveiled AirTag item trackers, new iPad Pro models, and new iMacs. Despite the threat, after the original demand was made public, no further stolen documents have been leaked online. 

REvil isn't known for bluffing and regularly shares stolen documents if its victims don't pay up, so it's unclear why the group didn't follow through this time. According to MacRumors, the photos were mysteriously deleted from their dark web location. The group has not stated why the photos were deleted, and all references to the blackmail attempt have been removed. 

Apple is still yet to comment on the breach, although it has a history of refusing to deal with hackers. A hacker group tried to extort money from Apple in 2017 by keeping consumer data hostage. "We do not reward cybercriminals for violating the law," Apple told the community, and the company has yet to comment on the breach. 

The group is still aggressively extorting other businesses, so it's unclear what caused it to delete all material related to the Quanta hack.

Apple's AirDrop Comes with a Security Flaw

 

Due to its intriguing features, the much-hyped announcement of AirDrop at the Apple event drew a lot of attention. However, it has recently been discovered that AirDrop has a security loophole that allows users to see personal information such as email addresses and phone numbers. This may result in a data leak affecting over 1.5 billion Apple users, as well as other security concerns. 

According to a study citing researchers from Germany's Technische Universitat Darmstadt, everyone can reach Apple users' email addresses and phone numbers, even if they are strangers, by simply opening the sharing pane on the smartphone and initiating the sharing process. A secure Wi-Fi link and proximity between the two Apple devices are needed to complete this task. 

The researchers discovered a flaw in the Contacts Only setting. You use the iOS Sharing function and choose AirDrop as the method to share a file with anyone via AirDrop. If the other person's AirDrop is set to Contacts Only, Apple must check to see if you're on their contact list. The corporation does this by comparing the contact number and email address to entries in the other person's address book. 

Apple uses a hashing feature to obfuscate your phone number and email address during this process to keep it secure. However, university researchers have already found that this hashing would not effectively preserve the data's privacy. 

“As an attacker, it is possible to learn the phone numbers and email addresses of AirDrop users—even as a complete stranger," the researchers said in the report. "All they require is a Wi-Fi-capable device and physical proximity to a target that initiates the discovery process by opening the sharing pane on an iOS or macOS device.”

The researchers said they developed their own approach, called "PrivateDrop," to replace the insecure AirDrop design. Without needing to swap the insecure hash values, PrivateDrop can easily and safely verify whether you're in a fellow iPhone user's contact list using optimised cryptographic protocols. PrivateDrop is available for third-party review on GitHub.

For the time being, the researchers recommend that users disable AirDrop. To do so on an iPhone or iPad, go to Settings, General, and then press the AirDrop entry. Select Receiving Off from the drop-down menu.

Hackers Demand $50 Million Ransom From Apple

 

A Russian hacking group claims to have obtained schematics for some yet-to-be-released Apple products. The hackers have demanded a $50 million ransom in exchange for not leaking any of the designs they have on hand. 

According to a report by Bloomerg, the group gained access to sensitive data by hacking into Quanta, an Apple supplier that produces MacBooks and other products. The Taiwan-based third-party manufacturer has reported the data leak. 

The threat actors from the hacking group called REvil, first tried to extort money from Quanta in exchange for the stolen data. When Quanta declined to pay to recover the stolen data, the hackers turned their attention to Apple, the company's largest customer. According to a report by The Record, the group announced their intentions in a message posted on a dark website. 

REvil started sharing stolen photographs of Apple products as proof before Apple’s Spring Loaded event that was hosted virtually earlier this week. The hacking group shared 21 screenshots of the newly released iMac's schematics, which had not been made public before the launch. The post thus came as a testament to the legitimacy of the stolen data. 

Aside from iMac pictures, the group also shared images of the M1 MacBook Air, which was released in 2020, and manufacturing diagrams for an unreleased laptop. Notably, all of the diagrams included a disclaimer that read, “This is Apple's property, and it must be returned.” 

The hacking group has threatened to release new data every day before Apple or Quanta pays the $50 million ransom. The group is attempting to receive the ransom by May 1. Besides Apple, Quanta Computer has a long list of clients, including some of the most well-known names in the laptop industry. HP, Dell, Microsoft, Toshiba, LG, Lenovo, and other companies are among them. 

REvil has hinted in a post on the dark web that it has data from other companies as well. The REvil operators wrote, “Our team is negotiating the sale of vast quantities of classified drawings and gigabytes of personal data with many major brands.” 

The implications of the cyber-attack and the resulting data leak are still unclear.

Russian hackers reportedly stole secret device blueprints from Apple

Hackers reportedly gained access to blueprints of the latest Apple developments by attacking the servers of the Taiwanese company Quanta Computer. The announcement of the results of the attack was made in Russian.

One of Apple's main suppliers, the Taiwanese company Quanta Computer, faced a ransomware attack. The hackers demanded to pay them $50 million. Quanta Computer also produces goods for HP, Facebook and Google Alphabet.

The attack was carried out by a group of REvil ransomware operators, also known as Sodinokibi. The group announced the penetration into the computer network of Quanta Computer in its blog on the Darknet. On Sunday, a REvil spokesman, known as Unknown, said the ransomware group would soon announce "the largest attack in history," the message was made in Russian on a channel where the REvil group is recruiting new partners.

Quanta acknowledged the attack without explaining whether data was stolen.

According to the agency, REvil members tried to engage Quanta Computer in ransomware talks in the past week, ahead of Apple's first new product launch in 2021, which took place April 20.

A spokesman for the hackers claimed to have stolen and encrypted "all the local network data," demanding $50 million for the decryption key.

The hackers received a response two days later from a person who said he was "not responsible for the company," but wanted to find out the terms of the interaction. Two days later, a REvil spokesperson threatened to release data about new Apple products. This was followed by the first publication of images, which, according to the hackers, were working materials about new Apple laptops. The materials contained specific component serial numbers, dimensions and performance parameters detailing the many components inside an Apple laptop. One of the images was signed by Apple designer John Andreadis and dated March 9, 2021.

Now REvil is trying to get money from Apple, the group has demanded a ransom by May 1, and until then plans to continue publishing new files every day.

Apple declined to respond to questions about the hack.

Recall, on April 20, Apple held a presentation of its new products, it showed a new generation of iMacs with processors of its own design, iPad Pro tablets, as well as Air Tag tags for tracking the location of objects through the application.

Ransomware Attack by REvil on Apple, Demands $50 Million

 

While Apple was working on the preparations for the 'Spring Loaded' event that went live on Tuesday, 20th April, the company requested a settlement to prevent its next-gen equipment data from being leaked. The REvil Group, also identified as SODINOKIBI, said that it had been able to access the computer network of Apple's Quanta Computer, and has requested $50 million to decrypt its systems, via the Dark Web. Quanta Computer is a major MacBook Air, MacBook Pro supplier. 

The operator of REvil published a blog on its dark website that goes by the name – 'Happy Blog' claiming that Quanta Computer is being a target of a ransomware attack. 

Even though the Hacker Group initially tried to negotiate an agreement with the company, the team allegedly posted details of the upcoming Apple devices before the Spring-Loaded event, following the refusal by Quanta Computer to pay the ransom, as per a blog post. 

Some of the schematic seemingly aligned with the current iMac as well as some new version details were shared by hackers. The Ransomware Operator warned Apple, to repurchase the existing data until 1st May to avoid further leakage. Each day, before Apple buckles up, hackers attempt to threaten to post new files to their site. The organization also said that it is dealing with many big suppliers on the sale of large amounts of classified drawings and gigabytes of personal information. 

“Quanta Computer's information security team has worked with external IT experts in response to cyberattacks on a small number of Quanta servers,” a Quanta Computer spokesperson stated. “We've reported to and kept seamless communications with the relevant law enforcement and data protection authorities concerning recent abnormal activities observed. There's no material impact on the Company's business operation.” 

The representative further stated that the information security defense system was triggered instantly while performing a comprehensive inquiry. The organization has also said its cybersecurity level was revamped and its current infrastructure is improved. 

Quanta also said that they were working on the issue with law enforcement authorities and data protection authorities

Telemetry Data is Being Shared by Google and Apple Despite the user Explicitly Opting out

 

A new study revealing Apple and Google's monitoring of mobile devices is making headlines. It discusses how, despite the fact that both companies give consumers the possibility to opt-out of sharing telemetry data, the data is still shared. Both Google's Pixel and Apple's iPhone extract data from mobile devices without the users' permission. Both iOS and Android transfer telemetry, according to Trinity College researcher Douglas Leith, “despite the user explicitly opting out.” 

The analysis is a component of a complete study titled "Mobile Handset Privacy: Measuring the Data iOS and Android Send to Apple and Google." Perhaps it comes out that Google gathers much more data than Apple, almost 20 times more data from the Android Pixel users. 

“The phone IMEI, hardware serial number, SIM serial number and IMSI, handset phone number etc. are shared with Apple and Google,” as per the report. “When a SIM is inserted, both iOS and Google Android send details to Apple/Google. iOS sends the MAC addresses of nearby devices, e.g. other handsets, and the home gateway, to Apple, together with their GPS location. Currently there are few, if any, realistic options for preventing this data sharing.” 

According to the researcher’s observations, Google Pixel transfers approximately 1MB of data to Google servers during the first ten minutes of operation. For the same duration of time, the iPhone sends about 42KB of data to Apple servers. When the Pixel is turned off, it transfers approximately 1MB of data to Google every 12 hours, whereas the iPhone sends just 52KB. The report also indicated that, whether in use or not, both operating systems link to their back-end servers every 4.5 minutes on average. 

Nevertheless, third-party software and pre-installed apps that come with both the operating system were not included in the evaluations. The study focused solely on data collected by handset features and elements at the operating system level, such as Apple's Bluetooth UniqueChipID, Secure Element ID, and the transmission of Wi-Fi MAC address. Even after not being opened or used by the user, the highlight of the study is the ability of pre-installed applications and services, which are exclusive to handset manufacturers, to connect to the network. 

According to the study, telemetry data transmission poses major privacy issues. The study does highlight the importance of sending general user data to the software manufacturer, as this provides for the creation and release of critical device and security updates for specific models.

Malware Affecting Apple’s New M1 Chip Detected by Researchers

 

MAC malware has relatively been a less popular choice than its equivalents for Windows attacks, but the vulnerability to Apple computers has been more prevalent in the last few years. There are adware and even Mac-customized malware, and attackers still try to bypass Apple's new protections. Hackers have now made their debut in malware programmed to run Apple's latest M1 ARM processors, launched in November for MacBook Pro, MacBook Air, and Mac Mini. 

Apple's M1 chip is a divergence since 2005 from the Intel x86 architecture, which provides Apple a chance to bake some Mac security safeguards and functionality directly to its processors. This transition allowed legitimate developers to create the software version that runs on M1 "natively" and does not require translating via an Apple emulator named Rosetta 2. 

As per a blog published on 14th February by Mac security researcher Patrick Wardle, a Safari adware extension, originally written for Intel x86 chips, was modified to operate on new M1 chips. The malicious GoSearch22 extension has been traced to the Pirrit Mac adware family, according to Wardle. 

Researchers from the Red Canary along with the Pirrit Mac adware have written a blog on another strain of malware – Silver Sparrow – which varies from the one detected by Wardle. Although Silver Sparrow has not yet released malicious packages, the Red Canary researchers have confirmed that they are able to discharge malicious payloads at a time. Silver Sparrow compromised 29,139 macOS endpoints, including the high identification volumes in the U.S.A., the United Kingdom, Canada, France, and Germany, on February 17 in 153 countries, based on data from Malwarebytes given to Red Canary.

Kevin Dunne -President of Greenlight, said malware developers' capability to reverse engineer the M1 chip is only three months. Although the malware only has a minimum footprint, Dunne said that it will likely grow with time to harness more vectors of attack. 

“Once bad actors have control of the physical device, they can use that device as an access point to the networks that machine is connected to, either physically or via VPN,” Dunne said. “This reinforces the need for additional protection at the application layer, to constantly assess activity within those applications for unusual behaviour and mitigate potential risks in real time.”

Malware manufacturers and dealers are developing advanced devices and software with the way they produce and sell them, and so are the legal businesses, Jon Gulley, a security test application at nVisium added. 

For now, researchers have found that the native M1 malware doesn't appear to be an incredibly dangerous threat. However, the advent of these new strains is a sign of the future and of the need for detective devices to close the void.

Google Researcher Groß Identifies the BlastDoor Device in Apple iOS 14

 

Last year, Apple rolled out iOS 14 with many new features, tighter privacy laws, and elements that make the iPhone smarter, introducing to the iPhone and iPad versions a new safety mechanism primarily for the detection of malware attacks from the iMessage network. The BlastDoor Security Sandbox tool was launched in an upgrade to the iOS 14 in September 2020 and discovered that the MacOS 11.1 was running on the M1 powered Mac Mini after reverse engineering and is meant to protect parsing of untrusted data from messaging client iMessage. The service is claimed to be written in swift, a standard memory-safe language that is "significantly harder" for introducing classic vulnerabilities to memory manipulation into the codebase — in this iMessage.

The BlastDoor device, concealed inside iOS 14, has been identified by Samuel Groß, a security researcher with the Project Zero team of Google. The prosecutor wrote a blog post on the scope of the current framework to protect consumers from bad actors.

The main function of BlastDoor is to unpack and process incoming messages in a secure and isolated environment where any malicious code embedded in a message cannot communicate with, disrupt, or recover user data on the underlying operating system. The BlastDoor service only functions for iMessage, so it reads all the obtained data as a connection. When a link is submitted via iMessage, a sample of a webpage will first be made of the sending system and metadata (such as title and page descriptor) gathered until the link is bundled into a folder. This archive is then encrypted and directly submitted to iCloud servers with a temporary key. Once the connection is received, the keys sent to the receiver will be decoded. All this exists inside the operation BlastDoor. 

Since several security analysts had previously found out that the iMessage service did an inadequate job of sanitizing incoming user data, the need for a service such as BlastDoor was evident. In the last three years, several incidents have occurred in which security researchers or real-world attackers have discovered and exploited iMessage Remote Code Execution (RCE) problems to hack them by transmitting a simple email, picture, or video to a computer. 

In 2019, Groß and his fellow security researcher Natalie Silvanovich discovered "zero interaction" faults in iMessage, which could allow attackers to read the contents of iPhone files without any note or message. The BlastDoor device is likely to fix these problems.

Furthermoore, Groß stated in the blog post, "Overall, these changes are probably very close to the best that could've been done given the need for backwards compatibility, and they should have a significant impact on the security of iMessage and the platform as a whole."

Parler on the Verge of Permanent Expulsion

 

Launched in 2018, Parler has become a place of refuge for individuals that have been prohibited or suspended by popular social networks including Facebook and Twitter for abusing those stages guidelines. The Henderson, Nevada–based organization has named itself as a free speech option in contrast to mainstream social networks and adopted a more loosened up approach to content moderation, attracting conspiracy theorists, members of hate groups, and right-wing activists who have transparently induced violence.

Google has suspended US-based microblogging stage Parler, where the majority of the supporters of active President Donald Trump are moving their base from its application store, referring to posts inducing viciousness and requesting strong moderation for heinous content from the social networking service. All the while, Apple had given Parler, the social network supported by conservatives and extremists, an ultimatum to implement a full moderation plan of its platform inside the following 24 hours or face suspension from the App store. 

The move by the two Silicon Valley organizations came the day when Twitter forever suspended Trump's account because of the "danger of additional prompting of viciousness". 

In suspending the service, Google, whose software powers Android telephones, referred to its approach against applications that promote violence and gave recent examples from Parler, including a Friday post that started "How do we take back our country? Around 20 or so coordinated hits" and another promoting "Million Militia March" on Washington. 

"To ensure client security on Google Play, our longstanding strategies require that applications showing user-generated content have moderation policies and implementation that eliminates offensive substance like spots that prompt violence. All developers consent to these terms and we have reminded Parler of this clear policy in recent months," Google said in a statement. 

Meanwhile, Apple in a statement said it has gotten various complaints with respect to the offensive substance in Parler service, allegations that the application was utilized to plan, organize and encourage the criminal operations in Washington DC on January 6 that prompted death toll, various wounds and the devastation of property. 

Matze, who depicts himself as a libertarian, established Parler in 2018 as a "free-speech driven" alternative to mainstream platforms however started seeking right-leaning clients as prominent supporters of Trump moved there. On Parler, John Matze sent out an opposing vibe. "We won't give in to pressure from anti-competitive actors! We will and consistently have authorized our guidelines against brutality and criminal behavior. Yet, we won't cave to politically persuaded organizations and those authoritarians who scorn free speech!" he wrote in a message.

2010-2020 Decade Roundup: 10 Most Frequently Occurred Security Vulnerabilities

 


A decade has come to an end but the security vulnerabilities of this decade in the IT sectors cannot be forgotten. In this article, we will be learning about the 10 most frequently occurred cyber vulnerabilities, which allowed threat actors to breach applications, steal user credentials, and tried to hurt millions at once. 

Understandably, this list will not be enough to enlist all vulnerabilities that strangled the IT world in the entire decade. Hence, in this article, we will be focusing on the vulnerabilities that had affected Unix, Linux, macOS, servers, and cloud computing. 

1. BlueBorne: This security attack occurred via a Bluetooth implementation in Android, iOS, Linux, and Windows. Reports showed that the blueBorne bug had affected over 8.2 billion devices worldwide. It was on 12 September 2017 when the vulnerabilities were reported by Armis, an IoT security firm, for the first time. This bug of affecting many electronic devices such as smartphones, laptops, smart cars, and wearable gadgets. 

2. Badlock: It was on 12 April 2016 when it has been discovered that a crucial security bug is affecting devices with CVE-2016-2118. The security bug that had been found in Microsoft Windows and Samba was affecting the Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) remote protocols supported by Windows and Samba network. 

3. DirtyCow: It was a very serious computer security vulnerability that was found in the Linux kernel. It had affected all Linux-based running devices, such as Android devices but there was an exception, this bug was only affecting those systems that were using older versions of the Linux kernel created before 2018. This bug is a local privilege escalation that exploits a race hazard in the implementation of the copy-on-write tool in the kernel's memory-management subsystem. It must be noted that those computers and devices that still use the older kernels remain vulnerable. 

4. ForShawod: This decade has crippled Modern Intel/AMD processors with many security bugs. L1 Terminal Fault or Foreshadow affects modern microprocessors. The first version discloses sensitive information from PC and cloud network, whereas, the second version targets –Hypervisors (VMM), Virtual machines (VMs), System Management Mode (SMM) memory, and the Operating systems (OS) kernel memory. 

5. Heartbleed: It was a very dangerous cyber attack in the popular OpenSSL cryptographic software library that allowed stealing sensitive information under normal conditions by SSL/TLS encryption which is used to secure the Internet. SSL/TLS provides services such as communication security and privacy over the internet for applications including email, instant messaging (IM), Web, and some virtual private networks (VPNs). After this vulnerability Google had established ‘Project Zero’, its task is to secure the Web and society. 

6. iSeeYou: It was affecting Apple laptops, hackers were leveraging the vulnerability to exploit remote access and taking photographs of a person. Apple’s laptops involved a variety of operating systems, such as macOS, Linux, and Microsoft Windows. Therefore, litigations against this attack vary depending upon the operating system. In response to the discovery of this attack, the organization released iSightDefender to reduce the attack. 

7. Lazy: This security vulnerability affects Intel CPUs. The malicious actor uses this vulnerability to leak the FPU registers’ content which belongs to another process. This vulnerability is associated with Spectre and Meltdown vulnerabilities. Patches such as OpenBSD, Linux, Xen, and others have been released to address the vulnerability. 

8. Linux.Encoder: It is also known as ELF/Filecoder.A and Trojan.Linux.Ransom.A. It is the first ransomware Trojan that targets computers, servers, cloud, and devices functioning Linux. Also, there are additional variants of this Trojan that target Unix and Unix-like systems. 

9. POODLE: This attack is also known as the man-in-the-middle that exploits Internet and security software clients’ fallback to SSL 3.0. Any software which supports a fallback to SSL 3.0 is affected. To overcome its effects people have to disable SSL 3.0 on the client-side and the network-side. Various platforms such as Microsoft, Google, Apple, OpenSSL, and others have released software patches so they can protect their platforms against the POODLE security attack. 

10. Rootpipe: Rootpipe security vulnerability had been seen in OS X that gives privilege escalation. Exploiting security vulnerabilities on a system allows a hacker to gain superuser (root) access and with other bugs on a Mac, such as an unpatched Apache web browser, hackers can take advantage of root pipe to gain complete command of the running system and Apple computers or Network. According to the researchers in November 2017, a similar attack had been seen in macOS High Sierra which was giving easy access to the hackers into the system without a password and root account.

Apple iCloud Outage Caused Setup Issues and Account Activation Failures


On December 25th, Apple users started facing issues in iCloud sign-in in the early morning. The outage that lasted for around 24 hours prevented users from setting up new Apple gadgets and devices; users experienced problems in the activation of Apple Watch, HomePod, iPhone along with several other devices. Reportedly, the problem was caused by an unspecified problem that occurred in Apple's iCloud backend. However, it was only a matter of a day before Apple resolved the issue by the evening of December 26th. 

The problem surfaced around 5 a.m. on the day of Christmas, making users wait longer than usual to relish the experience of their Apple product for Christmas. On Friday, while replying to a supposedly eager customer, Apple's support team tweeted acknowledging the customer's eagerness and indicating that the iCloud outage that lasted until Saturday was a result of the heightened demand experienced by the company.  

"We know your mom is eager to have everything working and appreciate you helping to set them up. We are experiencing a high capacity at this time which is impacting your ability to set up iCloud, please try back in a couple of hours," the tweet read. 

A lot of users upon noting the unusually long waiting time, some for as long as 32 hours and device activation failures reported the same on Twitter, while others said to have faced complete activation failures.  

Furthermore, certain users facing similar troubles reported their problem at forums.macrumors.com, "I realize it's Christmas morning and Apple's activation servers are probably on overload, but this still seems unnecessarily frustrating," BeatCrazy wrote.  

While explaining the issue in-depth, BeatCrazy further told, " I'm able to start the pairing process using my iPhone, sign into their Apple IDs with their passwords, but I keep getting hung when Apple wants me to enter the passcode of another device. I'm given options like their iPad passcodes, or one of my Macs. After entering any of these, the watch spins for about 2 minutes and I get the error "Verification Failed - There was an error verifying the passcode of your (or insert family member name here) iPhone (or insert iPad/Mac)." Apple gives me a choice to "reset encrypted data", which I take as an offer to destroy all their existing Apple ID passwords and data - not a good option IMO."  

Seemingly, due to the ongoing COVID-19 pandemic, the year's wrap and the holiday season is busier than usual for Apple, which delayed the release of its newest iPhone 12 series by a month.

Hackers Use Bugs To Attack iOS and Android Devices; Google Doesn't Disclose Details

 

Google's cybersecurity team found a cluster of high-end vulnerabilities in iOS, Windows, Android, and Chrome earlier this week. According to Google, these vulnerabilities were in high usage, which means hackers used them to carry out attacks. It is an alarming issue for cybersecurity. Besides this, the vulnerabilities share some similarities, says Motherboard. One can assume that the same cybercriminals exploited them. According to cybersecurity findings, few vulnerabilities hid in font libraries, few in chrome's sandbox to escape, and others controlled the systems. 

It means that the bugs belonged to a string of vulnerabilities used to attack user's devices. As of now, there's no concrete information about who the hacker is and their targets. Usually, whenever bugs are found, it is ethically disclosed to release security patches to fix the issue, before the hackers can exploit them. However, in the current case, it is confirmed that the hackers are using the bugs. In 2019, in a quite similar incident, google had found a string of vulnerabilities that hackers used to attack the Uighur community. In China, the government conducts a massive scale campaign of surveillance and monitoring on the Muslim community. 

Vice reports, "according to a source with knowledge of the vulnerabilities, all these seven bugs are related to each other, who asked to remain anonymous as they were not allowed to talk to the press." However, the experts don't have any information on the present situation, as Google hasn't disclosed anything about the vulnerabilities, the hackers, or the targets. Fortunately, Apple released iOS 12 (released in 2018) security patch, which can fix Apple devices up to the iPhone 5 series. 

It so happens that when a company releases a security patch that fixes old machines, it generally means that the bug is highly dangerous. Still, we can only assume, as no data is available. "In any case, some of these bugs were very critical and gave hackers a lot of power when they used them. The iOS bugs, for example, were so dangerous that Apple pushed updates not just for the current iOS 14, but also for the older, not usually supported, iOS 12," reports the Vice.

Apple Patches-Up Three Actively Exploited And Identified Zero-Day Vulnerabilities In its iPhone, iPod and iPad Devices

 

This month Apple released iOS 14.2 and iPad 14.2, which patched up a sum total of 24 vulnerabilities in different parts of the OSes, including sound, crash reporter, kernel, and foundation. 

The multinational technology has fixed up three identified zero-day vulnerabilities in its iPhone, iPod, and iPad devices possibly associated with a spate of related flaws very recently found by the Google Project Zero team that additionally had an impact over Google Chrome and Windows. 

Ben Hawkes from Google Project Zero who was able to identify the zero-day vulnerabilities as "CVE-2020-27930 (RCE), CVE-2020-27950 (memory leak), and CVE-2020-27932 (kernel advantage escalation)," he said in a tweet. 

Apple likewise offered credit to Project Zero for recognizing these particular defects in its security update and gave a little more detail on each.

CVE-2020-27930 is 'a memory corruption flaw' in the FontParser on iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and iPad mini 4 and later, as indicated by Apple. 

The vulnerabilities take into account an attacker to process a “maliciously crafted font” that can prompt arbitrary code execution.

Apple described CVE-2020-27950 as a memory initialization issue in the iOS kernel that influences iPhone 6s and later, iPod tough 7th generation, iPad Air 2 and later, and iPad smaller than usual 4 and later. 

The defect would permit a pernicious application to reveal kernel memory, according to the company. The Apple update comes along with the time of updates by Google over the last two weeks to fix various zero days in Google Chrome for both the desktop and Android versions of the browser. 

Shane Huntley from Google's Threat Analysis Group claims that the recently fixed Apple zero-day flaws are identified with three Google Chrome zero-days and one Windows zero-day likewise uncovered over the last two weeks, possibly as a component of a similar exploit chain.

“Targeted exploitation in the wild similar to the other recently reported 0days,” he tweeted, adding that the attacks are “not related to any election targeting.” 

It is however critical to take into notice that both Apple and Google have had an infamous past with regards to vulnerability revelation. 

The two tech monsters famously butted heads a year ago over two zero-day bugs in the iPhone iOS after Google Project Zero analysts guaranteed that they had been exploited for quite a long time.