Update your OpenSSH ASAP - ThreatWire
Hak5
10 min, 2 sec
This week's ThreatWire episode delves into the Rabbit R1 security concerns, reverse engineering efforts, and the broader implications of coding and security.
Summary
- The host discusses the Rabbit R1 device's extreme scrutiny due to poor security practices and reverse engineering by the Rabbitude team.
- Rabbitude gained access to R1's backend and found hard-coded API keys, leading to potential severe consequences for R1 users.
- The Rabbit team's lackluster response to security breaches is criticized, alongside their failure to address the issue properly.
- The episode also covers a major supply chain attack on the JavaScript ecosystem and a new vulnerability in OpenSSH affecting Linux systems.
Chapter 1
The host introduces the episode's focus on coding, security, and starts the report on the Rabbit R1 device's security flaws.
- The host expresses enthusiasm for discussing coding and security.
- She introduces the series 'ThreatWire'.
- Rabbit R1, an AI-enabled handheld device, has been criticized for security flaws since its launch.
Chapter 2
Rabbitude team exposes security issues with Rabbit R1, revealing their access to backend servers and the device's API keys.
- Rabbitude, a reverse engineering community, picked apart R1's hardware and exposed security flaws.
- They found hard-coded API keys in the backend, which could lead to serious privacy breaches.
- Despite being aware of the API key leaks, the Rabbit team disregarded the issue.
Chapter 3
The Rabbit team's inadequate response to the security concerns is highlighted, with minimal action taken.
- The Rabbit team addressed a data breach but failed to acknowledge the severity of the security incident.
- They eventually rotated the API keys after public exposure, causing brief downtime.
- Rabbit's CEO denies the claims of unauthorized emails, asserting they were spoofed.
Chapter 4
The host encounters a microphone malfunction and switches to an alternative microphone to continue the episode.
- The host acknowledges a technical issue with the lavalier microphone.
- She switches to using a Shure microphone to ensure the episode's recording can proceed.
- The host thanks viewers for understanding the microphone error.
Chapter 5
Sans SEC uncovers a major supply chain attack involving the JavaScript library polyfill, affecting various users and companies.
- Polyfill, a JavaScript library for backward compatibility, was sold to a Chinese entity, leading to instability and security issues.
- Malware was injected onto devices through the polyfill.io domain.
- CDN companies Fastly and Cloudflare create endpoints hosting polyfill to mitigate the issue.
Chapter 6
A critical remote code execution vulnerability in OpenSSH affecting Linux systems is discovered and users are urged to update.
- The vulnerability, identified as CVE-2024-6387, affects default configurations of OpenSSH and has a high severity score.
- It is caused by a race condition during authentication and affects several versions of OpenSSH.
- Over 14 million instances are potentially vulnerable; a patch is available for users to apply.
Chapter 7
The host concludes with a call for feedback on content preferences and promotes the show's Patreon for additional support.
- The host addresses viewer feedback for more technical content.
- She suggests monthly live streams on Patreon for deeper technical analysis.
- Viewers are invited to support the ad-free show on Patreon.
Chapter 8
The host wraps up the episode and directs viewers to find her online presence for more content and updates.
- The episode of ThreatWire for the week of July 1st, 2024 is concluded.
- The host invites viewers to follow her on various online platforms using her handle.