Checklist 339: Common Sense Security Steps
New Vulnerability “Downfall” Threatens Intel-based Macs: A Spectre and Meltdown Offshoot
In a recent report, a new vulnerability named “Downfall” has emerged, posing a potential threat to Intel-based Macs. The variant, akin to Spectre and Meltdown, which were identified in early 2018, raises concerns for users of affected processors.
Spectre and Meltdown, discovered over five years ago, targeted Intel processors’ “speculative execution” mechanism, exploiting a vulnerability in the way processors executed tasks. These vulnerabilities allowed attackers to trick processors into storing sensitive data that should have been discarded. Apple swiftly patched these vulnerabilities upon discovery.
However, security researcher Daniel Moghimi has now unearthed the Downfall variant. This new vulnerability, classified as CVE-2022-40982, targets a critical weakness inherent in modern processors used in personal and cloud computers. Downfall enables malicious apps to steal sensitive data from users sharing the same computer or cloud server. Banking details, passwords, encryption keys, personal emails, and messages are among the at-risk information.
The vulnerability arises due to memory optimization features in Intel processors, inadvertently revealing internal hardware registers to software. This enables unauthorized access to data stored by other programs.
Notably, Downfall doesn’t affect Macs powered by Apple silicon (M1 or M2 chips), providing a layer of security for those devices. Intel-based Mac users might also be safe, though caution is advised. Computers from 2016 onward or late-2015 iMacs could be susceptible to the flaw. However, the vulnerability’s impact on custom motherboards, firmware, and Intel’s T2 processor remains uncertain.
While upgrading to an Apple silicon-powered Mac is an option, it may not fully address the issue since Intel’s server market share is substantial. Users are urged to adopt standard cybersecurity practices to minimize risk. These include downloading apps only from trusted sources, using unique passwords, avoiding revealing security questions, enabling two-factor authentication, exercising caution with email links, guarding against bank fraud, and preferably avoiding sensitive sites on public Wi-Fi networks or using a trusted VPN service.
As the Downfall vulnerability raises concerns, vigilance and adherence to cybersecurity best practices become pivotal in safeguarding personal and sensitive information from potential exploitation.
Def Con Stunt Highlights iPhone Bluetooth Vulnerability
Hackers and security experts flocked to Las Vegas for Def Con, where an Apple-related incident took center stage. Conference attendees were startled when iPhones began displaying pop-up messages urging them to connect their Apple ID or share a password with a nearby Apple TV.
Jae Bochs, the mastermind behind the prank, aimed to alarm and amuse users by highlighting a significant iPhone vulnerability. Bochs, a security researcher, wanted to emphasize that merely toggling off Bluetooth on an iPhone doesn’t actually turn it off completely. He used a proof-of-concept method involving Apple’s Bluetooth low energy protocol to create custom advertisement packets, simulating connections to nearby devices and triggering the deceptive pop-ups.
Although the hack carried potential risks, the severity was debated. Bochs suggested that through convincing interactions with the pop-ups, users might unknowingly share passwords. He also pointed out a known issue that could leak personal data, such as phone numbers and Wi-Fi network details, from the transmitted packets.
TechCrunch highlighted previous research from 2019, which uncovered flaws in Apple’s Bluetooth low energy protocol that could leak sensitive device and behavioral data to eavesdroppers. While Bochs didn’t anticipate Apple changing its stance on the Control Center toggle feature, the possibility of adding a warning message to inform users that toggling Bluetooth there doesn’t fully disable it was suggested.
In contrast, 9to5Mac stressed that being informed is key to avoiding such vulnerabilities. It argued that users concerned about Bluetooth security should exercise caution before entering passwords into random prompts.
ATM Card Skimming Tactics and New Glue-Based Scam Threaten Users’ Financial Security
Naked Security highlights the ongoing threat of ATM card skimming, emphasizing that despite the rise of digital payment methods, many people still use ATMs for cash transactions. Card skimming involves not only stealing digital card information but also PINs, which serve as a second factor of authentication. Criminals often use hidden cameras to capture PINs in real time, exploiting the secrecy of ATM rooms to their advantage.
Card skimming seeks to capture both card data and PINs. Criminals employ hidden cameras to record PINs as they are entered. These cameras are often strategically placed in ATM rooms, exploiting staff’s focus on the ATM itself rather than the surrounding area.
The access points to ATM rooms, often requiring card insertion or swiping, can also be compromised. Criminals hide cameras in inconspicuous places within these rooms. Instances have occurred where cameras were concealed in corporate brochure holders, with staff unknowingly assisting in camouflaging the devices.
Preventive Measures:
Naked Security offers several precautionary measures to thwart ATM skimming attempts:
- Thorough Inspection
Users are advised to carefully inspect the ATM and its surroundings, paying attention to any anomalies. - Keypad Covering
Even when seemingly alone, users are encouraged to fully cover the keypad when entering their PIN to thwart both shoulder surfers and hidden cameras. - Wiggle Test
Users are urged to give components of the ATM a slight wiggle to identify parts that may be out of place or suspicious. - Alert Authorities
If anything appears unusual, users should refrain from entering their PIN, discreetly retrieve their card, and contact local law enforcement or the respective bank using contact details from previous statements or the ATM’s screen.
An emerging scam involving adhesive-laden ATM card slots has been exposed. Criminals fill the slot with glue, prompting users to employ the card’s Tap feature for access. Although this is a legitimate convenience feature, users are unaware that this tactic grants the criminals prolonged access to their account without requiring a PIN.
To protect against this new scam, users are advised to wait for the ATM to display a menu prompt indicating the transaction is finished. This confirms that the account is no longer accessible and prevents unauthorized access.
SecureMac adds that sharing information about these scams with friends and family members is crucial to ensure their financial safety as well.
As ATM card skimming techniques continue to evolve, users must remain vigilant, adopting thorough inspection practices and staying informed about emerging threats to safeguard their financial assets.
