The Nigerian Communications Commission’s Cyber Security Incident Response Team (NCC-CSIRT) has independently identified two cyber vulnerabilities and advised Nigerian telecom customers on how to defend themselves from cyber-attacks.
In its first-ever security advisories, issued less than three months after its formation, the CSIRT has solely identified two cyber-attacks targeting consumers and offered solutions to help telecom consumers avoid becoming victims of the two cyber vulnerabilities.
The first is known as Juice Jacking, and it is capable of gaining access into consumers’ devices while charging mobile phones at public charging stations. It is applicable to all mobile phones. The other is a Facebook for Android Friend Acceptance Vulnerability that only affects Android operating systems.
According to CSIRT security advisory 0001, published on January 26, 2022, attackers have discovered a new way to gain unauthorized access to unsuspecting mobile phone users’ devices when they charge their phones at public charging stations using Juice Jacking.
In order to improve customer service, many public spaces, restaurants, malls, and even public trains provide complementary services to their customers, one of which is providing charging ports or sockets.
An attacker, on the other hand, can take advantage of this courtesy to load a payload in the charging station or on the cables they would leave plugged in at the stations.
When unsuspecting victims connect their phones to the charging station or the cable left by the attacker, the payload is automatically downloaded onto the victims’ phones. This payload then grants the attacker remote access to the mobile phone, allowing them to monitor data sent as text or audio through the microphone.
If the victim’s camera is not covered, the attacker can even watch the victim in real time. The attacker is also granted full access to the phone’s gallery as well as its Global Positioning System (GPS) location.
When an attacker gains remote access to a user’s mobile phone, he breaches confidentiality, violates data integrity, and bypasses authentication mechanisms. Symptoms of an attack include a sudden increase in battery use, device performance that is slower than usual, apps that take a long time to launch and then crash often, and unusual data usage.
The NCC-CSIRT, on the other hand, suggested avoiding Universal Serial Bus (USB) data connection by utilizing a “charging only USB cable,” using one’s AC charging adaptor in public spaces, and not extending trust to portable devices prompting for USB data connection.
Other anti-Juice Jacking measures include installing antivirus software and keeping it up to date with the latest definitions; keeping mobile devices up to date with the latest patches; using one’s own power bank; charging in public places with one’s own charger; and using one’s own charger if one must charge in public.
The NCC-CSIRT Advisory 0001 of January 27, 2022, on the other hand, cautions that Facebook for Android is vulnerable to a permission vulnerability that allows anyone with physical access to the device to accept friend requests without having to unlock it. The products affected include Versions 329.0.0.29.120 of Android OS.
With this, the attacker will be able to add the victim as a friend and collect personal information of the victim, such as Email, Date of Birth, Check-ins, Mobile phone number, Address, Pictures and other information that the victim may have shared, which would only be visible to his/her friends.
However, to be protected from the Facebook-associated vulnerability, NCC-CSIRT in the security advisory recommends to users to disable the feature from their device’s lock screen notification settings.
The NCC-CSIRT was inaugurated in October, 2021 to provide guidance and direction for the constituents in dealing with issues relating to the security of critical infrastructure in their possession, and periodically assess, review and collate the threat landscape, risks, and opportunities affecting the communications sector, in order to provide advice to relevant stakeholders in those regards.
As the telecoms-industry specific intervention, the objective of which aligns with the objective of the National Cybersecurity Policy and Strategy (NCPS) document published by the Office of the National Security Adviser (ONSA), the NCC-CSIRT ensures continuous improvement of processes and communication frameworks to guarantee secure and collaborative exchange of timely information while responding to cyber threats within the sector.
In recent times, NCC-CSIRT has raised a series of cyber-vulnerability awareness based on security advisories it receives from the Nigerian Cybersecurity Emergency Response Team (ngCERT), which is the national body for the implementation of the NCPS objective. However, Juice Jacking and Facebook for Android Friend Acceptance Vulnerabilities are the two first-ever cyber vulnerabilities published by the NCC-CSIRT.
For most recent news you have to pay a visit world-wide-web and on internet I found this site as a most excellent website for latest updates.
Today, I went to the beachfront with my kids. I found a sea shell and gave it to my 4 year old daughter and said “You can hear the ocean if you put this to your ear.” She put the shell to her ear and screamed. There was a hermit crab inside and it pinched her ear. She never wants to go back! LoL I know this is completely off topic but I had to tell someone!
Excellent, what a weblog it is! This webpage provides useful information to us, keep it up.
Im not that much of a online reader to be honest but your blogs really nice, keep it up! I’ll go ahead and bookmark your site to come back down the road. Cheers