WeLiveSecurity

Air-gapped, the only way to go.

https://www.welivesecurity.com/2021/12/01/jumping-air-gap-15-years-nation-state-effort/

There are still several vectors even with the top security clearance procedures. They routinely miss things at security checkpoints.

“Even a perfect air gap will be vulnerable to a variety of different attack vectors, including (but not limited to) the following:

Physical compromise: An adversary bypasses physical security and gains access directly to the air-gapped network devices. Physical access is by far the most effective and obvious technique.

Insider threats: Someone who is part of an organization and has access to air-gapped secure systems intentionally or unintentionally compromises a system.

Supply chain compromise: A vendor with legitimate access to air-gapped systems unwittingly is compromised and brings infected devices into a network.

Misconfiguration: Misconfiguration of access controls or permissions allows an attacker to access the air-gapped system through a separate device on the network.

Social engineering (media drop): If an attacker was able to successfully conduct a malicious USB/media drop and an employee was to use that media within the air-gapped system, the network could be compromised.

Other advanced tactics: Thermal manipulation, covert surface vibrations, LEDs, ultrasonic transmissions, radio signals, and magnetic fields are among a range of advanced tactics documented and demonstrated by researchers at Ben Gurion…

I've been gradually improving my dev setup security over the past few months based on continuous reports like this. Here are things I'm trying out to improve my setup: - Use VSCode dev containers for development [1a]. Once you've created one once then they're quite easy to use and you don't need much Docker knowledge - it just needs to be installed. It's perfect for spinning up web/console apps but I had trouble with other stuff like Flutter and Electron. - Similarly I got familiar with GitHub Codespaces for smaller projects [1b]. I've done live coding in an interview before (where I had to modify a simple Node project) and I would absolutely use containers/codespaces for anything like that these days [2]. You can spin one up straight from any GitHub repo page and they're easy to work with. - Read the OWASP guidelines regularly for things like npm, Node, and Docker best practises. e.g. for Docker use the smallest image you can (Alpine) and use explicit Docker image tags [3]. - Review npm/python packages before installing them using socket.dev - it shows a full dependency security overview for things like env variable access, network calls, supply chain attacks, recent code ownership changes etc. You can also disable postinstall scripts globally as suggested by OWASP [4].

[1a] https://code.visualstudio.com/docs/devcontainers/create-dev-container [1b] https://github.com/codespaces [2]…

Yeah, they also raised $8M back in 2016: https://techcrunch.com/2016/05/26/adding-a-youtube-integration-ampme-raises-8-million-for-its-app-syncing-phones-into-a-single-speaker-system/

It seems that advertising didn’t work out, so they turned to in-app purchases in 2018 – roughly when the fake reviews also started.

On the subscription, it’s harder to cancel than it is to sign up for, like all App Store IAP subscriptions. It really should be possible to easily cancel from within the app itself rather than going to the Settings app – something a lot of people don’t know how to do, unfortunately.

“It used to be a legit app”: https://twitter.com/lap_felix/status/1480631686413041666?s=20

On the founder’s previous company: “Wajam: From start‑up to massively‑spread adware” https://www.welivesecurity.com/2019/06/05/wajam-startup-massively-spread-adware/

> would have thought the hoops Android/iOS make you jump through to add a PWA would be enough to make people question

The og article by ESET Security [0] specifically talks about (Android/Chrome-supported) WebAPKs essentially bypassing the usual "untrusted sources" warning, and that even the App Info screen shows Play Store as the origin source for all installed WebAPKs.

> tricky to teach someone to be tech literate with a moving target

Not fool proof, but given the IoCs, think it might be best to block all but top 50k domains by default.

Or, inform users if a domain they've never previously visited asks them to enter anything via clipboard or keyboard.

[0] https://www.welivesecurity.com/en/eset-research/be-careful-what-you-pwish-for-phishing-in-pwa-applications/ / https://archive.md/29SKK (hat-tip u/ChrisArchitect)

BTC because it's scarce

BTC isn't really scarce, there's quiet a few newer iterations like Litecoin, Monereo, Ethereum, Dogecoin etc..

It's also worth noting the supply was minted mainly by miners doing very low difficulty work early on, using basic home computers.

Satoshi made an intensional design choice to gain control of the supply for a very low cost, exploiting late adopters as bag holders.

The incentive system for bitcoin mining might of anticipated gaining popularity as time passes and increasing the reward as the network grows, but the system was designed completely opposite of that, at the expense of the masses for the benefit of sending the supply to the mining nodes operating in the first few months.

https://www.welivesecurity.com/wp-content/media_files/total_bitcoins_over_time_lg.jpg

Most of the time, when apps are caught doing something really shady, they're removed from the Play Store for doing the shady thing. A story wouldn't report that they stopped working because of a policy change, but some of these wouldn't make it into the store now:

https://www.bleepingcomputer.com/news/security/apps-with-15m-installs-on-google-play-send-your-data-to-china/

https://www.zdnet.com/article/phantomlance-spying-campaign-breaches-google-play-security/

https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/

There are also examples of apps using the filesystem to try to detect rooted devices, an invasion of user privacy:

https://www.reddit.com/r/Android/comments/g6cdl6/apps_have_access_to_your_file_system_without/