The biggest event for hackers concluded in Las Vegas last week. During the conference, there were many revelations that threw light on the cybersecurity space and some of them were shocking enough to get all the eyes. Here are the top updates that came out of Black Hat conference that you need to know about: 

Researchers Decrypted And Changed WhatsApp Messages 

Security experts from Checkpoint showed how hackers can alter WhatsApp messages. Checkpoint researchers reported that they had pointed the issue a year ago and the issue still persists. Interestingly, Facebook, the parent company has said that it is not a security vulnerability. WhatsApp is the largest social media messaging app, used by about 1.5 billion people across the globe, and 400 million users in India. 

Researchers pointed out the issue a year back, though Facebook says this is not a security vulnerability. Checkpoint Technologies also highlighted alleged vulnerabilities in the Facebook-own messaging app past week. Checkpoint researchers Roman Zaikin and Oded Vanunu said in their Black Hat USA session that they were able to reverse engineer WhatsApp web source code and decrypt traffic, thereby changing chat messages, as well as making private messages public and spoof sender identities. 

Checkpoint researchers shared that the platform leverages “protobuf2” protocol for encryption after successfully able to decrypt it. Converting protobuf2 encrypted data to Json (JavaScript Object Notation), researchers could see the actual parameters for the communication, which could also be manipulated to create spoof messages. 

Apple and Microsoft Bug Bounties For iOS And Azure Platforms

Apple announced that it was giving away special iPhones to ethical hackers and however could break into them and discover vulnerabilities would be rewarded with a million dollar bounty. Apart from Apple which opened its bug bounty program for iOS and MacOS to researchers, Microsoft also announced a bug bounty of USD 300,000, for any researcher to hack and expose vulnerabilities on the Azure cloud platform. 

It is noted that Natalie Silvanovich from Google’s Project Zero team recently researched the remote interaction-less attack surface of the iPhone and discovered 10 vulnerabilities in SMS, MMS, Visual Voicemail, iMessage and Mail, all of which have been patched by Apple. Similarly, after Microsoft announced its Azure-based bug bounty, Checkpoint revealed a remote code execution vulnerability in Microsoft’s Remote Desktop Protocol (RDP) which made unpatched Azure users exposed to attacks. 

Warshipping: IBM’s New Hacking Technique 

IBM X-Force Red–an autonomous team of veteran hackers, within IBM Security showcased a novel attack technique which has been nicknamed “warshipping”. With the new technique, IBM team demonstrated how a hacker can remotely gain access to a company’s wireless network by simply putting a small remote-controlled scanning device inside a package that gets delivered to an office building. 

IBM reported that that businesses need to be wary of unique ways in which hackers are lurking in corporate networks to steal sensitive information. By simply delivering a parcel to the company’s office, hackers can access all the resources within a company’s network by hiding in plain sight. IBM said it cost them less than $100 to create the gadget used in the research to harvest sensitive data. 

Spoofed Satellite Navigation Signals To Hijack Autonomous Cars 

Victor Murray, an Engineering Group Leader at SwRI, demonstrated how autonomous self-driving cars to stop, change directions and drive off the path. Murray achieved this by spoofing navigation data from the Global Navigation Satellite Systems (GNSS), including GPS maintained by US or the Russian GLONASS. Murray highlighted a serious flaw in current navigation systems that hackers can exploit.

In an interaction with media, Murray said GNSS signals are also very low power, and so it is not difficult to drown out legitimate GNSS broadcasts with malicious broadcasts. All of the GPS receivers are susceptible to spoofing as they lack integrity mechanisms, told Murray. Murray also mentioned prior research from Team Unicorn which was successful in creating spoof GNSS signals with less than a USD 400 radio and a laptop. 

New Spectre Vulnerability Found In Intel’s processors

Researchers from Bitdefender exposed a vulnerability which affects all of Intel’s x86 and x64 processors after 2012 (unless they have been patched already in a recent Microsoft update). It’s a modified form Spectre 1 vulnerability that takes advantage of speculative execution, a function found in x86 and x64 processors that anticipates and executes instructions even before specific commands are received by the system. Speculative-execution can leave information traces in-cache, allowing hackers to get in and access information stored in the protected kernel memory. The vulnerability makes use of the SWAPGS kernel-level instruction, first rolled out in 2012 with Ivy Bridge processors.