Security Isn't the Goal of Today's Software and Hardware Products

posted by Roy Schestowitz on Sep 25, 2023,
updated Sep 25, 2023

THE world's governments want power, not security. Security for users would mean these government are unable to find out what citizens are doing. Security is... scary (to a snooping, nosy regime).

Security is not an impossibility, but when regimes generally want to monopolise or hoard power, they'll reserve security for themselves.

In this week's news we have Google itself admitting that Android exploits are already in the wild [1], evidence of China picking on GNU/Linux [2] (not a backdoor), some Linux security tips [3], and evidence of states targeting mobile devices [4-5]. These target proprietary software [6-7], gullible users [8-9], or crooked organisations that cover up what actually happened [10].

Speaking of crooked organisations that cover up what actually happened, there's Microsoft chaos again ("38TB of private data on GitHub" [11] and internal company leaks [12]), showing that Microsoft cannot even secure Microsoft itself. And the media has the nerve to paint Microsoft as an authority on security???

Even today's firewalls turn out to be security holes [13], so buying "security" might in practice weaken actual security. As [14] puts it: "The question remains, however: can the S-RoT itself be attacked?"

Any newly-added layer represents more attack surface. CISA is meanwhile cited by Microsoft-sponsored media as the guardian of security [15], even for "Open Source", but everyone in the security sector knows that CISA has conflicting interests, just like the NSA and NIST. As we noted in the first paragraph, they want to dominate rather than secure. Be sceptical of what they're promising. █

Related/contextual items from the news:

1. Analyzing a Modern In-the-wild Android Exploit

   In December 2022, Google’s Threat Analysis Group (TAG) discovered an in-the-wild exploit chain targeting Samsung Android devices. TAG’s blog post covers the targeting and the actor behind the campaign. This is a technical analysis of the final stage of one of the exploit chains, specifically CVE-2023-0266 (a 0-day in the ALSA compatibility layer) and CVE-2023-26083 (a 0-day in the Mali GPU driver) as well as the techniques used by the attacker to gain kernel arbitrary read/write access.

2. Linux Threat Report: Earth Lusca Deploys Novel SprySOCKS Backdoor in Attacks on Government Entities

   The threat actor Earth Lusca, linked to Chinese state-sponsored hacking groups, has been observed utilizing a new Linux backdoor dubbed SprySOCKS to target government organizations globally. 

3. Securing Your Linux Device: Tools and Tactics

   Explore Linux security strategies, from intrusion detection to password management. Safeguard your Linux device with these tips and reliable tools.

4. PREDATOR IN THE WIRES: Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions

   Between May and September 2023, former Egyptian MP Ahmed Eltantawy was targeted with Cytrox's Predator spyware via links sent on SMS and WhatsApp after Eltantawy publicly stated his plans to run for President in the 2024 Egyptian elections. As Egypt is a known customer of Cytrox's Predator spyware, and the spyware was delivered via network injection from a device located physically inside Egypt, we attribute the attack to the Egyptian government with high confidence.

5. Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones

   Apple has patched 3 zero-day vulnerabilities that have likely been exploited by a spyware vendor to hack iPhones.

6. Obfuscated Scans for Older Adobe Experience Manager Vulnerabilities, (Tue, Sep 19th)

   Adobe Experience Manager (AEM) is a complex enterprise-level content management system built around open-source products like Apache Sling, Jackrabbit/Oak, and Felix. Just last week, Adobe patched another XSS vulnerability in AEM. But the scans we see now target older vulnerabilities, likely a vulnerability 2-3 years old.

7. New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware

   New and mysterious APT Sandman spotted targeting telcos in Europe and Asia as part of a cyberespionage campaign.

8. Phone scams conducted using PayPal’s own invoicing service

   Phishing attacks often start with an email or text message that links to a malicious web site designed to steal sensitive information. However, some instead direct recipients to call a phone number. Despite claiming to belong to a legitimate organization these fake phone numbers are controlled by the criminal. Callers can be tricked into sending money, sensitive information, or giving access to online accounts and devices through persuasive social engineering tactics. 

9. Scam victim loses more than £6,000 after buying an £8 camera on eBay

   eBay item linked to banking malware that hacked the Barclays app

10. Freecycle Network suffers breach, users told to change passwords

    The Freecycle Network, a group of organisations that allows its members to offer re-usable goods to others free, has been hit by a data breach, according to a statement.

11. Microsoft exposed 38TB of private data on GitHub: Wiz researchers

    In a blog post on Monday, Wiz researchers Hillai Ben-Sasson and Ronny Greenberg said a disk back-up was among the data exposed and this included secrets, private keys, passwords, and more than 30,000 internal Microsoft Teams messages.

12. Microsoft leaks Xbox plans along with documents in FTC case

    Microsoft's security reputation has taken another beating, with the company releasing a number of plans for its Xbox gaming platform along with public documents submitted to the court adjudicating a case filed by the FTC over its plans to acquire Activision Blizzard.

13. Fortinet Patches High-Severity Vulnerabilities in FortiOS, FortiProxy, FortiWeb Products

    Fortinet has released patches for a high-severity cross-site scripting vulnerability impacting its enterprise firewalls and switches.

14. OT/IoT and OpenTitan, an Open Source Silicon Root of Trust

    A silicon root of trust (S-RoT) is designed to provide security to those parts of a device that can be attacked by a third party. The question remains, however: can the S-RoT itself be attacked?

15. CISA Aims For More Robust Open Source Software Security for Government and Critical Infrastructure [Ed: CISA, like NIST, actually strives for back doors in things (so long as it controls these)]

    The agency’s roadmap outlines a plan for prioritizing where open source software makes infrastructure potentially vulnerable.