New Man-in-the-Disk attack leaves millions of Android phones vulnerable

Security researchers at Check Point Software Technologies have discovered a new attack vector against the Android operating system that could potentially allow attackers to silently infect your smartphones with malicious apps or launch denial of service attacks.

Dubbed Man-in-the-Disk, the attack takes advantage of the way Android apps utilize 'External Storage' system to store app-related data, which if tampered could result in code injection in the privileged context of the targeted application.

It should be noted that apps on the Android operating system can store its resources on the device in two locations—internal storage and external storage.

Google itself offers guidelines to Android application developers urging them to use internal storage, which is an isolated space allocated to each application protected using Android's built-in sandbox, to store their sensitive files or data.

However, researchers found that many popular apps—including Google Translate itself, along with Yandex Translate, Google Voice Typing, Google Text-to-Speech, Xiaomi Browser—were using unprotected external storage that can be accessed by any application installed on the same device.

How Android Man-in-the-Disk Attack Works?

Similar to the "man-in-the-middle" attack, the concept of "man-in-the-disk" (MitD) attack involves interception and manipulation of data being exchanged between external storage and an application, which if replaced with a carefully crafted derivative "would lead to harmful results."

For instance, researchers found that Xiaomi web browser downloads its latest version on the external storage of the device before installing the update. Since app fails to validate the integrity of the data, the app's legitimate update code can be replaced with a malicious one.

"Xiaomi Browser was found to be using the External Storage as a staging resource for application updates," the researchers said in a blog post.

"As a result, our team was able to carry out an attack by which the application’s update code was replaced, resulting in the installation of an alternative, undesired application instead of the legitimate update."

In this way, attackers can get a man-in-the-disk position, from where they can monitor data transferred between any other app on the user's smartphone and the external storage and overwrite it with their own malicious version in order to manipulate or crash them.

The attack can also be abused to install another malicious app in the background without the user's knowledge, which can eventually be used to escalate privileges and gain access to other parts of the Android device, like camera, microphone, contact list, and more.

Man-in-the-Disk Attack Video Demonstrations

Check Point researchers also managed to compromise files and crash Google Translate, Google Voice-to-Text, and Yandex Translate because those apps also failed to validate the integrity of data used from the Android's external storage.

Among the apps that Check Point researchers tested for this new MitD attack were Google Translate, Yandex Translate, Google Voice Typing, LG Application Manager, LG World, Google Text-to-Speech, and Xiaomi Browser.

Google, which itself doesn't follow its security guidelines, acknowledged and fixed some affected applications and is in the process of fixing other vulnerable apps as well, Check Point said.

Besides Google, the researchers also approached the developers of other vulnerable applications as well, but some, including, Xiaomi declined to fix the issue, according to the researchers.

"Upon discovery of these application vulnerabilities, we contacted Google, Xiaomi, and vendors of other vulnerable applications to update them and request their response," Check Point researchers said.

"A fix to the applications of Google was released shortly after, additional vulnerable applications are being updated and will be disclosed once the patch is made available to their users, while Xiaomi chose not to address it at this time."

The researchers stressed they only tested a small number of major applications and therefore expect the issue affects a more significant number of Android apps than what they explicitly noted, leaving millions of Android users potentially vulnerable to cyber threats.

Former Microsoft Engineer Gets Prison for Role in Reveton Ransomware

A former Microsoft network engineer who was charged in April this year has now been sentencedto 18 months in prison after pleading guilty to money laundering in connection with the Reveton ransomware.

Reveton malware is old ransomware, also known as scareware or police ransomware that instead of encrypting files locks the screen of victims’ computers and displays a message purporting to come from a national law enforcement agency.

The splash screen of the malware was designed to falsely tell unsuspecting victims that they have been caught doing illegal or malicious activities online or the law enforcement had found illegal material on their computer, forcing users to make pay a "fine" of $200-300 within 48 hours to regain access to their computers.

Raymond Odigie Uadiale, 41-year-old, who worked as a Microsoft network engineer, is not the actual author of the Reveton ransomware, but he helped the Reveton distributor, residing in the UK and identified as the online moniker "K!NG," in cashing out ransom money collected from victims in the form of Green Dot MoneyPak prepaid vouchers.

Uadiale, who was a student at Florida International University at the time of his crime in 2012 and 2013, was said to have acquired MoneyPak debit cards under the fake name of Mike Roland and received payments from victims of Reveton.

Using Liberty Reserve service, Uadiale then transferred $93,640 into accounts of his unnamed co-conspirator in the United Kingdom, after keeping his 30 percent cut.

Liberty Reserve was itself closed down by US authorities in May 2013, after its creator pleaded guilty to laundering hundreds of millions of dollars through the digital currency exchange and was sentenced to 20 years in prison.

In the Southern Florida US District Court on Monday, Uadiale was given an 18-month prison sentence and three years of supervised release, after he agreed to a plea agreement that dismissed the second count of substantive money laundering.

"The indictment charged Uadiale with one count of conspiracy to commit money laundering and one count of substantive money laundering. As part of the plea agreement, the government dismissed the substantive count."

"By cashing out and then laundering victim payments, Raymond Uadiale played an essential role in an international criminal operation that victimized unsuspecting Americans by infecting their computers with malicious ransomware," said Assistant Attorney General Brian Benczkowski.

Microsoft hired Uadiale as a network engineer after the conspiracy charged related to the ransomware scheme in the indictment ended

Hackers can compromise your network just by sending a Fax

What maximum a remote attacker can do just by having your Fax machine number?

Believe it or not, but your fax number is literally enough for a hacker to gain complete control over the printer and possibly infiltrate the rest of the network connected to it.

Check Point researchers have revealed details of two critical remote code execution (RCE) vulnerabilities they discovered in the communication protocols used in tens of millions of fax machines globally.

You might be thinking who uses Fax these days!

Well, Fax is not a thing of the past. With more than 300 million fax numbers and 45 million fax machines in use globally, Fax is still popular among several business organizations, regulators, lawyers, bankers, and real estate firms.


Since most fax machines are today integrated into all-in-one printers, connected to a WiFi network and PSTN phone line, a remote attacker can simply send a specially-crafted image file via fax to exploit the reported vulnerabilities and seize control of an enterprise or home network.

All the attacker needs to exploit these vulnerabilities is a Fax number, which can be easily found simply by browsing a corporate website or requesting it directly.

Faxploit Attack — Demonstration Video

Dubbed Faxploit, the attack involves two buffer overflow vulnerabilities—one triggers while parsing COM markers (CVE-2018-5925) and another stack-based issue occurs while parsing DHT markers (CVE-2018-5924), which leads to remote code execution.

To demonstrate the attack, Check Point Malware Research Team Lead Yaniv Balmas and security researcher Eyal Itkin used the popular HP Officejet Pro All-in-One fax printers—the HP Officejet Pro 6830 all-in-one printer and OfficeJet Pro 8720.

As shown in the above video, the researchers send an image file loaded with malicious payload through the phone line, and as soon as the fax machine receives it, the image is decoded and uploaded into the fax-printer's memory.

In their case, the researchers used NSA-developed EternalBlue and Double Pulsar exploits, which was leaked by the Shadow Brokers group and was behind the WannaCry ransomware global outcry last year, to take over the connected machine and further spread the malicious code through the network.

"Using nothing but a phone line, we were able to send a fax that could take full control over the printer, and later spread our payload inside the computer network accessible to the printer," the researcher said in a detailed blog post published today.

"We believe that this security risk should be given special attention by the community, changing the way that modern network architectures treat network printers and fax machines."

According to the Check Point researchers, attackers can code the image file with malware including ransomware, cryptocurrency miners, or surveillance tools, depending upon their targets of interest and motives.

Check Point researchers responsibly disclosed their findings to Hewlett Packard, which quickly fixed the flaws in its all-in-one printers and deployed firmware patches in response. A patch is available on HP's support page.

However, the researchers believe the same vulnerabilities could also impact most fax-based all-in-one printers sold by other manufacturers and other fax implementation, such as fax-to-mail services, standalone fax machines, and more.

Snapchat Source Code Leaked and Posted to GitHub

GitHub is often the go-to place for hackers or researchers to archive interesting code or data dumps. But sometimes affected companies do their best to remove exposed data from the code repository site.

Earlier this year, Snap—the company behind social media network Snapchat—exposed some of the source code of the network’s iOS app, Snap confirmed to Motherboard on Tuesday. After someone archived that exposed code on GitHub, Snap told GitHub to remove the data with a copyright act request, Snap told Motherboard.

“An iOS update in May exposed a small amount of our source code and we were able to identify the mistake and rectify it immediately,” a Snap spokesperson told Motherboard in an email. “We discovered that some of this code had been posted online and it has been subsequently removed. This did not compromise our application and had no impact on our community.”

The independent security researcher known as x0rz tweeted about the takedown on Tuesday, pointing to a copy of the request itself.

“What would be the best solution for the alleged infringement? Are there specific changes the other person can make other than removal?” one section reads.

“NO, THIS SHOULD BE REMOVED BECAUSE IT IS ALL LEAKED SOURCE CODE,” the reply, from a Snap employee, reads.

Got a tip? You can contact this reporter securely on Signal on +44 20 8133 5190, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.

The takedown was enforced under the Digital Millennium Copyright Act (DMCA), a law businesses often use to protect their intellectual property. In February, Apple used a DMCA request to remove some of its own code from GitHub.

One of the GitHub repos previously hosting the Snapchat code now says “We have disabled public access to the repository.”

It appears some researchers are trading the data privately, however.

“Yeah I got it. DM me,” one Twitter user wrote on Tuesday.

WhatsApp security snafu allows sneaky 'message manipulation'

Researchers claim to have uncovered weaknesses in WhatsApp that can be exploited to manipulate messages in private and group conversations.
Eggheads at Israeli security firm Check Point this week described how, with some social engineering trickery and custom extensions for popular network-packet-twiddling toolkit Burp Suite, they can:

1. Alter the text of someone's reply on their phone, essentially putting words in the other person's mouth.
2. Use the “quote” feature in a group conversation to change the identity of the sender, even if that person is not a member of the group.
3. Send a private message to another group participant that is disguised as a public message for all, so when the targeted individual responds, it’s visible to everyone in the conversation.

Basically, you can tamper with messages received and stored on your device, quote them back to your mark, and sow the seeds of all sorts of confusion. All the techniques involve social engineering tactics to hoodwink marks, as well as obtaining your public-private key pair from WhatsApp, as explained at some length in a blog post by Check Point's Dikla Barda, Roman Zaikin, and Oded Vanunu right here.
There's also a video illustrating the approach, as embedded below.

CoinHive Miner Virus Outbreak Has Infected 170,000 Routers

The Coinhive Miner virus has infected hundreds of thousands MikroTik routers. The malware has now reportedly installed a JavaScript miner to over 170,000 devices and this recent outbreak is believed to be getting bigger and bigger.

The first hint of attacks was discovered by researcher who goes by the nickname MalwareHunterBR and who tweeted, that the miner has started to spread at an alarming rate. In addition to this, news have also broken out that the first stages of the attack compromised about 70 thousand routers alone.

What is Behind Coinhive’s Infection Success

What is believed is that the hacker may have used one of the exploits for MikroTik devices to perform a zero-day type of attack through one device and then in the device drop a copy of the Coinhive library. This library is also in all of the pages which are displayed by the router, making all of the devices connected to it vulnerable.

And furthermore, since the zero day has been exploited by using only one Coinhive key for all of the injections performed by cooinhive via the past week, it is belived that only one attacker is behind the attack.

In addition, researchers also claim that non-MikroTik users were also among the victims, because some of the Internet Service providers have used MikroTik devices via their main network and since the hacker has injected the JavaScript code, this attack has spread to all of the devices that are logically connected to the MikroTik routers that are compromised.

The injection has worked with a tremendous success because of the fact how the attack is done and the fact that the infection process has succeeded in obtaining incomingand outgoing traffic control successfully.

US Department of Justice creates software blacklist to prevent foreign attacks

The US Department of Justice wants to educate its contractors and military software buyers about malicious software that could infiltrate the country’s infrastructure.

For fear of nation state attacks and cyberespionage attempts, the Pentagon has released a “Do Not Buy” software list that has been in development for approximately six months, writes Defense One. The list includes all software that is not according to “national security standards,” said Ellen Lord, defense undersecretary for acquisition and sustainment, and looks at companies with suspicious links to Russia and China.

US intelligence and officials from the Department of Justice have been working together to detect “certain companies that do not operate in a way consistent with what we have for defense standard.”

“We had specific issues … that caused us to focus on this,” Lord said in an interview.

“What we are doing is making sure that we do not buy software that’s Russian or Chinese provenance,” she said. “Quite often that’s difficult to tell at first glance because of holding companies.”

To ensure the list is as accurate as possible, the US Department of Justice is closely working with the Aerospace Industries Association, National Defense Industrial Association and Professional Services Council.

The names of the companies on the list has not been released, however Kaspersky Labs and ZTE have already been placed on a ban list.

According to a report from the National Counterintelligence and Security Center, foreign governments have asked access to software source code US companies want to sell abroad, which may lead to vulnerability exploits.

“Recent Chinese laws—including laws on national security and cybersecurity—provide Beijing a legal basis to compel technology companies operating in China to cooperate with Chinese security services,” reads the report.

UK government worried Huawei software could facilitate cyberespionage

Huawei Technologies, the Chinese ICT infrastructure and smart device manufacturer, is now on UK’s security blacklist following technical “shortcomings” in the software used, writesReuters.

UK officials are concerned telecom companies and their networks could be seriously compromised due to outdated software in Huawei devices. As mentioned by three anonymous sources for Reuters, the software component is actually the VxWorks operating system, sold by US-based Wind River Systems. It appears that as of 2020, the company will no longer release security patches, even though the software will still be in use.

According to a UK government report released in July, this glitch is believed to facilitate cyberattacks on British infrastructure and cyberespionage.

“Third party software, including security critical components, on various component boards will come out of existing long-term support in 2020, even though the Huawei end of life date for the products containing this component is often longer,” reads the government report.

This is not the first time the Chinese software company has been accused of allowing the Chinese government to use its equipment to spy on other nations. The Pentagon has already banned Huawei and ZTE phones from US military bases for fear they could jeopardize national security and secret operations.

“Cyber security remains Huawei’s top priority, and we will continue to actively improve our engineering processes and risk management systems,” said a Huawei spokesperson. The company said they will consider the recent national security concerns expressed by the UK government and will look into improving the areas mentioned. No explicit comments were made on the government’s July report.