Tag: app-subdomain-redirection:avast

In a recent investigation, a team from Blackwing Intelligence uncovered significant vulnerabilities in the fingerprint sensors of popular laptop models including the Dell Inspiron, Lenovo ThinkPad, and Microsoft Surface Pro X. This discovery was part of a project initiated by Microsoft’s Offensive Research and Security Engineering (MORSE), focusing on the integrity of widely used embedded fingerprint sensors in Windows Hello authentication systems.

The research effort, led by Blackwing’s Jesse D’Aguanno and Timo Teräs, concentrated on the embedded fingerprint sensors produced by ELAN, Synaptics, and Goodix. These sensors, integral to the security mechanisms of the Microsoft Surface Pro X, Lenovo ThinkPad T14, and Dell Inspiron 15, were found to have exploitable flaws, raising questions about the robustness of biometric security in these devices.

How researchers compromised these devices?

The fingerprint sensors in question, all being Match-on-Chip (MoC) varieties, are designed with their own microprocessor and storage. This design enables secure, internal fingerprint matching within the chip itself. However, a significant limitation emerged in this setup.

While MoC sensors effectively prevent the misuse of stored fingerprint data for authentication, they are not inherently designed to block a compromised sensor from imitating the communication patterns of a legitimate sensor. This flaw could result in false signals of successful user authentication or the replay of past interactions between the sensor and the host system.

In response to these potential vulnerabilities, Microsoft introduced the Secure Device Connection Protocol (SDCP). This protocol aimed to confirm the integrity and trustworthiness of the fingerprint device, as well as safeguard the data exchange between the fingerprint sensor and the host on these specific laptops.

Despite these measures, the researchers from Blackwing Intelligence managed to navigate around the Windows Hello authentication system on all three laptop models. They employed man-in-the-middle (MiTM) attacks, utilizing a custom setup involving a Raspberry Pi 4 running Linux. Their approach involved a mix of software and hardware reverse engineering, cracking cryptographic weaknesses in the Synaptics sensor’s custom TLS protocol, and deciphering and replicating proprietary communication protocols.

In the case of the Dell and Lenovo laptops, the security breach was accomplished through a method of identifying valid user IDs and substituting the attacker’s fingerprint for that of a legitimate Windows user. This was possible because the Synaptics sensor in these devices relied on a unique TLS stack for securing USB communication, rather than using Microsoft’s Secure Device Connection Protocol (SDCP).

For the Microsoft Surface device, which was equipped with an ELAN fingerprint sensor lacking SDCP safeguards, the situation was different. This sensor communicated in cleartext over USB and lacked authentication protocols. The researchers managed to imitate the fingerprint sensor by disconnecting the Surface’s Type Cover, which housed the sensor, and then sending valid login confirmations from this spoofed device.

The researchers pointed out a critical oversight in the implementation of security protocols by device manufacturers. “Microsoft did a good job designing SDCP to provide a secure channel between the host and biometric devices, but unfortunately device manufacturers seem to misunderstand some of the objectives,” they stated. They also highlighted a significant limitation of SDCP, noting, “Additionally, SDCP only covers a very narrow scope of a typical device’s operation, while most devices have a sizable attack surface exposed that is not covered by SDCP at all.” This statement underscores the gap between the design and implementation of security measures in these devices.

The investigation by Blackwing Intelligence revealed a critical oversight: the Secure Device Connection Protocol (SDCP), a key security feature, was not activated on two of the three laptops they examined. This finding led to a significant recommendation from the Blackwing team. They urged vendors of biometric authentication technologies to not only incorporate SDCP but also ensure it is actively enabled. The effectiveness of SDCP in deterring cyber attacks is nullified if it remains unused.

Reflecting on the broader context of biometric security, Microsoft had previously shared some enlightening statistics. Three years ago, the tech giant reported a notable shift in user behavior on Windows 10 devices. The proportion of users opting for Windows Hello biometric login over traditional passwords had surged to 84.7 percent, up from 69.4 percent in 2019. This marked increase underscores the growing reliance on biometric solutions for securing devices, making the findings of Blackwing Intelligence especially pertinent for both users and manufacturers.

The notorious ALPHV/BlackCat ransomware syndicate has taken an unprecedented step by lodging a formal complaint with the U.S. Securities and Exchange Commission, targeting MeridianLink. This notable software provider, integral to financial institutions like banks and credit unions, now faces allegations of not reporting a cyberattack within the required four-day window.

The plot thickens as MeridianLink’s dilemma is publicly exposed on the ransomware group‘s data leak website. ALPHV has set a tight deadline, demanding a ransom from MeridianLink within just 24 hours to avert the release of what they claim to be stolen data. This turn of events in the MeridianLink breach narrative represents a significant ramp-up in ransomware tactics, underscoring an increasing trend of cybercriminals boldly challenging large, publicly traded enterprises.

New details emerged about the MeridianLink breach

Peering further into the complexities of the MeridianLink breach, new details emerge, painting a picture of an unconventional cyberattack. According to DataBreaches.net, ALPHV, also operating under the alias BlackCat, asserts they penetrated MeridianLink’s network back on November 7. Veering off the usual ransomware path, they claim to have extracted sensitive data instead of the standard practice of encrypting company systems.

Adding an unexpected twist, ALPHV revealed that though there seemed to be initial outreach from MeridianLink, this did not evolve into meaningful negotiations over the alleged stolen data. This lack of communication might have triggered the hackers to shift gears, adopting a more confrontational approach. Their next move was to file a complaint with the U.S. Securities and Exchange Commission (SEC), accusing MeridianLink of not disclosing a cybersecurity incident that affected crucial customer and operational data.

To bolster their allegations, ALPHV posted a screenshot on their site, showing a completed form on the SEC’s Tips, Complaints, and Referrals portal. They communicated to the SEC, describing the situation as a “significant breach” and alleging that MeridianLink failed to meet the disclosure obligations as required in Form 8-K, under Item 1.05.

This scenario fits into a larger pattern of rising cybersecurity threats, like the MeridianLink breach, across the U.S. Reacting to this uptick in incidents, the SEC has rolled out new rules, compelling publicly traded companies to swiftly report cyberattacks that have a material impact. The MeridianLink case not only showcases the evolving strategies of ransomware groups but also emphasizes the growing need for prompt and clear disclosure in such incidents.

Yet, the MeridianLink breach scenario is further complicated by a crucial timing element. In a report from early October, Reuters pointed out that the new SEC cybersecurity rules are scheduled to come into effect on December 15, 2023. This timing adds an intriguing twist to the already complex MeridianLink case.

Adding to the unfolding drama, ALPHV has taken the step of displaying the SEC’s confirmation of their complaint against MeridianLink on their website. This action is a deliberate move by the ransomware group to validate their SEC submission and to show that their tactics have real-world impacts, extending into the realm of regulatory compliance. This development in the MeridianLink breach not only intensifies the situation but also highlights the bold strategies cybercriminals are employing.

Moving forward in the MeridianLink breach narrative, the company has now confirmed the cyberattack. Speaking with BleepingComputer, MeridianLink outlined its immediate measures to mitigate the threat, emphasizing the rapid deployment of containment strategies and the engagement of external cybersecurity experts for an in-depth investigation.

MeridianLink is actively evaluating the extent to which consumer personal information may have been affected by this cyberattack. The company has committed to notifying any individuals whose personal data may have been compromised.

In a statement meant to provide assurance, MeridianLink stated, “Based on our investigation to date, we have identified no evidence of unauthorized access to our production platforms, and the incident has caused minimal business interruption.” This comment seeks to reassure stakeholders about the control and minimal impact of the situation.

This development represents a pivotal moment in the evolving tactics of ransomware and extortion. While threats to report breaches to the SEC have been made by cybercriminal groups in the past, the MeridianLink incident could be the first where such a report is publicly confirmed. Traditionally, ransomware groups have exerted pressure through tactics like informing customers of the breach or directly intimidating the victim. ALPHV’s decision to file a complaint with the SEC marks a significant shift towards more formal and assertive strategies in the realm of cyber extortion.

Images used in this post are courtesy of BleepingComputer.

Ransomware attacks have been on the rise in recent years as large institutions such as city councils and hospitals have been targeted by scammers seeking ransom for the release of critical institutional information and data. Unfortunately, another ransomware attack has just hit every school in Los Angeles. Here is everything you need to know about the attack as well as some broader information about Ransomware attacks in general.

The Los Angeles Unified School District (LAUSD), which is one of the largest school districts in the US, encompassing over 600,000 students and 26,000 teachers has reported that it has been hit by a ransomware attack. The attack coincides with the beginning of the new school year.

According to the LAUSD press release announcing the news of the attack:

“Los Angeles Unified detected unusual activity in its Information Technology systems over the weekend, which after initial review, can be confirmed as an external cyber attack on our Information Technology assets. Since the identification of the incident, which is likely criminal in nature, we continue to assess the situation with law enforcement agencies.”

The press release goes on to say that the school district has an emergency plan of action for securing the continuity of learning for students across the areas and that certain sensitive aspects of the school district’s data infrastructure such as employee healthcare and payroll details have not been impacted.

Unfortunately, according to cybersecurity specialists at Avast who have recently published an in-depth report into ransomware attacks, these types of targeted and higher-value ransomware demands form a part of almost limitless demand for targeted ransomware coupled with “more effective ways to deliver their payloads, encrypt data, receive payments, and pressure victims.”

The report makes it clear that the blame for these types of attack does not fall solely onto those managing the school districts but also falls on policymakers too. The report states that:

“It is imperative that policymakers measure success against targeted ransomware in terms of the overall volume of ransomware payments, not just the absence of attacks on high-risk entities. It is time to start investing in a more secure future.”

On a personal level, however, Avast recommends taking three steps to protect yourself and your institution from a ransomware attack. Keep your systems updated, invest in and make use of reliable security software and ma regularly back up all your files. We have also put together a guide to help protect yourself against ransomware on your Android phone too.