Category Archives: iOS

Soldiers Get Lonely Too

If you can’t beat them on the battlefield, beat them in cyberspace.  Israel has accused Hamas of creating a fake dating app and targeting both male and female Israeli soldiers to download the app.

Once installed, the app has the ability to see the soldier’s location, contact list and to use the phone as a listening device and camera.

The app targeted Android phone users, likely because that was easier to do.  This is apparently the second generation of a surveillance app and is more sophisticated than the earlier app.  The user granted the app the permissions to do all of these things, which sort of makes sense for a dating app.

In an effort at spin control, the Israeli Defense Force said that the apps had failed to do any security damage at all, saying that some soldiers had refused to download the app and reported it to superiors.  They did admit that some soldiers had downloaded and installed the app.

In another situation, researchers at Northeastern University ran a small experiment to try and detect if their phones were eavesdropping on them.

They took what amounts to a tiny sample of apps – 17,000 out of millions – to see if the phone’s microphone was activated.  Out of this small sample, they didn’t find any.

What they did find, however, may be more disturbing.

They discovered that many of these apps were sending screenshots of the phone to third party domains and also video recordings of the user’s interaction with the apps.  There is only a very tiny step from there to listening to you in general.

The fact that these apps were doing this was not obvious to a normal user.

Given this, what do you do?

First, and you are not going to like this, read the user license agreement.  While only some of the apps that secretly recorded screenshots and video disclosed the fact in their license agreement, some of them did disclose it.

Second, if you are no longer using an app, uninstall it.  If the app is not there, it is hard to eavesdrop.

Finally, be cautious about installing apps.  Some people never met an app that they couldn’t use.  Being selective is probably just smart.

This, apparently, is both an Android and iPhone problem as some of the frameworks that mobile apps are built on top of intentionally offer this screen and video capture.  At least one vendor, Appsee, said they their developers are violating their license agreement by capturing user data without permission.  Once they were outed by the media, they disabled the video capture for a single app and feel a lot better about themselves.  Google also says this violates the Play store agreement.  Gee, I am sure that any hacker would be scared about that.

Other software platforms may not even care.

Until Google and Apple give you the ability to absolutely, positively know if your data is being captured, you have something else to be concerned about.

 

Information for this post came from The Guardian and Gizmodo.

Facebooktwitterredditlinkedinmailby feather

DNS Hijacking Malware targets iPhones, Android and Desktops

While most of the general user base has never heard of DNS and of those that have, only a few of those understand how it works, that has not stopped the hackers from very effectively abusing it against everyone.

Very simply, DNS maps the www.xyz.com names that people use in their browsers into the IP addresses that computers use and if that process can be corrupted, well, then, we have trouble  in River City.

Well, it can be corrupted and it has been corrupted and we do have trouble.  In River City.  And elsewhere.

The malware called Roaming Mantis now works on iPhones, Android Phones and desktops, in addition to Internet routers.

The attacks fool users into installing infected software and from that point, they can pretty much do anything they want.

Information for this post came from Hacker News.

So what should you do to protect yourself?

First, protect your router:

Use a strong password and NOT the default one.

Turn off the feature that allows you to administer your router FROM THE INTERNET, usually called remote administration.

Even though it is super tempting sometimes, do not install apps on your phone or computer that do not come from known reputable sources.

When you go to a site that asks for your credentials, attempt to verify the site.  Look closely at the URL for typos, look for the secure indicator, if your anti-virus software tests web sites, look at those results.  Mostly, just slow down a bit and see if what you are being asked to do seems logical.

Beyond that, you are likely going to need expert help.

Facebooktwitterredditlinkedinmailby feather

Is the Apple Losing its Shine?

Last week there were multiple reports that Petah Tekvah, Israel based Cellebrite could unlock any iPhone up to and including the iPhone X running the most current version of the Apple OS, but you had to send the phone to them along with a check for $1,500, per phone.

This week there is a report that Grayshift, an American startup, is reporting that it too can unlock your iPhone for the cops.

Wait, I just got a phone call.  My grandmother says that she can unlock any iPhone and she will do it for free.  Just kidding about that one, but two different companies, one week apart are saying they can hack any iPhone.  This seems really strange.

Grayshift was apparently founded by some U.S. intelligence community contractors and a former Apple security engineer.

They are privately circulating a data sheet that says that if you buy their software you can unlock 300 phones for $15,000 or an unlimited number of phones for $30,000.  The cheap version (a relative term) must be used online (so, I assume, that you cannot cheat them);  the expensive version can be used offline since it doesn’t need to keep track of how many phones you have unlocked.

The software itself is called GrayKey.

Apparently, right now, GrayKey will only unlock phones running iOS 10 and 11 – which is likely the majority of iPhones, but a version that will unlock iOS 9 is coming soon.

One guess is that these firms have figured out how to hack into Apple’s Secure Enclave, the heart of the security of the iPhone.  *IF* that is true, that is a real problem.  Of course Apple could figure out what both of these firms are doing and make them start over.  In the case of GrayKey, since the system is delivered to a paying customer, if Apple engineers can, somehow, get access to the system they can probably figure out what the software exploits.

It is also speculated that the attack might be a brute force attack, meaning that it starts with “A” and goes to “B” and then “C” and so on until it unlocks the phone.  Again, *IF* this is true, the longer the password is, the harder it is to use this technique.  For example, if the password is 8 characters and only uses letters and numbers, then there are ONLY 218,340,105,584,896 or 218 trillion possible guesses.  On the other hand, a 12 character password raises that number to 3,226,266,762,397,899,821,056 or 3 sextillion possibilities.  Passwords longer than 12 characters would require even more guesses.

The moral of this story is that long passwords, even with just upper and lower case letters plus numbers and no special characters will take a long time to crack.  One article said that a 12 character password would take 200 years to crack at a billion guesses per second.  If it does take that long, even if they do succeed, you won’t care.  Using that same billion guesses a second, an 8 character password would only take 60 hours.

I think this story is not over;  stay tuned for updates.

Information for this post came from Forbes.

Facebooktwitterredditlinkedinmailby feather

The Feds (and Others) Can Probably Unlock Any iPhone Ever Made

Here’s something you don’t hear every day.

Cellebrite, a cell phone hacking vendor based in Petah Tikvah, Israel, claims that they can unlock any iPhone ever made, including the iPhone X running iOS 11.2.6 .

Cellebrite, who offers their services to the highest bidder – mostly law enforcement and governments, both ones that have a better track record with privacy and those that have a horrible privacy record such as Russia – has  made a business out of offering forensics services pretty much to anyone who’s check will clear.  That is probably being a bit unfair, but they were hacked themselves last year and from the data that was released, the statement above does not appear to be too far off.

In any case, typically the newer phones are harder to hack.  You may remember that the FBI paid someone over a million dollars to hack into the iPhone of the San Bernadino shooter after the FBI did not reach out to Apple in a timely manner and get directions on how to unlock it.  In the case of iPhones, usually waiting is your enemy because after a phone is locked for too long, extra security features kick in making it harder to unlock.

Apple adds new security features with every release, so it is especially embarrassing to Apple that their newest flagship phone – one that costs over a thousand dollars at retail – running its newest operating system can, apparently,  be popped open like a can of Coke or Pepsi.

This hacking process is typically a cat and mouse game – the hackers figure out how to break in and Apple fixes it after they find out and the process starts over.

In this case,  in order to maintain their revenue stream for as long as possible, Cellebrite has added a twist to the unlock process.

Normally the unlock features are added to their software which police departments and repressive governments license for an annual fee.  This time the agency has to send the phone to Cellebrite which will charge them a fee of around $1,500 per phone to unlock and they will return the phone unlocked.

Lets say that governments and others send them just 1,000 phones – the NY DA alone said that he had 400 phones that he would like unlocked, so that number is stupid low – then that would generate an extra million and a half dollars to their revenue for the year.

The other thing that it does is protect the bug that they found from being identified and fixed by Apple.  There are likely businesses who are friendly to Apple and who have licensed Cellebrite’s software.  If unlock feature was added to the software then Apple would connect a test phone with extra debug features to the Cellebrite software and likely figure out exactly what Cellebrite is exploiting so that they can plug the hole.

So this method – forcing the cops to write a check and send them the phone both provides a major revenue boost and preserves the bug for a longer time.

All that not withstanding, I am sure that Apple is scratching their collective heads trying to figure out what Cellebrite is doing.

And, just to be clear, this is not a theoretical issue.  Homeland Security has already written a check to get at least one iPhone X unlocked.

If you are a terrorist or someone who would prefer that the feds or other repressive governments can’t see what is on your phone, do not count on Apple to be able to provide that to you, at least for now.

Information for this post came from Forbes.

 

Facebooktwitterredditlinkedinmailby feather

Hackers Fool iPhone FaceID for $150

It usually doesn’t take very long.  Whether it is fooling the fingerprint reader or jailbreaking an iPhone, it often comes within hours of a new device or software release.  Maybe, in this case, it says that Apple did good because it took a week to break Face ID.

On the other hand, it only took about $150 to do it.

Wired spent thousands trying to create 3D masks and were unable to fool it,  but some hackers in Vietnam it on a budget.

In Apple’s defense, they did have to spend about 5 minutes videoing the subject to get good data, but if you are going after a politician or a celebrity, getting 5 minutes of HiDef video will not be a problem.

The first thing they did is take the video and make a 3D printed frame for the attack.

Next they added a silicon nose.

Finally, they 2D printed (like on a piece of paper) the user’s eyes and attached them to the mask,

In the demo, when they uncovered the mask, the iPhone X unlocked.

So much for security on your $1,000 phone.

Probably, for the average person, the level of security FaceID provides is adequate.

But remember, the iPhone X is a status symbol, not a phone.  Who is going to buy them are business executives on expense accounts and politicians using other people’s money.   Those are great targets for the bad guys and worth, for sure, spending $150 to compromise their phone.

In fairness to Apple, the researchers have not revealed enough details to enable people to recreate this.

In fairness to the researchers, they have presented previous hacks of Lenovo and Toshiba facial recognition at Black Hat.

So, depending on your level of concern regarding the security of your phone, a good old password is likely best.  Make it reasonably long and avoid the glitz.

For the billionaires who buy an iPhone X, you might want to reconsider your proclivity for convenience over security and steer clear of FaceID.

Your call.

Information for this post came from Wired.

Facebooktwitterredditlinkedinmailby feather

The Spy Among Us

Multiple sources are reporting a feature of iPhone apps that is a major privacy concern.  This is not new and it also is an issue on Android phones, but, for some reason, everyone seems to be highlighting the problem with iPhones.  PERHAPS, that is because it it is being exploited in the wild on iPhones – I don’t know.

The short version goes like this –

IF you EVER allow an app to access your phone’s cameras, you have lost control of it.  That app can access your camera – both front facing and rear facing – whenever it wants to.  It does not have to ask you to access the camera.

You are trusting that app not to abuse that trust.

Actually, it kind of depends on whether YOU installed the app or someone else installed it – with or without your knowledge.  For example, here are 5 spying apps that people intentionally install.  It may be a parent or a spouse, but it is likely not you who installed the app.  Sometimes parents want to track what their kids are doing.  Sometimes a spouse wants to spy on their significant other.

The app could upload the photos to the net and/or it could process the images – say to examine your facial images as you look at the screen.

One part of the problem is that there is no indication that the camera, front or back, is on.  As a side note, while there is a light on many PCs indicating the camera is running, that is a bit of software and the camera COULD be turned on without the light being on.

Apple (and Google) could change the camera rules and require the user to approve camera access every single time the camera wants to turn on – but that would be inconvenient.

One of my contacts at the FBI forwarded an alert about this today, so I suspect that this is being actively exploited.

The FBI gave a couple of suggestions –

  1. Only install apps from the official app store, not anyplace else.
  2. Don’t click on links in emails

In reality, the only recommendation that the FBI made that will actually work is this next one:

3. Place a piece of tape over the front and rear camera.

Ponder this thought –

The camera sits on your table in front of you;  it is in your bedroom, potentially capturing whatever you do there; it is in your bathroom. You get the idea.

Just in case your were not paranoid enough before.

Information for this post came from The Hacker News and The Register.

Facebooktwitterredditlinkedinmailby feather