Just an (Info) Sec

Educational content to help people protect their security/privacy in day to day life. Interested in a particular topic - let me know!

[justaninfosec]

Last Updated: 21 March 2023

I’ve been kicking around Tumblr for A While now, doing the fandom thing elseblog. But last year, I saw a post that caught my eye for two reasons. One, it was a security/privacy tip for smartphones, which is something I see loads on some other platforms, but not much around here. And two, there was a LOT of interest in it. Not just based on the notes count, but the story the comments and tags told. People excited to share the info with friends, people shocked to find the thing in question was even a concern, people thrilled to find they’d already set the setting, all sorts of such sentiments.

Huh, I thought, maybe I don’t see that sort of content on Tumblr much not because people aren’t interested, but because it’s not being shared to start with.

…you know, I could share some security info on Tumblr. So. Here we go.

I’m still thinking through the full big picture of this blog, but I know I want to provide useful educational content to help people protect their security/privacy in day to day life. I want to keep posts short enough they’re not going to glaze over eyeballs, but I want there to be context. I could just spout stuff like “don’t reuse passwords!” and call it a day. But while that may be short, I don’t think it’s too sweet. I’ve found that explaining the why of things to people works out a lot better in the long run. They remember it better, they’re less likely to blow it off as useless if they understand why it matters, and they can extrapolate it to future scenarios much better. Knowledge is power, wooooo *waves flag*

I have a big list of topics drawn up I think might be of interest and for now will work on them in order of what I’m inclined to write about at the moment. Topics include, but are not limited to, passwords, mobile security, browsers, disaster preparedness, protecting your privacy, phishing, social media, protecting your identity, security news sources, and so on and so forth. Some stuff will be one offs, others will be post series on a given subject.

Once I’ve got enough of an audience, I’ll give polls a whirl to help choose how best to safeguard your vanilla extract stores amongst the current front runners.

As content is added and tagged, I’ll add links to the topic list below.

Have any security questions? Go ahead and ask them!

TOPICS:

Authentication

Passwords - Part 1

Security and Privacy News

Check the Security and Privacy News tag for news items good to be aware of, particularly if someone might need to take action on their phone, tablet, a popular website, etc.

[justaninfosec]

Threats: What Every Engineer Should Learn From Star Wars

Threats: What Every Engineer Should Learn From Star Wars

The launch landing page for Threats: What Every Engineer Should Learn From Star Wars

Okay, I know this isn't a general purpose security topic, but hey, I've seen a lot of Tumblr users admit to being in software dev over the years ;) Adam Shostack, well known in the security space on a variety of topics, particularly threat modeling, has a new book out. The twist? Looking at the concept of threats to software through the lens of Star Wars.

I haven't read this one myself yet so no book review right now, but it looks fun!

[justaninfosec]

Windows 11 Snipping Tool privacy bug exposes cropped image content

A severe privacy flaw named 'acropalypse' has also been found to affect the Windows Snipping Tool, allowing people to partially recover cont

I posted yesterday about the Google Pixel Markup tool bug that allows recovery of cropped portions of screenshots. And then, I found that a similar bug has been discovered in Microsoft Windows.

The Windows 11 Snipping Tool appears to occur if you take some action on an image file and the altered file content is smaller than the original file. The now excess 'old' file data can be recovered, though not perfectly (meaning you might recover part of the image that was cropped, but not all of it). Cropping an image is of course a common way a file might be made smaller.

Word is that the Snip & Sketch tool on Windows 10 is also vulnerable, but that the Windows 10 Snipping tool is not.

HOW TO FIX

There is not yet an official patch for this issue, though Microsoft has acknowledged they are investigating. In the meantime, per the article, "BleepingComputer also found that if you open an untruncated PNG file in an image editor, such as Photoshop, and save it to another file, the unused data at the end will be stripped off, making it no longer recoverable".

As with the PIxel bug, be aware that screenshot files made in the past could also have data recovered from them.

[justaninfosec]

An emergency security update for Windows 10 and Windows 11 has been released to address this.

Dangerous ‘acropalypse’ bug in Windows Snipping Tool fixed in emergency security update — install it now

The acropalypse bug has now been patched by Microsoft in both its Snip & Sketch and Snipping Tool software for Windows 10 and Windows 11.

(Posting this as a reblog/addition to the original post. If you think a new post would be a more useful approach, let me know.)

[justaninfosec]

The End of Twitter Verified Accounts

Last Updated: 29 March 2023

I’ve seen a fair bit of confusion floating around about what’s happening with Twitter Verified Accounts. In order to better arm yourself against misinformation and disinformation that may well ensue to an even greater degree in the near future, check out the below.

Bottom line is, the Verified Accounts program will “start winding down”, in Twitter’s words, on 1 April 2023. Once that’s complete, the program will no longer exist, having been replaced by Twitter Blue and Verified Organizations. Twitter Blue ISN’T “a price tag + Verified Accounts”; it’s something different.

The Verified Accounts program was launched in 2009, to help mitigate the impact of impersonation of notable entities and individuals. The intent was to verify accounts that were “authentic, notable, and active”. The requirements to be verified can be found here (an Archive link is used in case Twitter removes the page): https://web.archive.org/web/20221109153246/https://help.twitter.com/en/managing-your-account/legacy-verification-policy

You didn’t pay for a Verified Account; in fact, at many points, Twitter took the initiative on reaching out and working with notable accounts to get them verified. It was an imperfect process, and I’ve seen more than one person that was well-known in their industry struggling to get verified amidst impersonations by others. But you didn’t get to spend money and wind up with a checkmark.

Twitter Blue

Going forward, the blue checkmark will mean the user is subscribed to Twitter Blue - they paid money - and met the eligibility requirements outlined here and on its linked pages: https://help.twitter.com/en/managing-your-account/about-twitter-verified-accounts. There is mention of Twitter looking for an intent to deceive, but the criteria are far less clear than for Verified Accounts and it flat out says that using Twitter pseudonymously is not a violation of the Blue policy.

If you change your photo, display name, or username, you will lose your Blue checkmark until the account is revalidated. Given those first two items get changed frequently by many people, it will be interesting to see how this goes. Particularly given Twitter has cut their employee numbers so much, one wonders how quickly they’ll be able to deal with validations and revalidations.

Folks far more focused on the nuances of Twitter than I have expressed expectations that Twitter Blue is going to cause problems for a variety of reasons, including:

Blue accounts have features that will amplify their content over non-Blue accounts. So, pay some money, amplify your content. This is already showing concerning signs in the realm of misinformation/disinformation.

Many accounts that were Verified in the past have indicated they’ll not pay for Blue, which seems likely to bring back at least some of the impersonation issues that predated Verified Accounts.

Verified Organizations

Businesses, non-profits, and government organizations can apply for Verified Organization accounts. Based on some things I read, I’m currently a little fuzzy on whether this includes things like heads of state having to pay to have the account show it’s a government account. We’ll see.

What I suspect will prove quite key in general is that a Verified Organization account will cost $1000 USD PER MONTH minimum. To affiliate other accounts to the organization account, such as an employee account, will cost an additional $50 USD per month.

So, $12,000 per year minimum to have a Verified Organization account. I wonder how many businesses are going to pay that, so we may see further impersonation issues here.

---

So yeah, we'll see how this goes. I'll post again on the matter after I have a better sense of the shape it's all taking after the 1st of April.

[justaninfosec]

Android Phones with Exynos Chipset Need Security Updates

Last Updated: 29 March 2023

Google's Project Zero found numerous vulnerabilities in the Exynos chipset used by a variety of Android phones. The most severe of them could allow an attacker to remotely compromise a phone, without the phone owner needing to do anything. The attacker just needs the phone number. That said, it doesn't seem to be under active exploit yet, at least as far as public news goes.

Affected Devices: Only phones with certain Exynos chipsets are vulnerable. Adding to the confusion is the fact that in some cases, the same phone model has different chips, depending on where in the world it was sold.

The Samsung S22 is one example: the version sold in Europe has Exynos, but those sold in many other places have a Qualcomm chip.

Affected Chipsets: Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T5123.

Google provided this list of likely affected devices based on the chipset list:

Samsung Galaxy phones including those in the S22, M33, M13, M12, A71, A53, A33, A21s, A13, A12, and A04 series

Vivo phones including those in the S16, S15, S6, X70, X60, and X30 series

Google Pixel 6 and 6 Pro, Pixel 6a, Pixel 7 and 7 Pro

Any vehicles that use the Exynos Auto T5123 chipset

Exploited?: I haven't yet found information saying the vulnerabilities are known to have been exploited, but the Project Zero researchers stated "With limited additional research and development, we believe that skilled attackers would be able to quickly create an operational exploit to compromise affected devices silently and remotely".

Mitigation: Google recommends you turn off Wi-Fi calling and Voice-over-LTE (VoLTE) on the affected devices. However, they have acknowledged that depending on carrier, you may not be able to turn off VoLTE.

Furthermore, you may not be able to use your phone for voice at all if VoLTE is off, depending on carrier, etc. So realistically, your best bet is a patch. See below.

Fix: As of the latest update to this post, Google has said the Pixel 7, Pixel 6, Pixel 6 Pro, and Pixel 6a have the critical vulnerabilities patched in the March 2023 security update.

It looks like at least some of the Samsung models have some patches available, so install any security updates you have pending and keep an eye out for more.

Reference:

Ars Technica article

Google Project Zero entry

Android Police

[justaninfosec]

Windows 11 Snipping Tool privacy bug exposes cropped image content

A severe privacy flaw named 'acropalypse' has also been found to affect the Windows Snipping Tool, allowing people to partially recover cont

I posted yesterday about the Google Pixel Markup tool bug that allows recovery of cropped portions of screenshots. And then, I found that a similar bug has been discovered in Microsoft Windows.

The Windows 11 Snipping Tool appears to occur if you take some action on an image file and the altered file content is smaller than the original file. The now excess 'old' file data can be recovered, though not perfectly (meaning you might recover part of the image that was cropped, but not all of it). Cropping an image is of course a common way a file might be made smaller.

Word is that the Snip & Sketch tool on Windows 10 is also vulnerable, but that the Windows 10 Snipping tool is not.

HOW TO FIX

There is not yet an official patch for this issue, though Microsoft has acknowledged they are investigating. In the meantime, per the article, "BleepingComputer also found that if you open an untruncated PNG file in an image editor, such as Photoshop, and save it to another file, the unused data at the end will be stripped off, making it no longer recoverable".

As with the PIxel bug, be aware that screenshot files made in the past could also have data recovered from them.

[justaninfosec]

Google Pixel bug lets you “uncrop” the last four years of screenshots

New tool reveals cropped-out screenshot info isn't deleted, can be recovered.

There is a bug in the Markup screenshot editor tool on PIxel phones. The bug was introduced with Android 10 and allows recovery of portions of images that were cropped out in Markup. For example, if you took a screenshot of a webpage and cropped out a section that showed your real name, exploiting this bug could allow recovery of the cropped section.

I say "could" because it does depend on how someone got the screenshot file from you. Some sites/apps - Twitter is given as an example - recompress uploaded files and this results in the data being deleted from the file that is necessary to recovering the cropped sections. Sites/apps that share the original file - Discord is the example here - can contain the necessary information to exploit the bug.

The bug was patched in the March 2023 security update for Pixel devices, so please update your phone as soon as possible.

IMPORTANT: Patching your device addresses screenshots going forward. It does not fix all the screenshots you may have uploaded to various sites/apps over the time since Android 10 came out.

[justaninfosec]

Authentication: Passwords - Part 1

Summary: An overview of what authentication/passwords are and the topics the password post series will cover.

Last Updated: 27 Feb 2023

Being in technical job roles, I suspect I have more passwords than the average bear. But at this point, that’s not saying much - everyone and everything wants you to sign up for an account on their site or application and add yet another password to your picnic basket.

This one wants to be that long and this other one, isn’t even ALLOWED to be that long. It wants numbers, no it doesn’t. Symbols, but oh not that symbol. Now you have to change the password, even though you swear you just changed it the other day. You might find yourself thinking, surely it won’t hurt if I just reuse a password here and there, help out my tired brain? And how about I use my dog’s name, which is a very weird one that no one will ever guess.

And then, a password gets stolen. You may not even know how it happened. The repercussions can run a huge gamut. You may have someone pretend to be you on social media, maybe you lose money, maybe your company network is hacked, to name just a few.

There is only so much we can do to protect ourselves and our data when it comes to passwords, because there is so much variance in how they’re handled by different service providers. They’re also a huge target for attackers. But there are things to be aware of to decrease the likelihood of you having an issue. It’s also good to know what to do if a password does get compromised.

In this post series, we’ll look at:

Password best practices and generally useful info

Password management methods

How to respond to a compromise

A word about work-related passwords (Okay, a fair few words.)

Bonus Round: What are the password creation rules and not sharing passwords and all that protecting AGAINST?

I won’t predict how many posts this will be, as I plan to break them up if they get too long. Except the bonus round: you get what you get there! I’ll be talking about rainbow tables and it needs room.

To start off, let’s have a quick primer on what a password is.

Passwords are used in authentication processes. You’ve likely heard of things like documents or paintings being authenticated: proving they are what they are believed to be. In security terms, authentication generally means to verify that an asserted identity - of a person, a device, or a process - is what it claims to be. When I login to Tumblr, justaninfosec is my identity in that case. If I’m using only a password to login—

(More on that in a future series: using multi-factor authentication, rather than just a password, is much more secure.)

—then the password is used as the “single factor” to decide that I am truly the account owner of justaninfosec. If I provide the correct password, I am authenticated and logged into Tumblr. Theoretically, I am also the only one who has the ‘cleartext’ (i.e., not encrypted or hashed) version of my password and so no one else could know what it is. But as we’ll discuss in future posts, it’s often not that simple.