This Week In Nerd News - December 14, 2020

DHS, DOJ And DOD Are All Customers Of SolarWinds Orion.

The Source Of The Huge US Government Hack. Ouch. While the infection is on SolarWinds, the outcome was 100% preventable with DTTS.

The latest espionage attack on the U.S. government is not limited to the Treasury and Commerce departments. Looking at the agencies who use the software that was used as a launchpad for the hacks, the breach could go right to the heart of America’s national security apparatus.

New adware campaign warning from Microsoft.

Third party ad blocking is an excellent mitigation against this.

Microsoft has issued a warning about Adrozek, a new strain of browser modifier that, according to the company, “adds browser extensions, modifies a specific DLL per target browser, and changes browser settings to insert additional, unauthorized ads into web pages.”

Persistent code execution in the Google Play Core Library.

Just another reminder that Android managed updates are essential to keep it secure.

The Google Play Core Library is a popular library for Android that allows updates to various parts of an app to be delivered at runtime without the participation of the user, via the Google API. It can also be used to reduce the size of the main apk file by loading resources optimized for a particular device and settings (localization, image dimensions, processor architecture, dynamic modules) instead of storing dozens of different possible versions. The vulnerability we discovered made it possible to add executable modules to any apps using the library, meaning arbitrary code could be executed within them. An attacker who had a malware app installed on the victim’s device could steal users’ login details, passwords, and financial details, and read their mail.

Oblivious DoH from Cloudflare.

Will be interesting if anyone outside of the announced partners will ever deploy it because no ISP has any motivation to do so, even though at the ISP core would be the ideal place to deploy ODoH.

Today we are announcing support for a new proposed DNS standard — co-authored by engineers from Cloudflare, Apple, and Fastly — that separates IP addresses from queries, so that no single entity can see both at the same time. Even better, we’ve made source code available, so anyone can try out ODoH, or run their own ODoH service!