Medical equipment provider Medtronic has issued an urgent recall order for insulin pump controllers belonging to their “MiniMed Paradigm” family. The company cited serious cyber security risks as the reason for the recall.
The models in question are MMT-500 and MMT-503 which is used in conjunction with the Medtronic MiniMed 508 pump.
Overall more than 31,000 of these devices were sold between August 1999 and July 2018. These devices are used by diabetics all over the country to stop, start, or change the amount of insulin delivered to the user.
Medtronic was made aware of a security risk that could allow an unauthorized individual to record and replay the wireless signal generated any time the user presses a button on the controller. The controller sends commands to the insulin pump. An attacker could then over-deliver the desired amount of insulin or stop it from being delivered entirely. In the case of an insulin overdose or a denied dose this could lead to the death of the patient.
According to the latest data available to the company there have been no reports of this security flaw being exploited in the wilds. That is fortunate but as the security flaw becomes more widely known the worry is that it’s just a matter of time.
Medtronic issued a formal statement which contained the following recommendation:
“You should immediately stop using and disconnect the remote controller, disable the remote feature, and return the remote controller to Medtronic. See the Appendix attached to this letter for detailed instructions.”
Unfortunately this is not the first time Medtronic has had issues with this model. In 2019 the FDA warned users of the MiniMed 508 that these pumps were vulnerable to attack. Back then the issue the FDA was warning about was a man in the middle attack that could allow an attacker to take control over the device.
It appears that things haven’t gotten any better. If you, or anyone you know uses one of the devices referenced above don’t delay. Send it back for a replacement as soon as possible.
Researchers from Zimperium zLabs have detected a nasty, dangerous, global malware campaign that has managed to infect more than 10 million Android devices from around the world in more than 70 different countries.
As with most malware campaigns this one relies on social engineering to spread.
The first stage of the infection process is that the hackers have to get their malicious apps past the gatekeepers of the Google Play Store and other third-party app vendors.
This part is purely a numbers game but the hackers behind Grifthorse are pretty good at it. Grifthorse code has been found in more than 200 apps on the Play Store alone.
Once the poisoned apps are in position the next goal is to trick users into subscribing to paid services without their knowledge. So far the campaign has managed to steal hundreds of millions of dollars from their victims. Even worse is that in many cases users are unwittingly signed up for recurring payments that can add up quickly unless the victims are watching their accounts closely.
Zimperium’s researchers had this to say about the malware strain:
“Zimperium zLabs recently discovered an aggressive mobile premium services campaign with upwards of 10 million victims globally, and the total amount stolen could be well into the hundreds of millions of Euros.
…one of their first victims, if they have not shut off the scam, has lost more than €200 at the time of writing. The cumulative loss of the victims adds up to a massive profit for the cybercriminal group,” the researcher explained.
The numerical stats reveal that more than 10 million Android users fell victim to this campaign globally, suffering financial losses while the threat group grew wealthier and motivated with time.”
Don’t take the Grifthorse threat lightly and if you even suspect an infection monitor your accounts closely.
Are you a gamer? Do you have an account on Steam, EA Origin, or the Epic Games Store? If so there’s an emerging threat you should be aware of.
A new strain of malware is now being sold on the Dark Web. Discovered by researchers operating out of Kaspersky Labs the new malware strain has been dubbed BloodyStealer.
Once BloodyStealer is installed on an infected machine the malware is cable of stealing personal information including but not limited to login details at the sites mentioned above, information contained in cookie files, payment card information, and more.
Once the information is siphoned from a target system it is uploaded to a command and control server. There it is aggregated with the data from other pilfered accounts to be sold on the Dark Web. More disturbingly is the malware itself is being sold on the Dark Web which is leading to rapid and widespread adoption.
The researchers note that although the new malware strain isn’t made exclusively for targeting the gaming platforms listed above gaming is big business. They included that accounts controlled by gamers represent a lucrative segment of the market that’s very attractive to hackers and scammers around the world.
The researchers who discovered BloodyStealer had this to say about it:
“BloodyStealer is a prime example of an advanced tool used by cybercriminals to penetrate the gaming market. With its efficient anti-detection techniques and attractive pricing, it is sure to be seen in combination with other malware families soon.
Furthermore, with its interesting capabilities, such as extraction of browser passwords, cookies, and environment information as well as grabbing information related to online gaming platforms, BloodyStealer provides value in terms of data that can be stolen from gamers and later sold on the darknet.”
Keep a watchful eye out for this one especially if you’re a gamer.
Do you have an iPhone? Do you make use of the Apple Pay service? If so there is a security issue you need to be aware of. Researchers have discovered a means by which fraudulent payments can be made from a locked iPhone.
Two conditions must be true for the flaw to be exploited. The user must have a Visa card in their digital wallet and they must have express mode enabled.
Essentially the flaw amounts to digital pick-pocketing. It can be performed even if the owner of the phone has it tucked away in a bag or pocket. Even worse is the fact that there is no transaction limit.
This issue was apparently created when the company attempted to solve a separate issue. Apple users had been complaining that Apple Pay was sometimes cumbersome to use because it required the user to unlock the phone with a password, Touch ID, or Face ID.
In order to improve the overall user experience the company added an Express Mode to the service allowing transactions to be completed without the phone being unlocked.
When users enable this option in Apple Pay they get a notification that reads as follows:
“The card you select will work automatically without requiring your Touch ID or your passcode. Just hold iPhone near a supported transit reader.”
The researchers were able to emulate a ticket-barrier transaction of the kind you’d find in a mass transit station by using a Proxmark device which acted as a card reader. This device communicated with the target iPhone with an NFC chip that communicated with a payment terminal.
It’s easy enough to see how this story ends. Although not yet ubiquitous attacks like this are already being seen in the wilds and they will only increase in popularity over time.
As of now there is no fix for this issue. Visa and Apple insist that it’s a problem the other company needs to take charge of fixing. The best thing you can do to avoid the issue is to steer clear of Express Mode.
It’s good to be the King and in the world of search Google is the undisputed King.
That fact has made the tech giant something of a target however. Google has been sued repeatedly and investigated by both the US Congress and the EU’s General Court owing to its dominant position in the realm of search.
Many of the court cases the company is involved in hinge on the notion that Google is leveraging its dominant position to take unfair advantage. Recently the company has hit upon a novel way of defending itself.
A lawyer for Google presented evidence to the EU’s General Court that the most popular search term on the Bing search engine is, in fact “Google.” Thus, the company argues it has nothing to do with them unfairly leveraging their dominant position. The simple fact is that search engine users themselves are searching for Google because they simply prefer it.
Alfonso Lamadrid is one of the lawyers for Google’s parent company named Alphabet.
Lamadrid had this to say about the recent discovery:
“We have submitted evidence showing that the most common search query on Bing is by far Google. People use Google because they choose to, not because they are forced to. Google’s market share in general search is consistent with consumer surveys showing that 95 percent of users prefer Google to rival search engines.”
The company makes a compelling case that’s awfully hard to argue against. If users on a different search engine go out of their way to search for Google that’s got nothing to do with the company. Save for the fact that Google offers the superior product that the vast majority of end users prefer.
It remains to be seen how effective this line of reasoning will be before the court but it’s hard to see a flaw in the logic.
Are you a QuickBooks user? If so you’re going to be thrilled by the company’s recent announcement that Excel integration is coming soon.
You read that correctly. Soon you will be able to sync QuickBooks and Excel which should simplify your life a great deal. This is but the latest in a long line of similar moves Intuit QuickBooks has made.
Over the past few years the company has integrated their wildly popular software with a variety of other platforms like Bill.com, HubSpot, LeanLaw and DocuSign.
Alex Chriss is QuickBook’s Executive VP and General Manager.
He had this to say about the recent announcement:
“Further reducing complex workflows through automation, coupled with powerful customization capabilities, will enhance performance and scalability and allow businesses at a critical point in their journey to reach a new level of growth…
Customers will be able to sync data between Excel and QuickBooks Online Advanced automatically. This much-requested capability will help businesses save time and further streamline data syncing at critical points in their business journey, whether they’re adopting accounting software or seeking enhanced reporting that delivers greater visibility into their operations.
Customers will be able to build custom reports, in a tool they already use, without compromising on convenience or accuracy of data.”
If you run a business of any size this is great news indeed. If you aren’t currently using QuickBooks and your current accounting software is leaving you underwhelmed now is a great time to give QuickBooks a try. It is a solution hundreds of thousands of business owners rely on. Given the large and growing number of integrations available it’s easy to understand why.
Kudos to QuickBooks for going the extra mile and working so hard to create added value for their customers.
Hackers around the world are flexing their muscles.
For reasons that aren’t yet clear they have been launching distributed denial of service (DDOS) attacks against Voice over Internet Protocol (VoIP) providers and it is leading to widespread voice outages. VoIP provider Bandwidth.com is the latest company to fall victim to these attacks.
On the afternoon of September 25th the company began reporting a series of unexpected failures in their voice and messaging services. When the problem first began the company posted a notice on their status page that read as follows:
“Bandwidth is investigating an incident impacting Voice and Messaging Services. Calls and Messages may experience unexpected failures. All teams are actively engaged.”
In short order the teams leading the investigated uncovered the root cause. Threat actors were conducting a DDOS attack against them hoping to pressure the company into paying a Bitcoin ransom to make the attacks stop. The company opted not to pay and fought back to protect their network.
For now at least it seems that Bandwidth.com has won. However there is no guarantee that the attacks won’t increase in their intensity. David Morken is the CEO of Bandwidth.com.
Morken published the following on the company’s blog as the attack began to abate:
“Bandwidth and a number of critical communications service providers have been targeted by a rolling DDoS attack. While we have mitigated much intended harm, we know some of you have been significantly impacted by this event. For that I am truly sorry.
You trust us with your mission-critical communications. There is nothing this team takes more seriously. We are working around the clock to support your teams and minimize the impact of this attack. Our account managers and support teams have been actively reaching out to customers individually to address any issues. If you are experiencing problems and you haven’t heard from us yet, please let us know.
Real-time updates will continue to be posted at status.bandwidth.com. We will not rest until we end this incident, and will continue to do all we can to protect against future ones.
Thank you for your patience.”
Kudos to Bandwidth.com for their diligence and excellent handling of this incident.
A new Zero Day vulnerability in macOS has been discovered. The flaw impacts all macOS versions up to the latest release Big Sur. The bug was found by Park Minchan an independent security researcher and is tied to the way that macOS processes inteloc files. The processing methodology allows an attacker to embed malicious commands which the system will execute without any warnings or prompts visible to the user of the targeted machine.
Interloc is short for “internet location files” and have the extension “*.interloc”
A recently published SSD Secure Disclosure advisory had this to say about the newly discovered flaw:
“A vulnerability in macOS Finder allows files whose extension is inetloc to execute arbitrary commands. These files can be embedded inside emails which if the user clicks on them will execute the commands embedded inside them without providing a prompt or warning to the user.”
In this particular instance Apple botched the fix quietly patching the issue without assigning it a CVE identification number.
Unfortunately the fix was only partial and at present the bug can still be exploited in some instances as described below:
“Newer versions of macOS (from Big Sur) have blocked the file:// prefix (in the com.apple.generic-internet-location) however they did a case matching causing File:// or fIle:// to bypass the check. We have notified Apple that FiLe:// (just mangling the value) doesn’t appear to be blocked, but have not received any response from them since the report has been made. As far as we know, at the moment, the vulnerability has not been patched.”
Park Minchan developed a proof of concept that demonstrates how the bug could be exploited but to date no threat actors have been discovered exploiting the flaw in the wild. It is just a matter of time however. A flaw like this represents a serious weakness in the security of the OS.
Be aware that the easiest way to exploit the bug is via malicious links embedded in emails so make sure your employees are aware of the risks.
If you use the YouTube app on your phone and you’re a premium subscriber you’ve currently got the ability to download videos from the service. As of this date however those are the only people who have the ability to download videos.
Even if you’ve subscribed to the premium service there is no download function. That’s even if you access your account from your PC.
Recently YouTube decided to change that by adding the download function to the desktop experience so that it mirrors the app-based experience.
The new feature is already in place. So if you are a premium subscriber all you’ve got to do is to click on the share options below the video. Another option is alongside the “three dot” menu and you’ll see the new download option. Any videos you download from YouTube will be stored in your offline library where you can organize and sort them as you see fit.
Note that you’ll also be able to specify the resolution of the downloaded video and choose between 144p to 1080p. Significantly there is no 4k download option available. The good news is that there doesn’t appear to be any file size limitations beyond the available space you have on your hard drive.
The new feature is not browser specific. So whatever browser you use you should be able to download YouTube videos without difficulty. Again assuming that you’re a premium subscriber.
It may not be a feature you use terribly often but it is handy and convenient and when you need it you’ll probably really need it. Kudos to Google for continuing the good work of improving overall user experience and for making that experience seamless across multiple platforms.
It may not be something that will be sufficient to prompt most people to pay for the subscription service. However if you’re already paying the monthly fee it’s a nice perk that hasn’t been available to desktop users until now.
