With Doug Aamoth and Paul Ducklin.
DOUG. Extra extortion scams, extra crypto theft, and a bugfix for a bugfix.
All that extra on the Bare Safety podcast.
[MUSICAL MODEM]
Welcome to the podcast, everyone.
I’m Doug Aamoth, and he’s Paul Ducklin.
Paul, how do you do?
DUCK. I’m super-duper, thanks, Douglas.
DOUG. We like to begin the present with just a little little bit of tech historical past, and I’d wish to remind you that this week, in 2007, the primary technology iPhone was launched in the US.
At a time when most high-end telephones have been promoting for $200 with a two-year wi-fi service contract, the iPhone began at $500 with a two-year contract.
It additionally sported a slower connection velocity than many telephones on the time, with 2.5G, or EDGE, versus 3G.
Nonetheless, two-and-a-half months after its launch, Apple had offered 1,000,000 iPhones.
Within the US alone.
DUCK. Sure, I’d forgotten that thorny element of the of the 2-dot-5 EDGE!
I simply keep in mind pondering, “You can’t be critical?”
I used to be in Australia on the time, and so they have been *costly*.
I believe that was nonetheless the period after I was simply hanging onto my EDGE system… I preserve calling it a JAM JAR, nevertheless it was really referred to as a JASJAR or a JASJAM, or one thing.
A kind of sliding-keyboard Home windows CE gadgets.
I used to be the one particular person on this planet that liked it… I figured, properly, somebody has to.
You can write your individual software program for it – you simply compiled the code and put it on there – so I keep in mind pondering, this App Retailer factor, solely 2.5GG, super-expensive?
It would by no means catch on.
Properly, the world has by no means been the identical since, that’s for certain!
DOUG. It has not!
All proper, talking of the world not being the identical, we’ve obtained extra scams.
This one…why don’t I simply learn from the FTC about this rip-off?
The FTC (the Federal Commerce Fee in the US) says the criminals normally work one thing like this:
“A scammer poses as a possible romantic companion on an LGBTQ+ courting app, chats with you, shortly sends express photographs, and asks for comparable photographs in return.
For those who ship photographs, the blackmail begins.
They threaten to share your dialog and photographs with your folks, household, or employer except you pay, normally by present card.
Different scammers threaten people who find themselves closeted or not but absolutely out as LGBTQ+. They could strain you to pay up or be outed, claiming they’ll destroy your life by exposing express photographs or conversations.
No matter their angle, they’re after one factor your cash.”
Good individuals right here, proper?
DUCK. Sure,. that is really terrible, isn’t it?
And what notably caught me about this story is that this…
A few years in the past, the large factor of this type, as you keep in mind, was what grew to become often called “sextortion” or “porn scamming”, the place the crooks would say, “Hey, we’ve obtained some screenshots of you watching porn, and we turned in your webcam on the similar time. we have been in a position to do that as a result of we implanted malware in your pc. Right here’s some proof”, and so they’ve obtained your telephone quantity or your password or your property deal with.
They by no means present you the video, in fact, as a result of they don’t have it.
“Ship us the cash,” they are saying.
Precisely the identical story, besides that in that case we have been in a position to go to individuals and say, “All a pack of lies, simply neglect it.”
Sadly, that is precisely the alternative, isn’t it?
They *have* obtained the photograph… sadly, you despatched it to them, perhaps pondering, “Properly, I’m certain I can belief this particular person.”
Or perhaps they’ve simply obtained the present of the gab, and so they speak you into it, in the identical means as conventional romance scammers… they don’t need express photographs for blackmail, they need you to fall in love with them for the long run, to allow them to milk you for cash for weeks, months, years even.
However it’s difficult that we’ve got one sort of sexually-related extortion rip-off the place we are able to inform individuals, “Don’t panic, they will’t blackmail as a result of they really don’t have the photograph”…
…and one other instance the place, sadly, it’s precisely the opposite means round, as a result of they do have the photograph.
However the one factor you must nonetheless not do is pay the cash, as a result of how do you ever know whether or not they’ll delete that photograph.
Even worse, how are you aware, even when they really are – I can’t imagine I’m going to make use of these phrases – “reliable crooks”?
Even when their intention is to delete the photograph, how are you aware they haven’t had a knowledge breach?
They may have misplaced the information already.
As a result of dishonour amongst thieves and crooks falling out with each other is frequent sufficient.
We noticed that with the Conti ransomware gang… associates leaking an entire load of stuff as a result of they’d fallen out with the individuals on the core of the group, apparently.
And plenty of cybercrooks have poor operational safety themselves.
There’s been any variety of instances prior to now the place crooks both ended up getting bust or ended up freely giving the secrets and techniques of their malware as a result of their methods, the place they have been supposedly protecting all of the secrets and techniques, have been extensive open anyway.
DOUG. Sure.
At a really private and unsure time in individuals’s lives, in fact, once they lastly trusted somebody they’ve by no means met… after which this occurs.
In order that’s certainly one of our suggestions: Don’t pay the blackmail cash.
One other tip: Think about using your favourite search engine for a reverse picture search.
DUCK. Sure, a lot of individuals suggest that for all kinds of scams.
It’s quite common that the crooks will achieve your belief by choosing a web-based courting profile of somebody that they’ve pre-judged you’ll in all probability like.
They go and discover somebody who really is perhaps a very good match for you, they rip off that particular person’s profile, and so they come steaming in, pretending to be that particular person.
Which will get them off to an excellent begin in terms of romantic machinations, doesn’t it?
And so, in the event you do a reverse picture search and someone else’s profile comes up: bingo! You’ve busted them!
The dangerous information is that you may’t use that to show something in regards to the individuals…
…in different phrases, in the event you do the reverse search and nothing comes up, it doesn’t imply that the particular person you’re talking to actually is the unique proprietor of that {photograph}.
Nonetheless, we’ve got had individuals on Bare Safety commenting saying, “I obtained certainly one of these; I did a reverse picture search; it immediately got here out within the wash. Reverse search labored very well for me.”
You may journey the cook dinner up on the very, very first hurdle.
DOUG. Sure, I believe I shared this in one of many first podcast episodes we did…
We have been attempting to lease a ski-house, and the place we have been attempting to lease seemed just a little too good to be true for the value.
And my spouse referred to as the particular person to ask them about it, and clearly woke somebody up in the course of the night time on the opposite facet of the world.
As she was doing that, I dropped the picture right into a reverse picture search, and it was a Ritz Carlton Resort in Denver or one thing like that.
It was not even near the place we have been attempting to lease.
So this works past simply romance scams – it really works for something that simply smells sort of fishy, and has pictures related to it.
DUCK. Sure.
DOUG. OK. After which we’ve got the tip: Remember earlier than you share.
DUCK. Sure, that’s certainly one of our little jingles.
It’s simple to recollect.
And, actually, it’s not simply true for these sexual extortion scams, though, as you say, it’s particularly troubling and evil-sounding in such instances.
It’s completely true in all instances the place there’s somebody that you simply’re undecided about – don’t give out data, as a result of you may’t get it again later.
When you’ve handed over the information, then you definately don’t simply should belief them… you need to belief their pc, their very own angle to cybersecurity and every little thing.
DOUG. That dovetails properly with our subsequent tip, which is: If unsure, don’t give it out.
DUCK. Sure, I do know some individuals say, “Oh, properly, that sounds such as you’re sufferer blaming.”
However when you hand out your knowledge, you may *ask* for it again, however you may’t actually do way more than that.
It’s trivial to share stuff, nevertheless it’s nearly as good as unimaginable to name it again afterwards.
DOUG. OK, then we’ve obtained some sources within the article about the way to report such scams based mostly on the nation that you simply stay in, which is fairly helpful.
DUCK. Sure, we put in on-line fraud reporting URLs for: the USA, the UK, the European Union, Canada, Australia and New Zealand.
The US one is https://reportfraud.ftc.gov.
And the FTC, in fact, is basically the buyer rights physique in the US.
I used to be very pleasantly stunned with that website – I discovered it very simple to navigate.
You may put in as a lot or as little data as you need.
Clearly, if you wish to sustain with a case later, then you definately’re going to should share data that permits them to contact you again – in different phrases, it will be tough to stay fully nameless.
However in the event you simply wish to say, “Look, I’ve obtained this rip-off, I should be certainly one of 1,000,000 individuals”…
…if no person says something, then basically, statistically, nothing occurred.
You may report issues and simply say, “I obtained this URL, I obtained this telephone quantity, I obtained this data,” no matter it’s, and you’ll present as a lot or as little as you need.
And though it typically looks like reporting these things in all probability doesn’t make a distinction – as a result of clearly in the event you don’t give your e-mail deal with and your contact particulars, you gained’t get any reply to say whether or not it was helpful or not – you simply should take it on religion.
And my opinion is: I don’t see the way it can presumably do any hurt, and it might perform a little bit of fine.
It could assist the authorities to construct a case towards someone the place, with out a number of corroborating studies, they could have discovered it very tough to get to the authorized customary they wanted to really do one thing about what’s a very nasty crime.
DOUG. OK, that’s: FTC warns of LGBTQ+ plus extortion scams: Remember earlier than you share” on nakedsecurity.sophos.com.
And talking of being conscious, when are we going to have one week the place we’re not conscious of some form of crypto theft?
One other $100 million vanished into skinny air, Paul!
DUCK. I didn’t realise that was a rhetorical query.
I used to be about to chime in and say, “Not this week, Doug.”
Truly, while you have a look at the present alternate charge of US greenback to Ether, I’m wondering if this one was even price writing about. Doug?
It was not fairly $100 million… It was, “I don’t know, $80 million, $90 million – it’s nearly not price getting off the bed to jot down about,” he mentioned
very cynically.
Sure, this was one more decentralised finance, or De-Fi, firm catastrophe.
You wouldn’t understand it to go to their web site.
The corporate is known as Concord – they’re basically a blockchain sensible contract firm… you go to the web site, and it’s nonetheless stuffed with how nice they’re.
For those who go to their official weblog from their web site, there’s a story on there which is “Misplaced Funds Investigation Report”.
However that’s not *these* misplaced funds; that’s *these* misplaced funds.
That’s from again in January… I believe it was “solely” one thing like a $5 million hack, perhaps even much less, Doug, that someone made off with.
And that’s the final story on their weblog.
They do have data on Twitter about it, to be truthful, and so they have printed a weblog article someplace on Medium.com which particulars what little they appear to know.
It feels like that they had an entire lot of funds that have been locked up centrally, funds wanted to make the wheels work, and to permit these issues to be moved out and in, they have been utilizing what’s referred to as a “multi-signature” or “multisig” method.
One non-public key wouldn’t be sufficient to authorise transferring out any of those specific funds.
There have been 5 individuals who have been authorised, and two of them needed to are available in collectively, and apparently every non-public key was saved sort-of cut up in half.
The particular person had a password to unlock it, and so they wanted to get some key materials from a key server, and apparently every non-public key was on a special key server.
So, we don’t know the way it happend… did someone collude? Or did someone simply suppose they’d be actually intelligent and say, “Hey, I’ll share my key with you, and you share your key with me, simply in case, as additional backup?”
Anyway, the crooks managed to get two non-public keys, not one, in order that they have been in a position to faux to be multiple particular person, and so they have been in a position to unlock this massive quantity of funds and switch it to themselves.
And that added as much as some $80 million-plus US {dollars} price of Ether.
After which, it appears, that Concord, like they did again in January once they had the earlier rip-off… they did that what everybody’s doing as of late.
“Pricey Mr. White Hat, pricey Beautiful Criminal, in the event you ship the funds again, we’ll write it up as a bug bounty. We’ll rewrite historical past, and we’ll strive to not allow you to get prosecuted. And we’ll say it was all within the identify of analysis, however please give us our a refund.”
And also you suppose, “Oh, golly, that smacks of desperation,” however I suppose that’s all they’ve obtained to strive.
DOUG. And I like that they’re providing 1% of what was stolen.
After which the icing on the cake is they are going to “advocate for no legal fees” when funds are returned, which appears onerous to ensure.
DUCK. Sure, I suppose that’s all they will say, proper?
Properly, actually in England, you may have issues referred to as non-public prosecutions – they don’t should be introduced by the state.
So you would do a legal prosecution as a personal particular person. or as a charity, or as a public physique, if the state doesn’t wish to prosecute.
However you don’t get the alternative, the place you’re the sufferer of a criminal offense and also you say, “Oh, I do know that man. He was drunk out of his thoughts. He crashed into my automotive, however he repaired it. Don’t prosecute him.”
The state will in all probability go, “You understand what? It’s really less than you.”
Anyway, it doesn’t appear to have labored.
Whoever it was has already transferred one thing like 17,000 Ether (one thing simply shy of $20 million US, I believe) out of the account the place they’d initially collected the stuff.
So, it’s trying as if that is all taking place the gurgler. [LAUGHS]
I don’t know why I’m laughing, Doug.
DOUG. This simply retains taking place!
There’s obtained to be a greater option to lock down these accounts.
So, they’ve gone from two events having to co-sign to 4 events.
Now, does that repair this downside, or will this preserve taking place?
DUCK. “Hey, two wasn’t sufficient. We’ll go to 4.”
Properly, I don’t know… does that make it higher, or the identical, or worse?
The purpose is, it depends upon how the crooks, and why the crooks, have been in a position to get these two keys.
Did they only goal the 5 individuals and so they obtained fortunate with two of them and failed with three, by which case you may argue that making it four-out-of-five as an alternative of two-out-of-five will increase the bar a bit additional.
However what if the system itself, the best way that they’ve really orchestrated the keys, was the explanation the crooks obtained two of them… what if there was a single level of failure for any variety of keys?
And that’s simply what we don’t know, so simply go from two to 4… It doesn’t essentially resolve the issue.
In precisely the identical means that if somebody steals your telephone and so they guess your lock code and also you’ve obtained six digits, you suppose, “I do know, I’m going to go to a ten-digit lock code. That will probably be way more safe!”
But when the explanation the crooks obtained your lock code is that you’ve got a behavior of writing it down on a bit of paper and leaving it in your mailbox simply in case you’re locked out of your home… they’ll return and get the ten-digit, the 20-digit, the 5000-digit lock code.
DOUG. All proper, properly, we’ll keep watch over that.
And one thing tells me this gained’t be the final of those tales.
That is referred to as: Concord Blockchain loses practically $100 million as a result of hacked non-public keys, on nakedsecurity.sophos.com.
And now we’ve obtained a bug repair for a bug repair in OpenSSL.
DUCK. Sure, we’ve spoken about OpenSSL a number of occasions on the podcast, primarily as a result of it’s one of the in style third social gathering cryptographic libraries on the market.
So, a lot of software program makes use of it.
And the issue is that when it has a bug, there are a great deal of working methods (notably a lot of Linux is shipped with it) that have to replace.
And even on platforms which have their very own separate cryptographic libraries, just like the Home windows and the macOS methods of the world, you might have apps that nonetheless convey alongside their very own copy of OpenSSL, both compiled in or introduced alongside into the appliance folder.
You must go and replace these, too.
Now, thankfully, this isn’t a super-dangerous bug, nevertheless it’s sort of an annoying form of bug that’s an amazing reminder to software program builders that typically the satan’s within the particulars that encompass the trophy code.
This bug is one other model of the bug that was mounted within the earlier bugfix – it’s really in a script that ships together with OpenSSL, that some working methods use, that creates a particular searchable hash, an index, of system “certificates authority” certificates.
So it’s a particular script you run referred to as c_rehash, brief for “certificates rehash”.
And it takes a listing with a listing of certificates which have the names of the individuals who issued them and converts it into a listing based mostly on hashes, which may be very handy for looking and indexing.
So, some working methods run this script frequently as a comfort.
And it turned out that in the event you may create a certificates with a bizarre identify with magic particular characters in it, similar to the “dollar-sign spherical brackets” in Follina or the “dollar-sign squiggly brackets” in Log4Shell… principally they’d take the file identify off disk, and they might use it blindly as a command shell command line argument.
Anybody who’s written Unix shell instructions, or Home windows shell instructions. is aware of that some characters have particular superpowers, like “dollar-sign spherical brackets”, and “larger than” signal, which overwrites information, and the “pipe” character, which says to ship the output into one other command and run it.
So it was, in the event you like, poor consideration to element in an ancillary script that isn’t actually a part of the cryptographic library.
Principally, that is only a script that many individuals in all probability by no means thought-about, nevertheless it was delivered by OpenSSL; packaged in with it in lots of working methods; popped right into a system location the place it grew to become executable; and utilized by the system for what you may name “helpful cryptographic housekeeping”.
So the model you need is 3.0.4, or 1.1.1p (P-for-Papa).
However having mentioned that, whereas we’re recording this, there’s an enormous fuss happening in regards to the want for OpenSSL 3.0.5, a very totally different bug – a buffer overflow in some particular accelerated RSA cryptographic calculations, which might be going to wish fixing.
So, by the point you hear this, in the event you’re utilizing OpenSSL 3, there is perhaps one more replace!
The great facet, I suppose, Doug, is that when these items do get seen, the OpenSSL workforce do appear to get onto the issue and push out patches fairly shortly.
DOUG. Nice.
We’ll keep watch over that, and preserve a watch out for 3.0.5.
DUCK. Sure!
Simply to be clear, when 3.0.5, there gained’t be an identical 1.1.1q (Q-forQuebec), as a result of this bug is a brand new code that was launched in OpenSSL 3.
And in the event you’re questioning… similar to the iPhone by no means had iPhone 2, there was no OpenSSL 2.
DOUG. OK, we’ve obtained some recommendation, beginning with: Replace OpenSSL as quickly as you may, clearly.
DUCK. Sure.
Though this isn’t within the cryptographic library however in a script, you may as properly replace, as a result of in case your working system has the OpenSSL bundle, this buggy script will nearly actually be in it.
And it’ll in all probability be put in the place someone along with your worst pursuits at coronary heart may in all probability get at it, presumably even remotely, in the event that they actually wished to.
DOUG. OK, with that: Think about retiring the c_rehash utility in the event you’re utilizing it.
DUCK. Sure, that c_rehash is definitely a legacy perl script that runs different applications insecurely.
Now you can really use a built-in a part of the OpenSSL app itself: openssl rehash.
If you wish to know extra about that, you may simply sort openssl rehash -help.
DOUG. All proper.
After which, we’ve mentioned this time and time once more: Sanitise your inputs and outputs.
DUCK. Completely.
By no means assume that enter that you simply get from another person is protected to make use of simply as you obtained it.
And while you’ve processed knowledge that you simply obtained from elsewhere, or that you simply’ve learn in from someplace else, and also you’re going at hand it on to another person, do the great factor and examine that you simply’re not passing them dud data first.
Clearly, you’ll hope that they’d examine their inputs, however in the event you examine your outputs as properly, then it simply makes assurance double certain!
DOUG. OK. After which lastly: Be vigilant for a number of errors when reviewing code for particular kinds of bug.
DUCK. Sure, I believed that was price reminding individuals about.
As a result of there was one bug, the place Perl carried out what’s referred to as command substitution, which says, “Run this exterior command with these arguments, get the output, and use the output as a part of the brand new command.”
It was in sending the arguments to that command that one thing went fallacious, and that was patched: a particular operate was written that checked the inputs correctly.
However it appears that evidently no person went by way of actually rigorously and mentioned, “Did the one that wrote this utility initially use the same programmatic trick elsewhere?”
In different phrases, perhaps they shell out to a system operate elsewhere in the identical code… and in the event you seemed extra rigorously, you’ll have discovered it.
There’s a spot the place they do a hash calculation utilizing an exterior program, and there’s a spot the place they do file copying utilizing an exterior operate.
One had been checked and stuck, however the different had not been discovered.
DOUG. All proper, good recommendation!
That article is known as: OpenSSL points a bugfix for the earlier bugfix, on nakedsecurity.sophos.com.
And, because the solar slowly begins to set on our present for immediately, let’s hear from certainly one of our readers on the OpenSSL article we simply mentioned.
Reader Larry hyperlinks to an XKCD Internet comedian referred to as Exploits of a Mother… I implore you to go and discover it.
I realise that me attempting to verbally clarify an online comedian shouldn’t be actually nice fodder for a podcast, so go to https://xkcd.com/327 and see it your self.
DUCK. All you must do, Doug, as a result of many listeners may have thought, “I’m actually hoping that somebody would commented this”… I used to be!
It’s the one about Little Bobby Tables!
DOUG. All proper…
DUCK. It’s turn out to be a sort of web meme in its personal proper.
DOUG. The scene opens up.
A mother will get a telephone name from her son’s college that claims, “Hello, that is your son’s college. We’re having some pc hassle.”
And she or he says, “Oh, pricey, did he break one thing?”
They usually say, “In a means. Did you actually identify your son Robert'); DROP TABLE College students;--?”
“Oh, sure. Little Bobby Tables, we name him.”
They usually say, “Properly, we’ve misplaced this yr’s pupil information. I hope you’re comfortable.”
And she or he says, “And I hope you’ve discovered to sanitize your database inputs.”
Excellent.
DUCK. Somewhat little bit of a naughty mum… keep in mind, we’re saying sanitize your inputs *and your outputs*, so don’t exit of your option to set off bugs simply to be a smarty-pants.
However she’s proper.
They shouldn’t simply take any previous knowledge that they’re given, make up a command string with it, and assume that it’ll all be positive.
As a result of not everyone performs by the principles.
DOUG. That’s from 2007, and it nonetheless holds up!
When you have an fascinating story, remark or query you’d wish to submit, we’d like to learn it on the podcast.
You may e-mail suggestions@sophos.com; you may touch upon any certainly one of our articles; or you may hit us up on social: @nakedsecurity.
That’s our present for immediately.
Thanks very a lot for listening… for Paul Ducklin, I’m Doug Aamoth, reminding you till subsequent time to…
BOTH. …keep safe!
[MUSICAL MODEM]
