Security Leftovers

posted by Roy Schestowitz on Aug 11, 2023

• UK election admin agency breach exposed personal information of tens of millions voters

  The voter registries were accessed over a period of more than a year, the agency said.

• How an unpatched Microsoft Exchange 0-day likely caused one of the UK’s biggest hacks ever

  It’s looking more and more likely that a critical zero-day vulnerability that went unfixed for more than a month in Microsoft Exchange was the cause...

• Intel Downfall (Gather Data Sampling) vulnerability impacts AVX2/AVX-512 workloads

  After vulnerabilities like Spectre and Meltdown were discovered in 2018, Intel processors have more vulnerabilities with the Downfall attacks that target the Gather instruction part of AVX2/AVX-512 and impact 6th generation Skylake up to 11th generation Tiger Lake processors introduced as far back as 2014. It does not affect more recent processors, and as somebody who has just purchased a laptop based on a 13th Raptor Lake processor, I guess I can breathe a sigh of relief until the next vulnerability is discovered, but people using hardware with older Intel processors will have to update the OS and suffer from a performance impact, at least for tasks leveraging AVX2 or AVX-512.

• Cryptographic Flaw in Libbitcoin Explorer Cryptocurrency Wallet

  Cryptographic flaws still matter. Here’s a flaw in the random-number generator used to create private keys. The seed has only 32 bits of entropy.

  Seems like this flaw is being exploited in the wild.

• Using Machine Learning to Detect Keystrokes

  Researchers have trained a ML model to detect keystrokes by sound with 95% accuracy.

  “A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards”

  Abstract: With recent developments in deep learning, the ubiquity of microphones and the rise in online services via personal devices, acoustic side channel attacks present a greater threat to keyboards than ever. This paper presents a practical implementation of a state-of-the-art deep learning model in order to classify laptop keystrokes, using a smartphone integrated microphone. When trained on keystrokes recorded by a nearby phone, the classifier achieved an accuracy of 95%, the highest accuracy seen without the use of a language model. When trained on keystrokes recorded using the video-conferencing software Zoom, an accuracy of 93% was achieved, a new best for the medium. Our results prove the practicality of these side channel attacks via off-the-shelf equipment and algorithms. We discuss a series of mitigation methods to protect users against these series of attacks...