Tag Archive for: conduit

GPS Tracker Made in China Conduit for Vehicle Hacking

/in


6 Vulnerabilities Detected With No Available Patch

Prajeet Nair (@prajeetspeaks) •
July 19, 2022    

GPS Tracker Made in China Conduit for Vehicle Hacking

Severe vulnerabilities in a popular GPS tracking device made in China could allow hackers to remotely surveil vehicles’ locations and shut down their engines, say security researchers in a warning echoed by the U.S. government.

See Also: OnDemand | Zero Tolerance: Controlling The Landscape Where You’ll Meet Your Adversaries

Cybersecurity firm BitSight says it uncovered six vulnerabilities in a hard-wired GPS tracker made by MiCODUS. Boston-based BitSight estimates there are 1.5 million active tracking devices made by the Shenzen-based manufacturer deployed across the globe that are used by 420,000 different customers in more than 160 countries.

Organizations identified by BitSight as using trackers include a Fortune 50 energy company, a national military in South America, a nuclear power plant operator and a state on the east coast of the United States.

“If China can remotely control vehicles in the United States, we have a problem,” said Richard Clarke, a former presidential adviser on cybersecurity.

The firm estimates Russia is the country with the greatest number of vulnerable devices and in the top three of countries with the most users.

The vulnerabilities include a hard-wired master password and vulnerability to SMS-based commands that can be executed without authentication. There are no patches, leading the U.S. Cybersecurity and Infrastructure Security Agency to advise that the trackers be isolated from internet connectivity. The agency is not aware of any active exploitation of the vulnerabilities.

MiCODUS is a maker of automotive tracking devices designed for vehicle fleet management and theft protection for consumers and organizations. It did not immediately respond to a request for comment.

The company’s MV720 model – the subject of the BitSight and CISA advisory – supports all vehicles and has a function to cut off fuel supply, according to its

Source…

Ask.com serves as a conduit for malware – again

/in

Businesses that allow the Ask.com toolbar in their environments might want to rethink that after endpoints equipped with the browser add-on were compromised last November and then again the very next month using pretty much the same attack methods.

In both cases attackers managed to infiltrate the Ask.com updater infrastructure to the point that they used legitimate Ask signing certificates to authenticate malware that was masquerading as software updates.

And in both cases Ask Partner Network (APN), which distributes the Ask.com toolbar, told the security vendors who discovered the incidents that it had fixed the problem. The first one was discovered by security vendor Red Canary, and the second was caught by Carbon Black, whose researchers just wrote about it in their company blog.

To read this article in full or to leave a comment, please click here

Network World Tim Greene

Attacks to make Ask.com Toolbar a conduit for malware are nipped in the bud

/in

Attackers who were trying to turn the Ask.com Toolbar into a malware dispensary got caught early on when their scheme was picked up by security services that were looking for anomalies.

The malicious actors are unknown but they managed to get the legitimate Ask.com toolbar update feature to place a dropper/uploader into the browsers of several customers of security firm Red Canary.

Once installed, the dropper would bring in secondary malware including banking Trojans and other online-fraud code, says Keith McCammon, CSO of Red Canary. The secondary payloads varied, and some of the dozen or so compromised machines his team found had downloaded more than one kind, he says.

To read this article in full or to leave a comment, please click here

Network World Tim Greene