Check Point Research Blog

Thanks for making this comment. This post is a wonderful example of the rampant marketing that has given the security industry a bad name. - The title is technically accurate, which is the best kind of accurate for clickbait. This is not a novel vulnerability representative of an application security flaw within Google - the malware campaign specifically targets older devices using previously known vulnerabilities.[1] There is no new exploit research here. - There's a logo and cute name for something which is, again, not a novel vulnerability.[2] - Scaremongering tactics are used throughout to hype up the finding.[3][4] Deliberately ominous language like "...for now" is perhaps tolerable when it's coming from a media outlet, but it's certainly unacceptable from a firm conducting original security research. All things told, this is closer to "threat intelligence" than real security research. A much better source for this news is the blog post by Google's Director of Android Security, Adrian Ludwig (first footnote, linked elsewhere in this thread as well). In particular, notice the succinctness and the serious, yet detached professionalism associated with the post. In any case, there are legitimate arguments to be made in favor of extending software or device support lifetimes for vulnerability patches, but the onus is on device manufacturers to coordinate this. In the meantime, it would be great if fewer firms practiced this sort of manic self-promotion, but…

This is in a certain sense a typical checkpoint finding. It's probably a good finding and it's good that they point out the problematic andorid ecosystem. But their announcement is then filled with some nonsense and marketing bullshit that's more likely to confuse users than help. In their blog post they say [1]: * "Use known, trusted Wi-Fi networks or while traveling use only those that you can verify are provided by a trustworthy source." What's that supposed to mean? Is a Wifi trustworthy if it's named Starbucks, because I just bought a coffee there? * "End users and enterprises should consider using mobile security solutions designed to detect suspicious behavior on a device, including malware that could be obfuscated within installed apps." I call bullshit. * And then further on [2]: "ZoneAlarm® Mobile Security for Android™ keeps your mobile devices fully protected from malicious apps and Wi-Fi attacks." Oh really? Can they explain how they overcame the theoretical limits (halting problem) that prevent something like this from being possible? A lot of it reminds me to the Misfortune Cookie vuln a while ago. Also a good find from Check Point in DSL routers, yet they claimed Zone Alarm can protect you, which was outright nonsense. [1] http://blog.checkpoint.com/2016/08/07/quadrooter/ [2] https://www.checkpoint.com/resources/quadrooter-vulnerability-consumer…

According to checkpoint.. https://blog.checkpoint.com/exposure-management/the-2026-u-s-midterms-…

Anyone talking about "fax security" is another monk of security through obscurity. Phone line can be listened, fax can be hacked[1] and, most of the time, the fax is the copier and everyone in the building has access to it. 20 years ago I worked for a client that had a fax to exchange connector, any mailbox could send a fax from outlook[2] and they had linked fax numbers to group mailbox so that each department had their own fax numbers. 1 : https://blog.checkpoint.com/security/faxploit-hp-printer-fax-exploit/ 2 : It was always fun to analyze fax sending errors because someone wanted to send a funny video to a fax number.

For almost every user - yes. If apps had to run in a strict sandbox it would be better for most users. Where it would make you jump through an incredible number of hoops or even install “developer editions” of operating systems. You really can’t trust developers to do the right thing - even major developers like Zoom (the secret web server) , Facebook (the VPN that trashed usage actoss apps on iOS) and Google (convincing consumers to install corporate certificates to track usages on iOS). Even more to the point, you read about some app installed outside of the Google Play store that’s malware - including the official side loaded version of FortNite… https://blog.checkpoint.com/research/fortnite-vulnerability-where-only…

Checkpoint found a bunch of issues [1][2] using QEMU and AFL some time ago. So it's possible that's why srlabs didn't find much yet. [1] https://research.checkpoint.com/2021/security-probe-of-qualcomm-msm/ [2] https://blog.checkpoint.com/security/achilles-small-chip-big-peril/

It'd be easier to just Google it. Grievances start with "made in China" and end with firmware hacks from May of this year. https://blog.checkpoint.com/security/check-point-research-reveals-a-ma…

I was at a DefCon talk where these researchers demonstrated pwning a network by sending a fax: https://blog.checkpoint.com/2018/08/12/faxploit-hp-printer-fax-exploit…

Checkpoint's release for these vulnerabilities is here https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/ not clear from the writeup how many devices are affected. They fuzz-tested 'a DSP chip' (sounds like just one) and then say that Qualcomm products are used in 40% of devices. press release focuses on exfiltrating media + GPS, not clear if this is a rootkit that can access the keyboard or take over your email. 'more than 400 vulnerable pieces of code were found' not clear to me -- maybe I don't know how fuzzing DSPs work? Do they have access to the source code because the image decoder is open source?

Blog spam. Typical ArsTechnica these days. Here's the actual report: https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/

Multiple Kernel Vulnerabilities Affecting All Qualcomm Devices (2020) https://blog.zimperium.com/multiple-kernel-vulnerabilities-affecting-a… The Road to Qualcomm TrustZone Apps Fuzzing (2019) https://research.checkpoint.com/2019/the-road-to-qualcomm-trustzone-ap… QualPwn - Exploiting Qualcomm WLAN and Modem Over The Air (2019) https://blade.tencent.com/en/advisories/qualpwn/ QuadRooter: New Android Vulnerabilities in Over 900 Million Devices (2016) https://blog.checkpoint.com/2016/08/07/quadrooter/

There is no specific information available about the nature of the vulnerabilities or possible mitigation. Arstechnica.com is sensationalizing the news, when it comes to security I would rely on actual sec researchers. https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/

It had massive security problems, so they mostly killed it. eg https://blog.checkpoint.com/2015/05/12/the-microsoft-help-file-chm-may…

Not necessarily - if your all-in-one printer/fax/scanner combo machine is also connected to both the POTS and your internal network (as most probably are), it can be used as an attack vector: https://blog.checkpoint.com/2018/08/12/faxploit-hp-printer-fax-exploit…

It's not exactly a virus, but last fall some folks put together a PoC showing how certain fax machines could be compromised over the phone line, and used to gain access to their connected networks. [1] [1] https://blog.checkpoint.com/2018/08/12/faxploit-hp-printer-fax-exploit…

I thought so, too. CheckPoint's diagram of a Man in the Disk attack is also helpful: https://blog.checkpoint.com/wp-content/uploads/2018/08/Man-in-the-Disk…

This is the sourced post http://blog.checkpoint.com/2017/05/23/hacked-in-translation/ The ingenuity that goes into RCE exploits never ceases to amaze (and terrify) me. Can't wait for more details to be released.

URL should probably be changed to the original source: http://blog.checkpoint.com/2017/03/15/check-point-discloses-vulnerabil…

F-Droid is too much of a liability. http://blog.checkpoint.com/2016/11/30/1-million-google-accounts-breach…

http://blog.checkpoint.com/2016/02/02/ebay-platform-exposed-to-severe-… http://thedailywtf.com/articles/bidding-on-security

At a higher level than the other guy, and not precisely the same thing: http://blog.checkpoint.com/2016/02/02/ebay-platform-exposed-to-severe-…

The source is at http://blog.checkpoint.com/2016/08/07/quadrooter/http://blog.checkpoin… but that one is unreachable ATM.

It's sorta strange seeing this here today, since I'm not aware of anything happening with Salsa20 lately. But for people that are interested, the Petya ransomware that was running around a couple months ago used a borked version of Salsa20[1], returning 16-bit values instead of 32 bit values, which lead people to break it [2][3]. Moral of the story: don't roll your own crypto, even when you're a malware author. [1]: http://blog.checkpoint.com/2016/04/11/decrypting-the-petya-ransomware/ [2]: https://github.com/leo-stone/hack-petya [3]: https://0xec.blogspot.com/2016/04/reversing-petya-ransomware-with.html

Ok the linked[0] blog post from Check Point has more details into whats actually happening. [0] http://blog.checkpoint.com/2015/09/08/whatsapp-maliciouscard-vulnerabi…

I disagree. It may seem good on paper, but it gives you too much of a false sense of security. Security measures like this often seem to work, but they are papering over a deeper problem. Usually this is being done because user input is not being handled carefully, and if so, the assumption that blocking some keywords "defangs" potential exploits is usually easy to prove false. Consider the case of eBay and JSFuck[1]. I dislike the mentality that leads to this; WAFs, lazy pentesting and compliance checkboxes have created a substantial body of absolute bullshit security theater and I have absolutely zero doubt that this has convinced companies it's "safe" to put insanely poorly written software partially out on the open internet and that they've "done their due diligence" so to speak. And then I get a letter in the mail apologizing that my most confidential information has yet again been leaked by some company I barely or didn't have any real choice to give my data to. I'm sure they all care deeply about my data and that's why it was stolen using decades-old Java serialization library vulnerabilities. [1]: https://blog.checkpoint.com/research/ebay-platform-exposed-to-severe-v…

Recently I've spent an entire day playing with AI Dungeon, an AI-based creative writing service for playing role-playing, Dungeon-like text games. You can pay to unlock the "Dungeon" model - an advanced machine learning model supposed based on GPT-3. It's not GPT-3 itself, and it's not perfect because its output is seriously biased for role-playing games, but as close as we can get for an outsider. I was quite amazed by its performance. It was able to write first-person as an infosec researcher's blog post when I used some infosec news story as input, and it was also able to write a surprisingly coherent argument for patent reform and an argument against software patent when I used an EFF article as the input... These are clearly already included in its training input, but still, it was far beyond my expectation - none of the output is a verbatim quote from a single source, everything has been rewritten. I went to Hacker News, copied a random infosec news report on newly discovered security vulnerability on Qualcomm's smartphone chips as the input, copied from https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/) > With over 3 billion users globally, smartphones are an integral, almost inseparable part of our day-to-day lives. In this research dubbed "Achilles" we performed an extensive security review of a DSP chip from one of the leading manufacturers: Qualcomm Technologies. Qualcomm provides a wide variety of chips that are embedded into devices that…