Eliana Willis

Chip designer Arm has released a prototype of its Morello development board for researchers at Google, Microsoft and industry to test its goal for a CPU design that wipes out a chunk of memory-related security flaws in code.The Morello board is the product of a collaboration between Arm, Cambridge University, Microsoft and others based on the Capability Hardware Enhanced RISC Instructions (CHERI) architecture. Microsoft says the board and system on chip (SoC) is the first high-performance implementation of CHERI, which provides “fine-grained spatial memory safety at a hardware level”. If it proves successful after testing with legacy software, it could pave the way for future CPU designs.

CHERI architectural extensions are designed to mitigate memory safety vulnerabilities. CHERI augments pointers – the variables in computer code that reference where data is stored in memory – with limits as to how those references can be used, the address ranges that they can use to access, and which functionality they can use. “Once baked into silicon, they cannot be forged in software,” Arm explained. CHERI was developed by the University of Cambridge and SRI International after it received funding from DARPA’s Clean-slate design of Resilient, Adaptive, Secure Hosts (CRASH) program.SEE: The IT skills gap is getting worse. Here are 10 ways you can avoid a crisisThe Morello architecture is based on CHERI. Arm kicked off work on hardware for the Morello program in 2019 with backing from the UK government’s Digital Security by Design (DSbD) program and UK Research and Innovation (UKRI).       The Morello demonstrator board is a tweaked Arm Neoverse N1, a 2.5GHz quad-core server core CPU with support for Armv8.2a 64-bit architecture that has extra features to enable CHERI-based “compartmentalization” to counter exploits against memory-related security flaws. “For any research project, this phase is both exciting and critical. There has never been a silicon implementation of this hardware capability technology in a high-performance CPU,” said Arm.

The Morello board is a significant advancement for CHERI, which has been in development for over a decade. Saar Amar, of Microsoft’s Security Research and Defense team, notes the top existing implementation of CHERI topped was Toooba, which –while a “significant achievement” – could only run in an FPGA at 50MHz in a dual-core configuration. It was “roughly equivalent in microarchitecture to a mid-’90s CPU” that wasn’t good enough for testing complex software stacks at scale.  The CHERI and Morello architectures may be one way of tackling memory-related security flaws that stem from code written in programming languages like C and C++. Microsoft and Google say the majority of security bugs are memory safety issues and they’re often due to coding issues written in these languages. The volume of these bugs and patches they require has prompted major software firms like Microsoft, Google and Amazon to explore ‘type safe’ languages like Rust for systems programming. However, Rust is generally used to write new components because vast, existing code bases written in C or C++ are left in place, as Google is doing for Android’s code base.     The Morello boards are being shared with researchers to test the hypothesis of CHERI’s compartmentalization approach and whether it is a viable security architecture for businesses and consumers in the future. As detailed in a paper about CHERI by Google researcher Ben Laurie and peers, various CHERI modes can be more effective and efficient than mitigations in conventional memory management unit (MMU) hardware, which are used to translate virtual memory addresses to physical addresses. CHERI allows for software compartmentalization in a similar way to process isolation in software for today’s operating systems, notes Laurie. It also includes an in-process memory safety mechanism that avoids the need to make major changes to source-code – a potentially major benefit for existing code bases.    “Contemporary type-safe languages prevent big classes by construction, whereas CHERI memory protection prevents the exploitation of some of these bug classes,” writes Microsoft’s Armar. “There are billions of lines of C and C++ code in widespread use, and CHERI’s strong source-level compatibility provides a path to achieving the goals of high-performance memory safety without requiring a ground-up rewrite.” More

Botnets built from the Mirai codebase continue to wreak havoc in the technology arena, with cyberattackers taking advantage of lax Internet of Things (IoT) security in widespread attacks. 

Computers and other connected devices, including IoT and NAS storage, are compromised through weak credentials, vulnerabilities, exploit kits, and other security weaknesses. These systems join a network of slave devices that can be commanded to perform malicious activities.Attack types commonly associated with botnets are the launch of Distributed Denial-of-Service (DDoS) attacks, brute-force attacks leading to information theft and ransomware deployment, and the covert installation of cryptocurrency mining software on vulnerable, Internet-facing servers.  The most well-known, perhaps, is Mirai, which made its debut with catastrophic DDoS attacks in 2016 against DNS provider Dyn and the website of cybersecurity expert & reporter Brian Krebs.  Mirai’s source code was then released online, opening up an avenue for variants to be created including Okiru, Satori, and Masuta.  Despite the age of the original botnet, the code underpinning the network and the use of its code in mutated versions means that Mirai is still a risk to organizations today. 

On Tuesday, Intel 471 published a new report on Mirai’s fracturing into new forms and a reported surge in attacks during 2020 and 2021 against IoT devices using these botnet variations.  “Threat actors seized the opportunity to not only create large botnets, but also steal confidential data from IoT devices linked to compromised organizations, and potentially sell it on underground marketplaces,” the researchers say. As IoT device numbers are expected to reach approximately 30.9 billion by 2025, the team expects the threat – and overall power – of botnets to only continue to expand.  At present, Gafgyt and Mirai, alongside multiple botnets based on Mirai code such as BotenaGo, Echobot, Loli, Moonet, and Mozi, are being used to target devices primarily based in Europe and North America.  Threat actors are commonly using the below vulnerabilities in exploit kits to compromise IoT devices and increase the power of their networks: CVE-2018-4068, CVE-2018-4070 and CVE-2018-4071: Information leaks in Sierra Wireless AirLink (ES450 FW version 4.9.3) CVE-2019-12258, CVE-2019-12259, CVE-2019-12262 and CVE-2019-12264: DoS vulnerabilities in the Wind River Systems VxWorks RTOS CVE-2019-12255, CVE-2019-12260, CVE-2019-12261 and CVE-2019-12263: Memory corruption flaws in the VxWorks RTOS CVE-2021-28372: An authentication bypass bug in the ThroughTek Kalay P2P SDK (versions 3.1.5 and earlier) CVE-2021-31251: An improper authentication issue in Chiyu Technology firmware”The cybercriminal underground will continue to build off of Mirai, targeting every piece of equipment it can as the IoT market continues to boom,” the cybersecurity firm says. Intel 471 recommends that organizations implement IoT device monitoring processes, perform regular security audits, routinely change up credentials and keys, and maintain regular patch application cycles.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

An activist group in Belarus launched a ransomware attack against the country’s railway system in protest of Belarus President Alexander Lukashenko and Russian troop movements through the country. On Monday, The Belarusian Cyber-Partisans took to Twitter to say they encrypted the networks of Belarusian Railways, crippling the system and disrupting ticket sales. The group criticized Lukashenko and provided a list of demands in exchange for the encryption keys needed to unlock the system. “At the command of the terrorist Lukashenko, #Belarusian Railway allows the occupying troops to enter our land. We encrypted some of BR’s servers, databases and workstations to disrupt its operations. Automation and security systems were NOT affected to avoid emergency situations,” the group said. “We have encryption keys, and we are ready to return Belarusian Railroad’s systems to normal mode. Our conditions: Release of the 50 political prisoners who are most in need of medical assistance. Preventing the presence of Russian troops on the territory of #Belarus.”

We have encryption keys, and we are ready to return Belarusian Railroad’s systems to normal mode. Our conditions:🔺 Release of the 50 political prisoners who are most in need of medical assistance.🔺Preventing the presence of Russian troops on the territory of #Belarus. https://t.co/QBf0vtcNbK— Belarusian Cyber-Partisans (@cpartisans) January 24, 2022

Yuliana Shemetovets, a Belarusian activist and spokesperson for the group, told ZDNet that their goal was to disrupt the railway system “so it can indirectly affect the Russian troops using it for their purposes (potential attack on Ukraine).” According to The Washington Post, the Belarusian Defense Ministry said on Monday that Russian troops were coming to the country for military exercises. Russia is also sending 12 Su-35 fighters, two S-400 battalions and a Pantsir-S air defense system to Belarus as part of the troop movement, but US officials said it was all part of a Russian plan to invade Ukraine from the north. “[Belarusian Cyber-Partisans] don’t want Russian soldiers in Belarus since it compromises the sovereignty of the country and puts it in danger of occupation. It also pulls Belarus into a war with Ukraine. And probably Belarusian soldiers would have to participate in it and die for this meaningless war,” Shemetovets said. 

Shemetovets explained that the group encrypted the bulk of the railway’s servers, databases and workstations. They first gained access to the railway’s systems in December. “The backups have been destroyed. Dozens of databases have been attacked, including AS-Sledd, AS-USOGDP, SAP, AC-Pred, http://pass.rw.by, uprava, IRC, etc. Automation and security systems were deliberately not affected by a cyber attack in order to avoid emergency situations,” Shemetovets added. Shemetovets noted that the attack did affect some Belarusians trying to use the train system’s ticket platform and said they would work to restore the system so average citizens were not affected. The Belarusian Railways website was back online by Monday night. “We received so far only positive feedback (people that were writing to us are ready to put up with it a little so the major goal is achieved). The major target was freight trains but it looks like the passenger schedules were also affected,” Shemetovets said.”The government refused to make any comments. We need to wait a little longer to see how it actually affected them. As long as Lukashenko’s dictatorship regime stays CPs will continue their work.” The government did not respond to requests for comment and has not released a statement about the situation. But Belarusian Railways did issue a statement acknowledging the issue and said any web resources or services “issuing electronic travel documents” are temporarily unavailable. They added that they are working to restore the system and urged customers to contact their offices for travel documents. Since protests against Lukashenko began in 2020, the Belarusian Cyber-Partisans have worked to undermine the dictatorship by leaking hacked documents showing widespread corruption and police abuse. The group is made up of former IT workers from Belarus, according to profiles by Bloomberg, The MIT Technology Review and The Washington Post.Ransomware experts told ZDNet that they had never seen ransomware used in this way before. Emsisoft threat analyst Brett Callow said he was not aware of any situation where ransomware was deployed like this.”In terms of helping hactivists achieve their objectives, ransomware is as effective, perhaps more effective, than any other tool in their arsenal. And, of course, the entry barriers are lower than ever thanks to both user credentials and off-the-shelf ransomware being readily available,” Callow said, Recorded Future’s Allan Liska echoed those remarks, telling ZDNet he had never seen anything like this before. “This reminds me a bit of the escalation we saw with the Red Brigades kidnappings in the 70s and 80s. What started as simple kidnappings escalated to more radical behavior and assassination. Ransomware has evolved from encrypting single machines to whole networks and the the types of extortion demanded has continued to evolve,” Liska said.”This could be the next jump in the evolution of ransomware, or it could be an outlier.” More

OpenSea is contacting and reimbursing users affected by a loophole that allows people to buy NFTs for a fraction of their true cost and resell it for thousands.On Monday, blockchain security company Elliptic and multiple Twitter users spoke out about the bug. Motherboard was the first to report on the incident. Elliptic said it “identified at least three attackers who have purchased at least eight NFTs for much less than their market value within the past 12 hours.” The issue affects Bored Ape Yacht Club, Mutant Ape Yacht Club, Cool Cats and Cyberkongz NFTs.One user wrote on Twitter that his NFT was bought for about $1,800 worth of the Ethereum cryptocurrency before it was resold for $196,000.

Yooo guys! Idk what just happened by why did my ape just sell for .77?????— TBALLER.eth (@T_BALLER6) January 24, 2022

“One attacker, going by the pseudonym ‘jpegdegenlove’ today paid a total of $133,000 for seven NFTs — before quickly selling them on for $934,000 in ether. Five hours later this ether was sent through Tornado Cash, a ‘mixing’ service that is used to prevent blockchain tracing of funds. Jpegdegenlove also seems to have partially compensated two of their victims — sending 20 ETH ($45,000) to TBALLER and 13 ETH ($30,000) to Vault327. Another attacker purchased a single Mutant Ape Yacht Club NFT for $10,600, before selling it on five hours later for $34,800,” Elliptic explained.”The exploit appears to originate from the ability to re-list an NFT at a new price, without cancelling the previous listing. Those previous listings are now being used to purchase NFTs at prices specified at some point in the past — which is often well below current market prices.”DeFi developer Rotem Yakir released a detailed thread on Twitter explaining the OpenSea bug, writing that it “stems from the fact that previously you could re-list an NFT without canceling it (which you can’t now) and all the previous listing are not canceled on-chain.”

“Previously, you could have re-list an NFT without canceling the previous list. Sometimes but not always, If you cancel your new listing, the old one will not appear on the UI but is still valid,” Yakir said. “Using services like https://orders.rarible.com or even OS API someone can obtain the old listing and still use it. To make sure you are safe, you can check on https://orders.rarible.com and see if your previous listing is still there. However, if you want to be 100% safe then just transfer your NFT to a different wallet.”An OpenSea spokesperson told ZDNet that it has been trying to create solutions for the problem since it was identified. They also denied that it was a bug or vulnerability.”Since this issue was identified, we’ve taken it incredibly seriously and worked to ship product solutions for the community. This is not an exploit or a bug — it’s an issue that arises because of the nature of the blockchain. OpenSea cannot cancel listings on behalf of users. Instead, users must cancel their own listings,” the spokesperson said. “It’s OpenSea’s priority to make users aware of all their listings, and we’re working on a number of product improvements to address this, including a dashboard where they can easily see and cancel listings. In addition, we have been actively reaching out to and reimbursing affected users. We have not communicated broadly about this issue because we did not want to risk bringing it to the attention of bad actors who could abuse it at scale before we had mitigations in place.” ZDNet could not confirm whether users have been reimbursed. The OpenSea spokesperson said that it’s an issue of “confusing UI” that arises when users create listings and then transfer the listed NFT to a different wallet. When a user transfers items out of their third-party wallet, the listing they created for the item does not automatically cancel and cannot be canceled by OpenSea directly because it requires the user to sign for the cancellation in their wallet, the spokesperson explained. OpenSea is not the only platform affected by the issue, the NFT platform explained. According to OpenSea, the issue can arise any time a user moves an NFT to a different wallet without canceling active listings because the transaction is posted to the blockchain.The company added that it is in the process of changing its default listing duration from 6 months to 1 month so that if an NFT is transferred back into a wallet after 1 month, the listing will have expired.They also plan to notify users that they have a higher-priced listing still active when they lower the price for the same item. OpenSea said it is adding a dashboard to user profiles that shows all inactive listings and gives users an opportunity to cancel each listing with a single click.In the next two days, the company plans to integrate another feature that will surface in-product notifications about active listings and ask if users want to cancel it when they transfer an NFT that has an active listing associated with it out of their wallet. Users will also get an email from OpenSea when they transfer an NFT into a wallet with an active listing for that NFT. More

Some internet service has returned to the residents of Yemen and Burkina Faso after violence in both countries led to outages over the last week. NetBlocks, an organization tracking internet access across the world, said internet was restored in Yemen after a four-day, nation-wide outage. 

At about 1 am local time on Friday, Yemen suffered a total internet blackout due to air strikes on a telecommunications hub in the port city of Al Hodeida. Some online shared photos of a telecommunications building damaged by bombs. The Associated Press eventually confirmed that the attack on the telecommunications hub in Al Hodeida was part of a larger aerial assault on Yemen’s Houthi rebels by a Saudi-led coalition. The Houthis now run the state-owned monopoly that controls the country’s internet access, TeleYemen. A news channel in Yemen said the attack on the telecommunications hub killed an unknown number of people. “Visual reports appeared to corroborate initial reports of a strike. Al Hodeida is the main landing point for internet connectivity in Yemen, hosting the undersea FALCON and SEA-ME-WE 5 cables that route via the Red Sea,” NetBlocks explained in a report. TeleYemen uses the FALCON cable to connect much of the country’s western population to the internet. SMEX, an internet advocacy organization in the Middle East, attributed the internet outage to Saudi-led airstrikes targeting Houthi-held cities like Al Hodeida. 

“Internet is now only available to large companies and banks still connected through satellites, as well as those subscribed to the ‘Aden Net’ network, which has a very limited number of subscribers,” SMEX explained, adding that all government servers were disrupted after the attack. The Saudi-led coalition did not confirm whether it specifically targeted the telecommunications hub in Al Hodeida but told the Associated Press that it did launch “accurate airstrikes to destroy the capabilities of the militia” in Al Hodeida.The Washington Post reported that citizens were terrified during the internet outage because they could not contact family members and friends during the deadly bombing campaign. Internet in Burkina Faso shut down during coupMobile internet in Burkina Faso was down for more than 35 hours as fighting between rival military factions broke out. Since the outage, the president of the country, Roch Marc Christian Kaboré, was overthrown and removed from power. The country’s government was dissolved, all of the borders were closed and the Constitution has been suspended, according to The New York Times. Internet access returned on Monday, according to NetBlocks.

“Analysis of Google Transparency metrics corroborates user reports of a mobile internet blackout, indicating that traffic has been significantly disrupted at national scale from Sunday morning around 10 am. VPN services, which can circumvent partial restrictions, are not generally able to work around this class of network disruption,” NetBlocks said.The country previously shut off the internet to deal with a coup attempt earlier this month. The government also shut off the internet in November amid unrest. Alp Toker, director of NetBlocks, told ZDNet that the trend of governments shutting off the internet as a response to security issues was concerning. Leaders in Kazakhstan, Sudan and Myanmar have all recently closed off internet access during military takeovers, coups or unrest.”The tendency toward more severe nation-scale Internet blackouts is alarming, particularly at a time of growing reliance on digital communications worldwide. Shutdowns imposed by governments are inherently disproportionate and they harm human rights as well as economies across the board,” Toker said.”Legal frameworks are lacking, and where international conventions do exist, these are rarely effective at halting the practice, so the trend is likely to continue. Whether a regime is invading a neighboring country or silencing their own population, shutdowns give governments a free reign over the general public, leaving independent media muzzled and human rights abuses unreported.” More

The Department of Homeland Security (DHS) sent out a bulletin on Sunday to critical infrastructure operators and local governments warning about the potential for cyberattacks launched by the Russian government. These attacks would be in response to any US involvement in a potential war in Ukraine. First reported by CNN, the notice said Russia “maintains a range of offensive cyber tools that it could employ against US networks –from low-level denials-of-service to destructive attacks targeting critical infrastructure.” 

ZDNet Recommends

The best security key

While robust passwords help you secure your valuable online accounts, hardware-based two-factor authentication takes that security to the next level.

Read More

“We assess that Russia would consider initiating a cyber attack against the Homeland if it perceived a US or NATO response to a possible Russian invasion of Ukraine threatened its long-term national security,” the bulletin said, according to ABC News.DHS added that it has not seen Russia launch cyberattacks against US critical infrastructure, “notwithstanding cyber espionage and potential prepositioning operations in the past.”DHS sent the memo to state governments, local governments, and operators of critical infrastructure. A DHS spokesperson would not discuss the memo specifically but told ZDNet they regularly share information “with federal, state, local, tribal, and territorial officials and the private sector to ensure the safety and security of all communities across the country.” “We have increased operational partnerships between private sector companies and the federal government to strengthen our nation’s cyber defenses, including through CISA’s newly established Joint Cyber Defense Collaborative (JCDC). The JCDC brings these partners together to help us understand the full threat landscape and enable real-time collaboration to empower our private sector partners to gain information and take action against the most significant threats to the nation,” a DHS spokesperson said.CNN reported that in addition to the DHS memo, multiple government agencies have been in contact with private sector companies and organizations to issue similar warnings. The Cybersecurity and Infrastructure Security Agency (CISA) has published multiple advisories this year similarly warning of a Russian cyberattack following multiple incidents in Ukraine over the last two weeks.  

CISA, which referred all questions about the most recent memo to DHS, released an alert on January 11 detailing a variety of tactics used by Russian state-sponsored groups to attack local and tribal governments across the US between September 2020 and December 2020. 

The alert said Russian state-sponsored actors have targeted a variety of the US and international critical infrastructure organizations over the years and made specific references to previously reported attacks by Russian groups on critical infrastructure in Ukraine. A US Homeland Security report from 2016 said 225,000 customers were left without power two days before Christmas because of the Russian attack on three regional electric power distribution companies. CISA then followed up that alert with another warning last week urging all US organizations to shore up defenses “now” in response to website defacements and destructive malware targeting Ukraine government websites and IT systems.CISA recommended that organizations implement multi-factor authentication for remote systems, disable ports and access points that are not business-critical, and put strong controls in place for cloud services. Late last week, US President Joe Biden threatened reciprocal cyberattacks against Russia if it continued to attack Ukrainian systems. Kevin Breen, director of cyber threat research at Immersive Labs, said the attacks last year on Colonial Pipeline and food manufacturer JBS were proof that cyberattacks could cause significant damage to everyday life. “We’ve seen notable ransomware groups operating out of that region, including REvil and DarkSide, with the technical ability to compromise large networks rapidly and at great scale. It would be wrong to assume that the nation state housing such criminal elements doesn’t have a matching capability,” Breen said. “In this fast-paced world of constant cyberattacks and zero-day exploits, it’s always better to err on the side of caution. It’s better to assume you are a target and have strategic plans in place to match that of the adversaries’ capabilities,” Breen added.

Government More

The International Committee of the Red Cross (ICRC) has released an update about a cyberattack that led to a data breach affecting more than 500,000 vulnerable people receiving services from the organization. The ICRC expressed concern that the stolen data — which was from its global Red Cross and Red Crescent Movement’s Restoring Family Links services — would be “used by States, non-state groups, or individuals to contact or find people to cause harm.””This attack is an extreme violation of their privacy, safety, and right to receive humanitarian protection and assistance,” the organization said. Restoring Family Links works to reconnect missing people and children with their families after wars, violence, or other issues. Last week, the ICRC said hackers accessed servers on January 18 that had the personal information of more than 515,000 people from across the world. The personal information includes the names, locations, and contact information of missing people and their families, unaccompanied or separated children, detainees, and other people receiving services from the Red Cross and Red Crescent Movement as a result of armed conflict, natural disasters, or migration. They added that the login information for about 2,000 Red Cross and Red Crescent staff and volunteers was also been breached. In a more detailed explanation of the attack, the ICRC said its cyber partners detected an anomaly on ICRC servers before doing a deep dive and determining that hackers had gotten into the system and gained access to sensitive data. 

“The nature of the attack meant we could not guarantee the integrity of the system, so we took the compromised servers offline. We are now going through each application log to better understand what occurred. We do not believe that the data has been tampered with at this time, but to be sure we are hiring an independent audit firm to confirm this,” the ICRC said.”We do not know who is behind this attack. We have not had any contact with the hackers and no ransom ask has been made. In line with our standing practice to engage with any actor who can facilitate or impede our humanitarian work, we are willing to communicate directly and confidentially with whoever may be responsible for this operation to impress upon them the need to respect our humanitarian action.”

We are appalled that this humanitarian information has been compromised.Our most pressing concern now is the potential risks for people that the Red Cross and Red Crescent network seeks to protect and assist.@RMardiniICRC’s response to the cyber attack 👇 pic.twitter.com/lBBGlnMf1p— ICRC (@ICRC) January 20, 2022

The ICRC noted that the attack did not target the company hosting their servers and was specifically aimed at their systems. The organization is in the process of working with local ICRC arms to inform people who had their data accessed during the attack and will be letting them know about what is being done to address the situation as well as any risks they may face. There is no current evidence that the information accessed has been released or traded, according to the ICRC. They are still figuring out ways to continue helping families separated by war or violence without the affected servers. “As a result of this breach, we have been forced to take the data hosting systems in question offline, severely limiting the humanitarian services we can offer to the over half a million people affected. States have mandated impartial humanitarian organizations, such as the ICRC, with specific responsibilities. These include collecting information on people reported missing in order to reconnect separated family members,” the ICRC explained. “We need a safe and trusted digital humanitarian space in which our operational information, and most importantly the data collected from the people we serve, is secure. This attack has violated that safe digital humanitarian space in every way.”The ICRC also expressed concern that the attack would affect their ability to work with vulnerable populations who may not trust them with sensitive information anymore. They urged people concerned about their data to contact a local ICRC office for more information.  More