The IT Nerd

This week, a stunning story from Vice revealed how easy it is for an attacker to steal your text messages and do evil things with them. Let me illustrate how easy it is:

• Pay a trivial sum of money.
• Convince a VoIP wholesaler that they’re a reseller.
• Sign a form swearing that they’re allowed to route messages to your number to another number.
• Pwnage

Why is this important? It’s important because a lot of people use text messages as a means to do two-factor or multi-factor authentication for websites and other online accounts. Which means that if someone has access to your text messages, they have access to any account that uses text messages for authentication.

While that sounds scary, and it should sound scary, there are ways to protect yourself from this. You should be using a dedicated two-factor authentication app that requires physical access of your hardware—typically your phone—to finish the login process for an account. An example of this would be Microsoft Authenticator or Google Authenticator which bypass text messages to deliver the codes required for two-factor or multi-factor authentication. It also means that the bad guys need physical access to your phone to try and break into your online accounts. Quite simply, that’s not going to happen.

But there’s one slight problem. What if the service that you need to use only use text messages for authentication? Then I guess you are kind of stuck. Sort of. You can use a service like this one to monitor if, or when, your phone number’s texts are routed elsewhere. And a really, really strong password helps too. Along with not using obvious answers for your security questions.

Do you have any other suggestions that can help all of us keep our online accounts safe? If you do, leave them in the comments and share your thoughts.

Most people think that home routers are “plug in and forget” items that allow them to get their devices onto the Internet with having to think about it any further. Except that they aren’t “plug in and forget” devices. They provide security for your home network, which means that you have to make sure that the firmware is up to date. That also requires that the vendor of the router is on top of security threats and the like, and that they are putting out firmware for you to install.

That’s where this study from the Fraunhofer Institute for Communication comes in. It involved 127 routers from seven manufacturers and found the following:

• The researchers compared the firmware images from each tested router with known vulnerabilities and exploits, and the findings were disturbing. Many of the routers were found to be affected by hundreds of known vulnerabilities. Not a single router tested found to be without at least one known vulnerability. And 46 of the routers tested had not received an update in the last year. And 22 had not updated in the last two years. In the worse case, some routers were found to have not been updated in five years.
• Even when routers had received updates, 50 were found to used hard-coded qualifications: The username and password were encoded into the router as a default, meaning that attackers could easily gain access.

Then there’s the question of who makes security a top priority. Here’s the answer:

Nonetheless, vendors seem to prioritize security differently. Especially AVM does a better job than the other vendors regarding most of the security aspects. However, AVM routers are not flawless as well. ASUS and Netgear do a better job on some aspects than D-Link, Linksys, TP-Link and Zyxel.

Now while I could quibble about aspects of this study, I think the study paints a pretty stark picture. And router companies need to up their game. But until they get around to doing that, here’s my advice to minimize your risk:

1. Buy a router from a company that is known to have frequent updates to their products, and who has a track record for updating their products over the long term.
2. Check for updates frequently and apply them ASAP. Because hackers are not looking for routers that are up to dat. They’re looking for the ones that aren’t.
3. Check the router logs from time to time to make sure that there’s no funny business goin on in terms of someone trying to break into your network.

Wired has a story on a new type of Mac ransomware that is out there. Now if you don’t download pirated software, this isn’t a threat to you. At least not at the moment. But that is likely to change given how sophisticated this ransomware is:

The threat of ransomware may seem ubiquitous, but there haven’t been too many strains tailored specifically to infect Apple’s Mac computers since the first full-fledged Mac ransomware surfaced only four years ago. So when Dinesh Devadoss, a malware researcher at the firm K7 Lab, published findings on Tuesday about a new example of Mac ransomware, that fact alone was significant. It turns out, though, that the malware, which researchers are now calling ThiefQuest, gets more interesting from there. In addition to ransomware, ThiefQuest has a whole other set of spyware capabilities that allow it to exfiltrate files from an infected computer, search the system for passwords and cryptocurrency wallet data, and run a robust keylogger to grab passwords, credit card numbers, or other financial information as a user types it in. The spyware component also lurks persistently as a backdoor on infected devices, meaning it sticks around even after a computer reboots, and could be used as a launchpad for additional, or “second stage,” attacks. Given that ransomware is so rare on Macs to begin with, this one-two punch is especially noteworthy.

Though ThiefQuest is packed with menacing features, it’s unlikely to infect your Mac anytime soon unless you download pirated, unvetted software. Thomas Reed, director of Mac and mobile platforms at the security firm Malwarebytes, found that ThiefQuest is being distributed on torrent sites bundled with name-brand software, like the security application Little Snitch, DJ software Mixed In Key, and music production platform Ableton. K7’s Devadoss notes that the malware itself is designed to look like a “Google Software Update program.” So far, though, the researchers say that it doesn’t seem to have a significant number of downloads, and no one has paid a ransom to the Bitcoin address the attackers provide. […] Given that the malware is being distributed through torrents, seems to focus on stealing money, and still has some kinks, the researchers say it was likely created by criminal hackers rather than nation state spies looking to conduct espionage.

Clearly this is pretty sophisticated stuff and the means of distributing it will likely become more targeted over time as I cannot see the authors of this ransomware sticking with the method of hoping that you will download pirated software. I say that because whoever designed this clearly has something more “interesting” in mind.

Here’s some general advice for you. Back you your files every single day. That way if you get infected by ransomware, you can just nuke the computer and restore your files and go on with your life without paying the ransom. Which by the way, paying the ransom is something that you should never, ever do as it only encourages the scumbags who make ransomware. And you might not get your files back either. Which means that you handed these scumbags your money for no good reason.

Israel based NSO Group is making noise today by making some stunning claims. The Financial Times has details, but let me boil it down for you. In short this company has been telling its government customers that its Pegasus malware can now extract far more data about any given individual. Specifically, it can snag data on the person’s smartphone, as well as covertly retrieve all of the information that person has stored on servers owned by Apple, Google, Microsoft, Facebook and Amazon. This is a stunning revelation, assuming that this is true of course. Which it could be because this is the same group who hacked WhatsApp back in May. That forced an emergency patch to be issued by Facebook who owns WhatsApp.

Now both Apple, Amazon and Microsoft have put out statements saying they’re investigating this threat. And the word on the street is that Apple has blocked previous versions of this malware before. So this may be either a non-factor very quickly. or it might be the start of a game of cat and mouse that has users of these devices in the middle.

UPDATE: Mike Beck, Global Head of Threat Analysis for Darktrace reached out to me with this comment:

“This news highlights the reality of the cyber arms industry – private organisations, of which NSO is one example, are developing and selling spyware which is then often used by government agencies to catch sophisticated criminals. It stands to reason that national governments who are not equipped with large national intelligence budgets will look to the private sector to provide this capability.

However, if private sector companies are authorised to develop cyber weapons, outside of the accountability of government institutions, there are concerns about how these tools can be used. In the wrong hands, we could see this malware used to collect intelligence on average citizens and even used against nation-states, as part of cyber-warfare.

As the world’s attitude towards cyber-security matures, we can expect international law to control the use of these weapons. Meanwhile the likes of Apple, Google and Facebook will need to demonstrate that they can identify security threats and intervene rapidly, before user data is breached. AI will be a necessary ally to achieve this, given the complexity of today’s threat landscape, and the volume and diversity of the data systems that require protecting.”