 It’s the messaging app that connects a quarter of the world’s population, but many Americans still have haven’t heard of WhatsApp. That’s because most phone plans in the United States provide a standard flat rate for texting that allows people to communicate freely within the country. But throughout much of the world, including many of the world’s poorest countries, people are charged for every single message they send and receive. That is why, since its launch in 2009, WhatsApp has become a vital resource for billions of people – and they are prepared to defend it. When the Lebanese government tried to bring in a “WhatsApp tax”, charging $0.20 daily for calls made on the app, it helped trigger the mass protests that swept the country in 2019. One thing that does connect Americans to WhatsApp users, however, is Facebook chief executive Mark Zuckerberg and his flagrant disregard for data privacy. Facebook acquired WhatsApp in 2014 in a move to consolidate control over global communications. Now Zuckerberg is moving ahead with a change to WhatsApp’s privacy policy that aims to commercialize our communications in order to feed Facebook’s insatiable greed. At the time of WhatsApp’s purchase in 2014, the app did not collect phone numbers, metadata, or other contact information. Facebook promised to keep it this way. “We are absolutely not going to change plans around WhatsApp and the way it uses user data,” Zuckerberg claimed. “WhatsApp is going to operate completely autonomously.” Yet on 15 May, when Zuckerberg implements a new privacy update, this will be just one more in a series of his broken promises on data privacy. In 2016, WhatsApp implemented an update to its terms and conditions that allowed data like a user’s phone number to be shared with Facebook. Users were technically given 30 days’ notice to opt out. However, many were unaware of the possible opt-out and missed the small window in which they could do so, while the approximately one billion users who joined since were given no choice at all. WhatsApp announced its latest privacy update in January, with changes initially meant to take effect on 8 February. However, a popular outcry pushed the date back to 15 May, with Facebook no doubt hoping that public outrage would fade, paving the way for a quiet implementation. But public outrage has not faded. And so Facebook has opted for a familiar tactic: sow confusion and force through its new policy change anyway. The company is pestering WhatsApp users to accept the policy change by 15 May or, under a new opaque timeframe, a few additional weeks. Those who ignore or refuse the decision will lose access to basic WhatsApp functioning. Time is now running for Zuckerberg to reverse course in this latest assault on global communications – and protect the privacy of all WhatsApp users at this critical hour for democracy and dissent around the world. Facebook, for its part, has spent the months since the announcement downplaying the significance of these privacy updates by arguing that its latest changes will only affect communication with business accounts (WhatsApp Business was launched in January 2018). In truth, the changes will allow Facebook to collect payment and transaction data from WhatsApp users, meaning Facebook will be able to gather even more data and target users with ever more personalized ads. WhatsApp has also removed a passage in its privacy policy about opting out of sharing data with Facebook. Facebook argues that this simply reflects what’s been in place since 2016. That is exactly the problem.Today’s WhatsApp shares a great deal of information with Facebook it promised it wouldn’t, including account information, phone numbers, how often and how long people use WhatsApp, information about how they interact with other users, IP addresses, browser details, language, time zone, etc. This latest incursion has highlighted just how much data sharing has been going on for years without most users’ knowledge. Learn more when you visit OUR Forum.  Security researcher Mathy Vanhoef, who loves to poke holes in Wi-Fi security, is at it again, this time finding a dozen flaws that stretch back to cover WEP and seemingly impact every device that makes use of Wi-Fi. Thankfully, as Vanhoef explained, many of the attacks are hard to abuse and require user interaction, while others remain trivial. Another positive is Microsoft shipped its patches on March 9, while a patch to the Linux kernel is working its way through the release system. The details of FragAttacks follow a nine-month embargo to give vendors time to create patches. "An adversary that is within radio range of a victim can abuse these vulnerabilities to steal user information or attack devices," Vanhoef said in a blog post. "Experiments indicate that every Wi-Fi product is affected by at least one vulnerability and that most products are affected by several vulnerabilities." Several of the identified flaws relate to the ability to inject plaintext frames, as well as certain devices accepting any unencrypted frame or accept plaintext aggregated frames that look like handshake messages. Vanhoef demonstrated how this could be used to punch a hole in a firewall and thereby take over a vulnerable Windows 7 machine. "The biggest risk in practice is likely the ability to abuse the discovered flaws to attack devices in someone's home network," the security researcher wrote. "For instance, many smart homes and internet-of-things devices are rarely updated, and Wi-Fi security is the last line of defense that prevents someone from attacking these devices. Unfortunately ... this last line of defense can now be bypassed." Other vulnerabilities relate to how Wi-Fi frames are fragmented and how receivers reassemble them, allowing an attacker to exfiltrate data. Even devices that do not support fragmentation were at risk. "Some devices don't support fragmentation or aggregation but are still vulnerable to attacks because they process fragmented frames as full frames," Vanhoef wrote. "Under the right circumstances, this can be abused to inject packets." Some networking vendors such as Cisco and Juniper are starting to push patches for some of their impacted products, while Sierra has planned some of its products to be updated over the next year, and others will not be fixed. The CVEs registered to due FragAttacks have been given a medium severity rating and have CVSS scores sitting between 4.8 to 6.5. "There is no evidence of the vulnerabilities being used against Wi-Fi users maliciously, and these issues are mitigated through routine device updates that enable detection of suspect transmissions or improve adherence to recommended security implementation practices," the Wi-Fi Alliance wrote. Vanhoef said anyone with unpatched devices can protect against data exfiltration by using http connections. "To mitigate attacks where your router's NAT/firewall is bypassed and devices are directly attacked, you must assure that all your devices are updated. Unfortunately, not all products regularly receive updates, in particular smart or internet-of-things devices, in which case it is difficult (if not impossible) to properly secure them," the researcher wrote. "More technically, the impact of attacks can also be reduced by manually configuring your DNS server so that it cannot be poisoned. Specific to your Wi-Fi configuration, you can mitigate attacks (but not fully prevent them) by disabling fragmentation, disabling pairwise rekeys, and disabling dynamic fragmentation in Wi-Fi 6 (802.11ax) devices." Follow this thread on OUR FORUM.  Five serious vulnerabilities in a driver used by Dell devices have been disclosed by researchers. On Tuesday, SentinelLabs said the vulnerabilities were discovered by security researcher Kasif Dekel, who explored Dell's DBUtil BIOS driver -- software used in the vendor's desktop and laptop PCs, notebooks, and tablet products. The team says that the driver has been vulnerable since 2009, although there is no evidence, at present, that the bugs have been exploited in the wild. The DBUtil BIOS driver, which comes pre-installed on many Dell machines running Windows, contains a component -- the dbutil_2_3.sys module -- which was subject to Dekel's scrutiny. Dell has assigned one CVE (CVE-2021-21551), CVSS 8.8, to cover the five vulnerabilities disclosed by SentinelLabs. Two are memory corruption issues in the driver, two are security failures caused by a lack of input validation, and one logic issue was found that could be exploited to trigger denial-of-service. "These multiple critical vulnerabilities in Dell software could allow attackers to escalate privileges from a non-administrator user to kernel mode privileges," the researchers say. The team notes that the most crucial issue in the driver is that access-control list (ACL) requirements, which set permissions, are not invoked during Input/Output Control (IOCTL) requests. As drivers often operate with high levels of privilege, this means requests can be sent locally by non-privileged users. "[This] can be invoked by a non-privileged user," the researchers say. "Allowing any process to communicate with your driver is often a bad practice since drivers operate with the highest of privileges; thus, some IOCTL functions can be abused "by design." Functions in the driver were also exposed, creating read/write vulnerabilities usable to overwrite tokens and escalate privileges. Another interesting bug was the possibility to use arbitrary operands to run IN/OUT (I/O) instructions in kernel mode. "Since IOPL (I/O privilege level) equals to CPL (current privilege level), it is obviously possible to interact with peripheral devices such as the HDD and GPU to either read/write directly to the disk or invoke DMA operations," the team noted. "For example, we could communicate with ATA port IO for directly writing to the disk, then overwrite a binary that is loaded by a privileged process." Proof-of-Concept (PoC) code is being withheld until June to allow users time to patch. Dell was made aware of Dekel's findings on December 1, 2020. Following triage and issues surrounding some fixes for end-of-life products, Dell worked with Microsoft and has now issued a fixed driver for Windows machines. The PC giant has issued an advisory (DSA-2021-088) and a FAQ document containing remediation steps to patch the bugs. Dell has described the security flaw as "a driver (dbutil_2_3.sys) packaged with Dell Client firmware update utility packages and software tools [which] contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. "We remediated a vulnerability (CVE-2021-21551) in a driver (dbutil_2_3.sys) affecting certain Windows-based Dell computers," a Dell spokesperson said. "We have seen no evidence this vulnerability has been exploited by malicious actors to date. We appreciate the researchers working directly with us to resolve the issue."For more navigate to OUR FORUM.
|
Latest Articles
|