Vendors, Disclosure, and a bit of WebUSB Madness

Was there any specific bug to report before we gave the talk? No, because it was widely discussed in the security scene that WebUSB is a bad idea. We believe we have demonstrated that by showing how it breaks U2F. There was no single issue to report to Google or Yubico, but a public discussion to trigger so WebUSB is fixed.

[...]

I do not know what “private outreach” means and why Yubico lied about being unable to replicate our findings in a call on March 2nd, even though they had it apparently working internally.

Librarian Sues Equifax Over 2017 Data Breach, Wins $600

“The small claims case was a lot more about raising awareness,” said West, a librarian at the Randolph Technical Career Center who specializes in technology training and frequently conducts talks on privacy and security.

“I just wanted to change the conversation I was having with all my neighbors who were like, ‘Ugh, computers are hard, what can you do?’ to ‘Hey, here are some things you can do’,” she said. “A lot of people don’t feel they have agency around privacy and technology in general. This case was about having your own agency when companies don’t behave how they’re supposed to with our private information.”

On the matter of OpenBSD breaking embargos (KRACK)

The UK's worst public sector IT disasters

Smart lock can be hacked [sic] 'in seconds'

A hi-tech padlock secured with a fingerprint can be opened by anyone with a smartphone, security researchers have found.

[...]

The lock's software does not take even simple steps to secure the data it broadcasts, he said, leaving it open to several "trivial" attacks.

[Older] Router Vulnerability and the VPNFilter Botnet

Decades-old PGP bug allowed hackers to spoof just about anyone’s signature

The flaw, indexed as CVE-2018-12020, means that decades' worth of email messages many people relied on for sensitive business or security matters may have in fact been spoofs. It also has the potential to affect uses that went well beyond encrypted email.

Thomas Dullien on Complexity and Security

Security experts warn hackers [sic] will target Americans traveling to Russia for World Cup

New Lazy FP State Restore Vulnerability Affects All Intel Core CPUs

CVE-2018-3665: Floating Point Lazy State Save/Restore vulnerability affects Intel chips

New flaw in Intel processors can be exploited in a similar way to Spectre

A new security vulnerability has been found in Intel’s family of Core processors, along similar lines of the major Spectre bug that has been making headlines all year. Thankfully, this one appears to be less severe – and is already patched in modern versions of Windows and Linux.

The freshly-discovered hole is known as the ‘Lazy FP state restore’ bug, and like Spectre, it is a speculative execution side channel attack. Just a few weeks back, we were told to expect further spins on speculative execution attack vectors, and it seems this is one.

Intel explains: “Systems using Intel Core-based microprocessors may potentially allow a local process to infer data utilizing Lazy FP state restore from another process through a speculative execution side channel.”

openSUSE Leap 15 Now Offering Images for RPis, Another Security Vulnerability for Intel, Trusted News Chrome Extension and More

Intel yesterday announced yet another security vulnerability with its Core-based microprocessors. According to ZDNet, Lazy FP state restore "can theoretically pull data from your programs, including encryption software, from your computer regardless of your operating system." Note that Lazy State does not affect AMD processors.

Security updates for Thursday

FBI: Smart Meter [Cracks] Likely to Spread

A series of [cracks] perpetrated against so-called “smart meter” installations over the past several years may have cost a single U.S. electric utility hundreds of millions of dollars annually, the FBI said in a cyber intelligence bulletin obtained by KrebsOnSecurity. The law enforcement agency said this is the first known report of criminals compromising the hi-tech meters, and that it expects this type of fraud to spread across the country as more utilities deploy smart grid technology.

Introducing Graphene-ng: running arbitrary payloads in SGX enclaves

A few months ago, during my keynote at Black Hat Europe, I was discussing how we should be limiting the amount of trust when building computer systems. Recently, a new technology from Intel has been gaining popularity among both developers and researchers, a technology which promises a big step towards such trust-minimizing systems. I’m talking about Intel SGX, of course.

Intel LazyFP vulnerability: Exploiting lazy FPU state switching

Intel chip flaw: Math unit may spill crypto secrets to apps – modern Linux, Windows, BSDs immune

A security flaw within Intel Core and Xeon processors can be potentially exploited to swipe sensitive data from the chips' math processing units.

Malware or malicious logged-in users can attempt to leverage this design blunder to steal the inputs and results of computations performed in private by other software.

These numbers, held in FPU registers, could potentially be used to discern parts of cryptographic keys being used to secure data in the system. For example, Intel's AES encryption and decryption instructions use FPU registers to hold keys.

Security updates for Wednesday

Serious Security: How three minor bugs make one major exploit

More insecure webcams! Inattention to IoT security! Who would have thought?

Unfortunately, cybersecurity still seems to sit way down in Nth place for many vendors when they start programming their latest and greatest Internet of Things (IoT) devices.

In this case, the bugs are in a family of webcams – and not just any old webcams, but security webcams.

Thousands of Android Devices Shipped with their Debug Port Exposed [Ed: Repeat from earlier. This is FUD. Thousands among over a billion and it's a misconfiguration issue rather than a bug.]