enter image description here


With the onslaught of embedded devices hitting the streets, we see such devices with the operating system, hardware interfaces, and user-facing applications baked into a single blob called firmware. Trick the firmware and you have access to the whole system. Here at Black Hat, there are a lot of people doing just that.

Lately, these entire systems are being compromised for use in all kinds of attacks, like botnets, redirection or amplification attacks, and rogue beachheads from which to pivot to new attacks.

But with the fire-and-forget approach to hardware from many vendors, especially IoT vendors, the patch cycle is unpredictable at best, and possibly non-existent. That gives rise to rogue actors packaging firmware “upgrades” for your device that may have nasty code wrapped in them, but otherwise perform as you would expect, so you’d be upgrading your way to getting hacked.

There are tools to verify the firmware you download is legitimate, but often this is the realm of the professional IT person, not the millions of people who just rely on search results to pick their download site, and get more than they bargained for in the process.

No? Ask your friends how they would validate firmware for a router using a checksum provided by a vendor. If you’re here at Black Hat, maybe, but the other 99% of the users would be in the dark. But firmware is starting to run everything, as we relegate the myriad of daily duties like house security, alarms, security cameras and the like to these firmware-toting devices. So not only would we need to verify the legitimacy of firmware, but we’d also need to do it for each of the new gadgets we use. That just won’t happen in a practical way.

And your friends probably won’t, but if they do ask for advice, the best you can offer is to keep up with firmware updates in the first place, and help them figure out how to update their devices. The next is to convince them to only download firmware from the manufacturer’s website. There are many fake download sites that bundle your download with junkware by optimizing search terms so they pop up high in the rankings above the manufacture’s website, bundling things like download management software along with the files you really need. While your friends may never learn to code assembly or dig into the bits and bytes, they will need to start putting firmware security in the forefront as the new platforms that need to be maintained.

Meanwhile, here at Black Hat there are new tools released attempting to break firmware. As the tools become more widely available, and trained on new devices, they will become more effective.

Also, since many examples of firmware use a relatively stable operating system as the foundation, if any exploits are released against the underlying operating system itself, the whole firmware stack becomes unstable.

Luckily, there are hardware vendors who are busy baking in security checks to attest to the authenticity of any firmware to be loaded on the device, embedding a sort of “signature” for acceptable firmware releases that are authorized to run. It’s a positive step, and one that will continue to increase in popularity as firmware blankets the globe on new tiny devices. Meanwhile, you need to have a firmware plan.

Reference: https://www.welivesecurity.com

enter image description here


Hackers are a scary bunch—whether working as part of a criminal syndicate or an idealist with a political agenda, they’ve got the knowledge and the power to access your most precious data. If hackers want to target a particular company, for example, they can find vast amounts of information on that company just by searching the web. They can then use that info to exploit weaknesses in the company’s security, which in turn puts the data you’ve entrusted to that company in jeopardy.

Think of your home computer as a company. What can you do to protect it against hackers? Instead of sitting back and waiting to get infected, why not arm yourself and fight back?

Bad guys, beware. We’ve got 10 ways to beat you.

  1. Update your OS and other software frequently, if not automatically. This keeps hackers from accessing your computer through vulnerabilities in outdated programs. For extra protection, enable Microsoft product updates so that the Office Suite will be updated at the same time. Consider retiring particularly susceptible software such as Java or Flash.

  2. Download up-to-date security programs, including antivirus and anti-malware software, anti-spyware, and a firewall (if your OS didn’t come pre-packaged with it). To trick even the most villainous hackers, consider investing in anti-exploit technology, such as Malwarebytes Anti-Exploit, so you can stop attacks before they happen.

  3. Destroy all traces of your personal info on hardware you plan on selling. Consider using d-ban to erase your hard drive. For those looking to pillage your recycled devices, this makes information much more difficult to recover. If the information you’d like to protect is critical enough, the best tool for the job is a chainsaw.

  4. Do not use open wifi; it makes it too easy for hackers to steal your connection and download illegal files. Protect your wifi with an encrypted password, and consider refreshing your equipment every few years. Some routers have vulnerabilities that are never patched. Newer routers allow you to provide guests with segregated wireless access. Plus, they make frequent password changes easier.

  5. Speaking of passwords: password protect all of your devices, including your desktop, laptop, phone, smartwatch, tablet, camera, lawnmower…you get the idea. The ubiquity of mobile devices makes them especially vulnerable. Lock your phone and make the timeout fairly short. Use fingerprint lock for the iPhone and passkey or swipe for Android. “It’s easy to forget that mobile devices are essentially small computers that just happen to fit in your pocket and can be used as a phone,” says Jean-Philippe Taggart, Senior Security Researcher at Malwarebytes. “Your mobile device contains a veritable treasure trove of personal information and, once unlocked, can lead to devastating consequences.”

  6. Sensing a pattern here? Create difficult passwords and change them frequently. In addition, never use the same passwords across multiple services. If that’s as painful as a stake to a vampire’s heart, use a password manager like LastPass. For extra hacker protectant, ask about two-step authentication. Several services have only recently started to offer two-factor authentication, and they require the user to initiate the process. Trust us, the extra friction is worth it. Two-factor authentication makes taking over an account that much more difficult, and on the flip side, much easier to reclaim should the worst happen.

  7. Come up with creative answers for your security questions. People can now figure out your mother’s maiden name or where you graduated from high school with a simple Google search. Consider answering like a crazy person. If Bank of America asks, “What was the name of your first boyfriend/girlfriend?” reply “your mom.” Just don’t forget that’s how you answered when they ask you again.

  8. Practice smart surfing and emailing. Phishing campaigns still exist, but hackers have become much cleverer than that Nigerian prince who needs your money. Hover over links to see the actual email address from which the email was sent. Is it really from the person or company claiming to send them? If you’re not sure, pay attention to awkward sentence construction and formatting. If something still seems fishy, do a quick search on the Internet for the subject line. Others may have been scammed and posted about it online.

  9. Don’t link accounts. If you want to comment on an article and you’re prompted to sign in with Twitter or Facebook, do not go behind the door. “Convenience always lessens your security posture,” says Taggart. “Linking accounts allows services to acquire a staggering amount of personal information.”

  10. Keep sensitive data off the cloud. “No matter which way you cut it, data stored on the cloud doesn’t belong to you,” says Taggart. “There are very few cloud storage solutions that offer encryption for ‘data at rest.’ Use the cloud accordingly. If it’s important, don’t.”

Honorable mention: Alarmist webpages announcing that there are “critical errors” on your computer are lies. Microsoft will never contact you in person to remove threats. These messages come from scammers, and if you allow them to remotely connect to your computer, they could try to steal your information and your money. If that’s not a Nightmare on Elm Street, then we don’t know what is.

enter image description here


WannaCry encrypts your files and demands payment to regain access. Malicious software or "ransomware" has been used in a massive hacking attack, affecting tens of thousands of computers worldwide. Software security companies said a ransomware worm called "WannaCry" infected about 200,000 computer systems in 150 countries on Friday, with Russia, Ukraine, and Ta iwan being the top targets. The hack forced British hospitals to turn away patients, affected Spanish companies such as Telefonica, and threw other government agencies and businesses into chaos. Cyber security researchers from Symantec and Kaspersky Lab have said that some code in an earlier version of the WannaCry software had appeared in programmes used by the Lazarus Group, which researchers from many companies have identified as a North Korea-run hacking operation.

How it works: WannaCry is a form of ransomware that locks up files on your computer and encrypts them in a way that you cannot access them anymore. It targets Microsoft's widely used Windows operating system.

When a system is infected, a pop-up window appears with instructions on how to pay a ransom amount of $300. The pop-up also features two countdown clocks; one showing a three-day deadline before the ransom amount doubles to $600; another showing a deadline of when the target will lose its data forever. Payment is only accepted in bitcoin. The ransomware's name is WCry, but analysts are also using variants such as WannaCry. A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the US' National Security Agency (NSA), according cyber-security providers.

How it spreads: Ransomware is a programme that gets into your computer, either by clicking or downloading malicious files. It then holds your data as ransom. Some security researchers say the infections in the case of WannaCry seem to be deployed via a worm, spreading by itself within a network rather than relying on humans to spread it by clicking on an infected attachment.

The programme encrypts your files and demands payment in order to regain access. Security experts warn there is no guarantee that access will be granted after payment. Some forms of ransomware execute programmes that can lock your computer entirely, only showing a message to make payment in order to log in again. Others create pop-ups that are difficult or impossible to close, rendering the machine difficult or impossible to use. What can you do to prevent infection: According to Microsoft's Malware Protection Center, here are the steps you should take to protect yourself against ransomware:

  • Install and use an up-to-date antivirus solution (such as Microsoft Security Essentials)
  • Make sure your software is up-to-date
  • Avoid clicking on links or opening attachments or emails from people you don't know or companies you don't do business with
  • Ensure you have smart screen (in Internet Explorer) turned on, which helps identify reported phishing and malware websites and helps you make informed decisions about downloads
  • Have a pop-up blocker running on your web browser
  • Regularly backup your important files