A Review of the Best News of the Week on AI, IoT, & Mobile Security
China Is Forcing Tourists to Install Text-Stealing Malware at its Border (VICE, Jul 02 2019)
The malware downloads a tourist’s text messages, calendar entries, and phone logs, as well as scans the device for over 70,000 different files.
Tracing the Supply Chain Attack on Android — Krebs on Security (Krebs on Security, Jul 01 2019)
“Earlier this month, Google disclosed that a supply chain attack by one of its vendors resulted in malicious software being pre-installed on millions of new budget Android devices. Google didn’t exactly name those responsible, but said it believes the offending vendor uses the nicknames “Yehuo” or “Blazefire.” What follows is a deep dive into the identity of that Chinese vendor, which appears to have a long and storied history of pushing the envelope on mobile malware.”
Creator of DeepNude, App That Undresses Photos of Women, Takes It Offline (VICE, Jun 27 2019)
An app that algorithmically “undressed” images of women was taken down by its creator, citing server overload and potential harms.
One of My Favorite Things
Since I started this curated newsletter in June 2017, I’ve clipped ~10,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share today’s post on Twitter Facebook LinkedIn
Signs from above: Drone with projector successfully trolls car AI (Ars Technica, Jun 28 2019)
Advanced Driver Assist System (ADAS) installed on a Renault Captur, and the exploit relies on a drone with a projector faking street signs.
Rolling the Dice on AI (SC Magazine, Jun 26 2019)
Software is the only meaningful way to review all of that data about all logged-in users and determine a potential problem before the user has had the chance to do much damage, proponents agree.
Watching a Deepfake Being Made Is Boring, And You Must See It (VICE, Jun 26 2019)
AI-generated fake videos are hyped as a modern tech nightmare, and it’s important to understand their everyday banality.
Medtronic recalls vulnerable MiniMed insulin pumps (Help Net Security, Jun 28 2019)
Medtronic, the world’s largest medical device company, has issued a recall of some of its insulin pumps because they can be tampered with by attackers.
New Linux Worm Attacks IoT Devices (Dark Reading, Jun 26 2019)
Silex has ‘bricked’ more than 2,000 Linux-based IoT devices so far.
Tesla 3 navigation system fooled with GPS spoofing (Naked Security – Sophos, Jun 27 2019)
Cybersecurity researchers have fooled the Tesla Model 3’s automatic navigation system into rapidly braking and taking a wrong turn on the highway.
NIST Issues IoT Risk Guidelines (Dark Reading, Jun 27 2019)
A new report offers the first step toward understanding and managing IoT cybersecurity risks.
Five Million IP Camera Cyber-Attacks Blocked in Just Five Months (Infosecurity Magazine, Jun 28 2019)
IP surveillance devices facing high numbers of cyber-attacks
“Silexbot” Malware Bricks IoT Devices (SecurityWeek, Jun 28 2019)
A new piece of malware is targeting improperly secured Internet of Things (IoT) devices with the purpose of bricking them, Akamai’s security researchers have discovered.
FCC lets Verizon lock cell phones to network for 60 days after activation (Ars Technica, Jun 26 2019)
Verizon, seeking to deter theft, gets FCC waiver to lock phones for 60 days.
FTC crackdown targets operators behind 1 billion robocalls (Naked Security – Sophos, Jun 27 2019)
It’s a drop in the “4.7 billion robocalls placed per month” bucket, but hey, it’s better than nothing!
Black Market T-Mobile Location Data Tied to Spot of a Triple Murder (VICE, Jun 26 2019)
In 2017, two bounty hunters and a fugitive died in a chaotic shoot-out. Shortly after their deaths, someone started tracking one of the bounty hunter’s phones.
Many Potential Backdoors Found in Huawei Equipment: Study (SecurityWeek, Jun 27 2019)
A report published this week by US-based firmware and IoT security solutions provider Finite State shows that Huawei equipment is affected by many vulnerabilities, including potential backdoors, and the company’s devices are less secure compared to the products of other vendors.
Vulnerability in Cirque Du Soleil Show App (Infosecurity Magazine, Jul 01 2019)
Because the app had no authentication protocol, Štefanko said that an adversary could scan the network and get the IP addresses of devices with the defined port 6161 opened. An attacker could then send commands to all devices running the app, explained Štefanko, a vulnerability which he said could have been avoided quite easily.
Trump Move to Ease Huawei Sanctions Sparks Anger, Confusion (SecurityWeek, Jul 02 2019)
The US trade war truce with China which could ease sanctions on Huawei has prompted a backlash from lawmakers over national security concerns amid confusion over how the deal may impact the Chinese tech giant.