Attackers actively exploiting ‘Simjacker’ flaw to steal device data and spy on individuals

Cybersecurity researchers have warned of a critical vulnerability in SIM cards that could allow remote attackers to compromise targeted mobile phones and spy on victims without their knowledge just by sending an SMS.

Dublin-based firm AdaptiveMobile Security said the flaw — dubbed “Simjacker” — has been actively exploited for at least two years by a spyware vendor that works with governments to track individuals. The firm didn’t disclose the name of the company nor the individuals who may have been targeted in this way.

window.jwLibrary = "chM58Ml7";

Given the attack works across all platforms, the vulnerability demonstrates the increasing sophistication of threat actors to undermine network security by taking advantage of obscure tecnologies.

“The attack involves an SMS containing a specific type of spyware-like code being sent to a mobile phone, which then instructs the SIM Card within the phone to ‘take over’ the mobile phone to retrieve and perform sensitive commands,” AdaptiveMobile Security said.

The researchers have responsibly disclosed the flaw to GSM association (GSMA) and SIMalliance, the governing organizations overseeing mobile operators worldwide and seeking to improve the security of mobile services.

What is S@T?

The vulnerability resides in what’s called the S@T browser, embedded on most SIM cards as part of SIM Application Toolkit (STK) widely used by GSM mobile operators across the world to provide value-added services to customers.

Credit: AdaptiveMobile Security

How Simjacker works

S@T — short for SIMalliance Toolbox Browser — is a microbrowser (aka mobile browser) designed to be used on mobile devices, especially on phones that support Wireless Application Protocol (WAP), a common standard for accessing the internet since the early 2000s.

The browser — stored as an executable application on the SIM card residing inside a GSM mobile phone — offers mobile service providers an interactive means to allow users access web applications such as email, stock prices, news, and sports headlines.

With modern mobile browsers such as Chrome, Firefox, and Safari now capable of supporting full HTML web pages, WAP — and by extension S@T — has been deemed largely obsolete.

But AdaptiveMobile said it found the S@T browser technology active on mobile operators in at least 30 countries, with a combined population of over one billion. That doesn’t automatically make everyone susceptible, as it’s very much possible that mobile operators are no longer using SIM cards containing the vulnerable S@T browser.

Disclosing that the attacks are happening on a daily basis, the researchers also said a few phone numbers had been tracked hundred times over a 7-day period, implying they were high-profile targets.

How does the attack work?

At a high level, the vulnerability works by leveraging a GSM modem — available for as cheap as $10 — to send malicious messages to handsets that still use the S@T browser functionality in order to trigger specially crafted STK commands.

Here is some comment from the GSMA. It doesn’t have data on which countries were impacted (although others likely will) pic.twitter.com/itTNAXjGAH

— Joseph Cox (@josephfcox) September 12, 2019

The SMS is not the regular kind, but another flavor called Binary SMS that’s used to deliver rich-content, such as ringtones, telephone system settings and WAP push text messages.

The device, upon receiving the SMS, blindly passes on the message to the SIM card without bothering to check its origin, following which the SIM card uses the S@T browser to execute the command — including requesting location and device information such as IMEI numbers.

“During the attack, the user is completely unaware that they received the attack, that information was retrieved, and that it was successfully exfiltrated,” the researchers said.

While the primary attack detected involved the retrieval of mobile phone locations, the scope of Simjacker has considerably widened to “perform many other types of attacks against individuals and mobile operators such as fraud, scam calls, information leakage, denial of service and espionage.”

SIMalliance, for its part, has rolled out fresh recommendations to cellular carriers to implement additional security for S@T push messages by filtering such illegitimate binary SMSes.

As ZDNet notes, Simjacker attacks have been theorized at least since 2011. But this is the first time they have been exploited via complex techniques to enable surveillance.

“Now that this vulnerability has been revealed, we fully expect the exploit authors and other malicious actors will try to evolve these attacks into other areas,” AdaptiveMobile Security’s chief technology officer Cathal Mc Daid said.

Read next:

It's possible to monetize data while respecting consumer privacy — here's how

Telegram fixed a bug that stored images on recipients’ phones even after you ‘unsent’ them

Telegram messenger just fixed a bug that stored a picture you sent via a message even if you ‘unsend’ the message. The vulnerability, discovered by security researcher Dhiraj Mishra, affected the messenger’s last stable version (5.10.0 (1684)) before the update. 

Mishra said on his blog the app stored images in the “/Telegram/Telegram Images/” folder in the phone‘s internal storage even if a user chooses to remove it for all users. Horrifically, this applied to group chats as well which can have as many as 200,000 members.

window.jwLibrary = "chM58Ml7";

The video below shows the bug in action.

The messenger launched the unsend feature in 2017 that allows you to delete a message for everyone in the chat. Mishra had also tried replicating this bug in messengers such as WhatsApp, but the unsend feature worked as intended for those apps.

Telegram has released a new version (5.11) on September 5 to fix this bug.

You can read more about the anomaly here.

Read next:

Amazon will launch new Alexa hardware on September 25

Texas says no to ransom demand as it recovers from a ‘coordinated ransomware attack’

Texas officials have said that none of the municipalities impacted by the crippling ransomware attack last month have yielded to the ransom demand.

In its first update since August 20, the Texas Department of Information Resources (DIR) — which is leading the investigation into the incident — said more than half of the affected entities have resumed usual operations.

window.jwLibrary = "chM58Ml7";

“All the impacted entities had transitioned from assessment and response to remediation and recovery with business-critical services restored by August 23,” the agency noted.

The coordinated ransomware attack hit 22 agencies on August 16, with their IT systems locked out by Sodinokibi (REvil) ransomware after hackers breached the software of a third-party service provider used to remotely manage their infrastructure.

Then late last month, reports emerged that criminals had demanded a collective ransom of $2.5 million to regain access to those IT systems. But with the amount not being paid, it increasingly appears the officials decided to restore from backups.

The DIR chalked up the quick incident recovery to a previously established response plan that was put into action immediately. With support from over 10 government agencies, it said all sites were cleared for remediation and recovery within a week after the attack.

To pay or not to pay?

The development comes as several US cities have been crippled by a wave of ransomware attacks, with infections leading agencies to spend hundreds of thousands of dollars to recover access to systems.

“Ransomware attacks are a tried and tested method to get money for adversaries as they find it very lucrative,” Eric Cornelius, Chief Product Officer at Cylance, told TNW. The cybersecurity firm was acquired by Canadian enterprise software company Blackberry earlier this year.

Last week emerged news of a ransomware gang trying to extort an exorbitant sum of $5.3 million from the city of New Bedford, Massachusetts. But after the criminals rejected a smaller counter-offer of only $400,000, ZDNet reported the city eventually chose to restore from backups.

DIR has posted an update regarding the August 2019 Texas Cyber Incident. Please see the September 5th press release below. More information about #ransomware, #cybersecurity best practices, and other updated information is available on our website: https://t.co/kVQb0eKIjs pic.twitter.com/4NvMZVnNaQ

— Texas Department of Information Resources (@TexasDIR) September 5, 2019

“The conventional recommendation is to never pay a ransom. However, security professionals are beholden to the business financial interests and its key stakeholders — which may mean going against conventional wisdom,” states Forrester’s Guide To Paying Ransomware report.

Cities have often opted to pay for ransoms, as it’s the quickest way to resume normal function in the face of spiralling costs to recover and implement cybersecurity defenses to help protect against attacks in the first place. But the controversial trend is not being looked upon favorably.

“We would not be negotiating ransoms if the threat were to manifest physically,” Ryan Kalember, who leads cybersecurity strategy for California-based enterprise security solutions provider Proofpoint, told TNW. “Insurance has changed the economics in favor of the attackers. But there needs to be more conversation when taking such risk management decisions.”

An IBM Security and Morning Consult survey published last week found that nearly 60 percent of respondents said they are against their local governments using tax dollars to pay ransoms. An overwhelming 90-percent majority of US citizens said they’re in favor of increasing federal funding to improve cybersecurity in cities.

On the other end of the spectrum is the ransomware negotiation itself. “We use a machine learning approach to proactively detect and prevent ransomware threats,” said Cornelius.

“Unfortunately, there are also situations where organizations only reach out to us after they’ve been a victim of an ransomware attack,” he said. “We’ve successfully negotiated with the attackers in those cases, resulting in a 80-percent reduction in asking price.”

The need for preparedness

Kalember says the dynamic threat landscape means hackers are carefully picking their targets knowing that they have insurance and tend to pay out. Urging system administrators to be on the lookout for risks associated with remote desktop tools, he stressed the need for better preparednessness.

“Most of the ransomware attacks are unskilled efforts,” Kalember said. “There are not enough data practices in place. Watching out for phishing emails, hardening the IT infrastructure, removing administrator rights, and adding multi-factor authentication can go a long way towards improving security.”

In addition, the Texas DIR is also recommending companies and organizations that they block inbound network traffic from Tor Exit Nodes and outbound network traffic to Pastebin.

“The devil is in the details,” Cornelius said. “90 percent of it boils down to practicing good IT hygine. Attackers most often capitalize on well-known exploits. It’s very important that vulnerabilities are identified and patched timely.”

Over half a million active GPS trackers have ‘123456’ as default password

Researchers have found serious security vulnerabilities in over 600,000 GPS trackers available for sale on Amazon and other online retail merchants that may have exposed user data, including the exact real-time GPS coordinates.

Czech cybersecurity firm Avast, which disclosed the vulnerabilities, said it informed the manufacturer about the flaws on June 24, 2019, but added they never got a response to their repeated messages.

window.jwLibrary = "chM58Ml7";

The trackers — 31 models in all that are made by Chinese IoT manufacturer Shenzhen i365 Tech — allowed users to keep tabs on their childrens’ whereabouts through a companion app and a web portal, while the trackers uploaded the location information to a cloud server that communicated with the apps.

But researchers noted this setup was replete with flaws. Not only was the information on the web portal and the Android app sent to the server unencrypted (i.e. HTTP as opposed to HTTPS), the usernames were based on the trackers’ IMEI (International Mobile Equipment Identity) number, with the default password being “123456.”

Avast warned that hackers can use this information to intercept data and issue unauthorized commands, using the tracker to call and message arbitrary phone numbers, thereby letting them spy on conversations around the tracker without the user’s knowledge.

In addition, this can also allow a malicious user to take over victims’ accounts by going through the trackers’ IMEI codes in sequence and the same password “123456,” effectively locking them out. The attacker can even get the real-time GPS coordinates by just sending an SMS to the phone number associated with the SIM card that’s inserted into the tracker.

Credit: Avast

The affected 32 models of GPS trackers sold by Shenzen i365

Conveniently for the threat actor, the account settings make it possible for the attacker to force “the tracker [to] send an SMS to a phone number of a phone in his possession which allows him to tie the ID of a tracker with its phone number.”

Scanning a random sample of four million sequential IMEI numbers, the researchers zeroed on at least 600,000 devices still in use with default passwords, out of which over 167,000 were locatable.

Although the trackers were manufactured in China, Avast found the trackers to be widely used in Europe, South Africa, Australia, Brazil, the Middle East, and the US.

This is not the first time a flaw of this nature has been revealed. Back in May, UK cybersecurity firm Fidus Information Security revealed a vulnerability in a popular GPS tracker used by elderly patients that can be tricked into sending its real-time location simply by sending it a text message with a specific command.

As a consequence, the UK is considering laws that would mandate internet-connected gadgets to be sold with a unique password, and not a default.

GPS tracking devices are often used for a variety of purposes, from locating family members to pets, and from cars to valuables such as keys. Given that the issue exists to this day, it’s yet another cautionary reminder as to why you should change default passwords.

Read next:

China is following Facebook's playbook to issue a centralized digital currency

US preps voting systems against ransomware attacks ahead of 2020 elections

The US government is looking to protect voter registration databases and systems from ransomware threats ahead of the 2020 presidential election.

The Cybersecurity Infrastructure Security Agency (CISA) — a division of the Homeland Security department instituted by president Donald Trump in November last year — fears the databases could be at the receiving end of a ransomware attack.

window.jwLibrary = "chM58Ml7";

To that effect, it aims to launch a program for election officials in about a month to offer support for remote computer penetration testing and vulnerability scans.

“Intelligence officials are concerned that foreign hackers in 2020 not only will target the databases but attempt to manipulate, disrupt or destroy the data,” Reuters reported, quoting current and former U.S. officials.

The voter systems have been previously breached by the Russian military intelligence, who executed a cyberattack on a US voting software supplier in the days leading to 2016 elections. The highly targeted campaign, The Intercept revealed, also involved sending spear-phishing emails to more than 100 local election officials.

In addition, a series of ransomware attacks against state-run facilities have put the government on high alert. With infections forcing agencies to spend hundreds of thousands of dollars to recover access to critical systems, it’s become necessary that databases are secured and appropriate incident recovery plans are put in place to be able to respond to such crippling attacks.

Calling ransomware attacks “destructive,” CISA — in a notice put up last week — warned agencies to “make sure you’re not tomorrow’s headline” by backing up data offline, patching network infrastructure, and reviewing incident response plans.

In a report published in May, Massachusetts-based threat intelligence firm Recorded Future found at least 169 ransomware incidents targeting state and local governments since 2013, with 21 of them reported just in the first four months of 2019.

“It is imperative that states and municipalities limit the availability of information about electoral systems or administrative processes and secure their websites and databases that could be exploited,” Reuters quoted the FBI in a statement.

The focus of the program, it appears, is geared towards prevention of ransomware attacks, as CISA won’t advice states on whether they should pay or refuse to pay ransom post infection.

Ultimately, it’s not just about paying the ransom, as many businesses will also need to invest in upgrading their security practices before and after a ransomware attack. Cyber preparedness is of the essence, and it’s vital that organizations develop, test, and validate their capabilities to protect against, prevent, mitigate, respond to, and recover from significant security threats.

Read next:

How China’s Baidu outsold Google in the smart speaker market

LA County data leak exposes personal information of callers to crisis and abuse line

A mistake on the part of whoever is in charge of the LA County 2-1-1 System’s database exposed 3.2 million files containing terrifyingly sensitive data – much of which includes personally identifying information from calls with abuse and crisis victims. This is bad.

An Amazon Web Services (AWS) S3 bucket (basically, cloud storage) containing detailed information from more than 200,000 calls to the county’s 2-1-1 line, a hotline that provides assistance for abuse victims and persons in crisis (among other health and human services-related functions), was left configured for public access — for an unknown period of time — until a private security researcher noticed.

The leak exposed more than 33,000 social security numbers, over 300,000 email addresses, and the full names of the victims, alleged perpetrators, and witnesses in numerous suspected cases of physical and sexual abuse.

If that weren’t enough, the S3 bucket held “weakly hashed” passwords for 384 logins. Whatever information a bad actor couldn’t gain from the contents of the bucket could have feasibly been accessed by logging into the LA County 2-1-1 LinQ system using these credentials.

In the time since the incident was reported earlier this week, the bucket has reportedly been secured. But just like every other breach of this nature, by the time the problem is discovered there’s simply no way of knowing if any real damage has been done.

• 


• 


• 

When you’re dealing with detailed information accusing potentially violent people of things such as child abuse and rape, any breach of security risks the lives of people who, often, are the most vulnerable among us. This kind of breach – essentially an IT person forgets to secure the bucket after doing something that requires it be set to public temporarily – is 100 percent preventable.

Like we’ve said before: bad employees are worse than good hackers.

Chris Vickery, a Cyber Risk Analyst for cyber resilience firm UpGuard, found the vulnerability by searching for publicly accessible AWS buckets which contained files or folders with the word “county” in them. As is the case with all of the vulnerabilities he exposes, all he needed to access the information was a regular old internet browser.

If a “hacker” can use IE, Chrome, Firefox, Opera, or Safari they’ve got all the tools they need to “hack” these AWS buckets. What’s worse: Amazon has taken steps to mitigate this type of problem, yet it still persists.

We talked to Vickery about the problem, one he makes a living sniffing out. He believes it’s just human nature:

You gotta make it so people can’t screw up. Because if people can screw up, a certain percentage of them will. That’s simple statistics.

Vickery knows what he’s talking about. He’s found similar breaches in the NSA and Department of Defense databases (both caused by the same kind of AWS S3 bucket misconfiguration). He says we’re still in the “triage phase” when it comes to these kinds of breaches — meaning they’ll keep happening until someone finds a way to make it impossible for administrators to accidentally not do the one thing they need to do to make sure an AWS bucket isn’t publicly accessible: make it inaccessible to the public. Basically the best we can hope for is good guys like him finding the breaches before bad actors do. And that’s terrifying.

Everyone makes mistakes, but not every mistake could lead to exposing tens of thousands of victims, their families, and witnesses to unthinkable consequences. The government – at every level – continues to show it has little ability to protect our data.

For its part, LA County is investigating and performing a security audit – further evidence the state of cyber security preparedness in this country is best described as “reactionary.”

The Next Web’s 2018 conference is just a few days away, and it’ll be 💥💥. Find out all about our tracks here.

LA Confidential: How Leaked Emergency Call Records Exposed LA County's Abuse & Crisis Victims
on UpGuard

Read next:

Review: Dyson's Cyclone V10 vacuum is $500 overkill, but I love it anyway