Security Bits – 1 December 2019

Followups:

DNS over HTTPS: DNS-over-HTTPS is coming to Windows 10 — nakedsecurity.sophos.com/…
- Related: 🎧 Steve Gibson reports the Windows 10 story, and uses it as a transition into a deep-dive into some of the exceptionally cool possible improvements HTTPS + HTTP2 & HTTP3 could bring to DNS — Security Now Episode 742: Pushing “DoH” — overcast.fm/…
iOS13’s Problematic Release: According to reports, Apple have briefed their iOS development team on significant changes to their software development process aimed at making iOS 14 go a lot smoother than iOS 13 did — www.bloomberg.com/…

Security Medium — The Android Camera Bug

A bug was found in the camera app that ships on many Android phones that allowed third-party apps with permission to use external storage to silently enable the camera and mic, to access the photo library, and, to read geolocation data from the images in the library. Malicious apps could enable the camera and mic even when the phone was locked and the screen is off. Access to storage is one of the most common permissions, so the permission would not look suspicious.

The bug was responsibly disclosed, so both Google and Samsung have already patched the camera apps on their phones. Google patched their app via the Play store in July, and while Samsung say their app is now patched, they did not give a date for when it was released.

The security researchers who discovered the bug believe it affects apps by other manufacturers too, but while Google say they are working with manufacturers, we have no official confirmation that other phones were or are vulnerable. Frustratingly, this means owners of non-Google or Samsung devices simply don’t know whether or not they are exposed to this dangerous vulnerability. For now, it seems there are no wide-spread exploits in the wild, but that could change very quickly.

Notable Security Updates

Notable News

A security researcher found a 4TB database containing 1.2 billion aggregated stolen user records on the dark web. The data does not contain passwords or payment information, but could be very helpful in crafting targeted attacks — www.wired.com/…
Security researchers find significant problems with 3rd-party Android modifications and apps:
- Security researchers found 146 known vulnerabilities on 29 out-of-the-box Android phones including models from Samsung & Xiaomi. The source of the problem is custom software added to the core OS by the hardware manufacturers (Editorial by Bart: yet another reason to confine stick to Android phones from Google, you get official Android, and only official Android!) — nakedsecurity.sophos.com/…
- Thousands of Android apps have old security flaws lurking inside — www.wired.co.uk/…
Twitter continues to add more control for users to protect themselves from abuse on the platform:
Sir Tim Berners-Lee publishes plan to save the web from ‘digital dystopia’ — nakedsecurity.sophos.com/…
🇺🇸 The Pennsylvania Supreme Court has ruled that passwords are protected by the 5th amendment to the US constitution — nakedsecurity.sophos.com/…
🇺🇸 Think of the children: FBI sought Interpol statement against end-to-end crypto — arstechnica.com/…
- 🇪🇺 Related: EU raises eyebrows at possible US encryption ban — nakedsecurity.sophos.com/…
🇺🇸 NSA won’t collect phone location data, promises US government — nakedsecurity.sophos.com/…

Suggested Listening

🎧 A nice in-depth analysis of the potential dangers posed by the rapidly expanding use of algorithms in our modern world: The Real Story: Can algorithms be trusted? — overcast.fm/…

Palate Cleansers

Note: When the textual description of a link is part of the link it is the title of the page being linked to, when the text describing a link is not part of the link it is a description written by Bart.