ADT Tech Spied On Women For Four Years Before Getting Caught By Accident

from the what's-the-opposite-of-security dept

Another day, another example of why we might want to actually pass at least a basic privacy law for the internet era. The latest problem bubbled up over at home security vendor ADT, after a technician was caught using home security cameras to spy on people for years. More specifically, the tech accessed customer video cameras in 200 homes some 9,600+ times over a period of four years. His preferred targets were attractive women he spied on while they were having sex, bathing, or getting dressed. This was, as US Attorney Prerak Shah was quick to note, a grotesque abuse of trust:

"This defendant, entrusted with safeguarding customers’ homes, instead intruded on their most intimate moments,” said Acting U.S. Attorney Prerak Shah. “We are glad to hold him accountable for this disgusting betrayal of trust."

The tech simply added his email address to the authorization list for the company's ADT Pulse accounts, which lets home security customers access cameras when not at home. ADT's now facing three different lawsuits for failing to "implement adequate procedures that would prevent non-household members from adding non-household email addresses." Aka, they didn't engage in some basic due diligence to ensure that employees couldn't abuse the system. The federal charges were brought some five months after the first lawsuit was filed.

One of the interesting bits is that he appeared to have only been caught by accident, and could easily still be engaging in the same behavior today if not for one attentive subscriber:

"The lawsuit also claims the flagrant security breach was discovered not by the company, but 'by luck and happenstance.' A customer, reporting a technical issue, inadvertently revealed the unwanted third-party access," the lawsuit claims. "But for that event, ADT would be unaware of this invasive conduct."

So no basic security measures to prevent employees from abusing their authority. No system to notify users when somebody new was added to the email access list for video cameras they provide. ADT didn't even know this was going on -- and if not for a customer being attentive it probably still would be. And this is a security company! It's notably worse for the parade of "internet of thing" companies that decided we needed to hook every home device up to the internet with zero willingness to embrace or fund basic privacy and security standards.

In ADT's case, the company is busy trying to dodge responsibility by throwing complaining customers into binding arbitration, a lopsided process that pretends to be better than traditional class actions, but usually winds up with the companies in question getting little more than a wrist slap. When you know that repeated privacy and security violations can be brushed aside with a modicum of billable legal hours, you're not inclined to try very hard. It's far easier, and less expensive, to half-ass it, then have your lawyers water down already flimsy after-the-fact penalties.

It's why properly staffing and funding our privacy regulators, and having a basic privacy law where the expectations are clear and the penalties are notable (and consistently enforced) seems like a no brainer. Though it's still amazingly not clear how many national privacy scandals are necessary before we finally figure out that our existing "solution" of apathy, wrist slaps, binding arbitration, and intentional policy gridlock aren't working very well.

Filed Under: doj, iot, privacy, security, surveillance
Companies: adt

Internet-Connected Chastity Cages Hit By Bitcoin Ransom Hack

from the the-future-is-not-what-we-were-promised dept

If you hadn't noticed yet, the internet of things is a security and privacy shit show. Millions of poorly secured internet-connected devices are now being sold annually, introducing massive new attack vectors and vulnerabilities into home and business networks nationwide. Thanks to IOT companies and evangelists that prioritize gee-whizzery and profits over privacy and security, your refrigerator can now leak your gmail credentials, your kids' Barbie doll can now be used as a surveillance tool, and your "smart" tea kettle can now open your wireless network to attack.

So of course this kind of security and privacy apathy has extended to more creative uses of internet-connected devices. Case in point: last October, security researchers found that the makers of an IOT chastity cage -- a device used to prevent men from being able to have sex -- (this Amazon link has the details) had left an API exposed, giving hackers the ability to take remote control of the devices. And guess what: that's exactly what wound up happening. One victim and device user say he was contacted by a hacker who stated he wouldn't be able to free his genitals from the device unless he ponied up a bitcoin ransom.

Luckily his genitals weren't in the device at the time, though it's not clear other users were as lucky:

"A victim who asked to be identified only as Robert said that he received a message from a hacker demanding a payment of 0.02 Bitcoin (around $750 today) to unlock the device. He realized his cage was definitely "locked," and he "could not gain access to it." "Fortunately I didn’t have this locked on myself while this happened," Robert said in an online chat."

Given the often nonexistent security on internet of things devices, such problems aren't particularly uncommon in devices like not-so-smart thermostats. It's also a major problem in many hospitals where big medical conglomerates haven't been willing to pony up the money necessary to keep lifesaving technology private and secure. That said, "I had to pay some kid in the Ukraine $750 so I could access my own genitals" is a new wrinkle many hadn't seen coming.

It's just yet another reminder that you shouldn't connect everything to the internet just because you can. And you shouldn't endeavor to engage in such innovation unless you're willing to spend the money and take the time to ensure you're adhering to basic security and privacy standards. Whether a heart monitor or a sex toy, most companies still aren't after ten years of headlines like this. And despite some promising headway being made in policy, our response to the security dumpster fire that is the IOT remains a pretty hot, discordant mess.

Filed Under: bitcoin, chastity cage, hack, iot, ransomware, security

Malware Merchant NSO Group Caught Leaving Harvested Location Data Exposed

from the oh-well-'little-people'-aren't-the-end-users-so-who-cares dept

Israeli surveillance tech firm NSO Group is something else. (Pejorative, yo.) It set up shop in a contested country where it's not all that paranoid to say everyone is out to get them. (But it's still a little paranoid, if not a lot racist.) That being said, Israel doesn't have a lot of nearby allies. And its ongoing conflict with Palestine hasn't made it any new friends.

You'd think a government contractor operating out of this space would be more judicious with its sales efforts. But finding new customers seems to be more important to NSO Group than defending its own country against attacks. NSO has sold its pervasive surveillance products -- ones that leverage popular messaging apps to create spy-holes in end-to-end encryption -- to anyone who wants them, including those that would turn these tools against Israeli citizens, journalists, and activists.

NSO has enabled a global war on dissent and criticism. It's not the only company that takes a hands-off approach to sales -- justifying the money in its pocket with claims it's nothing more than an exploit-hawking middleman. This has earned it some justifiable disdain. It has also earned it lawsuits, including one filed by a company too big to ignore: Facebook.

Multiple governments have purchased exploits from NSO, resulting in a worldwide war on journalists and activists. This makes NSO richer. But it doesn't make the company any smarter. NSO and Israel briefly joined forces to engage in domestic surveillance, utilizing NSO's malware to facilitate COVID contact tracing -- an effort swiftly blocked by an Israeli court.

NSO hasn't slowed down its surveillance efforts -- the ones deployed by its customers. But it has again managed to generate unfavorable headlines and coverage. The company, whose offers of contact tracing were rejected by an Israeli court, hasn't dialed back its efforts to place people under surveillance -- supposedly for the public good.

But its exploits have their own security flaws. While it was trying to sell governments its contract tracing goods, it failed to secure some of the data it had been gathering in hopes of vertically integrating its spy tech and its "concern" for the general population's health. Zack Whittaker reports for TechCrunch:

NSO, a private intelligence company best known for developing and selling governments access to its Pegasus spyware, went on the charm offensive earlier this year to pitch its contact-tracing system, dubbed Fleming, aimed at helping governments track the spread of COVID-19. Fleming is designed to allow governments to feed location data from cell phone companies to visualize and track the spread of the virus. NSO gave several news outlets each a demo of Fleming, which NSO says helps governments make public health decisions “without compromising individual privacy.”

But in May, a security researcher told TechCrunch that he found an exposed database storing thousands of location data points used by NSO to demonstrate how Fleming works — the same demo seen by reporters weeks earlier.

NSO has responded to the hole it didn't close until notified by TechCrunch -- months after the first notification by the security researcher. It says the data seen in the breach isn't "real and genuine data."

Well, we'll see if that's true. At this point, this appears to be bullshit. As Whittaker notes, NSO's statement conflicts with news reports about NSO's use of location data sold to it by third-party brokers who gather location info from phone apps. NSO used this data to "train" its contact tracing AI. It's still "real and genuine data," even if NSO wasn't (yet!) using it in real-word applications.

TechCrunch asked researchers at Forensic Architecture, an academic unit at Goldsmiths, University of London that studies and examines human rights abuses, to investigate. The researchers published their findings on Wednesday, concluding that the exposed data was likely based on real phone location data.

Whatever the real-world applications by NSO, the fact is NSO utilized data of thousands of individuals from multiple countries (Rwanda, Israel, Saudi Arabia, UAE, Bahrain) to train an AI it was pitching to world governments -- a pitch that likely did not inform potential end users NSO would be buying data in bulk from brokers who are generally unconcerned about local data privacy laws.

NSO may be trying to rehabilitate its image by offering its considerable surveillance power to the fight against COVID, but its efforts show it's really still just in the business of collecting everything it can while expanding its user base to whoever's willing to buy -- even if it includes foreign enemies.

A failure to secure a database -- even if it's only filled with "trial" data -- is a monumental self-own. This indicates NSO isn't nearly as careful as it should be, considering the wealth of data/communications it helps government agencies siphon from targets' devices. When millions of people around the world are just grist for the surveillance mill, it rarely seems imperative to protect the data you've harvested from them. The only thing that matters to NSO is surveillance and the profit made. Collateral damage doesn't affect its bottom line -- not when there's a host of human rights violators lining up to buy your goods.

Filed Under: data breach, exploits, hacking, location data, security, surveillance
Companies: nso group

Dutch Prosecutors Say One Man Got Into Trump's Twitter Account With 'MAGA2020!' Password

from the p@ssw0rd! dept

This sort of thing will never stop amazing me. For any American President, one would assume they would have all kinds of advisers on all matters regarding security and best practices when it comes to the systems and technology they use. I'm old enough to remember when everyone freaked out over Barack Obama using a Blackberry, but at the time I hand-waived any such concerns under the assumption that there were checks in place to make such technology secure.

So how in the world did Donald Trump, often called America's first Twitter President, manage to have his Twitter account accessed using a laughably predictable password and 2-factor authentication?

Dutch prosecutors have found a hacker did successfully log in to Donald Trump's Twitter account by guessing his password - "MAGA2020!" But they will not be punishing Victor Gevers, who was acting "ethically".

Mr Gevers shared what he said were screenshots of the inside of Mr Trump's account on 22 October, during the final stages of the US presidential election. But at the time, the White House denied it had been hacked and Twitter said it had no evidence of it.

For what it's worth, both the White House and Twitter are both still claiming that they don't see any evidence that Gevers did in fact access Trump's Twitter account. That being said, Gevers is said to have provided evidence for what he'd done to Dutch police and the prosecutors there seem utterly convinced that Gevers did precisely what he said he had.

Dutch police said: "The hacker released the login himself.

"He later stated to police that he had investigated the strength of the password because there were major interests involved if this Twitter account could be taken over so shortly before the presidential election."

They had sent the US authorities their findings, they added.

For any other president, this sort of unauthorized access would be frustrating and somewhat concerning. For this president, however, who routinely announces hirings and firings of government employees via Twitter, and occasionally even announces American policy that way, it's horrifying. Someone who was actually nefarious could have created all kinds of chaos at the very least, or precipitated real life wars at worst, just by tweeting out from Trump's account. Imagine a world where a bad actor accesses Trump's account and tweets "America has declared war on North Korea. The battle begins in hours." It's not inconceivable that Seoul would be lost under North Korean artillery... or worse.

It's also worth noting that Gevers claims this isn't the first time he got access to Trump's account.

Earlier this year, Mr Gevers also claimed he and other security researchers had logged in to Mr Trump's Twitter account in 2016 using a password - "yourefired" - linked to another of his social-network accounts in a previous data breach.

The best people are apparently not advising the president on how to keep his vaunted Twitter account secure.

Filed Under: donald trump, hacking, maga2020, netherlands, passwords, security, victor gevers

Security Researcher Reveals Solarwinds' Update Server Was 'Secured' With The Password 'solarwinds123'

from the [checks-luggage-combination] dept

As was noted here earlier, up to 18,000 customers of globally-dominant network infrastructure vendor SolarWinds may have been compromised by malicious hackers. The hackers -- presumed to be operating on behalf of the Russian government -- deployed tainted updates (served up by SolarWinds) that gave them backdoors to snoop on internal communications and exfiltrate sensitive data.

The attack was so widespread and potentially catastrophic, the DHS's cyber wing issued an emergency directive that stated the only way to mitigate damage was to airgap devices and uninstall affected Orion software. Meanwhile, SolarWinds filed an update with the SEC detailing the extent of the damage. It was limited, but only if you consider 18-33,000 potential infections "limited." It's only a small percentage because Solarwinds's customer base is so large. The company boasts 300,000 customers, among them several government agencies and all five branches of the military. (It's not boasting much these days. It has memory-holed its "Customer" page during this trying time.)

Unfortunately, the directive from CISA was delivered a bit too late. CISA itself was compromised by the hack, something acknowledged by the DHS less than 24 hours after its dire directive was issued.

The fallout from this hacking -- which may have begun as early as March of this year -- will continue for a long, long time. But this latest news -- delivered by Zack Whittaker -- adds another layer of irony to the ongoing debacle. Orion is Solarwinds' one-stop shop for IT software. It promises to secure customers' IT infrastructure by bundling in the company's network security products.

No doubt the company claims to take security seriously. But while users are being subjected to password requirements that demand them to utilize most of the alphabet and multiple shift key presses, internal security isn't nearly as restrictive. Here's the "OMFG are you goddamn kidding me" news via Reuters, which first broke the news of the malicious hacking.

Security researcher Vinoth Kumar told Reuters that, last year, he alerted the company that anyone could access SolarWinds’ update server by using the password “solarwinds123”.

All five branches of the military. The NSA. The IRS. The USPS. DHS. The Treasury Department. Nearly every Fortune 500 company. All ten of the top ten telcos. The list goes on and on. And with this access, attackers could move laterally, using compromised credentials to eavesdrop on mutuals of targeted entities. And all of this "secured" by a password so simple an idiot could have created it.

We're fucked. And we're fucked by people making far more money than we are who take our security far less seriously than we do. Say what you will about the security ambivalence of the general public, but it's the "experts" who endanger us with lax security measures who do the most damage. If Joe Blow fails to secure his email account, he's probably only going to hurt himself. When a multinational vendor can't be bothered to gin up a decent password, entire government agencies become a plaything for malicious hackers.

Filed Under: dhs, hackers, infrastructure, passwords, security
Companies: solarwinds

To Prevent Free, Frictionless Access To Human Knowledge, Publishers Want Librarians To Be Afraid, Very Afraid

from the because-security dept

After many years of fierce resistance to open access, academic publishers have largely embraced -- and extended -- the idea, ensuring that their 35-40% profit margins live on. In the light of this subversion of the original hopes for open access, people have come up with other ways to provide free and frictionless access to knowledge -- most of which is paid for by taxpayers around the world. One is preprints, which are increasingly used by researchers to disseminate their results widely, without needing to worry about payment or gatekeepers. The other is through sites that have taken it upon themselves to offer immediate access to large numbers of academic papers -- so-called "shadow libraries". The most famous of these sites is Sci-Hub, created by Alexandra Elbakyan. At the time of writing, Sci-Hub claims to hold 79 85 million papers.

Even academics with access to publications through their institutional subscriptions often prefer to use Sci-Hub, because it is so much simpler and quicker. In this respect, Sci-Hub stands as a constant reproach to academic publishers, emphasizing that their products aren't very good in terms of serving libraries, which are paying expensive subscriptions for access. Not surprisingly, then, Sci-Hub has become Enemy No. 1 for academic publishers in general, and the leading company Elsevier in particular. The German site Netzpolitik has spotted the latest approach being taken by publishers to tackle this inconvenient and hugely successful rival, and other shadow libraries. At its heart lies the Scholarly Networks Security Initiative (SNSI), which was founded by Elsevier and other large publishers earlier this year. Netzpolitik explains that the idea is to track and analyze every access to libraries, because "security":

Elsevier is campaigning for libraries to be upgraded with security technology. In a SNSI webinar entitled "Cybersecurity Landscape -- Protecting the Scholarly Infrastructure", hosted by two high-ranking Elsevier managers, one speaker recommended that publishers develop their own proxy or a proxy plug-in for libraries to access more (usage) data ("develop or subsidize a low cost proxy or a plug-in to existing proxies").

With the help of an "analysis engine", not only could the location of access be better narrowed down, but biometric data (e.g. typing speed) or conspicuous usage patterns (e.g. a pharmacy student suddenly interested in astrophysics) could also be recorded. Any doubts that this software could also be used -- if not primarily -- against shadow libraries were dispelled by the next speaker. An ex-FBI analyst and IT security consultant spoke about the security risks associated with the use of Sci-Hub.

Since academic publishers can't compete against Sci-Hub on ease of use or convenience, they are trying the old "security risk" angle -- also used by traditional software companies against open source in the early days. Yes, they say, Sci-Hub/open source may seem free and better, but think of the terrible security risks… An FAQ on the main SNSI site provides an "explanation" of why Sci-Hub is supposedly a security risk:

Sci-Hub may fall into the category of state-sponsored actors. It hosts stolen research papers which have been harvested from publisher platforms often using stolen user credentials. According to the Washington Post, the US Justice Department is currently investigating the founder of Sci-Hub, Alexandra Elbakayan, for links between her and Russian Intelligence. If there is substance to this investigation, then using Sci-Hub to access research papers could have much wider ramifications than just getting access to content that sits behind a paywall.

As Techdirt pointed out when that Washington Post article came out, there is no evidence of any connections between Elbakyan and Russian Intelligence. Indeed, it's hard not to see the investigation as simply the result of whining academic publishers making the same baseless accusation, and demanding that something be "done". An article in Research Information provides more details about what those "wider ramifications than just getting access to content that sits behind a paywall" might be:

In the specific case of Sci-Hub, academic content (journal articles and books) is illegally harvested using a variety of methods, such as abusing legitimate log in credentials to access the secure computer networks of major universities and by hijacking "proxy" credentials of legitimate users that facilitate off campus remote access to university computer systems and databases. These actions result in a front door being opened up into universities' networks through which Sci-Hub, and potentially others, can gain access to other valuable institutional databases such as personnel and medical records, patent information, and grant details.

But that's not how things work in this context. The credentials of legitimate users that Sci-Hub draws on -- often gladly "lent" by academics who believe papers should be made widely available -- are purely to access articles held on the system. They do not provide access to "other valuable institutional databases" -- and certainly not sensitive information such as "personnel and medical records" -- unless they are designed by complete idiots. That is pure scaremongering, while this further claim is just ridiculous:

Such activities threaten the scholarly communications ecosystem and the integrity of the academic record. Sci-Hub has no incentive to ensure the accuracy of the research articles being accessed, no incentive to ensure research meets ethical standards, and no incentive to retract or correct if issues arise.

Sci-Hub simply provides free, frictionless access for everyone to existing articles from academic publishers. The articles are still as accurate and ethical as they were when they first appeared. To accuse Sci-Hub of "threatening" the scholarly communications ecosystem by providing universal access is absurd. It's also revealing of the traditional publishers' attitude to the uncontrolled dissemination of publicly-funded human knowledge, which is what they really fear and are attacking with the new SNSI campaign.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: academic research, libraries, open access, publishers, security
Companies: elsevier, sci-hub

Five Eyes Countries Band Together To Complain About Facebook And End-To-End Encryption

from the breaking-Messenger-will-leave-criminals-with-only-dozens-of-secure-options dept

The world's law enforcement agencies are back at it, advocating for the demise of end-to-end encryption. The last time they all got together like this, they were complaining to Facebook for thinking about adding encryption to its Messenger service.

Because Facebook does so well reporting child porn to the proper authorities, the proper authorities have gathered to decry its decision to encrypt this service, claiming it would result in a lot of unobserved child porn being passed between users. With Facebook unable to eavesdrop on messages, the images and videos can be shared unnoticed.

And, again, the international law enforcement community is asking for weaker encryption… and namechecking Facebook as the cause of and potential solution to all the world's child porn problems. The new "international statement" opens up with a united declaration that everyone loves encryption, before getting to the long list of "buts."

We, the undersigned, support strong encryption, which plays a crucial role in protecting personal data, privacy, intellectual property, trade secrets and cyber security. It also serves a vital purpose in repressive states to protect journalists, human rights defenders and other vulnerable people, as stated in the 2017 resolution of the UN Human Rights Council. Encryption is an existential anchor of trust in the digital world and we do not support counter-productive and dangerous approaches that would materially weaken or limit security systems.

Of course, that last sentence is a lie. At best, it's completely disingenuous. Almost immediately following this assertion that the undersigned have no intention or pursuing counterproductive/dangerous approaches, the Five Eyes crew (along with India and Japan) lists the counterproductive/dangerous ways they'd like encryption to be broken.

Particular implementations of encryption technology, however, pose significant challenges to public safety, including to highly vulnerable members of our societies like sexually exploited children. We urge industry to address our serious concerns where encryption is applied in a way that wholly precludes any legal access to content. We call on technology companies to work with governments to take the following steps, focused on reasonable, technically feasible solutions:

• Embed the safety of the public in system designs, thereby enabling companies to act against illegal content and activity effectively with no reduction to safety, and facilitating the investigation and prosecution of offences and safeguarding the vulnerable;

• Enable law enforcement access to content in a readable and usable format where an authorisation is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight; and

• Engage in consultation with governments and other stakeholders to facilitate legal access in a way that is substantive and genuinely influences design decisions.

I'm not sure what sort of "strong encryption" can handle all of these weak spots being introduced without turning into something easily misused, but these government reps are pretty sure people at these companies will come up with something. These governments have convinced themselves they're "stakeholders" in private conversations between citizens that are facilitated by services like Facebook's Messenger.

And that's what this is about. The statement cites Facebook's success in handling child porn while trying to use that against it.

In 2018, Facebook Messenger was responsible for nearly 12 million of the 18.4 million worldwide reports of CSAM [child sexual abuse material to the US National Center for Missing and Exploited Children (NCMEC)]. These reports risk disappearing if end-to-end encryption is implemented by default, since current tools used to detect CSAM [child sexual abuse material] do not work in end-to-end encrypted environments.”

If this is true, then there's nothing else that can be done. Weakened encryption that allows Facebook to intercept users' messages does nothing for the millions of Facebook users who've never trafficked in illegal content. The company can either give users security and privacy, or it can give these governments what they want. There's no middle ground that's going to accommodate both groups.

And this push against Facebook is working. These statements were converted into news articles claiming Facebook is "responsible" for 94% of all reported child porn. But that wording suggests Facebook is the problem, rather than its users. Facebook made 94% of the reports, showing once again it's been doing what it can to combat the problem.

Its decision to offer encryption to Messenger users isn't being made lightly. It's aware of the downside. But it's also aware of the threat posed to its users by a number of malicious entities, which include authoritarian governments and state-sponsored hackers. If it wants to protect its millions of innocent users, it has to offer the same shelter to criminals using the service. That's how it goes. The middle ground governments think the private sector should nerd towards simply doesn't exist.

Filed Under: australia, backdoors, canada, encryption, five eyes, india, japan, new zealand, security, uk, us
Companies: facebook

Internet Of Broken Things Jumps The Shark With IoT Chastity Penis Lock That Can Be Hacked

from the the-lock-not-the-penis dept

Say it with me now: not every last thing needs to be connected to the internet. If we've learned anything through the myriad of posts we have done on the internet of broken things, it's that far too many devices that need not be internet-connected are instead wide open to security flaws and connectivity-related flaws and outages. Pet feeders, so-called smart locks, healthcare devices: all examples of things that have been broken or broken into thanks to their being connected to the internet in wildly insecure manners.

But what if I told you that a lack of basic security could result in a device you bought potentially forcing you to have someone come at your penis with an angle grinder? Well, if you bought a Cell Mate chastity lock, you should damn well be concerned.

U.K.-based security firm Pen Test Partners  said the flaw in the Qiui Cellmate internet-connected chastity lock, billed as the “world’s first app controlled chastity device,” could have allowed anyone to remotely and permanently lock in the user’s penis.

The Cellmate chastity lock works by allowing a trusted partner to remotely lock and unlock the chamber over Bluetooth using a mobile app. That app communicates with the lock using an API. But that API was left open and without a password, allowing anyone to take complete control of any user’s device. Because the chamber was designed to lock with a metal ring underneath the user’s penis, the researchers said it may require the intervention of a heavy-duty bolt cutter or an angle grinder to free the user.

A researcher at -- checks notes and chuckles -- Pen Test Partners went on to say that someone exploiting the password-less API could lock "everyone in or out" at will. With no way to override the chastity lock either, you could suddenly cause a lot of people to be locked out of their own genitalia. A more perfect example of how 2020 has 2020'd the world there could not be.

It gest worse. This vulnerability has been known about since at least June. Qiui, a Chinese company, pushed out a new API for new users, but didn't remove the API for existing users. Why? Well, because doing so would cause all existing devices to lock.

Qiui chief executive Jake Guo told TechCrunch that a fix would arrive in August, but that deadline came and went. “We are a basement team,” he said. In a follow-up email explaining the risks to users, Guo said: “When we fix it, it creates more problems.”

As someone who owns a penis, I can assure you this is not what one wants to hear when it comes to a large metal lock that determines when I can access it. Nor do I like the idea of bolt-cutters. Or angle grinders. Or tube-smashers. Fine, I made that last one up.

As of this writing, this is all still a problem. Whether any malicious actor has used it to mess with people's dangly bits has not been confirmed officially.

It’s not known if anyone maliciously exploited the vulnerable API. Several user reviews of the app complained that the app had bugs that would cause the device to stay locked.

So, a PSA: if you're going to lock your genitalia up in a small metal vault, make sure it isn't connected to the internet.

Filed Under: chastity, hacked, hacking, internet connected, iot, security

Biggest Ransomware Attack Yet Crippled U.S. Hospitals Last Weekend

from the maybe-TikTok-isn't-our-biggest-problem dept

We've talked a lot about how while the lack of security in Internet of Things devices was kind of funny at first, this kind of apathy towards privacy and security in everyday technology isn't a laughing matter. Whether it's cars being taken over from an IP address up to ten miles away, to the rise in massive new DDoS attacks fueled by your not-so-smart home appliances, security experts have spent the better part of the decade warning us the check for our apathy on this front is coming due. We've (and this includes government agencies) have spent just as long ignoring them.

That's particularly true in the healthcare field, where hackable pacemakers and ransomware-infected hospital equipment is becoming the norm. Earlier this month, a woman died in Germany after a ransomware attack on her hospital delayed life-saving treatment. Though she most certainly probably isn't, she's being declared the first person to be killed by the steady parade of such attacks that have plagued the medical sector for much of this decade.

Last weekend, Universal Health Services, with more than 400 locations in the United States, was hit by one of the biggest ransomware attacks in U.S. history. As a result, the hospital chain was forced to resort to using pens and paper to manage patients after their computer systems ground completely to a halt. Such attacks usually come on the weekend when the hospitals are short staffed, and the results usually aren't pretty:

"Two Universal Health Services nurses, who requested to not be named because they weren’t authorized by the company to speak with the media, said that the attack began over the weekend and had left medical staff to work with pen and paper.

One of the nurses, who works in a facility in North Dakota, said that computers slowed and then eventually simply would not turn on in the early hours of Sunday morning. “As of this a.m., all the computers are down completely,” the nurse said."

This is of course not a new problem. Massively profitable medical organizations routinely underfund their privacy and security IT infrastructure, and the government penalties have been negligible. As a result, for most of this decade security researchers like Brian Krebs have been noting that hospitals are hit with 20 ransomware attacks a day. And of course the problem isn't just in surgical tools and antiquated computer systems, it extends to high tech gear like pacemakers embedded with wireless connectivity, which result in the kind of hackable products make global covert wetwork operatives giddy.

Instead of government, private industry, advocates, and experts working in coalition to create meaningful standards for medical devices and internet of things devices, we instead enjoy wasting calories on tech policy games of Whac-A-Mole in which we freak out about the outrage du jour that may or may not warrant it (see: TikTok). This kind of incoherent, histrionic approach to internet security isn't, if you hadn't noticed, working out particularly well.

Filed Under: cybersecurity, ddos, hospitals, iot, ransomware, security
Companies: universal heath service

Inspector General's Report Confirms CBP Contractor Was Hacked, Resulting In Sensitive Info Making Its Way To The Dark Web

from the collect-it-all,-protect-it-barely dept

Last year, a CBP vendor suffered a data breach affecting more than 100,000 people who had crossed the border at checkpoints. The CBP refused to name the contractor involved in the breach, but internal documents indicated it was Perceptics. Perceptics provided and maintained the system that photographed cars and their occupants as they crossed the border.

The vendor's involvement in the breach has now been publicly confirmed, thanks to an Inspector General's investigation of the incident. Sensitive information that was never supposed to be located on Perceptics' servers was obtained by hackers and (partially) distributed on the dark web. [h/t Motherboard]

The report [PDF] lists the extent of the damage, which was fairly minimal given what was involved.

The subcontractor’s network was later the subject of a malicious cyber attack that compromised approximately 184,000 traveler images from CBP’s facial recognition pilot. After removing duplicate images, CBP reduced its estimate to 100,000 individual images, of which they discovered 19 were posted to the Dark Web.

From which the IG draws this inevitable conclusion:

This incident may ultimately result in damage to the public’s trust in Government biometric programs.

Yes, whatever trust there is that hasn't been damaged yet, I guess.

Perceptics was authorized to be on-site to perform maintenance work. It was never authorized to transfer any photos to its own servers. But it did. And it did this in the worst way possible.

According to documentation from Unisys and CBP, Perceptics subsequently admitted to Unisys that it had downloaded approximately 184,000 traveler images from the equipment in conjunction with the work order tickets. Perceptics personnel accomplished this using an unencrypted USB hard drive that was eventually transported back to their corporate office in Knoxville, Tennessee. From there, subcontractor personnel uploaded CBP’s images to a Perceptics server.

This unauthorized data exfiltration led directly to another unauthorized data exfiltration.

Perceptics’ corporate network was subjected to a ransomware attack at some point prior to May 13, 2019. The attack compromised thousands of driver and passenger images that CBP captured during the VFS pilot. CBP determined that more than 184,000 traveler facial image files, as well as 105,000 license plate images from prior pilot work, were stored on the subcontractor’s network at the time of the ransomware attack. In addition, the hacker stole an array of contractual documents, program management documents, emails, system configurations, schematics, and implementation documentation related to CBP license plate reader programs.

Perceptics refused to pay the ransom and the hacker (d/b/a "Boris Bullet Dodger") released "9,000 unique files" on the dark web.

The Inspector General says Perceptics should never have taken files offsite. But it's not the only party to blame. CBP should have made this far more difficult to achieve.

Perceptics was able to make unauthorized use of CBP’s biometric data, in part because CBP did not implement all available IT security controls, including an acknowledged best practice. Additional IT security controls in place during the pilot could have prevented Perceptics from violating contract clauses and using an unencrypted hard drive to access and download biometric images at the pilot site.

The rest of the report is the CBP promising to secure barn doors as per the IG's recommendations. Certainly this will have some effect going forward. But the fact remains the CBP collects a lot of personal information that can be tied to border crossers' vehicles. All of this in one place continues to make the CBP -- and most government agencies -- tempting targets for malicious hackers.

Filed Under: border crossing, cbp, dark web, facial recognition, hacked, inspector general, leaked, security
Companies: perceptics, unisys