Eliana Willis

BLACK HAT USA: We need to be wary of mobile devices and IoT products, now widely abused to facilitate partner coercion, researchers have warned. 

Black Hat USA

At the Black Hat cybersecurity conference in Las Vegas this week, Lodrina Cherne, Principal Security Advocate at Cybereason and Martijn Grooten, consultant and coordinator at the Coalition Against Stalkerware said that the COVID-19 pandemic has prompted a surge in the use of stalkerware in intimate partner violence (IPV) and gender-based violence. The Coalition Against Stalkerware defines stalkerware as software, made available directly to individuals, that enables a remote user to monitor the activities on another user’s device without consent and without “explicit, persistent notification to that user in a manner that may facilitate intimate partner surveillance, harassment, abuse, stalking, and/or violence.” Mobile applications and PC monitoring software come straight to mind. Unlike spyware, which may be employed to monitor indiscriminately or by government agencies and law enforcement investigations, stalkerware is generally used by individuals.Such software can be used to remotely monitor and eavesdrop on phone calls, SMS messaging, Voice over IP (VoIP) applications, GPS/location data, messaging and social media apps, and to steal images and video from an infected device. It is often the case that stalkerware is installed through physical access to a handset. However, malicious SMS messages or phishing emails may also be the infection vector, although remote installation in stalkerware is rare, Cherne noted. “They are not hidden from a forensic practitioner,” Cherne commented. “But they are hidden from the user.”

According to the duo, stalkerware is most common on Android mobile devices, whereas this form of malware is most often detected on jailbroken, unpatched, or older iOS handsets. Desktop PC stalkerware also exists, although it is not as prolific.

This malware may be marketed as employee or children monitoring services and for ‘good’ and ‘ethical’ purposes — but as it is so often hidden, stealthy, and doesn’t require continual consent, can be used in IPV or to abuse others and violate their privacy. Using technology to intimidate, spy on, or abuse someone, however, now can go beyond mobile apps. As noted by the security experts, Internet of Things (IoT) devices including Bluetooth/possession trackers, shared social media accounts, and other smart technology, for example, home security cameras, are also ripe for abuse. Even remote-controlled devices such as smart thermostats or lights, too, could be used to demonstrate power over another and can be “intimidating,” according to Grooten.According to a WESNET survey conducted in Australia, 99.3% of domestic violence practitioners have clients who have experienced technology-facilitated abuse — and the use of video cameras for this purpose, alone, has increased by 183.2% between 2015 and 2000.”Tech abuse rarely involves hacking, it instead exploits a feature of the technology — they are rarely built with IPV in mind,” Grooten added.In the United States, the Stalking Prevention Awareness & Resource Center (SPARC) says that one in four individuals experiencing domestic abuse report that technology was used in some manner. 

ZDNet Recommends

While survivors may be “hyper-vigilant,” as they have had to be to endure IPV, the suspicions or belief they are being spied upon through stalkerware should not be dismissed. “Survivors should always be taken seriously to empower them,” Grooten said. “Don’t make decisions on their behalf and try to be supportive [..] understand that this is an abuse problem, not a technical problem.” Founded in 2019, the Coalition Against Stalkerware is a group of non-profit organizations, security advocates, and cybersecurity companies working together to fight stalkerware and other forms of technological abuse in domestic violence and coercive relationships.  Participants include F-Secure, the Electronic Frontier Foundation (EFF), Kaspersky, Malwarebytes, National Network to End Domestic Violence (NNEDV), and others. Interpol also supports the scheme.  “In recent years, the problem of stalkerware has been on the rise globally,” the coalition says. “Non-profit organizations report a growing number of survivors are seeking help with stalkerware, and cybersecurity companies are detecting a consistent increase in these harmful apps.” For further information and advice, check out the coalition’s guide video below, or check out our in-depth guide here:

[embedded content]

Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Security researchers have put the spotlight on a little-known but growing group of people who make up a significant part of the cyber-criminal ecosystem, even though some of them may not even be aware that they’re actually taking part in illegal activities. A collaborative research project by Czech Technical University in Prague, plus cybersecurity companies GoSecure and SecureWorks, analyzed the activities of people on the fringes of cybercrime, those behind projects like building the websites that end up being used for phishing attacks, affiliate schemes to drive traffic towards compromised or fake websites or writing the code that ends up in malware. 

The people behind these projects are doing it because it’s an easy way to make money. But by doing this work, they’re laying the foundations for cyber criminals to carry out malicious campaigns.SEE: Cybersecurity: Let’s get tactical (ZDNet special feature) The research, titled The Mass Effect: How Opportunistic Workers Drift into Cybercrime and presented at Black Hat USA, has its origins in analysis by Czech Technical University that revealed the inner-workings of Geost, a botnet and Android malware campaign that infected hundreds of thousands of users, which allowed researchers to examine chat logs of some of those involved. They were able to trace people in these chat logs to online forums and other discussion platforms and gain an insight into what motivates them.”We started to understand that, although they were involved in spreading malicious applications, they weren’t necessarily the mastermind behind it, but rather the informal workers, those who work on small gigs,” said Masarah Paquet-Clouston, security researcher at GoSecure. 

But while these people are at the bottom of the hierarchy, they’re performing useful tasks for cyber criminals who use the websites and tools they build for malicious activities, including phishing and distributing malware.  “They are trying to earn a living and maybe crime is paying better so they go there, they drift into crime and come and go,” said Sebastian Garcia, assistant professor at Czech Technical University, who argues that more attention needs to be paid to the people who dance the line between cybercrime and legal activity. “There is a mass of people in these public forums that the security community is not looking into, but these are the support, these are the people doing the majority of the work, building web pages for phishing emails, APKs, the encryption, the malware, the money mules,” he said. SEE: Cybersecurity: Why a culture of silence and driving mistakes underground is bad for everyoneIf we always focus on ‘motivated offenders’, the masterminds who actually thought of building the botnet and making money through all of this, we forget the workers, warned Paquet-Clouston. “We as a community often forget that there are many people involved, but they’re not necessarily highly motivated people but rather just those who end up doing the activity,” she said. However, this doesn’t necessarily mean that the people involved in these schemes should be treated as if they’re criminal masterminds, particularly when some may not even know that their skills are being exploited to aid cybercrime.  In fact, it could be possible to provide many of these people with opportunities to use their skills in a way that’s beneficial, rather than using them to help cybercrime. “There is a lot of people that, maybe given the correct opportunity, they don’t have to drift into crime,” said Garcia. MORE ON CYBERSECURITY More

The Parliamentary Joint Committee on Intelligence and Security (PJCIS) has recommended the passage of the so-called “hacking” Bill that will afford three new computer warrants to two Australian law enforcement bodies, providing its 33 other recommendations are met.The Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020, if passed, would hand the Australian Federal Police (AFP) and the Australian Criminal Intelligence Commission (ACIC) the new warrants for dealing with online crime.The first of the warrants is a data disruption one, which according to the Bill’s explanatory memorandum, is intended to be used to prevent “continuation of criminal activity by participants, and be the safest and most expedient option where those participants are in unknown locations or acting under anonymous or false identities”.The second is a network activity warrant that would allow the AFP and ACIC to collect intelligence from devices that are used, or likely to be used, by those subject to the warrant.The last warrant is an account takeover warrant that would allow the agencies to take control of an account for the purposes of locking a person out of the account.The Bill has been criticised for its “wide-ranging” and “coercive” powers by the Office of the Australian Information Commissioner (OAIC), human rights lawyers have asked the Bill be re-drafted, and the likes of Twitter have labelled parts of the proposed Bill as “antithetical to democratic law”.After considering all the submissions made and testimonies provided on the Bill, the PJCIS in its report [PDF] has called for some tweaks, such as amending the Bill to provide additional requirements on the considerations of the issuing authority to ensure the offences are reasonably serious and proportionality is maintained.

“The effect of any changes should be to strengthen the issuing criteria and ensure the powers are being used for the most serious of offending,” it added.The committee wants the issuing authority for all of the new powers introduced by the Bill, including emergency authorisations, to be a superior court judge, either of the Federal Court or a state or territory Supreme Court, except for account takeover warrants which may be granted by an eligible Judge as law according to the Surveillance Devices Act 2004.The issuing authority, PJCIS asked, must give consideration to third parties, specifically their privacy, and to privileged and journalistic information.It wants the Bill amended so that, in order to provide an emergency authorisation for disruption of data held in a computer, an authorising officer must be satisfied that that there are no alternative means available to prevent or minimise the imminent risk of serious violence to a person or substantial damage to property and that they consider the likely impacts of the proposed data disruption activity on third parties.In addition, the committee said the Bill should be amended so that, where an issuing authority declines to retrospectively approve an emergency data disruption authorisation, the issuing authority may require the AFP or ACIC to take remedial action, including financial compensation.See also: Intelligence review recommends new electronic surveillance Act for AustraliaThe OAIC previously testified the definition of a “criminal network of individuals” has the potential to include a significant number of individuals, including third parties not the subject or subjects of the warrant who are only incidentally connected to the subject or subjects of the warrant.To remedy that, the PJCIS has asked the definition under the network activity warrant require there to be a reasonable suspicion of a connection between the suspected conduct of the individual group member in committing an offence or facilitating the commission of an offence and the actions or intentions of the group as a whole.Where applying for authorisation is concerned, the committee wants changes made to reflect that only an AFP or ACIC law enforcement officer can apply for a data disruption warrant or an account takeover warrant. The person must also be approved, in writing, by either the AFP Commissioner or ACIC CEO to apply for data disruption warrants, and the relevant agency head must also be satisfied that person possesses the requisite skills, knowledge, and experience to make warrant applications.Further amendments requested include that the individual must make a sworn affidavit setting out the grounds of an application for an account takeover warrant.The PJCIS has asked the issuing criteria for each of the warrants require satisfaction that the order for assistance, and not just the disruption of data, is “reasonably necessary to frustrate the commission of the offences that are covered by the disruption warrant; and justifiable and proportionate, having regard to the seriousness of the offences that are covered by the disruption warrant and the likely impacts of the data disruption activity on the person who is subject to the assistance order and any related parties”.It wants it made clear that decisions under the Bill are not excluded from judicial review.The PJCIS wants the Bill to impose a maximum period for a non-emergency mandatory assistance order to be served and executed, and asked that if the order is not served and executed within that period, the order will lapse and a new order must be sought.It also wants all applications for a non-emergency mandatory assistance order to be made in writing and for the AFP and the ACIC, unless absolutely necessary, to be prohibited from seeking a non-emergency mandatory assistance order in respect of an individual employee of a company.Further amendments include the Bill making it clear that no mandatory assistance order can ever be executed in a manner that amounts to the detention of a person, and that the Bill introduce immunity provisions for both assisting entities and those employees or officers of assisting entities who are acting in good faith with an assistance order.The AFP and ACIC, the committee said, should also be required to notify the Commonwealth Ombudsman or the Inspector-General of Intelligence and Security (IGIS) as soon as reasonably practicable if they cause any loss or damage to other persons lawfully using a computer. Similarly, the PJCIS wants any computers that have been removed from premises under a data disruption warrant or a network activity warrant required to be returned to as soon as reasonably practicable.Elsewhere, PJCIS has requested an amendment to allow it to conduct a review of the three warrants no less than four years from when the Bill receives Royal Assent. It also wants each of the new powers to sunset five years from the date on which the Bill receives Royal Assent.The final recommendation, recommendation 34, simply states: The committee recommends the Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020 be passed, subject to the amendments outlined above.MORE ON THE HACKING BILL More

Image: Microsoft
The lead of Microsoft Edge Vulnerability Research Johnathan Norman has detailed an experiment in Edge that disabled the JavaScript just-in-time (JIT) compiler to enable some extra security protections. Describing JIT compiling as a “remarkably complex process that very few people understand and it has a small margin for error”, Norman pointed out that half of all vulnerabilities for the V8 JavaScript engine was related to the process. With the JIT engine turned off, it was possible for Edge to turn on protections — such as the hardware-based Control-flow Enforcement Technology (CET) from Intel, and Windows’ Arbitrary Code Guard (ACG) and Control Flow Guard (CFG) — that were previously incompatible with JIT. “This is unfortunate because the renderer process handles untrusted content and should be locked down as much as possible,” Norman said. “By disabling JIT, we can enable both mitigations and make exploitation of security bugs in any renderer process component more difficult. “This reduction in attack surface kills half of the bugs we see in exploits and every remaining bug becomes more difficult to exploit. To put it another way, we lower costs for users but increase costs for attackers.”
Image: Microsoft
In testing Edge with JIT disabled, Norman said users rarely noticed a difference in daily browsing, but the JIT-less Edge was hosed in benchmark tests, with performance reduced by as much as 58%.

“Our tests that measured improvements in power showed 15% improvement on average and our regressions showed around 11% increase in power consumption. Memory is also a mixed story with negatively impacted tests showing a 2.3% regression, but a larger gain on the tests that showed improvements,” Norman wrote. “Page Load times show the most severe decrease with tests that show regressions averaging around 17%. Startup times, however, have only a positive impact and no regressions.” Super Duper Secure Mode is currently available via edge://flags for users of canary, dev, and beta release channels of the browser, and currently switches CET on, but is not currently compatible with WebAssembly. “It will take some time, but we hope to have CET, ACG, and CFG protection in the renderer process. Once that is complete, we hope to find a way to enable these mitigations intelligently based on risk and empower users to balance the tradeoffs,” Norman said. “This is of course just an experiment; things are subject to change, and we have quite a few technical challenges to overcome. Also, our tongue-in-cheek name will likely need to change to something more professional when we launch as a feature.” On Twitter, Norman said plans were afoot to take Super Duper Mode to MacOS and Android, and to get WebAssembly working. Related Coverage More

Image: Getty Images/iStockphoto
A report from Western Australia’s Auditor-General has found that some former staff at state entities still had access to IT systems and equipment despite their employment being terminated.The finding was made as part of the Office of the Auditor-General’s (OAG) probe into staff exit controls in place at three state government agencies. The audit [PDF] assessed if the Department of Planning, Lands and Heritage (DPLH), the Department of Finance, and the Department of Local Government, Sport and Cultural Industries (DLGSC) effectively and efficiently managed the exit of staff to minimise security, asset, and financial risks.The audit covered the period 1 July 2019 to 31 December 2020 with a sample of 30 staff from DLGSC, 27 from DPLH, and 26 from Finance, including consultants and third-party contractors, that left during that period.While the report found all entities cancelled exiting staff’s IT system access, it was not always done immediately. According to the report, it took between two and 161 days to deactivate or withdraw access to information systems after staff left the entity. At Finance, OAG said it took between six and 161 days to cancel access to IT systems after the last day of employment. The case that took 161 days was related to a secondment arrangement where the former employee continued undertaking work on behalf of the entity, however. Setting that case aside, Finance took, on average, seven days to cancel IT systems access, despite its security management framework noting that IT access for terminated staff is meant to be disabled on the last day of employment. DPLH does not record specific dates when IT access is cancelled, but in probing system log information, where it was available, OAG found late cancellations ranged between one and 124 days after the individual had left.

Similarly, the OAG said DLGSC did not have sufficient information to determine when access to IT systems was cancelled for all 30 people in its audit sample. “System logs showing the dates of when this occurred were not recorded. In the absence of this information, we checked whether any of the individuals had accessed the IT systems and found that 29 did not access the system after they left,” the report said.”One person had accessed the system four days after their exit date.”The report also found that DPLH and DLGSC both lacked adequate information to show that office access passes were returned or deactivated for 72% of the sampled former staff. OAG said staff at DLGSC were charged a AU$12 fee for any changes to the status of passes from the private operator that managed the building and were therefore disincentivised to undertake the process.All access passes were cancelled or deactivated after staff left Finance, however for five out of the sample of 26, OAG said the cancellation of passes was not timely. For four people, OAG said it took between six and 44 days. The individual on secondment still had physical building access for the 116 days they continued to have systems access.Also under scrutiny was the asset returns process at the three entities, with OAG finding none had a complete and easily accessible record of all assets, including IT equipment, provided to staff.The report said OAG was unable to verify whether all IT assets had been returned to DPLH because there were insufficient records of what was issued to the 27 people in its sample. It said 15 staff had left with no evidence of laptop return. Only two of the 27 people were known to have had a phone issued, with evidence proving only one had been returned.At DLGSC, the OAG found records of only six exited staff in its sample of 30 pertaining to laptop returns and Finance demonstrated that 19 of 26 staff in the sample returned their IT equipment.To minimise the risk of unauthorised access to premises when staff leave, OAG recommended entities maintain an accurate register of all access passes including returns and cancellation/deactivation, conduct regular audits of all active passes, and ensure all access passes are returned when staff leave.The OAG has also requested the entities to ensure access to IT systems are removed or disabled immediately when staff leave. It has also asked the entities to clearly record when the removal of IT system access occurred and maintain a register of all assets issued to staff at commencement, during employment, and what is returned at exit.In addition, entities have been asked to minimise the risk of financial loss from overpayments to terminated employees, better manage the risks with different circumstances of employment termination, and improve communication between business functions responsible for staff exits.MORE FROM THE WEST More

Cybersecurity company Nozomi Networks Labs has warned the industrial control system (ICS) security community about five vulnerabilities affecting Mitsubishi safety PLCs.In a new report, the company said Mitsubishi acknowledged the issues — which are focused on the authentication implementation of the MELSOFT communication protocol — after they were discovered at the end of 2020. The Japanese manufacturing giant has devised a strategy to patch the issues but Nozomi Networks Labs said software updates for safety PLCs or medical devices often take longer to deploy than other software products. Vendors must go through specific certification processes before patches can be released, the report explained. “Depending on the type of device and regulatory framework, the certification procedure could be required for each individual software update,” Nozomi Networks Labs researchers wrote.”While waiting for the patch development and deployment process to be completed, we deployed detection logic for customers of our Threat Intelligence service. At the same time, we started researching more general detection strategies to share with asset owners and the ICS security community at large.”The researchers noted that the vulnerabilities they found “likely” affect more than one vendor and said they were concerned that “asset owners might be overly reliant on the security of the authentication schemes bolted onto OT protocols, without knowing the technical details and the failure models of these implementations.”The security company disclosed the first batch of vulnerabilities through ICS-CERT in January 2021 and another batch more recently, but patches are still not available. 

Mitsubishi has released a number of mitigations and Nozomi Networks Labs urged customers to assess their security posture in light of the advisories. The report specifically leaves out technical details or proof of concept documents in an effort to protect systems that are still being secured. Researchers discovered the vulnerabilities while researching MELSOFT, which is used as a communication protocol by Mitsubishi safety PLCs and corresponding engineering workstation software GX Works3. They found that Authentication with MELSOFT over TCP port 5007 is implemented with a username/password pair, which they said are “effectively brute-forceable” in some cases. The team tested multiple methods that gave them access to systems and found that there are even instances where attackers can reuse session tokens generated after successful authentication.”An attacker that can read a single privileged command containing a session token is able to reuse this token from a different IP after it has been generated, within a window of a few hours,” the report said.”If we chain together some of the identified vulnerabilities, several attack scenarios emerge. It’s important to understand this approach as real world attacks are often executed by exploiting several vulnerabilities to achieve the final goal.” Once an attacker gains access to a system, they can then take measures to lock other users out, forcing the last-ditch option of physically shutting down the PLC to prevent further harm.Nozomi Networks Labs suggested asset owners protect the link between the engineering workstation and the PLC so that an attacker cannot access the MELSOFT authentication or authenticated packets in cleartext. They also suggest protecting access to the PLC so an attacker cannot actively exchange authentication packets with the PLC. More