{"id":5558,"date":"2018-07-07T18:28:00","date_gmt":"2018-07-07T18:28:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/snooping-passwords-from-literally-hot-keys-chinas-ak-47-laser-malware-and-more\/"},"modified":"2018-07-07T18:28:00","modified_gmt":"2018-07-07T18:28:00","slug":"snooping-passwords-from-literally-hot-keys-chinas-ak-47-laser-malware-and-more","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/snooping-passwords-from-literally-hot-keys-chinas-ak-47-laser-malware-and-more\/","title":{"rendered":"Snooping passwords from literally hot keys, China’s AK-47 laser, malware, and more"},"content":{"rendered":"
<\/div>\n

Roundup<\/strong> The week surrounding America’s “Huzzah, we kicked out the Brits, and will now spell color any way we like” Day, on July 4, is traditionally one of the slowest periods in the annual business tech news cycle.<\/p>\n

IT security<\/a>, on the other hand, never rests. We’ve covered Google cracking down<\/a> on non-HTTPS sites, Fortnite cheats getting pwned<\/a> by malware, a fascinating interview<\/a> with plane hacker Chris Roberts, and even a new (and poorly written) computer crime novel<\/a> cowritten by Bill Clinton.<\/p>\n

But there were other stories bubbling under, so here’s the best of the rest.<\/p>\n

Time to get patching Ubuntu<\/span><\/h3>\n

Canonical has issued a rash of new security patches<\/a> for its Ubuntu GNU\/Linux distribution \u2013 updates that should be installed as soon as possible.<\/p>\n

Not all of these fixes are alike. If you’re running a system with an AMD processor, one patch removes an earlier update that was supposed to address the Spectre<\/a> CPU vulnerability. That microcode-level mitigation left some AMD-powered systems unable to boot, and now has been given the boot from Ubuntu Linux computers.<\/p>\n

There’s also a security update for Firefox packages, following critical fixes<\/a> from Mozilla. Ubuntu’s handling of PHP, Devscripts, and Archive Zip have also been given some secure code lovin’.<\/p>\n

Regarding the Firefox updates, the security fixes were publicly issued by the browser’s maker Mozilla on June 25 and 26, however, are only now making their way to Ubuntu users. Other Linux flavors, such as Debian, pushed out the Firefox security update days earlier to users.<\/p>\n

We asked Canonical why the week-long hold up, and a spokesperson told us the Ubuntu team was “waiting for the point release from Mozilla before pushing out updates.” The Firefox snap<\/a> is kept “up to date so users can install that if they want to run the latest version.”<\/p>\n

Still, the delay irritated<\/a> some, it meant people were left running vulnerable software while miscreants potentially developed exploits for the disclosed bugs.<\/p>\n

Infosec consultant, Stephan Verb\u00fccheln, based in Switzerland, told us earlier this week before Ubuntu updated its Firefox packages: “Despite this version fixing several security issues with critical risk, Ubuntu has still not updated the version in their repositories. There is no reason to assume that Ubuntu staff was overwhelmed by a sudden Mozilla release.”<\/p>\n

In any case, if you use Firefox, get the latest updates.<\/p>\n

Beware the Therminator<\/span><\/h3>\n

No, not Arnie with a lisp, but instead an interesting bit of research into side-channel data-leaking techniques.<\/p>\n

Boffins at the University of California Irvine has been doing some interesting work<\/a> [PDF] into thermal imaging and passwords. Humans run quite hot thanks to our mammalian status, and it turns out warm fingerprints left on key tops after typing in a password can be observed to snatch one’s login credentials.<\/p>\n

You might think that the poor thermal conductivity of the average keyboard was negligible, but it turns out a heat-sensing camera can spot keystrokes up to 45 seconds after the keys are pressed. It’s a canny bit of research that led the eggheads to postulate that we should consider dumping passwords altogether for a better system.<\/p>\n

It’s a cute surveillance technique, but one can’t help wondering about its practicality. After all, if you have the kind of access to a target that allows this kind of thermal imaging then why not just use a plain old camera to watch typed passwords, install a keylogger, or just look over their shoulder.<\/p>\n

\n

Quick links<\/span><\/h3>\n