Hacking, Security & Privacy News - Page 97

Earlier today, stories were hitting the web that Ubisoft's DRM installed a browser plug-in that contained a backdoor. Ubisoft acted quickly and has released a patch to fix the security hole as it turns out that the backdoor was an accident and was in no way meant to be there, or at least not exploitable as it was.

Tavis Ormandy, a Google security engineer, found the backdoor and wrote about it on the Seclists.org mailing list on Sunday. Mr. Ormandy went as far as to post a few lines of Javascript as an untested proof of concept. This morning, the story made it onto Hacker News along with a working proof of concept.

The list of games which come with Uplay, and the vulnerability, are as follows:

Apple have been hit again, with security firm Intego and their virus team identifying yet another Trojan horse that attacks Apple's Mac platform. The new Trojan called "Crisis", hasn't been seen in the wild yet, but Intego says that the Trojan is engineered to make analysis of the malware difficult for security experts.

Intego have stressed alertness regarding Crisis, as it appears to be quite smart, having the ability to bypass OS X security features and install itself, all without any user interaction.

Crisis has been tracked, back to the IP address of 176.58.100.37, which it then calls back to every five minutes for instructions. There's only two OS X versions that are said to be susceptible to Crisis, OS X 10.6 and 10.7. Crisis can install and run itself without the need for the user to enter in their password. It's also resistant to reboots, and will run until it is detected and removed.

A word of warning to our readers: next time you check into a hotel room, realize you're probably not the only one that can get in. Take a moment to run your fingers along the bottom of the keycard lock and check for a power port. If you find one, it means a hacker with a couple of cheap hardware parts could gain access to your room without leaving a trace.

24-year-old Mozilla software developer and self-described hacker Cody Brocious has issued this warning after he found the vulnerability while reverse engineering Onity-manufactured locks. By connecting $50 in hardware to the DC port, the door will supposedly unlock and provide access. However, in practice, it's not quite that reliable.

While demonstrating it to a Forbe's journalist, it only worked on one of the three doors they tried and only on the second try after Brocious tweaked his software. Still, with a bit of time, a hacker could perfect the software and technique and somewhere around 4 million doors would immediately be able to be opened.

We've seen some serious hacking over the last few years, with the last notable tech-related hack being Sony, but now Yahoo! have joined the ranks of victims being hit. Yahoo! confirmed that it had the usernames, and passwords of over 400,000 accounts stolen from its servers earlier this week, and that data from these accounts were posted online briefly.

The data has since been yanked offline, but it turns out that it wasn't just for Yahoo! accounts, as Gmail, AOL, Hotmail, Comcast, MSN, SBC Global, Verizon, BellSouth and Live.com login info was also taken on the day and placed online. Those who hacked the servers said that they did it simply to show Yahoo! the weaknesses in their security software, elaborating:

We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat. There have been many security holes exploited in Web servers belonging to Yahoo Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage.

Spam e-mail is nothing new. Most users have figured out ways to combat it either through the use of spam boxes or spam blockers on the e-mail servers themselves. This spam is traditionally sent out via compromised computers that have been pulled together into a botnet. The botnet can be ordered to do whatever nefarious activities its commander wants.

With Windows becoming more secure, however, it has been harder for hackers to gain these computers for botnets. Terry Zink of Terry Zink's Cyber Security Blog on the MSDN noticed something interesting about the spam he has been receiving lately. At the bottom of the message it says "Sent from Yahoo! Mail on Android."

Furthermore, he examined the headers of the e-mail and found "Message-ID: 1341147286.19774.androidMobile(at)web140302.mail.bf1.yahoo.com" I'm sure you can see where this is going. A spammer somewhere has a botnet that lives on Android devices, much like the rumors we've all heard. What's even more interesting is where these devices are located.

Once again, Apple's OS X is being confronted with a security risk. The latest backdoor has been discovered by Russian security firm Kaspersky Labs and is being used as part of a Advanced Persistent Threat campaign. This is just the latest in a series of security risks present in the Mac OS X operating system.

Kaspersky researchers found that Uyghur activists in China were being targeted by hackers. These hackers sent e-mails with a compromised attachment that was in the form of a JPEG. The code hidden inside the JPEG was a new form of the MaControl backdoor and is compatible with both the PowerPC and i386 Mac variants.

Costin Raiu, Director of Global Research & Analysis at Kaspersky Lab:

In case you needed more examples of why the United States needs to focus on cyber security, take a look at a virus discovered in Peru. "ACAD/Medre.A" is a virus that is committing espionage by sending blueprints to China from companies in Peru. It has already stolen tens of thousands of blueprints, according to ESET.

The virus targeted the software AutoCAD which is a primary tool used by industrial designers and architects. It is believed the virus was first distributed to Peruvian companies through the use of an AutoCAD template given to public bodies. The virus was detected several months ago but has just seen a spike in usage.

The virus sends back blueprints to e-mail accounts provided by two Chinese internet firms, 163.com and qq.com. However, this doesn't prove China or the Chinese were behind the virus. What it does prove is that companies and governments alike need to strengthen their cyber security measures to prevent things like this from happening.

Flame, a highly sophisticated virus that was first discovered in Iranian oil refineries, and is supposedly the result of a U.S. and Israel joint effort to slow down Iran's nuclear program, reports The Washington Post. The information comes from multiple Western officials who purportedly have knowledge of the project, but of course want to remain anonymous.

This shouldn't come as a surprise considering the U.S. were unveiled as using the volatile Stuxnet virus, where The New York Times reported about Operation: Olympic Games, which is a project that used Stuxnet and Duqu, both sophisticated viruses. These viruses targeted Iranian SCADA systems, that allowed the creators of this virus to gather intelligence and even control aspects of Iran's nuclear and oil refining facilities.

Stuxnet code has been found within the Flame virus, according to security researchers, which is an unofficial confirmation that the creators of the Stuxnet virus (the U.S. government) are also behind this new nasty virus. Once this was discovered, in Get Smart fashion, the virus began to self-destruct, hastily removing itself from infected computers... not suss, huh?

LulzSec, a hacking group responsible for many hacks last year, has been fairly quiet this year after their leader allegedly worked with law enforcement to bring charges against its members. Now, however, LulzSec Reborn has taken over and started hacking, mainly compromising user accounts and leaking the details.

LulzSec Reborn has had two major hacks this year and otherwise has been quiet. The first was a leaking of 170,000 MilitarySingles accounts on Pastebin and now they are taking responsibility for the leaking of 10,000 Twitter accounts on Pastebin. The latter, today's leak, features much more information than a traditional password hack.

The leak comes in the form of an SQL dump which features usernames, passwords, real names, bios, locations, avatars, security tokens used by the service for authentication with Twitter and the user's most recent Tweet. The hack comes from compromising a third-party site that required the login information to work.

A new discovery has been made by a Cambridge University researcher that a chip used by the US military features a security backdoor which could have massive implications on on national security. The chip, which was built in China, cannot simply be reprogrammed as the security backdoor is physically present on the silicon.

Sergei Skorobogatov of Quo Vadis Labs at Cambridge University said:

Our aim was to perform advanced code breaking and to see if there were any unexpected features on the (US Military) chip. We scanned the silicon chip in an affordable time and found a previously unknown backdoor inserted by the manufacturer. This backdoor has a key, which we were able to extract. If you use this key you can disable the chip or reprogram it at will, even if locked by the user with their own key. This particular chip is prevalent in many systems from weapons, nuclear power plants to public transport. In other words, this backdoor access could be turned into an advanced Stuxnet weapon to attack potentially millions of systems. The scale and range of possible attacks has huge implications for National Security and public infrastructure.