Quotulatiousness

March 24, 2011

Online security: compromised HTTPS certificates

Filed under: Technology — Tags: , , , — Nicholas @ 09:25

Iranian hackers (or someone trying to cast blame on Iran) managed to get a number of HTTPS certificates issued under false colours:

On March 15th, an HTTPS/TLS Certificate Authority (CA) was tricked into issuing fraudulent certificates that posed a dire risk to Internet security. Based on currently available information, the incident got close to — but was not quite — an Internet-wide security meltdown. As this post will explain, these events show why we urgently need to start reinforcing the system that is currently used to authenticate and identify secure websites and email systems.

[. . .]

Comodo also said that the attack came primarily from Iranian IP addresses, and that one of the fraudulent login.yahoo.com certs was briefly deployed on a webserver in Iran.

March 20, 2011

Hacking a secure WiFi connection not illegal, says Dutch court

Filed under: Europe, Law, Technology — Tags: , , , , — Nicholas @ 11:09

An interesting legal precedent may not be as far-reaching as the headline might imply:

Breaking in to an encrypted router and using the WiFi connection is not an criminal offence, a Dutch court ruled. WiFi hackers can not be prosecuted for breaching router security.

A court in The Hague ruled earlier this month that it is legal to break WiFi security to use the internet connection. The court also decided that piggybacking on open WiFi networks in bars and hotels can not be prosecuted. In many countries both actions are illegal and often can be fined.

[. . .]

The Judge reasoned that the student didn’t gain access to the computer connected to the router, but only used the routers internet connection. Under Dutch law breaking in to a computer is forbidden.

A computer in The Netherlands is defined as a machine that is used for three things: the storage, processing and transmission of data. A router can therefore not be described as a computer because it is only used to transfer or process data and not for storing bits and bytes. Hacking a device that is no computer by law is not illegal, and can not be prosecuted, the court concluded.

The key here is the definition of a computer under the law: I expect the Dutch to update this definition in response to the outcome of this case.

February 19, 2011

When “hacker army” is not an exaggeration

Filed under: Britain, China, Government, Military, Russia, Technology — Tags: , , , , , — Nicholas @ 10:07

Strategy Page counts noses of the various semi-organized hacker armies out in the wild:

Despite spending over a billion dollars a year defending their government networks, Britain recently complained openly of hackers getting into the communications network of the Foreign Office. The government also warned of increasing attacks on British companies. The recent attacks government and corporations were all targeting specific people and data. While China was not mentioned in these official announcements, British officials have often discussed how investigations of recent hacking efforts tended to lead back to China. There is also a strong suspicion, backed up by hacker chatter, that governments are offering large bounties for information from foreign governments. Not information from China, but from everyone else.

China one of many nations taking advantage of the Internet to encourage, or even organize, patriotic Internet users to obtain hacking services. This enables the government to use (often informally) these thousands of hackers to attack targets (foreign or domestic.) These government organizations arrange training and mentoring to improve the skills of group members. Turkey has over 45,000 of hackers organized this way, Saudi Arabia has over 100,000, Iraq has over 40,000, Russia over 100,000 and China, over 400,000. While many of these Cyber Warriors are rank amateurs, even the least skilled can be given simple tasks. And out of their ranks will emerge more skilled hackers, who can do some real damage. These hacker militias have also led to the use of mercenary hacker groups, who will go looking for specific secrets, for a price. Chinese companies are apparently major users of such services, judging from the pattern of recent hacking activity, and the fact that Chinese firms don’t have to fear prosecution for using such methods.

It was China that really pioneered the militia activity. It all began in the late 1990s, when the Chinese Defense Ministry established the “NET Force.” This was initially a research organization, which was to measure China’s vulnerability to attacks via the Internet. Soon this led to examining the vulnerability of other countries, especially the United States, Japan and South Korea (all nations that were heavy Internet users). NET Force has continued to grow. NET Force was soon joined by an irregular civilian militia; the “Red Hackers Union” (RHU). These are nearly half a million patriotic Chinese programmers, Internet engineers and users who wished to assist the motherland, and put the hurt, via the Internet, on those who threaten or insult China. The RHU began spontaneously in 1999 (after the U.S. accidentally bombed the Chinese embassy in Serbia), but the government has assumed some control, without turning the voluntary organization into another bureaucracy. The literal name of the group is “Red Honkers Union,” with Honker meaning “guest” in Chinese. But these were all Internet nerds out to avenge insults to the motherland.

You have to wonder how many script kiddies ever thought they’d end up being government operatives.

February 11, 2011

Human hacking: the overconfident CEO

Filed under: Law, Media, Technology — Tags: , , , — Nicholas @ 07:19

An interesting story at PC World talks about the methods used to get inside information on individuals and companies:

“He was the guy who was never going to fall for this,” said Hadnagy. “He was thinking someone would probably call and ask for his password and he was ready for an approach like that.”

After some information gathering, Hadnagy found the locations of servers, IP addresses, email addresses, phone numbers, physical addresses, mail servers, employee names and titles, and much more. But the real prize of knowledge came when Hadnagy managed to learn the CEO had a family member that had battled cancer, and lived. As a result, he was interested and involved in cancer fundraising and research. Through Facebook, he was also able to get other personal details about the CEO, such as his favorite restaurant and sports team.

Armed with the information, he was ready to strike. He called the CEO and posed as a fundraiser from a cancer charity the CEO had dealt with in the past. He informed him they were offering a prize drawing in exchange for donations — and the prizes included tickets to a game played by his favorite sports team, as well as gift certificates to several restaurants, including his favorite spot.

The CEO bit, and agreed to let Hadnagy send him a PDF with more information on the fund drive. He even managed to get the CEO to tell him which version of Adobe reader he was running because, he told the CEO “I want to make sure I’m sending you a PDF you can read.” Soon after he sent the PDF, the CEO opened it, installing a shell that allowed Hadnagy to access his machine.

When Hadnagy and his partner reported back to the company about their success with breaching the CEO’s computer, the CEO was understandably angry, said Hadnagy.

“He felt it was unfair we used something like that, but this is how the world works,” said Hadnagy. “A malicious hacker would not think twice about using that information against him.”

Takeaway 1: No information, regardless of its personal or emotional nature, is off limits for a social engineer seeking to do harm

Takeaway 2: It is often the person who thinks he is most secure who poses the biggest vulnerability. One security consultant recently told CSO that executives are the easiest social engineering targets.

January 10, 2011

QotD: Geeks and Hackers defined

Filed under: History, Media, Quotations, Technology — Tags: , , , , — Nicholas @ 16:29

One of the interesting things about being a participant-observer anthropologist, as I am, is that you often develop implicit knowledge that doesn’t become explicit until someone challenges you on it. The seed of this post was on a recent comment thread where I was challenged to specify the difference between a geek and a hacker. And I found that I knew the answer. Geeks are consumers of culture; hackers are producers.

Thus, one doesn’t expect a “gaming geek” or a “computer geek” or a “physics geek” to actually produce games or software or original physics — but a “computer hacker” is expected to produce software, or (less commonly) hardware customizations or homebrewing. I cannot attest to the use of the terms “gaming hacker” or “physics hacker”, but I am as certain as of what I had for breakfast that computer hackers would expect a person so labeled to originate games or physics rather than merely being a connoisseur of such things.

[. . .]

All hackers are, almost by definition, geeks — but the reverse is not true.

Eric S. Raymond, “Geeks, hackers, nerds, and crackers: on language boundaries”, Armed and Dangerous, 2011-01-09

December 23, 2010

Some interesting links

Filed under: Food, Randomness — Tags: , , , — Nicholas @ 00:06

A few links to follow at your leisure, as they’re not in any sense time-critical:

December 16, 2010

Bruce Schneier on Security in 2020

Filed under: Economics, Liberty, Technology — Tags: , , , — Nicholas @ 12:48

Aside from all the ugly new terms coined to describe the phenomena, the evolution of security is one of the most under-appreciated stories of the decade. The next decade is going to be even more important to how we live our lives:

There’s really no such thing as security in the abstract. Security can only be defined in relation to something else. You’re secure from something or against something. In the next 10 years, the traditional definition of IT security — ­that it protects you from hackers, criminals, and other bad guys — ­will undergo a radical shift. Instead of protecting you from the bad guys, it will increasingly protect businesses and their business models from you.

Ten years ago, the big conceptual change in IT security was deperimeterization. A wordlike grouping of 18 letters with both a prefix and a suffix, it has to be the ugliest word our industry invented. The concept, though — ­the dissolution of the strict boundaries between the internal and external network — was both real and important.

So, that was then. This is now:

Today, two other conceptual changes matter. The first is consumerization. Another ponderous invented word, it’s the idea that consumers get the cool new gadgets first, and demand to do their work on them. Employees already have their laptops configured just the way they like them, and they don’t want another one just for getting through the corporate VPN. They’re already reading their mail on their BlackBerrys or iPads. They already have a home computer, and it’s cooler than the standard issue IT department machine. Network administrators are increasingly losing control over clients.

This trend will only increase. Consumer devices will become trendier, cheaper, and more integrated; and younger people are already used to using their own stuff on their school networks. It’s a recapitulation of the PC revolution. The centralized computer center concept was shaken by people buying PCs to run VisiCalc; now it’s iPads and Android smart phones.

I’ve certainly noticed this myself: it was forced to my attention a couple of years ago, when a change of employment required me to buy and maintain my own “business” computer and software. Without seriously stressing my wallet, I was able to buy far more capable equipment than my previous employer had provided. Being able to check my email on multiple devices was very important, and once I’d started doing that, I realized the need to do many other things regardless of the machine I happened to be using. There are, of course, trade-offs involved:

The second conceptual change comes from cloud computing: our increasing tendency to store our data elsewhere. Call it decentralization: our email, photos, books, music, and documents are stored somewhere, and accessible to us through our consumer devices. The younger you are, the more you expect to get your digital stuff on the closest screen available. This is an important trend, because it signals the end of the hardware and operating system battles we’ve all lived with. Windows vs. Mac doesn’t matter when all you need is a web browser. Computers become temporary; user backup becomes irrelevant. It’s all out there somewhere — ­and users are increasingly losing control over their data.

Anyway, there’s lots more interesting stuff. Go read the whole thing.

December 13, 2010

The impossible balance of security and utility

Filed under: Military, Technology — Tags: , , , — Nicholas @ 12:35

Strategy Page looks at the mechanic that PFC Bradley Manning is reported to have used to grab copies of all the information now being released by WikiLeaks:

A bit late, the U.S. military has finally forbidden the use of all removable media (thumb drives, read/write DVD and CD drives, diskettes, memory cards and portable hard drives) from SIPRNet. Thumb drives had earlier been banned. The motivation for this latest action was Wikileaks, which obtained hundreds of thousands of secret American military and diplomatic documents from a U.S. soldier (PFC Bradley Manning). As an intel specialist, Manning had a security clearance and access to SIPRNet (Secret Internet Protocol Router Network). This was a private Department of Defense network established in 1991, using Internet technology and able to handle classified (secret) documents. But Manning got access to a computer with a writable CD drive, and was able to copy all those classified documents to a CD (marked as containing Lady Gaga tracks) and walk out of his workplace with it. The big error here was having PCs available with writable media. You need some PCs with these devices, but they should be few, and carefully monitored. Normally, you would not need to copy anything off SIPRNet. Most of the time, if you want to share something, it’s with someone else on SIPRNet, so you can just email it to them, or tell them what it is so they can call it up themselves. A network like SIPRNet usually (in many corporations, and some government agencies) has software that monitors who accesses, and copies, documents, and reports any action that meets certain standards (of possibly being harmful). SIPRNet did not have these controls in place, and still does not on over a third of the PCs connected.

Just like their civilian counterparts, soldiers have been very eager to get and keep connected, both for personal and professional reasons. Data not shared can’t be useful.

For the last decade, the Pentagon has had increasing security problems with its internal Internet networks. The Department of Defense has two private Internets (using Internet technology, but not connected to the public Internet). NIPRNet is unclassified, but not accessible to the public Internet. SIPRNet is classified, and all traffic is encrypted. You can send secret stuff via SIPRNet. However, some computers connected to SIPRNet have been infected with computer viruses. The Pentagon was alarmed at first, because the computers only used SIPRNet. As a result, they did not have any anti-virus software installed. It turned out that worm type hackware was the cause of infection, and was installed when someone used a memory stick or CD, containing the worm, to work and, well, you know the rest.

[. . .]

It’s easy for troops to be doing something on SIPRNET, then switch to the Internet, and forget that they are now on an unsecure network. Warnings about that sort of thing have not cured the problem. The Internet is too useful for the troops, especially for discussing technical and tactical matters with other soldiers. The army has tried to control the problem by monitoring military accounts (those ending in .mil), but the troops quickly got hip to that, and opened another account from Yahoo or Google, for their more casual web surfing, and for discussions with other troops. The Internet has been a major benefit for combat soldiers, enabling them to share first hand information quickly, and accurately. That’s why the troops were warned that the enemy is actively searching for anything G.I.s post, and this stuff has been found at terrorist web sites, and on captured enemy laptops. In reality, information spreads among terrorists much more slowly than among American troops. But if soldiers discuss tactics and techniques in an open venue, including posting pictures and videos, the enemy will eventually find and download it. The terrorists could speed up this process if they could get the right hackware inside American military computers.

May 4, 2010

Spear phishing (test) attack on US Air Force

Filed under: Military, Technology — Tags: , , , , , — Nicholas @ 07:43

I’d heard the term “phishing” before, and I’ve reported at least a dozen various attempts to the appropriate parties (companies and organizations who are used in phishing attempts often have a reporting address set up so you can just forward the message to them). “Spear phishing” was new to me, and apparently it was also new to a large number of US Air Force personnel:

Offers to hire American airmen, stationed at an airbase on the Central Pacific island of Guam, as extras in the Transformers 3 movie, turned out to be an unexpectedly scary training exercise. First, keep in mind that there is no Transformers 3 filming scheduled for Guam. The email was a fake, used to test how well airmen could detect a hacker attempts to deceive military Internet users to give up valuable information.

The Transformers 3 email was a test to see how many airmen would fall for a “spear phishing” offensive. “Phishing” (pronounced “fishing”) is when a hacker sends out thousands, or millions, of emails that look like warnings from banks, eBay or PayPal, asking for you to log in (thus revealing your password to the hackers, who have set up a false website for this purpose) to take care of some administrative matter. The hacker then uses your password to loot your account. “Spear phishing” is when the emails are prepared with specific individuals in mind. The purpose here is to get specific information from, say, a bank manager, or someone known to be working on a secret project. In the Guam case, the targets of the spear phishing test were asked to go to a web site and fill out an application form to be eligible to be an extra. That form asked for information that would have enabled hostile hackers to gain more access to air force networks. A lot of the airmen who received the Transformers 3 email, responded. The air force won’t say how many, but it was more than expected. A lot more.

I doubt that many readers need to be told this, but no legitimate bank or financial institution should ever be sending you an email requesting you to follow an embedded link and log in to your account. If you get such an email, forward it to the bank’s security folks. If it’s legitimate, they can confirm it for you, but in 2010, no sensible bank should be communicating with you in this way.

April 20, 2010

25 years on, the “Hackers” bestride the globe

Filed under: History, Technology — Tags: , , , , — Nicholas @ 07:34

Steven Levy revisits some of the people he profiled in his book Hackers, back in the Pre-Cambrian period of the geek revolution:

“It’s funny in a way”, says Bill Gates, relaxing in an armchair in his office. “When I was young, I didn’t know any old people. When we did the microprocessor revolution, there was nobody old, nobody. It’s weird how old this industry has become.” The Microsoft cofounder and I, a couple of fiftysomething codgers, are following up on an interview I had with a tousle-headed Gates more than a quarter century ago. I was trying to capture what I thought was the red-hot core of the then-burgeoning computer revolution — the scarily obsessive, absurdly brainy, and endlessly inventive people known as hackers. Back then, Gates had just pulled off a deal to supply his DOS operating system to IBM. His name was not yet a household word; even Word was not yet a household word. I would interview Gates many times over the years, but that first conversation was special. I saw his passion for computers as a matter of historic import. Gates himself saw my reverence as an intriguing novelty. But by then I was convinced that I was documenting a movement that would affect everybody.

The book I was writing, Hackers: Heroes of the Computer Revolution, came out just over 25 years ago, in the waning days of 1984. My editor had urged me to be ambitious, and so I shot high, crafting a 450-page narrative in three parts, making the case that hackers — brilliant programmers who discovered worlds of possibility within the coded confines of a computer — were the key players in a sweeping digital transformation.

I hadn’t expected to reach that conclusion. When I embarked on my project, I thought of hackers as little more than an interesting subculture. But as I researched them, I found that their playfulness, as well as their blithe disregard for what others said was impossible, led to the breakthroughs that would define the computing experience for millions of people.

I must have read Hackers during my first or second semester in college, as I tried to figure out how to get out of the series of dead-end jobs I’d had since leaving school. I found strong echoes of many of the characters Levy portrayed in the people I encountered in my first few “high tech” jobs, although I don’t think any of them have managed to become billionaires yet.

January 21, 2010

And yet more on passwords

Filed under: Technology — Tags: , , , , , — Nicholas @ 13:11

This is becoming a quarterly topic around here. Imperva has done some statistical analysis of the 32 million passwords which were exposed in the Rockyou.com security breach:

Key findings of the study include:

* The shortness and simplicity of passwords means many users select credentials that will make them susceptible to basic forms of cyber attacks known as “brute force attacks.”

* Nearly 50% of users used names, slang words, dictionary words or trivial passwords (consecutive digits, adjacent keyboard keys, and so on). The most common password is “123456”.

* Recommendations for users and administrators for choosing strong passwords.

“Everyone needs to understand what the combination of poor passwords means in today’s world of automated cyber attacks: with only minimal effort, a hacker can gain access to one new account every second—or 1000 accounts every 17 minutes,” explained Imperva’s CTO Amichai Shulman.

The report identifies the most commonly used passwords:

1. 123456
2. 12345
3. 123456789
4. Password
5. iloveyou
6. princess
7. rockyou
8. 1234567
9. 12345678
10. abc123

So there you go — all the tools you need to be a world-class password cracker.

November 8, 2009

Aussie iPhone owners rickrolled

Filed under: Australia, Technology — Tags: , , , , — Nicholas @ 18:56

The horror, the horror:

The attacks, which researchers say are the world’s first iPhone worm in the wild, target jailbroken iPhones that have SSH software installed and keep Apple’s default root password of “alpine.” In addition to showing a well-coiffed picture of Astley, the new wallpaper displays the message “ikee is never going to give you up,” a play on Astley’s saccharine addled 1987 hit “Never Gonna Give You Up.”

Tricking victims in to inadvertently playing the song has become a popular prank known as Rickrolling.

A review of some of the source code, shows that the malware, once installed, searches the mobile phone network for other vulnerable iPhones and when it finds one, copies itself to them using the the default password and SSH, a Unix application also known as secure shell. People posting to this thread on Australian discussion forum Whirlpool first reported being hit on Friday.

August 6, 2009

Twitter under DOS attack

Filed under: Americas, Technology — Tags: , , , , — Nicholas @ 13:58

Twitter users have been unable to access the site for most of Thursday morning, due to a Denial-of-Service (DOS) attack:

The extended silence in a normally noisy Twitterworld began around 9 a.m. Twitter later posted a note to its status update page saying the site had been slowed to a standstill by an attack.

In a denial-of-service attack, hackers typically direct a “botnet,” often made up of thousands of malware-infected home PCs, toward a target site in an effort to flood it with junk traffic. With the site overwhelmed, legitimate visitors cannot access the service.

“On this otherwise happy Thursday morning, Twitter is the target of a denial-of-service attack. Attacks such as this are malicious efforts orchestrated to disrupt and make unavailable services such as online banks, credit card payment gateways, and in this case, Twitter for intended customers or users,” co-founder Biz Stone said in a blog post. “We are defending against this attack now and will continue to update our status blog as we continue to defend and later investigate.”

Update: Service is back, intermittantly. More background on the attack here.

July 30, 2009

Latest threat to world civilization

Filed under: Technology — Tags: , , — Nicholas @ 07:25

OMG! Everybody panic!

It’s bad enough that the iPhone can, according to Apple itself, be used to crash cell towers, but apparently they can be very easily hijacked, too:

If you receive a text message on your iPhone any time after Thursday afternoon containing only a single square character, Charlie Miller would suggest you turn the device off. Quickly.

That small cipher will likely be your only warning that someone has taken advantage of a bug that Miller and his fellow cybersecurity researcher Collin Mulliner plan to publicize Thursday at the Black Hat cybersecurity conference in Las Vegas. Using a flaw they’ve found in the iPhone’s handling of text messages, the researchers say they’ll demonstrate how to send a series of mostly invisible SMS bursts that can give a hacker complete power over any of the smart phone’s functions. That includes dialing the phone, visiting Web sites, turning on the device’s camera and microphone and, most importantly, sending more text messages to further propagate a mass-gadget hijacking.

The researchers say they’ve notified Apple about the vulnerability, but that Apple had not provided a fix.

Everybody sing: “It’s the end of the world as we know it, it’s the end of the world as we know it . . .”

Update, 31 July: Apple has announced that it will be releasing a fix to this problem on August 1st.

Update, the second, 31 July: The folks on the Apple-iPhone mailing list say the fix has escaped and is now available through iTunes. I’ll be downloading the update as soon as I get home . . .

« Newer Posts

Powered by WordPress