News of the Cyber World

[kyonides]

News of the Cyber World

In the present thread I will post some curious news relating to cyber security, (design) flaws, adaptations, modifications, mobile apps and the like.

Modern ram used for computers vulnerable to Rowhammer attacks

https://www.linuxexperten.com/news/moder...er-attacks

Rowhammer attack is a means by which hackers can exploit the very same nature of DRAM, its high cell density to increase its capacity in GB of memory and data exchange. How does it happen? Well, those memory cells are able to leak its contents to other cells that had nothing to do with the cell block requested by any application to run properly. Usually programmers and designers would AVOID it at all costs but makers seemed to be lazy and refused to address the problem for years.

You wouldn't want your videogame session to overlap your homework written on Word / Powerpoint or LibreOffice Writer / Presentation that took you weeks to compile after readings dozen of boring books on subjects you find tedious and full of crappy stuff included between those very few snippets of information you have extracted from it, right?

Target Row Refresh (TRR) or the way they planned to deal with such issues are kind of laughable from a hacker's perpective it seems. Your data loaded on your DRAM is still in danger!
Nowadays they appear to be working on it at a slow pace... in vane because a study reveal a custom tool a research group made can be used to retrieve encryption keys from memory, or escalate an attacker's access right to sudo/SYSTEM-level on some of those flash new memory cards.

A real scandal...

Edge Browser Scores Worst In Telemetry Privacy

https://www.linuxexperten.com/news/edge-...ry-privacy

I guess you might prefer to use Firefox or Brave or Chromium instead, if you're working on a Windows box. Linux users don't have to worry about it.
By the way, Yandex is a bad as Edge.  

2FA code-stealing flaw in authenticator app

https://www.zdnet.com/article/google-cou...years-ago/
Researchers from ThreatFabric found out that Android phones might still be in danger.

Cerberus, a flaw capable of stealing some security codes generated by Android via Google Authenticator app, was discovered back in 2014 and the finder alerted Google about it on GitHub. Nightwatch researchers raised this very same point again in 2017 when they reported the same issue to Google's security team, says ZDNET.

Cerberus is also a hybrid between a banking trojan and a remote access trojan (RAT). It will get installed on your phone and then access the authenticator, take a screenshot of it with the generated codes and send them back to hackers eager to place their dirty hands on them. Yes, they get access to your banking data stored on your phone...
Frightening indeed!

A SandCastle for an Apple SandBox

https://www.linuxexperten.com/news/hack-...ne-android

Did you ever want to make your iPhone behave like an Android? Are you tired of having a phone that looks more like a sandbox? You no longer care about your device's warranty!?
Then this news are good for you!
Now you can turn your iPhone into an Android!  
Project Sandcastle is the solution a startup, namely Corellium, is offering to make it possible.

There's a catch! There's always a catch!

Corellium has been sued by Apple. You see, Apple does think it has the sole right to own your iPhone. They forget you purchased it sometime ago.
By the way, they also sued a bank and some US military contractor...