Connect with us

US company sells iOS exploit to UAE government

Published

on

Although Apple patched the vulnerability this week, the exploit was created for it five years ago.

No sooner had the Pegasus spyware scandal by the Israeli NSO Group abated than news of another spyware developed by an American company and sold to the UAE hit iPhone owners. As a result, Apple was forced to release an unexpected emergency update to iOS 14.8, which fixes an actively exploited vulnerability in iMessage.

Although a fix was released this week, the exploit for the vulnerability was developed five years ago, according to MIT Technology Review. Moreover, the tool was created by the American company Accuvant (now part of the larger Optiv company), which sold it to the UAE government for $ 1.3 million in 2016.

An exploit for an iMessage vulnerability allows attackers to take full control of the iPhone. The tool was used in attacks on hundreds of activists, journalists and oppositionists as part of a large-scale espionage operation.

New documents from the US Department of Justice shed light on who was involved in the development of the exploit, but do not say anything about who exactly closed the sale and purchase transaction.

As SecurityLab previously reported, three former US National Security Agency employees, Marc Baier, Ryan Adams, and Daniel Gericke, were involved in the development and deployment of the exploit. The US Department of Justice accused them of violating US export control laws, according to which companies and individuals must obtain permission before providing defense-related services to foreign governments. The defendants agreed to pay a $ 1.68 million fine.

In the case of the Pegasus spyware, it was very easy to find a scapegoat, which turned out to be its developer, the Israeli company NSO Group. But the fact that not just any, but an American company created and sold an exploit for hacking iMessage should seriously concern iPhone owners.

According to representatives of the Optiv company, it fully cooperates with the US Department of Justice and is not the subject of an investigation.

Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Security

Facebook Papers Sheds Light on Social Media Moderation Issues

Published

on

The media, to which the company’s internal documents were leaked, claim that the company prioritizes profits over users.

The so-called Facebook Papers (an array of documents released to the public by former Facebook product director Francis Haugen) shed light on the problems with content moderation and the fight against disinformation on the platform. Major media outlets to which Haugen handed the documents, including Reuters, Bloomberg and The Washington Post, argue that the company prioritizes profit over user safety, although Facebook employees have repeatedly warned it of the potential risks.

For example, The Washington Post accuses Facebook head Mark Zuckerberg of downplaying the importance of reports that the site contributed to incitement to hatred, while addressing the US Congress. According to the newspaper, Zuckerberg knew that the problem was actually much more serious than it was reported to the public.

According to internal company documents, the platform removes less than 5% of hateful posts, and senior management (including Zuckerberg) was well aware of the platform dividing people into opposing camps. Facebook denies the allegations and claims its internal documents were misinterpreted.

Zuckerberg is also allegedly responsible for the decision not to suppress misinformation about COVID-19 in the early stages of the pandemic, as there could be a “significant trade-off with the influence of MSI” (meaningful social interaction – an internal Facebook metric). Facebook denies this, claiming that the documents have been misunderstood.

In turn, the news agency Reuters accused Facebook of regularly neglecting developing countries, which were allowed to publish publications inciting hatred and calling for extremist action. In other words, the company did not hire enough moderators with knowledge of the language and culture of these countries to effectively remove such content. Instead, it unjustifiably relied on its automatic moderation systems, which are ineffective in non-English-speaking countries. Again, Facebook denies these allegations.

According to reports from The New York Times, Facebook was well aware that the “Like” and “Share” functions (key elements of the social network) contributed to the spread of hate speech. As stated in a document titled “What Is Collateral Damage”, Facebook’s failure to address this issue will ultimately result in the company “actively (not necessarily knowingly) promoting such activity.” Again, Facebook claims the document was misinterpreted because the company would not harm its users.

Continue Reading

Security

Discourse team has released an urgent patch to fix a critical vulnerability

Published

on

The vulnerability allows remote code execution using a specially crafted request.

Discourse Development Team let out steele update to address a remote code execution vulnerability in the platform.

Discourse is a popular open source Internet forum and mailing list management software with a client base of over 2,000 customers, including Amazon Seller Central, which has a monthly audience of 30 million users.

The vulnerability (CVE-2021-41163) is a validation error in the aws-sdk-sns gem upstream stream that can be exploited to remotely execute code using a specially crafted request. The highest severity vulnerability (CVSS 10) exists due to a lack of validation in the subscribe_url values.

The issue was fixed in Discourse 2.7.9 (stable) and 2.8.0.beta7. The Discourse team did not provide full information about the problem, but the information security expert who discovered the vulnerability, known as joernchen, published some details about her.

Developers are advised to upgrade to Discourse 2.7.9 and higher as soon as possible, and if this is not yet possible, apply protective measures, in particular, block requests containing the / webhooks / aws path at the upstream proxy level.

Continue Reading

Security

The skimmer on the SCUF Gaming website stole the data of 33 thousand bank cards

Published

on

The company warned its customers about possible suspicious activity with their bank cards.

Major manufacturer of custom gaming PCs and console controllers SCUF Gaming International notified its users that in February of this year, attackers hacked into his website and introduced a malicious script that steals bank card data.

SCUF Gaming users have fallen prey to web skimming, also known as e-skimming, digital skimming, or the Magecart attack. In the course of such attacks, attackers inject JavaScript scripts (so-called skimmers or Magecart scripts) into compromised online stores, which allow them to collect and steal payment and personal data of customers. Typically, the stolen information is then sold on hacking or carding forums or used for fraudulent purposes.

In this case, the script was injected into the online store SCUF Gaming after hackers gained access to the company’s backend server on February 3 using credentials belonging to a third-party vendor. Three weeks later, on February 18, the payment processor notified SCUF Gaming of unusual activity related to in-store credit cards. A month later, a skimmer was discovered on the site, which was subsequently removed.

“The investigation found that orders processed through PayPal were not compromised, and the incident is limited to payments and attempted payments using credit cards between February 3 and March 16,” the company said in a notice sent to affected users.

According to the notification, the names and surnames of cardholders, their email and billing addresses, card numbers, their expiration dates and CVVs could have been compromised.

The notification did not indicate the number of victims, but a letter to the attorney general says that the incident affected 32,645 people.

“This notification does not mean that fraud with your account has already taken place. You should monitor your account and notify the card issuer of any unusual or suspicious activity. As a precautionary measure, we recommend that you request a new payment card number from the issuer,” the notification says …

Continue Reading

Most Popular