Archive for the ‘Security’ Category

« Older Entries

iPhones can auto-connect to rogue Wi-Fi networks, researchers warn

Friday, June 14th, 2013

Attackers can exploit behavior to collect passwords and other sensitive data.

Security researchers say they’ve uncovered a weakness in some iPhones that makes it easier to force nearby users to connect to Wi-Fi networks that steal passwords or perform other nefarious deeds.

The weakness is contained in configuration settings installed by AT&T, Vodafone, and more than a dozen other carriers that give the phones voice and Internet services, according to a blog post published Wednesday. Settings for AT&T iPhones, for instance, frequently instruct the devices to automatically connect to a Wi-Fi network called attwifi when the signal becomes available. Carriers make the Wi-Fi signals available in public places as a service to help subscribers get Internet connections that are fast and reliable. Attackers can take advantage of this behavior by setting up their own rogue Wi-Fi networks with the same names and then collecting sensitive data as it passes through their routers.

“The takeaway is clear,” the researchers from mobile phone security provider Skycure wrote. “Setting up such Wi-Fi networks would initiate an automatic attack on nearby customers of the carrier, even if they are using an out-of-the-box iOS device that never connected to any Wi-Fi network.”

The researchers said they tested their hypothesis by setting up several Wi-Fi networks in public areas that used the same SSIDs as official carrier networks. During a test at a restaurant in Tel Aviv, Israel on Tuesday, 60 people connected to an imposter network in the first minute, Adi Sharabani, Skycure’s CEO and cofounder, told Ars in an e-mail. During a presentation on Wednesday at the International Cyber Security Conference, the Skycure researchers set up a network that 448 people connected to during a two-and-a-half-hour period. The researchers didn’t expose people to any attacks during the experiments; they just showed how easy it was for them to connect to networks without knowing they had no affiliation to the carrier.

Sharabani said the settings that cause AT&T iPhones to automatically connect to certain networks can be found in the device’s profile.mobileconfig file. It’s not clear if phones from other carriers also store their configurations in the same location or somewhere else.

“Moreover, even if you take another iOS device and put an AT&T sim in it, the network will be automatically defined, and you’ll get the same behavior,” he said. He said smartphones running Google’s Android operating system don’t behave the same way.

Once attackers have forced a device to connect to a rogue network, they can run exploit software that bypasses the secure sockets layer Web encryption. From there, attackers can perform man-in-the-middle (MitM) attacks that allow them to observe passwords in transit and even forge links and other content on the websites users are visiting.

The most effective way to prevent iPhones from connecting to networks without the user’s knowledge is to turn off Wi-Fi whenever it’s not needed. Apps are also available that give users control over what SSIDs an iPhone will and won’t connect to. It’s unclear how iPhones running the upcoming iOS 7 will behave. As Ars reported Monday, Apple’s newest OS will support the Wi-Fi Alliance’s Hotspot 2.0 specification, which is designed to allow devices to hop from one Wi-Fi hotspot to another.

Given how easy it for attackers to abuse Wi-Fi weaknesses, the Skycure research isn’t particularly shocking. Still, the ability of iPhones to connect to networks for the first time without requiring users to take explicit actions could be problematic, said Robert Graham, an independent security researcher who reviewed the Skycure blog post.

“A lot of apps still send stuff in the clear, and other apps don’t check the SSL certificate chain properly, meaning that Wi-Fi MitM is a huge problem,” said Graham, who is CEO of Errata Security. “That your phone comes pre-pwnable without your actions is a bad thing. Devices should come secure by default, not pwnable by default.”

Source:  arstechnica.com

Tags:
Posted in Apple, Apps, Cellular, Mobile, Network, Privacy, Security, Wi-Fi, WiFi, Wireless | No Comments »

Medical Devices Hard-Coded Passwords (ICS-ALERT-13-164-01)

Friday, June 14th, 2013

SUMMARY

Researchers Billy Rios and Terry McCorkle of Cylance have reported a hard-coded password vulnerability affecting roughly 300 medical devices across approximately 40 vendors. According to their report, the vulnerability could be exploited to potentially change critical settings and/or modify device firmware.

Because of the critical and unique status that medical devices occupy, ICS-CERT has been working in close cooperation with the Food and Drug Administration (FDA) in addressing these issues. ICS-CERT and the FDA have notified the affected vendors of the report and have asked the vendors to confirm the vulnerability and identify specific mitigations. ICS-CERT is issuing this alert to provide early notice of the report and identify baseline mitigations for reducing risks to these and other cybersecurity attacks. ICS-CERT and the FDA will follow up with specific advisories and information as appropriate

The report included vulnerability details for the following vulnerability

Vulnerability Type Remotely Exploitable Impact
Hard-coded password Yes, device dependent Critical settings/device firmware modification

 

The affected devices have hard-coded passwords that can be used to permit privileged access to devices such as passwords that would normally be used only by a service technician. In some devices, this access could allow critical settings or the device firmware to be modified.

The affected devices are manufactured by a broad range of vendors and fall into a broad range of categories including but not limited to:

  • Surgical and anesthesia devices,
  • Ventilators,
  • Drug infusion pumps,
  • External defibrillators,
  • Patient monitors, and
  • Laboratory and analysis equipment.

ICS-CERT and the FDA are not aware that this vulnerability has been exploited, nor are they aware of any patient injuries resulting from this potential cybersecurity vulnerability.

MITIGATION

ICS-CERT is currently coordinating with multiple vendors, the FDA, and the security researchers to identify specific mitigations across all devices. In the interim, ICS-CERT recommends that device manufacturers, healthcare facilities, and users of these devices take proactive measures to minimize the risk of exploitation of this and other vulnerabilities. The FDA has published recommendations and best practices to help prevent unauthorized access or modification to medical devices.

  • Take steps to limit unauthorized device access to trusted users only, particularly for those devices that are life-sustaining or could be directly connected to hospital networks.
    • Appropriate security controls may include: user authentication, for example, user ID and password, smartcard or biometric; strengthening password protection by avoiding hard‑coded passwords and limiting public access to passwords used for technical device access; physical locks; card readers; and guards.
  • Protect individual components from exploitation and develop strategies for active security protection appropriate for the device’s use environment. Such strategies should include timely deployment of routine, validated security patches and methods to restrict software or firmware updates to authenticated code. Note: The FDA typically does not need to review or approve medical device software changes made solely to strengthen cybersecurity.
  • Use design approaches that maintain a device’s critical functionality, even when security has been compromised, known as “fail-safe modes.”
  • Provide methods for retention and recovery after an incident where security has been compromised. Cybersecurity incidents are increasingly likely and manufacturers should consider incident response plans that address the possibility of degraded operation and efficient restoration and recovery.

For health care facilities: The FDA is recommending that you take steps to evaluate your network security and protect your hospital system. In evaluating network security, hospitals and health care facilities should consider:

  • Restricting unauthorized access to the network and networked medical devices.
  • Making certain appropriate antivirus software and firewalls are up-to-date.
  • Monitoring network activity for unauthorized use.
  • Protecting individual network components through routine and periodic evaluation, including updating security patches and disabling all unnecessary ports and services.
  • Contacting the specific device manufacturer if you think you may have a cybersecurity problem related to a medical device. If you are unable to determine the manufacturer or cannot contact the manufacturer, the FDA and DHS ICS-CERT may be able to assist in vulnerability reporting and resolution.
  • Developing and evaluating strategies to maintain critical functionality during adverse conditions.

ICS-CERT reminds health care facilities to perform proper impact analysis and risk assessment prior to taking defensive and protective measures.

ICS-CERT also provides a recommended practices section for control systems on the US-CERT Web site. Several recommended practices are available for reading or download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.a Although medical devices are not industrial control systems, many of the recommendations from these documents are applicable.

Organizations that observe any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT and FDA for tracking and correlation against other incidents.

The FDA has also announced a safety communications that highlights the points made in this alert. For additional information see: http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm356423.htm

Source:  US-CERT

Tags: ,
Posted in Cellular, Electronics, Hardware, Mobile, Network, Privacy, Security, Software, Wireless | No Comments »

Espionage malware infects raft of governments, industries around the world

Friday, June 7th, 2013

http://cdn.arstechnica.net/wp-content/uploads/2013/06/nettraveler_02.1-640x452.png

“NetTraveler” stole data on space exploration, nanotechnology, energy, and more.

Security researchers have blown the whistle on a computer-espionage campaign that over the past eight years has successfully compromised more than 350 high-profile targets in 40 countries.

“NetTraveler,” named after a string included in an early version of the malware, has targeted a number of industries and organizations, according to a blog post published Tuesday by researchers from antivirus provider Kaspersky Lab. Targets include oil industry companies, scientific research centers and institutes, universities, private companies, governments and governmental institutions, embassies, military contractors, and Tibetan/Uyghur activists. Most recently the group behind NetTraveler has focused most of its efforts on obtaining data concerning space exploration, nanotechnology, energy production, nuclear power, lasers, medicine, and communications.

“Based on collected intelligence, we estimate the group size to be about 50 individuals, most of which speak Chinese natively and have working knowledge of the English language,” the researchers wrote. “NetTraveler is designed to steal sensitive data as well as log keystrokes and retrieve file system listings and various Office and PDF documents.”

The highest number of infections were found in Mongolia, followed by India and Russia. Other countries with infections include Kazakhstan, Kyrgyzstan, Tajikistan, South Korea, Spain, Germany, the United States, Canada, the United Kingdom, Chile, Morocco, Greece, Belgium, Austria, Ukraine, Lithuania, Belarus, Australia, Hong Kong, Japan, China, Iran, Turkey, Pakistan, Thailand, Qatar, and Jordan. The earliest known samples of the malware are dated to 2005, but there are references that indicate it existed as early as 2004, Kaspersky said. The largest number of observed samples were created from 2010 to 2013.

Six of the NetTraveler victims were also compromised by Red October, the much larger espionage campaign that went undetected for five years. With more than 1,000 distinct modules, the operators were able to craft highly advanced infections that were tailored to the unique configurations of infected machines and the profiles of those who used them.

For a much deeper dive into NetTraveler, see the full Kaspersky report.

Source:  arstechnica.com

Tags: ,
Posted in Anti-Virus, Privacy, Security, Web | No Comments »

Largest ever DDoS attack directed at financial firm, Prolexic reports

Tuesday, June 4th, 2013

DDoS attackers attempted to bring down an unnamed financial services firm earlier this week using one of the largest traffic bombardments ever recorded, mitigation firm Prolexic has reported.

The 167 Gbps peak attack hit what is being described only as a “realtime financial exchange” on 27 May using the same DNS reflection method used to strike anti-spam organisation Spamhaus in late March, the company said.

Although smaller than the Spamhaus assault, it still registered as the largest ever defended by Prolexic in its 10-year history, which must on its own make it one of the largest ever recorded.

Despite its size, Prolexic had been able to distribute the traffic across four sites in Hong Kong, San Jose, Ashburn in Virgina, and London, with the latter bearing the greatest burden at a peak of 90Gbps.

“This was a massive attack that made up in brute force what it lacked in sophistication,” commented Prolexic’s CEO, Scott Hammack.

“Because of the proactive DDoS defense strategies Prolexic had put in place with this client, no malicious traffic reached its website and downtime was avoided. In fact, the company wasn’t aware it was under attack.”

The fact that the attacked business was a customer of Prolexic is one important difference between the incident and what happened to Spamhaus.

When Spamhaus was assaulted by a vast 300Gbps peak DNS reflection attack, it engaged the help of a content delivery network (CDN) called CloudFlare to help defend itself. The attackers then turned their fire on the Tier-1 providers used by CloudFlare in an attempt to cause maximum harm.

The attackers picking on the financial services firm would have known that Prolexic’s mitigation stood between themselves and the target from the start, raising the possibility that they were testing the ability of this sort of attack to overload dedicated defenses.

“It’s only a matter of time, possibly by the end of this quarter, before the 200Gbps marker is crossed,” predicted Hammack.

The firm was investing in the infrastructure necessary to cope with up to 1.2Tbps peak traffic loads by the end of 2013, he added.

DNS reflection (or amplification) attacks have become a new front in DDoS tactics in recent times despite being widely discussed for years. One possibility is that they are partly a reaction to the growth of DDoS mitigation firms and the desire of attackers to boost the size of their activity using open responders.

As EU security agency ENISA pointed out after the Spamhaus incident, the vulnerabilites exploited by the attackers were addressed by IETF best practice recomendations as far back as the year 2000.

Source:  networkworld.com

Tags: ,
Posted in Cloud, Security, Web | No Comments »

Oracle vows better Java security

Tuesday, June 4th, 2013

In light of recent vulnerabilities found in Java and ongoing concerns about the technology’s overall security, Oracle has promised—again—that it will fix the problems.

Oracle has already made some changes to Java and is working on new initiatives to improve security, Nandini Ramani, head of Java development at Oracle, wrote in a blog post on Friday. After a series of high-profile Web-based attacks targeted employees across various industries, Oracle pledged to address the underlying issues in the cross-platform environment.

Two of the changes outlined in Ramani’s post, including updates to the applet security model and the Java plugin’s default behavior, are already live. Others changes, such as how Java applications handle revoked certificates, implementing local security policies to create custom rules, and restricting libraries available to server-side applications, are currently in development. Ramani did not indicate when these updates would be available.

What About the Sandbox?
“Taken as a whole, this is good thing for Java, but these changes don’t solve the underlying problem with the Java sandbox itself,” HD Moore, chief research officer of Rapid7 and creator of the Metasploit penetration testing framework, said in an email to SecurityWatch.

The Java sandbox is a protected area where applications are executed, separate from the underlying system. The sandbox is supposed to catch malicious executables before they can take over the machine or hijack running processes. However, attackers have successfully exploited several vulnerabilities to bypass the Java sandbox.

“Until Oracle implements process-level sandboxing, such as that used by Adobe Reader and Google Chrome, a malicious applet with a valid signature can still abuse JRE security flaws to escape the sandbox and compromise the system,” Moore said.

The Changes So Far
Oracle updated the security model recently so users can run signed applets without granting additional privileges and block unsigned applets from running. This means just signing an applet no longer automatically gives the program the ability to break out of the sandbox.

“This is a good thing for security,” Moore said.

Another good thing is the fact the default plug-in security settings now prevent unsigned or self-signed applets from executing. The change now makes it possible to whitelist specific Web sites and centrally manage Java security policies in the enterprise, Moore noted.

And Coming Soon…
Currently, Java supports both Certificate Revocation Lists (CRL) and Online Certificate Status Protocol (OCSP) to verify whether a signed certificate is still valid. However, since the check is not performed by default, even if a certificate had been revoked, attackers would be able to keep using that bad certificatie. Oracle is planning an update which would enable checking by default.

The forthcoming Local Security Policy gives administrators additional control over policy settings, such as letting system administrators define which computers to run Java applets and which computers can’t.

Even though all of Java’s recent trials affected the applets running in the Web browser, Oracle is also exploring ways to make sure server-side applications remain secure, Ramani said. One change would be removing certain libraries that are not needed on server-side to reduce the attack surface.

New Schedule for Updates
Oracle is also going to update Java a bit more frequently. At the moment, Java is updated three times a year, following a separate update schedule from all other Oracle products. The quarterly Critical Patch Update will begin including Java fixes in October, Ramani said. Oracle will still release emergency updates, “out of band,” when necessary.

Considering that CPU is already a time-intensive effort for administrators, adding Java to the mix just makes for an even more gargantuan update. On the other hand, it means administrators don’t have to remember Java’s separate update schedule.

Source:  pcworld.com

Tags:
Posted in Security, Software | No Comments »

Malware that drains your bank account thriving on Facebook

Monday, June 3rd, 2013

In case you needed further evidence that the White Hats are losing the war on cybercrime, a six-year-old so-called Trojan horse program that drains bank accounts is alive and well on Facebook.

Zeus is a particularly nasty Trojan horse that has infected millions of computers, most of them in the United States. Once Zeus has compromised a computer, it stays dormant until a victim logs into a bank site, and then it steals the victim’s passwords and drains the victim’s accounts. In some cases, it can even replace a bank’s Web site with its own page, in order to get even more information– such as a Social Security number– that can be sold on the black market.

The Trojan, which was first detected in 2007, is only getting more active. According to researchers at the security firm Trend Micro, incidents of Zeus have risen steadily this year and peaked in May. Eric Feinberg, founder of the advocacy group Fans Against Kounterfeit Enterprise (FAKE), has noticed an uptick in Zeus-serving malicious links on popular N.F.L. Facebook fan pages such as one created by a group called “Bring the N.F.L. To Los Angeles.”

Mr. Feinberg said he had noticed an increase in such pages and malicious links in recent weeks. He sent those links to Malloy Labs, a security lab, which confirmed that the links on these pages were serving up Zeus malware. The malware was being hosted from computers known to be controlled by a Russian criminal gang known as the Russian Business Network, which has been linked to various online criminal activities, ranging from malware and identity theft to child pornography.

Mr. Feinberg said he has tried to alert Facebook to the problem, with increased urgency, but wasn’t satisfied with their response. A Facebook spokesman directed this reporter to a previous Facebook statement reminding users that it actively scans for malware and offering users the opportunity to enroll in self-remediation procedures such as a “Scan-And-Repair malware scan” that can scan for and remove malware from their devices.

Mr. Feinberg said that after-the-fact approach was hardly sufficient. “If you really want to hack someone, the easiest place to start is a fake Facebook profile– it’s so simple, it’s stupid.”

“They’re not listening,” Mr. Feinberg added. “We need oversight on this.”

Source:  nytimes.com

Tags: , ,
Posted in Anti-Virus, Privacy, Security, Web | No Comments »

Microsoft plugs security systems into its worldwide cloud

Thursday, May 30th, 2013

In a move designed to starve botnets where they live, Microsoft launched a program on Tuesday to plug its security intelligence systems into its global cloud, Azure.

The new offering, known as the Cyber Threat Intelligence Program, or C-TIP, will enable ISPs and CERTs to receive information on infected computers on their systems in near-real time, Microsoft said.

“All too often, computer owners, especially those who may not be using up-to-date, legitimate software and anti-malware protection, unwittingly fall victim to cybercriminals using malicious software to secretly enlist their computers into an army of infected computers known as a botnet, which can then be used by cybercriminals for a wide variety of attacks online,” Microsoft explained in a blog post.

Microsoft has been a leader in the industry in taking down botnets. Its victims include zombie armies enlisted with malware such as Conficker, Waledac, Rustock, Kelihos, Zeus, Nitol and Bamital.

Once a network is taken down, though, its minions must be sanitized. That’s what ISPs and CERTs do with the information they receive from Project MARS (Microsoft Active Response for Security), which is now plugged into Azure.

“While our clean-up efforts to date have been quite successful, this expedited form of information sharing should dramatically increase our ability to clean computers and help us keep up with the fast-paced and ever-changing cybercrime landscape,” Microsoft noted.

“It also gives us another advantage: cybercriminals rely on infected computers to exponentially leverage their ability to commit their crimes, but if we’re able to take those resources away from them, they’ll have to spend time and money trying to find new victims, thereby making these criminal enterprises less lucrative and appealing in the first place,” it added.

Following a botnet takedown, its zombies must be purged in a “remediation phase” of the operation. “The remediation phase is designed to clean up the systems that are infected after the command and control infrastructure is taken over,” said Jeff Williams, director of security strategy at Dell Secureworks

“To leave the infected systems would allow criminals to use the existing malware to create a new botnet,” he told CSO. “It’s a critical component of takedown work to remediate the infected systems.”

In addition to allowing Microsoft to feed remediation information to ISPs and CERTs quickly, Azure allows Microsoft to scale up its botnet busting efforts without a hiccup.

Currently, Microsoft manages hundreds of millions of events a day with its security intelligence systems. It foresees that number climbing into the ten to hundreds of billions in the future, noted T.J. Campana, director of the Microsoft Cybercrime Center.

Now the only data Microsoft is putting into its intelligence systems is MARS program data. “As we increase the number of takedowns we do per year, the size of the attacks and work with more partners around the world, we’ll be processing a much larger set of IP addresses and events per day,” Campana said.

Azure allows Microsoft to accommodate that expansion. “The ability to have that kind of elasticity dynamically through Azure has been a huge advantage to us,” he added.

For one security analyst, the move to Azure was long overdue. “It’s something Microsoft should be proactive about because it has millions of endpoints from which to collect this information,” Gartner security analyst Avivah Litan told CSO.

“This is long overdue,” she added. “They should have done something like this a couple of  years ago.”

Source:  networkworld.com

Tags: , ,
Posted in Cloud, Microsoft, Network, Privacy, Security, Server, Web | No Comments »

University fined $400,000 after disabled firewall put medical records at risk

Thursday, May 30th, 2013

A medical facility run by Idaho State University (ISU) has been fined $400,000 after thousands of patient records were left in an unprotected state when firewall monitoring was disabled.

According to the medical information commissioner, the US Department of Health Human Services (HHS), the records of 17,500 patients at the University’s 29 Pocatello Family Medicine Clinics were left unsecured for 10 months.

About half a dozen of the organisation’s clinics were subject to Health Insurance Portability and Accountability Act (HIPAA) rules, including the clinic at which the issue occurred, making it a notifiable incident.

The exact nature of the firewall issue was not specified in the HHS ruling but it mentioned more general problems with procedures dating back as far as 1 April 2007, some years before the breach was noticed in 2011.

The ISU had failed to carry out risk assessments on the sensitive data it held, the HHS said. It seems to have been the lack of systems within the organisation as a whole that compounded the breach on one site.

“Risk analysis, ongoing risk management, and routine information system reviews are the cornerstones of an effective HIPAA security compliance program,” said Leon Rodriguez of the HHS Office for Civil Rights (OCR).

“Proper security measures and policies help mitigate potential risk to patient information,” he said.

Source:  networkworld.com

Tags: ,
Posted in Privacy, Security, Web | No Comments »

Important security update: Reset your Drupal.org password

Thursday, May 30th, 2013

The Drupal.org Security Team and Infrastructure Team has discovered unauthorized access to account information on Drupal.org and groups.drupal.org.

This access was accomplished via third-party software installed on the Drupal.org server infrastructure, and was not the result of a vulnerability within Drupal itself. This notice applies specifically to user account data stored on Drupal.org and groups.drupal.org, and not to sites running Drupal generally.

Information exposed includes usernames, email addresses, and country information, as well as hashed passwords. However, we are still investigating the incident and may learn about other types of information compromised, in which case we will notify you accordingly. As a precautionary measure, we’ve reset all Drupal.org account holder passwords and are requiring users to reset their passwords at their next login attempt. A user password can be changed at any time by taking the following steps.

  1. Go to https://drupal.org/user/password
  2. Enter your username or email address.
  3. Check your email and follow the link to enter a new password.
    • It can take up to 15 minutes for the password reset email to arrive. If you do not receive the e-mail within 15 minutes, make sure to check your spam folder as well.

All Drupal.org passwords are both hashed and salted, although some older passwords on some subsites were not salted.

See below recommendations on additional measure that you can take to protect your personal information.

What happened?

Unauthorized access was made via third-party software installed on the Drupal.org server infrastructure, and was not the result of a vulnerability within Drupal itself. We have worked with the vendor to confirm it is a known vulnerability and has been publicly disclosed. We are still investigating and will share more detail when it is appropriate. Upon discovering the files during a security audit, we shut down the association.drupal.org website to mitigate any possible ongoing security issues related to the files. The Drupal Security Team then began forensic evaluations and discovered that user account information had been accessed via this vulnerability.

The suspicious files may have exposed profile information like username, email address, hashed password, and country. In addition to resetting your password on Drupal.org, we are also recommending a number of measures (below) for further protection of your information, including, among others, changing or resetting passwords on other sites where you may use similar passwords.

What are we doing about it?

We take security very seriously on Drupal.org. As attacks on high-profile sites (regardless of the software they are running) are common, we strive to continuously improve the security of all Drupal.org sites.

To that end, we have taken the following steps to secure the Drupal.org infrastructure:

  • Staff at the OSU Open Source Lab (where Drupal.org is hosted) and the Drupal.org infrastructure teams rebuilt production, staging, and development webheads and GRSEC secure kernels were added to most servers
  • We are scanning and have not found any additional malicious or dangerous files and we are making scanning a routine job in our process
  • There are many subsites on Drupal.org including older sites for specific events. We created static archives of those sites.

We would also like to acknowledge that we are conducting an investigation into the incident, and we may not be able to immediately answer all of the questions you may have. However, we are committed to transparency and will report to the community once we have an investigation report.

If you find that any reason to believe that your information has been accessed by someone other than yourself, please contact the Drupal Association immediately by sending an email to password@association.drupal.org. We regret this occurred and want to assure you we are working hard to improve security.

Excerpt from:  drupal.org

Tags:
Posted in Privacy, Programming, Security, Web | No Comments »

Microsoft warns of new Trojan hijacking Facebook accounts

Tuesday, May 14th, 2013

Malware focusing on the social network’s users in Brazil masquerades as a legitimate Google Chrome extension and Firefox add-on.

Microsoft has issued a warning that a new piece of malware masquerading as a Google Chrome extension and Firefox add-on is making the rounds, threatening to hijack Facebook accounts

First detected in Brazil, Trojan:JS/Febipos.A attempts to keep itself updated, just like normal, legitimate browser extensions, Microsoft noted in a security bulletin late Friday.

Once downloaded, the Trojan monitors whether the infected computer is logged into a Facebook account and attempts to download a config file that will includes a list of commands for the browser extension. The malware can then perform a variety of Facebook actions, including liking a page, sharing, posting, joining a group, and chatting with the account holder’s friends.

Some variants of the malware include commands to post provocative messages written in Portuguese that contain links to other Facebook pages. The number of likes and shares on one such page grew while malware experts at Microsoft were analyzing the Trojan, suggesting that the infections are continuing to occur.

Microsoft did not indicate how the malware installs itself or how many infections might have occurred.

There may be more to this threat because it can change its messages, URLs, Facebook pages and other activity at any time. In any case, we recommend you always keep your security products updated with the latest definitions to help avoid infection.

So while the malware appears to be designed to target users in Brazil — where Portuguese is the dominant language — Microsoft concluded that the Trojan could easily be modified to target users in other regions.

Source:  CNET

Tags:
Posted in Microsoft, Security, Web | No Comments »

Los Alamos National Lab has had quantum-encrypted internet for over two years

Monday, May 6th, 2013

Nothing locks down data better than a laser-based quantum-encrypted network, where the mere act of looking at your data causes it to irrevocably change. Although such systems already exist, they’re limited to point-to-point data transfers since a router would kill the message it’s trying to pass along just by reading it. However, Los Alamos National Labs has been testing an in-house quantum network, complete with a hub and spoke system that gets around the problem thanks to a type of quantum router at each node. Messages are converted at those junctures to conventional bits, then reconverted into a new encrypted message, which can be securely sent to the next node, and so on.

The researchers say it’s been running in the lab for the last two and a half years with few issues, though there’s still a security hole — it lacks quantum integrity at the central hub where the data’s reconverted, unlike a pure quantum network. However, the hardware would be relatively simple to integrate into any fiber-connected device, like a TV set-top box, and is still more secure than any current system — and infinitely better than the 8-character WiFi code you’re using now.

Source:  engadget

Tags:
Posted in Network, Security, Server | No Comments »

Internet Explorer zero-day exploit targets nuclear weapons researchers

Monday, May 6th, 2013

“Watering hole” attack targets workers browsing federal government website.

Attackers exploited a previously unknown and currently unpatched security bug in Microsoft’s Internet Explorer browser to surreptitiously install malware on the computers of federal government workers involved in nuclear weapons research, researchers said Friday.

The attack code appears to have exploited a zero-day vulnerability in IE version 8 when running on Windows XP, researchers from security firm Invincea said in a blog post. The researchers have received reports that IE running on Windows 7 is susceptible to the same exploit but have not been able to independently confirm that. Versions 6 and 7 of the Microsoft browser don’t appear to be vulnerable.

Update: In an advisory published a couple hours after this article went live, Microsoft confirmed a code-execution vulnerability in IE8. Versions 6, 7, 9, and 10 of the browser are immune to the exploit. People using IE8 should upgrade to versions 9 or 10, if at all possible. Those who are unable to move away from version 8 should take the following mitigations:

  • Set Internet and local intranet security zone settings to “High” to block ActiveX Controls and Active Scripting in these zones
    This will help prevent exploitation but may affect usability; therefore, trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.
  • Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and local intranet security zones
    This will help prevent exploitation but can affect usability, so trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.

The attack was triggered by a US Department of Labor website that was compromised to redirect visitors to a series of intermediary addresses that ultimately exploited the vulnerability, according to Invincea. The exploit caused vulnerable Windows machines to be compromised by “Poison Ivy,” a notorious backdoor trojan that had been modified so it was detected by only two of 46 major antivirus programs in the hours immediately following the attack. The specific webpages that were hacked dealt with illnesses suffered by employees and contractors developing atomic weapons for the Department of Energy, the blog post said, citing this report from NextGov. That’s consistent with so-called “watering hole” attacks, in which employees of a targeted organization are infected by planting malware on the sites they’re known to frequent.

“The target of this attack appears to be employees of the Dept of Energy that likely work in nuclear weapons research,” Invincea researchers wrote in a separate report published Wednesday. The report went on to cite this technical analysis from security firm AlienVault. It found indicators in the command servers Poison Ivy contacted that the attack was carried out by “DeepPanda,” a group of hackers believed to be located in China and carry out espionage attacks on other countries.

Initial reports about the Department of Labor website compromise said an older IE vulnerability that Microsoft patched in January had been exploited. It was only in Friday’s report that Invincea said this assessment is incorrect.

“For non-Invincea users, there are no known mitigations for this exploit that is currently in the wild,” Friday’s report warned. “For users of IE8, there is no patch currently available and with this exploit being out in the wild, the potential risk for damage is high.”

Source:  arstechnica.com

Tags: ,
Posted in Microsoft, Security, Web | No Comments »

Alaska phishing pupils take over classroom computers

Friday, May 3rd, 2013

A group of pupils at a middle school in Alaska took control of their classroom computers after phishing for administrator privileges.

They asked teachers at Schoenbar Middle School, for 12 to 13-year-olds, to enter admin names and passwords to accept a false software update, according to reports.

The pupils used those details to access and control classmates’ PCs.

Classmates then complained that their computers were not responding normally.

Associated Press said that at least 18 pupils were involved in the phishing, which gave them control over 300 computers allocated for student use at the school in the Alaskan town of Ketchikan.

Those computers have now been seized.

“I don’t believe any hardware issues were compromised,” Casey Robinson, the principal, told community radio station Ketchikan FM.

He said: “No software issues were compromised. I don’t think there was any personal information compromised. Now that we have all the machines back in our control, nothing new can happen.”

Mr Robinson added there would be a review of the way that devices are maintained.

“How we do business is definitely going to have to change when it comes to updating programs and resources that we have on the machines,” Mr Robinson said.

“Yes, something new is going to have to happen.”

Source:  BBC

Tags:
Posted in Network, Privacy, Security, Software | No Comments »

Systems manager arrested for hacking former employer’s network

Friday, May 3rd, 2013

He allegedly caused over US$90,000 in damages, the FBI said

A 41-year-old systems manager was arrested for allegedly disrupting his former employer’s network after he was passed over for promotions, leading him to quit his job and take revenge, the FBI said.

Michael Meneses of Smithtown, N.Y., who worked for a company that manufactures high-voltage power supplies, allegedly caused the company more than $90,000 in damages, the FBI New York Field Office said Thursday.

Meneses was employed at the company until January 2012, where he specialized in developing and customizing software the company used to run its business operations, according to the FBI. He was one of two employees responsible for ensuring that the software ran smoothly in order to keep production planning, purchasing and inventory control operating efficiently, it said. This role gave Meneses high-level access to the company’s network, the FBI added.

After being passed over for promotions, he allegedly expressed his displeasure and resigned in December 2011, the FBI said. His network access was terminated, but Meneses allegedly found a way to launch a three-week campaign to cause damage to his former employer after getting unauthorized access to the network, the FBI added.

He allegedly hacked into the company’s network, stole former co-workers security credentials, including by writing a program to capture log-in names and passwords, according to the FBI. The information was then used to remotely access the company’s network using a virtual private network to corrupt the company’s network from Meneses’ home and from a hotel close to his new employer, the FBI said.

“Meneses’ efforts ranged from using a former colleague’s e-mail account to discourage new applicants from taking Meneses’ position, to sending commands to alter the business calendar by one month, disrupting the company’s production and finance operations,” the FBI said.

As the complaint alleges, the defendant “engaged in a 21st Century campaign of cyber-vandalism and high-tech revenge,” Loretta E. Lynch, U.S. attorney for the Eastern District of New York, stated in the release.

Meneses appeared in the U.S. District Court, Eastern District of New York in Central Islip, Long Island on Thursday where he denied the allegations and was released on a $50,000 bond, according to a New York Times report. The affected company was referred to in the report as Spellman High Voltage Electronics Corporation.

If convicted, Meneses faces a statutory maximum sentence of 10 years in prison, a $250,000 fine, and restitution, the FBI said.

Source:  computerworld.com

Posted in Network, Privacy, Security, Software | No Comments »

Open IP ports let anyone track ships on Internet

Tuesday, April 30th, 2013

In 12hrs, researchers log more than 2GB of data on ships due to automatic ID systems.

While digging through the data unearthed in an unprecedented census of nearly the entire Internet, Researchers at Rapid7 Labs have discovered a lot of things they didn’t expect to find openly responding to port scans. One of the biggest surprises they discovered was the availability of data that allowed them to track the movements of more than 34,000 ships at sea. The data can pinpoint ships down to their precise geographic location through Automated Identification System receivers connected to the Internet.

The AIS receivers, many of them connected directly to the Internet via serial port servers, are carried aboard ships, buoys, and other navigation markers. The devices are installed at Coast Guard and other maritime facilities ashore to prevent collisions at sea within coastal waters and to let agencies to track the comings and goings of international shipping. Rapid7 security researcher Claudio Guarnieri wrote in a blog post on Rapid7′s Security Street community site that he, Rapid7 Chief Research Officer H.D. Moore, and fellow researcher Mark Schloesser discovered about 160 AIS receivers still active and responding over the Internet. In 12 hours, the trio was able to log more than two gigabytes of data on ships’ positions—including military and law enforcement vessels.

For many of the ships, the vessel’s name was included in the broadcast data pulled from the receivers. For others, the identification numbers broadcast by their beacons are easily found on the Internet. By sifting through the data, the researchers were able to plot the location of individual ships. “Considering that a lot of military, law enforcement, cargoes, and passenger ships do broadcast their positions, we feel that this is a security risk,” Guarnieri wrote.

Among the other information found in the AIS data were “safety messages,” text messages sent between ships and navigation stations to inform each other of hazards. Some of the messages were actually the equivalent of casual texts to arriving ships’ masters: “MOINMOIN GREETINGS TO YOUR CPT.”

Source:  arstechnica.com

Tags:
Posted in Electronics, Privacy, Security, Server, Web | No Comments »

Attack hitting Apache websites is invisible to the naked eye

Monday, April 29th, 2013

Newly discovered Linux/Cdorked evades detection by running in shared memory.

Ongoing exploits infecting tens of thousands of reputable sites running the Apache Web server have only grown more powerful and stealthy since Ars first reported on them four weeks ago. Researchers have now documented highly sophisticated features that make these exploits invisible without the use of special forensic detection methods.

Linux/Cdorked.A, as the backdoor has been dubbed, turns Apache-run websites into platforms that surreptitiously expose visitors to powerful malware attacks. According to a blog post published Friday by researchers from antivirus provider Eset, virtually all traces of the backdoor are stored in the shared memory of an infected server, making it extremely hard for administrators to know their machine has been hacked. This gives attackers a new and stealthy launchpad for client-side attacks included in Blackhole, a popular toolkit in the underground that exploits security bugs in Oracle’s Java, Adobe’s Flash and Reader, and dozens of other programs used by end users. There may be no way for typical server admins to know they’re infected.

“Unless a person really has some deep-dive knowledge on the incident response team, the first thing they’re going to do is kill the evidence,” Cameron Camp, a security researcher at Eset North America, told Ars. “If you run a large hosting company you’re not going to send a guy in who’s going to do memory dumps, you’re going to go on their with your standard tool sets and destroy the evidence.”

Linux/Cdorked.A leaves no traces of compromised hosts on the hard drive other than its modified HTTP daemon binary. Its configuration is delivered by the attacker through obfuscated HTTP commands that aren’t logged by normal Apache systems. All attacker-controlled data is encrypted. Those measures make it all but impossible for administrators to know anything is amiss unless they employ special methods to peer deep inside an infected machine. The backdoor analyzed by Eset was programmed to receive 70 different encrypted commands, a number that could give attackers fairly granular control. Attackers can invoke the commands by manipulating the URLs sent to an infected website.

“The thing is receiving commands,” Camp said. “That means that suddenly you have a new vector that is difficult to detect but is receiving commands. Blackhole is a tricky piece of malware anyway. Now suddenly you have a slick delivery method.”

In addition to hiding evidence in memory, the backdoor is programmed to mask its malicious behavior in other ways. End users who request addresses that contain “adm,” “webmaster,” “support,” and similar words often used to denote special administrator webpages aren’t exposed to the client exploits. Also, to make detection harder, users who have previously been attacked are not exposed in the future.

It remains unclear what the precise relationship is between Linux/Cdorked.A and Darkleech, the Apache plug-in module conservatively estimated to have hijacked at least 20,000 sites. It’s possible they’re the same module, different versions of the same module, or different modules that both expose end users to Blackhole exploits. It also remains unclear exactly how legitimate websites are coming under the spell of the malicious plugins. While researchers from Sucuri speculate it takes hold after attackers brute-force the secure-shell access used by administrators, a researcher from Cisco Systems said he found evidence that vulnerable configurations of the Plesk control panel are being exploited to spread Darkleech. Other researchers who have investigated the ongoing attack in the past six months include AV provider Sophos and those from the Malware Must Die blog.

The malicious Apache modules are proving difficult to disinfect. Many of the modules take control of the secure shell mechanism that legitimate administrators use to make technical changes and update content to a site. That means attackers often regain control of machines that are only partially disinfected. The larger problem, of course, is that the highly sophisticated behavior of the infections makes them extremely hard to detect.

Eset researchers have released a tool that can be used by administrators who suspect their machine is infected with Linux/Cdorked.A. The free python script examines the shared memory of a sever running Apache and looks for commands issued by the stealthy backdoor. Eset’s cloud-based Livegrid system has already detected hundreds of servers that are infected. Because Livegrid works only with a small percentage of machines on the Internet, the number of compromised Apache servers is presumed to be much higher.

Source:  arstechnica.com

Tags: ,
Posted in Anti-Virus, Linux, Security, Server, Web | No Comments »

Spamhaus hacking suspect ‘had mobile attack van’

Monday, April 29th, 2013

A Dutchman accused of mounting one of the biggest attacks on the internet used a “mobile computing office” in the back of a van.

The 35-year-old, identified by police as “SK”, was arrested last week.

He has been blamed for being behind “unprecedentedly serious attacks” on non-profit anti-spam watchdog Spamhaus.

Dutch, German, British and US police forces took part in the investigation leading to the arrest, Spanish authorities said.

The Spanish interior minister said SK was able to carry out network attacks from the back of a van that had been “equipped with various antennas to scan frequencies”.

He was apprehended in the city of Granollers, 20 miles (35km) north of Barcelona. It is expected that he will be extradited from Spain to be tried in the Netherlands.

‘Robust web hosting’

Police said that upon his arrest SK told them he belonged to the “Telecommunications and Foreign Affairs Ministry of the Republic of Cyberbunker”.

Cyberbunker is a company that says it offers highly secure and robust web hosting for any material except child pornography or terrorism-related activity.

Spamhaus is an organisation based in London and Geneva that aims to help email providers filter out spam and other unwanted content.

To do this, the group maintains a number of blocklists, a database of servers known to be being used for malicious purposes.

Police alleged that SK co-ordinated an attack on Spamhaus in protest over its decision to add servers maintained by Cyberbunker to a spam blacklist.

Overwhelm server

Spanish police were alerted in March to large distributed-denial-of-service (DDoS) attacks originating in Spain but affecting servers in the UK, Netherlands and US.

DDoS attacks attempt to overwhelm a web server by sending it many more requests for data than it can handle.

A typical DDoS attack employs about 50 gigabits of data per second (Gbps). At its peak the attack on Spamhaus hit 300Gbps.

In a statement in March, Cyberbunker “spokesman” Sven Kamphuis took exception to Spamhaus’s action, saying in messages sent to the press that it had no right to decide “what goes and does not go on the internet”.

Source:  BBC

Tags: ,
Posted in Database, E-Mail, Security, Server, Web | No Comments »

Cyberwar risks clamity, Eugene Kaspersky warns UK Government and spooks

Monday, April 29th, 2013

State-of-the-art cyberweapons are now powerful enough to severely disrupt nations and the organisations responsible for their critical infrastructure, Kaspersky Lab founder and CEO Eugene Kaspersky has warned in a speech to a select audience of UK police, politicians and CSOs.

That Kaspersky was invited to give the speech to such a high-level gathering is a clear signal that the message accords with the Government and UK security establishment’s view of the threat posed by cyber-weapons.

“Today, sophisticated malicious programs – cyberweapons – have the power to disable companies, cripple governments and bring whole nations to their knees by attacking critical infrastructure in sectors such as communications, finance, transportation and utilities. The consequences for human populations could, as a result, be literally catastrophic,” said Kaspersky.

As an illustration of his point, the number of malware samples analysed by Kaspersky Lab had risen from 700 per day in 2006 to 7,000 per day by 2011. Today the number including polymorphic variants had reached 200,000 each day, enough to overwhelm the defences of even well-defended firms.

The sophistication of threats had also risen dramatically since 2010 with the discovery of state-sponsored threats such as Red October, Flame, MiniFlame, Gauss, Stuxnet, Duqu, Shamoon and Wiper, some of which had been uncovered by Kaspersky Lab itself..

Countering this would be impossible as long as organisations tackled the problem one by one, each in isolation from others. Intelligence sharing was no longer a luxury and had become essential.

This would require intimate cooperation between the private sector and government bodies, he said. The heads of organisations had to internalise this as a new reality.

“But why should state intelligence and defence bother cooperating with the private sector? In the words of Francis Maude, UK Minister of the Cabinet Office, ‘We need to team up to fight common enemies but the key to cooperating, in a spirit of openness and sharing, are guarantees to maintain the confidentiality of data shared,” said Kaspersky.

Audience members included, City of London Police Commissioner Adrian Leppard, National Fraud Authority head Stephen Harrison, former Counter Terrorism and Security Minister Pauline Neville Jones, Minister for Crime and Security James Brokenshire, and CSOs from HSBC, Unilever, Vodafone and Barclays.

Although best known as a celebrity icon of the company that bears his name, Kaspersky has in recent times become vocal on issues of cyber-weapons and their geo-political as well as technical implications.

Although ostensibly preaching the orthodox position that cyber-defence should be a coalition of forces, his words contain nuances, warnings about the dangers of state-sponsored cyber-weapons, including those from the UK and its allies.

Most of the most advanced cyber-weapons uncovered by Kaspersky’s company are suspected of being created by the US, the early-adopter of such offensive capabilities. His point seems to be that the US and its allies will find themselves on the receiving end of the same if international standards of cyber-etiquette are not established.

Earlier this year, Interpol announced that Kaspersky Lab would be a key partner in its new Global Complex for Innovation (IGCI) in Singapore cybercrime fighting hub in Singapore, due for completion next year.

Source:  pcadvisor.com

Posted in Anti-Virus, Privacy, Security, Web | No Comments »

Malware found scattered by cyber espionage attacks

Monday, April 29th, 2013

 

Researchers following a cyberespionage campaign apparently bent on stealing drone-related technology secrets have found additional malware related to the targeted attacks.FireEye researchers have been tracking so-called “Operation Beebus” for months, but only last week reported the connection to unmanned aircraft often used in spying. Drones have also been used by the Obama administration to assassinate leaders of the Al-Qaeda terrorist group.

Malware linked to spying

FireEye researcher James Bennett, who was the first to make the drone connection, said last week that he has found two new malware associated with the attack, bringing the total to four.

The first two were versions of the same malware called Mutter. The new malware includes one that uses the same custom encryption scheme, but a different command-and-control protocol. The fourth malware is completely different from Mutter, but uses the same C&C infrastructure.

Bennett has yet to fully analyze the new malware, which he hopes will provide “more threads to follow.”

Operation Beebus is a cyberespionage campaign that FireEye has linked to the infamous Comment Crew, which security firm Mandiant has identified as a secret unit of China’s People Liberation Army. The hacker group attempts to steal information from international companies and foreign governments.

Bennett reported in a blog last week that he had uncovered evidence of cyberattacks against a dozen organizations in the U.S. and India. The attacks against academia, government agencies, and the aerospace, defense and telecommunication industries targeted individuals knowledgeable in drone technology.

The spear-phishing campaign included sending email that contained decoy documents meant to trick recipients into clicking on the file, which would download the malware. One such document was an article about Pakistan’s unmanned aerial vehicle industry written by Aditi Malhotra, an Indian writer and associate fellow at the Centre for Land Warfare Studies in New Delhi.

How it worked

Once downloaded, the Mutter malware opened a backdoor to the infected systems in order to receive instructions from C&C servers and to send stolen information. To avoid detection, Mutter is capable of remaining dormant for long periods of time, so that it will eventually be categorized as benign by malware analysis systems.

Despite the exposure, Operation Beebus is still active, although its infrastructure has changed. All but one of the domain names studied by Bennett is no longer in use, but several IP addresses are still active, probably being used with other domains.

“We are still seeing active communications going out with this Mutter malware, so we do know that it’s still going,” Bennett said.

One in five data breaches are the result of cyberespionage campaigns, according to the latest study by Verizon. More than 95 percent of cases originated from China, with targets showing an almost fifty-fifty split between large and small organizations.

Source:  pcworld.com

 

Tags:
Posted in Anti-Virus, Privacy, Security | No Comments »

Cisco releases security advisories

Friday, April 26th, 2013

Cisco has released three security advisories to address vulnerabilities affecting Cisco NX-OS-based products, Cisco Device Manager, and Cisco Unified Computing System. These vulnerabilities may allow an attacker to bypass authentication controls, execute arbitrary code, obtain sensitive information, or cause a denial-of-service condition.

US-CERT encourages users and administrators to review the following Cisco security advisories and apply any necessary updates to help mitigate the risks.

Source:  US-CERT

Posted in Cisco, Hardware, Network, Privacy, Security | No Comments »

« Older Entries