Infosec Reading List - April 2019

On a monthly basis I will publish my reading recommendations which mainly focus on Information Security (InfoSec) and Outdoor Sports. All InfoSec Reading Lists can be found here. Text in italic represent quotes from the original article.

Quotes from the Twitterverse

---

---

---

---

InfoSec

• Firefox, Edge, Safari, Tesla & VMware pwned at Pwn2Own - JIT bugs all over the place - [link]
• Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years - while this is seems to be a disaster at first sight, I think that this problem is widely spread since a huge amount of companies do not follow up in regards to what their apps are storing where and what - storing log data in the age of SIEMs is relatively easy. A proper solution to this would be to never send the plaintext password to the server - I covered an article related to that topic in my Reading List October 2018 here. “Before we send the username and password over the wire we perform a single SHA3-512 round on the plain-text password plus a unique name for our service” - so the theory is out there - [link]
• Trapdoor commitments in the SwissPost e-voting shuffle proof - I think we should seriously question whether society is ready for this e-voting move - we can hardly secure our critical infrastructure, IoT and all the legacy IT stuff that flies around - do we really want to digitize the core bones of our democracy? I’m sure we will get there - but I doubt that right now is the right time - [link]
• Malicious Counter-Strike 1.6 servers used zero-days to infect users with malware - [link]
• Some notes on the Raspberry Pi - [link]
• Buffer overflow flaw in British Airways in-flight entertainment systems will affect other airlines, but why try it in the air? - [link]
• DJI Drone Vulnerability - XSS in the forum - [link]
• Perfect is the Enemy - true words - [link]
• Emotet droppers - “All in all, it shows how much effort is put in to deliver an executable on the target, which then servers as yet another downloader for another stage within the infection process.” - [link]
• Hundreds of motel guests were secretly filmed and live-streamed online - where is a market, there is a service offer - [link]
• Family finds hidden camera livestreaming from their Airbnb in Ireland - not only hotels are affected, but also Airbnb - [link]
• How Instagram’s drug deals go undetected - “Smartphone data is packed with specific information that touches cell towers and can be triangulated. Indeed, plenty of less-careful sellers have geotagged themselves into handcuffs. Virtual private networks (VPNs) for iOS and Android devices offer relative anonymity, but Google Location Services, for example, transmits the SSIDs of in-range wireless networks. If you’re using cell-based Internet, even with a VPN, the device can transmit cell tower identifiers. Using a phone is risky, so the pros don’t.” - selling drugs in 2019 - avoid smartphones - [link]
• Why The Citrix Breach Matters – And What To Do Next - [link]
• How Lockergoga took down Hydro — ransomware used in targeted attacks aimed at big business - while this looks like a fail on Hydro’s side, this is a clear demonstration that most of the promises that the AV industry gives its customers, is snakeoil bulls**t and that we, as the industry, still have to work on getting better in protecting the endpoints - *“As you can see above the detection rate was 0 out of 67 anti-virus engines. Now, before vendors get annoyed, I am well aware that VirusTotal results don’t tell the full story  however having zero detection from any engine is an extremely bad sign.” - [link]
• Remote command injection through an endpoint security product - to underline my statement about the AV industry above, check out this article - [link]
• Locating The Netherlands’ Most Wanted Criminal By Scrutinising Instagram - TLDR: bad OPSEC, you shouldn’t use social media in case you are a fugitive - besides that, very nice OSINT work - [link]
• Connected camera cock up - TLDR: “Next step is to enter a device UID and static password of ‘ok12345678’.” - [link]
• Purism Becomes PIA’s First OEM Partner - “Purism plans to include PIA-based VPN by default in the Librem 5 phone, as well as within PureOS for its Librem 13 and Librem 15 laptops. Purism will also collaborate with PIA on a future services bundle.” - this is bad. I really hope that this PIA integration can be easily disabled - routing all traffic via one provider by default is not the right approach, even if it promises to respect users privacy - various others did as well and it turned out later that they lied - Purism, you don’t want to take this risk - [link]
• Wipro Intruders Targeted Other Major IT Firms - Supply Chain Attacks, getting more and more common - [link]
• Cloud attacks leverage credential dumps, phishing, and legacy email protocols to bypass MFA and breach cloud accounts worldwide - IMAP does not understand 2-factor-authentication by default - this is what bad guys abuse and exploit with the support of credential dumps - what helps here, besides using stronger protocols that support 2FA and raising awareness, is logging failed logins and block brute-forcing IPs accordingly - [link]
• How Do I Prepare to Join a Red Team? - [link]

Outdoor

• Now, This is Kiting! - check out the video in the link - a nice way of doing multi-sport adventures - [link]
• A Guide to Using Sauna to Increase Your Health and Longevity - [link]
• Lonely Traverse of the Jungle (D.R. Congo) - Packrafting the Congo River - [link]
• Inflated Ambitions - Pack Rafting the Oxus River in Afghanistan, amazing trip love the pictures - [link]
• Quitting Isn’t Always Failing - “We don’t lose credibility for making mistakes, we only lose credibility when we fail to admit that we made that mistake.” - [link]
• Camino Del Puma: Peru and Bolivia - I need to go back there, this place is too amazing to just go there once - [link]
• Solo travel is one of life’s greatest joys—but what if you get so sick you can’t think? - [link]
• Do Not Disturb: How I Ditched My Phone and Unbroke My Brain - [link]
• Interview: Chaz Powell on Trekking the Gambia - [link]
• Freedom - bikerafting the Pamirs - [link]