Bonum Certa Men Certa

Security Isn't the Goal of Today's Software and Hardware Products

posted by Roy Schestowitz on Sep 25, 2023,
updated Sep 25, 2023

Private Keep Out Sign

THE world's governments want power, not security. Security for users would mean these government are unable to find out what citizens are doing. Security is... scary (to a snooping, nosy regime).

Security is not an impossibility, but when regimes generally want to monopolise or hoard power, they'll reserve security for themselves.

In this week's news we have Google itself admitting that Android exploits are already in the wild [1], evidence of China picking on GNU/Linux [2] (not a backdoor), some Linux security tips [3], and evidence of states targeting mobile devices [4-5]. These target proprietary software [6-7], gullible users [8-9], or crooked organisations that cover up what actually happened [10].

Speaking of crooked organisations that cover up what actually happened, there's Microsoft chaos again ("38TB of private data on GitHub" [11] and internal company leaks [12]), showing that Microsoft cannot even secure Microsoft itself. And the media has the nerve to paint Microsoft as an authority on security???

Even today's firewalls turn out to be security holes [13], so buying "security" might in practice weaken actual security. As [14] puts it: "The question remains, however: can the S-RoT itself be attacked?"

Any newly-added layer represents more attack surface. CISA is meanwhile cited by Microsoft-sponsored media as the guardian of security [15], even for "Open Source", but everyone in the security sector knows that CISA has conflicting interests, just like the NSA and NIST. As we noted in the first paragraph, they want to dominate rather than secure. Be sceptical of what they're promising.

Related/contextual items from the news:

  1. Analyzing a Modern In-the-wild Android Exploit
    In December 2022, Google’s Threat Analysis Group (TAG) discovered an in-the-wild exploit chain targeting Samsung Android devices. TAG’s blog post covers the targeting and the actor behind the campaign. This is a technical analysis of the final stage of one of the exploit chains, specifically CVE-2023-0266 (a 0-day in the ALSA compatibility layer) and CVE-2023-26083 (a 0-day in the Mali GPU driver) as well as the techniques used by the attacker to gain kernel arbitrary read/write access.
  2. Linux Threat Report: Earth Lusca Deploys Novel SprySOCKS Backdoor in Attacks on Government Entities
    The threat actor Earth Lusca, linked to Chinese state-sponsored hacking groups, has been observed utilizing a new Linux backdoor dubbed SprySOCKS to target government organizations globally. 
  3. Securing Your Linux Device: Tools and Tactics

    Explore Linux security strategies, from intrusion detection to password management. Safeguard your Linux device with these tips and reliable tools.

  4. PREDATOR IN THE WIRES: Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions
    Between May and September 2023, former Egyptian MP Ahmed Eltantawy was targeted with Cytrox's Predator spyware via links sent on SMS and WhatsApp after Eltantawy publicly stated his plans to run for President in the 2024 Egyptian elections. As Egypt is a known customer of Cytrox's Predator spyware, and the spyware was delivered via network injection from a device located physically inside Egypt, we attribute the attack to the Egyptian government with high confidence.
  5. Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones

    Apple has patched 3 zero-day vulnerabilities that have likely been exploited by a spyware vendor to hack iPhones.

  6. Obfuscated Scans for Older Adobe Experience Manager Vulnerabilities, (Tue, Sep 19th)

    Adobe Experience Manager (AEM) is a complex enterprise-level content management system built around open-source products like Apache Sling, Jackrabbit/Oak, and Felix. Just last week, Adobe patched another XSS vulnerability in AEM. But the scans we see now target older vulnerabilities, likely a vulnerability 2-3 years old.

  7. New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware

    New and mysterious APT Sandman spotted targeting telcos in Europe and Asia as part of a cyberespionage campaign.

  8. Phone scams conducted using PayPal’s own invoicing service

    Phishing attacks often start with an email or text message that links to a malicious web site designed to steal sensitive information. However, some instead direct recipients to call a phone number. Despite claiming to belong to a legitimate organization these fake phone numbers are controlled by the criminal. Callers can be tricked into sending money, sensitive information, or giving access to online accounts and devices through persuasive social engineering tactics. 

  9. Scam victim loses more than £6,000 after buying an £8 camera on eBay
    eBay item linked to banking malware that hacked the Barclays app
  10. Freecycle Network suffers breach, users told to change passwords

    The Freecycle Network, a group of organisations that allows its members to offer re-usable goods to others free, has been hit by a data breach, according to a statement.

  11. Microsoft exposed 38TB of private data on GitHub: Wiz researchers

    In a blog post on Monday, Wiz researchers Hillai Ben-Sasson and Ronny Greenberg said a disk back-up was among the data exposed and this included secrets, private keys, passwords, and more than 30,000 internal Microsoft Teams messages.

  12. Microsoft leaks Xbox plans along with documents in FTC case
    Microsoft's security reputation has taken another beating, with the company releasing a number of plans for its Xbox gaming platform along with public documents submitted to the court adjudicating a case filed by the FTC over its plans to acquire Activision Blizzard.
  13. Fortinet Patches High-Severity Vulnerabilities in FortiOS, FortiProxy, FortiWeb Products

    Fortinet has released patches for a high-severity cross-site scripting vulnerability impacting its enterprise firewalls and switches.

  14. OT/IoT and OpenTitan, an Open Source Silicon Root of Trust

    A silicon root of trust (S-RoT) is designed to provide security to those parts of a device that can be attacked by a third party. The question remains, however: can the S-RoT itself be attacked?

  15. CISA Aims For More Robust Open Source Software Security for Government and Critical Infrastructure [Ed: CISA, like NIST, actually strives for back doors in things (so long as it controls these)]
    The agency’s roadmap outlines a plan for prioritizing where open source software makes infrastructure potentially vulnerable.

Other Recent Techrights' Posts

[Meme] One Person, Singular Pronoun
Abusing people into abusing the English language is very poor diplomacy
New Article From Richard Stallman Explains Why He Says He and She for Unknown Person (Not 'They')
"Nowadays I use gender-neutral singular pronouns for a person whose gender I don't know"
Lookout, It's Outlook
Outlook is all about the sharing!
Updated A Month Ago: Richard Stallman on Software Patents as Obstacles to Software Development
very recent update
Is BlueMail a Client of ZDNet Now?
Let's examine what BlueMail does to promote itself
Site Priorities and Upcoming Improvements
pages are served very fast
Ending Software Patents in Recent Years (Software Freedom Fighters MIA)
not a resolved issue
IRC Proceedings: Wednesday, November 29, 2023
IRC logs for Wednesday, November 29, 2023
Over at Tux Machines...
GNU/Linux news
Links 30/11/2023: Rushing Patent Cases With Shorter Trial Scheme (STS), Sanctions Not Working
Links for the day
Links 30/11/2023: Google Purging Many Accounts and Content (to Save Money), Finland Fully Seals Border With Russia
Links for the day
The 'Smart' Attack on Power Grid Neutrality (or the Wet Dream of Tiered Pricing for Power, Essentially Punishing Poorer Households for Exercising Freedom Like Richer Households)
The dishonest marketing people tell us the age of disservice and discrimination is all about "smart" and "Hey Hi" (AI) as in algorithms akin to traffic-shaping in the context of network neutrality
Links 29/11/2023: VMware Layoffs and Too Many Microsofters Going Inside Google
Links for the day
Just What LINUX.COM Needed After Over a Month of Inactivity: SPAM SPAM SPAM (Linux Brand as a Spamfarm)
It's not even about Linux
Microsoft “Discriminated Based on Sexuality”
Relevant, as they love lecturing us on "diversity" and "inclusion"...
IRC Proceedings: Tuesday, November 28, 2023
IRC logs for Tuesday, November 28, 2023
Media Cannot Tell the Difference Between Microsoft and Iran
a platform with back doors
Links 28/11/2023: New Zealand's Big Tobacco Pivot and Google Mass-Deleting Accounts
Links for the day
Justice is Still the Main Goal
The skulduggery seems to implicate not only Microsoft
OpenBSD Says That Even on Linux, Wayland Still Has a Number of Rough Edges (But IBM Wants to Make X Extinct)
IBM tries to impose unready software on users
[Teaser] Next Week's Part in the Series About Anti-Free Software Militants
an effort to 'cancel' us and spy on us
Over at Tux Machines...
GNU/Linux news
This work is licensed under a Creative Commons Attribution 4.0 International License
Professor Eben Moglen on How Social Control Media Metabolises Humans and Constraints Freedom of Thought
Nothing of value would be lost if all these data-harvesting giants (profiling people) vanished overnight
IRC Proceedings: Monday, November 27, 2023
IRC logs for Monday, November 27, 2023
When Microsoft Blocks Your Access to Free Software
"Linux is a cancer that attaches itself in an intellectual property sense to everything it touches." [Chicago Sun-Times]
Techrights Statement on 'Cancel Culture' Going Out of Control
relates to a discussion we had in IRC last night
Stuff People Write About Linux
revisionist pieces
Links 28/11/2023: Rosy Crow 1.4.3 and Google Drive Data Loss
Links for the day