Risky Business #770 -- A Russian IR guy discovers extremely cool spookware
Nov 13, 2024
auto_awesome
Chris Tarbell, a former FBI agent famed for his role in the Silk Road case, shares dramatic insights into combating cybercrime. He discusses the complexities of Ross Ulbricht’s story and the potential implications of a changing political landscape. Feross Aboukhadijeh, founder of Socket.dev, argues for a centralized tracking system for supply chain attacks, highlighting vulnerabilities in software ecosystems. The conversation delves into Apple’s new security feature limiting law enforcement access and the ongoing evolution of cybersecurity challenges in today’s digital landscape.
Apple's new iOS feature complicates law enforcement's access to data, highlighting tensions between privacy and criminal investigations.
The rise in zero-day vulnerabilities reflects a critical need for enhanced security in enterprise software and edge devices.
Chris Tarbell's insights on Ross Ulbricht's case raise essential questions about justice, online criminality, and societal perceptions of drug policy.
Deep dives
iOS 18.1's New Security Feature
iOS 18.1 introduces a security feature that causes a phone to reboot if it remains unlocked for 72 hours, entering a 'before first unlock' state, which complicates law enforcement's ability to access seized devices. This change has created significant friction between Apple and law enforcement agencies, who previously established methods for accessing data through various exploits or waiting for unlock techniques. The implications of this feature are particularly pronounced in democratic countries, where law enforcement is bound by rules, in contrast to authoritarian regimes where harsher methods may be employed to extract information from individuals. Apple's continued commitment to user privacy may further strain its relationship with law enforcement agencies looking to maintain access to critical data.
Rise of Oday Vulnerabilities
Recent statistics from Sysa highlight a growing trend in the exploitation of vulnerabilities, indicating that two-thirds of the most frequently exploited vulnerabilities last year were Oday vulnerabilities, affecting enterprise software technologies. This shift underscores the importance of securing edge devices, such as VPNs and file transfer appliances, which are increasingly targeted by attackers. The data confirms an ongoing pivot in the landscape of vulnerabilities, necessitating that vendors of edge equipment take security more seriously. This alarming trend requires heightened vigilance across the tech industry to address the new risks posed by these vulnerabilities.
Malicious Packages and Supply Chain Security
The discussion around software supply chain security emphasizes the pressing issue of malicious packages introduced into ecosystems such as NPM and RubyGems. Feroz Aboukadije from Socket explains how they detect numerous supply chain attacks weekly but also highlights the inadequacies in how these threats are communicated to the broader community. He argues for the establishment of a central repository similar to the NVD for tracking bad packages, advocating for more robust reporting and responsiveness mechanisms from registries. The need for better transparency and coordination in addressing supply chain vulnerabilities is critical to protect developers and end-users alike.
Implications of Encrypted Client Hello
Recent reports indicate that both Russia and China have blocked Encrypted Client Hello (ECH), a mechanism that enables users to bypass censorship by concealing the destination server in TLS connections. This move reflects increasing concerns about surveillance and control over internet traffic, as ECH is pivotal in facilitating secure communications that evade state monitoring. Such actions may also signal the potential for ECH to be exploited by cybercriminals, increasing the urgency for organizations to enhance their detection capabilities. The implications of ECH's restrictions could reshape how future cybersecurity measures are implemented, particularly amid rising global surveillance mandates.
Ross Ulbricht's Case and its Political Ramifications
The podcast explores the complexities surrounding Ross Ulbricht's case and the shifting political landscape following his potential release from prison. Advocates claim his extended sentence for operating the Silk Road was excessive, though testimony from former FBI agent Chris Tarbell reminds listeners of the severe implications of Ulbricht's actions, which included orchestrating crimes linked to drug trafficking and murder plots. This mixture of grassroots support and legal reflection poses questions about justice and the evolving understanding of online illicit activities. The conversation reflects broader societal debates over drug policy, criminal justice reform, and the effectiveness of existing law enforcement approaches.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
Apple frustrates law enforcement with iOS auto-reboot
CISA says most KEV vulnerabilities in 2023 were first used as zero days
Russians roll incident response on some sweet Linux spookware
Regular users can create mailboxes in M365?
Tor tracks down the source of its joe-job abuse complaints
And much, much more.
This week’s feature guest is former FBI agent Chris Tarbell, who arrested Silk Road operator Ross Ulbricht way back in 2013. As suggestions swirl that an incoming Trump administration might release Ulbricht, Chris talks about the reality of the Dread Pirate Roberts.
This episode is sponsored by software supply chain security firm Socket.dev. Founder Feross Aboukhadijeh thinks that we need a CVE-like catalogue for supply-chain attacks, and he makes a solid argument.