Tag Archives: monitoring

[ISN] PSA: Your crypto apps are useless unless you check them for backdoors

http://arstechnica.com/security/2015/02/psa-your-crypto-apps-are-useless-unless-you-check-them-for-backdoors/ By Dan Goodin Ars Technica Feb 4, 2015 At the beginning of the year, I did something I’ve never done before: I made a new year’s resolution. From here on out, I pledged, I would install only digitally signed software I could verify hadn’t been tampered with by someone sitting between me and the website that made it available for download. It seemed like a modest undertaking, but in practice, it has already cost me a few hours of lost time. With practice, it’s no longer the productivity killer it was. Still, the experience left me smarting. In some cases, the extra time I spent verifying signatures did little or nothing to make me more secure. And too many times, the sites that took the time to provide digital signatures gave little guidance on how to use them. Even worse, in one case, subpar security practices of some software providers undercut the protection that’s supposed to be provided with digitally signed code. And in one extreme case, I installed the Adium instant messaging program with no assurance at all, effectively crossing my fingers that it hadn’t been maliciously modified by state-sponsored spies or criminally motivated hackers. More about those deficiencies later—let’s begin first with an explanation of why digital signatures are necessary and how to go about verifying them. By now, most people are familiar with man-in-the-middle attacks. They’re waged by someone with the ability to monitor traffic passing between an end user and a website—for instance, a hacker sniffing an unsecured Wi-Fi connection or the National Security Agency sniffing the Internet backbone. When the data isn’t encrypted, the attacker can not only read private communications but also replace legitimate software normally available for download with maliciously modified software. If the attack is done correctly, the end user will have no idea what’s happening. Even when Web connections are encrypted with the HTTPS standard, highly skilled hackers still may be able to seed a website with malicious counterfeit downloads. That’s where digital signatures come in. A prime candidate for such an attack is the OTR plugin for the Pidgin instant messenger. It provides the means to encrypt messages so (1) they can’t be read by anyone monitoring the traffic sent between two parties and (2) each party can know for sure that the person on the other end is, in fact, who she claims to be. Fortunately, the OTR installer is provided through an encrypted HTTPS connection, which goes a long way to thwarting would-be man-in-the-middle attackers. But strict security practices require more, especially for software as sensitive as OTR. That’s why the developers included a GPG signature users can check to verify that the executable file hasn’t been altered in any way. […]




Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Australian infosec budgets are probably wrong: Deloitte

http://www.zdnet.com/article/australian-infosec-budgets-are-probably-wrong-deloitte/ By Stilgherrian ZDNet News February 4, 2015 Australian organisations are lagging when it comes to shifting the focus of their information security efforts from merely securing their networks to detecting intrusions, responding to them, and building resilience, according to senior security and risk executives from Deloitte, the international consulting firm. Deloitte divides an organisation’s infosec spend into three areas, each labelled with an adjective. “Secure” is the technology that protects critical assets against known and emerging threats across the ecosystem. This includes traditional network protection capabilities such as firewalls, anti-malware and anti-spam systems, and intrusion detection and prevention systems (IDS/IPS). “Vigilant” is about having the intelligence and monitoring capabilities to detect both known and unknown bad-guy activities, and understanding the extent to which they’re a risk to the business. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Thousands of U.S. gas stations exposed to Internet attacks

http://www.csoonline.com/article/2874230/cybercrime-hacking/thousands-of-us-gas-stations-exposed-to-internet-attacks.html By Lucian Constantin IDG News Service Jan 23, 2015 Over 5,000 devices used by gas stations in the U.S. to monitor their fuel tank levels can be manipulated from the Internet by malicious attackers. These devices, known as automated tank gauges (ATGs), are also used to trigger alarms in case of problems with the tanks, such as fuel spills. “An attacker with access to the serial port interface of an ATG may be able to shut down the station by spoofing the reported fuel level, generating false alarms, and locking the monitoring service out of the system,” said HD Moore, the chief research officer at security firm Rapid7, in a blog post. “Tank gauge malfunctions are considered a serious issue due to the regulatory and safety issues that may apply.” Earlier this month, Moore ran a scan to detect ATGs that are connected to the Internet through serial port servers that map ATG serial interfaces to the Internet-accessible TCP port 10001. This is a common set-up used by ATG owners to monitor the devices remotely. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] New Technology Detects Cyberattacks By Their Power Consumption

http://www.darkreading.com/analytics/security-monitoring/new-technology-detects-cyberattacks-by-their-power-consumption-/d/d-id/1318669 By Kelly Jackson Higgins Dark Reading 1/20/2015 Startup’s “power fingerprinting” approach catches Stuxnet infection within seconds in DOE power grid test bed. A security startup launching early next week uses trends in power consumption activity, rather than standard malware detection, to spot cyberattacks against power and manufacturing plants. The technology successfully spotted Stuxnet in an experimental network before the malware went into action. PFP Cybersecurity, which officially launches on Monday and was originally funded by DARPA, the Defense Department, and the Department of Homeland Security, basically establishes the baseline power consumption of ICS/SCADA equipment such as programmable logic controllers (PLCs), supervisory relays, or other devices and issues an alert when power consumption or RF radiation changes outside of their baseline usage occur. Such changes could be due to malware, as well as to hardware or system failures, for instance. The US Department of Energy’s Savannah River National Laboratory (SRNL) recently tested the PFP technology’s ability to detect Stuxnet on a Siemens SIMATIC S7-1200 PLC. Joe Cordaro, advisory engineer with SRNL, says the PFP system right away found Stuxnet on the PLC, before the infamous malware began to activate


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Microsoft Outlook Hacked In China, New Report Finds

http://techcrunch.com/2015/01/19/microsoft-outlook-hacked-in-china-new-report-finds/ By Sarah Perez Techtcrunch 1/19/2015 Only a few weeks after Google’s Gmail service was blocked in China, a new report from online censorship monitoring organization GreatFire.org released this morning states that Microsoft’s email system Outlook was recently subjected to a “man-in-the-middle” attack in China. This is a form of eavesdropping where the attacker inserts himself in between the victims’ connections, relaying messages between them while the victims’ continue believe they have a secure, private connection. Meanwhile, the attacker is able to read all the content they’re sharing. GreatFire.org was able to verify the attack itself, after receiving reports of its existence on January 17. It noted that IMAP and SMTP for Outlook were affected, but the web interfaces for Microsoft’s webmail services were not. (That is, Outlook.com and Login.live.com were not affected). The attack continued for a about a day, and has since stopped, the report states. Affected users were shown warning messages in their email clients that weren’t as immediately worrisome as those web browsers display, which means that some users may not have been aware that an attack was taking place. For example, in an example screenshot GreatFire.org posted, an iPhone warning message says “Cannot Verify Server Identity,” but asks if the user wants to continue anyway. However, when GreatFire.org reproduced the same result via the Firefox web browser, the message the browser offers is far more detailed, saying also that the error could means “that someone is trying to impersonate the site, and you shouldn’t continue.” […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Meaner POODLE bug that bypasses TLS crypto bites 10 percent of websites

http://arstechnica.com/security/2014/12/meaner-poodle-bug-that-bypasses-tls-crypto-bites-10-percent-of-websites/ By Dan Goodin Ars Technica Dec 8 2014 Some of the world’s leading websites—including those owned or operated by Bank of America, VMware, the US Department of Veteran’s Affairs, and business consultancy Accenture—are vulnerable to simple attacks that bypass the transport layer security encryption designed to thwart eavesdroppers and spoofers. The attacks are a variation on the so-called POODLE exploits disclosed two months ago against secure sockets layer (SSL), an encryption protocol similar to transport layer security (TLS). Short for “Padding Oracle On Downgraded Legacy Encryption,” POODLE allowed attackers monitoring Wi-Fi hotspots and other unsecured Internet connections to decrypt HTTPS traffic encrypted by the ancient SSL version 3. Browser makers quickly responded by limiting or eliminating use of SSLv3, a move that appears to have averted widespread exploitation of the bug. On Monday, word emerged that there’s a variation on the POODLE attack that works against widely used implementations of TLS. At the time this post was being prepared, SSL Server Test, a free service provided by security firm Qualys, showed that some of the Internet’s top websites—again, a list including Bank of America, VMware, the US Department of Veteran’s Affairs, and Accenture—are susceptible. The vulnerability was serious enough to earn all sites found to be affected a failing grade by the Qualys service. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] The 10 Biggest Bank Card Hacks

http://www.wired.com/2014/12/top-ten-card-breaches/ By Kim Zetter Threat Level Wired.com 12.02.14 The holiday buying season is upon us once again. Another event that has arrived along with the buying season is the season of big box retailer data breaches. A year ago, the Target breach made national headlines, followed shortly thereafter by a breach at Home Depot. Both breaches got a lot of attention, primarily because the number of bank cards affected was so high—more than 70 million debit and credit card numbers exposed in the case of Target and 56 million exposed at Home Depot. Luckily, very little fraudulent activity occurred on the stolen card numbers, primarily because the breaches were caught fairly soon, making them relatively minor incidents in the scheme of things, compared with other breaches that have occurred over the years that resulted in losses of millions of dollars. The Target breach was notable for one other reason, however: when it came to security, the company did many things right, such as encrypting its card data and installing a multi-million-dollar state-of-the-art monitoring system not long before the breach occurred. But although the system worked exactly as designed, detecting and alerting workers when it appeared that sensitive data was being exfiltrated from its network, workers failed to act on these alerts to prevent data from being stolen. Below, we look back on a decade of notable breaches, many of which happened despite the establishment of Payment Card Industry security standards that are supposed to protect cardholder data and lessen the chance that it will be stolen or be useful to criminals even when it’s nabbed. The PCI security standard (.pdf) which went into effect in 2005, is a list of requirements — such as installing a firewall and anti-virus software, changing vendor default passwords, encrypting data in transit (but only if it crosses a public network) — that companies processing credit or debit card payments are required by card companies to have in place. Companies are required to obtain regular third-party security audits from an approved assessor to certify ongoing compliance. But nearly every company that was victim to a card breach was certified as compliant to the PCI security standard at the time of the breach, only to be found noncompliant in a post-breach assessment. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Highly advanced backdoor trojan cased high-profile targets for years

http://arstechnica.com/security/2014/11/highly-advanced-backdoor-trojan-cased-high-profile-targets-for-years/ By Dan Goodin Ars Technica Nov 23 2014 Researchers have unearthed highly advanced malware they believe was developed by a wealthy nation-state to spy on a wide range of international targets in diverse industries, including hospitality, energy, airline, and research. Backdoor Regin, as researchers at security firm Symantec are referring to the trojan, bears some resemblance to previously discovered state-sponsored malware, including the espionage trojans known as Flame and Duqu, as well as Stuxnet, the computer worm and trojan that was programmed to disrupt Iran’s nuclear program. Regin likely required months or years to be completed and contains dozens of individual modules that allowed its operators to tailor the malware to individual targets. To remain stealthy, the malware is organized into five stages, each of which is encrypted except for the first one. Executing the first stage triggers a domino chain in which the second stage is decrypted and executed, and that in turn decrypts the third stage, and so on. Analyzing and understanding the malware requires researchers to acquire all five stages. Regin contains dozens of payloads, including code for capturing screenshots, seizing control of an infected computer’s mouse, stealing passwords, monitoring network traffic, and recovering deleted files. Other modules appear to be tailored to specific targets. One such payload included code for monitoring the traffic of a Microsoft IIS server. Another sniffed the traffic of mobile telephone base station controllers. Symantec researchers believe Regin was a sprawling framework that was used in multiple campaigns that data back to 2008 and possibly several years earlier. Liam O’Murchu, manager of operations for Symantec Security Response, told Ars that the roster of modules used against one target was often unique, an indication that Regin was used in multiple campaigns. “Essentially, what we think we’re looking at is different campaigns where in one infection they needed to sniff your keyboard whereas in another infection they wanted grab the user name and password of the admin connected to a base station controller,” O’Murchu said. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail