NC #597 Credit Card Mixup at Apple, Easy Pill, Clean Install of macOS, Security Bits

Something appears to be fishy with Apple’s databases, based on my story of how someone else’s credit card got into my account. Mark Pouley of Twin Lakes Images gives a great review of the Easy Pill medication tracker and reminder for iOS. I’ll tell you why I think doing a clean install of your OS from time to time and not using Migration Assistant is a good idea, but I’ll follow that up with all the little fiddly bits I’ve had to modify to get things running again. Bart Busschots is back with Security Bits where he gives us an update on the security of the Internet of Things and more information that’s been coming out, along with all of the rest of this week’s security news.

mp3 download

Hi this is Allison Sheridan of the NosillaCast Mac Podcast, hosted at Podfeet.com, a technology geek podcast with an EVER so slight Macintosh bias. Today is Sunday October 16, 2016 and this is show number 597.

Chit Chat Across the Pond

Bart Busschots is back with installment 23 of his Programming By Stealth series. Last time we learned how to change what elements on a web page looked like, but this week we learn how to actually change and create them. He’s using a real world example of changing whether links on a web page open in a new tab or replace the existing page. If we’re good and do our homework, next time we’re going to actually build a clock! He picked this example because the clock on podfeet.com/live broke when we went to https and without it no one knows if it’s 5 o’clock at my house and therefore time for the live show! It’s a fun episode so don’t forget to subscribe to Chit Chat Across the Pond in your podcatcher of choice.

Blog Posts

How Did Someone Else’s Credit Card Get in My Apple ID?

Easy Pill Medication Tracker and Reminder

Clean Install of macOS is a LOT of Work, Is it Worth It?

Security Bits

Followup – Mirai (IoT Botnet)

In the last instalment we reported on the botnet made up of Internet of Things devices that took down Brian Krebs’ website with a record-breaking Distributed Denial of Services (DDOS) attack. That attack has continued to make news, and to focus minds in the security community.

Brian Krebs has examined the Mirai source code (released two weeks ago) and reverse-engineers a list of vulnerable devices based on default username/password combinations present in the source-code – it’s mostly cameras, DVRs, and routers. What’s very worrying is that many of the devices on the list can be accessed by both a web interface and telnet/SSH, and changing the default password in one, often does not change it in the other, so even people who think they have changed the password may not have actually removed access via the default passwords. If that sounds bad, some devices made by Dahua are even worse – they have hard-coded SSH/Telnet passwords that cannot be changed by the user AT ALL!

Security maven Bruce Schneier has argued that the only solution to situations like this, when markets are clearly failing to protect customers, and indeed the entire internet, is government regulation. The European Commission seems to be thinking along similar lines. They are said to be working on a new official rating system for IoT security built around the model of European Energy Efficiency ratings. Devices would be tested against a set of rules, and they would earn a rating depending on how secure they are.

To highlight the depth of the problem, a Hungarian security researcher went public with a laundry list of spectacular flaws in internet connected cameras from Taiwanese tech company AVTECH (not the same as a US company with the same name which makes environmental monitoring equipment). These devices spew out their config to anyone who asks – the config page does not check if the user is logged in. The login checking has many more holes, allowing some files that should not be public to be downloaded from the devices without logging in. A number of URLs on the device don’t get properly sanitised, so you can inject terminal commands into the device through URLs – i.e. easy remote code execution. The devices also don’t check TLS certs when contacting their cloud service, so they may as well not have HTTPS at all. Passwords are stored in plain text, so when you combine that with the problem that they spit out private files they shouldn’t you get a really big problem.

Akamai also highlighted another problem they are seeing with IoT devices – many of them have poorly configured SSH deamons that allow them to be recruited into botnets without ever needing to be hacked at all. SSH can act as a kind of proxy, which is normally a good thing. However, of poorly configured, SSH can allow proxying by users that are not logged in, and millions of IoT devices are poorly configured in this way. To try highlight the point, and get the problem addressed, Akamai have given it a catching name SSHowDowN (from the terminal command to exploit this misconfiguration ssh -D -N).

Meanwhile, the US government-backed ICS-CERT is warning of problems with Cellular Gateways used to connect automotive and industrial equipment to the internet – arstechnica.com/…

Links:

Who makes the IoT things under attack – krebsonsecurity.com/…
We Need to Save the Internet from the Internet of Things – motherboard.vice.com/…
Europe to Push New Security Rules Amid IoT Mess – krebsonsecurity.com/…
CCTV that lets the crooks watch you, not the other way around… – nakedsecurity.sophos.com/…
Is your router taking part in DDoS attacks right under your nose? (SSHowDowN) – nakedsecurity.sophos.com/…
IoT Devices as Proxies for Cybercrime – krebsonsecurity.com/…

Security Medium – Cryptographic Trapdoors

Cryptographers have found a long-theorised, but never before realised, trapdoor in the discrete logarithm problem, the maths at the heart of many encryption algorithms. If an attacker can choose the prime number at heart of the encryption, they can make the encryption easier to crack by four orders of magnitude (10,000x). This brings 1024 bit crypto into the danger-zone, but 2048 bits is still safe.

There is no way to tell by looking at any given prime, whether or not it has a trapdoor in it. This is not a problem for many kinds of crypto – for example, SSH keys and TLS certs both use prime numbers chosen by the creator of the key or the requester of the cert. The person running the server being connected to does not need to break crypto to see what is happening on their server, they are at the end of the encryption, so they see the stuff in plain-text anyway! The only way these trapdoor could cause problems for HTTPS or SSH would be if people accepted private keys created for them by others. However, other encryption algorithms depend on a handful of standardised primes which are written into the standards, but often of unknown origin. This will have to change going forward. Any standard that relies on pre-defined primes will have to show where those primes came from, so we can be sure they are safe. There are plenty of ways of doing this.

This was always a theoretical possibility in the back of cryptographers heads. Now, it is a reality. There is no need to panic though. In the short term, we need to finish the move to 2048bit encryption that is already well under way, and perhaps accelerate the decommissioning of 1024bit crypto. In the long term we need to make sure that all new standards the rely on standardised primes show how the primes were arrived at so we can be confident they are truly random, and hence, safe.