Eliana Willis

Image: Apple
When Apple announced its plans to tackle child abuse material on its operating systems last week, it said the threshold it set for false positives account disabling would be one in a trillion per year.Some of the workings of how Apple arrived at that number was revealed in a document [PDF] that provided more detail about the system. The most contentious component of Cupertino’s plans was its on-device child sexual abuse material (CSAM) detection system. It will involve Apple devices matching images on the device against a list of known CSAM image hashes provided by the US National Center for Missing and Exploited Children (NCMEC) and other child safety organisations before an image is stored in iCloud. When a reporting threshold is reached, Apple will inspect metadata uploaded alongside the encrypted images in iCloud, and if the company determines it is CSAM, the user’s account will be disabled and the content handed to NCMEC in the US. The document states that the CSAM hashes Apple used would be the intersection of two collections from two child safety organisations operating in different countries. “Any perceptual hashes appearing in only one participating child safety organization’s database, or only in databases from multiple agencies in a single sovereign jurisdiction, are discarded by this process, and not included in the encrypted CSAM database that Apple includes in the operating system,” the document states. After running the hashes against 100 million non-CSAM images, Apple found three false positives, and zero when run against a collection of adult pornography. The company said assuming a “worst-case” error rate of one in one million, it wanted a reporting threshold to ensure its one-in-a-trillion false positive disabling threshold.

“Building in an additional safety margin by assuming that every iCloud Photo library is larger than the actual largest one, we expect to choose an initial match threshold of 30 images,” it said. “Since this initial threshold contains a drastic safety margin reflecting a worst-case assumption about real-world performance, we may change the threshold after continued empirical evaluation of NeuralHash false-positive rates — but the match threshold will never be lower than what is required to produce a one-in-one-trillion false positive rate for any given account.” To ensure Apple’s iCloud servers do not maintain a count of the number of positive CSAM images a user has, their device will also produce fake metadata, which Apple calls safety vouchers. Apple said its servers will not be able to distinguish real vouchers from the fake ones until the threshold is reached. “The on-device matching process will, with a certain probability, replace a real safety voucher that’s being generated with a synthetic voucher that only contains noise. This probability is calibrated to ensure the total number of synthetic vouchers is proportional to the match threshold,” Apple stated. “Crucially, these synthetic vouchers are a property of each account, not of the system as a whole. For accounts below the match threshold, only the user’s device knows which vouchers are synthetic; Apple’s servers do not and cannot determine this number, and therefore cannot count the number of true positive matches.” Apple also confirmed the metadata would contain a low-resolution copy of the images for human inspection, and these copies are also run against the CSAM hashes. “This independent hash is chosen to reject the unlikely possibility that the match threshold was exceeded due to non-CSAM images that were adversarially perturbed to cause false NeuralHash matches against the on-device encrypted CSAM database,” Apple said. “If the CSAM finding is confirmed by this independent hash, the visual derivatives are provided to Apple human reviewers for final confirmation.” Cupertino said the system was designed so that a user does not need to trust Apple to know the system is “functioning as advertised”. “The threat model relies on the technical properties of the system to guard against the unlikely possibility of malicious or coerced reviewers, and in turn relies on the reviewers to guard against the possibility of technical or human errors earlier in the system,” Apple said. The company maintained that the human inspection process would ensure that if non-CSAM hashes were added into the reporting set, that the material would not be passed onwards out of Apple. “The reviewers are confirming one thing only: That for an account that exceeded the match threshold, the positively-matching images have visual derivatives that are CSAM,” it said. “This means that if non-CSAM images were ever inserted into the on-device perceptual CSAM hash database — inadvertently, or through coercion — there would be no effect unless Apple’s human reviewers were also informed what specific non-CSAM images they should flag (for accounts that exceed the match threshold), and were then coerced to do so.” The company reiterated it would refuse requests to add non-CSAM images to the dataset. “Apple will also refuse all requests to instruct human reviewers to file reports for anything other than CSAM materials for accounts that exceed the match threshold,” it stated. When it made the initial announcement, Apple also announced machine learning would be used within iMessage to alert parents using family sharing when child accounts have viewed or sent sexually explicit images, as well as provide warnings to the child. “For child accounts age 12 and younger, each instance of a sexually explicit image sent or received will warn the child that if they continue to view or send the image, their parents will be sent a notification. Only if the child proceeds with sending or viewing an image after this warning will the notification be sent,” Apple previously said. “For child accounts age 13-17, the child is still warned and asked if they wish to view or share a sexually explicit image, but parents are not notified.” In its document, Apple said the feature cannot be enabled for adult accounts, and is not enabled by default. On the issue of false positives, it said in the case of children aged between 13 to 17, if an image is miscategorised, and a child views it, they would see something that is not explicit. For those under 13, it could involve parental inspection. “For a child under the age of 13 whose account is opted in to the feature, and whose parents chose to receive notifications for the feature, sending the child an adversarial image or one that benignly triggers a false positive classification means that, should they decide to proceed through both warnings, they will see something that’s not sexually explicit, and a notification will be sent to their parents,” Apple said. “Because the photo that triggered the notification is preserved on the child’s device, their parents can confirm that the image was not sexually explicit.” Apple also said it has considered the issue of an adult being forced onto an account as a child under 13, but did not provide a resolution other than to state that not viewing the images would not make alerts be sent. “If the feature were enabled surreptitiously or maliciously — for example, in the Intimate Partner Surveillance threat model, by coercing a user to join Family Sharing with an account that is configured as belonging to a child under the age of 13 — the user would receive a warning when trying to view or send a sexually explicit image,” it said. “If they chose to proceed, they would be given a second warning letting them know that viewing the image will result in a notification being sent, and giving them another choice about whether to proceed. If they declined to proceed, neither the fact that the warnings were presented, nor the user’s decision to cancel, are sent to anyone.” Related Coverage More

Image: ACT Policing
The Australian Federal Police (AFP) has plans to enhance and upgrade its Law Enforcement Monitoring Facility (LEMF), with a big part of the process requiring a new telecommunication interception and surveillance device monitoring and collection platform.LEMF, the AFP explained, is an international term used to denote the transmission destination for lawfully intercepted communications and call-associated data. “Whilst the term ‘facility’ extends to the site where monitoring/recording equipment is located, this generally consists of computer infrastructure that will accept, acknowledge, store, process, and present intercepted products in compliance with international interception data exchange and standards protocols,” the AFP wrote in a statement of requirement (SOR).”The rapid advance of communications in IP networks has enabled multiple means of communication via SMS, email, messaging apps, and social media platforms. “Many of these platforms provide encrypted communication meaning that the content is not readily intelligible.”The AFP said in addition, data and metadata collected from sources such as surveillance devices (SD) and open-source intelligence (OSINT) could be combined with telecommunication interception (TI) products to “provide a more complete picture for intelligence and investigation teams”. “These additional data sources bring further challenges for TI monitors and other AFP teams due to the large volume of data available,” it said. “Additional capabilities such as advanced searching algorithms and AI tools (including object detection, facial and automated transcription and translation) provide an opportunity to enrich data to aid monitors and investigators.”LEMF architecture (TI & SD) current state
Image: AFP

The current LEMF architecture, the SOR explains, has several limitations, such as limited access to the LEMF data layer. It said APIs are provided by the current platform but do not provide a full range of access to functionality of the platform. There is also a lack of integration with the AFP’s internal compliance systems and multiple points of entry for configuration of TI product and historical telecommunications data and stored communications are collected and managed in separate processes and need to be manually ingested into the LEMF.The AFP said video surveillance and operational surveillance data are stored in siloed systems and are not transferred to the LEMF and there is a lack of common process for producing TI and SD evidentiary material. The next-generation LEMF (NG-LEMF), the AFP said, will enable “end-to-end lifecycle management” for TI and surveillance device-collected data such as audio, video, location data, SMS, intercept related information, IP data and associated metadata, and a framework to deliver advanced monitoring and data visualisation.The AFP expects it will also ingest additional product types such as video and historical telecommunications metadata into the underpinning data layer to allow linking with collected TI and SD product.The SOR, however, is just for the TI collection capability and the front-end applications used by monitors and investigators to view and analyse TI and SD product.”In summary, the desired future state is for a loosely-coupled solution consisting of modular components that interact via well-defined interfaces. The benefit of this approach is that UI components, data enrichment services, and applications can be upgraded/replaced relatively easily,” the AFP wrote. “It also de-couples the TI and SD product and other data sources from the end-user applications and services. The AFP’s intent is that the solution will be an open platform that is able to be integrated into the future state as part of the overall modular approach to delivering the NG-LEMF.”The new solution, due to be awarded in December, is required to ingest large amounts of TI and SD product from carriage service providers, technical and electronic surveillance devices, and OSINT.The platform, either cloud-based or on-premise, should also allow API integration with the upgraded Electronic Surveillance Warrants and Authorisations Management System to support compliance by reducing manual entry and process duplication, the SOR explains. “The solution should make use of open-source software where possible and be able to be modified to satisfy additional requirements without changing core design,” the AFP adds. “It is essential that the data handling aspects of the solution can demonstrate and enforce compliance with legislative requirements.”See also: Ombudsman finds unlawful metadata access by ACT cops on 1,704 occasionsThe AFP said the successful vendor should assume there are two agencies using the solution, with the AFP given the discretion to add further “partners”.The SOR lists 117 user interface requirements, such as the platform being capable of identifying a user’s social media and messaging use, such as Facebook, Instagram, Twitter, Messenger, WhatsApp, LinkedIn, Tumbler, and Pinterest from intercepted IP data. The AFP has also published a second tender, this time to replace the existing secure internet gateway service due to end of life considerations. The AFP has a current gateway services contract, which provides services to AFP, ACIC, CDPP, FFMA, and Austrac, and under this arrangement, each agency has its own dedicated infrastructure and service requirements. It hopes the Future Secure Internet Gateway (FSIG) service will deliver a more innovative and agile solution than is currently in place.The telecommunication interception and surveillance device platform SOR closes 13 September 2021, while responses to the FSIG tender will be accepted until 9 September 2021. MORE FROM THE FEDS More

StackCommerce
With remote working so widespread, it’s never been more vital to have top-notch VPN protection on all of your devices, including your home network. Fortunately, a one-year subscription to top-of-the-line NordVPN happens to be on sale at the moment and you should grab it while you can. Here’s why.

Although there are lots of VPNs to choose from, they are far from equal. Not many of them offer a level of protection that is even close to what NordVPN provides. No matter where you are or what type of connection you have, you will have completely private and unrestricted internet access. Your identity, as well as all of your most confidential personal information, is hidden with the utmost secrecy, thanks to NordVPN’s private tunnels and double encryption.For the ultimate security, if you happen to become disconnected from NordVPN servers, then your internet connection will be automatically dropped. That prevents even a scrap of data being revealed accidentally. And you can be absolutely sure that your online activity is not recorded anywhere whatsoever because NordVPN has an extremely strict no-logging policy.Since you will have access to 5,400 server locations in nearly 60 countries around the world, you will also be able to anonymously slide right by all geographical restrictions that are placed on the content you might be interested in. So you can watch whatever you want, wherever you are, any time you please. Most importantly, NordVPN connections are lightning quick, which means you’ll see videos instantly, without any buffering.If there are any doubts about whether NordVPN is the best around, the reviews will quickly put them to rest. The service earned perfect 5-star ratings from CNET, TrustPilot, and more.Don’t pass up this opportunity to get bulletproof VPN protection. Get NordVPN: 1-Yr Subscription for $47.20 (reg. $286) with coupon code NORD20.

ZDNet Recommends More

The SynAck ransomware gang has released decryption keys for victims that were infected between July 2017 and 2021, according to data obtained by The Record. SynAck is in the process of rebranding itself as the El_Cometa ransomware gang and a member of the old group gave the keys to The Record. Emsisoft’s Michael Gillespie confirmed the veracity of the decryption keys and said they are working on their own decryption utility that they believe will be “safer and easier to use” because there are concerns that SynAck victims may damage their files further using the provided keys. Ransomware expert Allan Liska told ZDNet that the SynAck ransomware group started right before Ransomware-as-a-service began to take off in 2018. “So they never outsourced their ransomware activities. While they continued attacks, there weren’t nearly as many as groups like Conti or REvil were able to conduct, so they got lost in the shuffle,” Liska said. “They also didn’t hit any really big targets.”

A Kaspersky Lab report in 2018 said SynAck differentiated itself in 2017 by not using a payment portal and instead demanding victims arrange payment in Bitcoin through email or BitMessage ID. They generally demanded ransoms around $3,000 and gained notoriety for using the Doppelgänging technique, which targets the Microsoft Windows operating system and is designed to circumvent traditional security software and antivirus solutions by exploiting how they interact with memory processes.

There is little data on victims of the ransomware group but Kaspersky Lab researchers said they observed attacks by the gang in the US, Kuwait, Germany and Iran.”The ability of the Process Doppelgänging technique to sneak malware past the latest security measures represents a significant threat; one that has, not surprisingly, quickly been seized upon by attackers,” said Anton Ivanov, lead malware analyst at Kaspersky Lab. “Our research shows how the relatively low profile, targeted ransomware SynAck used the technique to upgrade its stealth and infection capability. Fortunately, the detection logic for this ransomware was implemented before it appeared in the wild.”A SynAck representative told The Record that the group plans to launch a new Ransomware-as-a-service platform and recruit affiliates to help with their work on El_Cometa. Multiple ransomware groups, like Avaddon and Prometheus, have released decryption tools in recent months, either in an effort to rebrand or due to increased law enforcement activity.  More

Back in 1992, the Berkeley Packet Filter (BPF) was introduced in Unix circles as a new, much faster network packet filter. That was nice, but far from revolutionary. Years later, in 2014, it was modified and brought into the Linux kernel as extended BPF (eBPF). There it would add radical new features to Linux and it’s being used for numerous, useful Linux-based projects and eBPF is moving on from Linux into Windows as well. 

Open Source

What’s so special about it? Simple, eBPF enables you to run programs in the Linux kernel without changing the kernel source code or adding additional modules. In effect, it acts like a lightweight, sandbox virtual machine (VM) inside the Linux kernel space. There, programs that can run in eBPF run much faster, while taking advantage of kernel features unavailable to other higher-level Linux programs. As Thomas Graf, Isovalent’s CTO & Co-Founder and Chair of the eBPF Governing Board explained:  Historically, the operating system has always been an ideal place to implement observability, security, and networking functionality due to the kernel’s privileged ability to oversee and control the entire system. At the same time, an operating system kernel is hard to evolve due to its central role and high requirement towards stability and security. The rate of innovation at the operating system level has thus traditionally been lower compared to functionality implemented outside of the operating system.  EBPF fundamentally changes this formula. By allowing sandboxed programs to run within the operating system, eBPF enables developers to create eBPF programs that add capabilities to the operating system at runtime. The operating system then guarantees safety and execution efficiency as if natively compiled with the aid of a Just-In-Time (JIT) compiler and verification engine. This has led to a wave of eBPF-based projects covering a wide array of use cases, including next-generation networking, observability, and security functionality.This has changed the way operating systems and infrastructure services work together. It bridged the gap between kernel and user-space programs. EBPF has also enabled developers to combine and apply logic across multiple subsystems which were traditionally completely independent.These new programs include Linux kernel debuggers, such as bpftrace; cloud-native security software with Falco, and Kubernetes security applications using Hubble. That’s a lot of new, important programs and more are coming. So, it only made sense to form a new foundation for the project: The Linux Foundation’s sponsored eBPF Foundation. You can judge how important people see it by its founding members. These include Facebook, Google, Isovalent, Microsoft, and Netflix. Why? Because it’s already useful for them. For instance, Facebook is using eBPF as the primary software-defined load balancer in its data centers, and Google is using Cilium to bring eBPF-based networking and security to its managed Kubernetes offerings GKE and Anthos. This explosion of eBPF-based projects is making it one of the most influential technologies in the infrastructure software world. So, Graf said, “the demand is high to optimize collaboration between projects and ensure that the core of eBPF is well maintained and equipped with a clear roadmap and vision for the bright future ahead of eBPF. This is where the eBPF Foundation comes in, and establishes an eBPF steering committee to take care of the technical direction and vision of eBPF. Additionally, with the port of eBPF to the Windows kernel and additional ports to other platforms on the way, the question of eBPF program portability and eBPF runtime requirements becomes more important and requires coordination.”

Want to know more? Go to the free and virtual eBPF Summit, on August 18-19, 2021. You’ll be glad you did. EBPF is bringing fundamental changes to networking, security, and applications across the entire infrastructure stack from PCs to the cloud. Related Stories: More

A cybersecurity researcher has discovered several new vulnerabilities within Wodify’s gym management web application that gives an attacker the ability to extract workout data, personal information and even financial information. Wodify’s gym management web application is used widely among CrossFit boxes in the US and other countries to help them grow. The software is in use at more than 5,000 gyms for things like class scheduling and billing. But Dardan Prebreza, senior security consultant for Bishop Fox, explained in a report that a slate of vulnerabilities “allowed reading and modifying the workouts of all users of the Wodify platform.” Through the attack, access “was not limited to a single gym/box/tenant, so it was possible to enumerate all entries globally and modify them,” Prebreza added, noting that an attacker could hijack a user’s session, steal a hashed password, or the user’s JWT through the Sensitive Information Disclosure vulnerability. “Thus, a combination of these three vulnerabilities could have a severe business and reputational risk for Wodify, as it would allow an authenticated user to modify all their production data, but also extract sensitive PII,” Prebreza said.  “Additionally, compromising administrative gym user accounts could allow an attacker to modify the payment settings, and thus, have a direct financial impact, as the attacker could eventually get paid by the gym members instead of the legitimate gym owner(s). An authenticated attacker could read and modify all other users’ workouts data, extract PII, and eventually gain access to administrative accounts with the aim of financial gains.” Prebreza rated the vulnerability risk level high because it could cause severe reputational damage and financial ramifications to Wodify gyms and boxes that could have their payment settings tampered with. 

Wodify did not respond to ZDNet’s request for comment about the vulnerabilities. Prebreza’s report includes a timeline that shows the vulnerabilities were discovered on January 7 before Wodify was contacted on February 12. Wodify acknowledged the vulnerabilities on February 23 but did not respond to further requests for information. Wodify CEO Ameet Shah was contacted and he connected the Bishop Fox team with Wodify’s head of technology, who held meetings with the company throughout April to address the issues. On April 19, Wodify confirmed that the vulnerabilities would be fixed within 90 days but from there, repeatedly pushed back the patch date for the problems. First the company pledged to release a patch in May but they pushed it to June 11 before pushing it again to June 26.Wodify did not respond to Bishop Fox for another month, admitting that they were pushing the patch back to August 5. With more than half a year passed since the vulnerabilities were uncovered, Bishop Fox said they told Wodify they would publicly disclose the vulnerabilities on August 6, eventually releasing the report on August 13. Wodify has not confirmed if there is actually a patch yet, and Bishop Fox urged customers to get in touch with the company. “The Wodify application was affected by insufficient authorization controls, allowing an authenticated attacker to disclose and modify any other user’s workout data on the Wodify platform,” Prebreza explained. “The data modification example in the report was performed with consent on a collaborator’s account, and the proof-of-concept payload was removed following the screenshot. However, the ability to modify data means that an attacker could modify all workout results and insert malicious code to attack other Wodify users, including instance or gym administrators.”The vulnerabilities ranged from insufficient authorization controls to sensitive information disclosure and stored cross-site scripting, which can be leveraged in other attacks, according to the study. While attackers would be able to change all of a Wodify users’ workout data, profile pictures and names, the attack also allows for the ability to insert malicious code that could go after other Wodify users, including gym administrators.Prebreza said the Wodify application was vulnerable to four instances of stored cross-site scripting, one of which “allowed an attacker to insert malicious JavaScript payloads into workout results.” “Any user that viewed the page with the stored payload would execute the JavaScript and perform actions on behalf of the attacker. If an attacker gained administrative access over a specific gym in this manner, they would be able to make changes to payment settings, as well as access and update other users’ personal information,” Prebreza noted. “Alternatively, an attacker could craft a payload to load an external JavaScript file to perform actions on behalf of the user. For example, the payload could change a victim’s email and take over the account by issuing a password reset (note: changing the email address did not require providing the current password). An attacker could similarly leverage the Sensitive Information Disclosure vulnerability to retrieve a victim’s hashed password or JWT (i.e., session token).”Erich Kron, security awareness advocate at KnowBe4, said this was an unfortunate case of an organization not taking a vulnerability disclosure seriously. “While the initial thought of just wiping someone’s workout history may seem insignificant to many, the fact that an attacker can access the account and associated information, possibly including payment methods and personal information, is a real problem,” Kron said. “Even just the workout information can be sensitive if the wrong person uses it to find patterns, for example the days and times a CEO for an organization typically works out, and uses it for malicious purposes. Organizations that create software should always have a process in place for dealing with reported vulnerabilities such as this, and must take them seriously.” More