Daily Archives: October 5, 2019

A bug in Signal for Android could be exploited to spy on users

Researcher discovered a logical flaw in the Signal messaging app for Android that could be exploited by a malicious caller to force a call to be answered at the receiver’s end without interaction.

Google Project Zero white-hat hacker Natalie Silvanovich discovered a logical vulnerability in the Signal messaging app for Android that could be exploited by a malicious caller to force a call to be answered at the receiver’s end without requiring his interaction.

This means that the attacker could spy on the receiver through the microphone of his device.

However, the Signal vulnerability can only be exploited if the receiver fails to answer an audio call over Signal, eventually forcing the incoming call to be automatically answered on the receiver’s device.

The logical vulnerability resides in a method handleCallConnected that could be abused cause the call to be answered, even though the user the interaction.

“In the Android client, there is a method handleCallConnected that causes the call to finish connecting. During normal use, it is called in two situations: when the device accepts the call when the user selects ‘accept,’ and when the device receives an incoming “connect” message indicating that the has accepted the call,” reads the analysis published by Silvanovich. “Using a modified client, it is possible to send the “connect” message to a callee device when an incoming call is in progress but has not yet been accepted by the user. This causes the call to be answered, even though the user has not interacted with the device.”

Silvanovich explained that the iOS client is affected by a similar logical issue, but the call is not established due to an error in the UI caused by the unexpected sequence of states.

Silvanovich shared her findings with the Signal security team last week that quickly addressed it on the same day with the release of the version v4.47.7.

Pierluigi Paganini

(SecurityAffairs – Signal, hacking)

The post A bug in Signal for Android could be exploited to spy on users appeared first on Security Affairs.

Magecart hackers are expanding their operations

Cybercrime gangs under the Magecart umbrella continue to compromise e-commerce platforms to steal payment card data from users worldwide.

Hacker groups under the Magecart umbrella continue to target organizations payment card data with so-called software skimmers. Security firms have monitored the activities of a dozen groups at least since 2010

According to a joint report published by RiskIQ and FlashPoint, some groups are more advanced than others, in particular, the gang tracked as Group 4 appears to be very sophisticated.

The list of victims of the groups is long and includes several major platforms such as British AirwaysNeweggTicketmasterMyPillow and Amerisleep, and Feedify

Millions of Magecart instances were detected over time, security experts discovered tens of software skimming scripts.

In a report recently published by RiskIQ, experts estimate that the group has impacted millions of users. RiskIQ reports a total of 2,086,529 instances of Magecart detections, most of them are supply-chain attacks.

“Suppliers can include vendors that integrate with sites to add or improve site functionality or cloud resources from which websites pull code, such as Amazon S3 Buckets. These third-parties integrate with thousands of websites” states the report.

Magecart group tracked as MG5 (Group 5) appears to be the most sophisticated and prolific group. MG5 focuses on supply chain attacks, it is responsible for the hack of hundreds of websites and providers such as SociaPlus and Inbenta.

In June, the gang made the headlines again, after infecting over 17,000 domains by targeting improperly secured Amazon S3 buckets

Recently, IBM researchers observed one of the MG5 group 5 using malicious code to inject into commercial-grade layer 7 L7 routers.

According to RiskIQ, many groups under the umbrella still focus on e-commerce sites powered with the Magento shopping or OpenCart platform.


Following a consolidated pattern of attack that is common in the hacking community, Magecart attempt to exploit vulnerabilities that the victims have yet to patch even is security updates have been released by Magento and other software vendors.

Attackers also look for new attack vectors to distribute their software skimming, such as compromising creative ad script tags to leverage digital ad networks to generate traffic to their skimmers and hit thousands of sites at once.

RiskIQ report revealed that of all malicious advertisements it has analyzed, the 17% is associated with the Magecart groups.

Below other interesting insights included in the report:

  • 17% of all Malvertisements detected by RiskIQ contain Magecart skimmers
  • The average length of a Magecart breach is 22 days with many lasting years, or even indefinitely.
  • Shopping platforms such as Magento and OpenCart are the lifeblood of many Magecart groups. RiskIQ has detected 9,688 vulnerable Magento hosts.
  • Magecart infrastructure is vast, with 573 known C2 domains, and 9,189 hosts observed loading C2 domains. 
  • Because Magecart skimmers stay on websites for so long, threat actors are purchasing Magecart infrastructure that’s gone offline to assume access to these breached sites. 

The full report, containing additional insights and information, is available for download here: https://www.riskiq.com/research/magecart-growing-threat/

Pierluigi Paganini

(SecurityAffairs – software skimmers, hacking)

The post Magecart hackers are expanding their operations appeared first on Security Affairs.

NSA Launches New Cybersecurity Directorate

NSA is redefining its cybersecurity mission and with the Cybersecurity Directorate it will enhance its partnerships with unclassified collaboration and information sharing.

Under the new Cybersecurity Directorate — a major organization that unifies NSA’s foreign intelligence and cyberdefense missions

The NSA announced the new Cybersecurity Directorate — which will help defend domestic organizations from foreign cyberattacks.

The NSA announced the new Cybersecurity Directorate — which will help defend domestic organizations from foreign cyberattacks — in a short press release. The NSA, sometimes called by its nickname, “No Such Agency,” is known for being secretive. But this new directorate seems to signal a pivot towards a more public approach to security than the Agency has taken in the past.


The directorate also reflects a change in the importance of national cybersecurity and provides a hint as to how government agencies are rethinking how cybersecurity divisions should be organized.

The NSA Makes Cyberdefense a Top Priority

The directorate will unify the NSA’s current foreign intelligence and cyberdefense operations, bringing them together in a “major organization” designed to defend domestic organizations against foreign cyberattacks. The NSA expects the directorate to “reinvigorate NSA’s white hat mission” by seeing the Agency turn towards providing partners and “customers” with threat information, and by otherwise equipping them against cyberattacks.

The directorate will have NSA turn its efforts towards securing military and defense industry security. A short, NSA-produced video at the end of the press release provided more information about what threats the NSA expects to defend the public from — including attacks on infrastructure, theft of classified information, and “mass deception of the public.”

The pivot comes at a time where the nation is facing several security crises and reasonable fears that almost anything that runs on a computer — banks, voting machines, and critical infrastructure — can be compromised or damaged by cyberattacks.

The launch of the new directorate — and the focus of the press release on cyberdefense — follows comments made by Glenn Gerstell, chief counsel of the NSA, back in September. At that time, Gerstell said that the NSA wouldn’t “hack back” in the case of a cyberattack and that the Agency was instead focused on defending key information and infrastructure from theft or damage by foreign actors.

The directorate is not the Agency’s first foray into providing private domestic organizations with intel about foreign hackers. In 2011, as the financial sector was still recovering from the financial crisis of 2008, the Agency began providing Wall Street banks with cybersecurity information in the hopes that it would prevent “financial sabotage.”

The State of Cybersecurity

The directorate reflects a broader change that’s also being seen in the private sector. Cybersecurity is no longer seen as a sub-component of an overall security plan, or as part of the tech department, but as a necessary investment that requires top talent and serious commitment of resources. Networks are more likely to be considered vulnerable and need better defense from cyberattacks.

Businesses are increasingly relying on Internet of Things or “smart” devices to provide data. But these devices are often improperly secured and allow an access point to secure networks, and the valuable information held there. As the world becomes more connected, there are more opportunities for hackers to slip in between the cracks of cyberdefenses and do damage once they have access to secure networks.

In the press release, the NSA said that the Agency will “invest in and rely on its expert workforce.” It’s not clear right now if the new directorate will result in the NSA expanding its cybersecurity workforce. If so, they may run into some of the problems faced by the private sector, in that the number of cybersecurity experts has not kept pace with the frequency of, intensity of, and damage done by cyberattacks.

What the NSA’s Directorate Means for Cybersecurity

The new director shows that cybersecurity is a higher priority than ever for the Agency, and signals a turn to more public involvement in national security. Time will tell how effective the directorate is at preventing or reducing the harm of cyberattacks, but the defense industry is likely happy to receive any help that they can.

Going forward, cybersecurity will continue to become more important as critical infrastructure and essential components of our economy and national defense become more connected. Whether or not the cybersecurity industry will be able to keep up with the rising pace of attacks remains to be seen.

About the author

Kayla Matthews is a technology and cybersecurity writer, and the owner of ProductivityBytes.com. To learn more about Kayla and her recent projects, visit her About Me page.

Pierluigi Paganini

(SecurityAffairs – cybersecurity, NSA Cybersecurity Directorate)

The post NSA Launches New Cybersecurity Directorate appeared first on Security Affairs.