Silent Security: Navigating the Perils of Typing your Password During a Meeting

S3 Ep147: What if you type in your password during a meeting?

Cryptocurrency, Cryptography, Data loss, Intel, Law & order, Podcast

On the latest episode of the Naked Security podcast, Doug Aamoth and Paul Ducklin discuss various topics related to cybersecurity and technology. They start by reflecting on the history of computing and the IBM Automatic Sequence Controlled Calculator, also known as the Mark I, which was presented to Harvard University in 1944. They then delve into a recent Bug With An Impressive Name (BWAIN) called Downfall, which is caused by memory optimization features in Intel processors. They also discuss the findings of a research paper on how touch-typing can help protect against audio snooping during meetings. Lastly, they cover the case of Heather Morgan, also known as the “Crocodile of Wall Street,” and her husband Ilya Lichtenstein, who have pleaded guilty to involvement in the Bitfinex cryptocurrency heist of 2016.

Memory Optimization Features in Intel Processors Pose Cybersecurity Risk

Downfall Bug (BWAIN) Exploits Intel Processor Optimization

The Downfall bug, named as a Bug With An Impressive Name (BWAIN), is caused by memory optimization features in Intel processors. The bug, similar to the Zenbleed bug in AMD Zen 2 processors, allows for information leakage from the CPU’s internal state. Downfall specifically enables the leakage of an entire register, rather than just a portion of it. This issue highlights the trade-off between performance gains and security, as enabling the optimization feature increases the risk of data compromise.

Mitigation Measures May Reduce Performance but Enhance Security

To mitigate the Downfall bug, users are advised to disable the optimization feature that enables data leakage. However, this may result in reduced performance, as the feature is designed to efficiently collect and process data from different memory addresses. The trade-off between security and performance must be carefully weighed, as the absence of mitigation measures exposes users to the risk of data breaches.

Protecting Against Audio Snooping During Meetings

Research Shows Typing Sounds Can Reveal Sensitive Information

A research paper discussed on the podcast highlights the cybersecurity risk posed by the sounds of typing during meetings. The study found that it is possible to discern the keystrokes and even passwords of individuals typing on a laptop during a meeting. This introduces a potential vulnerability for data leakage, as sensitive information may be recorded by those present or intercepted by unauthorized individuals.

Touch-Typing Recommended to Reduce Risk

The researchers recommend touch-typing as a countermeasure to mitigate the risk of audio snooping during meetings. Touch-typers, who have learned to type without looking at the keyboard, tend to type in a more regular and consistent manner. This makes it harder for adversaries to differentiate individual keystrokes and extract sensitive information from the audio recordings. Additionally, touch-typing offers the benefit of increased typing speed, making it a valuable skill in both performance and security aspects.

Other Measures to Protect Confidential Information During Meetings

In addition to touch-typing, individuals are advised to take other precautionary measures to protect their confidential information during meetings. This includes refraining from typing passwords or sensitive information while in a meeting, utilizing two-factor authentication (2FA) for account security, and muting the microphone when not speaking. While these measures may seem basic, they contribute to safeguarding data privacy and mitigating the risk of unauthorized access to sensitive information.

Guilty Pleas in Cryptocurrency Heist Case

The Case of “Crocodile of Wall Street” and Bitfinex Heist

Heather Morgan, known as the “Crocodile of Wall Street,” and her husband, Ilya Lichtenstein, have pleaded guilty in connection with the Bitfinex cryptocurrency heist of 2016. The couple was implicated in the theft of approximately 120,000 Bitcoins, which at the time were valued at $72 million. However, due to the surge in Bitcoin’s value, the stolen funds became worth over $4 billion by the time of their arrest.

Inability to Cash Out Ill-Gotten Gains Leads to Arrest

Morgan and Lichtenstein faced difficulties in cashing out their stolen funds, which ultimately led to their arrest. Their attempts to convert the stolen Bitcoins into other forms of value created a trail of evidence that law enforcement agencies were able to trace. Ultimately, their efforts to benefit from the heist were unsuccessful, and they have decided to plead guilty to their charges.

Implications for the Recovery of Stolen Funds

The case raises questions about the recovery of stolen funds in cryptocurrency heists. Individuals who had their Bitcoins stolen may be curious about whether they will receive the equivalent value in Bitcoins at the time of the theft or according to the current value of the cryptocurrency. The seized Bitcoins are currently being held as evidence, awaiting further legal proceedings. The outcome of the case will determine how the recovered funds are distributed to their rightful owners.

Conclusion

The discussions in this episode highlight the ongoing challenges and risks in the realm of cybersecurity. From vulnerabilities in processor optimization features to the potential for audio snooping during meetings, individuals and organizations must remain vigilant and adopt proactive measures to protect their sensitive information. Additionally, the case of the Bitfinex cryptocurrency heist serves as a reminder that illicit gains in the digital realm may not be as easily accessible as they seem, with law enforcement agencies working tirelessly to ensure accountability and deter cybercriminals.

Sources:

• Naked Security: S3 Ep147: What if you type in your password during a meeting?