New Episode Alert EP121

What's the deal with "Thunderspy"? 😀

May 19, 2020

Weekly Blaze PodcastEpisode 121May 18, 2020

Thunderbolt FlawsWordPress Plugin VulnerabilitiesPatriot Act Vote

Raise your hand if you think your smartphone is more of a distraction than a convenience. I know I'm raising my hand right now and many of you are probably doing the same. I personally struggle with the constant bombardment of text messages, Facebook and Twitter notifications, and updates from Amazon about every stage of travel that my most recent order is in. I mean, I honestly don't really care if my package is only 10 stops away but thanks for letting me know anyway Amazon. But it's tough to just stop using your phone and it's also a pain to turn off your phone or hide it someplace where you know you won't be able to access it. So here's a better solution, place your phone in a Silent Pocket faraday sleeve which will block all wireless signal making your device completely silent and distraction free on a temporary basis. And right now you can get 15% off of a faraday sleeve or other Silent Pocket products by using discount code "sharedsecurity" during checkout. Visit

and make your smartphone a little less distracting.

Over 90% of individuals show risky behavior in handling potential phishing messages according to Click Armor's free

. This engaging coronavirus edition of CanIBePhished.com can help identify your teams total vulnerability to phishing attacks that exploit the pandemic situation. So test your own vulnerability to phishing attacks for free now at

.

Thunderbolt flaw lets hackers steal your data in 'five minutes'

Wired reported last week that a Dutch researcher has demonstrated that if an attacker has physical access to a PC manufactured before 2019 and it has a Thunderbolt port,

. All of this in about 5 minutes. And you know it's serious when the attack even has a cool name: "Thunderspy" as it's now being called. Thunderbolt ports (which we all know as USB-C) are the

ports on most newer PC's that can not only power your laptop but also transfer data 8x faster than USB 3 and has 4x more video bandwidth than HDMI. Now we've always said that once someone has physical access to your computer, it's pretty much game over to begin with. But this vulnerability is a little different as there is no software fix and the only way to prevent it would be to physically disable the Thunderbolt port completely. Now you also have to open up the back of the laptop with a screwdriver to to attach a device that reprograms the firmware of the Thunderbolt port. So while there is some work here, it's not impossible and if you were a target by say a nation state or perhaps a celebrity, politician or other high-profile person, someone only needs 5 minutes alone with your laptop to steal your data. This is a perfectly plausible attack say if a victim was staying in a hotel room. Oh, what's also interesting is that Apple Mac computers are not vulnerable to this attack.

Now this isn't the first time that Thunderbolt ports have come under fire. Last year a collection of vulnerabilities known as "Thunderclap" showed that plugging a malicious device into a computer's Thunderbolt port can quickly bypass all of its security measures. Intel, who created Thunderbolt technology, released an update to prevent this vulnerability but it's not been fully adopted because many Thunderbolt computers made before 2019 are not compatible with the new protections. This update, called Kernel Direct Memory Access Protection, could also prevent this new attack as well.

So what can you do if you think you may be a target for this attack? Well the researcher has released a tool which can check to see if your PC is vulnerable and what you can do about it. Check out our show notes for a

. And second, consider not leaving your laptop or PC unsecured. Especially if you're traveling. Whenever this whole pandemic blows over. And even though this is a pretty powerful attack, for most of us it's not something we should worry too much about.

WordPress plugin Page Builder by SiteOrigin patched against code execution attacks

Do you run and manage a WordPress site and happen to use a plugin called "Page Builder by SiteOrigin"? If so, did you know that this plugin is currently the most popular page creation plugin for WordPress? In fact, it's actively installed in over one million websites across the world. Well with that type of popularity, it's also become a recent target for attackers with the recent disclosure of several vulnerabilities which can allow attackers to forge requests on behalf of a site administrator and execute malicious code in the administrator's browser. This would lead to an attacker having full access to a WordPress instance and all associated data. Now these flaws, which are known as Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) require a carefully crafted link sent to a victim by an attacker in order to execute the vulnerability. These vulnerabilities are rated critical because of the extreme rise in phishing attacks due to the recent pandemic.

WordPress, which is the most popular open source website software used by bloggers, businesses, and major news corporations like Bloomberg and CBS News, is a hot target for attackers and it's not always the core WordPress software that's the target. It’s the thousands upon thousands of plugins that are what attackers go after. Often times, these plugins are developed with security vulnerabilities and sometimes never fixed or patched. Especially plugins which may be abandoned by developers and no longer supported. So that's why I recommend that if you run a WordPress site, always keep your plugin's up-to-date and check to see if said plugins are still being maintained and updated. And while you're at it, remove any plugins that you may not be using anymore. The good news is that Page Builder by SiteOrigin was quickly patched so if you do use this plugin, be sure you're running the latest version.

.

Senate Votes to Allow FBI to Look at Your Web Browsing History Without a Warrant

While we were all just starting to emerge from our quarantine and stay at home orders across the US, the US Senate last week just narrowly rejected a bipartisan amendment that would have required the government to first obtain a warrant before accessing Americans' web browsing data. This amendment would have required "probably cause" or reasonable justification of a crime to obtain a warrant. This would have been much more than what is currently required under the existing Patriot Act law which allows the mass collection of Americans' browsing data. In typical American fashion the amendment fell short by a single vote and four senators who were expected to vote in favor of the amendment did not vote because they were absent for various reasons.

The vote was focused on controversial Section 215 within the Patriot Act which allows broad powers for the government to collect any quote "tangible thing" from libraries and other businesses as long as its relevant to a national security inquiry. This amendment is just one of several other reforms to the governments surveillance powers, which including Section 215, expired in March. The US Senate is expected to vote on a final bill later this week. One of the amendments sponsors, Senator Ron Wyden, said in a speech given to the senate floor quote "Right now, the government can collect web browsing and internet search history without a warrant under Section 215 of the Patriot Act. Section 215 is the most controversial and dangerous provision of [the Foreign Intelligence Surveillance Act]. That’s because it is so vague and so broad. Under Section 215, the government can collect just about anything so long as it is relevant to an investigation. This can include the private records of innocent, law-abiding Americans. They don’t have to have done anything wrong. They don’t have to be suspected of anything. They don’t even have to have been in contact with anyone suspected of anything. Their personal information just has to be relevant." end quote.

I couldn't agree more Senator Wyden. Section 215 has been and will continue to be one of the largest privacy concerns that US citizens have faced. And if this concerns you too, I encourage you to write your representatives to let them know how you feel about this topic and that there should be better laws to protect our privacy. Not sure how to contact your elected officials?

on how to do so.

AprilMonthly ShowEpisode 99In episode 99 of our April monthly show: Apple and Google’s controversial efforts to create contact tracing technology, fighting COVID-19 criminal activity, and what the new normal means for startup companies!

Watch this episode on our YouTube Channel!

Thank you to our sponsor

Silent Pocket!

Take advantage of this exclusive offer and help support this podcast!

Visit

to shop Silent Pocket's great line of privacy focused products.