jth's blurblog

Sandwich Helix
Saturday November 2^nd, 2024 at 1:54 PM

xkcd.com

The number one rule of string manipulation is that youâ€™ve got to specify your encodings.

Read the whole story

jth

18 days ago

reply

42

Saint Paul, MN, USA

New iPhone Exploit Uses Four Zero-Days by Bruce Schneier
Monday January 22^nd, 2024 at 9:55 AM

Schneier on Security

Kaspersky researchers are detailing “an attack that over four years backdoored dozens if not thousands of iPhones, many of which belonged to employees of Moscow-based security firm Kaspersky.” It’s a zero-click exploit that makes use of four iPhone zero-days.

The most intriguing new detail is the targeting of the heretofore-unknown hardware feature, which proved to be pivotal to the Operation Triangulation campaign. A zero-day in the feature allowed the attackers to bypass advanced hardware-based memory protections designed to safeguard device system integrity even after an attacker gained the ability to tamper with memory of the underlying kernel. On most other platforms, once attackers successfully exploit a kernel vulnerability they have full control of the compromised system.

On Apple devices equipped with these protections, such attackers are still unable to perform key post-exploitation techniques such as injecting malicious code into other processes, or modifying kernel code or sensitive kernel data. This powerful protection was bypassed by exploiting a vulnerability in the secret function. The protection, which has rarely been defeated in exploits found to date, is also present in Apple’s M1 and M2 CPUs.

The details are staggering:

Here is a quick rundown of this 0-click iMessage attack, which used four zero-days and was designed to work on iOS versions up to iOS 16.2.

Attackers send a malicious iMessage attachment, which the application processes without showing any signs to the user.
This attachment exploits the remote code execution vulnerability CVE-2023-41990 in the undocumented, Apple-only ADJUST TrueType font instruction. This instruction had existed since the early nineties before a patch removed it.
It uses return/jump oriented programming and multiple stages written in the NSExpression/NSPredicate query language, patching the JavaScriptCore library environment to execute a privilege escalation exploit written in JavaScript.
This JavaScript exploit is obfuscated to make it completely unreadable and to minimize its size. Still, it has around 11,000 lines of code, which are mainly dedicated to JavaScriptCore and kernel memory parsing and manipulation.
It exploits the JavaScriptCore debugging feature DollarVM ($vm) to gain the ability to manipulate JavaScriptCore’s memory from the script and execute native API functions.
It was designed to support both old and new iPhones and included a Pointer Authentication Code (PAC) bypass for exploitation of recent models.
It uses the integer overflow vulnerability CVE-2023-32434 in XNU’s memory mapping syscalls (mach_make_memory_entry and vm_map) to obtain read/write access to the entire physical memory of the device at user level.
It uses hardware memory-mapped I/O (MMIO) registers to bypass the Page Protection Layer (PPL). This was mitigated as CVE-2023-38606.
After exploiting all the vulnerabilities, the JavaScript exploit can do whatever it wants to the device including running spyware, but the attackers chose to: (a) launch the IMAgent process and inject a payload that clears the exploitation artefacts from the device; (b) run a Safari process in invisible mode and forward it to a web page with the next stage.
The web page has a script that verifies the victim and, if the checks pass, receives the next stage: the Safari exploit.
The Safari exploit uses CVE-2023-32435 to execute a shellcode.
The shellcode executes another kernel exploit in the form of a Mach object file. It uses the same vulnerabilities: CVE-2023-32434 and CVE-2023-38606. It is also massive in terms of size and functionality, but completely different from the kernel exploit written in JavaScript. Certain parts related to exploitation of the above-mentioned vulnerabilities are all that the two share. Still, most of its code is also dedicated to parsing and manipulation of the kernel memory. It contains various post-exploitation utilities, which are mostly unused.
The exploit obtains root privileges and proceeds to execute other stages, which load spyware. We covered these stages in our previous posts.

This is nation-state stuff, absolutely crazy in its sophistication. Kaspersky discovered it, so there’s no speculation as to the attacker.

Read the whole story

jth

303 days ago

reply

Saint Paul, MN, USA

1 public comment

JayM

321 days ago

reply

Ug

Atlanta, GA

Your Smart TV Knows What You’re Watching – The Markup
Wednesday December 13^th, 2023 at 7:46 AM

The Markup

If you bought a new smart TV during any of the holiday sales, there’s likely to be an uninvited guest watching along with you. The most popular smart TVs sold today use automatic content recognition (ACR), a kind of ad surveillance technology that collects data on everything you view and sends it to a proprietary database to identify what you’re watching and serve you highly targeted ads. The software is largely hidden from view, and it’s complicated to opt out. Many consumers aren’t aware of ACR, let alone that it’s active on their shiny new TVs. If that’s you, and you’d like to turn it off, we’re going to show you how.

First, a quick primer on the tech: ACR identifies what’s displayed on your television, including content served through a cable TV box, streaming service, or game console, by continuously grabbing screenshots and comparing them to a massive database of media and advertisements. Think of it as a Shazam-like service constantly running in the background while your TV is on.

These TVs can capture and identify 7,200 images per hour, or approximately two every second. The data is then used for content recommendations and ad targeting, which is a huge business; advertisers spent an estimated $18.6 billion on smart TV ads in 2022, according to market research firm eMarketer.

For anyone who’d rather not have ACR looking over their shoulder while they watch, we’ve put together a guide to turning it off on three of the most popular smart TV software platforms in use last year. Depending on the platform, turning off ACR took us between 10 and 37 clicks.

Roku OS is the most popular smart TV operating system in the US, running on the company’s streaming media devices and TVs, as well as some TCL, Hisense, Philips, and Sharp televisions. It took 11 to 24 clicks to turn off Roku’s ACR system, called “Smart TV Experience,” which is only bundled with TVs and not Roku streaming sticks. Roku offers users the ability to turn off targeted advertising and opt out of third-party data sharing through an online account, but turning off ACR is available only on the TV set itself.

↩︎ link

On your TV’s homescreen, select the Settings menu.
Under the Settings menu, navigate to and select the Privacy option.
Select the Smart TV Experience option.
Uncheck the Use info from TV inputs option to turn off ACR.

Users can also opt out of seeing personalized ads from their Roku homescreen. The same number of ads will still appear but will not be based on user data.

On the homescreen, select the Settings menu.
Under the Settings menu, navigate to and select the Privacy option.
Under privacy, select the Advertising option.
Uncheck Personalized ads. A pop-up will appear. Confirm Don’t personalize my ads.

Samsung is the most popular TV manufacturer in the world. It took 10 to 37 clicks to turn off ACR, which Samsung calls “Viewing information services.” If you’ve connected your television to a Samsung account, you can opt out of ACR and other ad targeting online as well.

↩︎ link

Navigate to the homescreen by pressing the Home button.
Navigate left to the sidebar menu.
In the sidebar menu, select the Privacy Choices option.
Select the Terms & Conditions, Privacy Policy option.
Ensure the Viewing Information Services checkbox is unchecked.
Turn off ad targeting. Underneath the Viewing Information Services checkbox, uncheck Interest-Based Advertisements Services U.S. Privacy Notice.
Select the OK option box at the bottom of the screen to confirm changes to turn off ACR (and targeted advertising if you unchecked it).

LG requires users to accept all the user agreements and terms of service to use any of the television’s smart features. This includes agreements for viewing information, voice assistants, and cross-device advertising.

LG calls its ACR-powered content recommendation system “Live Plus.” It took 27 clicks to turn off “Live Plus.” LG does not offer a way to limit ACR and other tracking through an online account.

↩︎ link

Navigate to the homescreen by pressing the Home button.
On your remote, press the Settings button.
In the settings side menu pop-up, select the Settings option.
In the menu, select the General option.
In the General menu, select the System option.
In the System menu, select the Additional Settings option.
In the Additional Settings, toggle off the Live Plus option.

Users can also opt out of ad targeting, limit ad tracking, and third-party data sharing.

The Additional Settings menu includes a Home Settings menu where users can turn off banner ads and content recommendations:

In the Additional Settings menu, select the Home Settings option.
Uncheck the Home Promotion option.
Uncheck the Content Recommendation option.

The Additional Settings menu includes an Advertisement settings menu where users can limit ad tracking:

In the Additional Settings menu, select Advertisement.
Toggle on the Limit AD Tracking option.

The Support menu includes an Advertisement settings menu where users can limit the sharing or sale of data to third parties:

Navigate to the homescreen by pressing the Home button on your remote.
On your remote, press the Settings button.
In the settings side menu pop-up, select the Settings option.
In the menu, select the Support option.
In the Support menu, select the Privacy & Terms option.Toggle on the Do Not Sell My Personal Information option.

LG does not offer a way to opt out of ACR or ad targeting on its website. Opting out of third-party data sharing is more difficult to do online than on your TV, requiring you to find and submit your model’s TV operating system and unique hardware identifier.

If you recently purchased a new smart TV with ACR that is not on this list, email me at mohamed@themarkup.org. I’m also interested in learning more about readers’ experiences with privacy and advertising on smart TVs.

Read the whole story

jth

343 days ago

reply

Good advice to disable the tracking and targeted advertising embedded in your smart TVs.

Saint Paul, MN, USA

1 public comment

acdha

344 days ago

reply

Your TV should only be connected to an Apple TV, and never your Wi-Fi

Washington, DC

Sign Combo
Thursday November 9^th, 2023 at 3:27 PM

xkcd.com

Read the whole story

jth

377 days ago

reply

This is what it's like in certain parts of East St. Louis.

Saint Paul, MN, USA

323 days ago

It's important to recognize that communities are diverse, and individuals within East St. Louis may have different experiences and perspectives. Efforts from both the local community and external support organizations aim to address these challenges and work toward improving the overall well-being of residents. Community engagement, economic development initiatives, and social programs are some of the strategies employed to uplift communities and create positive change.