This week
Apple is going to scan devices for photos of child sexual abuse
Apple has unveiled two new features this week to help combat the spread of child sexual abuse material (CSAM).
The first is built into its iMessage app to detect potential CSAM and present warnings on children’s devices about sensitive images, help if they are being pressured and reminders that the person in the image may not have wanted it to be shared. The defaults are to not view the image with links to other resources being provided. A notification will be sent to any Apple Family parental accounts.
This is a welcome feature, especially as child sexual predators try to keep their communications secret, and in many cases parents are unaware that their child is being hurt by a predator.
The second feature involves scanning all of a user’s photos for CSAM using a technique called ‘NeuralHash’ and reporting the results back to Apple.
NeuralHash converts images into numbers, based on the features in the image rather than the exact pixels. That means two images, one slightly cropped, or altered with a filter (such as made black and white) will return the same hash.
Apple’s system here will see a database containing fingerprints of known CSAM downloaded on every device against which the user’s iCloud photos. Each photo will be given a ‘voucher’ containing a score. These are reported to Apple and, if a certain threshold is reached, Apple will be able to decrypt the user’s images and review them before disabling the account and sharing the images and user’s details with the US’s National Center for Missing and Exploited Children (NCMEC).
It’s important to note that there are privacy protections in place with this system through Private Set Intersection (PSI) and Threshold Secret Sharing (TSS). Apple’s website has technical information on the approach. Users won’t be able to reverse the CSAM database, nor will they be able to see the results of the comparison, and therefore try and game the system to avoid detection.
However, as the Electronic Frontier Foundation (EFF) says:
“Apple can explain at length how its technical implementation will preserve privacy and security in its proposed backdoor, but at the end of the day, even a thoroughly documented, carefully thought-out, and narrowly-scoped backdoor is still a backdoor.”
There will be a way for Apple to decrypt user content. Something that it fought the FBI in court over with the San Bernardino shooter’s iPhone. Executives at other Silicon Valley tech companies, which stood with Apple in that defence, are now understood to be ‘incandescent’. Sajid Javid, UK Health Secretary, has said Facebook should follow suit, despite existing systems in place in their WhatsApp product that have resulted in over 400,000 cases being reported to NCMEC.
Intelligence agencies have bemoaned the rise of end-to-end encryption as preventing them from being able to conduct their missions. It is more complicated nowadays than it was to place a wiretap decades ago: the volume of potential channels has increased (how many messaging apps do you have on your phone?) as well as the protection of their content. However, agencies have also proved resourceful in circumventing these constraints. In some cases running encrypted phone networks used by criminals (vol. 3, iss. 27, vol. 4, iss. 24).
Child protection is being used to drive legislation by governments around the world to compel tech companies to weaken the security and privacy of their products and services. The ‘ends’ of child sexual abuse are abhorrent, however, they shouldn’t be used to justify any ‘means’.
Decryption is one part of that, but arguably the more chilling aspect of this is how the content to be decrypted will be identified.
What Apple is building is a mass surveillance infrastructure that is ripe for repurposing, misuse and abuse. While the system has been trained on 200,000 known CSAM, it would be trivial to replicate with an alternative set. Tank Man for example would generate reports of those with photos of the unidentified man blocking the path of tanks in Tiananmen Square. Apple is known to have already compromised on its strong privacy stance to keep Chinese authorities happy (vol. 4, iss. 21).
Legislation like Australia’s Assitance and Access Act is also relevant and allows for Technical Assistance Notices (vol. 2, iss. 27) to compel the use of existing capabilities by law enforcement and security agencies.
iOS 15 also includes new image to text features that allow ‘copy and pasting’ details out of photos (like items on a menu, or phone numbers from a billboard). Equally, the capability can be extended to apply the same techniques to words or phrases used in iMessage or Notes.
The scanning occurs on the device and will only apply to those who also back up their photos to iCloud so that the images can be reviewed and confirmed suspicious by Apple before submission to authorities. Therefore if a user doesn’t have iCloud Photos enabled the system will not function.
It doesn’t take much imagination to work out that a child sexual predator is therefore going to turn iCloud Photos off. (If they haven’t already; I’d suspect major cloud providers aren’t your first port-of-call for storing illegal material). That is a win for Apple though: their platform will be rid of CSAM.
It’s the remainder, therefore, that needs to be weighed: the benefit of identifying and reporting (what I’d assume to be a small proportion) of users with CSAM, versus the definite and demonstrable harm expected to be inflicted by authoritarian regimes on minorities or protesters, given the same capability.
iMessage feature: techcrunch.com (iMessage feature), CSAM: ft.com, techcrunch.com, arstechnica.com, bbc.co.uk (WhatsApp), eff.org, apple.com announcement, technical summary
Interesting stats
6% of revenue ($85M), the value of Zoom’s settlement of a class-action lawsuit over their misleading ‘end-to-end encryption’ claims and inadequate security controls that led to zoombombing theregister.com
$10 the amount of credit Amazon is giving to incentivise customers at their physical stores to provide their palm prints. The biometric data will be used to identify the shoppers at checkout techcrunch.com
1/3 of 2,000 people surveyed by Mortar Research for Barclays were scammed online in the last three months, with 29% of those falling victim being aged 21-30, accounting for the largest age group ft.com
Other newsy bits
An interview with BlackMatter ransomware gang
Dmitry Smilyanets, an analyst at Recorded Future, has an interview with the new ransomware gang BlackMatter. It’s an interesting read and what jumps out is how ‘professional’ the operation is: market intelligence, competitor research (and benchmarking), and product roadmaps all feature. When asked if they had considered a legal career, such as penetration testing, they answered that “this could not bring the proper material reward,” the interview concluding “we believe in our motherland, we love our families, and we earn money for our children.”
Responsible cyber offence
Five eyes governments have been making noises about ‘irresponsible’ behaviour in cyberspace recently, including pointing the finger at Russia for harbouring cybercriminals and China for reckless espionage campaigns (vol. 4, iss. 30). Understanding of cyber capability and how it is (not) analogous to physical response can be poor amongst cabinet members. (The over-reliance on military terminology probably isn’t helping here.) Perri Adams, Dave Aite, George Perkovich and JD Work propose what the principles, or ‘norms’, could be for responsible offensive cyber behaviour from nation-states and how these may help to contain the fallout and unintended consequences of actions.
Defeating TPMs and stealing VPN certificates
Interesting writeup from Dan Goodin of work done by researchers at Dolos Group as part of a customer engagement to try and compromise their network if a new laptop was intercepted. The build was pretty well locked down, but they were able to open the case and hook up to the ‘trusted platform module’ (TPM). Good hacking, though the threat model for most organisations shouldn’t need to worry attackers intercepting laptops and direct connections onto the motherboard. As one commenter put it “If the NSA or the GRU wants to see what’s in my network they will, and I can’t stop them, any more than I could stop a SEAL team from successfully robbing my convenience store."
“Master faces”
Some really interesting research out of Tel Aviv University looking at which faces “[pass] face-based identity-authentication for a large portion of the population.” Their analysis suggests you can get ‘coverage’ of 40% of the population with less than 10 ‘master faces’. “Overall, our results indicate that performing a dictionary attack of face authentication systems is feasible at high success rates."
Twitter announces algorithm bug bounty challenge
This is neat, and nice to see companies starting to think about harms and adversarially about the algorithms powering their services, even if it is for a modest prize initially.
In brief
Attacks, incidents & breaches
- COVID-19 vaccine rollout in the Italian region of Lazio may be delayed following attack allegedly carried out by RansomEXX group zdnet.com
- Silicon Valley venture capital firm Advanced Technology Venture was hit by a ransomware attack in July and theft of personal information on the firms ‘limited partners’ (LPs) or private investors techcrunch.com
- Click Studios, developer of Passwordstate that was compromised in April, finally updates software following silence and asking customers to sign non-disclosure agreements techcrunch.com
- Database dump of EU ‘Cybersecurity Atlas’ (public directory of cyber security companies) being sold online. The data is largely publicly accessible, but questions remain over how the database itself came to be dumped therecord.media
- Computer hardware manufacturer Gigabyte hit by RansomEXX attack, causing the shutdown of websites and systems in Taiwan bleepingcomputer.com
Threat intel
- Telcos are attractive targets for espionage because of the data they hold on who has been communicating with who, and where they are located, so it shouldn’t come as a surprise that Cybereason has found evidence of advanced persistent threat (APT) actors inside South-Eastern Asian telco networks. All three groups are believed to be linked to the Chinese government and, in some cases, all three groups were operating on the same endpoints at the same time theregister.com
- LockBit ransomware advertising to insiders on new screens: “Would you like to earn millions of dollars?” bleepingcomputer.com
- Brian Krebs has a good write-up of ransomware gangs and how their names have changed over time krebsonsecurity.com
- Prometheus is a ‘traffic direction system’ (TDS) malware-as-a-service used to redirect users, push scams and other malware bleepingcomputer.com
- Researchers from Singapore’s Government Technology Agency found AI-written phishing emails outperform human-written ones wired.com
Vulnerabilities
- Vulnerabilities in pneumatic tube system used in 80% of US hospitals therecord.media
- Cobalt Strike vulnerabilities can crash command and control servers, according to Sentinel One bleepingcomputer.com
- Unauthenticated remote code execution vulnerabilities found in Cisco small business VPN routers, though requires remote management web portal to be enabled (it’s off by default) bleepingcomputer.com
- Registering DNS server names on DNS-as-a-Service providers, like AWS’ Route 53, led to ‘nation-state level’ espionage capability due to misconfiguration of Windows endpoints wiz.io
- Until earlier this year you could subvert Apple’s AWDL (Apple Wireless Direct Link) to bounce network traffic out of air-gapped systems therecord.media
Security team
- A developer created an NPM package called ‘-‘ to see if he could, and now it has over 700,000 downloads, because of command-line typos (probably) bleepingcomputer.com
- Securing large organisations is hard, even if you’re a government department - Departments of State, Transport and Education and the Social Security Administration all score ‘D’ grades in the latest audit: “Inspectors general identified many of the same issues that have plagued Federal agencies for more than a decade… seven Federal agencies still have not met the basic cybersecurity standards necessary to protect America’s sensitive data.” arstechnica.com
- US National Security Agency (NSA) and Cybersecurity and Infrastructure Agency (CISA) release hardening guidance for Kubernetes nsa.gov
- Google Identity Services now include ‘One Tap’ alongside ‘Sign in with Google’ using tokens and sharing basic profile information zdnet.com
- Three judges have ordered IR reports be handed over as part of discovery in breach lawsuits in the past year, rejecting arguments that the reports are work products or protected by attorney-client privilege cyberscoop.com
- Microsoft exploring alternatives to ‘just in time’ JavaScript compilation in Edge browser for “super duper security mode” theregister.com
Internet of Things
- Some electric vehicle (EV) charging points use Raspberry Pis to power their functionality, and many have vulnerabilities that could be used to hijack accounts and impede charging, according to research from Pen Test Partners techcrunch.com
- A TCP/IP stack developed by HCC Embedded for use in industrial applications called NicheStack contains vulnerabilities dubbed ‘INFRA:HALT’ that range from DNS cache poisoning, through denial of service to full remote code execution therecord.media
Public policy
- National Cyber Director, Chris Inglis, has endorsed plans to create a ‘bureau of cyber statistics’ to help understand cyber threats and their consequences. The proposals were originally made by the Cyberspace Solarium Commission (see vol. 3, iss. 11). cyberscoop.com
- Another Commission proposal was the establishment of a public-private initiative to help respond to large-scale cyberattacks, this week CISA Director Jen Easterly unveiled plans for the ‘Joint Cyber Defence Collaborative’ (JCDC) at Black Hat. Sharing insights, defence plans and joint exercises are amongst the key aims therecord.media
- Russia has proposed the ‘United Nations Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes’ calling for member states to develop legislation and capabilities to address 23 different types of cybercrime theregister.com
- The White House decided not to ban ransomware payments for fear of driving the behaviour underground cyberscoop.com
Mergers, acquisitions and investments
- Dragos competitor Nozomi Networks lands $100M Series D funding to scale product development, sales and marketing of its industrial cyber security offering while eyeing a future IPO techcrunch.com
- Sophos acquires DevSecOps outfit Refactr, found in 2017, for an undisclosed sum techcrunch.com
And finally
Conti ransomware gang training material leaked
A disgruntled affiliate of the Conti ransomware gang has published information about their ransomware operation, including command and control IP addresses, and training material. The files are shared with affiliates to help them compromise organisations and perpetrate attacks. Its release should help improve detection rules to defend against attacks from the group, though also highlights the maturity of their operation. Regardless, it’s such a shame, and perhaps they need a better ‘insider threat’ programme? ;-)