IoT Vulnerabilities in “Smart Guns”

As IoT technology advances with wireless cards and connections being added to nearly every modern appliance, so to the IoT becoming a piece of military and weapons technology. While not unexpected, it is still considered very concerning among security researchers that vulnerabilities in technology of personal firearms may create new risks and hazards to all.

In 2015 two security researchers, Runa Sandvik and Michael Auger, revealed vulnerabilities in the software of firearms manufacturing company TrackingPoint’s newly designed TP750 Sniper Rifle. The scope of the $13,000 rifle houses an on board computer utilizing the Linux Kernel in order to help the shooter determine the best possible shot from calculating thousands of variables, including bullet weight, wind speed, environmental temperature, range, lighting, etc. The “smart scope” also houses a wireless card and bluetooth connector which is what allowed Sandvik and Auger to use an exploit via SSH in order to connect remotely to the on board computer. Once connected and given root privileges(the rifle used default passwords), the two researchers were able to change any variable in the scopes software. By changing a single variable in the targeting systems code, the scope accounted the bullet weight of the rifle round not as the actual .4 ounces, but as 72 pounds, causing the rifle to highly over compensate and fire far above the target. Sandvik stated that, “You can make it lie constantly to the user so they’ll always miss their shot.”  Sandvik and Auger revealed that the exploit used allowed them to do anything from make the rifle miss, shoot next to the intended target, or even just delete the entire file system of the scope’s on board computer.

Since the discovery, the rifle’s manufacturer, TrackingPoint, has laid off a majority of its staff, switched CEO’s, and has stopped taking orders for their rifles. Despite being contacted by both, Sandvik and Auger, TrackingPoint has yet to reveal if they have patched the software in their scopes.

In more recent news, a hacker using the alias “Plore” revealed at the the 2017 Defcon Security Convention that he was able to use magnets to hack another “smart gun”. In 2006, German arms developer Armatix developed the Armatix iP1, a .22LR caliber handgun that uses RFID technology in order to allow only permitted users to fire the weapon. The Armatix iP1 uses an RFID encoded wrist watch system that releases the magnetically locked safety mechanism in the gun when the watch is within 10 inches of the wearer. Independently seeking for a work around to the gun itself, Plore discovered two methods through which malicious entities would be able to hack the “smart gun”. After purchasing one of the handguns himself, Plore found that the RFID protections could be overridden by generating the same RFID signal from a pair of $20 homemade radio relays he had made from hardware he had purchased at a HomeDepot. The homemade relay would allow him to trick the RFID receiver in handgun into thinking he had the watch on, while in fact the watch itself was in another room.

Plore also discovered that the magnetic locks on the safety mechanism in the Armatix iP1 could also be moved and unlocked with an even simpler work around by holding $15 worth of magnets next to the gun itself. By using magnets also bought from a hardware store, Plore was able to simply unlock the safety and fire the gun repeatedly.

While weapons designers and manufacturers are working to create new and more technologically modern firearms, security researchers fear that attempts by companies may fall short as these two have. And as many critics agree that IoT connected and other “smart guns” are likely to continue being made and designed, they still fear that the vulnerabilities that they create will do more harm than good. Only time will tell if though, if the fear for “smart guns” is as concrete as the experts claim it to be.

– Henry Keena

Sources:

https://www.wired.com/2015/07/hackers-can-disable-sniper-rifleor-change-target/#slide-4

https://www.wired.com/story/smart-gun-fire-magnets/

https://arstechnica.com/gadgets/2015/05/trackingpoint-in-trouble-smart-gun-company-stops-orders-lays-off-staff/

A More “Intimate” IoT Issue

As humans get more attached to technology, it appears that we also get more detached from reality and those around us. The meaning of interpersonal relationships gets foggier as our practical need for face-to-face interaction is lost. But the loss of the practicality of it in day-to-day life does not mean that humans do not desire personal relationships. To be more specific, the human desire for a romantic relationship does not dwindle even as our desire to go out and create one does. Some would say that a solution to this issue would be, gently put, robotic escort services.

Whether these robotic prostitutes are for hire or are personally owned is beyond the scope of this discussion. As is whether this is a good direction for humanity to go in. The issue to be discussed is much graver than that.

As the IoT grows more populous with frivolous devices, one cannot help but come across articles stating the dangers of having these devices on the internet. Sure, hacking a toaster can allow you access to someones home network. And yes, a juice press that connects to World Wide Web seems more than a little bit silly. But they are merely pocket change when compared to the possibility of being killed by an IoT device. If during use, one of these sex robots was to be hacked it could be commanded to kill you. If this sounds ridiculous to you, I’m certain that you’re not alone. But Dr. Nick Patterson of Deankin University in Australia will have you know that this is not at ridiculous as it may seem.

“Hackers can hack into a robot or a robotic device and have full control of the connections, arms, legs and other attached tools like in some cases knives or welding devices,” Patterson says. “Often these robots can be upwards of 200 pounds, and very strong. Once a robot is hacked, the hacker has full control and can issue instructions to the robot. The last thing you want is for a hacker to have control over one of these robots. Once hacked they could absolutely be used to perform physical actions for an advantageous scenario or to cause damage.”

While an immediate threat is not thought to be present, it is certainly a consideration one should make before purchasing one of these machines in the future.

-Alan Richman

Sources: Patterson initially gave this information to the Daily Star in the United Kingdom. The given link is to the source with this information containing no graphic, explicit, or sexual imagery.

http://bgr.com/2017/09/11/sex-robot-hack-security-cyborg/

Major Accounting Firm Deloitte Hit by Extensive Cybersecurity Data Breach

Similar to Equifax’s data breach, Deloitte with $37B in annual revenues, suffered an extensive cybersecurity data breach that led to a lot of things being compromised. Moreover, Deloitte did not tell anyone similar to Equifax, both of the company’s data had been compromised months ago before reported. Deloitte kept the hack internally secret, only informing “a handful” of senior partners and lawyers, as well as six clients. The company is one of the world’s Big Four accounting firms — which works with large banks, global firms, and government agencies, among others, provides tax and auditing services, operations consulting, merger and acquisition assistance and, ironically cybersecurity advice.

The hackers compromised confidential emails, sensitive attachments, the hackers may have gotten their hands on usernames, passwords, IP addresses, business information and workers’ health records. The Guardian reported that six Deloitte clients have already confirmed that the hack had impacted their data. Deloitte has yet to establish whether a lone wolf, business rivals, or state-sponsored hackers were responsible.

The cause of the data breach was apparently stemmed from an administrator’s account that was protected by a single password and did not have multi-factor authentication setup. The attack was discovered back in March 2017, but the attackers could have gained access as early as October 2016. The emails were stored in Microsoft Azure; some 5 million emails were said to have been stored in the cloud when it was compromised. Compromised email servers are usually filled with very sensitive information that hackers can exploit and even spear phish people with. However, Deloitte told The Guardian that only a fraction were actually at risk. Deloitte’s internal review is still ongoing.

-Matthew Brown

Sources:

https://www.engadget.com/2017/09/25/deloitte-reports-extensive-cybersecurity-breach/

http://www.bbc.com/news/technology-41385951

http://www.techrepublic.com/article/deloitte-hacked-cybersecurity-attack-compromises-client-emails-and-plans/

https://boingboing.net/2017/09/25/uh-oh.html

BankBots on the Google Play Store

 

Image courtesy of SecurityLab.ru. Yes, it’s Russian.

“The Google Play store once again has been invaded with apps carrying BankBot.” The article, written by Bradley Barth for SC Magazine, starts off on a strong note. What catches my attention is the short phrase once again. That, however, is for another time. BankBots are on the rise again, and it’s spread to 160 apps across 27 different countries, according to Barth.

“What is BankBot,” an article on The Merkle, desribes BankBot’s as “Android Banking Trojans.” BankBot is a malicious campaign with an intent to attack us through convenience — banking apps. Once there was a time when the biggest threat to banks were physical robberies and stock market crashes. Nowadays, the Internet of Things is the biggest perpetrator of bank attacks.

With the shift towards total digital domination of our lives, banks have followed suit by developing downloadable apps for ease-of-access banking. Of course, these banks require legitimate credentials for use. BankBots take advantage of this fact, as well as the lack of attention by consumers to develop imitation apps that somehow evade all Google Play Store legitimacy checks. So, how easy is it to get into BankBotting? Buntinx of The Merkle feels as though anyone can get started in the business of malicious banking. Many well-known hacking forums (remaining unnamed for obvious reasons) have multiple easy-to-follow, step-by-step, baby’s-first-BankBot tutorials that anyone can follow, free of charge. Because of this, there isn’t just one type of BankBot; people are taking the base design and creating personalized copies that range in complexity and scope of attacks.

In the months of April, May, and June of 2017, 62 separate long-term BankBot campaigns were discovered and shut-down. This was only the first wave of mass-BankBotting. BankBots were found to be the first malicious banking Trojans able to work their way into many high-security banks, work internationally, bypass Play Store vetting, and have the ability to communicate to web-based backends. These Trojans also have the ability to hijack and intercept SMS messages. Well-known banking Trojans like ZeuZ and EDA2 are beginning to find themselves shadowed by the ability of the BankBot campaign.

This campaign only affects Android users using third-party or non-major banking apps. The only way to protect your banking credentials is using trusted apps and websites (or just stick to iOS).

-Ryan W. Moore, 21 September 2017

Sources:

https://www.scmagazine.com/more-bankbot-apps-sneak-into-google-store-uae-banks-added-to-malwares-targets/article/688379/

https://themerkle.com/what-is-bankbot/

 

CCleaner Hack

As of Augusts 15th the application CCleaner was hacked.

CCleaner is an application made by Piriform that works on computers running Microsoft Windows. The intent of this application is to clean out the temporary files, broken shortcuts, unneeded files along with other ‘junk’. This application also cleaned out the users’ browser history and temporary internet files to help protect the users from identity theft and help protect their privacy.

This Avast download servers were compromised by a group of unknown of hackers for nearly a month. From August 15th to September 12th, CCleaner was replaced with a malicious version. This is a prime example of a supply chain attack, where hackers indirectly attack a company through the company’s process of supplying a product.

The versions that were effected have been confirmed by Avast and Piriform. The effected versions are Windows 32-bit version of CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191. The malware was at first detected on September 15. This malicious version used a multi-staged malware payload that takes data from infected computers and sends it to the attackers’ remote command-and-control servers.

Data Stolen:

• Computer name
• List of installed software, including Windows updates
• List of all running processes
• IP and MAC addresses
• Additional information like whether the process is running with admin privileges and whether it is a 64-bit system.

Based on an estimate of 5 million downloads per week, it is indicated that about 20 million people could’ve been affected by this malware. Piriform estimated that approximately 3% of its users ( 2.27 million people) were affected. Piriform strongly recommends strongly that the affected users download version 3.5 or higher of CCleaner.

– Justin Palmer

Sources:

https://www.piriform.com/docs/ccleaner/introducing-ccleaner

http://thehackernews.com/2017/09/ccleaner-hacked-malware.html

https://www.cnet.com/how-to/ccleaner-was-hacked-heres-what-to-do-next/