RISKS-LIST: Risks-Forum Digest Thursday 19 May 2022 Volume 33 : Issue 22

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/33.22>
The current issue can also be found at
<http://www.csl.sri.com/users/risko/risks.txt>

Contents:
Researchers Find Potential Way to Run Malware on iPhone Even When it's OFF
(The Hacker News)
PDF election ballots (Andrew Appel)
New Bluetooth Hack Could Let Attackers Remotely Unlock Smart Locks and Cars
(The Hacker News)
When Your Smart ID Card Reader Comes With Malware (KrebsOnSecurity)
Sadly, this food delivery robot got caught on the tracks while trying to
cross (Twitter)
Two-Card Monte: Why Mastercard And Visa Rarely Shut Down Scammers Who Are
Ripping Off Consumers (Buzzfeed News)
Crypto meltdown highlights need for urgent regulatory intervention
(Dave Farber)
Eavesdroppers Can Hack 6G Frequency with DIY Metasurface (Jake Boyd)
China's Internet Censors Try a New Trick: Revealing Users' Locations?
(NYTimes)
Exposure through identity verification? (Geoff Keunning)
463 people's COVID benefits accidentally sent to one of them (Mark Brader)
Zero-trust security: Assume everyone on the Internet is out to get you --
and already has (techxplore)
DOJ says it will no longer prosecute good-faith hackers under CFAA
(TechCrunch)
Selfies Further Endanger Rare Phallic Plant, Conservationists Fear
(Richard C. Paddock)
Artificial Intelligence (Colbert/Gervais via Lauren Weinstein)
Re: Companies envision taxis flying above jammed traffic (Martin Ward,
John Levine, Barry Gold)
Re: Finding it hard to get a new job? Robot recruiters might be to blame
(Amos Shapir)
Abridged info on RISKS (comp.risks)

----------------------------------------------------------------------

Date: Tue, 17 May 2022 18:00:14 -1000
From: geoff goodfellow <geoff@iconia.com>
Subject: Researchers Find Potential Way to Run Malware on iPhone Even When
it's OFF (The Hacker News)

A first-of-its-kind security analysis of iOS Find My function has identified
a novel attack surface that makes it possible to tamper with the firmware
and load malware onto a Bluetooth chip that's executed while an iPhone is
"off."

The mechanism takes advantage of the fact that wireless chips related to
Bluetooth, Near-field communication (NFC
<https://en.wikipedia.org/wiki/Near-field_communication>), and
ultra-wideband (UWB <https://en.wikipedia.org/wiki/Ultra-wideband>) continue
to operate while iOS is shut down when entering a "power reserve" Low Power
Mode (LPM).

While this is done so as to enable features like Find My
<https://thehackernews.com/2022/02/experts-create-apple-airtag-clone-that.html>
and facilitate Express Card transactions
<https://support.apple.com/en-us/guide/security/sec90cd29d1f/web>, all the
three wireless chips have direct access to the secure element, academics
from the Secure Mobile Networking Lab (SEEMOO
<https://www.seemoo.tu-darmstadt.de/>) at the Technical University of
Darmstadt said <https://arxiv.org/pdf/2205.06114.pdf> in a paper entitled
"Evil Never Sleeps."

"The Bluetooth and UWB chips are hardwired to the Secure Element (SE) in
the NFC chip, storing secrets that should be available in LPM," the
researchers said.

"Since LPM support is implemented in hardware, it cannot be removed by
changing software components. As a result, on modern iPhones, wireless
chips can no longer be trusted to be turned off after shutdown. This poses
a new threat model."

The findings are set to be *presented*
<https://wisec2022.cs.utsa.edu/accepted-papers/> at the ACM Conference on
Security and Privacy in Wireless and Mobile Networks (WiSec 2022) this
week. [...]

https://thehackernews.com/2022/05/researchers-find-way-to-run-malware-on.html

------------------------------

Date: Thu, 19 May 2022 13:48:37 PDT
From: Peter Neumann <neumann@csl.sri.com>
Subject: PDF election ballots

Andrew Appel:

A PDF File Is Not Paper, So PDF Ballots Cannot Be Verified

https://freedom-to-tinker.com/2022/05/19/a-pdf-file-is-not-paper-so-pdf-ballots-cannot-be-verified/

[PDF is an executable language. Ballots can also be altered -- or indeed
executed, as seems to happens to certain disfavored candidates in certain
countries. PGN]

------------------------------

Date: Thu, 19 May 2022 10:08:46 -1000
From: geoff goodfellow <geoff@iconia.com>
Subject: New Bluetooth Hack Could Let Attackers Remotely Unlock Smart
Locks and Cars (The Hacker News)

A novel Bluetooth relay attack can let cybercriminals more easily than ever
remotely unlock and operate cars, break open residential smart locks, and
breach secure areas.

"An attacker can falsely indicate the proximity of Bluetooth LE (BLE)
devices to one another through the use of a relay attack," UK-based
cybersecurity company NCC Group said. "This may enable unauthorized access
to devices in BLE-based proximity authentication systems."

Relay attacks <https://en.wikipedia.org/wiki/Relay_attack>, also called
two-thief attacks, are a variation of person-in-the-middle attacks in which
an adversary intercepts communication between two parties, one of whom is
also an attacker, and then relays it to the target device without any
manipulation.

While various mitigations have been implemented to prevent relay attacks,
including imposing response time limits during data exchange between any
two devices communicating over BLE and triangulation-based localization
techniques, the new relay attack can bypass these measures. [...]

https://thehackernews.com/2022/05/new-bluetooth-hack-could-let-attackers.html
https://research.nccgroup.com/2022/05/15/technical-advisory-tesla-ble-phone-as-a-key-passive-entry-vulnerable-to-relay-attacks/
https://research.nccgroup.com/2022/05/15/technical-advisory-kwikset-weiser-ble-proximity-authentication-in-kevo-smart-locks-vulnerable-to-relay-attacks/
https://research.nccgroup.com/2022/05/15/technical-advisory-ble-proximity-authentication-vulnerable-to-relay-attacks/

[Tom Van Vleck noted:
New Bluetooth hack can unlock your Tesla -- and all kinds of other devices
The comments are really funny.
https://arstechnica.com/information-technology/2022/05/new-bluetooth-hack-can-unlock-your-tesla-and-all-kinds-of-other-devices/
PGN]

------------------------------

Date: Tue, 17 May 2022 17:14:53 -1000
From: geoff goodfellow <geoff@iconia.com>
Subject: When Your Smart ID Card Reader Comes With Malware (KrebsOnSecurity)

Millions of U.S. government employees and contractors have been issued a
secure smart ID card that enables physical access to buildings and
controlled spaces, and provides access to government computer networks and
systems at the cardholder's appropriate security level. But many government
employees aren't issued an approved card reader device that lets them use
these cards at home or remotely, and so turn to low-cost readers they find
online. What could go wrong? Here's one example. [...]

https://krebsonsecurity.com/2022/05/when-your-smart-id-card-reader-comes-with-malware/

------------------------------

Date: Wed, 18 May 2022 11:16:05 -1000
From: geoff goodfellow <geoff@iconia.com>
Subject: Sadly, this food delivery robot got caught on the tracks while
trying to cross (Twitter)

https://twitter.com/tulipsmg/status/1525976684998144005

[Gee whiz. Two different food-delivery robots in successive issues. This
one should be in a Train "sears robot catalog", because it caught fire.
(Funny only if you are my age, perhaps.) PGN]

------------------------------

Date: Wed, 18 May 2022 16:08:50 -0400
From: Monty Solomon <monty@roscom.com>
Subject: Two-Card Monte: Why Mastercard And Visa Rarely Shut Down Scammers
Who Are Ripping Off Consumers (Buzzfeed News)

The global credit-card rivals maintain a strikingly permissive relationship
with companies that have been accused of fraud. For one of Mastercard' top
executives, that relationship went even further. A BuzzFeed News
investigation.

https://www.buzzfeednews.com/article/rosalindadams/mastercard-visa-fraud

------------------------------

Date: Fri, 20 May 2022 06:32:12 +0900
From: Dave Farber <farber@keio.jp>
Subject: Crypto meltdown highlights need for urgent regulatory intervention

>From an OPED in Nikkei Asia 5/20 by David Farber and Dan Gilmor

You have to feel a twinge of sympathy for the people who "invested" their
savings in cryptocurrencies during the past few months and who subsequently
lost most or all of their money when the cryptocurrency marketplace
collapsed during the past several weeks.

The words "invested" is in quotes for a reason. This bubble was a classic in
the genre, and the people who are collectively losing the most money are
low-information gamblers, not investors, just as they are when every
economic bubble deflates.