Ethical hackers battle to prevent 'information security apocalypse'

(CNN) -- Barely a day passes without news of another major computer security breach. Last week a hacking network named "Hollywood Leaks" began their attack on the personal data of celebrities, officially adding the glitterati to a roll of shame that already includes targets as diffuse as Sony, the Church of Scientology and PayPal.

However only a few days before the emergence of this latest hacking outfit, a far less conspicuous but similarly-skilled group met at a London hotel to discuss the other side of all matters of information security, otherwise known as "infosec".

The inaugural 44Con was Britain's first major conference for the good guys of infosec. Among the 300 delegates and speakers were a number of so-called "white hats", programmers and penetration testers specifically employed to discover businesses' weak spots.

Using information from these ethical hackers, manufacturers can remedy or "patch" the problem before its release and companies can take measures to safeguard their data.

Everybody had a look at the Sony thing and thought, 'Oh God, I hope I'm not next.'
Steve Lord, foudner 44Con

Although their more destructive brethren might continue to grab headlines, 44Con demonstrated that the fight against hackers, and other more traditional threats to information security, is also strong.

"The way people use and consume media and share information has drastically changed over the past ten years," said Steve Lord, a security professional and co-founder of 44Con.

"The information that we used to think would stay on a computer, in an increasingly networked world, it goes everywhere. So there is an increasing demand for people to secure that information because otherwise people won't put it there."

44Con attracted representatives from governments and members of the military, alongside risk managers, consultants and students. According to Lord, the roll call included "hackers, freaks, geeks, spooks and kooks," none of whom was required to identify themselves further than a first name.

"It's everyone around the table all looking at the same problems and hopefully coming up with some solutions," Lord said.

High-profile hacking is only one strand of the ongoing battle to protect electronic information from damage or infiltration.

Events at 44Con ran the gamut from workshops demonstrating old-fashioned lock-picking with a paperclip, through discussions of threats to iPads and smart phones and even a presentation of how NASA's transmissions to astronauts have recently been intercepted.

"We've got a serious problem here... like the global financial crisis," said Haroon Meer, a researcher at the infosec consultancy, Thinkst. But although Meer also referred to "our upcoming security apocalypse", others were focused on how intelligence can be used to predict attacks before they occur and, crucially, how to acquire boardroom backing for improved security measures.

We've got a serious problem here... like the global financial crisis.
Haroon Meer, infosec consultant

Infosec professionals often converse in a language that is not always immediately accessible to a layman (executives included), but the result of their endeavors can often be startlingly clear.

"Every single guy at boardroom level that I speak to says, 'Are we going to be the next Sony?'" said Lord, referring to the recent devastating hack on the electronics giant. "Everybody had a look at the Sony thing and thought, 'Oh God, I hope I'm not next.'"

Sony given 'epic fail' award from hackers

Several presentations at 44Con offered chilling demonstrations of the vulnerabilities of common business devices. Alex Plaskett, a consultant at MWR InfoSecurity, who described himself as someone who has been "professionally breaking things" for many years, performed a so-called "drive-by" exploit on a Windows 7 smart phone.

Independent security consultant, Neil Kettle, performed a take-down of the much garlanded online banking security software Trusteer Rapport, running a key-logging program that replicated on screen anything a user might be entering into supposedly secure password fields.

Another security expert Roelof Temmingh showcased the most recent version of Maltego, software that analyzes and compares freely available information from numerous social networking sites.

Using the website of the Executive Office of the President as an example, Temmingh was able to extract specific information such as favored restaurants among White House staffers, as well as other behavioral trends.

"Even if we don't want to attack, what can we learn?" Temmingh asked, before revealing that at least one member of the Bush administration was a fan of Moody's Diner, visited a psychic medium named "Rosemary the Celtic Lady" and was a keen editor of Wikipedia pages.

The examples were deliberately banal and outdated, but the implication was clear. Through similar paths, hackers of more nefarious intentions could determine what versions of browsers are being used in the White House, for instance, and probe specific vulnerabilities. "If you can exploit the browser of a leader, then you've exploited the PC of a president," Temmingh warned.

However it was left to Alexis Conran, a former confidence trickster who appeared in a British TV show called "The Real Hustle", to sum up the challenges still faced by the infosec sector.

"The general public will only take steps to protect themselves if they know what the dangers are," he said.

[CNN]

Cybercrooks prey on 9/11 anniversary

Malware, 'commemorative coin' auctions and fake charity donation



Cybercrooks are gearing up for the 10th anniversary of the 9/11 attacks with a range of malware traps and hacking attempts both on social networks and the wider internet, net security firm BitDefender warns.

The first wave of these attacks comes in the form of the newly established websites offering supposed content such as "Bin Laden alive", "in depth details about the terrorist attack", "police investigation results" and "towers going down" to attract the curious.

The sites are filed with links to scareware and phishing sites. Others have created fraudulent charity donation sites that serve only to line their greedy pockets at the expense of genuine gift-giving sites.

In addition, fraudsters are running fake auctions and sales of items supposedly linked to the devastating attacks such as shards of metal from the twin tower or even "commemorative coins" supposedly minted from silver collected at the attack site.

More scam, perhaps involving malware, can be expected to follow over the coming days.

“Because of the advancement of hacking and spamming technology over the past decade, plus the significance of the anniversary and increased media coverage, Sept 11 this year may prove hectic on the malware front,” said Catalin Cosoi, head of the Online Threats Lab at Bitdefender.

BitDefender says many of the scams likely to be on show are similar to those seen during anniversaries of the London bombings of July 2005.

Cybercrooks marked remembrances of the 7/7 attacks with fake donation requests, spamming of viruses disguised as supposed videos of the assaults and advanced fee fraud email scams. ®

[TheRegister]

People Who Get Malware Also Get Mugged More Than Usual

Our Lifehacker AU comrades point out this interesting fact from Norton's latest Cybercrime report: People who fall victim to malware are statistically more likely to be mugged in real life too. Interesting.

The obvious caveat is that correlation doesn't imply causation, but it is a bit telling to see that these two statistics are linked. Could it be that people who aren't careful online—because honestly, that's what falling victim to malware is—aren't careful in meatspace either?

Norton's internet safety advocate agrees, and says "Clearly these people aren't taking enough care in their real-world interactions and it carries over in their online world." Just think about people you know and how careful they are in their everyday dealings with other people. The more guarded or suspicious you are, the less likely you are to hand over your personal information to a shady site or click a link or open an attachment you're not sure about.

Norton Cybercrime Report (PDF) via [Lifehacker]

Massive Hack Attack Plunges Netherlands Into the Stone Age

An attack on a company that certifies secure websites has forced the Dutch government to abandon email for faxes and snail mail. How long before frustrated citizens take to the streets and smash windows with postal scales and rolls of thermal paper?

A recent hack of the Dutch-based security company Diginotar has rendered many of the Dutch government's website's insecure and unusable for official business. According to the Wall Street Journal

In what is shaping up as one of the most damaging hacking cases for a single country, courts have advised lawyers to switch to fax and old-fashioned paper mail instead of email.

Lawyers can't access the Dutch Bar Association's Intranet, and have been told by courts to switch to fax machines and mail until the problems are solved.

So what's going on? While most of the world has been too bored by the details to really care, a huge hacking attack has rocked the system of certification many important websites rely on to assure their authenticity. A hacker broke into Digitnotar, one of the largest issuers of these certificates, and stole certificates allowing them to set up fraudulent websites and snoop on user's personal information and communication. For more than a week in July, fake certificates for sites like Google, Twitter—even the CIA—were in circulation.

According to a report by the security firm Fox-IT, the certificates were likely used to intercept communications in Iran. A notorious Iranian hacker named Comodohacker has claimed responsibility for the hack, hiding this understated message in the script he used to bust into Digitnotar.

"THERE IS NO ANY HARDWARE OR SOFTWARE IN THIS WORLD EXISTS WHICH COULD STOP MY HEAVY ATTACKS
MY BRAIN OR MY SKILLS OR MY WILL OR MY EXPERTISE"

As far as hacking attacks go, the Diginotar attack wasn't as obviously spectacular as, say, a massive dump of user names and passwords. But Dutch people now have to remember how to attach a stamp to a letter! And now that the U.S. postal service is going out of business at any moment, such an attack would basically send the U.S. back to the mid-1800s, all gas-lit lamps and Pony Express.

[Gawker]

Cyber crime now bigger than the drugs trade

The global cost of cybercrime is greater than the combined effect on the global economy of trafficking in marijuana, heroin and cocaine, which is estimated at $388bn, a new headline-grabbing study reported.

The Norton Cybercrime Report puts the straight-up financial costs of cyberattacks worldwide at $114bn, with time lost dealing with the crime adding the remaining $274bn, while the global black market in the three drugs costs $288bn.

Every second, 14 adults become the victim of some sort of cybercaper, adding up to over a million victims every day, the report from Norton-maker Symantec said, with young men who access the web on their mobiles the most likely victims.

But despite the large number of victims, people aren't doing enough to stop it for themselves. Although 74 per cent of people say they're aware of cybercrime, 41 per cent of them don't have up-to-date security software and 61 per cent don't use complex, regularly-changing passwords.

“There is a serious disconnect in how people view the threat of cybercrime,” said Adam Palmer, Norton's lead cybersecurity advisor. "Over the past 12 months, three times as many adults surveyed have suffered from online crime versus offline crime, yet less than a third of respondents think they are more likely to become a victim of cybercrime than physical world crime in the next year."

The most common cybercrime issues are malware and viruses, which have affected 54 percent of those surveyed, with online scams second (11 per cent), and phishing catching 10 per cent of adults out.

Cyber-villainy is also on the up on phones, with 10 per cent of adults having been victims of an attack on their mobile, according to the study. The study surveyed almost 20,000 people in 24 countries. ®

[The Register]

Webcam sextortion perve gets 6 years

Hacked girls' PCs and blackmailed them to pose



A Peeping Tom webcam sextortionist has been jailed for six years after targeting several young women.
Luis Mijangos, 32, a resident of Santa Ana, California, was imprisoned on Thursday after he was convicted of hacking into more than 100 computers, using stolen personal information, to blackmail his young female victims into posing for sexually explicit videos and pictures.

Mijangos, a freelance computer consultant who is confined to a wheelchair, used malware to compromise victims' machines. In one case he posted naked photos of a woman on her friend's MySpace page. In another he posed as a victim's boyfriend in order to trick her into posing for revealing pictures.

Mijangos used modified versions of remote access tools, such as Poison Ivy or SpyNet, which he planted onto file-sharing networks or sent to victims disguised as video clips or songs so that he could gain compromised access to their PCs, Computerworld reports.

The case is the latest in a long list of prosecutions of voyeurs who used computing technology to abuse victims. For example, Adrian Ringland of Ilkeston, Derbyshire, was jailed for 10 years back in 2006 after he was convicted of using spyware to take explicit photos of kids using compromised access to computer webcams. In 2008, a 47-year-old Cypriot got four years for taking illicit snaps of a teenager after he planted Trojan horse spyware to gain remote control of the 17-year-old's webcam. More discussion on the issue and advice on possible countermeasures (use anti-malware and, if in doubt, disable webcams) can be found in a blog post by Sophos here. ®

[The Register]

Two UK suspects cuffed in Anonymous manhunt

British police have arrested two men as part of a continuing investigation with the FBI into computer attacks carried out under the flags of the Anonymous and Lulz Security hacking crews.

The men, aged 20 and 24, were arrested on Thursday in Mexborough, near Doncaster, South Yorkshire, and Warminster, Wiltshire, under suspicion of committing offenses under the Computer Misuse Act, an article published on Friday in The Guardian reported. The men were arrested separately, and computer equipment from a Doncaster address was confiscated for forensic examination.

“The arrests relate to our inquiries into a series of serious computer intrusions and online denial-of-service attacks recently suffered by a number of multi-national companies, public institutions and government and law enforcement agencies in Great Britain and the United States," said Detective Inspector Mark Raymond from the Metropolitan Police's Central e-Crime Unit, according to a separate article from the Associated Press.

Over the past 18 months, people claiming affiliation with Anonymous and the splinter group Lulz Security have take responsibility for breaching the security of Sony, the CIA, Britain's Serious Organized Crime Agency and multiple US law enforcement groups. The attacks continued Thursday with the reported leak of internal email and documents from 28 Texas police chiefs.

Thursday's arrests came the same day Scotland Yard charged two men with attacks also attributed to Anonymous. Christopher Weatherhead, 20, of Northampton, and Ashley Rhodes, 26, of Kennington, south London, were charged with conspiracy to carry out an unauthorized act in relation to a computer.

They are scheduled to in Westminster Magistrates' Court on September 7.

Two other suspects, including 22-year-old Peter David Gibson and a 17-year-old from Chester, have already been charged in the case, which relates to denial-of-service attacks on PayPal, Amazon, MasterCard, Bank of America, and Visa in December.

The arrests are part of a trans-Atlantic crackdown on Anonymous following an 18-month hacking spree by the loosely organized griefer group. In the past few months, dozens of people in North America and Europe have been snared in the probe, including 14 people in the US and five in the UK and the Netherlands. ®

[The Register]

Researchers Uncover RSA Phishing Attack, Hiding in Plain Sight

Ever since security giant RSA was hacked last March, anti-virus researchers have been trying to get a copy of the malware used for the attack to study its method of infection. But RSA wasn’t cooperating, nor were the third-party forensic experts the company hired to investigate the breach.

This week Finnish security company F-Secure discovered that the file had been under their noses all along. Someone — the company assumes it was an employee of RSA or its parent firm, EMC — had uploaded the malware to an online virus scanning site back on March 19, a little over two weeks after RSA is believed to have been breached on March 3. The online scanner, VirusTotal, shares malware samples it receives with security vendors and malware researchers.

RSA had already revealed that it had been breached after attackers sent two different targeted phishing e-mails to four workers at its parent company EMC. The e-mails contained a malicious attachment that was identified in the subject line as “2011 Recruitment plan.xls.”

None of the recipients were people who would normally be considered high-profile or high-value targets, such as an executive or an IT administrator with special network privileges. But that didn’t matter. When one of the four recipients clicked on the attachment, the attachment used a zero-day exploit targeting a vulnerability in Adobe Flash to drop another malicious file — a backdoor — onto the recipient’s desktop computer. This gave the attackers a foothold to burrow farther into the network and gain the access they needed.

“The email was crafted well enough to trick one of the employees to retrieve it from their Junk mail folder, and open the attached excel file,” RSA wrote on its blog in April.

The intruders succeeded in stealing information related to the company’s SecurID two-factor authentication products. SecurID adds an extra layer of protection to a login process by requiring users to enter a secret code number displayed on a keyfob, or in software, in addition to their password. The number is cryptographically generated and changes every 30 seconds.

The company initially said that none of its customers were at risk, since the attackers would need more than the data they got from RSA to break into customer systems. But three months later, after defense contractor Lockheed Martin discovered hackers trying to breach their network using duplicates of the SecurID keys that RSA had issued the company — and other defense contractors such as L-3 were targeted in similar attacks — RSA announced it would replace most of its security tokens.

So just how well crafted was the e-mail that got RSA hacked? Not very, judging by what F-Secure found.

The attackers spoofed the e-mail to make it appear to come from a “web master” at Beyond.com, a job-seeking and recruiting site. Inside the e-mail, there was just one line of text: “I forward this file to you for review. Please open and view it.” This was apparently enough to get the intruders the keys to RSAs kingdom.

F-Secure produced a brief video showing what happened if the recipient clicked on the attachment. An Excel spreadsheet opened, which was completely blank except for an “X” that appeared in the first box of the spreadsheet. The “X” was the only visible sign that there was an embedded Flash exploit in the spreadsheet. When the spreadsheet opened, Excel triggered the Flash exploit to activate, which then dropped the backdoor – in this case a backdoor known as Poison Ivy – onto the system.

Poison Ivy would then reach out to a command-and-control server that the attackers controlled at good.mincesur.com, a domain that F-Secure says has been used in other espionage attacks, giving the attackers remote access to the infected computer at EMC. From there, they were able to reach the systems and data they were ultimately after.

F-Secure notes that neither the phishing e-mail nor the backdoor it dropped onto systems were advanced, although the zero-day Flash exploit it used to drop the backdoor was advanced. And ultimately, the fact that the attackers hacked a giant like RSA just to gain the information they needed to hack Lockheed Martin and other defense contractors exhibited a high level of advancement, not to mention chutzpah.

[Wired]

Google Certificate Hackers May Have Stolen 200 Others

Hackers who obtained a fraudulent digital certificate for Google may have actually obtained more than 200 digital certificates for other top internet entities such as Mozilla, Yahoo and even the privacy and anonymizing service Tor.

Dutch certificate authority DigiNotar, which was hacked in July, has never acknowledged the number of fraudulent certificates the hackers managed to obtain, nor identified the possible targets other than Google.

But a Dutch security consultant told ComputerWorld this week that “about 200 certificates were generated by the attackers.”

Hans Van de Looy, who spoke with the publication, wouldn’t reveal his source, but the number he cited is close to the number of certificates that Google has since placed on the blacklist for its Chrome web browser. On Monday, Google increased the number of certificates its browser was blacklisting from 10 to 247.

News about the hack at DigiNotar broke this weekend after reports began circulating from people in Iran who claimed they were getting browser error messages when they tried to load the Gmail website. Google subsequently confirmed that a fraudulent Google certificate issued to a non-Google entity was operating in the wild, allowing someone to conduct a man-in-the-middle attack to intercept Gmail browsing.

DigiNotar, which is owned by Illinois-based Vasco Data Security, is one of numerous firms around the world that are authorized to generate security certificates to internet entities. The certificates authenticate web pages using the Secure Socket Layer protocol so that users can trust that their encrypted communication is going to the correct location.

DigiNotar acknowledged on Monday that it discovered the breach back on July 19 and said it had revoked all of the certificates the intruders had managed to obtain. But the Google certificate, which had been generated by the intruders on July 10, managed to slip through DigiNotar’s auditors, raising speculation that the Dutch company missed others as well.

Mozilla, which makes the Firefox browser, has since acknowledged that the attackers managed to obtain a certificate for the secure page hosting addons for its browser.

DigiNotar has been criticized for not disclosing the breach earlier to browser makers or the companies, like Google and Yahoo, who have had their digital certificates commandeered.

[Wired]

U.S. Sources Exposed as Unredacted State Department Cables Are Unleashed Online

An encrypted WikiLeaks file containing 251,000 unredacted U.S. State Department cables is now widely available online, along with the passphrase to open it. The release of the documents in raw form, including the names of U.S. informants around the globe, has raised concerns that dozens of people could now be in danger.

The release of the file comes amidst a heated blame fest between WikiLeaks and the Guardian newspaper in London, which let slip the encrypted version of the database and the decryption key respectively. As details surface about how the leak occurred, it appears that both organizations share the blame.

The 1.73-GB file and passphrase were published Thursday on Cryptome, a competing secret-spilling site, after news broke over the last week that the file had been circulating on the internet unnoticed for several months. Wired.com’s keyword search of the file shows that the uncensored cables contain more than 2,000 occurrences of the phrase “strictly protect”, which is used in cables to denote sources of information whose identities diplomats consider confidential.

It’s unclear how the release will affect imprisoned 23-year-old Pfc. Bradley Manning, who’s facing a court-martial for allegedly leaking the database to WikiLeaks last year.

WikiLeaks had given the Guardian access to the file, along with the passphrase, last summer when WikiLeaks founder Julian Assange met with Guardian editor David Leigh.

WikiLeaks, the Guardian and other media outlets have been publishing the cables in dribs and drabs since last November, after carefully removing the names of most informants. The full database of cables was to have been released piecemeal through Nov. 29 of this year. But last Friday, as news of the leaked file and passphrase was made public, WikiLeaks suddenly began publishing a torrent of cables from the database. It has so far published about 144,000 cables, most of them unclassified. The Associated Press found the names of 90 confidential U.S. sources, including human rights workers laboring under totalitarian regimes, named in that subset of cables.

WikiLeaks said in a statement that it “advanced its regular publication schedule, to get as much of the material as possible into the hands of journalists and human rights lawyers who need it,” before information about the file and passphrase was widely published and repressive regimes sifted through the cables. WikiLeaks has been soliciting votes from the public on whether people agree or disagree that all 250,000 of the cables should be released in raw, unredacted form.

The popular vote favors release, and WikiLeaks has hinted on Twitter its intention to publish. But this time third parties have overtaken the secret-spilling site, and the file is already easily found elsewhere.

WikiLeaks blames the Guardian for disclosing the password in a book it published earlier this year about its WikiLeaks collaboration. WikiLeaks called the Guardian’s action “gross negligence or malice.” “The Guardian disclosure is a violation of the confidentiality agreement between WikiLeaks and Alan Rusbridger, editor-in-chief of the Guardian, signed July 30, 2010,” the group said in a lengthy statement.

The Guardian has downplayed its role in the debacle, while simultaneously revealing a lack of security savvy at the dawn of its relationship with WikiLeaks. The paper notes that although the Guardian’s book did reveal the passphrase, it did not reveal the location of the file, and that Assange had told the paper that “it was a temporary password which would expire and be deleted in a matter of hours. It was a meaningless piece of information to anyone except the person(s) who created the database.”

“No concerns were expressed when the book was published, and if anyone at WikiLeaks had thought this compromised security, they have had seven months to remove the files,” the paper went on to say. “That they didn’t do so clearly shows the problem was not caused by the Guardian’s book.”

Crypto keys, however, last forever, and even if WikiLeaks hadn’t blundered in its handling of the encrypted file, the Guardian clearly should have treated the key as highly sensitive for the foreseeable future.

The fracas heated up last Friday when an editor for the German news weekly Der Freitag revealed that his publication had found the uncensored cables in a 1.73-GB password-protected file named “cables.csv” that was available on the internet, and that the password had inadvertently been published online.

WikiLeaks revealed on Wednesday that the passphrase had indeed been published in a book written by Leigh. In the book, Leigh wrote that during the paper’s meeting with Assange in Belgium last year, Assange had given him the passphrase, in part in writing, and in part orally.

Assange had told the paper that the file, which was placed in a subdirectory on a WikiLeaks server, would remain online only a short time, after which it would be removed. Assange, however, apparently never removed the file, and it later found its way into the hands of the organization’s former spokesman, Daniel Domscheit-Berg, and then back to WikiLeaks, after which it wound up on BitTorrent as part of a large archive of WikiLeaks files, which could be downloaded by anyone.

[Wired]