Notices by Dan Goodin (dangoodin@infosec.exchange), page 3

I so, so, so don't want to drive any new car that can do this:

A federal appeals court refused to bring back a class action lawsuit alleging four auto manufacturers had violated Washington state’s privacy laws by using vehicles’ on-board infotainment systems to record and intercept customers’ private text messages and mobile phone call logs.

The court ruled that the practice does not meet the threshold for an illegal privacy violation under state law, handing a big win to automakers Honda, Toyota, Volkswagen and General Motors, which are defendants in five related class action suits focused on the issue.

The plaintiffs had appealed a prior judge’s dismissal. But the appeals court ruled Tuesday that the interception and recording of mobile phone activity did not meet the Washington Privacy Act’s standard that a plaintiff must prove that “his or her business, his or her person, or his or her reputation” has been threatened.

A suit filed against Honda in 2021, argu[ed] that beginning in at least 2014 infotainment systems in the company’s vehicles began downloading and storing a copy of all text messages on smartphones when they were connected to the system.

An Annapolis, Maryland-based company, Berla Corporation, provides the technology to some car manufacturers but does not offer it to the general public, the lawsuit said. Once messages are downloaded, Berla’s software makes it impossible for vehicle owners to access their communications and call logs but does provide law enforcement with access, the lawsuit said.

Many car manufacturers are selling car owners’ data to advertisers as a revenue boosting tactic, according to earlier reporting by Recorded Future News. Automakers are exponentially increasing the number of sensors they place in their cars every year with little regulation of the practice.

https://therecord.media/class-action-lawsuit-cars-text-messages-privacy

@ryanc

Hope so.

Mastadonians wanting more security- and privacy-related content here: there are a bunch of journalists, researchers and engineers who are woefully underfollowed relative to the impact and importance of the work they do. Please follow and engage with them so they have a strong incentive to use this platform more.

There are way too many to name all of them. In no particular order here are some (but sorry, not all; please look at the people I follow for more):

@lhn
@josephcox
@jasonkoebler
@malwarejake
@sophieschmieg
@howelloneill
@selenalarson
@philip
@neilmadden
@ryanc
@Wednesday
@yossarian
@LukaszOlejnik
@chenghlee
@saraislet
@Bryan

Please boost for visibility

Google has removed a video posted by academic researchers demonstrating how a newly discovered side channel in Apple's A- and M-series CPUs can be used to steal a password.

I thought for sure the removal was a mistake, but a Google representative told me the video was removed for violating a term of service barring "demonstrating how to use computers or information technology to steal credentials, compromise personal data, or cause serious harm to others."

The video, demonstrating important research by @genkin, @YuvalYarom , @themadstephan and jason kim, is here:

https://onedrive.live.com/?authkey=%21AMTjzIS6XfV1jzg&id=8208800C17D803E6%211176&cid=8208800C17D803E6&parId=root&parQt=sharedby&o=OneUp

Just to underscore how arbitrary and patently asinine Google's ToS enforcement is here, two additional videos the researchers posted demonstrating the same side channel remain available.

I wonder how researchers from #projectzero feel about this. Is there any chance any of them can intervene?

People following me for cybersecurity content: Chris Bing, one of the most distinguished reporters on this beat, recently joined the Fediverse. Chris has broken way too many stories to count and also has valuable insight into all things related to hacking. Please follow him.

@Bing_Chris

And please boost for reach.

@feld

Yes, I'm making people freak out.

A reminder that ALL browsers running on iOS are vulnerable to iLeakage, the attack that allows hackers to steal passwords and other sensitive data when you visit their booby-trapped websites. It's not just Safari on iOS, although that's the only browser affected on macOS. Currently, there's no patch available.

https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/

1Password detects “suspicious activity” in its internal Okta account

1Password, a password manager used by millions of people and more than 100,000 businesses, said it detected suspicious activity on a company account provided by Okta, the identity and authentication service that disclosed a breach on Friday.

“On September 29, we detected suspicious activity on our Okta instance that we use to manage our employee-facing apps,” 1Password CTO Pedro Canahuati wrote in an email. “We immediately terminated the activity, investigated, and found no compromise of user data or other sensitive systems, either employee-facing or user-facing.”

Since then, Canahuati said, his company had been working with Okta to determine the means that the unknown attacker used to access the account. On Friday, investigators confirmed it resulted from a breach Okta reported hitting its customer support management system.

Okta said then that a threat actor gained unauthorized access to its customer support case management system and, from there, viewed files uploaded by some Okta customers. The files the threat actor obtained in the Okta compromise comprised HTTP archive, or HAR, files, which Okta support personnel use to replicate customer browser activity during troubleshooting sessions. Among the sensitive information they store are authentication cookies and session tokens, which malicious actors can use to impersonate valid users.

Security firm BeyondTrust said it discovered the intrusion after an attacker used valid authentication cookies in an attempt to access its Okta account. The attacker could perform “a few confined actions,” but ultimately, BeyondTrust access policy controls stopped the activity and blocked all access to the account. 1Password now becomes the second known Okta customer to be targeted in a follow-on attack.

Monday’s statement from 1Password provided no further details about the incident, and representatives didn’t respond to questions. A report dated October 18 and shared on an internal 1Password Notion workspace said the threat actor obtained a HAR file a company IT employee had created when recently engaging with Okta support. The file contained a record of all traffic between the 1Password employee’s browser and Okta servers, including session cookies.

https://arstechnica.com/security/2023/10/1password-detects-suspicious-activity-in-its-internal-okta-account/

@oceanwave

I'm not giving 1password credit for a forward-looking disclosure.1Password didn't disclose this event until I asked them about it. Even then they provided very few details.

That internal report was published only after this story went live.

I think what's to be admired here is that 1password had measures in place to prevent the Okta breach from becoming a vector to attack 1password.

GPUs from all six of the major suppliers are vulnerable to a newly discovered attack that allows malicious websites to read the usernames, passwords, and other sensitive visual data displayed by other websites, researchers have demonstrated in a paper published Tuesday.

The cross-origin attack allows a malicious website from one domain—say, example.com—to effectively read the pixels displayed by a website from example.org, or another different domain. Attackers can then reconstruct them in a way that allows them to view the words or images displayed by the latter site. This leakage violates a critical security principle that forms one of the most fundamental security boundaries safeguarding the Internet. Known as the same origin policy, it mandates that content hosted on one website domain be isolated from all other website domains.

GPU.zip, as the proof-of-concept attack has been named, starts with a malicious website that places a link to the webpage it wants to read inside of an iframe, a common HTML element that allows sites to embed ads, images, or other content hosted on other websites. Normally, the same origin policy prevents either site from inspecting the source code, content, or final visual product of the other. The researchers found that data compression that both internal and discrete GPUs use to improve performance acts as a side channel that they can abuse to bypass the restriction and steal pixels one by one.
Advertisement

“We found that modern GPUs automatically try to compress this visual data, without any application involvement,” Yingchen Wang, the lead author and a researcher at the University of Texas at Austin, wrote in an email. “This is done to save memory bandwidth and improve performance. Since compressibility is data dependent, this optimization creates a side channel which can be exploited by an attacker to reveal information about the visual data.”

https://arstechnica.com/security/2023/09/gpus-from-all-major-suppliers-are-vulnerable-to-new-pixel-stealing-attack/

I'm not sure how to think of this new GPU.zip attack. The side channel exists in the GPUs themselves, so it seems fair to think they are vulnerable.

On the other hand, the only (known) way to exploit this side channel is loading iframes into Chrome or Edge, so it also seems reasonable to say these browsers are the things that are vulnerable.

I'm curious to know what you think.

https://arstechnica.com/security/2023/09/gpus-from-all-major-suppliers-are-vulnerable-to-new-pixel-stealing-attack/

I didn’t join Mastodon until after we launched 404 Media. I joined, frankly, because lots of people told me that we should. Mastodon had been decried by many (me, previously), as a social media platform that is too complicated or weird to sign up for. I had also convinced myself that people on Mastodon would be mad at me if I made jokes, which has (mostly) not been the case.

I’ve now been using it for about two months and I am here to tell you that it is, in principle, what we should want the internet to be. If you have been remotely interested in Mastodon but had reservations about joining because you thought it would be difficult, confusing, or otherwise annoying, it is not.

https://www.404media.co/mastodon-is-the-good-one/

I am so jealous of WhatsApp users now that they can have more than one account on a single phone. I so, so, so want Signal to do the same thing.

https://about.fb.com/news/2023/10/multiple-accounts-on-whatsapp/

Yesterday, Daniel J. Bernstein published a paper alleging that Kyber-512, an encryption algorithm selected as a NIST post-quantum contender, wasn't nearly as secure as its stewards say. The gist is that NIST either intentionally or unintentionally made basic math errors that inflated its security level and has spent the rest of the time since covering up the problem.

The post is 17,000 words long! Has anyone read it and if so, can you send me the cliff notes?

https://blog.cr.yp.to/20231003-countcorrectly.html

@patrickcmiller

Yup, Meredith, and so too is Twitter, which you continue to support with your influence and engagement.

Ugh. Google has patched yet another 0day in yet another media-encoding library that's nearly ubiquitous. Libvpx is in a ton of Linux projects (citation: https://pastebin.com/TdkC4pDv). Wikipedia says it's used by YouTube, Netflix, Amazon, JW Player, Brightcove, and Telestream. It also appears to be used in iOS.

If anyone has reasons to think this vulnerability is limited to Chrome, please let me know. Preliminarily, though, I'm inclined to think this is yet another vuln under active exploit that's going to make a ton of software vulnerable to RCE exploits.

The 0day is tracked as CVE-2023-5217.

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html

GPUs from all major suppliers are vulnerable to new pixel-stealing attack

https://arstechnica.com/security/2023/09/gpus-from-all-major-suppliers-are-vulnerable-to-new-pixel-stealing-attack/

Here someone is challenging my use of pro-fascist to describe the dead bird site. "Pro-fascist? Really?"

Yes, really.

-- Elon personally intervened to get the pro-Nazi, pro-Hitler, anti-semetic Kanye West reinstated.

-- Twitter is a haven for groups like White Lives Matter California, an organization the Southern Poverty Law Center has designated a hate group.

-- Musk has threatened to sue researchers tracking hate speech on the platform

-- The dead bird paid Andrew Tate $20k and End Wokeness $10k.

-- It paid $16k to Ian Miles Cheong, a far-right user has used Twitter to falsely identify an innocent Black man as the “number one suspect” in the shooting of two police officers

-- It has paid QAnon influencer Jacob Creech.

-- Elmo has called for the the QAnon shaman who particpated in the Jan. 6 riot to be freed.

-- He has defended the Jan 6 rioters, saying they were peaceful.

-- He reinstated Michael Flynn.

I could go on an on, but I would burn up way too much time because there are so many more examples.

My point is: Twitter most definitely welcomes, encourages and even pays for far-right extremist views that include anti-semitism, support for Hitler and nazis, and support for an illegal riot that saw multiple members of the Capitol Police brutally killed.

I stand by my description of Twitter as "pro-fascist."

Dear Twitter users. Your support of a social media platform that welcomes and pays for far-right content is NOT the fault of capitalism. No one is forcing you to post cat pics on the fascist-friendly dead bird site. This is YOUR decision and history won't judge it kindly.

Yo dog, we heard you liked patches, so we're gonna make you update every piece of software that renders Webp images.

https://arstechnica.com/security/2023/09/with-0-days-hitting-chrome-ios-and-dozens-more-this-month-is-no-software-safe/