Transatlantic Cable podcast episode 338 | Kaspersky official blog

Episode 338 of the Transatlantic Cable podcast kicks off with the story of the year (so far) as some people see it – the Kate Middleton / photoshop mess. Is it really as big a deal as some believe it to be, or is it just a silly mistake?

From there the team discuss news that South Korea have developed a tool to help scan images for deepfakes, but will it be useful enough to be of any use? Additionally, the team talk about the Play ransomware gang and will GDPR shut down WorldCoin?

If you liked what you heard, please consider subscribing.

Kate photo withdrawn by five news agencies amid ‘manipulation’ concerns
South Korean Police Develops Deepfake Detection Tool
Worldcoin hit with temporary ban in Spain over privacy concerns
Play ransomware leaked 65,000 government documents

Kaspersky official blog – ​Read More

How to protect yourself from the pig butchering scam | Kaspersky official blog

Today, we’re discussing the increasingly common scam known as pig butchering. Due to its high profitability, this scheme is rapidly gaining popularity among fraudsters, and the number of victims is constantly growing. What is it? How does it work? And how can you protect yourself? We’ll cover it all in today’s post.

What is pig butchering and how does this scam work?

Pig butchering is a type of scam associated, on the one hand, with investing (often in cryptocurrencies), and on the other, with online romantic relationships.

Just as pigs are raised for a long time before being slaughtered, in the pig butchering fraud scheme, scammers typically spend a lot of time and effort carefully courting their victims — usually over a period of weeks or even months. In this regard, pig butchering differs significantly from other fraudulent schemes, whose creators are often impatient and looking for quick profits.

The setup: a random message and a friendly stranger

It all starts with some random message in a messenger, social network or SMS. The scammer either pretends to have sent the message to the wrong recipient or refers to some distant mutual acquaintance that are easy to find and collect information about from the victim’s social media profile. If the victim responds to the scammer, saying something like “You’ve got the wrong number”, the scammer politely apologizes and tries to initiate a casual conversation. Message by message, an ongoing relationship develops between victim and scammer.

It should be noted here that scammers often deliberately select the victims based on their status and personal traits. That is, they look for reasonably well-off but perhaps lonely and vulnerable individuals who may not be opposed to engaging in conversation with a friendly stranger. At this stage, the scammer’s goal is to build at least friendly relations with the victim and, ideally, a romantic connection.

Thus, the scammer gains the victim’s trust and lulls their vigilance. As mentioned earlier, these scammers are usually in no rush and spend a lot of time communicating with the victim, which is uncharacteristic of online fraudsters. So even if the victim has some suspicions at first, they tend to fade away after a while.

The plot thickens: an opportunity to invest profitably

Sooner or later, the scammer finds a way to steer the conversation toward financial topics. Specific approaches here may vary, but the general idea is that the scammer carefully presents the victim with an opportunity to make a profitable investment.

This could be something traditional like stocks, bonds, futures or options. But lately, it’s more often associated with some “promising” cryptocurrency projects. The overall complexity and opacity of crypto, coupled with the ease of moving funds, make it ideal for such fraud.

At this stage, the victim may become alarmed and suspect something is amiss. However, the scammer is quick to reassure their precious… pig: there’s no need for the victim to transfer any money personally to them or anyone associated with them. All the victim needs do is simply create an account on a trading platform and try to deposit some money there to see how it works.

Climax: incredible profits and new money deposits

An important detail of the pig butchering scheme is that at every stage the scammer carefully maintains the victim’s illusion of control. The victim independently creates an account on the trading platform and can independently choose what to trade there. The scammer only provides helpful advice, making the whole process faster and easier — and of course, as profitable as possible.

The scammer’s trading tips turn out to work well — who would have guessed it? The victim quickly makes their first profit on the trading platform, gets excited, and starts depositing more and more for even bigger earnings.

Finale: the scammer vanishes with the money

But of course, sooner or later, the scammer absconds. This usually happens once a reasonable balance has formed in the account. Alternatively, the scammer may milk the victim until the moment they try to withdraw money from the platform.

That’s when the victim learns the truth: the trading platform was fake, and all those incredible profits just disappeared into thin air. As for the real money, it has long gone to some unknown account. At this stage, the scammer cuts all communication with the victim, deletes the accounts used for the scam, and — poof! — vanishes in a puff of smoke.

The victim has lost everything invested in the platform, and we’re usually talking significant amounts: the fraudsters often manage to get away with tens or even hundreds of thousands of dollars — sometimes even millions.

Scam farms in Southeast Asia

As you may have gathered from the description of pig butchering, this scheme has several key differences from most scams. First, the criminals come well-prepared — they have effective tools to deceive their victims. Second, they’re in no hurry and are ready to work on a single target for a long time, gradually moving toward their sinister goal. Third, we’re talking about truly large sums of money — meaning the amount of time and effort involved eventually pays off.

The secret to this success is that, in the vast majority of cases, it’s not individual scammers who are behind pig butchering, but large criminal groups. These organizations run huge fraudulent “farms”, most often located in the least prosperous countries of Southeast Asia. Such farms exist in Laos and the Philippines, but most farms are in Cambodia and, above all, Myanmar, where a civil war has been going on for several years.

One of the largest scam farms engaged in pig butchering — KK Park. This farm, located in Myanmar near the border with Thailand, employs over 2000 people. Source

These enterprises are truly massive: for example, a report last year about one of the largest scam farms, called KK Park, claimed that over 2000 people work there, and it has even earned its own article on Wikipedia. Moreover, the farms are constantly expanding and, of course, new ones are being opened.

Generally speaking, these fraud farms should more accurately be called labor camps — and this is perhaps the saddest detail of this scheme. For it turns out that the rank-and-file operators of pig butchering — the ones who directly communicate with the victims — are usually doing so against their own will.

Scam enterprises require highly skilled, well-educated, multilingual employees with strong online communication abilities. As you might imagine, such people don’t naturally appear in the jungles of Myanmar or Cambodia. Usually, these are citizens of other countries who are lured by the promise of high-paying jobs — call center operators, SMM specialists, translators or IT specialists.

Scam farms are constantly expanding: this photo, taken on July 1, 2023, shows the construction of a new building at KKII — a newer part of KK Park. Most likely, it has already been completed by now. Source

Usually, new scam-farm workers first end up in neighboring Thailand, from where they’re taken to Myanmar or Cambodia. There they’re transported to a camp located far away from any large populated areas and have their documents confiscated. Then these people essentially become slaves: they’re forced to work 12-16 hours a day for nothing but food, can be subjected to violence, and sometimes even resold to other fraudsters.

The overall scale of the problem is extremely serious. A report last year by the UN Office of the High Commissioner for Human Rights, citing reliable sources, gave the following figures: at least 120,000 people are employed in scam farms in Myanmar, and approximately another 100,000 in Cambodia.

How to protect yourself from pig butchering

It’s difficult to calculate the exact total losses of pig butchering victims because it’s a global problem — scammers target citizens of different countries. In addition, not everyone reports that they’ve been a victim. However, rough estimates suggest the size of the pig butchering industry runs to billions of dollars.

It’s a very lucrative business, so there’s no use hoping the problem will simply go away by itself. Nor is there any hope that the authorities in Cambodia or Myanmar will address it — they appear to have other priorities. Therefore, unfortunately, we must protect ourselves and our loved ones on our own. Here’s what we can advise:

Be cautious with random online acquaintances — even if the person has been communicating with you for a long time and doesn’t seem to be a scammer.
Don’t invest carelessly in obscure investment schemes — even if they apparently demonstrate high profitability.
In particular, don’t invest carelessly in cryptocurrency schemes, as due to the quirks of this topic the number of scammers in this sphere is unfortunately very high. Additionally, it’s important to note that all blockchain transactions are irreversible and uninsured.
Remember the golden rule of investing: the higher the potential profit — the higher the risk. When it comes to risky schemes, never invest money that you are not prepared to lose.
Inform your family and close ones about this fraudulent scheme — it’s possible that this could protect them from financial loss, plus the inevitable psychological trauma resulting from such deep deception.

Kaspersky official blog – ​Read More

Transatlantic Cable podcast, episode 337

 

In this special episode of the Transatlantic Cable Podcast, we engage in a thoughtful conversation with guests Genie Gan and Ekaterina Burdova about the pivotal topic of Women in Technology, coinciding with the celebration of International Women’s Day. Throughout the episode, we delve into various aspects of empowering women in STEM fields, touching on strategies for governmental and academic institutions to foster greater female participation, community-driven initiatives aimed at providing support and encouragement, and corporate measures to promote gender diversity and create inclusive workplaces. Additionally, the discussion explores the influence of media representation, citing examples like “The Queen’s Gambit” and its impact on shaping perceptions of female protagonists in male-dominated spheres. Emphasizing the significance of representation for aspiring female leaders, the guests also discuss ways to serve as role models for young girls interested in pursuing careers in technology. Furthermore, the conversation highlights the importance of mentoring programs in women’s professional development, as well as the challenges and strategies for maintaining a healthy work-life-family-education balance. Ultimately, the episode aims to challenge myths surrounding women in tech and inspire meaningful change within the industry.

If you liked what you heard, please consider subscribing.

 

Kaspersky official blog – ​Read More

Transatlantic Cable podcast episode 336 | Kaspersky official blog

Episode 336 of the Transatlantic Cable Podcast begins with news that Tumblr and WordPress are set to begin selling user data for AI training. From there the team talk about META’s decision to begin helping assist the EU in combatting fake news and disinformation on their platforms.

To wrap up, the team talk about LockBit’s resurgence and a truly bizarre Wi-Fi password scanning tool.

If you liked what you heard, please consider subscribing.

Tumblr, WordPress Announce User Data Sales for AI Training
Meta unveils team to combat disinformation and AI harms in EU elections
Back from the dead: LockBit taunts cops, threatens to leak Trump docs
Cybersecurity enthusiast collects Wi-Fi passwords using homemade device

Kaspersky official blog – ​Read More

How cybercriminals scam women ahead of March 8 | Kaspersky official blog

Taking place every year on March 8 in many countries across the world, International Women’s Day is celebrated differently depending on the country: in some it’s a national holiday; in others it’s not a holiday but still widely observed. But what’s the same everywhere is that it’s a day when everyone’s eyes are on women from all walks of life; and when I write everyone’s, that includes scammers’ eyes too. The feverish days running up to March 8 (ordering this, buying that – and all in good time, but not too early if we’re talking fresh flowers) provide a perfect opportunity for cybercriminals to make money, so they triple-down on sending links to fake sites, generating countless fake promotional codes, and making false promises of valuable gifts for every purchase.

In this post, we discuss ways in which women can protect themselves from falling prey to these scams.

Fake marketplace gifts

Statistics show that women are far more likely to shop at online marketplaces than men: 43 percent against 32 percent. Thus, women are more likely to be targeted by promotions that appear in dazzling quantities ahead of any public holiday. Sadly, these campaigns aren’t always legal and run by the brands whose names are used in sending out unprecedentedly generous offers.

For several years in a row, shortly before March 8, young women receive WhatsApp messages purportedly from Amazon and offering a valuable gift: “Welcome to the Amazon International Women’s Day Giveaway! We have more than 10,000 free gifts!” To participate, the recipient is asked to follow a link and fill out a quick survey, and then share the message with a few dozen friends and verify their identity through email. Needless to say, respondents get no fancy smartphones, hair dryers, or laptops. Instead, according to security researchers, victims’ devices may have been compromised, with the scammers getting access to the camera, microphone, banking apps, contacts, and gallery.

In fact, some brands do employ instant messaging services and email to spread promotional offers, and Amazon is no exception. So, if you receive such a message, start by carefully scanning it: suspicious generosity, grammatical errors, an odd sender’s address, and an urgent call to follow a link “while it still lasts” may be a sign that it’s a scam. Remember the rules for safe online shopping and use reliable security to be confident you’re following a link to an official website — not a fake.

“Flowers for our regular customers!”

The tradition of giving women flowers on March 8 dates back to 1946, when Italian women’s rights activists chose the yellow mimosa as a symbol of resilience, sustained growth, and solidarity. Young women still get flowers from their friends and family every March 8. Scammers exploit this sweet tradition too.

On the eve of International Women’s Day, scammers promise to send women flowers, while the recipient women, they say, will only need to pay for delivery. If a woman agrees, she receives a payment link in an instant messaging app. To no one’s surprise, after following all the instructions, the victim gets no flowers, and the florist shop’s phone number turns out to be somehow unavailable.

The whole story is a typical delivery scam, which we’ve written about earlier. Losses in this case include both the “cost of delivery” and the bank card details, which can later be used to steal far larger sums. Here’s a golden rule for you if you want to avoid being scammed: never pay for a gift. After all, it should be free because it’s a gift. If a florist shop, nail salon, or spa decides to be nice and send you flowers all of a sudden, make sure they don’t charge you for this.

“Anything you say can be used against you”

You must have heard the Miranda warning in movies: “Anything you say can be used against you…”. Well, it’s just as true for digital life as it is for real life. We’re talking about doxers. These are people who collect any and all information available about their potential victims — information the victims themselves have published — and threaten to make it public. This type of threat is known as doxing.

Young women are especially defenseless before doxers. A malicious actor can use data on the victim for catfishing: creating a fake online identity with the victim’s name, face, and other personal details to set up further scams on social networks and in dating services. The least they can do is harass you with text messages, phone calls, fake deliveries, or even swatting. Popular streamer Amouranth, with more than 6.3 million Twitch followers, says she gets swatted several times a month.

Streamer Wolfabelle experienced a different kind of doxing: a stalker found out her address and threatened to publish it unless she gave him sexual favors. She even received a photo of her house made by the doxer to prove he wasn’t bluffing.

On a positive note, this isn’t something you can’t prevent. In a nutshell, here’s what you should do: avoid sharing your geolocation, publish only a minimum of information that can appear in online searches, or make your social profiles private. If you’ve already been a victim of doxing, please refer to our other post.

Celebrating March 8 safely

Keep your eyes open when accepting promotional offers. Gifts and giveaways are nice, but as soon as they ask you to pay or share the link with your friends, that’s when you know you’re dealing with scammers.
Avoid clicking suspicious links in instant messages. Please read our detailed anti-phishing tips and remember that malicious actors become more active in the run-up to and during holidays.
Publish your personal details in private social profiles only. This life hack will go at least some way toward keeping you safe from doxing. Remember to carefully select followers and friends who can view your profile details.
Use comprehensive security that keeps you from visiting phishing and scam sites, protects your payment and personal details, and prevents identity theft.

Kaspersky official blog – ​Read More

Protecting surveillance cameras and smart doorbells from intruders | Kaspersky official blog

Recently, the Edina Police Department (Minneapolis, U.S.A.) issued a remarkable warning to residents. Following the investigation of nine apartment burglaries, the police concluded that thieves were disrupting the Wi-Fi connection in the apartments. They did this to prevent the home’s smart surveillance cameras from alerting the owners of the danger and transmitting video to them. Is such a technologically advanced burglary really possible? It is. Are there other ways to attack smart-home security systems? Definitely. What can be done about it? Great question. Let’s find out!…

Defenseless defenders

Protection devices — whether they be locks, cameras, alarms, or anything else — should, in theory, be completely secure against any kind of hostile action. After all, they could be deliberately targeted by attackers hoping to break in! Unfortunately, in practice, manufacturers are not always prudent. They make various mistakes: in smart locks, the mechanical part is often not made reliable enough; in cameras, video streams are transmitted openly, allowing unauthorized persons to view or even interfere with them; and in alarms, control channels are poorly protected. This is in addition to other smart-home vulnerabilities that we’ve written about before.

What’s even more worrying is that many of these devices are vulnerable to two really simple attacks: power disruption and communication disruption.

Home Wi-Fi can be disrupted in various ways — from crudely jamming the entire radio-wave frequency range to more specialized attacks on a specific network or Wi-Fi client. There are other ways besides messing with radio waves, too. The internet in a home is usually connected through one of four easily recognizable cables: fiber optic, telephone, twisted pair (Ethernet), or coaxial television. One can reliably disrupt the connection simply by cutting these cables.

In case the entire security system relies on the power grid without backup sources, simply cutting off the power to the apartment can easily knock out the smart protection.

Improving protection performance

Most of the problems described above can be dealt with. As with any security measures, none of the solutions below guarantees 100% protection, but they will significantly reduce the likelihood of a burglary.

Choose the right equipment. All of the issues mentioned above should be considered before purchasing any security systems. This way, you can formulate additional requirements for the equipment:

an autonomous power supply
the ability to transmit information without Wi-Fi
an adequate level of mechanical protection
the manufacturer’s compliance with high cybersecurity standards

The first two requirements are perfectly combined in cameras that operate using Power over Ethernet (PoE) technology. Both data and power are transmitted through a single cable. You just need to buy either a PoE-enabled Ethernet router/hub or a separate PoE converter and connect it to the power grid using an uninterruptible power supply (UPS). This will make the internet in the home, the functionality of the cameras and sensors, and their connection to the router resistant to power outages and Wi-Fi interference.

If it’s not suitable for you to have Ethernet cables running through your home, you could consider cameras with an autonomous power supply (batteries) or, at worst, cameras connected through a capacious power bank. This would protect against power outages, but the problem of attackers interfering with Wi-Fi would remain. To protect against this, you could choose devices that operate on 3G/4G/5G. It’s worth noting that they’re usually designed for houses rather than apartments, so they often have “outdoor” features: waterproof casing, long-range IR illumination, and so on.

Many cameras have the ability to record to an SD card, but this doesn’t help much in quickly responding to an incident.

A sufficient level of mechanical security is mainly important for locks, but it’s also relevant for cameras, doorbells and sensors, which are directly accessible to intruders. The level of security is difficult to assess before purchasing, but you can search the internet for tests for burglary and vandalism resistance, as well as customer reviews.

Assessing the cybersecurity level of a specific camera or doorbell is also not easy: you’d have to carefully study the manufacturer’s website and its reputation in terms of technical support and release of updates. We’ve given some useful tips on this topic before.

Implement “redundancy”. Even if you’ve already bought some equipment, some additional measures would help improve home security. It’s highly advisable to provide redundancy for the internet channel. Depending on the situation, the backup channel could be launched either through a 4G modem or using a second wired connection and a second router. The main difficulty is configuring the router and the rest of the equipment so that the connection automatically switches to the backup channel when the main one goes down. In some routers this isn’t difficult — the function is called backup channel — while in others it’s impossible. Of course, both routers (if there are two of them) would need power through a UPS. If you don’t already have uninterrupted power, it’s time to get some.

If it’s difficult to provide redundancy for the internet channel and automatic switching at the router level, as a relatively simple alternative, you could install a redundant camera: one would operate through the main internet channel, while the other — through the backup one.

Protect against cyberattacks. To hinder targeted attacks on security devices, it’s important to follow the main rules of cybersecurity, which we’ve written about many times: protect your router, choose strong Wi-Fi passwords, regularly update the firmware of smart devices and the router, and use a comprehensive security solution for all computers, smartphones, and smart devices in your home network.

Kaspersky official blog – ​Read More

How to store Location History in Android in 2024? | Kaspersky official blog

Of all the accusations routinely hurled Google’s way, there’s one that especially alarms users: the company can track the location of all Android — and to some extent, Apple — phones. Past experience suggests that Google indeed does this — not only using this data to display ads, but also storing it in Location History and even providing it to law enforcement agencies. Now Google promises to only store Location History on the device. Should we believe it?

What’s wrong with Location History?

Location History lets you easily view the places a user visited and when they did so. You can use it for all kinds of things: remembering the name of that beach or restaurant you went to while on vacation two years ago, finding the address of a place your better half often goes to after work, getting new bar suggestions based on the ones you’ve been to, locating the florist that delivered the surprise bouquet for a party, and many more. The different ways this feature both benefits and harms Google account holders are commonly reported. Little wonder then that many — even those with a clean consciences — often want to turn it off completely.

Regrettably, Google has often been caught abusing its Location History setting. Even if explicitly disabled, Location History was still collected under “Web & App Activity”. This led to a series of lawsuits, which Google lost. In 2023, the company was ordered to pay $93 million under one suit, and a year earlier $392 million under another. These fines were but a pinprick to a corporation with hundreds of billions of dollars in revenue, but at least the court had Google revise its location tracking practices.

The combined legal and public pressure apparently led to the company announcing at the end of 2023 a drastic change: now, according to Google, Location History will be collected and stored on users’ devices only. But does that make the feature any more secure?

How does Location History (supposedly) work in 2024?

First of all, check that the feature has been updated on your device. As is wont with Google, updates for the billions of Android devices roll out in waves, and to relatively recent OS versions only. So, unless you see an alert that looks like the one below, it’s likely your device hasn’t received the update, and enabling Location History will save the data on Google’s servers.

Unless Google has explicitly warned you that your Location History will be stored on your device, it’s likely to continue being saved to Google’s servers

If your Location History is now stored locally, however, Google Maps will offer options for centralized management of your “places”. By selecting a point on the map, such as a coffee shop, and opening its description, you’ll see all the times you visited the place in the past, all searches for the place on the map, and other things like that. One tap on the location card can delete all of your activity associated with the place.

Google says it will store the history for each place for three months by default and then delete it. To change this setting or disable history, simply tap the blue dot on the map that shows your current location and turn off Location History in the window that pops up.

Options for configuring and disabling Location History

An obvious downside to offline Location History is that it won’t be accessible to the user on their other devices. As a workaround, Google suggests storing an encrypted backup on its servers.

Keep in mind that what we’re discussing here is the new implementation of Location History as described by Google. Detailed analysis of how this new pattern actually works may reveal pitfalls and caveats that no one except Google’s developers knows about at this point.

What threats does this update eliminate?

Although the new storage method improves the privacy of location data, it can’t be considered a one-size-fits-all solution to all existing issues. So how does it affect various hypothetical threat scenarios?

Tracking you to customize ads. This is unlikely to be affected in any way: Google can continue to collect data on places you visit in an anonymized, generalized form. You’ll keep seeing ads linked to your current or past locations unless you disable either that or all targeted ads entirely. Remember that Google isn’t the only one out there tracking your location. Other apps and services have been found guilty of abusing this data as well; here are a few examples: one, two, and three.
Evil hackers and cyberspies. These malicious groups typically use commercial spyware (stalkerware) or malicious implants, so the changes to Google’s Location History will hardly affect them.
Jealous partner or prying relative. It’ll be harder to use a computer on which you’re signed in to your Google account to track your location. Someone could still quietly snoop on your phone while it’s unlocked, as well as secretly install commercial spyware such as stalkerware, which we mentioned above. Therefore, it’s general steps to protect smartphones from mobile spyware, not the updates to Google Maps, that are crucial to addressing this.
Law enforcement. This isn’t likely to change much, as, in addition to asking Google, the police can request your location data from the mobile carrier or deduce it from surveillance camera footage, which is both easier and faster.

So, the update doesn’t help user privacy all that much, does it? We’re afraid not.

How do I effectively protect my location data?

You’re limited to fairly drastic options these days if you want to prevent location tracking. We list these here in ascending order of extremity.

Use comprehensive security on all your devices, including phones and tablets. This will reduce the likelihood of being exposed to malware, including stalkerware.
Disable Google Location History and Web & App Activity, avoid giving location permissions to any apps except navigation apps, turn off personalized ads, and use a DNS service that filters ads.
Turn off all geo-tracking features (GPS, Google location services, and others) on your smartphone.
When on an especially important trip, activate flight mode for an hour or two, or just turn off your smartphone.
Ditch smartphones in favor of the most basic dumbphones.
Ultimately, stop carrying around any kind of phone at all.
Live 100% off-grid; e.g., in a cave.

Kaspersky official blog – ​Read More

Transatlantic Cable podcast episode 335 | Kaspersky official blog

Episode 335 of the Transatlantic Cable Podcast kicks off with news that Apple are already preparing for a post-quantum world with their latest iMessage update. From there the team discuss criticism around Google’s ‘woke’ AI picture issues.

Following that, the team wrap up with two stories, the first around Air Canada’s chatbot giving incorrect refund advice to a customer, and a spoon-bending magician says he was paid to create a fake Biden robocall.

If you like what you heard, please consider subscribing.

Post-quantum iMessage: the next step in privacy protection
Google to fix AI picture bot after ‘woke’ criticism
Air Canada must honor refund policy invented by airline’s chatbot
A magician says a Democratic op paid him to make the fake Biden call

Kaspersky official blog – ​Read More

VoltSchemer: attacks on wireless chargers through the power supply | Kaspersky official blog

A group of researchers from the University of Florida has published a study on a type of attack using Qi wireless chargers, which they’ve dubbed VoltSchemer. In the study, they describe in detail how these attacks work, what makes them possible, and what results they’ve achieved.

In this post, first we’ll discuss the researchers’ main findings. Then we’ll explore what it all means practically speaking — and whether you should be concerned about someone roasting your smartphone through a wireless charger.

The main idea behind the VoltSchemer attacks

The Qi standard has become the dominant one in its field: it’s supported by all the latest wireless chargers and smartphones capable of wireless charging. VoltSchemer attacks exploit two fundamental features of the Qi standard.

The first is the way the smartphone and wireless charger exchange information to coordinate the battery charging process: the Qi standard has a communication protocol that uses the only “thing” connecting the charger and the smartphone — a magnetic field — to transmit messages.

The second feature is the way that wireless chargers are intended for anyone to freely use. That is, any smartphone can be placed on any wireless charger without any kind of prior pairing, and the battery will start charging immediately. Thus, the Qi communication protocol involves no encryption — all commands are transmitted in plain text.

It is this lack of encryption that makes communication between charger and smartphone susceptible to man-in-the-middle attacks; that is, said communication can be intercepted and tampered with. That, coupled with the first feature (use of the magnetic field), means such tampering  is not even that hard to accomplish: to send malicious commands, attackers only need to be able to manipulate the magnetic field to mimic Qi-standard signals.

To illustrate the attack, the researchers created a malicious power adapter: an overlay on a regular wall USB socket. Source

And that’s exactly what the researchers did: they built a “malicious” power adapter disguised as a wall USB socket, which allowed them to create precisely tuned voltage noise. They were able to send their own commands to the wireless charger, as well as block Qi messages sent by the smartphone.

Thus, VoltSchemer attacks require no modifications to the wireless charger’s hardware or firmware. All that’s necessary is to place a malicious power source in a location suitable for luring unsuspecting victims.

Next, the researchers explored all the ways potential attackers could exploit this method. That is, they considered various possible attack vectors and tested their feasibility in practice.

VoltSchemer attacks don’t require any modifications to the wireless charger itself — a malicious power source is enough. Source

1. Silent commands to Siri and Google Assistant voice assistants

The first thing the researchers tested was the possibility of sending silent voice commands to the built-in voice assistant of the charging smartphone through the wireless charger. They copied this attack vector from their colleagues at Hong Kong Polytechnic University, who dubbed this attack Heartworm.

The general idea of the Heartworm attack is to send silent commands to the smartphone’s voice assistant using a magnetic field. Source

The idea here is that the smartphone’s microphone converts sound into electrical vibrations. It’s therefore possible to generate these electrical vibrations in the microphone directly using electricity itself rather than actual sound. To prevent this from happening, microphone manufacturers use electromagnetic shielding — Faraday cages. However, there’s a key nuance here: although these shields are good at suppressing the electrical component, they can be penetrated by magnetic fields.

Smartphones that can charge wirelessly are typically equipped with a ferrite screen, which protects against magnetic fields. However, this screen is located right next to the induction coil, and so doesn’t cover the microphone. Thus, today’s smartphone microphones are quite vulnerable to attacks from devices capable of manipulating magnetic fields — such as wireless chargers.

Microphones in today’s smartphones aren’t protected from magnetic field manipulation. Source

The creators of VoltSchemer expanded the already known Heartworm attack with the ability to affect the microphone of a charging smartphone using a “malicious” power source. The authors of the original attack used a specially modified wireless charger for this purpose.

2. Overheating a charging smartphone

Next, the researchers tested whether it’s possible to use the VoltSchemer attack to overheat a smartphone charging on the compromised charger. Normally, when the battery reaches the required charge level or the temperature rises to a threshold value, the smartphone sends a command to stop the charging process.

However, the researchers were able to use VoltSchemer to block these commands. Without receiving the command to stop, the compromised charger continues to supply energy to the smartphone, gradually heating it up — and the smartphone can’t do anything about it. For cases such as this, smartphones have emergency defense mechanisms to avoid overheating: first, the device closes applications, and if that doesn’t help it shuts down completely.

Using the VoltSchemer attack, researchers were able to heat a smartphone on a wireless charger to a temperature of 178°F — approximately 81°C. Source

Thus, the researchers were able to heat a smartphone up to a temperature of 81°C (178°F), which is quite dangerous for the battery — and in certain circumstances could lead to its catching fire (which could of course lead to other things catching fire if the charging phone is left unattended).

3. “Frying” other stuff

Next, the researchers explored the possibility of “frying” various other devices and everyday items. Of course, under normal circumstances, a wireless charger shouldn’t activate unless it receives a command from the smartphone placed on it. However, with the VoltSchemer attack, such a command can be given at any time, as well as a command to not stop charging.

Now, take a guess what will happen to any items lying on the charger at that moment! Nothing good, that’s for sure. For example, the researchers were able to heat a paperclip to a temperature of 280°C (536°F) — enough to set fire to any attached documents. They also managed to fry to death a car key, a USB flash drive, an SSD drive, and RFID chips embedded in bank cards, office passes, travel cards, biometric passports and other such documents.

Also using the VoltSchemer attack, researchers were able to disable car keys, a USB flash drive, an SSD drive, and several cards with RFID chips, as well as heat a paperclip to a temperature of 536°F — 280°C. Source

In total, the researchers examined nine different models of wireless chargers available in stores, and all of them were vulnerable to VoltSchemer attacks. As you might guess, the models with the highest power pose the greatest danger, as they have the most potential to cause serious damage and overheat smartphones.

Should you fear a VoltSchemer attack in real life?

Protecting against VoltSchemer attacks is fairly straightforward: simply avoid using public wireless chargers and don’t connect your own wireless charger to any suspicious USB ports or power adapters.

While VoltSchemer attacks are quite interesting and can have spectacular results, their real-world practicality is highly questionable. Firstly, such an attack is very difficult to organize. Secondly, it’s not exactly clear what the benefits to an attacker would be — unless they’re a pyromaniac, of course.

But what this research clearly demonstrates is how inherently dangerous wireless chargers can be — especially the more powerful models. So, if you’re not completely sure of the reliability and safety of a particular wireless charger, you’d be wise to avoid using it. While wireless charger hacking is unlikely, the danger of your smartphone randomly getting roasted due to a “rogue” charger that no longer responds to charging commands isn’t entirely absent.

Kaspersky official blog – ​Read More

Toy robot security issues | Kaspersky official blog

Kaspersky experts recently studied the security of a popular toy robot model, finding major issues that allowed malicious actors to make a video call to any such robot, hijack the parental account, or, potentially, even upload modified firmware. Read on for the details.

What a toy robot can do

The toy robot model that we studied is a kind of hybrid between a smartphone/tablet and a smart-speaker on wheels that enables it to move about. The robot has no limbs, so rolling around the house is its only option to physically interact with its environment.

The robot’s centerpiece is a large touchscreen that can display a control UI, interactive learning apps for kids, and a lively, detailed animated cartoon-like face. Its facial expressions change with context: to their credit the developers did a great job on the robot’s personality.

You can control the robot with voice commands, but some of its features don’t support these, so sometimes you have to catch the robot and poke its face the built-in screen.

In addition to a built-in microphone and a rather loud speaker, the robot has a wide-angle camera placed just above the screen. A key feature touted by the vendor is parents’ ability to video-call their kids right through the robot.

On the front face, about halfway between the screen and the wheels, is an extra optical-object-recognition sensor that helps the robot avoid collisions. Obstacle recognition being totally independent of the main camera, the developers very usefully added a physical shutter that completely covers the latter.

So, if you’re concerned that someone might be peeping at you and/or your child through that camera — sadly not without reason as we’ll learn later — you can simply close the shutter. And in case you’re worried that someone might be eavesdropping on you through the built-in microphone, you can just turn off the robot (and judging by the time it takes to boot back up, this is an honest-to-goodness shutdown — not a sleep mode).

As you’d expect, an app for controlling and monitoring the toy is available for parents to use. And, as you must have guessed by now, it’s all connected to the internet and employs a bunch of cloud services under the hood. If you’re interested in the technical details, you can find these in the full version of the security research, which we’ve published on Securelist.

As usual, the more complex the system — the more likely it is to have security holes, which someone might try to exploit to do something unsavory. And here we’ve reached the key point of this post: after studying the robot closely, we found several serious vulnerabilities.

Unauthorized video calling

The first thing we found during our research was that malicious actors could make video calls to any robot of this kind. The vendor’s server issued video session tokens to anyone who had both the robot ID and the parent ID. The robot’s ID wasn’t hard to brute-force: every toy had a nine-character ID similar to the serial number printed on its body, with the first two characters being the same for every unit. And the parent’s ID could be obtained by sending a request with the robot ID to the manufacturer’s server without any authentication.

Thus, a malicious actor who wanted to call a random child could either try to guess a specific robot’s ID, or play a chat-roulette game by calling random IDs.

Complete parental account hijack

It doesn’t end there. The gullible system let anyone with a robot ID retrieve lots of personal information from the server: IP address, country of residence, kid’s name, gender, age — along with details of the parental account: parent’s email address, phone number, and the code that links the parental app to the robot.

This, in turn, opened the door for a far more hazardous attack: complete parental-account hijack. A malicious actor would only have needed to have taken a few simple steps:

The first one would have been to log in to the parental account from their own device by using the email address or phone number obtained previously. Authorization required submitting a six-digit one-time code, but login attempts were unlimited so trivial brute-forcing would have done the trick.
It would only have taken one click to unlink the robot from the true parental account.
Next would have been linking it to the attacker’s account. Account verification relied on the linking-code mentioned above, and the server would send it to all comers.

A successful attack would have resulted in the parents losing all access to the robot, and recovering it would have required contacting tech support. Even then, the attacker could still have repeated the whole process again, because all they needed was the robot ID, which remained unchanged.

Uploading modified firmware

Finally, as we studied the way that the robot’s various systems functioned, we discovered security issues with the software update process. Update packages came without a digital signature, and the robot installed a specially formatted update archive received from the vendor’s server without running any verifications first.

This opened possibilities for attacking the update server, replacing the archive with a modified one, and uploading malicious firmware that let the attacker execute arbitrary commands with superuser permissions on all robots. In theory, the attackers would then have been able to assume control over the robot’s movements, use the built-in cameras and microphones for spying, make calls to robots, and so on.

How to stay safe

This tale has a happy ending, though. We informed the toy’s developers about the issues we’d discovered, and they took steps to fix them. The vulnerabilities described above have all been fixed.

In closing, here are a few tips on staying safe while using various smart gadgets:

Remember that all kinds of smart devices — even toys — are typically highly complex digital systems whose developers often fail to ensure secure and reliable storage of user data.
As you shop for a device, be sure to closely read user feedback and reviews and, ideally, any security reports if you can find them.
Keep in mind that the mere discovery of vulnerabilities in a device doesn’t make it inferior: issues can be found anywhere. What you need to look for is the vendor’s response: it’s a good sign if any issues have been fixed. It’s not a good thing if the vendor appears not to care.
To avoid being spied or eavesdropped on by your smart devices, turn them off when you’re not using them, and shutter or tape over the camera.
Finally, it goes without saying that you should protect all your family members’ devices with a reliable security solution. A toy-robot hack is admittedly an exotic threat — but the likelihood of encountering other types of online threats is still very high these days.

Kaspersky official blog – ​Read More