Check Point Research Blog

Recently I've spent an entire day playing with AI Dungeon, an AI-based creative writing service for playing role-playing, Dungeon-like text games. You can pay to unlock the "Dungeon" model - an advanced machine learning model supposed based on GPT-3. It's not GPT-3 itself, and it's not perfect because its output is seriously biased for role-playing games, but as close as we can get for an outsider.

I was quite amazed by its performance. It was able to write first-person as an infosec researcher's blog post when I used some infosec news story as input, and it was also able to write a surprisingly coherent argument for patent reform and an argument against software patent when I used an EFF article as the input... These are clearly already included in its training input, but still, it was far beyond my expectation - none of the output is a verbatim quote from a single source, everything has been rewritten.

I went to Hacker News, copied a random infosec news report on newly discovered security vulnerability on Qualcomm's smartphone chips as the input, copied from https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/)

> With over 3 billion users globally, smartphones are an integral, almost inseparable part of our day-to-day lives. In this research dubbed "Achilles" we performed an extensive security review of a DSP chip from one of the leading manufacturers: Qualcomm Technologies. Qualcomm provides a wide variety of chips that are embedded into devices that…

Thanks for making this comment. This post is a wonderful example of the rampant marketing that has given the security industry a bad name.

- The title is technically accurate, which is the best kind of accurate for clickbait. This is not a novel vulnerability representative of an application security flaw within Google - the malware campaign specifically targets older devices using previously known vulnerabilities.[1] There is no new exploit research here.

- There's a logo and cute name for something which is, again, not a novel vulnerability.[2]

- Scaremongering tactics are used throughout to hype up the finding.[3][4] Deliberately ominous language like "...for now" is perhaps tolerable when it's coming from a media outlet, but it's certainly unacceptable from a firm conducting original security research.

All things told, this is closer to "threat intelligence" than real security research. A much better source for this news is the blog post by Google's Director of Android Security, Adrian Ludwig (first footnote, linked elsewhere in this thread as well). In particular, notice the succinctness and the serious, yet detached professionalism associated with the post.

In any case, there are legitimate arguments to be made in favor of extending software or device support lifetimes for vulnerability patches, but the onus is on device manufacturers to coordinate this. In the meantime, it would be great if fewer firms practiced this sort of manic self-promotion, but…

This is in a certain sense a typical checkpoint finding. It's probably a good finding and it's good that they point out the problematic andorid ecosystem.
But their announcement is then filled with some nonsense and marketing bullshit that's more likely to confuse users than help.

In their blog post they say [1]:

* "Use known, trusted Wi-Fi networks or while traveling use only those that you can verify are provided by a trustworthy source."
What's that supposed to mean? Is a Wifi trustworthy if it's named Starbucks, because I just bought a coffee there?

* "End users and enterprises should consider using mobile security solutions designed to detect suspicious behavior on a device, including malware that could be obfuscated within installed apps."
I call bullshit.

* And then further on [2]:
"ZoneAlarm® Mobile Security for Android™ keeps your mobile devices fully protected from malicious apps and Wi-Fi attacks."
Oh really? Can they explain how they overcame the theoretical limits (halting problem) that prevent something like this from being possible?

A lot of it reminds me to the Misfortune Cookie vuln a while ago. Also a good find from Check Point in DSL routers, yet they claimed Zone Alarm can protect you, which was outright nonsense.

[1] http://blog.checkpoint.com/2016/08/07/quadrooter/

[2] https://www.checkpoint.com/resources/quadrooter-vulnerability-consumer/

I disagree. It may seem good on paper, but it gives you too much of a false sense of security. Security measures like this often seem to work, but they are papering over a deeper problem. Usually this is being done because user input is not being handled carefully, and if so, the assumption that blocking some keywords "defangs" potential exploits is usually easy to prove false. Consider the case of eBay and JSFuck[1].

I dislike the mentality that leads to this; WAFs, lazy pentesting and compliance checkboxes have created a substantial body of absolute bullshit security theater and I have absolutely zero doubt that this has convinced companies it's "safe" to put insanely poorly written software partially out on the open internet and that they've "done their due diligence" so to speak. And then I get a letter in the mail apologizing that my most confidential information has yet again been leaked by some company I barely or didn't have any real choice to give my data to. I'm sure they all care deeply about my data and that's why it was stolen using decades-old Java serialization library vulnerabilities.

[1]: https://blog.checkpoint.com/research/ebay-platform-exposed-to-severe-vulnerability/

For almost every user - yes. If apps had to run in a strict sandbox it would be better for most users. Where it would make you jump through an incredible number of hoops or even install “developer editions” of operating systems.

You really can’t trust developers to do the right thing - even major developers like Zoom (the secret web server) , Facebook (the VPN that trashed usage actoss apps on iOS) and Google (convincing consumers to install corporate certificates to track usages on iOS).

Even more to the point, you read about some app installed outside of the Google Play store that’s malware - including the official side loaded version of FortNite…

https://blog.checkpoint.com/research/fortnite-vulnerability-where-only-the-secure-survive/

Checkpoint's release for these vulnerabilities is here https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/

not clear from the writeup how many devices are affected. They fuzz-tested 'a DSP chip' (sounds like just one) and then say that Qualcomm products are used in 40% of devices.

press release focuses on exfiltrating media + GPS, not clear if this is a rootkit that can access the keyboard or take over your email.

'more than 400 vulnerable pieces of code were found' not clear to me -- maybe I don't know how fuzzing DSPs work? Do they have access to the source code because the image decoder is open source?