Risky Business #789 Summary: Apple's AirPlay Vulnerabilities Are Surprisingly Awful

Host: Patrick Gray
Guest: Adam Boileau (Sponsor Interview)

Introduction

In episode #789 of "Risky Business," Patrick Gray provides a comprehensive dive into the latest cybersecurity news, critical vulnerabilities, and an insightful interview with Adam Poynton, CEO of Knock Knock. The episode covers high-profile ransomware attacks, emerging financial cybercrimes, significant software vulnerabilities, and the pivotal role of IPv6 in modern network security.

Key News Highlights

1. Ransomware Attack on Marks and Spencer

• Overview:
  British retailer Marks and Spencer (M&S) fell victim to a ransomware attack that significantly impacted its operations. Initially reported as a minor incident, the situation escalated quickly, leading to a £500 million loss in market cap, layoffs of hundreds of staff, and the disabling of online sales.

• Insights:
  Adam Boileau identifies the Scattered Spider group as the likely perpetrators, referencing their previous attacks on Las Vegas casinos. Despite expectations of swift law enforcement action, the group's poor operational security may delay arrests.

• Notable Quote:
  Patrick Gray (01:42): "It's a complete mess for a retailer, that's for sure."
  Adam Boileau (02:13): "They’re not really known for their opsec. So, yeah, probably going to end badly."

2. Brokerage Account Takeovers in Malaysia and Japan

• Overview:
  Attackers have been compromising brokerage accounts in Malaysia and Japan by exploiting password reuse and credential dumping. They sell customers' shares and reinvest the proceeds in volatile penny stocks, manipulating market prices to siphon funds.

• Scale:
  In Japan, approximately $350 million worth of shares were liquidated and $315 million were used to inflate penny stock prices, disrupting financial markets.

• Notable Quote:
  Adam Boileau (05:41): "When you come up with a new way to cash out, then, you know, off you go. And repeat that around the world."

3. Bitcoin Theft and Monero Price Manipulation

• Overview:
  An attacker stole 3,520 Bitcoin (valued at around $330 million) and attempted to launder the funds by converting them into Monero. This massive influx caused Monero's price to spike by 50%, highlighting vulnerabilities in cryptocurrency laundering methods.

• Notable Quote:
  Adam Boileau (07:12): "It's pretty wild watching the speedrun all of this financial crime happen all at once."

4. Chinese Media Reports on US Cyberattacks

• Overview:
  The Chinese Global Times reported that US intelligence agencies launched a cyberattack against a major Chinese commercial encryption provider. China claims to have detected and handled the attack, though the exact details remain unclear.

• Skepticism:
  Both Patrick and Adam express doubt about the adequacy of China's response, comparing it to past incidents like the RSA key theft, which required significant remediation.

• Notable Quote:
  Patrick Gray (08:36): "They handled it. And then you read the report and it talks about how throughout 2024, suspected U.S. intelligence agencies owned their CRM..."

5. Iranian Cyberattacks and Port Fire

• Overview:
  Iran reported repelling a major cyberattack on its infrastructure, coinciding with a significant fire at a port facility. While the two incidents are likely unrelated, the timing raises suspicions about coordinated attacks.

• Notable Quote:
  Adam Boileau (10:08): "They foiled it by turning it into atmospheric pollution."

6. Power Systems Failure in Spain and Portugal

• Overview:
  A widespread blackout in Spain and Portugal initially raised concerns of a cyber-induced power grid attack. However, investigations later ruled out cyberattacks, attributing the failure to natural causes.

• Notable Quote:
  Patrick Gray (11:58): "Spain has ruled it out. So probably a squirrel."

7. SK Telecom's SIM Card Replacement Crisis

• Overview:
  South Korean telecom SK Telecom faced a massive SIM card replacement initiative due to the suspected compromise of private key material. With 20 million customers and only 1 million SIM cards on hand, the rollout has caused significant operational disruptions.

• Security Implications:
  The compromise suggests that attackers may have accessed symmetric key material essential for SIM card security, enabling SIM cloning and unauthorized access.

• Notable Quote:
  Patrick Gray (13:22): "It's a very big mess."

Research Highlights

1. AirPlay Vulnerabilities by Oligo Security

• Overview:
  Oligo Security identified multiple vulnerabilities in Apple's AirPlay protocol. These flaws allow attackers on the same Wi-Fi network to gain unauthorized control over AirPlay-enabled devices, including third-party products like Sony TVs and CarPlay systems.

• Technical Details:
  The vulnerabilities exploit Apple's plist format in the AirPlay protocol, leading to issues like use-after-free errors and remote code execution without user interaction.

• Notable Quote:
  Adam Boileau (16:16): "There’s a range of bugs, at least one of them is kind of zero user interaction required affected macOS and the other Apple systems as well."

2. Juice Jacking (Choice Jacking) Attack Research

• Overview:
  Researchers from an Austrian university presented a novel juice jacking attack named "choice jacking." This method allows malicious USB devices to inject commands and manipulate Bluetooth settings, granting unauthorized access to the connected device.

• Attack Mechanics:
  The USB device initially mimics a keyboard to inject keystrokes, triggers Bluetooth pairing, and then leverages Bluetooth to change USB roles, enabling data theft without user interaction.

• Notable Quote:
  Adam Boileau (20:47): "So this is super cool. So you plug in the USB device. It initially pretends to be a keyboard..."

3. Android 16 USB Security Enhancements

• Overview:
  Android 16 introduces advanced security features to mitigate USB-based attacks. This includes the ability to disable USB ports when the device is locked, preventing unauthorized access through techniques like juice jacking.

• Impact:
  These enhancements aim to bolster the security of Android devices against sophisticated physical attacks, aligning with broader zero-trust security models.

Critical Vulnerabilities

1. Erlang OTP SSH Bug

• Overview:
  A critical CVSS 10/10 vulnerability was discovered in Erlang OTP's SSH implementation, allowing unauthenticated remote command execution. This poses a severe threat to telco environments reliant on Erlang-based systems.

• Technical Insights:
  The bug allows attackers to send out-of-state messages within the SSH protocol to prompt command execution, bypassing authentication mechanisms.

• Notable Quote:
  Patrick Gray (25:08): "You don't often hear the words CVSS 10 and SSH in the same sentence, right?"

2. SAP NetWeaver Vulnerability

• Overview:
  SAP NetWeaver faces an actively exploited CVSS 10/10 vulnerability in its service discovery and registration endpoint via UDDI (Universal Description, Discovery, and Integration). This flaw enables unauthorized code execution within enterprise environments.

• Implications:
  The vulnerability allows attackers to reroute services and execute arbitrary code, posing significant risks to organizations using SAP systems.

• Notable Quote:
  Adam Boileau (27:36): "This is straight up CVSS 10 out of 10… a bug that you can connect to and execute code."

3. Commvault Backup System Bug

• Overview:
  A severe bug in Commvault’s backup system allows directory traversal and subsequent code execution by processing malicious ZIP files. This vulnerability has been exploited in the wild, jeopardizing backup integrity and security.

• Technical Details:
  The exploit involves manipulating ZIP file paths to inject malicious code into the web root of Commvault’s Java-based web application.

• Notable Quote:
  Adam Boileau (28:47): "It's straight up code executing your backup server and then you restore the backups of the domain controller, steal all of the key mats."

Future Threats

Mobile Payment Fraud by Chinese and Russian Actors

• Overview:
  Catalan Kimpanu's research highlights the increasing sophistication of mobile payment fraud orchestrated by Chinese and Russian cybercriminal groups. These attackers employ techniques like NFC relay attacks and malware to manipulate mobile payment systems.

• Attack Methods:
  Chinese groups use social engineering to enroll victims' cards into mobile wallets, while Russian crews deploy malware to relay NFC data, enabling unauthorized transactions at ATMs and point-of-sale terminals.

• Notable Quote:
  Adam Boileau (32:49): "Once those radio systems converge and become more and more commonplace… there’s a bunch of building access control… it's not just payment cards."

US Government Updates

CISA Leadership Changes

• Overview:
  Madhu Gotu Mukala, CIO of South Dakota, has been appointed as the new deputy director of CISA. The nomination for the CISA director remains pending, with current leadership facing uncertainty amid ongoing investigations and departures.

• Chris Krebs Investigation:
  Former CISA director Chris Krebs is under investigation following his resignation and critical stance against the Trump administration. Additionally, whistleblower Daniel J. Baroulas has filed a complaint alleging improper data handling at the National Labor Relations Board (NLRB).

• Notable Quote:
  Patrick Gray (37:08): "A whistleblower from the National Labor Relations Board has filed a complaint… it's pretty mind-blowing stuff."

Top Tier's Cybersecurity Defense Blog Post

• Overview:
  Top Tier published a detailed blog post outlining strategies to defend cybersecurity companies against advanced adversaries, including nation-states and cybercriminal groups targeting security vendors.

• Key Points:
  The post discusses attacks on EDR products, rental of access for testing exploits, and the importance of robust internal security measures to protect sensitive environments.

• Notable Quote:
  Adam Boileau (44:27): "It's really nice seeing this kind of detail from a vendor."

Sponsor Interview: Knock Knock and IPv6

Introduction to Knock Knock

Patrick introduces Adam Poynton, CEO of Knock Knock, to discuss the critical role of IPv6 in enhancing network security and enabling zero-trust architectures.

Security Advantages of IPv6

• Precision Attribution:
  IPv6 allows for unique IP addressing of individual devices, facilitating precise attribution and traffic control at the firewall level.

• Zero Trust Foundation:
  The unique addressing scheme of IPv6 is pivotal for implementing zero-trust models, where each device’s access is authenticated and authorized explicitly.

• Notable Quote:
  Adam Poynton (50:41): "You get precision attribution, you get precision direction of the flow of traffic… unlocks the zero trust model."

Use Cases for Knock Knock

1. Internal Network Segregation (OT Networks):
   Knock Knock enables dynamic access control for operational technology (OT) networks, allowing administrators to grant on-demand access through Single Sign-On (SSO) without maintaining persistent network connections.

   • Benefits:
     Reduces attack surfaces by limiting access to critical internal networks, ensuring that only authenticated sessions can interact with sensitive environments.

   • Notable Quote:
     Adam Poynton (57:04): "People are finding that, yeah, you can just drop in, knock knock, add a few firewall rules and orchestrate it that way. And it's really working."

2. Supercomputing Lab Access:
   Supercomputing environments require high-speed, secure access to massive data sets. Knock Knock provides controlled, time-limited access to these environments without exposing them to persistent threats.

   • Benefits:
     Ensures that data-intensive operations can occur securely without compromising the integrity of the supercomputing infrastructure.

   • Notable Quote:
     Adam Poynton (60:06): "Having direct access… not wanting them being extremely exposed to hostile external or even hostile internal threats."

IPv6 Adoption and Challenges

• Current Adoption Rates:
  Over 50% of Google visits in the United States are served over IPv6, indicating a significant shift towards broader deployment.

• Implementation Challenges:
  Despite its advantages, global IPv6 adoption faces hurdles such as dual-network maintenance (V4 and V6), infrastructure upgrades, and ensuring consistent support across all network segments.

• Notable Quote:
  Patrick Gray (51:39): "You can't be guaranteed that you're going to get it from your provider. Like if you're out on the road, you’re connecting to the hotel Wi-Fi… there's no guarantee that you're going to be able to get V6."

Future Prospects

• Knock Knock's Role:
  By leveraging IPv6, Knock Knock enhances network security through precise access controls and simplifies the implementation of zero-trust models across diverse environments.

• Notable Quote:
  Adam Poynton (54:09): "Every client, every server… it’s not experimental, but there's a lot of effort and it's complicated."

Conclusion

Episode #789 of "Risky Business" underscores the evolving landscape of cybersecurity threats, from sophisticated ransomware attacks to critical software vulnerabilities. The discussion emphasizes the pivotal role of IPv6 in enhancing network security and supports the adoption of zero-trust models through precise access controls. The sponsor interview with Knock Knock highlights practical solutions for securing internal networks and specialized environments like OT systems and supercomputing labs.

Key Takeaways:

• Ransomware and Financial Cybercrimes: Persistent threats target high-value organizations, necessitating robust defenses and swift incident responses.

• Software Vulnerabilities: Critical flaws in widely-used systems like Erlang OTP, SAP NetWeaver, and Commvault highlight the need for continuous security assessments and prompt patching.

• Emerging Attack Vectors: Innovative methods like juice jacking and NFC relay attacks demonstrate the creativity of cyber adversaries, emphasizing the importance of proactive security measures.

• IPv6 as a Security Enabler: Adoption of IPv6 facilitates precise network controls and is foundational for modern security architectures like zero trust, despite implementation challenges.

• Government Cybersecurity Dynamics: Leadership changes and internal security lapses within agencies like CISA highlight ongoing challenges in maintaining national cybersecurity resilience.

This episode serves as a crucial update for information security professionals, providing actionable insights and highlighting the urgency of adopting advanced security measures in an increasingly complex threat landscape.

For more detailed discussions and expert insights, make sure to listen to the full episode of "Risky Business."