Researchers have found a major encryption flaw in 100 million Samsung Galaxy phones.

From the abstract:

In this work, we expose the cryptographic design and implementation of Android’s Hardware-Backed Keystore in Samsung’s Galaxy S8, S9, S10, S20, and S21 flagship devices. We reversed-engineered and provide a detailed description of the cryptographic design and code structure, and we unveil severe design flaws. We present an IV reuse attack on AES-GCM that allows an attacker to extract hardware-protected key material, and a downgrade attack that makes even the latest Samsung devices vulnerable to the IV reuse attack. We demonstrate working key extraction attacks on the latest devices. We also show the implications of our attacks on two higher-level cryptographic protocols between the TrustZone and a remote server: we demonstrate a working FIDO2 WebAuthn login bypass and a compromise of Google’s Secure Key Import.

Here are the details:

As we discussed in Section 3, the wrapping key used to encrypt the key blobs (HDK) is derived using a salt value computed by the Keymaster TA. In v15 and v20-s9 blobs, the salt is a deterministic function that depends only on the application ID and application data (and constant strings), which the Normal World client fully controls. This means that for a given application, all key blobs will be encrypted using the same key. As the blobs are encrypted in AES-GCM mode-of-operation, the security of the resulting encryption scheme depends on its IV values never being reused.

Gadzooks. That’s a really embarrassing mistake. GSM needs a new nonce for every encryption. Samsung took a secure cipher mode and implemented it insecurely.

News article.

Read More

A popular target of attackers, Microsoft Active Directory will receive an extra measure of protection under a new offering announced Thursday by Attivo Networks. The company’s ADSecure-DC solution expands its Active Directory protection to non-Windows endpoints.

About a year ago Attivo introduced an endpoint product that could detect suspicious attempts to query Active Directory, intercept the queries, and steer them off course. “That was done on every Windows machine on the endpoint,” says Attivo Chief Security Advocate and CMO Carolyn Crandall, “but there are situations where you have Linux, Mac devices, or IoT devices that you can’t load the Windows agent onto, or where you don’t want to load an agent on a Windows endpoint. Now, with AD Secure Domain Controller, attacks can be detected from unmanaged devices.”

To read this article in full, please click here

Read More

The following CIS Benchmarks have been updated or released for March 2022. We’ve highlighted the major updates below. Each Benchmark includes a full changelog that can be referenced to see all changes made.

Read More

Study uncovers 200,000 such assets across 35 vendors

Read More

Report reveals SecOps teams are overworked and understaffed

Read More

Role-based access control, or RBAC, is an approach for restricting access to digital resources based on a user’s role in an organization. For instance, under RBAC, a company’s accountant should be able to access corporate financial records but not the content management system used to update the company’s website, while those permissions would be reversed for that company’s web development team.

Just about every organization enforces some kind of access controls on its digital assets—indeed, every operating system in use today has access controls built in. Access controls generally grant specific permissions to (and impose restrictions on) individual users or groups that those users might belong to. What distinguishes the RBAC model from other forms of access control is that the users are grouped together based on the roles they play, and permissions are determined primarily by those roles, rather than being tailored for each individual user. In this article, you’ll learn how RBAC works, and see the advantages and disadvantages of this approach.

To read this article in full, please click here

Read More

In the meantime, Ukrainian sites are being hacked to spread fake new

Read More