Cyber Updates - 14/01

Hey all,

Here are this week’s cyber updates.

(1) I’m pretty sure most of you are aware of Google Chrome’s (as well as other browser’s) auto fill feature. This feature allows Chrome to automatically fill your personal information in websites in order to speed up registration processes.

What most of you don’t know is that hidden fields are auto-filled, and thus submitted to the website’s owner. This allows the website to collect personal information without the user’s consent.

Here is a link to a PoC website: https://anttiviljami.github.io/browser-autofill-phishing/

If you didn’t understand this one, please let me know and I’ll send you a link to another website, with an example of stealing your credit card info J

(2) Cellebrite, the Israeli-based company that allegedly helped the FBI to hack the iPhone, was hacked.

The my.Cellebrite database has been hacked, allowing the hackers to extract over 900GB of customers’ data.

Here are all the details: http://www.cellebrite.com/Mobile-Forensics/News-Events/Press-Releases/cellebrite-statement-on-information-security-breach

(3) The Brazilian government has accidentally twitted a link to a Google Drive Excel spreadsheet, which contained a list of plain text passwords for social media accounts (Facebook, Gmail, Twitter, Instagram and more).

It appears as if the tweet contained by accident a copy-paste link to the spreadsheet instead of the intended URL.

They really should be more careful with their tweets, but more than that, I couldn’t help but wonder why they didn’t enforce any permissions on Google Drive…

Here are all the details: https://www.hackread.com/brazilian-govt-twitter-posts-social-media-passwords/

Stay tuned for more updates,

Dan Gurfinkel

Head of Offensive Security & Response Unit