WannaCry ransomware analysis: Samples date back to at least early February 2017

VirusTotal results showing the earliest observed sample of Wannacry ransomware

The WannaCry ransomware worm has spread panic and destruction as it infects hundreds of thousands of systems around the world; a rate not seen since the Blaster and Sasser worms of 2003. WannaCry — also known as WannaCrypt, WannaCryptor, WanaCrypt0r, WCry, or WCrypt — leverages vulnerabilities that Microsoft patched in the March MS17-010 Security Bulletin, after taking the unprecedented step of canceling the February Patch Tuesday.

While collecting samples of WannaCry, I found a sample that predates the worm version. The sample was compiled on February 9th, and uploaded to VirusTotal on February 10th. While compile timestamps can be faked, the closeness to the upload date suggests that the compilation timestamp is legitimate.

Read more

Google Pixel phones can be unlocked with a recording of a trusted voice by default

user manually enables "Ok Google" Trusted Voice

The headline feature of the new Google Pixel phones is deep integration between the operating system and the Google Assistant AI. By default, the Google Assistant can be activated even when the phone is locked and the display is off, if the device hears the trusted voice say the hot word, “Ok Google”. This also has the effect of unlocking the device, meaning that anyone with a recording of the trusted voice saying “Ok Google” — or even someone with a similar voice — can easily unlock the device.

Read more

Android 7.1 adds native android visual voicemail support for Verizon

When I first switched my Nexus 6P to from T-Mobile to Verizon, I noticed that support for native visual voicemail in the Android dialer was missing. Worse, I was getting cryptic text messages instead of the usual basic voicemail notification.

A blog post from Matt Cutts describes this situation in detail. It turns out the text messages are somehow used in the background by Verizon’s proprietary visual voicemail application. That application is not available to Nexus devices on the Google Play store like the My Verizon app is. So the only solution to get regular voicemail notifications working on Nexus devices was to have a Verizon rep switch your line to basic voicemail. This option is different that basic visual voicemail, which is on your line by default.

In an age of texting and messaging apps, loosing visual voicemail might not seem like a big deal to most consumers, but I’ve found that the voicemail to text feature is extremely useful when I need to discreetly check voicemails from businesses and doctor’s offices while on the go or at work. It’s also indispensable for those who are hearing impaired.  I wondered how Verizon and Google were going to do Visual Voicemail on the Pixel phones, since Verizon’s Visual Voicemail app is not on the list of installed Verizon apps. Now we know.

After upgrading my Nexus 6P on Verizon to the Android 7.1.1 beta, I discovered that Visual Voicemail in the native Android dialer works! You just need to make sure that that basic (free) or premium visual voicemail is active on your line. Voicemail-to-text works too, if you add Premium Visual Voicemail to your line. Unfortunately, there is no sign of Wi-Fi calling support (yet?). HD voice has always worked on the Nexus 6P.

A screenshot of the Verizon Wireless Premium Visual Voicemail welcome message in the Android 7.1 Dialer on a Nexus 6P

Also, the Support tab in Settings is there, as seen on the Pixel phones.

A screenshot of the settings app in Android 7.1 on a Nexus 6P, showing the support tab first seen on the Google Pixel phones

This was one of the features that I thought was Pixel exclusive. It’s nice to see it included.  Hopefully more features from the Pixel phones like the Google Assistant will make their way to Nexus devices over the next few months. That would go a long way towards soothing the outrage of many Nexus owners who feel left behind. It would certainly be in Google’s long-term interest to put the assistant in the hands of as many Android users as possible once it has full integration with third party services.

Update: Unfortunately, the day after this post was published, Google updated Google Support Services that remove the phones and chat support buttons for Nexus devices 🙁

A screenshot of the support tab in settings as seen on a Nexus 5X after the Google Support Services update

You can get Android 7.1.1 on a Nexus device right now by signing up for the Android Beta. It’s actually very stable, and I think it’s snappier than 7.0.

My Google Pixel XL is due to arrive today. I’ll have a full review here next week.

Featured image by Andrew Taylor. Used under a CC BY 2.0 license.

PSA: The latest Google Chrome release trips EMET’s EAF+ mitigation

A screenshot of the EAF+ error generateted W=by the latest Google Chrome release when used with the defualt EMET config

When Google Chrome updated to 53.0.2785.101 on my Windows systems, I encountered an onslaught of alerts from EMET, which was killing chrome.exe processes for EAF+ violations as fast as Chrome kept trying to spawn them (each tab in Chrome is a separate process). Luckily, this problem is easily fixable.

Read more

HHS: Ransomware encryption of ePHI is a HIPAA breach

Colorful shelves of paperrecords at a dental clinic Credit: Tom Magliery License: CC BY-NC-SA 2.0

As a growing number of medical facilities are struck by ransomware, the US Department of Health and Human Services (HHS) has published a fact sheet describing how businesses that process electronic Protected Health Information (ePHI) should defend against and respond to ransomware.

Read more

Prevent ransomware from succeeding with strategic defense-in-depth

Thoughtfully placed countermeasures can prevent ransomware like Petya, shown in this screenshot

Ransomware has become the weapon of choice for financially motivated cybercriminals. Individuals, hospitals, businesses, schools, police departments, and government agencies have all been victims of highly disruptive ransomware, resulting in ransom payments totaling at least $24 million in 2015, according to the DoJ and DHS. It doesn’t take much to start a ransomware campaign, and the returns can be extremely high. Fortunately, the steps to prevent ransomware from succeeding are equally simple and low cost.

Read more

DoJ v. Apple: It’s all about the precedent

a battle for encryption privacy and secrecy has crecent;y meen highlighted in a series of DoJ v. Apple

By now, you’ve probably heard something about the ongoing legal battle between Apple and the Department of Justice. “DoJ v. Apple” coverage has been abundant, on blogs and TV news shows alike, but in case you haven’t here’s a quick recap. The FBI obtained the work iPhone of Syed Rizwan Farook, who, along with his wife Tashfeen Malik, murdered 14 people in a shooting rampage at a holiday party in San Bernardino, California. The government suspects that iPhone may hold critical information about the couple’s contacts in the weeks leading up to the attacks – contacts that may uncover future plots. They have a warrant, but they can’t access the data on the phone because it is using the strong encryption that comes with iOS 9 and up. Not even Apple can bypass the encryption, at least directly.

Read more