Categories
Apple exploits FBI hacking Intelwars iPhone Terrorism

Details on the Unlocking of the San Bernardino Terrorist’s iPhone

The Washington Post has published a long story on the unlocking of the San Bernardino Terrorist’s iPhone 5C in 2016. We all thought it was an Israeli company called Cellebrite. It was actually an Australian company called Azimuth Security.

Azimuth specialized in finding significant vulnerabilities. Dowd, a former IBM X-Force researcher whom one peer called “the Mozart of exploit design,” had found one in open-source code from Mozilla that Apple used to permit accessories to be plugged into an iPhone’s lightning port, according to the person.

[…]

Using the flaw Dowd found, Wang, based in Portland, Ore., created an exploit that enabled initial access to the phone ­ a foot in the door. Then he hitched it to another exploit that permitted greater maneuverability, according to the people. And then he linked that to a final exploit that another Azimuth researcher had already created for iPhones, giving him full control over the phone’s core processor ­ the brains of the device. From there, he wrote software that rapidly tried all combinations of the passcode, bypassing other features, such as the one that erased data after 10 incorrect tries.

Apple is suing various companies over this sort of thing. The article goes into the details.

Share
Categories
Intelwars

TARPLEY.net 2021-04-18 08:12:56

With less than two weeks left in Biden’s hundred days, his popularity stands at 59% based on new sample of 5100 adults; 72% approve of President’s vaccine policies; US Treasury reports Manafort associate Kilimnik gave Trump campaign’s internal polling to Russian intelligence in 2016, definitively establishing collusion; Japan, US renew mutual defense treaty against China, […]

Share
Categories
Intelwars Squid

Friday Squid Blogging: Blobs of Squid Eggs Found Near Norway

Divers find three-foot “blobs” — egg sacs of the squid Illex coindetii — off the coast of Norway.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Read my blog posting guidelines here.

Share
Categories
Global News Intelwars Politics Society

German Police Abiding By The COVID Rules…. ? ? ? (Video)

H/t reader U. B. * * * PayPal: Donate in USD PayPal: Donate in EUR PayPal: Donate in GBP

Share
Categories
Cybersecurity Intelwars Schneier news Twitter

Cybersecurity Experts to Follow on Twitter

Security Boulevard recently listed the “Top-21 Cybersecurity Experts You Must Follow on Twitter in 2021.” I came in at #7. I thought that was pretty good, especially since I never tweet. My Twitter feed just mirrors my blog. (If you are one of the 134K people who read me from Twitter, “hi.”)

Share
Categories
disclosure Intelwars microsoft NSA patching vulnerabilities

NSA Discloses Vulnerabilities in Microsoft Exchange

Amongst the 100+ vulnerabilities patch in this month’s Patch Tuesday, there are four in Microsoft Exchange that were disclosed by the NSA.

Share
Categories
Intelwars

Biden Responds to Russian Active Measures

United Front Against Austerity|Tax Wall Street Party American System Network|April 15, 2021 US banks cannot buy the newly bonded debt of the Russian central bank. This strikes at Kremlin’s ability to fund their regime. Ten diplomats were expelled, with EU, UK, Canada and Australia joining in. Our US Treasury targets Prigozhin and his worldwide networks. […]

Share
Categories
Cybersecurity Intelwars national security policy Supply chain threat models

DNI’s Annual Threat Assessment

The office of the Director of National Intelligence released its “Annual Threat Assessment of the U.S. Intelligence Community.” Cybersecurity is covered on pages 20-21. Nothing surprising:

  • Cyber threats from nation states and their surrogates will remain acute.
  • States’ increasing use of cyber operations as a tool of national power, including increasing use by militaries around the world, raises the prospect of more destructive and disruptive cyber activity.
  • Authoritarian and illiberal regimes around the world will increasingly exploit digital tools to surveil their citizens, control free expression, and censor and manipulate information to maintain control over their populations.
  • During the last decade, state sponsored hackers have compromised software and IT service supply chains, helping them conduct operations — espionage, sabotage, and potentially prepositioning for warfighting.

The supply chain line is new; I hope the government is paying attention.

Share
Categories
Intelwars

TARPLEY.net 2021-04-14 23:46:37

United Front Against Austerity|Tax Wall Street Party American System Network|April 14, 2021 Biden announces US and NATO forces will leave Afghanistan between May 1 and September 11; Move cuts in several directions; Kerry’s “Zero Carbon” mantra is rejected by natural US ally India, while champion polluter China gets license for unlimited emissions through 2060; Does […]

Share
Categories
Intelwars

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak:

The list is maintained on this page.

Share
Categories
China Courts cyberespionage Espionage FBI Intelwars microsoft zero day

The FBI Is Now Securing Networks Without Their Owners’ Permission

In January, we learned about a Chinese espionage campaign that exploited four zero-days in Microsoft Exchange. One of the characteristics of the campaign, in the later days when the Chinese probably realized that the vulnerabilities would soon be fixed, was to install a web shell in compromised networks that would give them subsequent remote access. Even if the vulnerabilities were patched, the shell would remain until the network operators removed it.

Now, months later, many of those shells are still in place. And they’re being used by criminal hackers as well.

On Tuesday, the FBI announced that it successfully received a court order to remove “hundreds” of these web shells from networks in the US.

This is nothing short of extraordinary, and I can think of no real-world parallel. It’s kind of like if a criminal organization infiltrated a door-lock company and surreptitiously added a master passkey feature, and then customers bought and installed those locks. And then if the FBI got a court order to fix all the locks to remove the master passkey capability. And it’s kind of not like that. In any case, it’s not what we normally think of when we think of a warrant. The links above have details, but I would like a legal scholar to weigh in on the implications of this.

Share
Categories
Intelwars

Tuesday Roundtable

United Front Against Austerity|Tax Wall Street Party American System Network|April 13, 2021 Is social friction around issues like race and gender simply a product of the struggle for progress, or are these divisive issues being manipulated by America’s adversaries? This wide-ranging discussion covers topics ranging from cultural wedge issues, “active measures,” universal basic income, and […]

Share
Categories
Cybersecurity Intelwars national security policy NSA

More Biden Cybersecurity Nominations

News:

President Biden announced key cybersecurity leadership nominations Monday, proposing Jen Easterly as the next head of the Cybersecurity and Infrastructure Security Agency and John “Chris” Inglis as the first ever national cyber director (NCD).

I know them both, and think they’re both good choices.

More news.

Share
Categories
Intelwars

World Tensions Escalate as Serious Cyber-Attack Hits Main Iranian Nuclear Center at Natanz

United Front Against Austerity|Tax Wall Street Party American System Network|April 12, 2021 Tehran Accuses Israel of Aggression; Denials Are Unconvincing; Washington Insists It Had No Role, but US Proximity Talks with Iran on Reviving JCPOA in Vienna May Be Disrupted; Blinken Warns Chinese Communists That US is Committed to Defense of Taiwan and Will Assist […]

Share
Categories
Intelwars

Marking the 156th Anniversary of the Triumph of the Union at Appomattox Court House!

US Must Lead Free World in Comprehensive Boycott of Next February’s Beijing Winter Olympics; Both Pompeo and Blinken Have Condemned Chinese Communist Operations against Uighurs of East Turkestan as Outright Genocide Under International Law, Ending all Business as Usual; Attending Sporting Events in Beijing Would Be a Dangerous Validation of Xi Regime and Sign of […]

Share
Categories
Intelwars Squid

Friday Squid Blogging: Jurassic Squid and Prey

A 180-million-year-old Vampire squid ancestor was fossilized along with its prey.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Read my blog posting guidelines here.

Share
Categories
Authentication backdoors hacking Intelwars Open Source Supply chain

Backdoor Added — But Found — in PHP

Unknown hackers attempted to add a backdoor to the PHP source code. It was two malicious commits, with the subject “fix typo” and the names of known PHP developers and maintainers. They were discovered and removed before being pushed out to any users. But since 79% of the Internet’s websites use PHP, it’s scary.

Developers have moved PHP to GitHub, which has better authentication. Hopefully it will be enough — PHP is a juicy target.

Share
Categories
cyberattack google Intelwars Terrorism zero day

Google’s Project Zero Finds a Nation-State Zero-Day Operation

Google’s Project Zero discovered, and caused to be patched, eleven zero-day exploits against Chrome, Safari, Microsoft Windows, and iOS. This seems to have been exploited by “Western government operatives actively conducting a counterterrorism operation”:

The exploits, which went back to early 2020 and used never-before-seen techniques, were “watering hole” attacks that used infected websites to deliver malware to visitors. They caught the attention of cybersecurity experts thanks to their scale, sophistication, and speed.

[…]

It’s true that Project Zero does not formally attribute hacking to specific groups. But the Threat Analysis Group, which also worked on the project, does perform attribution. Google omitted many more details than just the name of the government behind the hacks, and through that information, the teams knew internally who the hacker and targets were. It is not clear whether Google gave advance notice to government officials that they would be publicizing and shutting down the method of attack.

Share
Categories
Intelwars

While Congress Is Still on Easter Recess, Biden Keeps Campaigning for $2.2 Trillion Infrastructure and Recovery

United Front Against Austerity|Tax Wall Street Party American System Network|April 7, 2021 President Challenges GOP to Join Effort or Be Exposed as Party of K-Shaped Recovery; Biden Touts “Largest Single Investment in American Jobs Since World War II”; Republicans Are Using an Obsolete Concept of Infrastructure: Today’s Infrastructure Includes High-Speed Rail, Water Projects, High-Speed Internet, […]

Share
Categories
Cryptocurrency Encryption Intelwars privacy signal

WTF: Signal Adds Cryptocurrency Support

According to Wired, Signal is adding support for the cryptocurrency MobileCoin, “a form of digital cash designed to work efficiently on mobile devices while protecting users’ privacy and even their anonymity.”

Moxie Marlinspike, the creator of Signal and CEO of the nonprofit that runs it, describes the new payments feature as an attempt to extend Signal’s privacy protections to payments with the same seamless experience that Signal has offered for encrypted conversations. “There’s a palpable difference in the feeling of what it’s like to communicate over Signal, knowing you’re not being watched or listened to, versus other communication platforms,” Marlinspike told WIRED in an interview. “I would like to get to a world where not only can you feel that when you talk to your therapist over Signal, but also when you pay your therapist for the session over Signal.”

I think this is an incredibly bad idea. It’s not just the bloating of what was a clean secure communications app. It’s not just that blockchain is just plain stupid. It’s not even that Signal is choosing to tie itself to a specific blockchain currency. It’s that adding a cryptocurrency to an end-to-end encrypted app muddies the morality of the product, and invites all sorts of government investigative and regulatory meddling: by the IRS, the SEC, FinCEN, and probably the FBI.

And I see no good reason to do this. Secure communications and secure transactions can be separate apps, even separate apps from the same organization. End-to-end encryption is already at risk. Signal is the best app we have out there. Combining it with a cryptocurrency means that the whole system dies if any part dies.

Share
Categories
Intelwars

Russia and China Reported Running Aggressive anti-US Subversion Operations in Mexico

United Front Against Austerity|Tax Wall Street Party American System Network|April 6, 2021 Biden and Blinken Must Engage Central and Latin American Leaders ASAP; Biden White House Issues April 6 Clarification that Covid Shots and “Vaccine Passports” Will Not Be Mandated by US Government, Thus Depriving GOP Demagogues of Their Best Scaremongering Issue for 2022; Communist […]

Share
Categories
cell phones Cloning Intelwars Scams Uber

Phone Cloning Scam

A newspaper in Malaysia is reporting on a cell phone cloning scam. The scammer convinces the victim to lend them their cell phone, and the scammer quickly clones it. What’s clever about this scam is that the victim is an Uber driver and the scammer is the passenger, so the driver is naturally busy and can’t see what the scammer is doing.

Share
Categories
Intelwars

TARPLEY.net 2021-04-05 23:46:29

United Front Against Austerity|Tax Wall Street Party American System Network|April 5, 2021 GOP Senator Roy Blunt of Missouri, a Lame Duck from the McConnell Leadership Clique, Reveals on ABC How the Pluto-Party Intends to Block Biden’s $2.2 Trillion Recovery and Infrastructure Act and Cripple the United States in the Contest with Chinese Communism; Pretending to […]

Share
Categories
academic papers Intelwars sensors Wi-Fi wireless

Wi-Fi Devices as Physical Object Sensors

The new 802.11bf standard will turn Wi-Fi devices into object sensors:

In three years or so, the Wi-Fi specification is scheduled to get an upgrade that will turn wireless devices into sensors capable of gathering data about the people and objects bathed in their signals.

“When 802.11bf will be finalized and introduced as an IEEE standard in September 2024, Wi-Fi will cease to be a communication-only standard and will legitimately become a full-fledged sensing paradigm,” explains Francesco Restuccia, assistant professor of electrical and computer engineering at Northeastern University, in a paper summarizing the state of the Wi-Fi Sensing project (SENS) currently being developed by the Institute of Electrical and Electronics Engineers (IEEE).

SENS is envisioned as a way for devices capable of sending and receiving wireless data to use Wi-Fi signal interference differences to measure the range, velocity, direction, motion, presence, and proximity of people and objects.

More detail in the article. Security and privacy controls are still to be worked out, which means that there probably won’t be any.

Share