Connect with us

Biz & IT

China’s Baidu says its answer to Alexa is now on 200M devices

Published

on

A Chinese voice assistant has been rapidly gaining ground in recent months. DuerOS, Baidu’s answer to Amazon’s Alexa, reached over 200 million devices, China’s top search engine announced on its Weibo official account last Friday.

To put that number into context, more than 100 million devices pre-installed with Alexa have been sold, Amazon recently said. Google just announced it expected Assitant to be on 1 billion devices by the end of this month.

Voice interaction technology is part of Baidu’s strategy to reposition itself from a heavy reliance on search businesses towards artificial intelligence. The grand plan took a hit when the world-renown scientist Lu Qi stepped down as Baidu’s chief operating officer, though the segment appears to have scored healthy growth lately, with DuerOS more than doubling from a base of 90 million installs since last June.

When it comes to how many devices actually use DuerOS regularly, the number is much less significant: 35 million machines a month at the time Baidu’s general manager for smart home devices announced the figure last November.

Like Alexa, which has made its way into both Amazon-built Echo speakers and OEMs, DuerOS also takes a platform play to power both Baidu-built and third-party devices.

Interestingly, DuerOS has achieved all that with fewer capabilities and a narrower partnership network than its American counterpart. By the end of 2018, Alexa could perform more than 56,000 skills. Devices from over 4,500 brands can now be controlled with Alexa, says Amazon. By comparison, Baidu’s voice assistant had 800 different skills, its chief architect Zhong Lei revealed at the company’s November event. It was compatible with 85 brands at the time.

This may well imply that DuerOS’s allies include heavy-hitters with outsize user bases. Baidu itself could be one as it owns one of China’s biggest navigation app, which is second to Alibaba’s AutoNavi in terms of number of installs, according to data from iResearch. Baidu said in October that at least 140 million people had activated the voice assistant of its Maps service.

Furthermore, Baidu speakers have managed to crack a previously duopolistic market. A report from Canalys shows that Baidu clocked in a skyrocketing 711 percent quarter-to-quarter growth to become China’s third-biggest vendor of smart speakers during Q3 last year. Top players Alibaba and Xiaomi, on the other hand, both had a sluggish season.

While Baidu deploys DuerOS to get home appliances talking, it has doubled down on smart vehicles with Apollo . The system, which the company calls the Android for autonomous driving, counted 130 OEMs, parts suppliers and other forms of partners as of last October. It’s attracted global automakers Volvo and Ford who want a foothold in China’s self-driving movement. Outside China, Apollo has looked to Microsoft Azure Cloud as it hunts for international partnerships.

Baidu has yet to prove commercial success for its young AI segment, but its conversational data trove holds potential for a lucrative future. Baidu became China’s top advertising business in part by harnessing what people search on its engine. Down the road, its AI-focused incarnation could apply the same data-crunching process to what people say to their machines.

Source link

Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published.

Biz & IT

Omnipotent BMCs from Quanta remain vulnerable to critical Pantsdown threat

Published

on

Getty Images

In January 2019, a researcher disclosed a devastating vulnerability in one of the most powerful and sensitive devices embedded into modern servers and workstations. With a severity rating of 9.8 out of 10, the vulnerability affected a wide range of baseboard management controllers made by multiple manufacturers. These tiny computers soldered into the motherboard of servers allow cloud centers, and sometimes their customers, to streamline the remote management of vast fleets of computers. They enable administrators to remotely reinstall OSes, install and uninstall apps, and control just about every other aspect of the system—even when it’s turned off.

Pantsdown, as the researcher dubbed the threat, allowed anyone who already had some access to the server an extraordinary opportunity. Exploiting the arbitrary read/write flaw, the hacker could become a super admin who persistently had the highest level of control for an entire data center.

The industry mobilizes… except for one

Over the next few months, multiple BMC vendors issued patches and advisories that told customers why patching the vulnerability was critical.

Now, researchers from security firm Eclypsium reported a disturbing finding: for reasons that remain unanswered, a widely used BMC from data center solutions provider Quanta remained unpatched against the vulnerability as recently as last month.

As if Quanta’s inaction wasn’t enough, the company’s current posture also remains baffling. After Eclypsium privately reported its findings to Quanta, the solutions company responded that it had finally fixed the vulnerability. But rather than publish an advisory and make a patch public—as just about every company does when fixing a critical vulnerability—it told Eclypsium it was providing updates privately on a customer-by-customer basis. As this post was about to go live, “CVE-2019-6260,” the industry’s designation to track the vulnerability, didn’t appear on Quanta’s website.

In an email, Eclypsium VP of Technology John Loucaides wrote:

Eclypsium is continuing to find that custom servers (eg. Quanta) remain unpatched to vulnerabilities from as far back as 2019. This is affecting a myriad of devices from a large number of cloud providers. The problem isn’t any one vulnerability, it’s the system that keeps cloud servers old and vulnerable. Quanta has only just released the patch for these systems, and they did not provide it for verification. In fact, their response to us was that it would only be made available upon request to support.”

Multiple Quanta representatives didn’t respond to two emails sent over consecutive days requesting confirmation of Eclypsium’s timeline and an explanation of its patching process and policies.

Current, but not patched

A blog post Eclypsium published on Thursday shows the type of attack that’s possible to carry out on Quanta BMCs using firmware available on Qunta’s update page as of last month, more than three years after Pantsdown came to light.

Eclypsium’s accompanying video shows an attacker gaining access to the BMC after exploiting the vulnerability to modify its web server. The attacker then executes a publicly available tool that uses Pantsdown to read and write to the BMC firmware. The tool allows the attacker to supply the BMC with code that opens a reverse web shell whenever a legitimate administrator refreshes a webpage or connects to the server. The next time the admin tries to take either action, it will fail with a connection error.

Behind the scenes, however, and unbeknownst to the admin, the attacker’s reverse shell opens. From here on, the attacker has full control of the BMC and can do anything with it that a legitimate admin can, including establishing continued access or even permanently bricking the server.

BMC Attack Demo

The power and ease of use of the Pantsdown exploit are by no means new. What is new, contrary to expectations, is that these types of attacks have remained possible on BMCs that were using firmware Quanta provided as recently as last month.

Quanta’s decision not to publish a patched version of its firmware or even an advisory, coupled with the radio silence with reporters asking legitimate questions, should be a red flag. Data centers or data center customers working with this company’s BMCs should verify their firmware’s integrity or contact Quanta’s support team for more information.

Even when BMCs come from other manufacturers, cloud centers, and cloud center customers shouldn’t assume they’re patched against Pantsdown.

“This is a serious problem, and we do not believe it is a unique occurrence,” Loucaides wrote. “We’ve seen currently deployed devices from each OEM that remain vulnerable. Most of those have updates that simply were not installed. Quanta’s systems and their response did set them apart, though.”

Continue Reading

Biz & IT

Critical Zoom vulnerabilities fixed last week required no user interaction

Published

on

Zoom

Google’s Project Zero vulnerability research team detailed critical vulnerabilities Zoom patched last week making that made it possible for hackers to execute zero-click attacks that remotely ran malicious code on devices running the messaging software.

Tracked as CVE-2022-22786 and CVE-2022-22784, the vulnerabilities made it possible to perform attacks even when the victim took no action other than to have the client open. As detailed on Tuesday by Google Project Zero researcher Ivan Fratric, inconsistencies in how the Zoom client and Zoom servers parse XMPP messages made it possible to “smuggle” content in them that usually would be blocked. By combining those flaws with a glitch in the way Zoom’s code-signing verification works, Fratric achieved full code execution.

“User interaction is not required for a successful attack,” the researcher wrote. “The only ability an attacker needs is to be able to send messages to the victim over Zoom chat over XMPP protocol.” Fratric continued:

Initial vulnerability (labeled XMPP Stanza Smuggling) abuses parsing inconsistencies between XML parsers on Zoom’s client and server in order to be able to “smuggle” arbitrary XMPP stanzas to the victim client. From there, by sending a specially crafted control stanza, the attacker can force the victim client to connect to a malicious server, thus turning this primitive into a man-in-the-middle attack. Finally, by intercepting/modifying client update requests/responses, the victim client downloads and executes a malicious update, resulting in arbitrary code execution. A client downgrade attack is utilized to bypass signature check on the update installer. This attack has been demonstrated against the latest (5.9.3) client running on Windows 64-bit, however some or all parts of the chain are likely applicable to other platforms.

In December, Zoom finally joined the 21st century when it gave the macOS and Windows clients the ability to update automatically. The severity of the vulnerabilities fixed last week underscores the importance of auto update. Often, within a few hours or days of the updates like these becoming available, hackers have already reverse engineered them and use them as an exploit road map. And yet, one of the computers I regularly use for Zoom had yet to install the patches until Wednesday, when I thought to choose the “Check for Updates” option.

For my Zoom client to auto update, it needed to run an intermediate version first. Once I manually updated, the auto update was finally in place. Readers may want to check their systems to ensure they’re running the latest version, too.

Continue Reading

Biz & IT

Digital driver’s license billed as harder than plastic to forge is easily forged

Published

on

In late 2019, the government of New South Wales in Australia rolled out digital driver’s licenses. The new licenses allowed people to use their iPhone or Android device to show proof of identity and age during roadside police checks or at bars, stores, hotels, and other venues. ServiceNSW, as the government body is usually referred to, promised it would “provide additional levels of security and protection against identity fraud, compared to the plastic [driver’s license]” citizens had used for decades.

Now, 30 months later, security researchers have shown that it’s trivial for just about anyone to forge fake identities using the digital driver’s licenses, or DDLs. The technique allows people under drinking age to change their date of birth and for fraudsters to forge fake identities. The process takes well under an hour, doesn’t require any special hardware or expensive software, and will generate fake IDs that pass inspection using the electronic verification system used by police and participating venues. All of this, despite assurances that security was a key priority for the newly created DDL system.

“To be clear, we do believe that if the Digital Driver’s Licence was improved by implementing a more secure design, then the above statement made on behalf of ServiceNSW would indeed be true, and we would agree that the Digital Driver’s Licence would provide additional levels of security against fraud compared to the plastic driver’s licence,” Noah Farmer, the researcher who identified the flaws, wrote in a post published last week.

A better mousetrap hacked with minimal effort

“When an unsuspecting victim scans the fraudster’s QR code, everything will check out, and the victim won’t know that the fraudster has combined their own identification photo with someone’s stolen Driver’s Licence details,” he continued. As things have stood for the past 30 months, however, DDLs make it “possible for malicious users to generate [a] fraudulent Digital Driver’s Licence with minimal effort on both jailbroken and non-jailbroken devices without the need to modify or repackage the mobile application itself.”

DDLs require an iOS or Android app that displays each person’s credentials. The same app allows police and venues to verify that the credentials are authentic. Features designed to confirm the ID is authentic and current include:

  • Animated NSW Government logo.
  • Display of the last refreshed date and time.
  • A QR code expires and reloads.
  • A hologram that moves when the phone is tilted.
  • A watermark that matches the licence photo.
  • Address details that don’t require scrolling.

Surprisingly simple

The technique for overcoming these safeguards is surprisingly simple. The key is the ability to brute-force the PIN that encrypts the data. Since it’s only four digits long, there are only 10,000 possible combinations. Using publicly available scripts and a commodity computer, someone can learn the correct combination in a matter of a few minutes, as this video, showing the process on an iPhone, demonstrates.

ServiceNSW Digital Driver’s Licence proof-of-concept: Brute-forcing PIN.

Once a fraudster gets access to someone’s encrypted DDL license data—either with permission, by stealing a copy stored in an iPhone backup, or through remote compromise—the brute force gives them the ability to read and modify any of the data stored on the file.

From there, it’s a matter of using simple brute-force software and standard smartphone and computer functions to extract the file storing the credential, decrypting it, changing the text, re-encrypting it, and copying it back to the device. The precise steps on an iPhone are:

  • Use iTunes backup to copy the contents of iPhone storing the credential the fraudster wants to modify
  • Extract the encrypted file from the backup stored on the computer
  • Use brute-force software to decrypt the file
  • Open the file in a text editor and modify the birth date, address, or other data they want to fake
  • Re-encrypt the file
  • Copy the re-encrypted file to the backup folder and
  • Restore the backup to the iPhone

With that the ServiceNSW app will display the fake ID and present it as genuine.

The following video shows the entire process from start to finish.

Death by 1,000 flaws

A variety of design flaws make this simple hack possible.

The first is a lack of adequate encryption. A key based on a four-digit PIN is woefully inadequate. Apple provides a function named SecRandomCopyBytes for producing random bytes that can be used to generate secure keys. “If this was used to encrypt the Digital Driver’s Licence rather than the 4 digit PIN, it would make the task of brute-forcing much harder if not completely infeasible for attackers,” Farmer wrote.

The next major flaw is that, astonishingly, DDL data is never validated against the back-end database to make sure that what’s stored on the iPhone matches records maintained by the government department. With no means to natively validate the data, there’s no way to tell when information has been tampered with. As a result attackers are able to display the falsified data on the Service NSW application without any means to prevent or detect the fraud.

The third shortcoming is that using the “pull-to-refresh” function—a cornerstone of the DDL verification scheme intended to ensure the most current information is showing—fails to refresh any of the data stored in the electronic credential. Instead, it updates only the QR code. A better response would be for the pull-to-refresh function to download the latest copy of the DDL from the ServiceNSW database.

Fourth, the QR code transmits only the DDL holder’s name and status as either over or under the age of 18. The QR code is supposed to allow the person checking the ID to scan it with their own ServiceNSW app to validate that the data presented is authentic. To bypass the check, a fraudster only needs to obtain the driver’s license details from a stolen or otherwise-obtained DDL and replace it locally on their phone.

“When an unsuspecting victim scans the fraudster’s QR code, everything will check out, and the victim won’t know that the fraudster has combined their own identification photo with someone’s stolen Driver’s Licence details,” Farmer explained. Had the system returned the legitimate image data, the scanning party would easily see that the fraudster had forged the DDL, since the face returned by Service NSW wouldn’t match the face displayed on the app.

The last flaw the researcher identified was that the app allows the data it stores to be backed up and restored at all. While all files stored in the Documents and Library/Application Support/ folders are backed up by default, iOS allows developers to easily exclude certain files from backup by calling NSURL setResourceValue:forKey:error: with the NSURLIsExcludedFromBackupKey key.

With a reported 4 million NSW residents using the DDLs, the gaffe could have serious consequences for anyone who relies on DDLs to verify identities, ages, addresses, or other personal information. It’s not clear how or even if Service NSW plans to respond. Given time differences between San Francisco and New South Wales, officials with the department weren’t immediately available for comment.

Farmer noted this tweet, which called out a hotel bar for refusing service to someone who had only physical ID and instead accepting only DDLs. “I know 10 kids that you let in regularly with fake digital licenses because they are easy to make,” the person claimed.

While the veracity of that claim can’t be verified, it certainly sounds plausible, given the ease and effectiveness of the hack shown here.

Continue Reading

Trending