ASUS, Microsoft, & Tesla – Hack Naked News #212

Zero-Days in Counter Strike client could be used to build a major botnet, huge aluminum plants hit by ‘severe’ ransomware attack, Myspace loses 50 million songs in server migration, wifi signals can reveal your password, and PuTTY in your hands: an SSH client gets patched after RSA key exchange memory vulnerability was spotted! Ralf Hund from VMRay joins us for expert commentary to discuss the Evolution of GandCrab!

Security News

1. Asus pushes patch after hackers used updates to send malware – The supply chain strikes again: Thousands of Asus computers were infected with malware from the company’s own update tool, researchers from Kaspersky Lab said Monday. . The hack, which Kaspersky Lab is calling Operation ShadowHammer, went on between June and November 2018. Kaspersky Lab found that it affected more than 57,000 people using its products. The Russia-based cybersecurity company was only able to find those numbers for its own users, and estimates that the malware could affect more than a million Asus owners worldwide.
2. ASUS Releases Security Update for Live Update Software – ASUS has released Live Update version 3.6.8. This version addresses vulnerabilities that a remote attacker could exploit to take control of an affected system. These vulnerabilities were detected in exploits in the wild.
3. Microsoft Announces Windows Defender ATP Antivirus for Mac – Microsoft Thursday announced that the company is bringing its anti-malware software to Apple’s macOS operating system as well—and to more platforms soon, like Linux. As a result, the technology giant renamed its Windows Defender Advanced Threat Protection (ATP) to Microsoft Defender Advanced Threat Protection (ATP) in an attempt to minimize name-confusion and reflect the cross-platform nature of the software suite.
4. Microsoft experts found high severity flaws in Huawei PCManager – experts discovered the flaws because the kernel sensors in Microsoft Defender Advanced Threat Protection (ATP) detected an anomalous behavior associated with a Huawei device management driver. Further analysis revealed that the Huawei’s PCManager tool pre-installed on MateBook laptops is affected by a vulnerability (CVE-2019-5241) that can be exploited by an attacker for local privilege escalation. An attacker can trigger the flaw by tricking the victims into executing a malicious application.
5. Researchers find 36 new security flaws in LTE protocol | ZDNet – A group of academics from South Korea have identified 36 new vulnerabilities in the Long-Term Evolution (LTE) standard used by thousands of mobile networks and hundreds of millions of users across the world. The vulnerabilities allow attackers to disrupt mobile base stations, block incoming calls to a device, disconnect users from a mobile network, send spoofed SMS messages, and eavesdrop and manipulate user data traffic. They were discovered by a four-person research team from the Korea Advanced Institute of Science and Technology Constitution (KAIST), and documented in a research paper they intend to present at the IEEE Symposium on Security and Privacy in late May 2019.
6. Paper: Leaked authentication secrets pervasive across GitHub – An academic study of GitHub found that more than 100,000 of the web service’s code repositories contain publicly accessible authentication secrets such as API and cryptographic keys, while thousands of new secrets are leaked each day.North Carolina State University researchers Michael Meli, Matthew McNiece (also from Cisco Systems) and Bradley Reaves detail their findings in a paper published last month in conjunction with the 2019 Network and Distributed Systems Security Symposium.The researchers combined two approaches to identify the leaked secrets. The first methodology involved querying a GitHub a repository search engine API for nearly six months, from Oct. 31, 2017 through April 20, 2018. The second technique involved using BigQuery, a web service that enables analysis of massive datasets, to query a weekly snapshot of GitHub activity on April 4, 2018.
7. New Settings Let Hackers Easily Pentest Facebook, Instagram Mobile Apps – Since almost all Facebook-owned apps by default use security mechanisms such as Certificate Pinning to ensure integrity and confidentiality of the traffic, it makes it harder for white hat hackers and security researchers to intercept and analyze network traffic to find server-side security vulnerabilities.For those unaware, Certificate Pinning is a security mechanism designed to prevent users of an application from being a victim of network-based attacks by automatically rejecting the whole connection from sites that offer bogus SSL certificates.Dubbed “Whitehat Settings,” the new option now lets researchers easily bypass Certificate Pinning on the Facebook-owned mobile apps by: Disabling Facebook’s TLS 1.3 support, Enabling proxy for Platform API requests, Using user-installed certificates “Choose not to use TLS 1.3 to allow you to work with proxies such as Burp or Charles which currently only support up to TLS 1.2,” Facebook says.
8. Under Attack: Over Half of SMBs Breached Last Year – According to Cisco’s “Small and Mighty” Cybersecurity Special Report — drawing on data gathered from 1,816 respondents across 26 countries — more than half (53%) of midmarket companies suffered a security breach in 2018.As outlined in the survey’s report, respondents worry most about targeted attacks against employees (think phishing), advanced persistent threats (such as new types of malware), and distributed denial-of-service attacks
9. Researchers get a free Tesla for spotting infotainment system bug| SC Media – Tesla awarded two researchers a car after they found a vulnerability in the vehicle’s infotainment system which allowed them to commandeer the vehicle. The exploit was found during the Pwn2Own hacking event held in Vancouver during which Tesla was the first automaker to participate and ultimately led to the researchers receiving $375,000 in prizes, including a free Model 3 for their efforts.

Full Show Notes

To learn more about Netsparker, visit: https://securityweekly.com/netsparker

Visit http://hacknaked.tv to get all the latest episodes!

Paul Asadorian – CEO, DigitalMunition.

http://traffic.libsyn.com/sw-all/ASUS_Microsoft__Tesla_-_Hack_Naked_News_212_converted.mp3