Ethical hackers battle to prevent 'information security apocalypse'

(CNN) -- Barely a day passes without news of another major computer security breach. Last week a hacking network named "Hollywood Leaks" began their attack on the personal data of celebrities, officially adding the glitterati to a roll of shame that already includes targets as diffuse as Sony, the Church of Scientology and PayPal.

However only a few days before the emergence of this latest hacking outfit, a far less conspicuous but similarly-skilled group met at a London hotel to discuss the other side of all matters of information security, otherwise known as "infosec".

The inaugural 44Con was Britain's first major conference for the good guys of infosec. Among the 300 delegates and speakers were a number of so-called "white hats", programmers and penetration testers specifically employed to discover businesses' weak spots.

Using information from these ethical hackers, manufacturers can remedy or "patch" the problem before its release and companies can take measures to safeguard their data.

Everybody had a look at the Sony thing and thought, 'Oh God, I hope I'm not next.'
Steve Lord, foudner 44Con

Although their more destructive brethren might continue to grab headlines, 44Con demonstrated that the fight against hackers, and other more traditional threats to information security, is also strong.

"The way people use and consume media and share information has drastically changed over the past ten years," said Steve Lord, a security professional and co-founder of 44Con.

"The information that we used to think would stay on a computer, in an increasingly networked world, it goes everywhere. So there is an increasing demand for people to secure that information because otherwise people won't put it there."

44Con attracted representatives from governments and members of the military, alongside risk managers, consultants and students. According to Lord, the roll call included "hackers, freaks, geeks, spooks and kooks," none of whom was required to identify themselves further than a first name.

"It's everyone around the table all looking at the same problems and hopefully coming up with some solutions," Lord said.

High-profile hacking is only one strand of the ongoing battle to protect electronic information from damage or infiltration.

Events at 44Con ran the gamut from workshops demonstrating old-fashioned lock-picking with a paperclip, through discussions of threats to iPads and smart phones and even a presentation of how NASA's transmissions to astronauts have recently been intercepted.

"We've got a serious problem here... like the global financial crisis," said Haroon Meer, a researcher at the infosec consultancy, Thinkst. But although Meer also referred to "our upcoming security apocalypse", others were focused on how intelligence can be used to predict attacks before they occur and, crucially, how to acquire boardroom backing for improved security measures.

We've got a serious problem here... like the global financial crisis.
Haroon Meer, infosec consultant

Infosec professionals often converse in a language that is not always immediately accessible to a layman (executives included), but the result of their endeavors can often be startlingly clear.

"Every single guy at boardroom level that I speak to says, 'Are we going to be the next Sony?'" said Lord, referring to the recent devastating hack on the electronics giant. "Everybody had a look at the Sony thing and thought, 'Oh God, I hope I'm not next.'"

Sony given 'epic fail' award from hackers

Several presentations at 44Con offered chilling demonstrations of the vulnerabilities of common business devices. Alex Plaskett, a consultant at MWR InfoSecurity, who described himself as someone who has been "professionally breaking things" for many years, performed a so-called "drive-by" exploit on a Windows 7 smart phone.

Independent security consultant, Neil Kettle, performed a take-down of the much garlanded online banking security software Trusteer Rapport, running a key-logging program that replicated on screen anything a user might be entering into supposedly secure password fields.

Another security expert Roelof Temmingh showcased the most recent version of Maltego, software that analyzes and compares freely available information from numerous social networking sites.

Using the website of the Executive Office of the President as an example, Temmingh was able to extract specific information such as favored restaurants among White House staffers, as well as other behavioral trends.

"Even if we don't want to attack, what can we learn?" Temmingh asked, before revealing that at least one member of the Bush administration was a fan of Moody's Diner, visited a psychic medium named "Rosemary the Celtic Lady" and was a keen editor of Wikipedia pages.

The examples were deliberately banal and outdated, but the implication was clear. Through similar paths, hackers of more nefarious intentions could determine what versions of browsers are being used in the White House, for instance, and probe specific vulnerabilities. "If you can exploit the browser of a leader, then you've exploited the PC of a president," Temmingh warned.

However it was left to Alexis Conran, a former confidence trickster who appeared in a British TV show called "The Real Hustle", to sum up the challenges still faced by the infosec sector.

"The general public will only take steps to protect themselves if they know what the dangers are," he said.

[CNN]

Cybercrooks prey on 9/11 anniversary

Malware, 'commemorative coin' auctions and fake charity donation



Cybercrooks are gearing up for the 10th anniversary of the 9/11 attacks with a range of malware traps and hacking attempts both on social networks and the wider internet, net security firm BitDefender warns.

The first wave of these attacks comes in the form of the newly established websites offering supposed content such as "Bin Laden alive", "in depth details about the terrorist attack", "police investigation results" and "towers going down" to attract the curious.

The sites are filed with links to scareware and phishing sites. Others have created fraudulent charity donation sites that serve only to line their greedy pockets at the expense of genuine gift-giving sites.

In addition, fraudsters are running fake auctions and sales of items supposedly linked to the devastating attacks such as shards of metal from the twin tower or even "commemorative coins" supposedly minted from silver collected at the attack site.

More scam, perhaps involving malware, can be expected to follow over the coming days.

“Because of the advancement of hacking and spamming technology over the past decade, plus the significance of the anniversary and increased media coverage, Sept 11 this year may prove hectic on the malware front,” said Catalin Cosoi, head of the Online Threats Lab at Bitdefender.

BitDefender says many of the scams likely to be on show are similar to those seen during anniversaries of the London bombings of July 2005.

Cybercrooks marked remembrances of the 7/7 attacks with fake donation requests, spamming of viruses disguised as supposed videos of the assaults and advanced fee fraud email scams. ®

[TheRegister]

People Who Get Malware Also Get Mugged More Than Usual

Our Lifehacker AU comrades point out this interesting fact from Norton's latest Cybercrime report: People who fall victim to malware are statistically more likely to be mugged in real life too. Interesting.

The obvious caveat is that correlation doesn't imply causation, but it is a bit telling to see that these two statistics are linked. Could it be that people who aren't careful online—because honestly, that's what falling victim to malware is—aren't careful in meatspace either?

Norton's internet safety advocate agrees, and says "Clearly these people aren't taking enough care in their real-world interactions and it carries over in their online world." Just think about people you know and how careful they are in their everyday dealings with other people. The more guarded or suspicious you are, the less likely you are to hand over your personal information to a shady site or click a link or open an attachment you're not sure about.

Norton Cybercrime Report (PDF) via [Lifehacker]

Massive Hack Attack Plunges Netherlands Into the Stone Age

An attack on a company that certifies secure websites has forced the Dutch government to abandon email for faxes and snail mail. How long before frustrated citizens take to the streets and smash windows with postal scales and rolls of thermal paper?

A recent hack of the Dutch-based security company Diginotar has rendered many of the Dutch government's website's insecure and unusable for official business. According to the Wall Street Journal

In what is shaping up as one of the most damaging hacking cases for a single country, courts have advised lawyers to switch to fax and old-fashioned paper mail instead of email.

Lawyers can't access the Dutch Bar Association's Intranet, and have been told by courts to switch to fax machines and mail until the problems are solved.

So what's going on? While most of the world has been too bored by the details to really care, a huge hacking attack has rocked the system of certification many important websites rely on to assure their authenticity. A hacker broke into Digitnotar, one of the largest issuers of these certificates, and stole certificates allowing them to set up fraudulent websites and snoop on user's personal information and communication. For more than a week in July, fake certificates for sites like Google, Twitter—even the CIA—were in circulation.

According to a report by the security firm Fox-IT, the certificates were likely used to intercept communications in Iran. A notorious Iranian hacker named Comodohacker has claimed responsibility for the hack, hiding this understated message in the script he used to bust into Digitnotar.

"THERE IS NO ANY HARDWARE OR SOFTWARE IN THIS WORLD EXISTS WHICH COULD STOP MY HEAVY ATTACKS
MY BRAIN OR MY SKILLS OR MY WILL OR MY EXPERTISE"

As far as hacking attacks go, the Diginotar attack wasn't as obviously spectacular as, say, a massive dump of user names and passwords. But Dutch people now have to remember how to attach a stamp to a letter! And now that the U.S. postal service is going out of business at any moment, such an attack would basically send the U.S. back to the mid-1800s, all gas-lit lamps and Pony Express.

[Gawker]

Cyber crime now bigger than the drugs trade

The global cost of cybercrime is greater than the combined effect on the global economy of trafficking in marijuana, heroin and cocaine, which is estimated at $388bn, a new headline-grabbing study reported.

The Norton Cybercrime Report puts the straight-up financial costs of cyberattacks worldwide at $114bn, with time lost dealing with the crime adding the remaining $274bn, while the global black market in the three drugs costs $288bn.

Every second, 14 adults become the victim of some sort of cybercaper, adding up to over a million victims every day, the report from Norton-maker Symantec said, with young men who access the web on their mobiles the most likely victims.

But despite the large number of victims, people aren't doing enough to stop it for themselves. Although 74 per cent of people say they're aware of cybercrime, 41 per cent of them don't have up-to-date security software and 61 per cent don't use complex, regularly-changing passwords.

“There is a serious disconnect in how people view the threat of cybercrime,” said Adam Palmer, Norton's lead cybersecurity advisor. "Over the past 12 months, three times as many adults surveyed have suffered from online crime versus offline crime, yet less than a third of respondents think they are more likely to become a victim of cybercrime than physical world crime in the next year."

The most common cybercrime issues are malware and viruses, which have affected 54 percent of those surveyed, with online scams second (11 per cent), and phishing catching 10 per cent of adults out.

Cyber-villainy is also on the up on phones, with 10 per cent of adults having been victims of an attack on their mobile, according to the study. The study surveyed almost 20,000 people in 24 countries. ®

[The Register]

Webcam sextortion perve gets 6 years

Hacked girls' PCs and blackmailed them to pose



A Peeping Tom webcam sextortionist has been jailed for six years after targeting several young women.
Luis Mijangos, 32, a resident of Santa Ana, California, was imprisoned on Thursday after he was convicted of hacking into more than 100 computers, using stolen personal information, to blackmail his young female victims into posing for sexually explicit videos and pictures.

Mijangos, a freelance computer consultant who is confined to a wheelchair, used malware to compromise victims' machines. In one case he posted naked photos of a woman on her friend's MySpace page. In another he posed as a victim's boyfriend in order to trick her into posing for revealing pictures.

Mijangos used modified versions of remote access tools, such as Poison Ivy or SpyNet, which he planted onto file-sharing networks or sent to victims disguised as video clips or songs so that he could gain compromised access to their PCs, Computerworld reports.

The case is the latest in a long list of prosecutions of voyeurs who used computing technology to abuse victims. For example, Adrian Ringland of Ilkeston, Derbyshire, was jailed for 10 years back in 2006 after he was convicted of using spyware to take explicit photos of kids using compromised access to computer webcams. In 2008, a 47-year-old Cypriot got four years for taking illicit snaps of a teenager after he planted Trojan horse spyware to gain remote control of the 17-year-old's webcam. More discussion on the issue and advice on possible countermeasures (use anti-malware and, if in doubt, disable webcams) can be found in a blog post by Sophos here. ®

[The Register]

Two UK suspects cuffed in Anonymous manhunt

British police have arrested two men as part of a continuing investigation with the FBI into computer attacks carried out under the flags of the Anonymous and Lulz Security hacking crews.

The men, aged 20 and 24, were arrested on Thursday in Mexborough, near Doncaster, South Yorkshire, and Warminster, Wiltshire, under suspicion of committing offenses under the Computer Misuse Act, an article published on Friday in The Guardian reported. The men were arrested separately, and computer equipment from a Doncaster address was confiscated for forensic examination.

“The arrests relate to our inquiries into a series of serious computer intrusions and online denial-of-service attacks recently suffered by a number of multi-national companies, public institutions and government and law enforcement agencies in Great Britain and the United States," said Detective Inspector Mark Raymond from the Metropolitan Police's Central e-Crime Unit, according to a separate article from the Associated Press.

Over the past 18 months, people claiming affiliation with Anonymous and the splinter group Lulz Security have take responsibility for breaching the security of Sony, the CIA, Britain's Serious Organized Crime Agency and multiple US law enforcement groups. The attacks continued Thursday with the reported leak of internal email and documents from 28 Texas police chiefs.

Thursday's arrests came the same day Scotland Yard charged two men with attacks also attributed to Anonymous. Christopher Weatherhead, 20, of Northampton, and Ashley Rhodes, 26, of Kennington, south London, were charged with conspiracy to carry out an unauthorized act in relation to a computer.

They are scheduled to in Westminster Magistrates' Court on September 7.

Two other suspects, including 22-year-old Peter David Gibson and a 17-year-old from Chester, have already been charged in the case, which relates to denial-of-service attacks on PayPal, Amazon, MasterCard, Bank of America, and Visa in December.

The arrests are part of a trans-Atlantic crackdown on Anonymous following an 18-month hacking spree by the loosely organized griefer group. In the past few months, dozens of people in North America and Europe have been snared in the probe, including 14 people in the US and five in the UK and the Netherlands. ®

[The Register]

Researchers Uncover RSA Phishing Attack, Hiding in Plain Sight

Ever since security giant RSA was hacked last March, anti-virus researchers have been trying to get a copy of the malware used for the attack to study its method of infection. But RSA wasn’t cooperating, nor were the third-party forensic experts the company hired to investigate the breach.

This week Finnish security company F-Secure discovered that the file had been under their noses all along. Someone — the company assumes it was an employee of RSA or its parent firm, EMC — had uploaded the malware to an online virus scanning site back on March 19, a little over two weeks after RSA is believed to have been breached on March 3. The online scanner, VirusTotal, shares malware samples it receives with security vendors and malware researchers.

RSA had already revealed that it had been breached after attackers sent two different targeted phishing e-mails to four workers at its parent company EMC. The e-mails contained a malicious attachment that was identified in the subject line as “2011 Recruitment plan.xls.”

None of the recipients were people who would normally be considered high-profile or high-value targets, such as an executive or an IT administrator with special network privileges. But that didn’t matter. When one of the four recipients clicked on the attachment, the attachment used a zero-day exploit targeting a vulnerability in Adobe Flash to drop another malicious file — a backdoor — onto the recipient’s desktop computer. This gave the attackers a foothold to burrow farther into the network and gain the access they needed.

“The email was crafted well enough to trick one of the employees to retrieve it from their Junk mail folder, and open the attached excel file,” RSA wrote on its blog in April.

The intruders succeeded in stealing information related to the company’s SecurID two-factor authentication products. SecurID adds an extra layer of protection to a login process by requiring users to enter a secret code number displayed on a keyfob, or in software, in addition to their password. The number is cryptographically generated and changes every 30 seconds.

The company initially said that none of its customers were at risk, since the attackers would need more than the data they got from RSA to break into customer systems. But three months later, after defense contractor Lockheed Martin discovered hackers trying to breach their network using duplicates of the SecurID keys that RSA had issued the company — and other defense contractors such as L-3 were targeted in similar attacks — RSA announced it would replace most of its security tokens.

So just how well crafted was the e-mail that got RSA hacked? Not very, judging by what F-Secure found.

The attackers spoofed the e-mail to make it appear to come from a “web master” at Beyond.com, a job-seeking and recruiting site. Inside the e-mail, there was just one line of text: “I forward this file to you for review. Please open and view it.” This was apparently enough to get the intruders the keys to RSAs kingdom.

F-Secure produced a brief video showing what happened if the recipient clicked on the attachment. An Excel spreadsheet opened, which was completely blank except for an “X” that appeared in the first box of the spreadsheet. The “X” was the only visible sign that there was an embedded Flash exploit in the spreadsheet. When the spreadsheet opened, Excel triggered the Flash exploit to activate, which then dropped the backdoor – in this case a backdoor known as Poison Ivy – onto the system.

Poison Ivy would then reach out to a command-and-control server that the attackers controlled at good.mincesur.com, a domain that F-Secure says has been used in other espionage attacks, giving the attackers remote access to the infected computer at EMC. From there, they were able to reach the systems and data they were ultimately after.

F-Secure notes that neither the phishing e-mail nor the backdoor it dropped onto systems were advanced, although the zero-day Flash exploit it used to drop the backdoor was advanced. And ultimately, the fact that the attackers hacked a giant like RSA just to gain the information they needed to hack Lockheed Martin and other defense contractors exhibited a high level of advancement, not to mention chutzpah.

[Wired]

Google Certificate Hackers May Have Stolen 200 Others

Hackers who obtained a fraudulent digital certificate for Google may have actually obtained more than 200 digital certificates for other top internet entities such as Mozilla, Yahoo and even the privacy and anonymizing service Tor.

Dutch certificate authority DigiNotar, which was hacked in July, has never acknowledged the number of fraudulent certificates the hackers managed to obtain, nor identified the possible targets other than Google.

But a Dutch security consultant told ComputerWorld this week that “about 200 certificates were generated by the attackers.”

Hans Van de Looy, who spoke with the publication, wouldn’t reveal his source, but the number he cited is close to the number of certificates that Google has since placed on the blacklist for its Chrome web browser. On Monday, Google increased the number of certificates its browser was blacklisting from 10 to 247.

News about the hack at DigiNotar broke this weekend after reports began circulating from people in Iran who claimed they were getting browser error messages when they tried to load the Gmail website. Google subsequently confirmed that a fraudulent Google certificate issued to a non-Google entity was operating in the wild, allowing someone to conduct a man-in-the-middle attack to intercept Gmail browsing.

DigiNotar, which is owned by Illinois-based Vasco Data Security, is one of numerous firms around the world that are authorized to generate security certificates to internet entities. The certificates authenticate web pages using the Secure Socket Layer protocol so that users can trust that their encrypted communication is going to the correct location.

DigiNotar acknowledged on Monday that it discovered the breach back on July 19 and said it had revoked all of the certificates the intruders had managed to obtain. But the Google certificate, which had been generated by the intruders on July 10, managed to slip through DigiNotar’s auditors, raising speculation that the Dutch company missed others as well.

Mozilla, which makes the Firefox browser, has since acknowledged that the attackers managed to obtain a certificate for the secure page hosting addons for its browser.

DigiNotar has been criticized for not disclosing the breach earlier to browser makers or the companies, like Google and Yahoo, who have had their digital certificates commandeered.

[Wired]

U.S. Sources Exposed as Unredacted State Department Cables Are Unleashed Online

An encrypted WikiLeaks file containing 251,000 unredacted U.S. State Department cables is now widely available online, along with the passphrase to open it. The release of the documents in raw form, including the names of U.S. informants around the globe, has raised concerns that dozens of people could now be in danger.

The release of the file comes amidst a heated blame fest between WikiLeaks and the Guardian newspaper in London, which let slip the encrypted version of the database and the decryption key respectively. As details surface about how the leak occurred, it appears that both organizations share the blame.

The 1.73-GB file and passphrase were published Thursday on Cryptome, a competing secret-spilling site, after news broke over the last week that the file had been circulating on the internet unnoticed for several months. Wired.com’s keyword search of the file shows that the uncensored cables contain more than 2,000 occurrences of the phrase “strictly protect”, which is used in cables to denote sources of information whose identities diplomats consider confidential.

It’s unclear how the release will affect imprisoned 23-year-old Pfc. Bradley Manning, who’s facing a court-martial for allegedly leaking the database to WikiLeaks last year.

WikiLeaks had given the Guardian access to the file, along with the passphrase, last summer when WikiLeaks founder Julian Assange met with Guardian editor David Leigh.

WikiLeaks, the Guardian and other media outlets have been publishing the cables in dribs and drabs since last November, after carefully removing the names of most informants. The full database of cables was to have been released piecemeal through Nov. 29 of this year. But last Friday, as news of the leaked file and passphrase was made public, WikiLeaks suddenly began publishing a torrent of cables from the database. It has so far published about 144,000 cables, most of them unclassified. The Associated Press found the names of 90 confidential U.S. sources, including human rights workers laboring under totalitarian regimes, named in that subset of cables.

WikiLeaks said in a statement that it “advanced its regular publication schedule, to get as much of the material as possible into the hands of journalists and human rights lawyers who need it,” before information about the file and passphrase was widely published and repressive regimes sifted through the cables. WikiLeaks has been soliciting votes from the public on whether people agree or disagree that all 250,000 of the cables should be released in raw, unredacted form.

The popular vote favors release, and WikiLeaks has hinted on Twitter its intention to publish. But this time third parties have overtaken the secret-spilling site, and the file is already easily found elsewhere.

WikiLeaks blames the Guardian for disclosing the password in a book it published earlier this year about its WikiLeaks collaboration. WikiLeaks called the Guardian’s action “gross negligence or malice.” “The Guardian disclosure is a violation of the confidentiality agreement between WikiLeaks and Alan Rusbridger, editor-in-chief of the Guardian, signed July 30, 2010,” the group said in a lengthy statement.

The Guardian has downplayed its role in the debacle, while simultaneously revealing a lack of security savvy at the dawn of its relationship with WikiLeaks. The paper notes that although the Guardian’s book did reveal the passphrase, it did not reveal the location of the file, and that Assange had told the paper that “it was a temporary password which would expire and be deleted in a matter of hours. It was a meaningless piece of information to anyone except the person(s) who created the database.”

“No concerns were expressed when the book was published, and if anyone at WikiLeaks had thought this compromised security, they have had seven months to remove the files,” the paper went on to say. “That they didn’t do so clearly shows the problem was not caused by the Guardian’s book.”

Crypto keys, however, last forever, and even if WikiLeaks hadn’t blundered in its handling of the encrypted file, the Guardian clearly should have treated the key as highly sensitive for the foreseeable future.

The fracas heated up last Friday when an editor for the German news weekly Der Freitag revealed that his publication had found the uncensored cables in a 1.73-GB password-protected file named “cables.csv” that was available on the internet, and that the password had inadvertently been published online.

WikiLeaks revealed on Wednesday that the passphrase had indeed been published in a book written by Leigh. In the book, Leigh wrote that during the paper’s meeting with Assange in Belgium last year, Assange had given him the passphrase, in part in writing, and in part orally.

Assange had told the paper that the file, which was placed in a subdirectory on a WikiLeaks server, would remain online only a short time, after which it would be removed. Assange, however, apparently never removed the file, and it later found its way into the hands of the organization’s former spokesman, Daniel Domscheit-Berg, and then back to WikiLeaks, after which it wound up on BitTorrent as part of a large archive of WikiLeaks files, which could be downloaded by anyone.

[Wired]

Anonymous To Destroy Facebook On November 5th (Update: Well, Probably Not)

Anonymous To Destroy Facebook On November 5th (Update: Well, Probably Not)

Best Free Ways to Protect Your Private Files

Best Free Ways to Protect Your Private Files

Bad Guys Access 75,000 University of Wisconsin Social Security Numbers

Bad Guys Access 75,000 University of Wisconsin Social Security Numbers

Why Apple Collects Detailed Location Data from Your iPhone

All iSpy conspiracy bullshit aside, you are probably more interested in what your iPhone does with location data. Well, if you opt-in to the iPhone's location services, detailed—but anonymized—location data is transmitted back to Apple on a regular basis.

Gadget Lab reminds us of a letter Apple general counsel Bruce Sewell sent to a couple of Congressman last year explaining how and why Apple collects location data. (Wired's hosting the letter here.) Basically, if you've got Location Services turned on, whenever you request current location data (like via an app), Apple collects info about nearby cell towers and Wi-Fi hotspots. If you happen to be using GPS, it'll collect the GPS coordinates too. That data's then transmitted to Apple every 12 hours over "secure" Wi-Fi networks, anonymized with a "random identification number generated every 24 hours by an iOS device," so neither Apple nor anybody can personally identify you.

If you remember, Apple started doing its own location services last year (from iOS 3.2 onward), instead of using Google or Skyhook's location data. So, it needs to build and maintain its own database of known tower locations and Wi-Fi hotspots—that's where this info comes in. You're an official location scout for Apple, in other words. When your device asks where it's at, it hits up this database before zeroing in with GPS.

Not too crazy, though it doesn't make the ease with which your location history can be extracted from your Mac or iPhone any less unnerving. Also, it makes the lack of a purge after the data's transmitted to Apple seem more and more like a mere oversight.

More on this is at Gadget Lab: [Gadget Lab] via [Gizmodo]

Hide Your Data Through Fragmentation, Not Encryption

The thing about data encryption is that it's basically a flashing neon sign indicating "SENSITIVE DATA HERE!" A new technique lets you secure your data by customizing the way that data is fragmented across your drive.

The new method uses special software to place data on specific parts of your hard disc using a code instead of the disc drive controller chip. Your sensitive data is encoded into a binary value and used to modify the fragmentation patterns of an existing file. The conversion is based on whether or not sequential clusters of data are stored adjacently. If they are, it represents a binary 1; if they aren't, it's a 0.

The system was developed by Hassan Khan and his colleagues at the University of Science and Technology in Islamabad, Pakistan. They say that it can hide a 20MB message on a 160GB hard drive, and detecting its existence would be "unreasonably complex." This is important because the normal methods of encryption are so well known that they're dead giveaways that something is amiss, and often the fact that you have something to hide can be just as damning as the information itself.

This isn't a permanent solution for data security, of course. Now that this type of camouflage is in the field, it won't be long until a detection method is reverse engineered. But research like this is important for everyone—journalists, dissidents, LOIC enthusiasts—who thinks they are at risk of having their drives seized and searched for incriminating information.

[ScienceDirect via New Scientist via Gizmodo]

Corrupt bank worker jailed over Trojan-powered tax scam

A former local business manager at a bank who participated in a £3.2m self assessment tax fraud was jailed for three years and three months on Friday.

Nikola Novakovic, 34, conspired with Oleg Rozputnii, 28, to register over 1,050 fictitious taxpayers on the Income Tax Self Assessment system. The pair claimed fraudulent tax refunds under assumed names before laundering the proceeds of the scam via 200 fraudulent bank accounts.

Personal details needed to pull off the racket were extracted from the computers of consumers using an unspecified computer virus. Rozputnii, an illegal immigrant from the Ukraine, used numerous false identities to help commit the fraud, which also involved Dmytro Shepel, 26, a Ukrainian, also from London.

Joe Rawbone, assistant director of HMRC Criminal Investigation, said: "These men ran an audacious scam stealing millions of pounds. They set up hundreds of false bank accounts using viruses to hack into personal computers to gain information. They used their illegal profits to fund lavish lifestyles, buying performance cars including Porches, Mercedes and Jaguars. HMRC takes tax fraud extremely seriously and we will recover any financial gain from this criminal activity."

The scam netted £3.2m between January 2008 and September 2010 when the racket was uncovered following a lengthy investigation by HM Revenue & Customs (HMRC).

Sentencing, Mr Recorder Singh QC said that Novakovic "had abused his position with the bank" as part of a "sophisticated and orchestrated fraud".

Novakovic and Rozputnii pleaded guilty to cheating the public revenue in March. Rozputnii, the main mover behind the scam, was jailed for three years and nine months on Friday. Shepel was sentenced to three-and-a-half years at an earlier hearing in August 2010.

Pictures of the subjects and their cars can be found in a HMRC statement on the case here. ®

[TheRegister]

Wireless Security – Choosing the Best Wi-Fi Password

Running through some tests for an upcoming wireless security book and it really brings home the importance of choosing a good password for your Wi-Fi network.

Currently, the best security setting for your home or office Wi-Fi is WPA2.

WPA2 Enterprise is the best if your organization supports it, but WPA2 Personal is great for home and small offices.

Do not use WEP. It has been cracked a long time ago, and an attacker does not even have to crack it, the WEP key can be passed just like NTLM passwords.

The most common technique used for WPA/WPA2 hacking is a dictionary attack.

The attacker captures a WPA password handshake and passes this through a program that will try numerous passwords from a word list.

Here is the key, if the password is not in the word list, they hacker does not get into your system.

Using a lengthy complex password goes a long way in keeping your WPA2 network secure.

A combination of upper/lower case letters, numbers and special characters is the best bet.

Some prefer using a short sentence that means something to them, while replacing some of the letters with numbers and adding in a few extra characters.

I just ran one common word list attack against my WPA2 password. It tried over 1 million word combinations from the list with no dice. My network is still secure!

The more un-dictionary looking your password is, the better!

[InfoSecIsland]

Building More Secure Passwords

The problem of weak, guessable security passwords isn’t a new one, but it’s not going away.
In fact it’s getting worse, despite pleading from IT professionals to choose tough-to-guess passwords.

Workers are still disconcertingly likely to come up with something like “password1!” or simply attach a few numbers like “123,” to the end of a word.

As users have to create several passwords for different systems and change them every 60 or 90 days, it’s little wonder they default to the least complicated password their systems allow and make only minor variations when forced to change them.

Unfortunately, such passwords are easy to guess. At the other end of the scale are passwords software programs randomly generated, which are difficult for users to remember (leading them to write these passwords down which defeats the effort).

In a recent paper coauthored by Cisco, Florida State University, and Redjack LLC, researchers examined how different password requirements affect password strength — such as requiring a minimal password length or the addition of a special character.

The researchers discovered that such policies usually don’t provide greater security since hackers are well-versed in these tactics and can use them to guess passwords and access accounts.

For instance, hackers know that when users are required to use a special character in a password, they can simply append that character to the end of the password.

A better practice say the researchers, is an external password creation tool that changes a password after it’s created to add a guaranteed amount of randomness — for example, adding two random digits to the end of a password.

This allows users to choose a password that they are likely to remember while making it difficult for hackers to guess.

Another option is to implement a “judgmental” password policy which will reject a password instantly based on its estimated strength and suggest a stronger one.

Or administrators could implement password protection software, which lets users remember only one strong master password, leaving the application to store encrypted passwords.


Excerpted and adapted from the Cisco 2010 Annual Security Report


[infosecIsland]

DHL Express spam campaign leads to fake AV

A new spam campaign impersonating the popular mail service DHL Express is currently underway, warn Bkis researchers.

The email in question looks like this:



Once the user downloads and opens the attachment, the worm contained in it downloads a fake AV solution from a server located in Russia.

The fake AV ("XP Home Security") immediately starts its work and tries to trick the user into buying a full version that will supposedly remove all the infections it found.

Users are warned to be careful when reviewing emails purportedly coming from DHL express or any of the other well-known express mail services - more often than not, they are fake emails containing malicious attachments.

[net-security]

Ransom Trojan locks Windows

Ransomware is slowly becoming quite a problem, and the latest one spotted by F-Secure tries a rather innovative approach: it locks the victims out of Windows and doesn't allow them boot Windows in either normal or Safe mode until they have entered a code to "complete activation":



Posing as a legitimate Microsoft action, the scammers claim that the activation is "absolutely free and is simply a formality." The victims are offered six phone numbers to which they can place a call, enter a given code and once they receive an activation key, enter it and gain access to their computer again.

The note says that the call from the victim's county is free of charge, but that's a complete lie. The calls purportedly go to Microsoft call centers, but these numbers belong to rogue call centers seemingly located in countries such as the Dominican Republic or Somalia - i.e. countries with expensive phone rate.

But, these rogue call centers are actually located in countries the calls to which are much cheaper than to the previously mentioned ones, so the scammers and the owners of these call centers split the difference in the fee.

F-Secure's Mikko Hypponen demonstrated how the scam works, and says that no matter how many times and to which of the offered numbers one makes the call, one is forced to listen to a four minutes long prerecorded message that reveals at the end always the same activation code: 1351236.

You Windows can be unblocked only by entering the code or formatting your hard drive and restoring its contents from your backup - there is no other way.

[net-security]

“Facebook Support. Your password has been changed!” contains trojan

MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the subject “Facebook Support. Your password has been changed! ID09687″. Note that the number may change with each email.

The email is send from the spoofed addresses:

account@facebook.com
manager@facebook.com

The message has the following body:

Dear user of FaceBook.
Your password is not safe!
To secure your account the password has been changed automatically.
Attached document contains a new password to your account and detailed information about new security measures.
Thank you for your attention,
Your Facebook

The attached ZIP file has the name New_Password_IN04393.zip, note that the number at the end will change, and contains the 33 kB large file New_Password.exe.

The trojan is known as Gen:Heur.VIZ.2 (BitDefender), Mal/FakeAV-JX (Sophos), Trojan.Generic.Bredolab-2 (ClamAV).

The following files will be created:

%System%\document.doc

Several Windows registry changes will be exectued and the trojan can establish connection with the IP 193.106.34.20 on port 80.

Data can be obtained from following URLs:

• hxxp://profmiale.ru/TGQW4nHJOS/document.doc
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=8
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=9
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=uploader
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=grabbers
• hxxp://profmiale.ru/TGQW4nHJOS/grabbers.php
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=0
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=1
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=2
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=3
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=4
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=5
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=6
• hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=7

At the time of writing, only 6 of the 42 AV engines did detect the trojan at Virus Total.

Virus Total permalink and MD5: ecc2d442886b7296b5bd7eaeaae0bcea.

[ComputerSecurityArticles]

Facebook Scam Alert: ‘Everyone do check what she did on cam’ Spreading

We’re monitoring an on-going Facebook scam campaign that seems to be spreading faster than any campaign we’ve come across before.

What did this girl do on her webcam?

The scam starts with a user being tagged in a photo such as the one above. The photograph is posted in an album called “BBC News” to give it authenticity. It typically has over 100+ people tagged in it and it contains the following text: “Everyone do check what she did on cam …. — [URL]”

An example of what it would look like to see your friends tagged in this photo

The short URL typically redirects the users to a .info domain, which then takes the user to a Facebook Application Installation page.

Short URL redirects to the following Application Install Page

When a user allows the application, the scam continues with that user posting the same photo, tagging over 100 users in it and helping it propagate.

Over 100 Friends tagged in this scam

Users are also redirected to another .info domain, which contains a video that is gated by another form of a survey scam:

Facebook Verification Spam Bot – Freudian Slip?

The scammers have managed to be nimble enough to switch the campaign from one Short URL service to another. At first, this was spreading via Bit.ly:

Bit.ly Stats as this scam was first spreading

Over the course of an hour, this particular URL received over 80,000 clicks.  However, the scam has since shifted to the Goo.gl Short URL service:

Goo.gl Short URL Statistics for this scam

In less than an hour, the goo.gl version of the scam has reached over 125,000 clicks.
Recommendations: First and foremost, don’t click on the link included in the description of the photograph. One of the things you can do to prevent your friends/family members from falling for this is to untag yourself from the photograph:

You can untag yourself from any photo

Additionally, you can report the image so that Facebook can take action against it (this is an important step):

You can help prevent this scam from spreading by reporting it

If you’ve been tricked into installing the application, visit the Privacy Settings page and click on ‘Edit Your Settings’ under Apps and Websites.  Locate the Rogue Application under the Apps and Websites section (typically has the word “news” in it). Once you’ve located it under the  ‘Apps You Use’ section, click on ‘Edit Settings’ in order to remove the application.
Scammers are finding new ways to trick users. The key here is to be aware and to keep your friends and family members in the loop about scams like this one.  We can’t stress that enough.
Update: The goo.gl short URL has now logged over 220,000 clicks.

Over 220,000 clicks on the goo.gl short URL

Additionally, the scammers have also moved to TinyURL:

Scammers are also using tinyurl to lead users to the scam application

[ComputerSecurityArticles]

GCHQ says BlackBerry is safest

BlackBerrys are the only recommended smartphones for handling highly sensitive Government data, according to a GCHQ division.

The UK's National Technical Authority for Information Assurance at GCHQ (CESG) has published smartphone security guidance for public sector workers.

The advice published today covers various phones, including the Apple iPhone, Windows Phone 7 devices, Nokia hardware and BlackBerrys.

Four security procedures documents have been produced, outlining how to best secure any mobile deployment for UK Government departments and organisations on those platforms.

“These security procedures cover architectural issues (such as recommended network layout, recommendations for operational monitoring), configuration advice, user education and training suggestions, and information on residual risks that senior risk owners will need to take into account,” a CESG spokesperson told IT PRO.

“The publication of this risk management advice and guidance is intended to ensure all UK Government organisations have access to the information they need to take educated risk management decisions when deploying remote working solutions using smartphones.”

CESG worked with the telecoms industry to produce the report on how to secure smartphones for remote working, covering lower risk situations.

The guidance document itself was not available to the press.

CESG claimed the document will help many parts of the public sector work more efficiently and effectively, in turn saving money for the taxpayer.

As for more handling serious data, however, the GCHQ body said the only way was BlackBerry.
“The BlackBerry Enterprise Solution from Research In Motion remains the only smartphone system to have been formally evaluated by CESG and is approved to protect material classified up to and including ‘restricted,’” CESG said.

RIM was unsurprisingly buoyant about that particular comment, as a host of supporters talked about BlackBerry security credentials.

“The BlackBerry platform remains, in my opinion, the leader in this respect, providing the highest levels of assurance without the added cost or complexity of needing to bring third-party software into the equation,” said Nick McQuire, director for enterprise mobility at analyst house IDC.

BlackBerry devices are not infallible of course, as the recent Pwn2Own contest highlighted when a Torch 9800 was successfully hacked.

“The reality is that BlackBerry does have more enterprise features and controls such as remote kill, email retention, guaranteed message deliver with application and encryption controls,” said Ron Gula, chief executive (CEO) of Tenable Network Security.

“However, while this is important, a lot of it is just details, and we'll probably see some leapfrogging between the various mobile vendors as they get bitten and react.”

[ITPro]

Hackers Drain Cash From iTunes Accounts

Hacked accounts and fraudulent purchases are leaving iTunes users singing a sad song — again.

Crafty computer criminals are compromising users’ iTunes accounts and purchasing hundreds of dollars worth of music, apps, gift cards, ringtones and games, the security firm Kaspersky Lab reported.

The hacks, discussed in detail in an Apple Discussions blog and an “iTunes Account Hacked!” Facebook page, all share similar characteristics: the assailants gain access to the victims’ credit card information, modify the billing address and use the stolen info to make the fraudulent purchases.

“Another victim! My iTunes was drained of $29.98 on 3/25/11 at midnight,” wrote coupster7 on the Apple blog. “They also changed my billing address city/state to Towson, Md. Reported to apple.”

Unfortunately for users of the ubiquitous music platform, the iTunes hacks have been occurring since early 2010. Unlike coupster7, some attacks do serious damage to victims’ wallets.

On the Facebook page where consumers air hacking grievances, iTunes customer Jeff Tarsha wrote in May 2010, “Just happened to me. $200 out of bank account for stupid items. I think it was iTunes screw up thought because it happened right after placing an order for $1.99 cent song. I think it got messed up with somebody else’s order, but iTunes could care less and instantly blames me for not protecting my data. WTF?”

Hackers have long sought out iTunes as a target because of its popularity and the sensitive banking information users keep stored in their accounts.

Apple has yet to release a public statement about the compromised iTunes accounts. They did not return a call for comment.

[SecurityNewsDaily]

How to Create and Remember Super-Secure Passwords

How many websites did you visit today that required a password? Probably quite a few.

Do you need a password to access data or email at work? You likely do.

In fact, you may have even needed a password to log on to the computer you’re reading this on right now.

Passwords are the front line of defense in protecting the data on your computer. They keep your kids from hijacking your Twitter account, and keep cybercriminals from gaining access to your bank account.

The problem is that because we need so many passwords today, many of us take the easy way out. We either use the same password for everything, or use very simple, easy-to-remember passwords.
And that’s where we can get into trouble.




The risks of weak or multiple-use passwords

“Let’s say you fall for a phishing attack on Facebook,” explained Beth Jones, senior threat researcher for the information-security firm SophosLabs North America. “They can see your email address and try that same password there.

“If you have sensitive information in your email, such as bank statements or credit-card statements, then the attacker can try that password to access bank accounts or credit-card accounts as well,” Jones said.

“They would have several key pieces of [personal] information… so in theory they could try the ‘forgot username’ on other accounts, such as Twitter, or online games,” she said. “You can see how this snowballs quickly.”

Not only should you have a unique password for each site you log into online, but, as Gunther Ollmann, vice president of research at the Atlanta-based computer-security firm Damballa, pointed out, you should also avoid recycling old passwords.

“Criminals — and unethical web masters — often try to use the passwords that have been taken from one site and use them against other sites, especially if your email address is also known to them,” Ollman explained.

“Each website or application you use should have a different password, and ideally you should not use a predictable algorithm for generating them,” he said. “For example, a bad practice is to use a password that contains the particular website’s name or address in it.”


How to create perfect passwords

So what makes a good, strong password?

“Password strength is measured by two characteristics — length and complexity,” said Josh Shaul, chief technology officer with New York-based Application Security, Inc. and author of Practical Oracle Security: Your Unauthorized Guide to Relational Database Security. “In general, the longer the password, the more difficult it is to guess and the stronger it is.”

Password complexity, he added, means avoiding passwords that can be easily guessed.

“The easiest passwords to remember are simple words, places, dates or easy-to-type text strings,” Shaul said. “Favorite sports teams, cities, names, birthdays and even strings like ‘12345‘ or ‘qwerty‘ are very commonly used. These are all weak passwords.”

Most experts agree on the basics of creating strong passwords. Here are some tips from the Identity Theft Resource Center:

• A password should contain at least eight characters (some experts say 10 or 14 characters is the minimum).
• The password should have at least three of the four following types of characters — upper-case letters (ABC), lower-case letters (abc), numerals (123), and punctuation marks or other special characters (!#$%&*_=+? ).
• If you’re using only one capital letter or special character, don’t make it the first or last character in the password.
• Avoid common names, slang words or any words in the dictionary. Computers can run through entire dictionaries in minutes.
• Don’t include any part of your name or any part of your email addresses.
• Choose an especially strong password for websites that hold especially sensitive personal information — for example, banks or online retailers that store your credit-card information.
• Don’t ever refer to anything that can be learned from your social networking profiles or an Internet search. In other words, don’t make it your favorite band or movie, your pet’s name, your nickname, your phone number or, especially, your birth date.

Here’s a good way to create a strong password. Pick a phrase you’ll remember. Take the first letter of each word and run them together into a “word.” Capitalize some letters and substitute numerals where it would make sense to.

For example, the phrase “I hate to work late” could become “iH82wkl8.”

Or tweak that formula and don’t abbreviate all the words. "This little piggy went to market" might become "tlpWENT2m."

Not sure, even after following those tips, whether your password is strong enough? Go to one of the many websites that will check it for you.

Can’t think of a good password? There are also websites that generate them.


Should you write them down?

So if we need a unique, strong password for nearly everything we do online — check multiple email accounts, use Facebook and Twitter, make comments on CNN, buy something from Amazon — how can we remember them all? Is it okay to write them down somewhere?

Several years ago, the conventional wisdom was to never write down passwords — but that was when most of us only had a few to remember.

Some experts have since changed their minds.

“With today's threat landscape being dominated by password-stealing malware, physically writing down your passwords is becoming more acceptable,” Damballa’s Ollman said.

“The probability of someone breaking into your house and stealing your written-down passwords is considerably more remote than the 1-in-3 to 1-in-4 probability that your computer will fall to a criminal’s malware,” Ollman said.

Jones of SophosLabs sticks to the old advice — don’t write them down.

“This is really not a great idea, particularly for work,” Jones said. “Physical security is just as important as online security.

“Anyone walking by could see the sticky note next to your machine and then break into your accounts (especially if you use the same password for everything),” she added. “The risk is even greater if, as a user, you log into more than one location and have your password written at all those locations.”

Web browsers often ask if they can remember your password for you. Is that safer than writing down your password?

“For some passwords, it may be okay to let the browser remember your password on your personal laptop or home PC,” said Chris Burchett, founder and chief technology officer with Addison, Texas-based information-security firm Credant.

“In general, if the information on the website that requires your password is what you consider to be public, then it may be okay to let the browser remember the password,” Burchett said. “But be careful. 

Never let the browser remember passwords to banking websites or other sites where private personal identity information is used or available.”

“Also be careful when using a public-kiosk computer like the ones at the airport. Never let browsers on computers you don't own store passwords,” he added. “In fact, it would be best not to log into any website requiring a password from a computer you don't own.”


Password-management software

Instead, the experts suggest using third-party password-management software, which stores all your passwords in one place and protects them with one very strong master password — the only one you’ll have to remember.

“Managing passwords is a challenge because there are so many online accounts requiring passwords these days,” Burchett said. “Using a password manager to securely generate, store, rotate and supply passwords on demand may be worth considering as long as you remember to make the master password strong enough.”

There are dozens of password managers, both free and inexpensive (none cost more than $30). Some of the better-known ones include Web Confidential, LastPass, KeePass and its Mac/Linux sibling KeePassX. Some run on PCs, others on smartphones, while some are browser plug-ins.

As for the password managers that come with browsers, most of them aren’t very secure. Only Opera and Mozilla Firefox use master passwords, and Firefox’s is turned off by default. (Here’s how to turn it on.)

Now that you’ve read all this, do yourself a favor this weekend. Go through all your online accounts and use these tips to create strong, unique passwords for each one, and then use a password manager to remember them all.

It’ll take less time than you think. Next time a friend or relative has an email account hijacked or gets charged for dozens of iTunes songs he didn’t buy, you’ll be glad you did.

[SecurityNewsDaily]