Danie van der Merwe

The new USB Rubber Ducky is more dangerous than ever - The beloved hacker tool can now pwn you with its own programming language

Wed, 17 Aug 2022 05:50:20 -0300

Danie van der Merwe

gadgeteer@hub.netzgemeinde.eu

To the human eye, the USB Rubber Ducky looks like an unremarkable USB flash drive. Plug it into a computer, though, and the machine sees it as a USB keyboard — which means it accepts keystroke commands from the device just as if a person was typing them in.

The original Rubber Ducky was released over 10 years ago and became a fan favorite among hackers (it was even featured in a Mr. Robot scene).

“Everything it types is trusted to the same degree as the user is trusted,” Kitchen told me, “so it takes advantage of the trust model built in, where computers have been taught to trust a human. And a computer knows that a human typically communicates with it through clicking and typing.”

While previous versions were mostly limited to writing keystroke sequences, DuckyScript 3.0 is a feature-rich language, letting users write functions, store variables, and use logic flow controls (i.e., if this... then that).

See The new USB Rubber Ducky is more dangerous than ever

#technology #hacking #rubberducky #security

Less quacking, more hacking.

technology security rubberducky hacking

A Defensive Computing Checklist by Michael Horowitz

Wed, 20 Jul 2022 10:02:09 -0300

Danie van der Merwe

gadgeteer@hub.netzgemeinde.eu

This is a very interesting site for those wanting tips about how to protect yourself online, when using e-mail, a phone, your car, crypto, doorbells, Facebook, WhatsApp, Twitter, public Wi-Fi, VPN's, etc. Yes, it is a very long list, but it is grouped into categories. It is well worth, though, skimming through and bookmarking for later reference. Just some basic behaviour changes go a long way to protecting you.

Some typical gems are:
* Any time you are asked to pay for something with a gift card, it is a scam.
* Non technical people are often tricked into installing malicious software. As Brian Krebs says "If you didn't go looking for it, don't install it!"
* Do not logon to a website using your Google or Facebook identity. Your privacy is increased by creating a new account just for that one site.

See Defensive Computing Checklist

#technology #security #privacy #vulnerabilities

Defensive Computing Checklist

technology security privacy vulnerabilities

Critical flaws in $20 Micodus MV720 GPS tracker enable “disastrous” and “life-threatening” hacks

Wed, 20 Jul 2022 07:18:20 -0300

Danie van der Merwe

gadgeteer@hub.netzgemeinde.eu

A security firm and the US government are advising the public to immediately stop using a popular GPS tracking device or to at least minimize exposure to it, citing a host of vulnerabilities that make it possible for hackers to remotely disable cars while they’re moving, track location histories, disarm alarms, and cut off fuel.

An assessment from security firm BitSight found six vulnerabilities in the Micodus MV720, a GPS tracker that sells for about $20 and is widely available. The researchers who performed the assessment believe the same critical vulnerabilities are present in other Micodus tracker models. The China-based manufacturer says 1.5 million of its tracking devices are deployed across 420,000 customers. BitSight found the device in use in 169 countries, with customers including governments, militaries, law enforcement agencies, and aerospace, shipping, and manufacturing companies.

Ouch, and the point often being that really cheap devices often have not had all the R&D done on securing them. For basic location this may not be serious, but where it is controlling access, alarm systems, shipping, and such like, it does start getting quite serious.

See Critical flaws in GPS tracker enable “disastrous” and “life-threatening” hacks

#technology #security #vulnerabilities #GPS #tracking

China-based Micodus has yet to patch critical vulnerabilities in MV720 GPS tracker.

technology vulnerability security GPS tracking

Apple’s new Lockdown Mode defends against government spyware - Yes it seems to have come to this stage now

Fri, 08 Jul 2022 10:18:28 -0300

Danie van der Merwe

gadgeteer@hub.netzgemeinde.eu

Apple announced that a new security feature known as Lockdown Mode will roll out with iOS 16, iPadOS 16, and macOS Ventura to protect high-risk individuals like human rights defenders, journalists, and dissidents against targeted spyware attacks.

Once enabled, the Lockdown Mode will provide Apple customers with messaging, web browsing, and connectivity protections designed to block mercenary spyware (like NSO Group's Pegasus) used by government-backed hackers to monitor their Apple devices after infecting them with malware.

So this moves more towards better security, at the cost of features and convenience, as security and convenience mutually exclude each other.

See Apple’s new Lockdown Mode defends against government spyware

#technology #apple #security #spyware

Apple announced that a new security feature known as Lockdown Mode will roll out with iOS 16, iPadOS 16, and macOS Ventura to protect high-risk individuals like human rights defenders, journalists, and dissidents against targeted spyware attacks.

technology security spyware apple

Android Police's 16 best Password Managers in 2022 - LastPass has really Fallen down the rankings

Wed, 06 Jul 2022 09:08:53 -0300

Danie van der Merwe

gadgeteer@hub.netzgemeinde.eu

Although the list focuses primarily on Android, any worthwhile password manager has to be fully cross-platform. There is no excuse today for using the same password more than once across sites, nor for choosing strong unique passwords for each.

Interesting to see an option too for 'travel mode' that removes sensitive data from your device when you cross borders. Many now also offer 2FA along with the password, making 2FA more seamless.

It's worth remembering too that it is incredibly easy usually to migrate from one password manager to another, by simply exporting and importing your password list.

See The 16 best password managers in 2022

#technology #security #passwords #passwordmanagers

Protection where you need it most

technology passwords passwordmanagers security

1Password will help you remember which ‘sign in with’ service you used and which account goes with it

Thu, 30 Jun 2022 09:13:41 -0300

Danie van der Merwe

gadgeteer@hub.netzgemeinde.eu

1Password is trying to solve the situation where you go to log on to a website and wonder something like “did I sign in with Google, Apple, or an actual email and password combo” or “which of my five Google accounts did I use for this?”

Quite useful as it's not always an e-mail login that you did for a specific site. With new passwordless logins this could become more crucial. Good to see password managers innovating around this.

Bitwarden, for example, also handles 2FA inside their app so there is no need to juggle a second app to type in the 2FA code as well.

See 1Password will help you remember which "sign in with" service you used

#technology #security #passwords #1Password

Sign in with Google with 1Password.

technology security passwords 1password

A wide range of routers are under attack by new, unusually sophisticated malware called ZuoRAT

Wed, 29 Jun 2022 13:19:58 -0300

Danie van der Merwe

gadgeteer@hub.netzgemeinde.eu

An unusually advanced hacking group has spent almost two years infecting a wide range of routers in North America and Europe with malware that takes full control of connected devices running Windows, macOS, and Linux, researchers reported on Tuesday.

So far, researchers from Lumen Technologies' Black Lotus Labs say they've identified at least 80 targets infected by the stealthy malware, infecting routers made by Cisco, Netgear, Asus, and DayTek. Dubbed ZuoRAT, the remote access Trojan is part of a broader hacking campaign that has existed since at least the fourth quarter of 2020 and continues to operate.

Its ability to enumerate all devices connected to an infected router and collect the DNS lookups and network traffic they send and receive and remain undetected is the hallmark of a highly sophisticated threat actor.

Like most router malware, ZuoRAT can't survive a reboot. Simply restarting an infected device will remove the initial ZuoRAT exploit, consisting of files stored in a temporary directory. To fully recover, however, infected devices should be factory reset. Unfortunately, in the event connected devices have been infected with the other malware, they can't be disinfected so easily.

See A wide range of routers are under attack by new, unusually sophisticated malware

#technology #vulnerability #security #routers

Router-stalking ZuoRAT is likely the work of a sophisticated nation-state, researchers say.

technology security router vulnerabity

Why you should use Two-Factor Authentication (2FA) - Good security is easier to have than you might think

Tue, 21 Jun 2022 13:06:28 -0300

Danie van der Merwe

gadgeteer@hub.netzgemeinde.eu

Much like the name implies, two-factor authentication adds a second way to verify you’re actually you while logging in. This can look a little different depending on what version you go with, but it will always rely on something that only you should have access to. A two-factor login could involve something like a cryptographically generated key, a one-time password sent to your phone, or a physical piece of hardware you plug in, just to name a few examples.

One of the best ways to defend against account breaches is to have 2FA turned on for as many sites and applications as possible. Even if someone has your password, they can't log in without your two-factor code. Many sites even have several 2FA options available, so that begs the question – Which kind of 2FA is the best, and more importantly, which ones should you avoid whenever possible?

The linked article gives some practical examples as well as some sound advice on this topic. It's true on the one end of the scale that hardware 2FA keys are not always usable, but on the other end having just plain e-mail without any 2FA is also not very safe. More and more, though, we are seeing password managers, like Bitwarden, which have 2FA also built right in, and which are securely synced across your devices. 2FA apps like Authy also sync the codes across devices, so if you lose your phone, you are not high and dry without your 2FA codes.

See Why you should use 2FA

#technology #security #2FA

Good security is easier to have than you might think

technology security 2FA

Ad-Blocking showdown looming over Manifest V3 extension standard, and Firefox and Safari may score on Privacy

Fri, 10 Jun 2022 14:54:26 -0300

Danie van der Merwe

gadgeteer@hub.netzgemeinde.eu

There’s a growing split over how much room browsers should leave for ad blocking — and Chrome and Firefox have ended up on opposite sides of the fight.

The rupture centers on a feature called Web Request, commonly used in ad blockers and crucial for any system that looks to block off a domain wholesale. Google has long had security concerns about Web Request and has worked to cut it out of the most recent extension standard, called Manifest V3, or MV3 for short. But, in a recent blog post, Mozilla made clear that Firefox will maintain support for Web Request, keeping the door open for the most sophisticated forms of ad blocking.

In essence the move by Google will increase security as it closes out the ability for any 3rd party extension to use an API feature called Web Request. This is the feature that most ad-blocker extensions use to filter the traffic, by observing traffic between the browser and a website and to modify or block requests to certain domains.

The Web Request feature is powerful and flexible, and it can be used for both good and bad purposes.

For compatibility reasons, Mozilla will still use most of the Manifest V3 spec in Firefox so that extensions can be ported over from Chrome with minimal changes. But, crucially, Firefox will continue to support blocking through Web Request after Google phases it out, enabling the most sophisticated anti-tracking ad blockers to function as normal.

Once Manifest V2 support ends in June 2023, changes in functionality will become more apparent to users of any Chromium-based browser.

See Firefox and Chrome are squaring off over ad-blocker extensions

#technology #security #privacy #browsers #adblockers

A browser privacy showdown has been brewing for a while.

technology adblockers privacy security browsers