SN 1070: CISA's Free Internet Scanning - Malware Disguised as a VPN
Steve Gibson discusses various cybersecurity topics including social media companies backing away from end-to-end encryption, malware disguised as VPN software, and his positive experience with CISA's free internet scanning service. He also addresses questions about AI-generated code and shares insights from security researchers about current threats.
Summary
This Security Now episode covers multiple cybersecurity developments. Gibson begins by discussing how both TikTok and Meta have announced plans to discontinue or not implement end-to-end encryption on their platforms, citing concerns about content moderation and child safety. He suggests this may signal a broader retreat from consumer encryption on major platforms. The episode covers proxy-related malware, particularly the takedown of SOX Escort, a residential proxy service that was actually a front for malware operations infecting routers and modems to create proxy botnets. Gibson warns about the growing threat of malware targeting consumer bandwidth for malicious purposes. A significant portion discusses VPN-related malware, where attackers use SEO poisoning to distribute fake VPN clients that harvest credentials while appearing legitimate. Microsoft's research shows these attacks use digitally signed malware hosted on trusted platforms like GitHub. Gibson addresses listener questions about AI-generated code, sharing contrasting perspectives from product manager Akash Gupta and veteran programmer Uncle Bob Martin. While acknowledging AI's potential, Gibson explains his personal reluctance to use AI for production code due to concerns about understanding and maintaining code he didn't write. The main feature discusses Gibson's successful experience with CISA's free internet scanning service, which he highly recommends to enterprise users. CISA found a minor vulnerability in GRC's SSL configuration involving deprecated cipher suites, demonstrating the service's value even for well-maintained networks.
Key Insights
- Gibson argues that Meta and TikTok's retreat from end-to-end encryption may signal a broader industry backing away from consumer encryption on major platforms
- Gibson claims that most users don't actually demand encryption and won't leave platforms if it's removed, unlike privacy advocates
- Gibson explains that SOX Escort operated as a malware front, infecting over 369,000 IP addresses through router vulnerabilities rather than user permission
- Gibson warns that bad guys have substantial interest in using distributed consumer bandwidth to hide their attacks behind residential IP addresses
- Gibson states that keeping routers secure requires avoiding any deliberately exposed WAN-side services, particularly remote web access to management interfaces
- Gibson describes how attackers use SEO poisoning to make malicious VPN downloads appear first in Google search results for legitimate VPN software
- Gibson notes that the fake VPN malware was digitally signed with valid certificates, representing a failure of the code signing system to prevent malicious software
- Gibson argues that today's AI is 'stochastic' and cannot absolutely follow rules, making it unsuitable for production code where reliability is critical
- Gibson explains his personal coding philosophy centers on writing code as correctly as possible rather than just 'good enough'
- Gibson believes future AI coding will require specialized, application-specific AI rather than general-purpose models
- Gibson reports that CISA's scanning service found a theoretical SSL vulnerability in GRC's servers related to deprecated 64-bit block ciphers
- Gibson explains that the Suite 32 vulnerability would require 18.6 hours of continuous connection and 705 GB of data transfer to exploit
- Gibson discovered that CISA scans networks continuously with frequency based on vulnerability severity, from every 12 hours for critical issues to every 90 days for dark hosts
- Gibson argues there's no downside to CISA scanning since they only examine publicly accessible information that attackers can already see
- Gibson recommends that any organization with multiple static IP addresses should use CISA's free scanning service as an additional security layer
Topics
Full transcript available for MurmurCast members
Sign Up to Access