Hacker Alerts and Security

noreply@blogger.com (Gillis57) — Fri, 27 Mar 2009 02:56:00 +0000

My New Blog

noreply@blogger.com (Gillis57) — Tue, 08 Jul 2008 22:22:00 +0000

I have switched all of my blog entries to go to my new website
www.secureyourselfonline.com

That will be my new home :)

1 Million Dollar Prize

noreply@blogger.com (Gillis57) — Mon, 07 Jul 2008 18:09:00 +0000

A professor at Harvard released a statement today that he has rated a new security format which is "Absolutely Unbreakable" in his opinion. And permanent privacy is putting it's money where it's clout is, 1,000,000.00 dollars to the first person who is able to crack the code of Permanent Privacy. The platform is based on 256 AES encryption method for the core data, and a more sinister trick for those trying to crack it. Essentially, prior to encrypting the email- you convert the text of the email into a series of non-sequential, non-repeating letters and numbers based upon a key you provide. You then contact the person you are contacting directly and provide them with the key to decrypt the data. You THEN use AES to encrypt the data, so if anyone is able to decrypt the AES cyphertext, they will have no idea of the next text to decrypt.

From the director of Permanent Privacy:"You can now send emails and store data with 100 per cent security. Even the Pentagon cannot read your secrets if they do not have the keys."

I give it two months before the code is cracked and some geek is one million dollars richer.

For more details on the contest:Go Here
You have to purchase a copy of the program to enter, which seems a little crappy to me- If you want to know how to improve your project you don't charge people to look at it.

LinkedIn Scamming Customers?

noreply@blogger.com (Gillis57) — Sat, 05 Jul 2008 23:08:00 +0000

Anyone who is active in the professional world loves LinkedIn. (In my opinion) it is an absolutely flawless way to network, get your name out there, and build up on online resume that is able to be referenced on websites,blogs, or emails. It allows companies seeking employees an easy venue to find qualified personnel, helps skilled labor to find a company looking for someone just like them, and rekindles old flames left to die. Okay, so maybe isn't the hotbed of romantic activity on the internet, but its great for business. Especially LinkedIn's bottom line.

"How can LinkedIn benefit from networking?"

When you sign up for LinkedIn, you are asked to complete a resume of sorts. This initial information includes your name, date of birth, field of business,location and interests. Then you of course have the option of adding where you have worked, gone to school, and clubs/associations you are a part of. After all these personally identifiable things, you are then given the option of Joining Linkedin "Groups". These are generally trade groups or groups that allow a person to further network their profile. In short, LinkedIn has developed a complete advertiser's dream scenario. A company can buy your profile information from LinkedIn, and are provided with all of your information, along with means of contact for you. In general, LinkedIn has a full demographical breakdown of you and anyone you "Invite" to LinkedIn. And whereas the majority of LinkedIn users are over 40 and have incomes of over $100,000 dollars- they are the ideal targets of marketers, both legitimate and not. Recently LinkedIn decided to advertise merchandise to its users, but in a selective manner. For example, if Mercedes decided to advertise its new model, it would go to LinkedIn and they would choose from the member database the ones that fitted the marketing campaign. Then, LinkedIn decided to make a little more money by offering Premium Business and Premium Business Plus. With a regular membership you couldn't just send someone an e-mail, you had to be introduced first; with the new types of membership, this was no longer an issue. HR companies saw a great opportunity in this and for good reason. All they had to do was pay and they had access to all sorts of potential job candidates.

Their new Enterprise Corporate Solution gives access to all 23 million users of LinkedIn.

ALERT: YOUTUBE USERS COMPROMISED!

noreply@blogger.com (Gillis57) — Fri, 04 Jul 2008 00:59:00 +0000

The ruling comes as part of Google's legal battle with Viacom over allegations of copyright infringement.

Digital rights group the Electronic Frontier Foundation (EFF) called the ruling a "set-back to privacy rights".

The viewing log, which will be handed to Viacom, contains the log-in ID of users, the computer IP address (online identifier) and video clip details.

While the legal battle between the two firms is being contested in the US, it is thought the ruling will apply to YouTube users and their viewing habits everywhere.

Viacom, which owns MTV and Paramount Pictures, has alleged that YouTube is guilty of massive copyright infringement.

The UK's Premier League association is also seeking class action status with Viacom on the issue, alleging YouTube, which was bought by Google in 2006, has been used to watch football highlights.

Legal action

When it initiated legal action in March 2007 Viacom said it had identified about 160,000 unauthorised clips of its programmes on the website, which had been viewed more than 1.5 billion times.

Following the launch of its billion-dollar lawsuit, YouTube introduced filtering tools in an effort to prevent copyright materials from appearing on the site.

We urge Viacom to back off this overbroad request
Electronic Frontier Foundation

Q&A: What does this ruling mean?
Send us your comments

The US court declined Viacom's request that Google be forced to hand over the source code of YouTube, saying it was a "trade secret" that should not be disclosed.

But it said privacy concerns expressed by Google about handing over the log were "speculative".

Google's senior litigation counsel Catherine Lacavera said in a statement: "We are disappointed the court granted Viacom's over-reaching demand for viewing history.

"We will ask Viacom to respect users' privacy and allow us to anonymise the logs before producing them under the court's order."

The ruling will see the viewing habits of millions of YouTube users given to Viacom, totalling more than 12 terabytes of data.

Viacom said it wanted the data to "compare the attractiveness of allegedly infringing video with that of non-infringing videos."

YouTube and Google had "compelled" it to go to court, Viacom said, "by continuing to defend their illegal and irresponsible conduct and profiting from copyright infringement, when they could be implementing the safe and legal user generated content experience they promise".

It said it would not be asking for any "personally identifiable information" of any user.

"Any information that we or our outside advisors obtain will be used exclusively for the purpose of proving our case against You Tube and Google (and) will be handled subject to a court protective order and in a highly confidential manner."

'Erroneous ruling'

Leading privacy expert Simon Davies told BBC News that the privacy of millions of YouTube users was threatened.

The chickens have come home to roost for Google
Simon Davies, privacy expert

He said: "The chickens have come home to roost for Google.

"Their arrogance and refusal to listen to friendly advice has resulted in the privacy of tens of millions being placed under threat."

Mr Davies said privacy campaigners had warned Google for years that IP addresses were personally identifiable information.

Google pledged last year to anonymise IP addresses for search information but it has said nothing about YouTube data.

Mr Davies said: "Governments and organisations are realising that companies like Google have a warehouse full of data. And while that data is stored it is under threat of being used and putting privacy in danger."

The EFF said: "The Court's erroneous ruling is a set-back to privacy rights, and will allow Viacom to see what you are watching on YouTube.

"We urge Viacom to back off this overbroad request and Google to take all steps necessary to challenge this order and protect the rights of its users."

The body said the ruling was also potentially unlawful because the log data did contain personally identifiable data.

The court also ruled that Google disclose to Viacom the details of all videos that have been removed from the site for any reason.

ALERT:ATM PIN NUMBERS HACKED!

noreply@blogger.com (Gillis57) — Wed, 02 Jul 2008 21:24:00 +0000

Hackers broke into Citibank's network of ATMs inside 7-Eleven stores this year and stole customers' PIN codes, according to recent court filings that revealed a disturbing security hole in the most sensitive part of a banking record.

The scam netted the alleged identity thieves millions of dollars. But more importantly for consumers, it indicates criminals were able to access PINs -- the numeric passwords that theoretically are among the most closely guarded elements of banking transactions -- by attacking the back-end computers responsible for approving the cash withdrawals.

The case against three people in U.S. District Court for the Southern District of New York highlights a significant problem.

Hackers are targeting the ATM system's infrastructure, which is increasingly built on Microsoft Corp.'s Windows operating system and allows machines to be remotely diagnosed and repaired over the Internet. And despite industry standards that call for protecting PINs with strong encryption -- which means encoding them to cloak them to outsiders -- some ATM operators apparently aren't properly doing that. The PINs seem to be leaking while in transit between the automated teller machines and the computers that process the transactions.

"PINs were supposed be sacrosanct -- what this shows is that PINs aren't always encrypted like they're supposed to be," said Avivah Litan, a security analyst with Gartner research firm. "The banks need much better fraud detection systems and much better authentication."

It's unclear how many Citibank customers were affected by the breach, which extended at least from October 2007 to March. The bank has nearly 5,700 Citibank-branded ATMs inside 7-Eleven Inc. stores in the U.S., but it doesn't own or operate any of them.

Open Source Routers!

noreply@blogger.com (Gillis57) — Wed, 02 Jul 2008 19:11:00 +0000

Netgear has announced the launch of its WGR614L open source Wireless-G router.

The fully-featured wireless router is designed to support a variety of applications created by the open source community.

The router supports Linux-based Tomato and DD-WRT firmware and will soon support OpenWRT.

It is powered by a 240MHz MIPS32 CPU with 16KB of instruction cache, 16KB of data cache and 1KB of pre-fetch cache, and incorporates 4MB of Flash memory and 16MB of Ram.

"There has been growing demand for more powerful platforms to support open source enthusiasts seeking to create more robust, commercial-grade applications for their wireless routers," said Som Pal Choudhury, senior product line manager for advanced wireless at Netgear.

The router features a single 10/100 internet Wan port, a four-port 10/100 Lan switch, an 802.11g access point and all of the most common security and logging features.

"An important feature of our offering is the dedicated and responsive open source community which enables users to easily exchange ideas and troubleshoot issues," explained Choudhury.

"New applications currently being developed include traffic shaping applications, redirections to captive portals for hotspots, guest access via a separate SSID, upstream and downstream QOS and intelligent bandwidth monitoring. "

Ironically the router is also 'Works with Windows Vista' certified. The WGR614L is available now for around $69.

British Health Records Stolen

noreply@blogger.com (Gillis57) — Tue, 01 Jul 2008 22:08:00 +0000

This is really beginning to get to me. With the proliferation of laptops in our society, you would think that knowledge of security would begin to rapidly spread as well. However, this is the second story in less than a week of a laptop being stolen from a car. Now, if this was an office of some sort, with semi-inconsequential data it would be understandable. But it seems that more and more, Healthcare IT staff are carrying around patient data on their personal laptops. These are people who are carrying around credit card info, banking numbers, social security numbers, Names, dates of birth. And i still wouldn't have a problem with it if they would take some sort of rudimentary precautions to ensure the protection of the data. However, there have been cases of IT staff storing full system backup tapes, laptops, USB Crypto keys, and entire servers in the back of their cars. They are then completely amazed when these top-level security measures are thwarted by a crook with a crowbar. This latest incident occured after a British IT worker for the NHS trust left his laptop unsecured in his car, along with 21,000 patients details. To make things worse, none of the information was encrypted. So the thief now has complete access to any and all patient data. The NHS trust reinforced the now common perception that they were completely technologically incompetent by stating (trying to make the situation better) "the data will almost certainly by wiped by the thief"

What steps should you take in order to secure a system from theft?
A. Set a Bios Level Password
B. Set at least a 14 digit password.
C. Require some sort of Biometric Authorization for Access
D. Always keep your data in an encrypted folder
E. If practical, Hide private data inside of another file
F. Keep any backups in humidity controlled, insulated environment.
G. Rule of Thumb: If your system can be seen, its public data.
H. Thumb of Rule: If your system is in your car, it deserves to be stolen.

Mcafee's Spam Project.

noreply@blogger.com (Gillis57) — Tue, 01 Jul 2008 19:20:00 +0000

Have you ever pondered to yourself, "What would happen if I left my computer without anti-virus, routine maintenance, or any care to be taken of it?" Do you imagine a zombie computer, revving its engine repeatedly in disgust of your lack of decent ownership?Well,Mcafee has released the results of its Spammed Persistently All Month campaign- So you do not have to wonder anymore.

The project asked a group of 70 users from 10 countries to surf the web unprotected and gather as much spam as possible.

The guinea pigs were able to amass a total of 104,000 spam messages, an average of 2,096 messages per person and 70 messages per day for each user.

Americans topped the spam haul, amassing 23,233 spam messages between five users. Brazil finished a distant second with 15,856 messages, and the UK was fifth with 11,965.

Participants in the study also noticed significant system slowdowns from unwanted software installations.

"In just 30 days there was quite a noticeable change in the performance of their computers," said McAfee Avert Labs senior vice president Jeff Green.

"This showed just how much malware was being installed without their knowledge, and that spam is much more than a nuisance. It is a very real threat. "

The US also led the study in the number of adult-oriented spam messages, while the UK received the highest number of Nigerian '419' messages. Brits received more than 23 per cent of the infamous money transfer scam attempts.

Financial services messages were the most popular spam topics, followed by advertisements and health and medicine messages. Adult emails were the fourth most-popular, while offers for free items were fifth and 419 scams tenth.

McAfee also noted an increasing number of location- and language-specific spam, particularly in France and Germany. The large spam loads in Brazil and Mexico also suggest a new focus on emerging economies.

"Our participants came from all walks of life, from all over the world and, given their interest to take part in the experiment, they were well aware of the problem," said McAfee chief executive Dave DeWalt.

"Despite this, they were all shocked by the sheer amount of spam they attracted in such a short time and the lengths the spammers would go to in order to achieve success."AA

ALERT:Credit Cards Able to Be Cloned!

noreply@blogger.com (Gillis57) — Thu, 26 Jun 2008 17:28:00 +0000

It's a near ideal scene: a family riding a train, traversing hundreds of miles in a few hours. As the train chugs along at incredible speeds, they cross mountains,valleys, chug through forests and along beaches. The son begins to tug at his fathers curtail, accidentally knocking his dad into someone passing through the hallway.

No problem right?

Wrong. A group of hackers from the Netherlands used a technique that was popularized at DEFCON 15 to develop means to clone England's "Oyster" transit card. The cards use a microchip from the manufacturer "Mifare". A brief scan of a legitimate card reader (I.E, turnstiles to access the London Underground) reveal the cryptographic key that reads and authorizes a card to be used. Once the attacker uploads this key to his/her laptop, they are carrying a portable card reader wherever they go. This means that if the attacker is able to interrupt your cards RFID signature, they are able to clone your card onto a card of their choosing. This allows them to consume the balance of your card.

The Mifare chips are also used in numerous secure site authentication methods, which have drawn attention from the British government. When it was revealed that the same technology could be used to gain forged access to nuclear and governmental sites, they announced they would be replacing over 100,000 Mifare "Secure" RFID smart cards. At a cost of over 60 euros a piece, this security screw up could end up costing the British government over 3 million US dollars.

These events lead me wondering, how long before:
A.Credit Cards Have RFID
B.Hackers Crack It
C.Cloned Credit Cards
D.Aluminum Plated Wallets

Marshall Islands Attacked

noreply@blogger.com (Gillis57) — Wed, 25 Jun 2008 19:28:00 +0000

The Marshall Islands, an island chain housing 55,000+ people came under attack today.
The attack didn't involve bombs, missiles, guns, or any invading forces. This attack was brought about by a small group of "Hackers", who executed a distributed denial of service attack on the National Telecommunications Authority. This attack did not destroy, or damage any property/infrastructure, rather, temporarily cut off communications with the outside world. Marshall Island residents were still able to communicate inside the NTA network. The attack was a generically low-tech one, consisting of a mass spamming of the mail servers. The incoming spam filled up all the routes for mail exiting, thus rendering the servers useless. These spam mails were sent via a series of zombie computers from around the world. Presumably an individual (Re: One Person) had complete control of all the zombies from a private IRC channel, and is still executing the attack from there.

As of Late, "Botnets" have become an increasingly lucrative business for hackers. While relatively easy to setup, Renting a Botnet out could net one upwards of 10,000 US dollars.

As of Wednesday, June 25, external communications with the nation have still not been restored.

Would it be wrong for me to point out that the Marshall Islands were also where we tested the Nuclear Bomb? Recently it came out that the US was working on developing a "Carpet Bombing" technique for shutting down a nations IT infrastructure. What motivation would any individual or group have at shutdown a national infrastructure?
I Believe this may be the first in an unfortunate series of internet militarization tests.

New Biometric Bank Protection

noreply@blogger.com (Gillis57) — Tue, 24 Jun 2008 21:52:00 +0000

A voice biometric system for authorizing banking transactions was launched yesterday, and even Rory Bremner's impressions are not clever enough to fool it.

Voice Transact, which is the brainchild of Nick Ogden, the founder of the WorldPay remote payment system, uses a vocal signature that is matched against a pattern stored on file when the account it opened. It is designed to help reduce fraud, particularly phishing-related online scams.

"We are creating a global network for banks to use that is changing the way people confirm their transactions," Mr Ogden said. "Voice biometric signatures can enable consumers to have complete control over signing for financial transactions anywhere in the world."

The company is in talks with a major pan-European bank and expects to launch a service in the UK towards the end of the summer. It is also in discussion with MasterCard, and in six weeks' time, consumers at a participating Dubai bank will be able to take money out of a cash machine without their bank card. By selecting the "cardless transaction" option, and inputting the mobile phone number, the customer will be immediately rung back and asked to repeat a random string of numbers. Once the voice pattern has been matched, the cash machine will dispense money in the normal way.

The company invested $10m (£5m) in the technology, which works by creating a profile when a customer registers their account. Transactions are authorized by repetition of a random string of numbers that do not relate to the financial information but merely function as a way of getting the person to talk.

While a customer who has actually lost their voice could have problems, a normal cold should present no problems, and a three-hour test session was conducted with Rory Bremner last year to ensure that the system cannot be cracked. "We guarantee the integrity of the system so we will stand behind any transaction that is processed through the network," Mr Ogden said. If an authorization is rejected, the customer will immediately be contacted by a call centre as an alternative verification.

My thoughts? This system will not make a flipping difference in regards to limiting the amount of phishing. Nearly all phishing scams are geared towards the least technological savvy people, so harvesting authorization will be no problem. All that would be required is to get a person to "Verify Their Account" on a phishing server, including having a person say numbers 1-9. This would include verifying the account with their Voice authorization , which would be ftp'd to the Phishers records. The recording could be then played using any high grade audio output, thus bypassing the authorization. Yet another biometric meant to keep honest people honest.

Millions of Health Records stolen. Again.

noreply@blogger.com (Gillis57) — Sun, 22 Jun 2008 23:31:00 +0000

And here I am, Sitting at my desk in the middle of a storm, watching twitlive, browsing the internation. What do I come across? Another, Another, Another, Another, Theft of CONFIDENTIAL information. Did the criminal slide in under the cover of darkness, bypass laser security, and swiftly crack into a safe containing a base of backups? Nope, the ever intelligent Network Admin decided to keep the backups in, the back-of his car. Do you want more info on the massacre of confidential information? If you must, read on:

The University of Utah Hospitals & Clinics is currently notifying 2.2 million patients about the theft of medical billing records. On June 2, a box of backup tapes containing patient and guarantors billing records was stolen out of a car belonging to a contracted independent storage company. The tapes contained the personal information on 2.2 million patients and guarantors including patient names, related demographic information and diagnostic codes. In addition, these records contained the Social Security numbers of 1.3 million patients. The Salt Lake County Sheriff’s Department, the FBI and the U.S. Postal Service are investigating the theft. According to Lorris Betz, M.D., Ph.D, Senior Vice President for Health Sciences, University of Utah Hospitals & Clinics is taking aggressive steps to protect patient confidentiality including notifying all 2.2 million individual through postal mail, offering one year of free credit monitoring to those whose SSNs were on the tapes and offering a $1,000 reward for the return of the tapes, no questions asked. The University of Utah Hospitals & Clinics has also setup a hotline - 866-581-3599 - and a web site - healthcare.utah.edu/billingrecordstheft - to help answer any questions and provide more information about the theft.

ALERT: MAC OS-X New Exploits

noreply@blogger.com (Gillis57) — Sat, 21 Jun 2008 00:12:00 +0000

Did you really think your precious Mac was immune? That you were exempt from the Warzone that is the interwebs? Well, unless you have the intelligence of a monkey, this alert doesn't apply. This requires you to actively allow the hacker access, however for easily manipulated clients- you may need to pay heed to this latest alert.

Security vendor SecureMac has discovered multiple variants of a Trojan capable of letting a hacker remotely commandeer a Mac computer.

The malicious code is being distributed from a hacker Web site, where there have been discussions on distributing the Trojan through iChat and LimeWire, said SecureMac, which has given the Trojan a "critical" security rating. The program can infect Mac OS X 10.4 and 10.5 machines.

A Trojan is a program that appears legitimate, but performs illicit activity when it is run, such as stealing passwords, making the system more vulnerable to future entry, or simply destroying programs or data on the hard disk. LimeWire is a popular peer-to-peer file-sharing program, and iChat is Apple's instant messaging client.

Besides offering a hacker remote access to the system, the Trojan discovered by SecureMac can transmit system and user passwords. Additionally, the application can log keystrokes, take pictures with the built-in camera on a Mac, take screenshots, and turn on file sharing.

The program takes advantage of a flaw within the Apple Remote Desktop Agent. The program avoids detection by opening ports in the firewall and turning off system logging.

The Trojan is distributed as AppleScript called Asthtv05 or as an application bundle called Astht_v06. The filed must be downloaded and opened in order to infect a machine.

Malicious code targeting the Mac isn't new. Apple in May released a patch for a serious vulnerability within its iCal calendar application. The flaw made it possible for an attacker to exploit the vulnerability by adding or modifying files on a CalDAV server. The code is distributed as an .ics calendar file in an e-mail attachment, or through a malicious Web site.

Is Windows the Problem?

noreply@blogger.com (Gillis57) — Wed, 18 Jun 2008 19:55:00 +0000

Using virus and malware-laden software used to just be a bad for one's productivity. As it turns out, it can also be a bad idea for one's career.

Michael Fiola, formerly an investigator with the Massachusetts Department of Industrial Accidents, was charged with possession of child pornography. He lost his community's respect, many of his friends, and his family. His crime? He was given a Windows-based laptop that was riddled with vulnerabilities that were or became prey to malware.

An investigation showed he hadn't downloaded the pornography. His computer did:

When the DIA issued Fiola his Dell Latitude laptop in November 2006, it was so badly configured that it may well have already been hacked, said Tami Loehrs, a forensics investigator hired by Fiola's defense team. The Microsoft Systems Management Server software on the laptop was misconfigured and was not receiving critical software updates, and the laptop's Symantec antivirus software was either misconfigured or not working properly, she said.

"He was handed a ticking time bomb," she said.

In this case, it's called Windows. Or, more accurately, an IT department that inflicted a poorly implemented Windows environment on Mr. Fiola. Could this have happened with Linux or the Mac? Yes and maybe. Yes, because weak IT yields weak security. But maybe, because both of these Unix-based systems handle security much better than Windows traditionally has. But that's not really the point.

The real villain here, of course, is the pornography swine that would inflict themselves on unsuspecting users. There are enough losers out there interested in porn to not have to trick them into viewing it or distributing it.

We like to think of our computers as tools. In this case, however, it was Mr. Fiola that became the tool, however unwittingly.

This calls to mind just how critical it is to ensure our systems are secure. If, in fact, Linux or Mac are more secure from this sort of problem (a point that is debatable), then the "low cost" associated with Windows and ease of use must be balanced against the very real problems that can arise from using Windows (or, at least, older versions of Windows).

Did Microsoft create this problem for Mr. Fiola? No. If anything, it sounds like his IT department is to blame. But if it were me, I'd be asking for a Mac when joining a new company. With the Mac, my odds of having a Fiola-esque experience go down dramatically.

New Home Router Hacking Program

noreply@blogger.com (Gillis57) — Wed, 18 Jun 2008 19:29:00 +0000

A newly discovered Trojan in the wild hacks into home wireless routers and changes their DNS settings to point to the attacker’s rogue DNS server. The malware is a new variant of the DNSChanger Trojan that has been circulating around the Internet, according to researchers at Secure Computing who have been studying it.

Home routers make easy prey because many users don’t lock them down, and even use their default passwords for authentication. There’s been plenty of research in this space over the past year, everything from drive-by hacks to botnet infections to DNS rebinding. (See Attackers Use New 'Call-Home' Method to Infiltrate Home Networks and RSA Session Features Live Linksys Router Hack and The Hack Your Home Router Challenge.)

Sven Krasser, director of data mining research for Secure Computing, says the new DNSChanger Trojan attack also indirectly infects any machine that connects to the router. “This is the first time we’ve seen on [a] wide basis that the computing resources of the wireless router are part of the attack,” he says. “It also [affects] machines that are not directly exploited -- ones that are connecting to the router.”

The Trojan executes brute-force attacks on the Web interface of a router that only uses basic authentication -- and it’s mostly going after D-Link and Linksys routers so far, according to Krasser.

Secure Computing says the attackers behind the malware are the infamous Zlob malware authors.

Krasser says the attackers can send a victim to any Website, and most times return the correct site back to the user to evade detection. Other times they redirect a user to their own spoofed pages, he says. He says phishing is a likely goal of the attackers.

He says it’s possible that attackers could kick the attack up a notch and add put their malcode onto the routers, such as zombie code. Secure Computing researchers have posted some screen shots and an analysis of the Trojan in their blog.

Never use default passwords in home routers, Krasser says, and keep it updated.

More Data Stolen

noreply@blogger.com (Gillis57) — Wed, 18 Jun 2008 19:16:00 +0000

Finjan Inc., a leader in secure web gateway products, today announced its discovery of a server controlled by hackers (Crimeserver) containing more than 500Mb of premium
data. The data included healthcare and business related data, as well as
personal identifiable information (stolen Social Security Numbers). This
data is part of the premium offering that the cybercriminals operating the
Crimeservers were selling to the highest bidder online.

The compromised data came from all around the world and contained
information from individuals, businesses, airlines and healthcare
providers. The report contains examples of compromised data that Finjan
found on the Crimeserver, such as:

- Compromised medical related data of hospitals and publicly owned
healthcare providers

- Compromised business related data of a U.S. airline carrier

- Identity theft (stolen Social Security Numbers)

Some of the implications of stolen medical and patient data include:
illegal and/or bogus treatments; obtaining prescription drugs for the
purpose of selling them; loss of health coverage for the victimized
patient; inaccurate records of victimized patients, which could result in
incorrect and potentially harmful treatments. Healthcare providers could
also face potential HIPAA violations or breach of general data protection
legislation.

Finjan's Malicious Code Research Center (MCRC) detected a Crimeserver
operated by cybercriminals who used campaigns to steal data. These
campaigns consisted of highly sophisticated attacks, incorporating
Crimeware toolkits, Trojans and Command and Control (C&C) servers to drive
traffic from a specific region, with specific characteristics.

"This report illustrates the latest development in cybercrime. It shows
the business cycle of data collecting and trading by today's
cybercriminals. Crimeware infecting PCs is a serious business problem that
has far-reaching consequences, such as impacting the security of businesses
and patients around the world," said Yuval Ben-Itzhak, CTO of Finjan. "We
see that cybercriminals go after premium data that they can trade for
substantial profit. The increase in Web-based attacks is staggering.
Industry figures include a growth of more than 200% of Web-based malware,
with an increase of over 800% in backdoor and password-stealing malware,
illustrating that sensitive corporate and medical are at risk."

According to Finjan, the fact that sensitive business, patient and
personal data were compromised in a timeframe of less than one calendar
month underscores the necessity for enterprises and organizations to have a
comprehensive security technology in place that provides effective
protection against these sophisticated threats.

The compromised data and the Crimeserver applications were detected
using Finjan's patented active real-time code inspection technology while
diagnosing users' Web traffic.

I am controlling your PC via Bluetooth.

noreply@blogger.com (Gillis57) — Wed, 11 Jun 2008 17:47:00 +0000

Microsoft's June Patch Tuesday release included a critical fix affecting all Windows Vista and XP systems, which could allow attackers to wirelessly steal confidential information from laptops by exploiting a flaw in the Bluetooth stack.

The Bluetooth stack flaw, detailed in Microsoft bulletin CVE-2008-1453 and rated 'critical', could allow an attacker to take complete control of an affected system, install programs, alter data or create new accounts with full user rights.

The MS08-030 patch modifies the way the Bluetooth stack handles a large number of service description requests.

Microsoft recommends applying the patch immediately and security experts advise users to turn off Bluetooth features until the patch has been applied.

Matthew Aburn, director of security consultancy Halcyon, said the flaw was particularly dangerous because hardware manufacturers usually set the factory default for Bluetooth as 'active'.

"Hardware-wise, most ship with Bluetooth on by default. I'd definitely recommend that if you're not using Bluetooth, you should turn it off," Aburn told ZDNet.com.au.

Rob Pregnall, Symantec's senior manager of Technical Product Management for Endpoint Security in Asia Pacific and Japan, agreed. He said hardware manufacturers should do this to make those features easier to access.

"When I look at a freshly bought machine from a reputable manufacturer, the first thing I notice is that every bell and whistle is turned on. I see it across different hardware manufacturers, including Macs," he said.

"All the different communication technologies are generally activated, so I think it's a move by manufacturers to ensure that everything is turned on so that minimal effort is needed to use the capabilities that users were sold on," Pregnall said.

In a blog, Microsoft admits that although in most cases an attacker would need to be in close range to exploit the vulnerability, there are ways to increase that distance.

"The standard range of Bluetooth is in the order of metres, although an attacker could use specialised antennas to increase this," the blog said.

This was backed up by Halcyon's Aburn.

"People look at the standard specifications for Bluetooth range of connectivity, which says you need to be so many metres away but using a directional antenna, people can target you from much further away," he said.

This month's Patch Tuesday includes fixes for a drive-by download weakness in Internet Explorer, as well as flaws in affecting Microsoft's multimedia.

The critical vulnerability affecting Internet Explorer described in CVE-2008-1442 and CVE-2008-1544 only affects Windows XP and Vista systems. The MS08-031 cumulative patch fixes a couple of vulnerabilities, including one that could allow remote code execution if a user viewed a specially crafted web page using Internet Explorer and another which could allow information disclosure if a similarly configured page was viewed using the browser.

The DirectX flaws affects all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. This update addresses the vulnerability detailed in CVE-2008-0011 and CVE-2008-1444. Microsoft says the vulnerability "could allow remote code execution if a user opens a specially crafted media file. An attacker who successfully exploited either of these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."

Students Hack Windows Cardspace

noreply@blogger.com (Gillis57) — Mon, 09 Jun 2008 00:11:00 +0000

Students at the Ruhr University of Bochum, Germany, say they have found a way to steal security tokens in Microsoft's new CardSpace authentication framework. Attackers can apparently get access to protected, encrypted user data – such as passwords, credit card numbers, and delivery addresses – when they are transmitted. CardSpace (formerly InfoCard) is the successor to Passport. In both architectures, users' personal data are stored locally on the user's system. Depending on the web site, users can decide which data they want to transmit. CardSpace is designed to make classic passwords a thing of the past, by replacing them with digital certificates that may be self-signed or signed by an authoritative CA such as Verisign.

According to the report, anti-DNS pinning, DNS rebinding, DNS spoofing, and drive-by pharming are apparently all successful ways to steal transmitted tokens. Attackers basically need to manipulate the user system's name resolution so that the token for the browser-based CardSpace is sent to the attacker. To this end, attackers manipulate the DNS entries on a router, for instance by means of cross-site request forgery, and send the attacked user to a malicious name server. If the attacker manages to switch name resolution during an authentication process so that the victim lands both on a shop's genuine CardSpace website and on a malicious forgery, the attacker then gets the token. During the token's validity, attackers can then pretend to be the user in question when they go shopping.

The students have created a demo server that they claim demonstrates the problem. To reproduce the demonstration, you should change your own DNS settings and install an untrusted certificate. In our test at heise Security, we could not get the demonstration to run, however. Microsoft has apparently already been informed of the problem and is working on a solution. In their report, the students propose improving Same Origin Policy as a security function for browsers.

The Social Butterfly

noreply@blogger.com (Gillis57) — Sun, 08 Jun 2008 22:45:00 +0000

In a world ripe with social networking sites such as Myspace, Facebook, LinkedIn, or any of the other 550,000 different sites allowing you to connect with people you are already friends with, there is bound to be a shady element. That underworld of exploitation, manipulation, and incredible social aptitude. Wait what?

Welcome to the world of the over-friendly and ‘single-minded' Trojan. Single-minded, as it seems to be inviting people to the site and start networking. A Trojan is a programme that appears to be desirable (like a free downloadable game or screen saver), but contains viruses or worms (self-replicating viruses) that can create havoc with the PC and the network.

However, in the case of these social networking sites, the Trojans that plant themselves on the users' computers and send invites to all mail IDs saved in the contact list, are harmless. The Trojan embeds itself in the user's computer when he/she logs on to a social networking site and sends invites to all listed in the contact list.

The receiver – believing it to be from a genuine friend – accepts the invitations and becomes a member of the social networking site. The sites use this to increase their membership, while hackers use the technique for their phishing attempts.

They do not crash the PC nor the network, an IT specialist with a leading BPO notes. But they sure can mar friendships, relationships or even lead to unwanted and unsolicited networking.

Internet Service Providers Association of India (ISPAI) president Rajesh Chharia says, "Even though these programmes only send spam and are quite harmless, at times it can lead to embarrassing situations".

"As most of these social networking sites are used for business networking and friendship, it is not possible for Internet Service Providers (ISPs) to block these sites. The best option is to put in good firewalls at the user's level," he said.
So the next time you log on to a social networking site, an invitation to join the site has gone to your super boss on your behalf. But without your knowledge!

MICROSOFT SCAMS AGAIN!

noreply@blogger.com (Gillis57) — Sat, 07 Jun 2008 18:56:00 +0000

Businesses that skip Windows Vista and upgrade their computers directly from the XP operating system to Windows 7 could expose themselves to security risks and other problems, Microsoft says in a new white paper.

Bypassing Vista could have "implications for security, support, and regulatory compliance and reduce flexibility in the face of changing business requirements," writes Microsoft VP Mike Nash, in the paper.Specifically, Nash says that businesses that wait for Windows 7 -- set for release in late 2009 or early 2010 -- to upgrade from XP could find themselves using outdated applications that don't employ proper security safeguards or are no longer supported.

They also won't get the advantage of new security technologies and other improvements that Microsoft embedded in Vista, Nash says. "By not deploying Windows Vista, it means missing out on the proven benefits such as better security, productivity, search, mobility, manageability and infrastructure optimization," Nash says in the paper, which is titled "The Business Value Of Windows Vista."

Do you remember any similar pushes with previous operating systems? This could possibly be because of the absolute travesty that is Vista security, that has kept so many large businesses from switching to the operating system. After such an outcry from the IT community and backlash against their prettiest operating system, Microsoft has decided to switch their tactics from marketing to George Bush-esque "strategertizing". Overheard in a consultation, "OH so you don't want to upgrade to Vista? If you don't You will never be able to Upgrade again!!!" Basically they are trying to tell you that if you don't upgrade to Vista, You can't upgrade to 7. And you can bet that the software of 7 wont allow a install from XP. And will most likely have a discount upgrade to Vista. 49.99 so that you can upgrade to vista so that you can upgrade to 7 (It's a steal!!!)

British Beauty Queen Hijacked!

noreply@blogger.com (Gillis57) — Sat, 07 Jun 2008 17:22:00 +0000

Am I being a little sensationalistic? I may be, however no one ever said that Beauty Queens were the brightest of the bunch. Cases like this are why I suggest that people be required to have a driver's license for the Internet.

Miss Scarborough has become the latest victim of online phishing fraudsters, with the the beauty contest winner having had £10,000 stolen from her bank account.

Jade Saunders, a 20-year-old student, was crowned Miss Scarborough in April this year, and is also a semi-finalist for Miss England 2008.

Saunders reportedly clicked on a link in an e-mail purporting to be from her bank, which took her to a genuine-looking, but fake, website. By entering her security log-in details on the fake site, Saunders provided the cybercriminals with all they needed to set up a standing order on her account for £10,000.

Alright, Here are a few checkpoints upon receiving an email from a seemingly legitimate source

[] IS IT FROM A LEGITIMATE SOURCE? LEGIT COMPANIES DO NOT USE FREE EMAIL ACCOUNTS
(Free Emails such as Yahoo, Hotmail, Gmail)
[] IS THE EMAIL GRAMMATICALLY INCORRECT
(Legit Companies typically don't spell words improperly)
[] IS THE EMAIL UNFORMATTED? (i.e No breaks, Paragraphs, Letterhead, Etc.)
(Companies will usually use some sort of professional formatting)
[] IS EMAIL STATING THAT YOU MUST ENTER PERSONAL INFORMATION?
(Companies do not ask for Passwords, SS #'s, or Bank Info)
[] DOES THE EMAIL STATE THAT CHARGES ARE BEING MADE TO YOUR ACCOUNT?
(If so, contact the companies customer support phone number immediately)
[] IS THERE A LINK? If you have checkmarks above, DO NOT CLICK!
(If so, hover your mouse over the link and a box will come up and say where it goes. If it Is not the company's website- Do Not Click!)

IF the email makes you feel uneasy at all, in general, don't click anything at all.
When you enter information on a phisher's website, he has all the information to take out a line of credit, transfer funds, or do any number of other unscrupulous things. Companies will not ask you to enter information in order to verify anything, and if you do recieve such an email- be sure to immediately contact the company in question on the phone support line.

BE SAFE ONLINE! IF NOT, YOU MAY SUFFER BIG LOSS IN THE REAL WORLD.

ALERT: IS YOUR VOTE COMPROMISED?

noreply@blogger.com (Gillis57) — Sat, 07 Jun 2008 03:51:00 +0000

Despite millions of calls to switch back to strictly paper ballots, lawmakers have still not heeded the calls and warnings of computer experts. It came to my attention this friday that in Pinellas County, Florida- A duo of viruses were introduced to the network of ballot stations, bringing into question the validity of the vote.

Two pieces of malicious software were recently discovered on voting stations across Pinellas County.The two bugs, known as Flush.G and W32.SillyDC, work in tandem and go from computer to computer redirecting Internet browsers to sites the user hasn't selected, officials said. The worm is carried through removable media like USB drives, is easily detected and, officials say, rather harmless.

Pinellas Deputy Supervisor of Elections Rick Becker said the worm isn't the kind of Trojan horse that would be used to corrupt a computer voting system and was unsure just where it came from.

Many E-Voting companies love to market the security of their products, stating that since they are not connected to an external internet, that they are exempt from exploitation. However, a proof of concept attack was done by Princeton students against the DieBold voting machines. In this attack, they introduced a virus which self-propogated throughout the systems and switched votes from candidate A or candidate B, and gave them to candidate C.

Are you tired of feeling like your vote doesn't matter? Write to your state or local congressman and encourage them to switch to strictly paper voting.

University Students Scammed- Is your info secure?

noreply@blogger.com (Gillis57) — Wed, 04 Jun 2008 22:23:00 +0000

A data breach at United Healthcare Services Inc. has led to a rash of identity-theft crimes at the University of California, Irvine.

So far, Nearly 155 medical students have had their information stolen. The attackers stole the social security numbers stolen from an internal database. This breach affects nearly 1300 students, putting them at risk for Credit Card fraud as well as Tax scams. So far, the spammers have stolen 155 students Tax returns.

"In February, the police began getting reports from graduate students that when they filed their income tax returns, they were being told that their returns had already been filed using their Social Security numbers," she said.

So all that the attacker needed was a simple set of numbers, and they took students for hundreds, even thousands of dollars. All because of crappy security measures.

This is why people, This is why.

Checklist To ask your school IT Department
[] What security measures do you have in place for physical IT Infrastructre?
[] What security measures are in place to ensure the confidentiality of my information
[] If there is a unapproved access of my information- How promptly will I be notified?
[] Do you have set guidelines for partners of the university to follow in virtual exchanges?
[] WHO has access to my information and WHEN/WHY can they access it?

HP Support Hacked! UPGRADE NOW!

noreply@blogger.com (Gillis57) — Wed, 04 Jun 2008 21:24:00 +0000

A customer support application that comes bundled with HP PCs have been found to harbour multiple security vulnerabilities.

The pre-installed software is designed to make it easy for users to keep drivers and HP software automatically updated. But flaws in ActiveX components within HP Instant Support give rise to multiple vulnerabilties that lend themselves to drive-by download malware attacks in cases where Windows users running the vulnerable software stray onto insecure or hacker controlled websites, CSIS Security Group warns.

HP Instant Support HPISDataManager.dll version 1.0.0.22 and earlier are vulnerable. Users need to upgrade to version 1.0.0.24 as explained in a security bulletin from HP here.

A CSIS advisory containing proof of concept demos of the flaws can be found here. And there's an easy to digest bit from Secunia here.

It's not the first trouble HP has had with rogue ActiveX controls in its pre-installed utilities. In December last year two ActiveX bugs created a mechanism for hackers to either thrash or inject hostile code onto HP PCs running either HP Software Update or HP Info Center, respectively.