Hacking, Security & Privacy - Page 53

The times are changing and what better way to illustrate this than by telling you how many cyber attacks the Navy sees every hour? The number, by the way, is 110,000, at least according to HP. HP should know, too, as they run the Navy Marine Corps Intranet (NMCI) and protect it from intruders.

The HP's Discover event in Frankfurt, Mike Nefkens, head of enterprise services at HP, told V3, "For the US Navy we provide the network for 800,000 men and woman in 2,000 locations around the world, protecting them against 110,000 cyber attacks every hour. This means the attacks average out at about 1,833 per minute or 30 every second."

Wow. Let me grab a calculator. 24 * 365 * 110,000 = 963,600,000. That works out to 963 million attacks every year. That's an incredible number and really illustrates that our nation needs to secure its IT infrastructure more than anything else.

UK citizen Gary McKinnon hacked NASA, the US Army and US Navy systems to the point of effectively crippling the entire US Army's Military District of Washington network. This attack had their systems down for 24 hours and affected over 2000 computers across many states.

At the same time, he gained access to a US Army server which was responsible for managing 2455 accounts, causing the systems to reboot and become inoperable. McKinnon hacked these systems over ten years ago, and has British officials refusing to send the hacker overseas due to concerns he may commit suicide, based on evaluations of McKinnon who suffers from Asperger's Syndrome and "depressive illness".

Because McKinnon's sentence is estimated at 60 years, mixed with his depressive illness, this is something the UK officials are saying will force McKinnon to take matters into his own hands. It has gone as far as making the UK push this as a matter of human rights.

More proof of cyber espionage has surfaced with the discovery of miniFlame, a virus that is small and highly flexible. miniFlame is designed to control systems and steal data and was originally discovered in July 2012. When first discovered, it was thought that the virus was simply a module for the Flame virus.

However, further analysis has shown that the "module" is actually an "interoperable tool that could be used as an independent malicious program, or concurrently as plug-in for both the Flame and Gauss malware." Kaspersky research suggests that there were several versions built during 2010 and 2011, some of which are still on infected machines.

The main findings:

US Secretary of Defense, Leon Panetta, has earned of cybersecurity on Thursday during a speech that the agency is aware of foreign hackers that have remotely gained access to control systems for vital American infrastructure. Examples of this would be chemical, electricity and water plants.

Panetta stated:

Panetta also warned of recent cyberattacks on US financial institutions have been "unprecedented" in both their scale, and speed. If you're a reader of our site, you might remember us reporting in August that the world's largest oil company, Saudi Aramco, were cyber-attacked.

Users of the popular video chat and messaging application Skype are being targeted by a round of ransomware and click fraud that is being sent around as a message from contacts. The message reads "lol is this your new profile pic?" and is then followed by a link. The link downloads a zip file, which contains an executable that infects the system.

The executable opens up a Java exploit using BlackHole 2.0. The system is then locked down via the ransomware and displays a message requesting money. GFI, the company that first reported this latest wave, explains how it works:

The ransomware also simulates legitimate clicks on websites and such to generate ad revenue for the creators of the ransomware. Not only are you having to pay to unlock the system, but your computer generates money for the creators even if you don't pay up. Microsoft has responded to the issue:

We're here again, with another exploit to watch out - this time with security researcher Adam Gowdiak discovering a new zero-day vulnerability in Java. This new bug is said to be in currently-supported versions of Java, such as Java 5, Java 6, and Java 7 and has the ability to allow attackers to install malware on close to 1 billion systems (based on the installation numbers from Oracle themselves).

This exploit affects both Macs and PCs, meaning that any Java-powered PC is at risk. Right now, the exploit doesn't pose much threat to the general public, but Gowdiak who is known for finding similar issues within Java, has said that he isn't currently aware of any active attacks that exploit this particular vulnerability.

Gowdiak found the exploit last week and has spent the last few days testing a proof-of-concept before he revealed the exploit to Oracle. Oracle has since confirmed that the vulnerability with Gowdisk, and have said that it will be fixed in a future security update. Oracle haven't given a date on when this update will be pushed out, but the next scheduled update is a while way - October 16.

A member of Anonymous has claimed responsibility for the hacking of GoDaddy today, which has affected sites across the web. GoDaddy's site has been down today, along with sites hosted with the service. Other sites that use GoDaddy for DNS or other services have also been affected, though not all are down for everyone.

GoDaddy has acknowledged the problem with a Tweet:

@AnonymousOwn3r has Tweeted the following, taking credit for the attack:

A new leak has shown up on Pastbin. This latest showing comes from AntiSec and contains a list over 1 million Apple UDIDs, allegedly taken from a list of over 12 million that was on an FBI laptop. The UDIDs were supposedly in the file with other personally identifiable information such as zip codes, names, and other data, but that has been stripped out for the leak.

The file, according to the Pastebin post, came from the Dell laptop of Supervisor Special Agent Christopher K. Stangl which was exploited by a Java exploit back in March 2012. The details of the hack, along with information on how to get the data is available on Pastebin. Several tools have popped up to check if your UDID is on the list.

It really begs the question why the FBI would have this data. These UDID numbers are more likely to be on an app developer's PC as a customer list as they are used for push notifications. The implications of them being taken from the FBI, if this turns out to be true, are not fully known. They could be there to be tracked, or for a variety of other reasons.

A new vulnerability has been found in the latest version of Java. The vulnerability is a rather massive hole and users with Java installed in their browser should likely disable it right now to prevent themselves from being infected. Have I scared you enough? But wait, I haven't even told you the problem!

The new security hole allows malicious people to break into users' computers and install nasty malware and viruses. This security hole fits into a category of security flaws known as a "zero-day" threat because it is the first time it has been found. Due to this, there currently exists no way to fix the problem or defend against it, other than disabling Java.

The vulnerabilities were actually found back in April, according to a few sources, and they reportedly told Oracle about the problem. However, Oracle had decided to hold off until the October patch release date to do anything about them. Now, the vulnerabilities have been integrated into BlackHole, a hacking tool.

Google have announced the second Pwnium hacking competition after widthdrawning from this TippingPoint's annual Pwn2Own which was previously held back in February. Google have thrown $2 million in rewards for anyone who can find bugs in their popular Chrome browser, exploit them and detail how they achieved the hack.

The first Pwnium that was held in March, in Vancouver, only had $1 million up for grabs, and only a slice of that was handed out. This was because there were only two submissions, requiring Google to sign over just $120,000 of the $1 million they had up for grabs. So, what are Google offering? $60,000 for a full Chrome exploit using only bugs found in the web browser itself. $50,000 for a partial Chrome exploit using Chrome itself, or other browser, or Windows flaws such as Webkit or kernel-level flaws.

Finally, $40,000 for a non-Chrome exploit for a bug found in Flash, Windows or a driver. In addition incomplete or unreliable exploits may be eligible for a prize, where Google have said "our rewards panel will judge any such works as generously as we can". Sounds like Google just want to give money away! Rules have changed from the annual Pwn2Own hacking competition, with TippingPoint no longer requiring entrants to reveal all the details about exploits used to compromise security. Google has said that this change is "worrisome" and decided to leave the competition, promoting their own Pwnium challenge instead.

Saudi Aramco, who has the title of the world's largest oil company, has been struck by a cyber attack. The company has reported that nearly all of their workstations have been hit by malware, and the breach is said to be similar to the attack on Iranian systems back in Apri, but oil-production industrial equipment was not affected.

Saudi Aramco have said they've disconnected their entire network from the Internet as a precautionary measure, and expect a full recovery of their systems before the end of the week. The oil company hasn't said who is involved, but have insisted that the production of oil has not been altered as a result of the breach. The company said in a statement:

There are other networks connected to the Aramco system, with companies Chevron and Schlumberger Ltd attached, and vulnerable. Most of the oil industry companies across the world have moved over to Windows-based systems during the Y2K scare, and could face similar problems. Also, the rapid expansion of Internet connectivity mixed with the nature of Windows has increased the chances of a cyber attack to the energy industry.

Malware is bad. It's created by people who want to cause you trouble or steal your information. It's a fact of life that Windows will always be a target of malware, but how about Android? It seems as more hackers and scammers are now targeting the mobile operating system with varying degrees of success.

In the second quarter of 2012, Kaspersky Labs found that the number of malware out there targeting Android has tripled. Likely this is the result of an increased number of Android phones giving malicious programmers a wider base to attack. This is the same reason so many different malwares are written for Windows.

During the three months that make up the second quarter, the number of new malware increased to nearly 15,000. 49 percent of the malware were multi-functional Trojans designed to steal data such as contact names, phone numbers, and e-mails. 25 percent were SMS Trojans which send texts to premium numbers to gain money for the programmer.

This is something that I've read with great interest, and to anyone who has seen the TV show "Person of Interest", you'll understand that these types of systems are not just fiction, but they can be used for wrong-doing, too.

Last week, WikiLeaks talked of, and released internal documents and e-mails by hackers regarding TrapWire. TrapWire is a privately-owned surveillance technology that is used by various private and public agencies. TrapWire seems to work by collecting surveillance data from 'participating' private and public sources, such as CCTV cameras.

The data is then poured into the system, where TrapWire can analyze the data, detecting changes in patterns such as noticing a certain vehicle is not on its usual morning commute to work, which can then be looked at as 'suspicious behavior'. The technology is owned by Abraxas, who were eventually acquired by Cubic. In 2005, Abraxas Corp. CEO Richard Hollis talked about TrapWire:

The developer behind successful titles such as the recently released Diablo III, and World of Warcraft, oh I suppose we can't leave out StarCraft, has posted an "important security update" to its official website. Blizzard have announced that their security team found an "unauthorized and illegal access into our internal network here at Blizzard".

The developer quickly took appropriate steps to close off access, and started working with law enforcement and security experts to investigate into the matter. At the moment, Blizzard have found no evidence that financial information (such as credit card details) or billing details and real names were compromised. Blizzard's investigation is ongoing, but there's nothing suggesting that these pieces of information were accessed.

What was accessed, were lists of email addresses for global Battle.net users, outside of China. This mens that players on North American-based servers, such as North America, Latin America, Australia, New Zealand, and Southeast Asia had their personal security question, and information regarding to Mobile and Dial-In Authenticators were accessed. Blizzard have noted that based on what they currently know, this information is not enough for anyone to access Battle.net accounts.

And so they should. After having the joy of a daisy-changed hack, Mat Honan has been keeping the tech world up-to-date on the going ons of the recent hack over at Apple, and what companies are doing to make sure that it doesn't happen to anyone else.

Apple have improved their services, issuing a 24-hour ban on calling Apple support to change your Apple ID password. Honan's hack involved some social engineering, meaning that a hacker actually made a voice call, setting up accounts pretending to be him. Wired reported on the ban, saying:

What are Apple's new security protocols in order to reset your password over the phone? Mat has said via Twitter:

It's a sad reality that there's always someone trying to break into Windows. This is due to the wide use that Windows has over other operating systems. Even before the official release, people are doing their best to break into Microsoft's upcoming Windows 8, and sadly, they've found three exploits to do just that.

With three months left before the actual release of Windows 8, Microsoft has time to take care of these exploits that have been found. Sung-Ting Tsai of Trend Micro is the person who found the exploits, so he's helping Microsoft patch them rather than working on exploiting them for nefarious reasons.

The exploits are in the kernel level advanced local procedure call, the component object model (COM) application programming interface, and the Windows Runtime API. Tsai worked on several methods to attack the vulnerabilities, and while he wasn't completely successful, he says that someone with enough time could find a way to compromise the system.

Earlier today, stories were hitting the web that Ubisoft's DRM installed a browser plug-in that contained a backdoor. Ubisoft acted quickly and has released a patch to fix the security hole as it turns out that the backdoor was an accident and was in no way meant to be there, or at least not exploitable as it was.

Tavis Ormandy, a Google security engineer, found the backdoor and wrote about it on the Seclists.org mailing list on Sunday. Mr. Ormandy went as far as to post a few lines of Javascript as an untested proof of concept. This morning, the story made it onto Hacker News along with a working proof of concept.

The list of games which come with Uplay, and the vulnerability, are as follows:

Apple have been hit again, with security firm Intego and their virus team identifying yet another Trojan horse that attacks Apple's Mac platform. The new Trojan called "Crisis", hasn't been seen in the wild yet, but Intego says that the Trojan is engineered to make analysis of the malware difficult for security experts.

Intego have stressed alertness regarding Crisis, as it appears to be quite smart, having the ability to bypass OS X security features and install itself, all without any user interaction.

Crisis has been tracked, back to the IP address of 176.58.100.37, which it then calls back to every five minutes for instructions. There's only two OS X versions that are said to be susceptible to Crisis, OS X 10.6 and 10.7. Crisis can install and run itself without the need for the user to enter in their password. It's also resistant to reboots, and will run until it is detected and removed.

A word of warning to our readers: next time you check into a hotel room, realize you're probably not the only one that can get in. Take a moment to run your fingers along the bottom of the keycard lock and check for a power port. If you find one, it means a hacker with a couple of cheap hardware parts could gain access to your room without leaving a trace.

24-year-old Mozilla software developer and self-described hacker Cody Brocious has issued this warning after he found the vulnerability while reverse engineering Onity-manufactured locks. By connecting $50 in hardware to the DC port, the door will supposedly unlock and provide access. However, in practice, it's not quite that reliable.

While demonstrating it to a Forbe's journalist, it only worked on one of the three doors they tried and only on the second try after Brocious tweaked his software. Still, with a bit of time, a hacker could perfect the software and technique and somewhere around 4 million doors would immediately be able to be opened.

We've seen some serious hacking over the last few years, with the last notable tech-related hack being Sony, but now Yahoo! have joined the ranks of victims being hit. Yahoo! confirmed that it had the usernames, and passwords of over 400,000 accounts stolen from its servers earlier this week, and that data from these accounts were posted online briefly.

The data has since been yanked offline, but it turns out that it wasn't just for Yahoo! accounts, as Gmail, AOL, Hotmail, Comcast, MSN, SBC Global, Verizon, BellSouth and Live.com login info was also taken on the day and placed online. Those who hacked the servers said that they did it simply to show Yahoo! the weaknesses in their security software, elaborating:

Yahoo!'s response was that they had a fix for the vulnerability coming soon, and that the investigation is ongoing and its systems has yet to be fully secured. Yahoo! apologizes for the breach, and are advising users to change their passwords immediately.