Anonymous protests planned over government surveillance

Monday’s targets include TrapWire and INDECT, which the shadowy group says track and profile citizens.

Protesters in Canada may get into trouble for wearing the Guy Fawkes masks they’re known for if a protest escalates to a riot. That’s because Canada's House of Commons last week approved a bill that bans people from hiding their faces during riots.

The bill was championed by a lawmaker who said it was a response to last year's Stanley Cup riots in Vancouver, during which often-masked vandals smashed and lit fire to the city after their professional hockey team lost to the Boston Bruins, reports the security firmSophos .

While the bill doesn’t apply to peaceful demonstrations, anyone convicted of covering his or her face during a riot or unlawful assembly could get up to 10 years in prison.

The sponsor says the bill doesn’t aim to limit freedom of expression or peaceful protest, but to protect people who want to enjoy their activities safely and freely.

While it’s true there have been several notable Canadian riots involving masked people in recent years, Sophos points out that masks have also been used to protect protesters.

Last year, for example, in a video posted to the Internet, masked members of Anonymousvowed to release the names and addresses of an unspecified number of people associated with the drug syndicate known as Los Zetas -- which has been attributed with thousands of deaths and gruesome acts of retribution, such as beheadings -- unless the drug lords released a member of Anonymous they kidnapped from a street demonstration in Mexico's Veracruz state.

As for the issue of the government using technology to track and profile citizens, Anonymous has been outspoken.

Source: pcworld.com

Read More

Malware infects 13 percent of North American home networks

Some 13 percent of home networks in North America are infected with malware, half of them with "serious" threats, according to a report released Wednesday by a cyber-security company.

However, that number is a one-percent decrease from the quarter that ended in June, according to Kindsight Security Labs, of Mountain View, California, in its third-quarter malware report [PDF].

Based on information gathered from service providers, Kindsight reported that 6.5 percent of the home network infections were high-level threats that could turn a home computer into a spam-spewing zombie on a botnet or compromise a computer owner's bank account.

ZeroAccess botnet

Some 2.2 million home networks worldwide are infected with malware controlled by the ZeroAccess botnet, the report estimated. In North America, one in every 125 home networks are infected with malicious software.

Map of the ZeroAccess botnet as it spreads across North America

"The ZeroAccess.net has grown significantly to become the most active botnet we've measured this year," Kevin McNamee, Kindsight security architect and director, said in a statement.

"Cyber criminals are primarily using it to take over victim computers and conduct click fraud," McNamee continued. "With ZeroAccess, they can mimic the human behavior of clicking online ads, resulting in millions of dollars of fraud."

Kindsight estimates that online advertisers lose $900,000 a day in fraud perpetrated by ZeroAccess.

Big money for evil-doers

Spam, add-click malware, banking Trojans, theft of identity information, and fake security software are big money makers for cybercriminals, the report noted.

The cyber-security vendor also reported that it saw a 165% increase in the number of Android malware samples during the period. Nevertheless, despite the growth in spyware apps and malware, there have been no major malware outbreaks, the report said.

"Aggressive Adware," some of it bordering on spyware, continues to be a problem in the Android market, according to Kindsight. It estimates that three percent of all mobile devices host some form of that software.

While security software aimed at removing aggressive adware from mobile devices has been introduced into the market, the report explained, it remains to be seen how effective it will be in mitigating the problem.

Similar efforts were made in the past to address spyware problems in the Windows world, but the Android environment is a horse of a different color. "One key difference between these ad-funded Android apps and the traditional Window’s variety is that the Android variety is being distributed from the Google Play App Store, which lends them considerable legitimacy," the report said.

Source: pcworld.com

Read More

Report: Open DNS resolvers increasingly abused to amplify DDoS attacks

Open and misconfigured DNS (Domain Name System) resolvers are increasingly used to amplify distributed denial-of-service (DDoS) attacks, according to a report released Wednesday by HostExploit, an organization that tracks Internet hosts involved in cybercriminal activities.

In the latest edition of its World Hosts Report, which covers the third quarter of 2012, the organization included data about open DNS resolvers and the Autonomous Systems—large blocks of Internet Protocol (IP) addresses controlled by network operators—where they are located.

That’s because, according to HostExploit, incorrectly configured open DNS resolvers—servers that can be used by anyone to resolve domain names to IP addresses—are increasingly abused to launch powerful DDoS attacks.

DNS amplification attacks date back more than 10 years and are based on the fact that small DNS queries can result in significantly larger DNS responses.

An attacker can send rogue DNS requests to a large number of open DNS resolvers and use spoofing to make it appear as if those requests originated from the target’s IP address. As a result, the resolvers will send their large responses back to the victim’s IP address instead of the sender’s address.

In addition to having an amplification effect, this technique makes it very hard for the victim to determine the original source of the attack and also makes it impossible for name servers higher up on the DNS chain that are queried by the abused open DNS resolvers to see the IP address of the victim.

“The fact that so many of these unmanaged open recursors exist allow the attackers to obfuscate the destination IPs of the actual DDoS targets from the operators of the authoritative servers whose large records they’re abusing,” said Roland Dobbins, solutions architect in the Security & Engineering Response Team at DDoS protection vendor Arbor Networks, Thursday via email.

“It’s also important to note that the deployment of DNSSEC has made DNS reflection/amplification attacks quite a bit easier, as the smallest response the attacker will stimulate for any query he chooses is at least 1300 bytes,” Dobbins said.

Even though this attack method has been known for years, “DDoS amplification is used far more frequently now and to devastating effect,” Bryn Thompson of HostExploit wrote Wednesday in a blog post.

“We have seen this recently and we see it increasing,” Neal Quinn, the chief operating officer of DDoS mitigation vendor Prolexic, said Thursday via email.

“This technique allows relatively small botnets to create large floods toward their target,” Quinn said. “The problem is serious because it creates large volumes of traffic, which can be difficult to manage for many networks without use of a cloud mitigation provider.”

Dobbins couldn’t immediately share any data about the recent frequency of DNS-based DDoS amplification attacks, but noted that SNMP (Simple Network Management Protocol) and NTP (Network Time Protocol) reflection/amplification attacks “can also generate very large, overwhelming attack sizes.”

In its report, HostExploit ranked the Autonomous Systems with the largest number of open DNS resolvers in their IP address spaces. The top one, controlled by Terra Networks Chile, contains more than 3,200 open resolvers in a pool of around 1.3 million IPs. The second one, controlled by Telecomunicacoes de Santa Catarina (TELESC)—now part of Oi, Brazil’s largest telecom operator—contains nearly 3,000 resolvers in a space of 6.3 million IP addresses.

“It should be stressed open recursive nameservers are not a problem in themselves; it is the mis-configuration of a nameserver where the potential problem lays,” HostExploit said in its report.

Source: pcworld.com

Read More

Hide your secrets, Anonymous wants to launch a WikiLeaks competitor

Love 'em or hate 'em, it's hard to ignore Anonymous. The hacktivist is famously associated with, among other things, protests against the Church of Scientology, takedowns of government websites, cyber-attacks, and—from time to time—just rampant trolling.

Judging from this report from The Hacker News, however, it looks as though Anonymous's latest endeavor is quite serious. An unnamed individual, who identified himself as a representative of the collective, recently conducted an email interview with The Voice of Russia with regard to the TYLER project.

In the interview, Anonymous explained that TYLER will be "like WikiLeaks on steroids." Scheduled to exit beta testing on November 5th and to go live on December 21, TYLER was apparently designed to "expose corruption malfeasance and counter Internet censorship."

Sounds just like WikiLeaks, doesn't it? That's because it's supposed to be. If you're wondering why Anonymous came up with TYLER, the reason is simple: They're no longer playing on Julian Assange's team. "[W]hat we will do is cease from this day all support of any kind for WikiLeaks or Julian Assange. No longer will Anonymous risk prison to defend WikiLeaks or Julian Assange from their enemies. No longer will Anonymous risk prison to supply material for WikiLeaks disclosures. Anonymous turns it's back on WikiLeaks," Anonymous declared in a statement.

Whatever the case may be, one thing is clear: Now's a great time to make sure you're not on Anonymous's naughty list.

Source: techhive.com

Read More

Email scams stage comeback

Security vendors Sophos and Kaspersky Lab both have in recent days warned of scam emails using the names of well-established companies to try to lure victims to malware sites. The scheme is obvious, or ought to be—the bad guys figure that if they use a trusted name, victims will trust the link.

The scams have been present virtually since email began, but security experts say they are increasing at an accelerating pace.

Graham Cluley, senior technology consultant at Sophos, reported early last week on a"widespread malware campaign that has been spammed out, disguised as a communication from DHL Express." He said it claims to be a tracking notification.

A few days later, Cluley reported on emails claiming to be from companies like British Airways, LinkedIn, YouTube, Google, and Amazon. "The truth is that the headers are forged, and the emails have been specially crafted to look like legitimate communications from online firms, he wrote.

"Clicking on the links could send your computer to Canadian pharmacy-like spam sites offering to sell you Viagra, or even webpages hosting malicious payloads," he wrote.

On Kaspersky Lab's Threatpost blog, Brian Donohue wrote: "Criminal hackers launched an attack campaign earlier this week in which they sent a slew of emails purporting to come from the financial software developer Intuit. The emails contained links that led to sites hosting the Blackhole exploit kit in an apparent attempt to infect the machines of corporate users."

There are multiple other examples, purporting to come from American Express, Microsoft and others.

Email malware the focus?

There are mixed opinions about whether this means that malware attacks are now more focused on email than web searches. Chester Wisniewski, a senior security adviser with Sophos, said web infections still impact more users than any other method.

"There has been an increase in malicious email, but it hasn't approached the amount of infections sourced from the web," he said. "It really is just a change in how email infections work. They used to be attached EXEs and SCRs that were simple Trojans. Most organizations are smart enough to block executables from entering through their email gateways, so criminals have moved on to HTML, PDF and RTF files."

[Related: After 40 years, email security still elusive, experts say]

But Bogdan Botezatu, senior e-threat analyst at Bitdefender, said web search malware"has now lost ground in terms of email spam bundled with malicious attachments or malicious links."

Botezatu said a Bitdefender study earlier this year found that of 264.6 billion spam messages sent daily, 1.14% carry attachments. "That means that, every day, about 300 million spam messages carry a malicious payload. We expect this trend to increase by 2% to 6% from one year to another," he said.

Cluley said it is difficult to compare the two types of attacks strictly in numerical terms. "Many attacks these days will incorporate aspects of both. An email may contain a link to a malicious website, or an email with a dangerous attachment may then download further code from the web," he said.

"I think we can safely say that neither web nor email threats are going away," Cluley said.

Advice

The best way to avoid all this trouble is to adopt some version of President Ronald Reagan's motto: Trust, but verify. In his blog post, Cluley advises users to always be careful about clicking on links in unsolicited emails. "Hover over links with your mouse to tell where it's really going to before clicking, and keep your antivirus and anti-spam protection updated," he said.

Stephen Cobb, a security evangelist at ESET, said to "'Be intelligent,' together with 'Be informed' and probably 'Be suspicious.'"

"I would also say that running good antivirus at all times adds a strong line of defense in addition to anything your browser, browser add-on, or email service is doing to keep you safe," Cobb said.

Another way to spot scams is to recall the grammar you learned in elementary school. Scams are frequently littered with grammatical mistakes.

One scam email circulating Monday, purporting to be a sweepstakes award from Microsoft, declared in a sentence fragment: "Where your email address (XXXX) emerged as one of the online Winning (sic) emails in the 2nd category and therefore attracted a cash award of 350,000.00 Euros (Three Hundred and Fifty Thousand Euros Only) and a (sic) HP laptop."

Cobb and others say some email providers are better than others at screening out scams. "Gmail is pretty good, largely because it can leverage Google's vast amount of traffic to spot malicious activity," Cobb said.

"But, of course, pretty good is not always good enough," he said. "I run Gmail in parallel with an unfiltered email app on some accounts and clearly Gmail learns about new malicious email campaigns pretty quickly, but I sometimes see infected documents and malicious links coming through Gmail, and these are usually first-of-a-kind attacks."

Bogdan Botezatu said while Gmail and Yahoo Mail block potentially malicious attachments, "it would be unreasonable to assume that any e-mail service could block these attachments with 100% accuracy."

J. Wolfgang Goerlich, an information security manager for a Michigan-based financial services firm, agrees that technology is part of the solution. "Organizations need to utilize and update spam filters to reduce the likelihood of scam emails getting to the end user," he said.

But he said given that signature controls always lag behind the scammers, "people become the last line of defense. It is important for an organization help its employees develop the equivalent of email street smarts," he said.

Source: pcworld.com

Read More

Future cyber attacks could rival 9-11, cripple US, warns Panetta

The Secretary of Defense laid out why the military should be involved in defending critical infrastructure

The U.S. is facing a dramatically increasing threat from cyber attacks and a future attack on the country's critical infrastructure could have an effect similar to the Sept. 11 terrorist attacks of 2001, the U.S. Secretary of Defense said Thursday evening.

Speaking at a meeting of the Business Executives for National Security (BENS) in New York, Leon Panetta called the Internet "the battlefield of the future" and spelled out what he believes the Department of Defense's role should be in cyberspace.

The military's role in securing the domestic Internet and working against attacks on commercial institutions has been controversial, although Panetta sought to get the assembled business leaders on his side by warning them of the danger a large-scale attack could have on their companies.

"A cyber attack perpetrated by nation states or violent extremist groups could be as destructive as the terrorist attack on 9/11," he said in the televised speech. "Such a destructive cyber terrorist attack could virtually paralyze the nation." (See video of Panetta warning against future cyber attacks.)

Panetta acknowledged recent distributed denial of service (DDOS) attacks on U.S. financial institutions that disrupted their websites and expressed concern with the speed at which they hit, but said he was even more alarmed by a recent attack by malware dubbed "Shamoon" that hit oil company Saudi Aramco.

"Shamoon included a routine called a 'wiper,' coded to self-execute," Panetta said. "This routine replaced crucial system files with an image of a burning U.S. flag. It also put additional 'garbage' data that overwrote all the real data on the machine. More than 30,000 computers it infected were rendered useless, and had to be replaced. It virtually destroyed 30,000 computers."

"All told, the Shamoon virus was probably the most destructive attack the private sector has seen to date," he said. "Imagine the impact an attack like that would have on your company."

Panetta told his audience the Department of Defense knows of specific instances where attackers have gained access to critical infrastructure systems and said such attacks could do great harm.

"An aggressor nation or extremist group could use these kinds of cyber tools to gain control of critical switches," he said. "They could for example derail passenger trains, or even more dangerous trains loaded with lethal chemicals," he said. "They could contaminate the water supply in major cities, or shut down the power grid across large parts of the country. The most destructive scenarios involve cyber actors launching several attacks on our critical infrastructure at one time in combination with a physical attack on our country."

Such a scenario, said Panetta, would "paralyze and shock the nation" and be equivalent to a "cyber Pearl Harbor." (See video of Panetta setting out the scenario.)

The Department of Defense has an interest in stirring up fear of online attacks -- it wants to remain involved in cyber defense.

Over the last few years, the U.S. has developed the world's most sophisticated system to detect and prevent cyber attacks, Panetta said. He then set out why he believes the Department should be involved in national cyber security.

Panetta first addressed one of the biggest issues surrounding increased military involvement with the Internet: the possibility that the Department of Defense would monitor personal e-mail and communications between U.S. citizens.

"That it not our goal, that is not our job, that is not our mission," he said. "Our mission is to defend the nation. We defend. We defer. And if called upon, we take decisive action to protect our citizens. In the past we have done so through operations on land and at sea, in the sky and in space. In this century, the United States military must help defend the nation in cyberspace as well." (See video of Panetta pledging not to monitor the communications of U.S. citizens.)

To do this, Panetta said the Department of Defense in investing more than US$3 billion per year in developing new capabilities to fight cyber attacks and said the U.S. has the capability to go on the offensive when required.

"If we detect an incoming attack that will cause significant physical destruction in the United States, or kill American citizens, we need to have the option to take action against those who would attack us, to defend this nation when directed by the president" Panetta said. "For these kinds of scenarios, the department has developed the capability to conduct effective operations to counter threats to our national interests in cyberspace."

"Let me be clear, that we will only do so to defend our nation, to defend our interests, to defend our allies. And we will only do so in a manner that is consistent with the policy principles and legal frameworks that the department follows for other domains, including the law of armed conflict," he said. (See video of Panetta's remarks on when the military would get step in to defend the national Internet.)

As a result of the increased focus on cyber security by several government agencies, Panetta said the Department of Defense is in the final stages of revising its rules of engagement in cyberspace. The change is the largest in seven years and will spell out the duty of the military to defend its networks and also the nation should the U.S. come under major cyber attack.

As a result of the increased focus on cyber security by several government agencies, Panetta said the Department of Defense is in the final stages of revising its rules of engagement in cyberspace. The change is the largest in seven years and will spell out the duty of the military to defend its networks and also the nation should the U.S. come under major cyber attack.

Panetta closed with a call to his audience to share the responsibility to protect cyberspace.

"Ultimately, no one has a greater interest in cyber security than the business that depend on a safe, secure, and resilient global digital infrastructure," he said. "To defend those networks more effectively, we must share information between the government and private sector."

"We've made real progress in sharing information with the private sector, but very frankly, we need Congress to act to ensure that this sharing is timely and comprehensive. Companies should be able to share specific threat information with the government without the prospect of lawsuits hanging over their head. And a key principle must be to protect the fundamental liberties and privacy in cyberspace that we are all duty bound to uphold."

Source: itworld.com

Read More

Cyber espionage campaign targets energy companies

Signs suggest remote access trojan by group that attacked RSA.

 Hackers using a Remote Access Trojan (RAT) named Mirage have been engaged in a systematic cyber espionage campaign against a Canadian energy company, a large oil firm in the Philippines and several other entities since at least this April, Dell's SecureWorks Counter Threat Unit says. The campaign is the second one targeted at oil companies to be discovered by SecureWorks this year. In February, researchers at the firm discovered attackers using remote access tools similar to Mirage to target several oil companies in Vietnam. That campaign also targeted government agencies in several countries, an embassy, a nuclear safety agency and multiple business groups, according to SecureWorks.

The domains for three of the command and control (C&C) servers used to control Mirage and for several of the C&C servers used in the February campaign, appear to belong to the same individual or group of individuals, SecureWorks said.

Also noteworthy is the fact that the IP addresses for the command and control servers used for Mirage and in the February campaign belong to China's Beijing Province Network. The same network was also implicated in last year's attacks on security vendor RSA that resulted in the theft of confidential information related to the company's SecurID two-factor authentication technology.

Command and control servers associated with the 2009 GhostNet campaign that targeted government computers in more than 100 companies also used IP addresses in the same network. The evidence suggests that the same group of people is behind the sweeping cyber espionage campaigns, SecureWorks researchers Joe Stewart said today. The latest Mirage campaign has so far impacted companies in Canada, the Philippines, a military organization in Taiwan and several unidentified entities in Nigeria, Egypt, Brazil and Israel, Stewart said.

The Mirage malware program itself is very crafty and is designed to evade easy detection, according to SecureWorks. All of its communications with its command and control servers are disguised to appear like the URL traffic pattern associated with Google searches.

Those behind the espionage have used phishing emails to trick mid-level to senior executives at the targeted companies to click on attachments containing malware for installing Mirage on their systems. One of the emails used in the campaign for instance, contained a pdf of a news story about Yemeni women being eligible to participate in that country's elections.

Over the past few months, researchers at SecureWorks discovered several customized variants of Mirage designed to evade detection by anti-virus and anti-malware programs

"One of the variants was seen in a subset of samples that had been modified specifically for the environment targeted by the threat actors," SecureWorks analyst Silas Cutler wrote in the alert. "These samples had been configured with default credentials for the targeted environment's web proxy servers," he noted. 

 Source : computerworld.com

Read More

Hacker to use cloud for brute force WiFi crack

WPA-PSK not powerful enough in a cloud world.

A security researcher claims to have figured out a quick and inexpensive way to break a commonly used form of password protection for wireless networks using powerful computers that anybody can lease from Amazon.com over the Web.

Thomas Roth, a computer security consultant based in Cologne, Germany, says he can hack into protected networks using specialised software that he has written that runs on Amazon's cloud-based computers. It tests 400,000 potential passwords per second using Amazon's high-speed computers.
That leaves businesses as well as home networks prone to attack if they use relatively simple passwords to secure their networks.

Amazon leases time on computers to developers and companies that don't have the money to buy their own equipment, or don't use it frequently enough to justify doing so. Customers include individual programmers and corporate users.

A spokesman for Amazon said that Roth's research would only violate his company's policies if he were to use Amazon Web Services (AWS) and its Elastic Compute Cloud (EC2) computing service to break into a network without permission of its owner.

"Nothing in this researcher's work is predicated on the use of Amazon EC2. As researchers often do, he used EC2 as a tool to show how the security of some network configurations can be improved," said Amazon spokesman Drew Herdener.

"Testing is an excellent use of AWS, however, it is a violation of our acceptable use policy to use our services to compromise the security of a network without authorisation."

Roth will distribute his software to the public and teach people how to use it later this month at the Black Hat hacking conference in Washington, D.C.

He said he is publicising his research in a bid to convince skeptical network administrators that a commonly used method for scrambling data that travels across WiFi network passwords is not strong enough to keep crafty intruders from breaking in to networks.

That encryption method, dubbed WPA-PSK, scrambles data using a single password. If a potential intruder is able to figure out the password, he or she can gain access to computers and other devices on the network.

Roth said that the networks can be broken into if hackers use enough computer power to "brute force" their way into figuring out the passwords that protect networks.

Those passwords were difficult for the average hacker to break until Amazon.com recently started leasing time on powerful computers at relatively inexpensive rates: It takes the processing capability of multiple computers to perform mathematical calculations needed to break the passwords.

The online retailer charges users 28 cents a minute to use machines that Roth used in his attack. It would cost at least tens of thousands of dollars to purchase and maintain that equipment.

Roth said that he used his software and Amazon's cloud-based computers to break into a WPA-PSK protected network in his neighborhood. It took about 20 minutes of processing time. He has since updated his software to speed its performance and believes he could hack into the same network in about 6 minutes.

"Once you are in, you can do everything you can do if you are connected to the network," he said.

Roth said he was not publicising his discovery to encourage crime, but to change a misconception among network administrators:

"People tell me there is no possible way to break WPA, or, if it were possible, it would cost you a ton of money to do so," he said. "But it is easy to brute force them."

Read More

1.5 million stolen Facebook IDs up for sale

A hacker named Kirllos is offering to sell the accounts in an underground forum for 2.5 cents per account
A hacker named Kirllos has a rare deal for anyone who wants to spam, steal or scam on Facebook: an unprecedented number of user accounts offered at rock-bottom prices.
Researchers at VeriSign's iDefense group recently spotted Kirllos selling Facebook user names and passwords in an underground hacker forum, but what really caught their attention was the volume of credentials he had for sale: 1.5 million accounts.

IDefense doesn't know if Kirllos' accounts are legitimate, and Facebook didn't respond to messages Thursday seeking comment. If they are legitimate, he has the account information of about one in every 300 Facebook users. His asking price varies from $25 to $45 per 1,000 accounts, depending on the number of contacts each user has.
To date, Kirllos seems to have sold close to 700,000 accounts, according to VeriSign Director of Cyber Intelligence Rick Howard.

Hackers have been selling stolen social-networking credentials for a while -- VeriSign has seen a brisk trade in names and passwords for Russia's VKontakte, for example. But now the trend is to go after global targets such as Facebook, Howard said.

Facebook has more than 400 million users worldwide, many of whom fall victim to scams each day. In one such scam, criminals send out messages from a compromised account, telling friends that the account's owner is trapped in a foreign country and needs money to get home.

In another, they send Web links that lead to malicious software, telling friends that it's a hilarious or sensationalistic video.

"People will follow it because they believe it was a friend that told them to go to this link," said Randy Abrams, director of technical education with security vendor Eset. Once the malware gets installed, criminals can steal more passwords, break into bank accounts, or simply use the computers to send spam or launch distributed denial of service attacks. "There's just a plethora of things that people can do if they can trick people into installing their software," he said.

Kirllos' Facebook prices are extremely cheap compared to what others are charging. In its most recent Internet Security Threat Report, Symantec found that e-mail usernames and passwords typically went for between $1 to $20 per account -- Kirllos wants as little as $0.025 per Facebook account. More coveted credit card or bank account details can go for much more, ranging between $0.85 to $30 for credit card numbers to $15 to $850 for top-quality online bank accounts.

Read More

Hacker restores "Other OS" to PS3; has Sony opened Pandora's box?

Last week on April 1st, Sony pushed out a (more or less mandatory) firmware update (version 3.21) that clobbered the "Install Other OS" feature from older PS3s (the feature had already been disabled from the newer PS3 Slim).

When Sony revealed that a firmware update would remove this feature, hacker George "Geohot" Hotz announced that he'd see what he could do about helping people retain this functionality while still being able to use their PS3 on the Playstation Network. His plan was to build a custom version of firmware 3.21 that had all of Sony's content (such that is is; the update didn't seem to do anything but remove the feature) while retaining Other OS.

Yesterday he released video purported to show an early version of his custom firmware in operation (video embedded below). Hotz's blog post offers a few more details, but the one caveat is that your PS3 has to have firmware version 3.15 or earlier in order for this to work. If you've already upgraded to 3.21, you'll be out of luck when Hotz releases his custom version.

What's interesting to me about this story is that Hotz (who, prior to taking on the challenge of the PS3, was big in the iPhone hacking scene) was the first to hack the PS3 back in January. Some suspect that this was the incentive for Sony to go all paranoid and yank the "Install other OS" feature in the first place, so there's some poetic justice in Hotz putting that feature back in.

Now I don't know George Hotz and I'd never heard the name "Geohot" before that news in January, and only recently have I started reading his blogs. From reading him, it sounds like he initially hacked the PS3 just for the challenge of doing so and because he's legitimately interested in seeing how things work. He states more than once that he doesn't condone piracy and for now, let's take that at face value. On the other side of the coin, I can understand how Sony can be so skittish about having their hardware hacked, considering how much rampant piracy (accomplished via custom firmware) impacted the Sony PSP. But I think Hotz makes a really good point in the closing paragraph of his most recent blog post:

"Note to the people who removed OtherOS, you are potentially turning 100000+ legit users into "hackers." There was a huge(20x) traffic spike to this blog after the announcement of 3.21. If I had ads on this site I guess I'd be thanking you."

How many PS3 owners were paying attention to the PS3 hacking scene before Sony yanked this feature on them? It didn't seem like there were that many, but now it's become big news. Is Sony trying to put out a fire with gasoline? Newer PS3s didn't have the "Install Other OS" option. Now Hotz says it's possible that his hack will enable it on those new systems too. If that turns out to be true, Sony has done themselves more harm than good. Accepting that Hotz has no interest in piracy, that certainly isn't true of everyone and it seems logical that his custom firmware will offer a good starting point for those with more nefarious reasons for hacking their PS3. By removing the Install Other OS feature, all Sony has managed to do is garner ill-will and encourage the PS3 hacking scene that it was trying so hard to quash.

Read More

To fight scammers, Russia cracks down on .ru domain

In a bid to cut down on fraud and inappropriate content, the organization responsible for administering Russia's .ru top-level domain names is tightening its procedures.

Starting April 1, anyone who registers a .ru domain will need to provide a copy of their passport or, for businesses, legal registration papers. Right now, domains can be set up with no verification -- a practice that has allowed scammers to quickly set up .ru domains under bogus names.


The changes will help Russia align its rules with international best practices, said Olga Ermakova, informational projects manager with the Coordination Center for the .ru top-level domain, in an e-mail interview. The .ru administrators care about the "cleanness" of the domain, she added. "We don't need negative content, and such content is often [created] by unknown users."

Loopholes in the domain name system help spammers, scammers and operators of pornographic Web sites to avoid detection on the Internet by concealing their identity. Criminals often play a cat-and-mouse game with law enforcement and security experts, popping up on different domains as soon as their malicious servers are identified.

Criminals in eastern Europe have used .ru domains for a while, registering domain names under fake identities and using them to send spam or set up command-and-control servers to send instructions to networks of hacked computers.

With the new domain registration requirements, it will be more difficult for criminals to continue with business as usual. At the very least, the requirement that registrants must submit paper documents will make setting up domains a more costly and time-consuming process.

"It's pushing the malicious activity elsewhere," said Rodney Joffe, chief technologist with Neustar, a DNS service provider. "If it's so much of a hassle, they'll say, 'Screw it. I'm going to register another top-level domain.'"

Russia has been under pressure to clean up the .ru system, which is widely perceived as a safe haven for scammers. China made similar changes last month to the way that its .cn space is administered.

Joffe said it's too early to say how effective the .cn changes have been.

The .ru domain has been a top source of fraud of late, agreed Robert Birkner, chief strategy officer with Hexonet, a domain name service company. But even if it is cleaned up, criminals will have other places to go. Vietnam's .vn domain and Indonesia's .id have also been a problem lately, he said.

Earlier this week, representatives from the U.S. Federal Bureau of Investigation and the U.K.'s Serious Organised Crime Agency (SOCA) lobbied the group responsible for coordinating the Internet's domain name system to enforce tighter name recognition policies. Now it is "ridiculously easy" to register a domain name under false details, said Paul Hoare, senior manager and head of e-crime operations with SOCA.

Last month, a study of Internet domain name databases found that only 23 percent of records were accurate.

source: ComputerWorld.com

Read More

More than 100 companies targeted by Google hackers

Two months after hack, security firm says another 68 command-and-control servers have been identified

IDG News Service — The hackers who broke into Google two months ago have gone after more than 100 companies, according to an estimate by security vendor Isec Partners.

Researchers have been closing in on the unidentified criminals responsible for the attack over the past month. In the process, they have uncovered another 68 so-called command-and-control servers, used to control the hacked machines.

Investigators had already identified 34 hacked companies after examining the single command-and-control server used in the Google attack, and the discovery of another 68 servers could mean that many more companies were compromised than previously thought. "It's easily over 100 companies," said Alex Stamos a partner with Isec Partners.

In the weeks since Google went public with details of the hack, informal discussion lists have sprung up, including security experts and staffers from companies that have been compromised. In those discussions, "that list of control machines keeps getting longer and longer," Stamos said.

The code used in the attacks, known in security circles as Aurora, has been in use for at least 18 months, Stamos said. But the security industry was unaware of Aurora until Google discovered the intrusion last December. That allowed hackers to get onto corporate networks undetected.

Other technology companies, including Intel, Adobe, and Symantec, have also been hit by the attack, which investigators have traced back to China.

To break into victim companies, the hackers sent carefully targeted e-mail or instant messages to victims, hoping to trick them into visiting Web pages or opening malicious documents that would then attack their computers.

The worst part of the attack is what happens once the initial victim has been compromised. The hackers then use a variety of techniques to acquire additional usernames and passwords and fan out across the targeted company's network, downloading sensitive data, which is then moved offshore.

This type of targeted attack is not new, but it is dangerous because it is so good at circumventing traditional security measures, said Rob Lee, a computer forensics instructor with the SANS Institute. "We've been dealing with [these attacks] for five years," he said. "They're basically going around all the security appliances via email."

Not all of these attacks have been linked to Aurora, but Lee said that "there have been hundreds of companies infiltrated."

Stamos agreed that traditional security products such as antivirus and intrusion detection systems are not enough to stop the attack. "The interesting thing to me about these attackers is they're very patient," he said. "They'll spend a lot of time writing custom malware to get around people's antivirus."

"They'll use a social network to learn about one person in the company, and then will send emails or chats messages as that person's friend," he added.

Read More

Watchdog issues spam warning to real estate agent

Targets real estate sector.
The communications watchdog has issued a "formal warning" to Elders Real Estate Wollongong following an investigation that found the agency breached the Spam Act.

The Australian Communications and Media Authority said the real estate agent breached the Act by sending commercial electronic messages without an unsubscribe facility.

ACMA said it contacted "more than forty" head offices of real estate franchisors and companies last year to inform them of "key obligations" and "consequences of non-compliance" with anti-spam laws.

"This is the first enforcement measure taken against a real estate agent since an ACMA awareness campaign about unsolicited communications targeted at the real estate sector," said Chris Cheah, acting chairman of the ACMA.

Penalties of up to $1.1 million per day may be imposed by the Federal Court for repeat offenders of the Spam Act, ACMA said.

Read More

White House calls for IT boost to fight terrorism

Better technology needed to 'connect the dots' on terror-related data, says Obama report
The White House report on the failed bombing attempt of a U.S airliner on Christmas Day highlights the challenges U.S intelligence agencies face in correlating terrorism-related information gathered from multiple databases and sources.

The review, released yesterday, identified an overall failure by intelligence agencies to "connect the dots," despite having enough information at their disposal to have potentially disrupted the botched attack.

The problem, according to the report, was not a lack of information sharing between government agencies but a failure by the intelligence community to "identity, correlate and fuse into a coherent story all of the discrete pieces of intelligence held by the U.S. government."

In listing the various causes for this failure, the report noted that information technology within the counter-terrorism community "did not sufficiently enable the correlation of data that would have enabled analysts to highlight the relevant threat information."

Nigerian citizen Umar Farouk Abdulmutallab attempted to detonate an explosive device while onboard an international flight from Amsterdam to Detroit on Dec. 25. Though the plane landed safely, the incident sparked widespread concern over the intelligence lapses that led to his being allowed on the flight in the first place.

Prior to his having boarded the flight, Abdulmutallab's father had expressed concerns about his son's radicalization to U.S. embassy officials in Nigeria. Various other agencies had gathered information about Abdulmuttalab's visiting Yemen and meeting with operatives from an Al Qaida-affiliated terror group.

The report called on the director of national intelligence to "accelerate information technology enhancements" in areas such as knowledge discovery, database integration and cross-database searches. It also called for improved capabilities for linking biographic information with terrorism-related intelligence.
Computers that don't talk to each other

The report identifies what's been a challenge for some time within the intelligence community, said James Lewis, director and senior fellow at the Center for Strategic and International Studies (CSIS). The office of the Director of National Intelligence, one of the agencies responsible for analyzing and integrating terrorism-related intelligence gathered by the U.S. government, has been struggling for years to accomplish its mission, Lewis said.

"In the past, the director of the National Counter Terrorism Center had 11 different computers because none of the computers could talk with each other," said Lewis, who led a CSIS-led group that submitted a set of cybersecurity recommendations to President Obama last January.

The DNI has been trying to address the issue by standardizing its technology acquisition, but the task still remains a work in progress, Lewis said. in this particular case, "the dots were in several different places and we haven't brought them to a single place."
The incident also highlights an intelligence culture that emphasizes secrecy over information sharing, said John Pescatore, a former analyst at the National Security Agency who is now an analyst at research firm Gartner Inc.

The State Department and intelligence agencies, including the NSA, the FBI and the CIA, all have their own processes for handing raw intelligence data that they gather, Pescatore said. Often this raw information is filtered before being passed or shared with other agencies, which results in an incomplete picture of an unfolding scenario, such as the attempted Christmas Day bombing, he said.

"The first issue isn't tools, it is what you would do with the information the tool might discover," Pescatore said. The intelligence community was developed to gather information about opponents that was to be used in attacking the opponent, he said. "Defending against kamikaze pilots, suicide bombers or airplane terrorists is not the same thing by a long shot."

Handling terrrorist threats will require intelligence agencies to be more proactive in sharing information, he said. And rather than relying on threat information, the Transportation Security Administration and other consumers of intelligence information need to have a more direct role in analyzing intelligence data, he said,
Fix the culture first

More than eight years after the terrorist attacks of Sept 11, 2001, the biggest challenge for U.S. counter-terrorism efforts continues to be cultural issues rather than technology issues, said Bruce Schneier, a noted security expert and chief security technology officer at BT Group PLC.

"The intelligence community has been optimized to fight the cold war where secrecy was paramount," Schneier said. "That kind of secrecy doesn't make sense any more. You need more openness and collaboration and sharing," Schneier said. While it is conceivable that IT enhancements could boost data correlation abilities, the fundamental issue that needs to be overcome is cultural, he said.

Unlike Cold War foes such as the Soviet Union, Al Qaida and other adversaries are decentralized and poorly funded. "Our intelligence organizations need to trade techniques and expertise with industry, and they need to share information among the different parts of themselves," Schneier said.

"Today's terrorist plots are loosely organized ad hoc affairs, and the dots that are so important for us to connect beforehand might be on different desks, in different buildings, owned by different organizations," he said. "What we need is an intelligence community that shares ideas and hunches and facts on Facebook, Twitter, and wiki. I'm not advocating that the CIA and NSA open its networks to everyone, but they need to bring Web 2.0 tools into their own classified networks

Read More

Judge kicks notorious spammer off Facebook

A federal judge in San Jose, California, has ordered convicted spammer Sanford Wallace to stay away from Facebook.

Facebook sued Wallace and two other men last week in an effort to cut down on spam and phishing schemes on the social-networking site. On Monday, Judge Jeremy Fogel of the U.S. District Court for the Northern District of California issued a temporary restraining order barring Wallace and two other alleged spammers, Adam Arzoomanian and Scott Shaw, from accessing Facebook's network.

Wallace was served with notice of the lawsuit on Monday in Las Vegas, said Sam O’Rourke, senior litigation counsel with Facebook. "Basically, he's not allowed to have any contact with our site or our physical location," he said. "Should Mr. Wallace choose to continue to spam us we can actually go out and have a bench warrant and try to have him arrested, so we think it's a pretty significant ruling."

In court filings, Facebook argues that these men gained access to legitimate Facebook accounts and then used them to spam the profile pages of the account holders' friends. Facebook allows users to post messages on the "Wall" of the profile pages of their friends.
·
The Facebook spam messages served two functions -- they enticed users into visiting phishing Web sites where they could be tricked up into giving up their Facebook login credentials; they routed victims to commercial Web sites that paid the spammers for the traffic, Facebook said.

Wallace would entice users with typo-filled messages that had subjects such as "has anyone emailed youu to let you know your defauult image is diisplayed on dynafaces.com," or "I'm not sure if you know but your pix are all over bakescream ^dot^ com->you gotta see it," Facebook said.

Sometimes Wallace would get users to register on these sites and then try to log into Facebook with the same usernames and passwords, hoping the victims used the same credentials for both sites.

News of the lawsuit was first reported Friday by Inside Facebook, a Web site for Facebook developers.

Wallace is one of the country's most notorious spammers, with a career that dates back to the 1990s. Last May a federal judge found him and a partner guilty under the CAN-SPAM act and ordered them to pay US$230 million for phishing and spamming MySpace users with links to gambling, ringtone and pornography Web sites.

Spammers and phishers have been hitting Facebook particularly hard over the past year and a half, said Dave Jevans, chairman of the Anti-Phishing Working Group. Because Facebook spam often looks like it comes from a friend it can be very effective. And because it's Web-based, it skirts traditional e-mail spam filtering tools, Jevans said.

"Some of the bigger guys can get a million people a day to look at their stuff," he said. "It's occasional, but you'll see it."

Spam is just one of several ills plaguing the social network. Over the past few days, Facebook users have also been hit with a new variant of the Koobface worm, which tries to trick victims into installing malicious software onto their PCs. Also, fake applications that send out messages such as "F a c e b o o k - closing down!!!" or "Error Check System" to try to trick victims into sending the messages to their friends have also been circulating around the social network.

Late last year, the judge in the Wallace case awarded Facebook a record US$873 million in damages after Facebook accused other spammers of using stolen logins to pump out more than 4 million spam messages. Facebook says that it doesn't expect the spammers in that case to pay up, but the company hopes that it may serve as a deterrent.

Jevans agreed that lawsuits probably won't stop the big-time Facebook spammers, but he said they could deter the little guys.

Despite criminals best efforts, spam has not become a major problem on the social network O’Rourke said. "I think we're being targeted just because we have 175 million users now. No self-respecting spammer can not pay attention to that."

Read More

Hackers attack IE7 flaw

Less than a week after the last round of Microsoft Internet Explorer patches, security experts are already warning that exploit code is in circulation.

The particular flaw, MS09-002, is being exploited using a specially crafted Word document which is emailed to users. Once opened it installs malware onto the target system, including a Trojan to allow the malware to update itself.

"Several anti-virus vendors reported MS09-002 exploits in the wild. We can confirm that the exploit for the CVE-2009-0075 vulnerability (Uninitialized Memory Corruption) in Internet Explorer 7 is definitely in the wild and working on an unpatched Windows XP machine," said Bojan Zdrnja of the Sans Internet Storm Center.

"Initially there was some confusion about this attack as most anti-virus vendors mentioned Word documents. The exploit targets Internet Explorer 7, but so far it has been delivered to the end user as a Word document.

"That being said there is absolutely nothing preventing attackers from using the exploit in a drive-by attack and we can, unfortunately, expect that this will happen very soon."

The first malware to try and exploit the flaw looks to have been reverse-engineered rather than being in existence before the patch was announced, experts said. The malware collects information from infected computers, encrypts it and sends it to a server in China.

The short turnaround time from patch to malware will leave IT administrators racing to update corporate servers in time, and they are advised to warn users about potential threats.

Read More

Hackers clone passports in drive-by RFID heist

A British hacker has shown how easy it is to clone US passport cards that use RFID by conducting a drive-by test on the streets of San Francisco.

Chris Paget, director of research and development at Seattle-based IOActive, used a US$250 Motorola RFID reader and an antenna mounted in a car’s side window and drove for 20 minutes around San Francisco, with a colleague videoing the demonstration.

During the demonstration he picked up the details of two US passport cards, which are fitted with RFID chips and can be used instead of traditional passports for travel to Canada, Mexico and the Caribbean.

“I personally believe that RFID is very unsuitable for tagging people,” he said.

“I don’t believe we should have any kind of identity document with RFID tags in them. My ultimate goal here would be, my dream for this research, would be to see the entire Western Hemisphere Travel Initiative be scrapped.”

Using the data gleaned it would be relatively simple to make cloned passport cards he said. Real passport cards also support a ‘kill code’ (which can wipe the card’s data) and a ‘lock code’ that prevents the tag’s data being changed.

However he believes these are not currently being used and even if they were the radio interrogation is done in plain text so is relatively easy for a hacker to collect and analyse.

The ease with which the passport cards were picked up is even more worrying considering that less than a million have been issued to date.

Paget is a renowned ‘white hat’ ethical hacker and has made the study of the security failings of RFID something of a speciality.

In 2007 he was due to present a paper on the security failings of RFID at the Black Hat security conference in Washington but was forced to abandon the plans after an RFID company threatened him with legal action.

He points out that RFID tags are increasingly being used in physical security systems such as building access cards and the technology needs significant security adding before it could be considered safe for commercial use.

Copyright © 2009 vnunet.com

Read More

Second mass hack exposed

Hot on the heels of a recent hack in which 10,000 sites were compromised, researchers have disclosed a new large-scale attack..

Researchers at McAfee estimated that the attack has been active for roughly one week, and in that time frame has managed to place itself on roughly 200,000 web pages.

Most of the infected pages are running the phpBB forum software, said McAfee. The compromised pages are embedded with a Javascript file that links to the site hosting the attack.


Rather than attempt to exploit browser vulnerabilities, the attack attempts to trick a user into manually launching its malicious payload.

"This contrasts [Thursday’s] attack in that the vast majority of those were active server pages (.ASP)," explained McAfee researcher Craig Schmugar on a company blog posting.

"The ASP attacks are different than the phpBB ones in that the payload and method are quite different. Various exploits are used in the ASP attacks, where the phpBB ones rely on social engineering."

The infected pages bring up what appears to be a pornographic web site. Upon loading the page, a 'fake codec' social engineering attack is attempted. The user is told that in order to view the movie on the page, a special video codec must be installed.

The user then downloads a trojan program which installs a malware package on the users system then delivers a fraudulent error message telling the user that the supposed codec could not be installed.

Copyright © 2008 vnunet.com

Read More

Hackers exploit Obama site to spread malware

My.BarackObama.com still serving up Trojan a week after being notified, says Websense
A social networking site operated by the 2008 Barack Obama presidential campaign is serving up malware to unwary visitors a full week after the tactic was reported, a security researcher said today.

My.BarackObama.com, still active after the innauguration last week of President Obama, is being used by hackers trying to dupe users into downloading a Trojan horse, said Dan Hubbard vice president of security research at Websense Inc.

My.BarackObama.com provides tools that enable visitors to join groups of Obama supporters, raise funds and create a personal blog hosted on the site. The criminals have set up bogus accounts and used them to create blogs. When a user reaches one of the fake blogs, a YouTube-like video window is displayed; clicking on that video frame takes the user to a malicious Web site packed with pornography.

If the user clicks to view the porn, a message pops up claiming a video codec must be downloaded and installed. The executable file is no codec, but rather a Trojan horse that hijacks the PC.

"The group behind this is one of those that's infecting people with fake antivirus software," said Hubbard, referring to so-called scareware programs that pose as security software but are actually useless. Until the victim pays for the worthless program -- prices range between $40 and $50 -- he or she is deluged with fake pop-up warnings.

The cybercrooks don't just try to grab people browsing through My.BarackObama.com, Hubbard added; rather, they are actively polluting search engines with the URLs of their bogus blog accounts in an attempt to take advantage of My.BarackObama.com's reputation and popularity.

Although Websense first uncovered the phony blogs a week ago, it has had no luck reaching someone responsible for the My.BarackObama.com site. "We've been constantly trying to reach them, and tried every possible angle, from e-mail to the site itself to the phone, but we haven't heard back," said Hubbard. "Obviously, they've been fairly busy."

Multiple bogus blogs on the site are still serving the Trojan, Hubbard confirmed today.

A call Monday by Computerworld to the contact phone number listed in the site's terms of service was not returned.

This is not the first time Obama's name has been used to spread malicious code. The weekend before his inauguration, sites claiming that Obama would refuse to take office infected users with the Waledec bot Trojan; last November, the day after Obama won the U.S. presidential election, hackers launched a major malware campaign based on a site that claimed to have final vote tallies.

Read More

British UFO hacker's extradition case to be reviewed

IDG News Service —

A British hacker who sought to find evidence of UFOs on U.S. military computers has another chance at avoiding extradition after a court ruling Friday.

The High Court in London ruled that Gary McKinnon can have his case reviewed by the director of public prosecutions for England and Wales, Keir Starmer, according to statement released by McKinnon's attorney.

McKinnon is seeking to be prosecuted in the U.K. although his extradition order has been approved by the U.K. government. He has managed to avoid extradition so far through a series of legal maneuvers and appeals, all of which have been unsuccessful but held up his transfer to the U.S.

McKinnon was indicted in November 2002 in the U.S. District Court for the Eastern District of Virginia. He faces charges of illegally accessing and damaging U.S. government computers.

The U.S. government alleges his exploits cost at least US$700,000 and caused the shutdown of critical military networks shortly after the Sept. 11, 2001, terrorist attacks. McKinnon could face a sentence of 60 years or more.

Most recently, McKinnon has tried to garner support that, for medical reasons, if he is extradited and sentenced he should be allowed to serve a sentence in the U.K. Now McKinnon is pushing to only be prosecuted in the U.K. due to the stress he would endure from a U.S. trial.

He has been diagnosed with Asperger Syndrome, which is a neurological disorder characterized by obsessive behavior and deficiencies in social interaction.

McKinnon has admitted to hacking the computers and described how he did it in detail at computer security conferences in London. From his north London home, McKinnon began probing military computers looking for evidence of UFOs.

He used a program called "RemotelyAnywhere" to control U.S. military computers. Many of the computers he accessed were set up with default passwords, which made them easy to access, McKinnon has said.

He timed his hacking when no one was working at the U.S. offices. But on one occasion he miscalculated the time difference. Someone using a computer that McKinnon controlled noticed the cursor moving on its own. The connection was severed, and U.K. police eventually tracked McKinnon down.

IDG News Service

Read More