Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile Security

End of Bibblio RCM includes -->
8/21/2017
03:42 PM
Larry Loeb
Larry Loeb
Larry Loeb

Sleepless in Cupertino

A hacker finds the key to Apple's SEP and there's good news in the battle against spear-phishing. Bad news and good to start the week.

Apple gets peeled
Someone named xerub is causing some sleepless nights in Cupertino. What s/he has done is publish the key used for the iPhone’s Secure Enclave Processor’s (SEP) firmware.

SEP is a coprocessor inside the iPhone that is a barrier around some of the security functions like TouchID. These functions are directly controlled by the SEP itself. What has been published is the key to obscuring the SEP’s firmware in iOS, an extra step in the security fabric that was used to slow down attackers.

While this obscurity removal will make it somewhat easier to understand what goes on inside of the SEP, the takeaway here is that the functionality of SEP will not be affected by this key.

Someone may someday use this to make some sort of SEP exploit, but that day has not come. Ignore the pundits saying how this will now make iOS unsafe to use. It still works fine. And who knows, Apple may end up changing that SEP key in some way so that what has been published will become irrelevant.

The really interesting thing here is that this is a direct attack on the cryptology front door of a security solution. Attacks usually go around that front door and try to break a window because its easier to do. How the key was obtained, how that cryptology was compromised is the really important and underlying question. If it can be done on this sort of computationally intensive problem, what else can be done?

It will be more than interesting to see if the answer to that appears as time goes on.

Some good news
Researchers from the University of California, Berkeley, and the Lawrence Berkeley National Laboratory have come up with a way to set up an automated warning system about spearfishing email attacks.

In fact, it was so good that Facebook paid them $100,000 and gave them the 2017 Internet Defense Prize for their work.

Their paper on the system was presented at this week’s USENIX Security Symposium in Vancouver. It combines a new non-parametric anomaly scoring technique for ranking security alerts along with an analysis of what is inside of spear-phishing emails.

They looked at 4 years of an organization’s emails (370 million of them!) in their research and came up with two key parts: domain reputation features and sender reputation features.

The domain reputation feature looks at links in an email to see if it is a risk. They decided that a URL is risky if , for example, it has not been visited by many organization employees, or even if it has never been visited until very recently.


Want to learn more about the tech and business cases for deploying virtualized solutions in the cable network? Join us in Denver on October 18 for Light Reading's Virtualizing the Cable Architecture event – a free breakfast panel at SCTE/ISBE's Cable-Tec Expo featuring speakers from Comcast and Charter.

The sender reputation looks at identity spoofing in the “From:” header, any very close matches to a previously known senders and suspicious content that may imply immediate action is needed or reference credentials and the like.

All events are evaluated against each other, and the ones that hit the top are referred out to the security team. The advantage of doing things in this manner was is a low false positive rate.

This kind of research points the way to adding automation to the security arena in a meaningful way. Reducing false positives also reduces alert fatigue which may swamp actionable alerts.

The threats we have come of late to accept as normal due to routine communications may be mitigated by applying this kind of new automation tool.

Related posts:

Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-31099
PUBLISHED: 2022-06-27
rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a s...
CVE-2022-31101
PUBLISHED: 2022-06-27
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
CVE-2022-31103
PUBLISHED: 2022-06-27
lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule `@keyframes`. This package is depended on by [react-letter](https://github.com/mat-sz/react-letter),...
CVE-2022-32994
PUBLISHED: 2022-06-27
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.
CVE-2022-32995
PUBLISHED: 2022-06-27
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.