Hey all,
Here are this week’s cyber updates:
(1) Hyundai app has been found vulnerable to MiTM attacks. The app communicates with Hyundai’s server using the HTTP protocol, but encrypts the data before it is sent. However, the encryption key is symmetric, hence allowing an attacker to decrypt the data.
Thus, a malicious user connected to the same Wi-Fi network as the attacker may conduct a MiTM attack and view the username and password. This would allow the attacker to track the victim’s car, unlock its door and start its engine.
I wonder if insurance companies would increase the premium for Hyundai cars 🙂
Here are all the details:
(2) When users buy a new laptop, they think of its firmware, weight, and battery life, but they don’t think of the default programs that are installed with it. HP laptops, which are shipped with the HP Display Control software, are now vulnerable to privilege escalation exploits. In particular, the installed service is executed as the SYSTEM user, but allows any OS user to change the service’s binary path.
An attacker can thus change the binary path to their own malicious executable, therefore executing OS code with SYSTEM privileges.
Here are all the details:
(3) Can you hack the US Air Force? Now you can legally do it, and gain money from it. The DoD has engaged with a new bug bounty program, allowing you to hack the Air Force, but beware, you must be a citizen of the Five Eyes countries to participate and pass a background check.
Here are all the details:
Stay tuned for more updates,
Dan Gurfinkel
Head of Offensive Security & Response Unit
