Tag Archives: context

[ISN] Brit infosec bod finds Kaseya ‘master admin’ remote code exec holes

http://www.theregister.co.uk/2015/09/24/brit_infosec_bod_finds_kaseya_master_admin_remote_code_exec_holes/ By Darren Pauli The Register 24 Sep 2015 Three remote code execution and privilege escalation flaws have been reported in the Kaseya IT management software which when chained enable unauthenticated attackers to gain ‘master admin’ status. The remote upload holes reported by British Agile Information Security bod Pedro Ribeiro and since patched allow attackers to upload arbitrary code to Kaseya Virtual System Administrator. Any net crim can exploit words one vulnerability (CVE-2015-6922) to upload and execute arbitrary code on the server under the context of IIS. That flaw rated a severity score of 7.5 exists within the uploader.aspx page which fails to enforce authentication and does not restrict destination file paths. A privilege escalation flaw in the same feature and also rated 7.5 uin severity will make attackers ‘master admins’. […]




Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] No, the CIA isn’t stealing Apple’s secrets

http://blog.erratasec.com/2015/03/no-cia-isnt-stealing-apples-secrets.html By Robert Graham blog.erratasec.com March 10, 2015 The Intercept news site by Glenn Greenwald is activism rather than journalism. Their stories don’t reference experts knowledgeable about subjects, but only activists who are concerned about the subjects. This was demonstrated yet against in their piece claiming “The CIA Campaign to Steal Apple’s Secrets”. Yes, the Snowden documents are real, but pretty much everything else is made up. Here’s the deal. Terrorist leaders use iPhones. They are a status symbol, and status symbols are important to leaders. Moreover, since Apple’s security is actually pretty good, terrorists use the phones for good reason (most Android devices suck at security, even the Blackphone). Getting software onto terrorist’s phones, or basebands, is an important goal of intelligence. When CIA drones bomb a terrorist compound, iPhones will be found among the bodies. Or, when there is a terrorist suspect coming out of a dance club in Karachi, a CIA agent may punch them in the face and run away with their phone. However, it happens, the CIA gets phones and wants to decrypt them. Back in 2011 when this conference happened, the process of decrypting retrieved iPhones was time consuming (months), destructive, and didn’t always work. The context of the presentation wasn’t that they wanted to secretly spy on everyone’s phones. The context was that they wanted to decrypt the phones they were getting. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Government Cybersecurity Research Explores Technological, Human Capabilities

http://www.afcea.org/content/?q=government-cybersecurity-research-explores-technological-human-capabilities-0 By Robert K. Ackerman AFCEA Signal March 1, 2015 Challenges ranging from teaching people new ways of learning languages to providing security for homemade computer chips head the priority list for researchers at the National Security Agency. The exponential expansion of technology capabilities is perhaps matched by the growth of potential conflict areas, and both are increasing the issues faced by the agency’s research community. Traditional skills such as translating communications intercepts now must take into account that any one of thousands of languages spoken on Earth could be vital if a new trouble spot flares up. The ubiquity of networked devices, especially in the context of the emerging Internet of Things, provides its own unique cybersecurity challenges. And, the near future may see individuals making chips at home for their own customized communications devices, which also would need to be secured. These are some of the tasks facing Dr. Deborah A. Frincke, director of research at the National Security Agency/Central Security Service (NSA/CSS). Frincke points out that hers is the only group within the intelligence community that has a large body of long-, medium- and short-term research. In addition to conducting contract research with academia and industry, it also has a sizeable investment in long-term staff. “We have a very large body of professional researchers who have spent their entire careers here and also those we hire more later [in their] careers … and that is unique,” she offers. “We don’t see that elsewhere—that investment in a long-term body of internal researchers.” This institutional knowledge provides a significant advantage, she continues. With the research directorate inside the agency, it “sits right at the table’ with the senior leaders of the agency. Leadership hears about technological advances at the same time it is learning about worldwide issues, she points out, which enables real-time coordination of research with mission needs. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Cloud security remains a barrier for CIOs across Europe

http://www.computerweekly.com/news/2240236318/Cloud-security-remains-a-barrier-for-CIOs-across-Europe By Cliff Saran ComputerWeekly.com 09 December 2014 Security issues are the main factor limiting the further use of cloud computing services, research from Eurostat has found. In a survey conducted by the European Commission’s Eurostat statistics service, public cloud computing was reportedly used by 24% of large enterprises and 12% of small and medium-sized enterprises (SMEs) in the EU. However, the survey noted that the risk of a security breach scored highest both for large enterprises and SMEs, at 57% and 38% respectively. “Firms attach importance to the protection of their IT systems, but the issue can be seen in the wider context of resilience to possible security breaches when using the cloud,” the Eurostat report stated. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Alere Home Monitoring data breach class suit thrown out

http://healthitsecurity.com/2014/10/09/alere-home-monitoring-data-breach-class-suit-thrown-out/ By Patrick Ouellette Health IT Security October 9, 2014 Nearly two years after Alere Home Monitoring, Inc. reported that an employee’s password-protected laptop was stolen from their car and 116,000 patients’ data was potentially compromised, a California federal judge threw out a possible class action suit that sought $116 million in damages. Law360 reports that U.S. District Judge Jon S. Tigar found no liability for the negligent release of stolen medical information under California’s Confidential Medical Information Act (CMIA). According to the report, plaintiffs were given 21 days to refile an amended complaint. “These two California Court of Appeal decisions are the only published opinions interpreting this California statute statutory law, and plaintiffs have cited no other data that would persuade this federal court sitting in diversity that the California Supreme Court would necessarily decide the issue otherwise,” Judge Tigar wrote. Alere’s 2012 breach exposed home monitoring patients’ names, addresses, dates of birth, Social Security numbers and diagnosis codes. For context, there are a lot of patients who use Alere products through Medicare coverage, explaining why the scope of the breach was so large. The patients involved in the class suit used Alere’s International Normalized Ratio (INR) products at home for bleeding and blood clot tests, with the information to be transmitted between the patient and physician. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Hacker exploits printer Web interface to install, run Doom

http://arstechnica.com/security/2014/09/hacker-exploits-printer-web-interface-to-install-run-doom/ By Sam Machkovech Ars Technica Sept 15 2014 On Friday, a hacker presenting at the 44CON Information Security Conference in London picked at the vulnerability of Web-accessible devices and demonstrated how to run unsigned code on a Canon printer via its default Web interface. After describing the device’s encryption as “doomed,” Context Information Security consultant Michael Jordon made his point by installing and running the first-person shooting classic Doom on a stock Canon Pixma MG6450. Sure enough, the printer’s tiny menu screen can render a choppy and discolored but playable version of id Software’s 1993 hit, the result of Jordon discovering that Pixma printers’ Web interfaces didn’t require any authentication to access. “You could print out hundreds of test pages and use up all the ink and paper, so what?” Jordon wrote at Context’s blog report about the discovery, but after a little more sniffing, he found that the devices could also easily be redirected to accept any code as legitimate firmware. A vulnerable Pixma printer’s Web interface allows users to change the Web proxy settings and the DNS server. From there, an enterprising hacker can crack the device’s encryption in eight steps, the final of which includes unsigned, plain-text firmware files. The hacking possibilities go far beyond enabling choppy, early ’90s gaming: “We can therefore create our own custom firmware and update anyone’s printer with a Trojan image which spies on the documents being printed or is used as a gateway into their network,” Jordon wrote. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Ground Zero Summit 2014, New Delhi India | Call For Paper Open

Forwarded from: GroundZero Summit CFP Ground Zero Summit 2014 13 – 16 November 2014, New Delhi, India Ground Zero Summit (G0S) 2014 in its second year promises to be Asia’s largest Information Security gathering and proposes to be the ultimate platform for showcasing researches and sharing knowledge in the field of cyber security. G0S rationale: The increasing volume and complexity of cyber threats – including phishing scams, data theft, and online vulnerabilities, demand that we remain vigilant about securing our systems and information. Enterprises and governments worldwide are grappling the grim reality of data and critical systems being exploited. This summits aims at addressing these new forms of cyber attack and formulate solutions. Web URL : http://g0s.org/ Tracks and relevant submissions G0S is a triple track conference and papers have to be submitted under the following tracks. Systems Track (OS/Systems/Application/Hardware) * OS exploitation * Application hacking * Rootkits and Malware * Forensics and Anti-forensics * SCADA security and exploitation * Telecom equipment security and exploitation * Embedded device/hardware security and exploitation * Malware on the mobile platform – Android, Windows OS, Symbian * Mobile Application Security. * Bitcoin Forensics * Banking Security * Communications Track (Communication and Networks) * Protocol exploitation and security * Satellite Technology / Security * Aviation Security * Botnet communication, C&C and takedowns * Web hacking * Radio communication hacking * GSM/3G/LTE/5G networks – security and exploitation * Satellite communication hacking * Network security * Intrusion prevention (and evasion) techniques * APT prevention (and evasion) techniques * Replacing network Security with “Intelligent, self automated Networks” * Growth of Mobile Data Networks with repercussions for the same * Strategy Track (Gov/GRC/Cyber warfare/CII) * GRC * Privacy * Social media in context of security and Privacy * Surveillance * Auditing * New age Cyber warfare/Cyber intelligence/Cyber terrorism/Cyber crimes * Upcoming information security trends * Critical infrastructure Protection * Cyber security in context of the Govt * Global Cyber Diplomacy * IT Act 2008 in light of Prism Surveillance * Security VS privacy * Evolving role of CERT to protect country’s citizens against external and internal intrusions * Repercussions of PRISM surveillance leak on Social Media E-mail for submission: “cfp (at) g0s.org” Speaker’s Privileges * G0S is providing all speakers with return air tickets (Economy). * For Indian speakers return air tickets will be provided for distance more than 300 kms, others will be provided First Class train tickets. * Accommodation in New Delhi for 3 nights (check out time as per hotel policy). * One speaker pass and one complementary Conference pass. * Invitation to Conference party. * An honorarium of USD 1000 is to be awarded for talks that are new, highly technical and have never been presented or published before (exclusive to G0S 2014) anywhere online or offline. * Please note that the selection of a paper for an honorarium is at the sole discretion of the Ground Zero Staff and their decision will be final based on the technical depth of the talk and whether it has been presented/published before. * The selected speakers will be notified about the same in our acceptance email. * In cases where there are more than one speakers for the same session. * Only one speaker may avail benefits and privileges under G0S policy. IIC membership will be provided to all speakers for 1 year initially.


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Crypto weakness in smart LED lightbulbs exposes Wi-Fi passwords

http://arstechnica.com/security/2014/07/crypto-weakness-in-smart-led-lightbulbs-exposes-wi-fi-passwords/ By Dan Goodin Ars Technica July 7, 2014 In the latest cautionary tale involving the so-called Internet of things, white-hat hackers have devised an attack against network-connected lightbulbs that exposes Wi-Fi passwords to anyone in proximity to one of the LED devices. The attack works against LIFX smart lightbulbs, which can be turned on and off and adjusted using iOS- and Android-based devices. Ars Senior Reviews Editor Lee Hutchinson gave a good overview here of the Philips Hue lights, which are programmable, controllable LED-powered bulbs that compete with LIFX. The bulbs are part of a growing trend in which manufacturers add computing and networking capabilities to appliances so people can manipulate them remotely using smartphones, computers, and other network-connected devices. A 2012 Kickstarter campaign raised more than $1.3 million for LIFX, more than 13 times the original goal of $100,000. According to a blog post published over the weekend, LIFX has updated the firmware used to control the bulbs after researchers discovered a weakness that allowed hackers within about 30 meters to obtain the passwords used to secure the connected Wi-Fi network. The credentials are passed from one networked bulb to another over a mesh network powered by 6LoWPAN, a wireless specification built on top of the IEEE 802.15.4 standard. While the bulbs used the Advanced Encryption Standard (AES) to encrypt the passwords, the underlying pre-shared key never changed, making it easy for the attacker to decipher the payload. “Armed with knowledge of the encryption algorithm, key, initialization vector, and an understanding of the mesh network protocol we could then inject packets into the mesh network, capture the Wi-Fi details, and decrypt the credentials, all without any prior authentication or alerting of our presence,” researchers from security consultancy Context wrote. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail