Qualcomm and HackerOne Partner on Bounty Program

Qualcomm kicked off its first bug bounty program Thursday, opening the door for white hat hackers to find flaws in a dozen Snapdragon mobile chipsets and related software. Rewards for the invite-only bug bounty program top $15,000 each. HackerOne will facilitate Qualcomm’s bounty program; the chipmaker is hoping to secure millions of smartphones running Snapdragon silicon, including phones sold by Samsung, LG, HTC and Google.
Eligible Snapdragon products include eight mobile processors, four LTE modems and additional related silicon technologies and software. The bug bounty program will be administered through the Qualcomm Technologies business unit in conjunction with HackerOne. The program, Qualcomm claims, is the first of its kind for a major silicon vendor. “With Qualcomm Technologies’ vulnerability rewards program they will continue to build vital relationships with the external security researcher community and supplement the great work their internal security team is doing,” said Alex Rice, chief technology officer for HackerOne in a prepared statement. Qualcomm joins a number of high-profile and recently launched bug-bounty programs. Earlier this month the Department of Defense awarded a contract to HackerOne to bolster the cyber security of the U.S. Army’s digital assets. That complemented another investment by the U.S. government with Synack, which was picked to create a bug-bounty platform for the IRS. HackerOne also had a high profile Hack the Pentagon bug bounty program which ran from April 18 to May 12 earlier this year. Qualcomm and HackerOne said that 40 security researchers have been invited to participate. The bounty program includes a list of chipset models eligible for submissions, along with software components that include Linux kernel code (part of “Android for MSM”) and WLAN and Bluetooth firmware. At the top range of the bounty program are $15,000 rewards for critical bugs tied to Snapdragon cellular modems. Rewards of $9,000 are tied to ‘critical’ Trusted Execution Environment, or TEE, and bootloader vulnerabilities. Security vulnerabilities rated ‘high’ payout between $5,000 and $4,000. Vulnerabilities considered ‘medium’ and ‘low range’ offer rewards of $2,000 to $1,000. Not eligible, are issues tied to OEM modifications, some denial of service issues and bugs tied to PC software such as USB drivers, according to HackerOne. Qualcomm said the rewards program is effective starting November 17. Qualcomm’s bug bounty program comes on the heels of this summer’s revelation of four massive vulnerabilities, dubbed Quadrooter, which impacted over 900 million smartphones running Qualcomm chipsets. Security research firm Check Point discovered the vulnerabilities and said they could allow an attacker to elevate privileges on top Android handsets and give an attacker complete control over targeted devices. In October, Google released the last in a series of patches addressing the vulnerabilities.

Eligible Snapdragon products include eight mobile processors, four LTE modems and additional related silicon technologies and software. The bug bounty program will be administered through the Qualcomm Technologies business unit in conjunction with HackerOne. The program, Qualcomm claims, is the first of its kind for a major silicon vendor. “With Qualcomm Technologies’ vulnerability rewards program they will continue to build vital relationships with the external security researcher community and supplement the great work their internal security team is doing,” said Alex Rice, chief technology officer for HackerOne in a prepared statement. Qualcomm joins a number of high-profile and recently launched bug-bounty programs. Earlier this month the Department of Defense awarded a contract to HackerOne to bolster the cyber security of the U.S. Army’s digital assets. That complemented another investment by the U.S. government with Synack, which was picked to create a bug-bounty platform for the IRS. HackerOne also had a high profile Hack the Pentagon bug bounty program which ran from April 18 to May 12 earlier this year. Qualcomm and HackerOne said that 40 security researchers have been invited to participate. The bounty program includes a list of chipset models eligible for submissions, along with software components that include Linux kernel code (part of “Android for MSM”) and WLAN and Bluetooth firmware. At the top range of the bounty program are $15,000 rewards for critical bugs tied to Snapdragon cellular modems. Rewards of $9,000 are tied to ‘critical’ Trusted Execution Environment, or TEE, and bootloader vulnerabilities. Security vulnerabilities rated ‘high’ payout between $5,000 and $4,000. Vulnerabilities considered ‘medium’ and ‘low range’ offer rewards of $2,000 to $1,000. Not eligible, are issues tied to OEM modifications, some denial of service issues and bugs tied to PC software such as USB drivers, according to HackerOne. Qualcomm said the rewards program is effective starting November 17. Qualcomm’s bug bounty program comes on the heels of this summer’s revelation of four massive vulnerabilities, dubbed Quadrooter, which impacted over 900 million smartphones running Qualcomm chipsets. Security research firm Check Point discovered the vulnerabilities and said they could allow an attacker to elevate privileges on top Android handsets and give an attacker complete control over targeted devices. In October, Google released the last in a series of patches addressing the vulnerabilities.

See more at: Qualcomm and HackerOne Partner on Bounty Program https://wp.me/p3AjUX-vKy

“PoisonTap” Device Made Using $5 Raspberry Pi Can Easily Hack Password-Protected Computers

The lock screen of a computer is the ultimate locked door which every hacker seeks to break. This is because the lock screen protects the access of a PC/laptop to unauthorized access. Many hackers have tried to devise ways and means to break this ultimate door be it on Windows, Mac or Linux run PC/laptops. A hacker used a $50 device called Hak5 LAN Turtle to do the same while our very own Samy Khamkar had better ideas.
He has created a hacking device that allows attackers to easily gain access to a password-protected computer, hijack all its Internet traffic, and install backdoors. He has created this ultimate hack tool called PoisonTap using just $5 Rasberry Pi and running on Node.js. A person wanting to hack the lock screen password has to just plug in the $5 PoisonTap to Windows or Mac computer via USB, the device starts loading the exploits needed to compromise the machine without asking for the lock screen password.
The PoisonTap uses the similar method $50 device called Hak5 LAN Turtle and targets the weak Ethernet authentication in Mac and Windows PC. Once the PoisonTap is connected, the hacking tool emulates an Ethernet device over USB. The Windows/Mac PC recognizes the PoisonTap as Ethernet device it loads it as a low-priority network device and sends it a DHCP request. The PoisonTap then starts hijacking the internet traffic by taking control of IPv4 space. Once this is done, Poison can steal HTTP cookies and sessions for the Alexa top 1 million websites from the victim’s browser.
Khamkar has said that cookie siphoning is possible even if the web browser is not actively used. As long as the application is running in the background, it’s likely that at least one of the open webpages is making HTTP requests.
PoisonTap can then install  backdoors for hundreds of thousands of domains, and open a remote access channel to the victim’s router.
Since PoisonTap steals cookies and not credentials, the attacker can hijack the victim’s online accounts even if they have two-factor authentication (2FA) enabled. Furthermore, HTTPS protection is bypassed if the “secure” cookie flag and HSTS are not enabled. Khamkar says PoisonTap can also bypass several other security mechanisms, including same-origin policy (SOP), HttpOnly cookies, X-Frame-Options HTTP response headers, DNS pinning and cross-origin resource sharing (CORS).
The interesting part is that PoisonTap needed to connect only once to the target PC. Once it is connected and it installs the backdoors, the hacker has access to the exploited PC even when it is disconnected.