Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

December 1, 2016

OSS-Fuzz: Continuous fuzzing for open source software

Filed under: Cybersecurity,Programming,Security — Patrick Durusau @ 3:16 pm

Announcing OSS-Fuzz: Continuous fuzzing for open source software

From the post:

We are happy to announce OSS-Fuzz, a new Beta program developed over the past years with the Core Infrastructure Initiative community. This program will provide continuous fuzzing for select core open source software.

Open source software is the backbone of the many apps, sites, services, and networked things that make up “the internet.” It is important that the open source foundation be stable, secure, and reliable, as cracks and weaknesses impact all who build on it.

Recent security stories confirm that errors like buffer overflow and use-after-free can have serious, widespread consequences when they occur in critical open source software. These errors are not only serious, but notoriously difficult to find via routine code audits, even for experienced developers. That’s where fuzz testing comes in. By generating random inputs to a given program, fuzzing triggers and helps uncover errors quickly and thoroughly.

In recent years, several efficient general purpose fuzzing engines have been implemented (e.g. AFL and libFuzzer), and we use them to fuzz various components of the Chrome browser. These fuzzers, when combined with Sanitizers, can help find security vulnerabilities (e.g. buffer overflows, use-after-free, bad casts, integer overflows, etc), stability bugs (e.g. null dereferences, memory leaks, out-of-memory, assertion failures, etc) and sometimes even logical bugs.

OSS-Fuzz’s goal is to make common software infrastructure more secure and stable by combining modern fuzzing techniques with scalable distributed execution. OSS-Fuzz combines various fuzzing engines (initially, libFuzzer) with Sanitizers (initially, AddressSanitizer) and provides a massive distributed execution environment powered by ClusterFuzz.
… (emphasis in original)

Another similarity between open and closed source software.

Closed source software is continuously being fuzzed.

By volunteers.

Yes? 😉

One starting place for more information: Effective file format fuzzing by Mateusz “j00ru” Jurczyk (Black Hat Europe 2016, London) and his website: http://j00ru.vexillium.org/.

November 30, 2016

Urgent: Update Your Tor Browser [Today, Yes, Today] + Aside on shallow bugs

Filed under: Cybersecurity,Security — Patrick Durusau @ 3:58 pm

Tor Browser 6.0.7 is released

From the webpage:

Tor Browser 6.0.7 is now available from the Tor Browser Project page and also from our distribution directory.

This release features an important security update to Firefox and contains, in addition to that, an update to NoScript (2.9.5.2).

The security flaw responsible for this urgent release is already actively exploited on Windows systems. Even though there is currently, to the best of our knowledge, no similar exploit for OS X or Linux users available the underlying bug affects those platforms as well. Thus we strongly recommend that all users apply the update to their Tor Browser immediately. A restart is required for it to take effect.

Tor Browser users who had set their security slider to “High” are believed to have been safe from this vulnerability.

We will have alpha and hardened Tor Browser updates out shortly. In the meantime, users of these series can mitigate the security flaw in at least two ways:

1) Set the security slider to “High” as this is preventing the exploit from working.
2) Switch to the stable series until updates for alpha and hardened are available, too.

Here is the full changelog since 6.0.6:

  • All Platforms
    • Update Firefox to 45.5.1esr
    • Update NoScript to 2.9.5.2

A reminder from the Tor project that:

many eyes make all bugs shallow

is marketing talk for open source, nothing more.

For more on that theme: Linus’s Law aka “Many Eyes Make All Bugs Shallow” by Jeff Jones.

A little over 10 years old now, predating HeartBleed for example, but still an interesting read.

I am and remain an open source advocate but not on the basis of false claims of bug finding. Open source improves your changes of finding spyware. No guarantees but open source improves your chances.

Why any government or enterprise would run closed source software is a mystery to me. Upload all your work to the NSA on a weekly basis. With uploads you create a reminder of your risk, which is missing with non-open source software.

Hacking Journalists (Of self-protection)

Filed under: Cybersecurity,Journalism,Reporting,Security — Patrick Durusau @ 3:28 pm

Inside the mind of digital attackers: Part 1 — The connection by Justin Kosslyn.

From the post:

John has a target: name, country, brief context, and maybe the email address or website. John has been given a goal: maybe eavesdropping, taking a website offline, or stealing intellectual property. And John has been given constraints: maybe he cannot risk detection, or he has to act within 24 hours, or he cannot reach out to the state-owned telecommunications company for help.

John is a government-backed digital attacker. He sits in an office building somewhere, at a desk. Maybe this is the job he wanted when he was growing up, or maybe it was a way to pay the bills and stretch his technical muscles. He probably has plans for the weekend.

Let’s say, for the sake of this example, that John’s target is Henry, in the same country as John. John’s goal is to copy all the information on Henry’s computer without being detected. John can get help from other government agencies. There’s no rush.

The first thing to realize is that John, like most people, is a busy guy. He’s not going to do more work than necessary. First, he’ll try to use traditional, straightforward techniques — nothing fancy — and only if those methods fail will he try to be more creative with his attack.

The start of an interesting series from Jigsaw:

A technology incubator at Alphabet that tackles geopolitical problems.

Justin proposes to take us inside the mind of hackers who target journalists.

Understanding the enemy and their likely strategies is a starting place for effective defense/protection.

My only caveat is the description of John as a …government-backed digital attacker….

Could be and increases John’s range of tools but don’t premise any defense on attackers being government-backed.

There are only two types of people in the world:

  1. People who are attacking your system.
  2. People have not yet attacked your system.

Any sane and useful security policy accounts for both.

I’m looking forward to the next installment in this series.

1 Million Compromised Google Accounts – 86 Goolian Infected Apps – In Sort Order

Filed under: Cybersecurity,Security — Patrick Durusau @ 2:48 pm

“Gooligan” Android Malware Compromised 1 Million Google Accounts by Bogdan Popa.

From the post:

Security experts at Check Point have discovered a new very aggressive form of Android malware that already compromised no less than 1 million Google accounts and which can infect approximately 74 percent of the Android phones currently on the market.

The firm warns that the malware which they call Gooligan is injected into a total of 86 Android apps that are delivered through third-party marketplaces (you can check the full list of apps in the box at the end of the article). Once installed, these apps root the phone to get full access to the device and then attempt to deploy malicious software which can be used to steal authentication tokens for Google accounts.

This pretty much gives the attackers full control over the targeted Google accounts, and as long as vulnerable phones have Gmail, Google Drive, Google Chrome, YouTube, Google Photos, or any other Google app that can be used with an account, there’s a big chance that the attack is successful.
…(emphasis in original)

You can check to see if your account has been breached: Gooligan Checker.

The article also lists 86 Goolian infected apps, in no particular order. (Rhetorical questions: Why do people make it difficult for readers? What is their payoff?)

To save you from digging through and possibly missing an infected app, here are the 86 Googlian infected apps in dictionary order:

  • แข่งรถสุดโหด
  • Assistive Touch
  • ballSmove_004
  • Battery Monitor
  • Beautiful Alarm
  • Best Wallpapers
  • Billiards
  • Blue Point
  • CakeSweety
  • Calculator
  • Chrono Marker
  • Clean Master
  • Clear
  • com.browser.provider
  • com.example.ddeo
  • com.fabullacop.loudcallernameringtone
  • Compass Lite
  • com.so.itouch
  • Daily Racing
  • Demm
  • Demo
  • Demoad
  • Detecting instrument
  • Dircet Browser
  • Fast Cleaner
  • Fingerprint unlock
  • Flashlight Free
  • Fruit Slots
  • FUNNY DROPS
  • gla.pev.zvh
  • Google
  • GPS
  • GPS Speed
  • Hip Good
  • HotH5Games
  • Hot Photo
  • Html5 Games
  • Kiss Browser
  • KXService
  • Light Advanced
  • Light Browser
  • memory booste
  • memory booster
  • Memory Booster
  • Minibooster
  • Multifunction Flashlight
  • Music Cloud
  • OneKeyLock
  • Pedometer
  • Perfect Cleaner
  • phone booster
  • PornClub
  • PronClub
  • Puzzle Bubble-Pet Paradise
  • QPlay
  • SettingService
  • Sex Cademy
  • Sex Photo
  • Sexy hot wallpaper
  • Shadow Crush
  • Simple Calculator
  • Slots Mania
  • Small Blue Point
  • SmartFolder
  • Smart Touch
  • Snake
  • So Hot
  • StopWatch
  • Swamm Browser
  • System Booster
  • Talking Tom 3
  • TcashDemo
  • Test
  • Touch Beauty
  • tub.ajy.ics
  • UC Mini
  • Virtual
  • Weather
  • Wifi Accelerate
  • WiFi Enhancer
  • Wifi Master
  • Wifi Speed Pro
  • YouTube Downloader
  • youtubeplayer
  • 小白点
  • 清理大师

November 23, 2016

Taping Donald, Melania, Mike and others

Filed under: Cybersecurity,Government,Politics,Security — Patrick Durusau @ 4:23 pm

Just in time for a new adminstration, Great. Now even your headphones can spy on you by Andy Greenberg.

From the post:

CAUTIOUS COMPUTER USERS put a piece of tape over their webcam. Truly paranoid ones worry about their devices’ microphones—some even crack open their computers and phones to disable or remove those audio components so they can’t be hijacked by hackers. Now one group of Israeli researchers has taken that game of spy-versus-spy paranoia a step further, with malware that converts your headphones into makeshift microphones that can slyly record your conversations.

Researchers at Israel’s Ben Gurion University have created a piece of proof-of-concept code they call “Speake(a)r,” designed to demonstrate how determined hackers could find a way to surreptitiously hijack a computer to record audio even when the device’s microphones have been entirely removed or disabled. The experimental malware instead repurposes the speakers in earbuds or headphones to use them as microphones, converting the vibrations in air into electromagnetic signals to clearly capture audio from across a room.

“People don’t think about this privacy vulnerability,” says Mordechai Guri, the research lead of Ben Gurion’s Cyber Security Research Labs. “Even if you remove your computer’s microphone, if you use headphones you can be recorded.”

But the Ben Gurion researchers took that hack a step further. Their malware uses a little-known feature of RealTek audio codec chips to silently “retask” the computer’s output channel as an input channel, allowing the malware to record audio even when the headphones remain connected into an output-only jack and don’t even have a microphone channel on their plug. The researchers say the RealTek chips are so common that the attack works on practically any desktop computer, whether it runs Windows or MacOS, and most laptops, too. RealTek didn’t immediately respond to WIRED’s request for comment on the Ben Gurion researchers’ work. “This is the real vulnerability,” says Guri. “It’s what makes almost every computer today vulnerable to this type of attack.”

(emphasis in original)

Wired doesn’t give up any more details but that should be enough to get you started.

You must search for RealTek audio codec datasheets. RealTek wants a signed NDA from a development partner before you can access the datasheets.

Among numerous others, I know for a fact that datasheets on ALC655, ALC662, ALC888, ALC1150, and ALC5631Q are freely available online.

You will have to replicate the hack but then:

  1. Choose your targets for taping
  2. Obtain their TV/music preferences from Amazon, etc.
  3. License new content (would not want to upset the RIAA) for web streaming
  4. Offer your target the “latest” TV/music by (name) for free 30 day trial

For the nosy non-hacker, expect to see “hacked” earphones for sale on the Dark Web.

Perhaps even in time for holiday shopping!

Warning:Hacking or buying hacked headphones is a violation of any number of federal, state and local laws, depending on your jurisdiction.

PS: I am curious if the mic in cellphones is subject to a similar hack.

Perhaps this is the dawning of the age of transparency. 😉

Comic Book Security

Filed under: Cryptography,Cybersecurity,Encryption,Security — Patrick Durusau @ 3:21 pm

The Amazing Mysteries of the Gutter: Drawing Inferences Between Panels in Comic Book Narratives by Mohit Iyyer, et al.

Abstract:

Visual narrative is often a combination of explicit information and judicious omissions, relying on the viewer to supply missing details. In comics, most movements in time and space are hidden in the “gutters” between panels. To follow the story, readers logically connect panels together by inferring unseen actions through a process called “closure”. While computers can now describe the content of natural images, in this paper we examine whether they can understand the closure-driven narratives conveyed by stylized artwork and dialogue in comic book panels. We collect a dataset, COMICS, that consists of over 1.2 million panels (120 GB) paired with automatic textbox transcriptions. An in-depth analysis of COMICS demonstrates that neither text nor image alone can tell a comic book story, so a computer must understand both modalities to keep up with the plot. We introduce three cloze-style tasks that ask models to predict narrative and character-centric aspects of a panel given n preceding panels as context. Various deep neural architectures underperform human baselines on these tasks, suggesting that COMICS contains fundamental challenges for both vision and language.

From the introduction:

comics-460

Comics are fragmented scenes forged into full-fledged stories by the imagination of their readers. A comics creator can condense anything from a centuries-long intergalactic war to an ordinary family dinner into a single panel. But it is what the creator hides from their pages that makes comics truly interesting, the unspoken conversations and unseen actions that lurk in the spaces (or gutters) between adjacent panels. For example, the dialogue in Figure 1 suggests that between the second and third panels, Gilda commands her snakes to chase after a frightened Michael in some sort of strange cult initiation. Through a process called closure [40], which involves (1) understanding individual panels and (2) making connective inferences across panels, readers form coherent storylines from seemingly disparate panels such as these. In this paper, we study whether computers can do the same by collecting a dataset of comic books (COMICS) and designing several tasks that require closure to solve.

(emphasis in original)

Comic book security: A method for defeating worldwide data slurping and automated analysis.

The authors find that human results easily exceed automated analysis, raising the question of the use of a mixture of text and images as a means to evade widespread data sweeps.

Security based on a lack of human eyes to review content is chancy but depending upon your security needs, it may be sufficient.

For example, a cartoon in a local newspaper that designates a mission target and time, only needs to be secure from the time of its publication until the mission has finished. That it is discovered days, weeks or even months later, doesn’t impact the operational security of the mission.

The data set of cartoons is available at: http://github.com/miyyer/comics.

Guaranteed, algorithmic security is great, but hiding in gaps of computational ability may be just as effective.

Enjoy!

November 22, 2016

The 10 Commandments of Exfiltration

Filed under: Cybersecurity,Security — Patrick Durusau @ 8:34 pm

‘Perfect’ Data Exfiltration Demonstrated by Larry Loeb.

From the post:

The 10 Commandments of Exfiltration

Following the experiment, the researchers came up with a technique of exfiltration based on their newly established 10 commandments. According to the SafeBreach presentation, these commandments are:

  1. No security through obscurity should be used.
  2. Only Web browsing and derived traffic is allowed.
  3. Anything that may theoretically be perceived as passing information is forbidden.
  4. Scrutinize every packet during comprehensive network monitoring.
  5. Assume TLS/SSL termination at the enterprise level.
  6. Assume the receiving party has no restrictions.
  7. Assume no nation-state or third-party site monitoring.
  8. Enable time synchronization between the communicating parties.
  9. There’s bonus points for methods that can be implemented manually from the sender side.
  10. Active disruption by the enterprise is always possible.

The technique discussed is criticized as “low bandwidth” but then I think, how much bandwidth does it take to transmit an admin login and password?

Definitely worth a slow read.

Other contenders for similar 10 commandments of exflitration?

As a trivial example, consider a sender who leaves work every day at the same time through a double door. If they exit to their right, it is a 0 and if they exit to their left, it is a 1. Perhaps only on set days of the week or month.

Very low bandwidth but as I said, for admin login/password, it would be sufficient.

How imaginative is your exflitration security?

Advancing exploitation: a scriptless 0day exploit against Linux desktops

Filed under: Cybersecurity,Government,Security — Patrick Durusau @ 1:16 pm

Advancing exploitation: a scriptless 0day exploit against Linux desktops by Chris Evans.

From the post:

A powerful heap corruption vulnerability exists in the gstreamer decoder for the FLIC file format. Presented here is an 0day exploit for this vulnerability.

This decoder is generally present in the default install of modern Linux desktops, including Ubuntu 16.04 and Fedora 24. Gstreamer classifies its decoders as “good”, “bad” or “ugly”. Despite being quite buggy, and not being a format at all necessary on a modern desktop, the FLIC decoder is classified as “good”, almost guaranteeing its presence in default Linux installs.

Thanks to solid ASLR / DEP protections on the (some) modern 64-bit Linux installs, and some other challenges, this vulnerability is a real beast to exploit.

Most modern exploits defeat protections such as ASLR and DEP by using some form of scripting to manipulate the environment and make dynamic decisions and calculations to move the exploit forward. In a browser, that script is JavaScript (or ActionScript etc.) When attacking a kernel from userspace, the “script” is the userspace program. When attacking a TCP stack remotely, the “script” is the program running on the attacker’s computer. In my previous full gstreamer exploit against the NSF decoder, the script was an embedded 6502 machine code program.

But in order to attack the FLIC decoder, there simply isn’t any scripting opportunity. The attacker gets, once, to submit a bunch of scriptless bytes into the decoder, and try and gain code execution without further interaction…

… and good luck with that! Welcome to the world of scriptless exploitation in an ASLR environment. Let’s give it our best shot.

Above my head, at the moment, but I post it as a test for hackers who want to test their understanding/development of exploits.

BTW, some wag, I didn’t bother to see which one, complained Chris’ post is “irresponsible disclosure.”

Sure, the CIA, FBI, NSA and their counter-parts in other governments, plus their cybersecurity contractors should have sole access to such exploits. Ditto for the projects concerned. (NOT!)

“Responsible disclosure” is just another name for unilateral disarmament, on behalf of all of us.

Open and public discussion is much better.

Besides, a hack of Ubuntu 16.04 won’t be relevant at most government installations for years.

Plenty of time for a patched release. 😉

November 21, 2016

OPM Farce Continues – 2016 Inspector General Report

Filed under: Cybersecurity,Government,Government Data,NSA,Security — Patrick Durusau @ 4:59 pm

U.S. Office of Personnel Management – Office of the Inspector General – Office of Audits

The Office of Personnel Management hack was back in the old days when China was being blamed for every hack. There’s no credible evidence of that but the Chinese were blamed in any event.

The OMP hack illustrated the danger inherent in appointing campaign staff to run mission critical federal agencies. Just a sampling of the impressive depth of Archuleta’s incompetence, read Flash Audit on OPM Infrastructure Update Plan.

The executive summary of the current report offers little room for hope:

This audit report again communicates a material weakness related to OPM’s Security Assessment and Authorization (Authorization) program. In April 2015, the then Chief Information Officer issued a memorandum that granted an extension of the previous Authorizations for all systems whose Authorization had already expired, and for those scheduled to expire through September 2016. Although the moratorium on Authorizations has since been lifted, the effects of the April 2015 memorandum continue to have a significant negative impact on OPM. At the end of fiscal year (FY) 2016, the agency still had at least 18 major systems without a valid Authorization in place.

However, OPM did initiate an “Authorization Sprint” during FY 2016 in an effort to get all of the agency’s systems compliant with the Authorization requirements. We acknowledge that OPM is once again taking system Authorization seriously. We intend to perform a comprehensive audit of OPM’s Authorization process in early FY 2017.

This audit report also re-issues a significant deficiency related to OPM’s information security management structure. Although OPM has developed a security management structure that we believe can be effective, there has been an extremely high turnover rate of critical positions. The negative impact of these staffing issues is apparent in the results of our current FISMA audit work. There has been a significant regression in OPM’s compliance with FISMA requirements, as the agency failed to meet requirements that it had successfully met in prior years. We acknowledge that OPM has placed significant effort toward filling these positions, but simply having the staff does not guarantee that the team can effectively manage information security and keep OPM compliant with FISMA requirements. We will continue to closely monitor activity in this area throughout FY 2017.

It’s illegal but hacking the OPM remains easier than the NSA.

Hacking the NSA requires a job at Booz Allen and a USB drive.

November 19, 2016

If You Don’t Get A New Car For The Holidays

Filed under: Security — Patrick Durusau @ 3:49 pm

Just because you aren’t expecting:

car-christmas-460

Doesn’t mean a new car isn’t in your future:

grid-locks-460

From the Sparrows Lock Pick website:

Sparrows Gridlock

There is a reason as to why a coat hanger is the tool of choice for most Automobile lockouts. Picking a standard 10 wafer Automotive lock is a Huge challenge. Most often it is achieved by being stubborn with a pinch of lucky a dash of skill.

The Gridlock set lets you develop that skill by working through three automotive locks of ever increasing difficulty. Building from a 3 to a 6 to a full 10 wafer Automotive lock will allow you to develop the skill for picking wafers. Wafer picking is an entirely different skill set when compared to pin tumbler picking.

A standard pin tumbler key is cut just along the top to lift the pins up into place letting you open the lock. A wafer lock key is cut on the top and bottom, this then moves the wafers Up and Down positioning them for the lock to open.

Learning to manipulate and rock those wafers into position is a skill ….. a skill that one day may get you a well deserved high five or a court appointed lawyer.

The Gridlock comes with 3 progressive wafer locks and an automotive tension wrench specific to appling tension to wafer locks. The locks are solid aluminum and perfect in scale to a classic car lock.

Think of lock picking as an expansion of your skills at digitally hacking access to automobiles.

With the Auto Rocker Picks, sans shipping, the package lists for $41.50. You may want some additional accessories from the LockPickShop

Security discussions determine when your security will fail, not if.

Security discussions that don’t include physical security determine it will be sooner rather than later.

November 17, 2016

Operating Systems Design and Implementation (12th USENIX Symposium)

Filed under: Computer Science,CS Lectures,Cybersecurity,Security — Patrick Durusau @ 9:59 pm

Operating Systems Design and Implementation (12th USENIX Symposium) – Savannah, GA, USA, November 2-4, 2016.

Message from the OSDI ’16 Program Co-Chairs:

We are delighted to welcome to you to the 12th USENIX Symposium on Operating Systems Design and Implementation, held in Savannah, GA, USA! This year’s program includes a record high 47 papers that represent the strength of our community and cover a wide range of topics, including security, cloud computing, transaction support, storage, networking, formal verification of systems, graph processing, system support for machine learning, programming languages, troubleshooting, and operating systems design and implementation.

Weighing in at seven hundred and ninety-seven (797) pages, this tome will prove more than sufficient to avoid annual family arguments during the holiday season.

Not to mention this is an opportunity to hone your skills to a fine edge.

November 16, 2016

The Amnesic Incognito Live System (Tails) 2.7

Filed under: Cybersecurity,Security — Patrick Durusau @ 3:10 pm

The Amnesic Incognito Live System (Tails) 2.7

The Amnesic Incognito Live System (Tails) is a Debian-based, live distribution with the goal of providing Internet anonymity for its users. The distribution accomplishes this by directing Internet traffic through the Tor network and by providing built-in tools for protecting files and scrubbing away meta data. The project’s latest release mostly focuses on fixing bugs and improving security: “Tails 2.7 is out. This release fixes many security issues and users should upgrade as soon as possible. New features: ship LetsEncrypt intermediate SSL certificate so that our tools are able to authenticate our website when its certificate is updated. Upgrades and changes: Tor 0.2.8.9, Tor Browser 6.0.6, Linux kernel 4.7, Icedove 45.4.0. Fixed problems: Synaptic installs packages with the correct architecture; set default spelling to en_US in Icedove. Known issues: users setting their Tor Browser security slider to High will have to click on a link to see the result of the search they done with the search box.” Additional information on Tails 2.7 can be found in the project’s release notes. A list of issues fixed in the 2.7 release can be found in the list of former security issues. Download: tails-i386-2.7.iso (1,113MB, signature, pkglist). Also available from OSDisc.

An essential part of your overall cybersecurity stance.

All releases are date/time sensitive.

BEFORE installing this release, even later today, check for a later release: Tails.

Checking for the latest release only takes seconds and is a habit that will help you avoid patched security holes.

PoisonTap – Wishlist 2016

Filed under: Cybersecurity,Security — Patrick Durusau @ 2:50 pm

PoisonTap Steals Cookies, Drops Backdoors on Password-Protected Computers by Chris Brook.

From the post:

Even locked, password-protected computers are no rival for Samy Kamkar and his seemingly endless parade of gadgets.

His latest, PoisonTap, is a $5 Raspberry Pi Zero device running Node.js that’s retrofitted to emulate an Ethernet device over USB. Assuming a victim has left their web browser open, once plugged in to a machine, the device can quietly fetch HTTP cookies and sessions from millions of websites, even if the computer is locked.

If that alone doesn’t sound like Mr. Robot season three fodder, the device can also expose the machine’s internal router and install persistent backdoors, guaranteeing an attacker access long after they’ve removed the device from a USB slot.

“[The device] produces a cascading effect by exploiting the existing trust in various mechanisms of a machine and network, including USB, DHCP, DNS, and HTTP, to produce a snowball effect of information exfiltration, network access and installation of semi-permanent backdoors,” Kamkar said Wednesday in a writeup of PoisonTap.

Opportunity may only knock once.

Be prepared by carrying one or more PoisonTaps along with a bootable USB stick.

November 15, 2016

Surveillance Self-Defense [Guide to creating “false” persona?]

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 7:51 pm

Surveillance Self-Defense – Tips, Tools and How-Tos for Safer Online Communications

From the webpage:

Modern technology has given those in power new abilities to eavesdrop and collect data on innocent people. Surveillance Self-Defense is EFF’s guide to defending yourself and your friends from surveillance by using secure technology and developing careful practices.

Select an article from our index to learn about a tool or issue, or check out one of our playlists to take a guided tour through a new set of skills.

Definitely a starting point that merits sharing.

One important topic that is missing: How to create a “false” persona?

A “false” persona that cannot be connected back to a user is far more valuable than two-factor authentication, strong passwords, etc.

Pointers to such resources?

November 14, 2016

Tor Risks for Whistleblowers

Filed under: Cybersecurity,Security,Tor — Patrick Durusau @ 7:57 pm

Exclusively Relying on Tor Risks Detection and Exposure for Whistleblowers by Michael Best.

Eighteen (18) slides to remind you that just using Tor can leave you vulnerable to detection and exposure.

Depending on who you are exposing, detection may be hazardous to your freedom or even your life.

Unfortunately, like other forms of cybersecurity, avoiding detection and exposure requires effort. Effort that is rare among casual users of computers.

Depending upon your risk factors, you and your colleagues should review security practices on a regular basis.

I would include these slides and/or an adaptation of them as part of that review.

Pointers to regular security practice review cheatsheets?

Leaking and Whistleblowing in the Trump Era

Filed under: Cybersecurity,Government,Privacy,Security — Patrick Durusau @ 5:47 pm

In the Trump Era, Leaking and Whistleblowing Are More Urgent, and More Noble, Than Ever by Glenn Greenwald.

From the post:

For the past 15 years, the U.S. Government under both parties has invented whole new methods for hiding what they do behind an increasingly impenetrable wall of secrecy. From radical new legal doctrines designed to shield their behavior from judicial review to prosecuting sources at record rates, more and more government action has been deliberately hidden from the public.

One of the very few remaining avenues for learning what the U.S. Government is doing – beyond the propaganda that they want Americans to ingest and thus deliberately disseminate through media outlets – is leaking and whistleblowing. Among the leading U.S. heroes in the War on Terror have been the men and women inside various agencies of the U.S. Government who discovered serious wrongdoing being carried out in secret, and then risked their own personal welfare to ensure that the public learned of what never should have been hidden from it in the first place.

Many of the important consequential revelations from the last two administrations were possible only because of courageous sources who came forward in this way. It’s how we learned about the abuses of Abu Ghraib, the existence of torture-fueled CIA “black sites,” the Bush warrantless eavesdropping program, the wanton slaughter carried out in Iraq and Afghanistan, the recklessness and deceit at the heart of the U.S. drone program, the NSA’s secret construction of the largest system of suspicionless, mass surveillance ever created, and so many other scandals, frauds, and war crimes that otherwise would have remained hidden. All of that reporting was possible only because people of conscience decided to disregard the U.S. Government’s corrupt decree that this information should remain secret, on the ground that concealing it was designed to protect not national security but rather the reputations and interests of political officials.

For that reason, when the Intercept was created, enabling safe and productive whistleblowing was central to our mission. We hired some of the world’s most skilled technologists, experts in information security and encryption, to provide maximum security for our journalists and our sources. We adopted the most advanced programs for enabling sources to communicate and provide information to us anonymously and without detection, such as Secure Drop. And we made an institutional commitment to expend whatever resources are necessary to defend the right of a free press to report freely without threats of recrimination, and to do everything possible to protect and defend our sources who enable that vital journalism.

Over the past two years, we have published several articles by our security experts on how sources (and others) can communicate and provide information to us in the safest and most secure manner possible, to minimize the chances of being detected. We’ve published interviews with other experts, such as Edward Snowden, on the most powerful tools and methods available for securing one’s online communications. As our technologist Micah Lee explained, no method is perfect, so “caution is still advised to those who want to communicate with us without exposing their real-world identities,” but tools and practices do exist to maximize anonymity, and we are committed to using those and informing the public about how to use them in the safest and most effective manner possible.

Considering the damage done to the Constitution by George W. Bush and Barack Obama, leaking/whistleblowing in the Trump era is not “more urgent, and more noble….”

That is to say leaking/whistleblowing is always urgent and noble.

Think about the examples Greenwald cites. All are from the Bush and Obama administrations with nary a hint of Trump.

Exposing murder, torture, war crimes, lying to allies, Congress and the American public. And that’s just the short list. The margin of this page isn’t large enough to enumerate all the specific crimes committed by both administrations.

By all means, let’s encourage leaking and whistleblowing in the Trump era, but don’t leak timidly.

Government officials, staffers, contractors and their agents (double or otherwise), have freely chosen to participate in activities hidden from the public. Hidden because they are ashamed of what they have done (think CIA torturers) and/or fear just prosecution for their crimes (waging wars of aggression).

Leak boldly, insist on naming all names and all actions being described.

Secrecy hasn’t prevented excesses in secret, perhaps severe and repeated consequences from bold leaks will.

Leak early, often and in full.

PS: We should not rely exclusively on insiders to leak information.

Hackers have an important role to play in creating government transparency, with or without the government’s consent.

November 4, 2016

The U.S. Government And Zero-Day Vulnerabilities: …

Filed under: Cybersecurity,Government,Security — Patrick Durusau @ 8:37 pm

The U.S. Government And Zero-Day Vulnerabilities: From Pre-Heartbleed To Shadow Brokers by Jason Healey. (PDF version)

I have seldom seen this many weasel words used by a non-lawyer, at least in one sentence:

We estimate with moderate confidence that the current U.S. arsenal of zero-day vulnerabilities is probably in the dozens.

In fuller context, followed by more weaseling:


We estimate with moderate confidence that the current U.S. arsenal of zero-day vulnerabilities is probably in the dozens. The arsenal is a function of several factors, an equation through which it is difficult to get much higher than 50 or 60. The factors include how many years the United States has been retaining zero days (at least fifteen), how many are retained per year (dozens before 2014 and single digits since), the average number burned per year (say 50 percent), the average life of a zero day once used (approximately 300 days[39]), the average number of zero days discovered by vendors or used by other actors which thereby renders them useless for the United States (25 percent), and the average half-life of a zero-day vulnerability if not used (approximately 12 months). Note that this count critically depends on the “single digit per year” assessment discussed above. This count does not include battlefield and non-commercial systems, non-U.S. systems (such as the TopSec firewall vulnerabilities in the Shadow Brokers’ release), or U.S. government exploits that utilize vulnerabilities that have already been made public. (emphasis in original)

The critical lesson I take from Healey is that sovereigns don’t voluntarily disarm to their disadvantage. Ever.

Reciprocity. Isn’t that when you treat others as they treat you?

Governments that put users at risk have no reasonable expectation of any better treatment from others.

Considering that all of the major breaches of the last 24 months involved no zero-day exploits, you have to wonder who the U.S. government intends to hack that is all that clever?

Hire Fancy Bear to send them a GMail phishing email. 😉

PS: Don’t hire the FBI. It took them two weeks and custom software sort emails. (Clinton/Abedin/Weiner laptop)

Tracking Mall Shoppers With ISMI Numbers (Legally?)

Filed under: Cybersecurity,Security — Patrick Durusau @ 9:00 am

Tweets from a retailer whose initials are A-M-A-Z-O-N remind me daily there are less than 30 days until Black Friday. (Non-U.S. readers, Black Friday is an attempt to build up a sense of personal worth weakened by the prior day’s association with family members. “I shop, therefore my life has meaning.”)

Build your own IMSI slurping, phone-stalking Stingray-lite box – using bog-standard Wi-Fi by John Leyden.

From the post:

Black Hat EU Wi-Fi networks can tease IMSI numbers out of nearby smartphones, allowing pretty much anyone to wirelessly track and monitor people by their handsets’ fingerprints. (emphasis in original)

See John’s post for the details but if only being able to track people by their cellphones sounds ho-hum, think again.

Mall shoppers are tracked by observers, video, credit card purchases, but what about tracking their physical locations from entry into the mall, all ay shopping until they exit?

Inexpensively, unless you want to triangulate their precise locations.

Assuming the data is centralized for processing, identification of shoppers who previously visited ****, or who just were at the food court, or even individuals, could be provided in real time.

So far as I know, Wi-Fi networks are legal in all fifty states of the United States.

The presentation and the slides.

Privacy tip: Leave you smart phone in your car.

November 3, 2016

Understanding the fundamentals of attacks (Theory of Exploitation)

Filed under: Computer Science,Cybersecurity,Security — Patrick Durusau @ 8:31 pm

Understanding the fundamentals of attacks – What is happening when someone writes an exploit? by Halvar Flake / Thomas Dullien.

The common “bag of tricks” as Halvar refers to them for hacking, does cover all the major data breaches for the last 24 months.

No zero-day exploits.

Certainly none of the deep analysis offered by Halvar here.

Still, you owe it to yourself and your future on one side or the other of computer security, to review these slides and references carefully.

Even though Halvar concludes (in part)

Exploitation is programming emergent weird machines.

It does not require EIP/RIP, and is not a bad of tricks.

Theory of exploitation is still in embryonic stage.

Imagine the advantages of having mastered the art of exploitation theory at its inception.

In an increasingly digital world, you may be worth your own weight in gold. 😉

PS: Specifying the subject identity properties of exploits will assist in organizing them for future use/defense.

One expert hacker is like a highly skilled warrior.

Making exploits easy to discover/use by average hackers is like a skilled warrior facing a company of average fighters.

The outcome will be bloody, but never in doubt.

November 2, 2016

Don’t cyber-mess with Britain, warns UK Chancellor (I’m So Scared!)

Filed under: Cybersecurity,Security — Patrick Durusau @ 3:00 pm

Don’t cyber-mess with Britain, warns UK Chancellor by John E Dunn.

<> on January 22, 2013 in London, England.

From the post:


“We will continue to invest in our offensive cyber-capabilities, because the ability to detect, trace and retaliate in kind is likely to be the best deterrent.”

The use of the word “retaliate” is key. According to Hammond, without the ability to go on the offensive in cyberspace the UK would be left with no way to respond except by either “turning the cheek” or resorting to old-fashioned military force, which means the risk of people being killed.

Enemies must understand this. Anyone thinking of attacking the UK in cyberspace was risking getting the same back.

Before hackers start wailing in despair, burning their computers, abandoning the internet, seeking asylum with the Amish, remember that Hammond and company would have to blame someone first.

On the issue of blame, check the latest pronouncements from the then U.S. President or one of their sycophants for the cyber-villain-of-the-day.

For example, today, November 2, 2016, if your hacker moniker isn’t Fancy Bear, your safe from retaliation.

Governmental cyber attribution is a politically colored game of buying a pig in a poke.

Let the buyer and public beware!

PS: I would not be overly fearful of British efforts. British government has for years has been unable to find child molesters in its own midst. There may be reasons other than incompetent for that failure.

Is Google Fancy Bear? Or is Microsoft? Factions of Fancy Bear?

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 10:13 am

Fancy Bear: Russia-linked hackers blamed for exploiting Windows zero-day flaw.

From the post:

MICROSOFT IS USING a new tactic to get people to upgrade to Windows 10 by warning that those who don’t could fall victim to Russian hackers.

The company said in a security advisory that a hacking group previously linked to the Russian government and US political hacks has exploited a newly discovered Windows zero-day flaw that was outed by Google earlier this week.

Microsoft claimed that the hacking group ‘Strontium’, more commonly known as ‘Fancy Bear’, had carried out a small number of attacks using spear phishing techniques.

Too much of a coincidence Google drops a zero-day flaw the same week it shows up in the wild from Fancy Bear?

Too much of a coincidence Windows 10 is the magic solution to an “all Windows/all the time” vulnerability?

Could Google and Microsoft be rival factions of Fancy Bear?

The super-hackers in North Korea, should be offended by the obsession with Fancy Bear. Double ditto for the Chinese warlord class hackers.

For months, years in internet time, it’s Fancy Bear this and Fancy Bear that. Your toaster on the blink, must be Fancy Bear. Your printer is jammed, must be Fancy Bear. Worried about hacking paper ballots? Must be Fancy Bear.

Despite DNI James Clapper‘s paranoid and Hillary Clinton-serving fantasies, there is more to attribution than saying a catchy name.

October 29, 2016

I Spy A Mirai Botnet

Filed under: Bots,Cybersecurity,Security — Patrick Durusau @ 8:12 pm

Rob Graham created telnetlogger to:

This is a simple program to log login attempts on Telnet (port 23).

It’s designed to track the Mirai botnet. Right now (Oct 23, 2016) infected Mirai machines from around the world are trying to connect to Telnet on every IP address about once per minute. This program logs both which IP addresses are doing the attempts, and which passwords they are using.

I wrote it primarily because installing telnetd on a Raspberry Pi wasn’t sufficient. For some reason, the Mirai botnet doesn’t like the output from Telnet, and won’t try to login. So I needed something that produced the type of Telnet is was expecting. While I was at it, I also wrote some code to parse things and extract the usernames/passwords.

Cool!

A handy, single purpose program that enables you to spy in Mirai botnets.

Rob has great notes on managing the output.

Perhaps you should publish the passwords you collect (internally) as fair warning to your users.

Or use them in an attempt to hack your own network, before someone else does.

Enjoy!

PS: It complies, etc., but even for the pleasure of spying on Mirai botnets, I’m not lowering my shields.

Schneider Electric Unity Pro Targeting Data

Filed under: Cybersecurity,Security — Patrick Durusau @ 3:36 pm

Major Vulnerability Found in Schneider Electric Utility Pro by Tom Spring should have Open Source Intelligence (OSINT) gurus in high gear.

From the post:

Schneider Electric is grappling with a critical vulnerability found in its flagship industrial controller management software called Unity Pro that allows hackers to remotely execute code on industrial networks.

The warning comes from Indegy, an industrial cybersecurity firm. Indegy discovered the vulnerability and issued a report on the flaw Tuesday. Mille Gandelsman, CTO of Indegy, called the vulnerability a “major concern” and urged anyone running Unity Pro software to update to the latest version. Unity Pro, which runs on Window-based PCs, is used for managing and programing millions of industrial controllers around the world.

“If the IP address of the Windows PC running the Unity Pro software is accessible to the internet, then anyone can exploit the software and run code on hardware,” Gandelsman told Threatpost. “This is the crown jewel of access. An attacker can do anything they want with the controllers themselves.”

The flaw resides in a component of Unity Pro software named Unity Pro PLC Simulator, used to test industrial controllers, according to Indegy.

“This is what an attacker would want to have access to in order to impact the actual production process within an ICS physical environment. That includes the valves, turbines, centrifuges and smart meters. These are accessible from the engineering stations natively,” Gandelsman said. “With this type of access, an attacker can use it to change the recipe to drugs being manufactured by industrial control systems or turn off the power grid of a city.”
… (emphasis added)

How is Open Source Intelligence (OSINT) relevant?

Schneider Electric products are found in:

Afghanistan Guatemala Puerto Rico
Albania Guinea Qatar
Algeria Guinea-Bissau Reunion Island
Angola Guyana Romania
Antigua and Barbuda HaĂŻti Russia
Argentina Honduras Rwanda
Armenia Hong Kong Saint Barthelemy
Australia Hungary Saint Lucia
Austria Iceland Saint Martin
Azerbaijan India Saint Pierre and Miquelon
Bahamas Indonesia Saint Vincent and the Grenadines
Bahrain Iran Samoa
Bangladesh Iraq Sao Tome and Principe
Barbados Ireland Saudi Arabia
Belarus Israel Senegal
Belgium Italy Serbia
Benin Ivory Coast Seychelles
Bermuda Jamaica Sierra Leone
Bhutan Japan Singapore
Bolivia Jordan Slovakia
Bosnia-Herzegovina Kazakhstan Slovenia
Botswana Kenya Solomon Islands
Brazil Kosovo Somalia
Brunei Kuwait South Africa
Bulgaria Kyrgyzstan South Korea
Burkina-Faso Laos Spain
Burundi Latvia Sri Lanka
Cambodia Lebanon Sudan
Cameroon Liberia Suriname
Canada Libya Swaziland
Cape Verde Liechtenstein Sweden
Cayman Islands Lithuania Switzerland
Central African Republic Luxembourg Taiwan
Chad Macedonia Tanzania
Chile Madagascar Thailand
China Malawi Togo
Colombia Malaysia Tonga
Comoros Maldives Trinidad and Tobago
Congo Mali Tunisia
Cook Islands Malta Turkey
Costa Rica Martinique Turkmenistan
Croatia Mauritania Turks and Caicos Islands
Cuba Mauritius Tuvalu
Cyprus Mayotte Uganda
Czech Republic Mexico Ukraine
Denmark Moldova United Arab Emirates
Djibouti Monaco United Kingdom
Dominican Republic Mongolia United States
DR of Congo Montenegro Uruguay
Ecuador Montserrat Uzbekistan
Egypt Morocco Vanuatu
El Salvador Mozambique Venezuela
Equatorial Guinea Myanmar Vietnam
Eritrea Namibia Virgin islands
Estonia Nepal Wallis and Futuna
Ethiopia Netherlands Yemen
Fiji New Caledonia Zambia
Finland New Zealand Zimbabwe
France Nicaragua
French Guiana Niger
French Polynesia Nigeria
Gabon Norway
Gambia Oman
Georgia Pakistan
Germany Peru
Ghana Philippines
Greece Poland
Guadeloupe Portugal

Open Source Intelligence (OSINT) techniques can be used to identify and locate Schneider Electric Unity Pro installations, an important step in assessing their vulnerabilities.

Such techniques can provide actionable and valuable intelligence for planners, government officials, risk assessment and other purposes.

In the interest of “responsible disclosure” (read “reserved for paying customers”), I omit my suggestions on the best OSINT techniques for this particular use case.

PS: All versions of the Schneider Electric Unity Pro prior to its latest patch are vulnerable.

October 13, 2016

IBM’s Program Of Security Via Obscurity (Censorship)

Filed under: Cybersecurity,Security — Patrick Durusau @ 3:15 pm

Before today, my response to the question: “Does IBM promote security through obscurity?” would have been no!

Today? Full Disclosure @SecLists posted this tweet:

ibm-censoring-460

A working version of the URL: http://seclists.org/fulldisclosure/2016/Oct/43.

I don’t suppose better software engineering practices and/or rapid repair of IBM’s software occurred to anyone?

October 12, 2016

How-To Spot An Armchair Jihadist

Filed under: FBI,Government,Security — Patrick Durusau @ 3:27 pm

To efficiently use law enforcement resources against threats to civil order, the police must recognize the difference between an actual jihadist and an armchair jihadist.

An armchair jihadist is one that talks a good game, dreams of raining fire and death on infidels, etc., but in truth, is the Walter Mitty of terrorism.

Unfortunately, law enforcement disproportionately captures armchair jihadists, for example, the arrest of Samata Ullah, who was charged in part with possession of:

…a book about guided missiles and a PDF version of a book about advanced missile guidance and control for a purpose connected with the commission, preparation or instigation of terrorism”
….

Admitting the romanticism of building one’s own arsenal, how successful do you think an individual or even a large group of individuals would be at building and testing a guided missile?

Here’s a broad outline of the major steps to building a laser guided missile:

The Manufacturing Process

Constructing the body and attaching the fins

1 The steel or aluminum body is die cast in halves. Die casting involves pouring molten metal into a steel die of the desired shape and letting the metal harden. As it cools, the metal assumes the same shape as the die. At this time, an optional chromium coating can be applied to the interior surfaces of the halves that correspond to a completed missile’s cavity. The halves are then welded together, and nozzles are added at the tail end of the body after it has been welded.

2 Moveable fins are now added at predetermined points along the missile body. The fins can be attached to mechanical joints that are then welded to the outside of the body, or they can be inserted into recesses purposely milled into the body.

Casting the propellant

3 The propellant must be carefully applied to the missile cavity in order to ensure a uniform coating, as any irregularities will result in an unreliable burning rate, which in turn detracts from the performance of the missile. The best means of achieving a uniform coating is to apply the propellant by using centrifugal force. This application, called casting, is done in an industrial centrifuge that is well-shielded and situated in an isolated location as a precaution against fire or explosion.

Assembling the guidance system

4 The principal laser components—the photo detecting sensor and optical filters—are assembled in a series of operations that are separate from the rest of the missile’s construction. Circuits that support the laser system are then soldered onto pre-printed boards; extra attention is given to optical materials at this time to protect them from excessive heat, as this can alter the wavelength of light that the missile will be able to detect. The assembled laser subsystem is now set aside pending final assembly. The circuit boards for the electronics suite are also assembled independently from the rest of the missile. If called for by the design, microchips are added to the boards at this time.

5 The guidance system (laser components plus the electronics suite) can now be integrated by linking the requisite circuit boards and inserting the entire assembly into the missile body through an access panel. The missile’s control surfaces are then linked with the guidance system by a series of relay wires, also entered into the missile body via access panels. The photo detecting sensor and its housing, however, are added at this point only for beam riding missiles, in which case the housing is carefully bolted to the exterior diameter of the missile near its rear, facing backward to interpret the laser signals from the parent aircraft.

Final assembly

6 Insertion of the warhead constitutes the final assembly phase of guided missileďżź construction. Great care must be exercised during this process, as mistakes can lead to catastrophic accidents. Simple fastening techniques such as bolting or riveting serve to attach the warhead without risking safety hazards. For guidance systems that home-in on reflected laser light, the photo detecting sensor (in its housing) is bolted into place at the tip of the warhead. On completion of this final phase of assembly, the manufacturer has successfully constructed on of the most complicated, sophisticated, and potentially dangerous pieces of hardware in use today.

Quality Control

Each important component is subjected to rigorous quality control tests prior to assembly. First, the propellant must pass a test in which examiners ignite a sample of the propellant under conditions simulating the flight of a missile. The next test is a wind tunnel exercise involving a model of the missile body. This test evaluates the air flow around the missile during its flight. Additionally, a few missiles set aside for test purposes are fired to test flight characteristics. Further work involves putting the electronics suite through a series of tests to determine the speed and accuracy with which commands get passed along to the missile’s control surfaces. Then the laser components are tested for reliability, and a test beam is fired to allow examiners to record the photo detecting sensor’s ability to “read” the proper wavelength. Finally, a set number of completed guided missiles are test fired from aircraft or helicopters on ranges studded with practice targets.

Did Samata Ullah have the expertise and/or access to the expertise or manufacturing capability for any of those steps?

Moreover, could Samata Ullah have tested and developed a guided missile without someone noticing?

Possession of first principle reading materials, such as chemistry, rocket, missile, etc., manuals or guides is a clear sign an alleged jihadist is an armchair jihadist.

Another sign of an armchair jihadist, along with the possession of such reading materials, is their failure to obtain explosives, weapons, etc., in an effective way.

The United States, via the CIA and the US military, routinely distributes explosives and weapons around the world to various factions.

A serious jihadist need only travel to well known locations and get in line for explosives, RPGs (rocket-propelled grenades), mortars, etc.

Does the weapon in this photo look homemade?

080213-A-6876F-021

Of course not! Anyone with a passport and a little imagination can possess a wide variety of harmful devices.

But then, they are not an armchair jihadist.

DIY missile/explosive reading clubs of jihadists are not threats to the public. Manufacturing of explosives and missiles are difficult and dangerous, tasks best left to professionals. They are more dangerous to each other than the general public.

When allocating law enforcement resources, remember that the only thing easier to acquire than weapons is possibly marijuana. Anyone planning on building weapons can be ignored as an armchair jihadist.

In the United States and the United Kingdom, law enforcement resources would be better spent in the pursuit of wealthy and governmental pedophiles.

PS: I started to edit the steps for building a guided missile for length but the description highlights the absurdity of the charges in question. Melting steel or aluminum and pouring it into a metal die? Please, that’s not a backyard activity. Neither is pouring molten rocket fuel using a centrifuge.

October 6, 2016

Unmasking Tor users with DNS

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 1:21 pm

Unmasking Tor users with DNS by Mark Stockley.

From the post:

Researchers at the KTH Royal Institute of Technology, Stockholm, and Princeton University in the USA have unveiled a new way to attack Tor and deanonymise its users.

The attack, dubbed DefecTor by the researchers’ in their recently published paper The Effect of DNS on Tor’s Anonymity, uses the DNS lookups that accompany our browsing, emailing and chatting to create a new spin on Tor’s most well established weakness; correlation attacks.

If you want the lay-person’s explanation of the DNS issue with Tor, see Mark’s post. If you want the technical details, read The Effect of DNS on Tor’s Anonymity.

The immediate take away for the average user is this:

Donate, volunteer, support the Tor project.

Your privacy or lack thereof is up to you.

Terrorist HoneyPots?

Filed under: Cybersecurity,HoneyPots,Security — Patrick Durusau @ 10:50 am

I was reading Checking my honeypot day by Mark Hofman when it occurred to me that discovering CIA/NSA/FBI cybertools may not be as hard as I previously thought.

Imagine creating a <insert-current-popular-terrorist-group-name> website, replete with content ripped off from other terrorist websites, including those sponsored by the U.S. government.

Sharpen your skills at creating fake Twitter followers, AI-generated tweets, etc.

Instead of getting a Booz Allen staffer to betray their employer, you can sit back and collect exploits as they are used.

With just a little imagination, you can create honeypots on and off the Dark Web to attract particular intelligence or law enforcement agencies, security software companies, political hackers and others.

If the FBI can run a porn site, you can use a honeypot to collect offensive cyberweapons.

October 4, 2016

Resource: Malware analysis – …

Filed under: Cybersecurity,Programming,Security — Patrick Durusau @ 2:04 pm

Resource: Malware analysis – learning How To Reverse Malware: A collection of guides and tools by Claus Cramon Houmann.

This resource will provide you theory around learning malware analysis and reverse engineering malware. We keep the links up to date as the infosec community creates new and interesting tools and tips.

Some technical reading to enjoy instead of political debates!

Enjoy!

October 2, 2016

Security Community “Reasoning” About Botnets (and malware)

Filed under: Bots,Cybersecurity,Security — Patrick Durusau @ 8:41 pm

In case you missed it: Source Code for IoT Botnet ‘Mirai’ Released by Brian Krebs offers this “reasoning” about a recent release of botnet software:

The source code that powers the “Internet of Things” (IoT) botnet responsible for launching the historically large distributed denial-of-service (DDoS) attack against KrebsOnSecurity last month has been publicly released, virtually guaranteeing that the Internet will soon be flooded with attacks from many new botnets powered by insecure routers, IP cameras, digital video recorders and other easily hackable devices.

The leak of the source code was announced Friday on the English-language hacking community Hackforums. The malware, dubbed “Mirai,” spreads to vulnerable devices by continuously scanning the Internet for IoT systems protected by factory default or hard-coded usernames and passwords.

Being a recent victim of a DDoS attack, perhaps Kerbs anger about the release of Mirai is understandable. But only to a degree.

Non-victims of such DDoS attacks have been quick to take up the “sky is falling” refrain.

Consider Hacker releases code for huge IoT botnet, or, Hacker Releases Code That Powered Record-Breaking Botnet Attack, or, Brace yourselves—source code powering potent IoT DDoSes just went public: Release could allow smaller and more disciplined Mirai botnet to go mainstream, as samples.

Mirai is now available to “anyone” but where the reasoning of Kerbs and others breaks down is there is no evidence that “everyone” wants to run a botnet.

Even if the botnet was as easy (sic) to use as Outlook.

For example, gun ownership in the United States is now at 36% of the adult population, but roughly one-third of the population will not commit murder this coming week.

As of 2010, there were roughly 210 million licensed drivers in the United States. Yet, this coming week, it is highly unlikely that any of them will commandeer a truck and run down pedestrians with it.

The point is that the vast majority of users, even if they were competent to read and use the Mirai code, aren’t criminals. Nor does possession of the Mirai code make them criminals.

It could be they are just curious. Or interested in how it was coded. Or, by some off chance, they could even have good intentions and want to study it to fight botnets.

Attempting to prevent the spread of information hasn’t resulted in any apparent benefit, at least to the cyber community at large.

Perhaps its time to treat the cyber community as adults, some of who will make good decisions and some less so.

Value-Add Of Mapping The Food Industry

Filed under: Cybersecurity,Security — Patrick Durusau @ 7:39 pm

Did you know that ten (10) companies control all of the major food/drink brands in the world?

behind-the-brands-illusion-of-choice-460

(From These 10 companies control everything you buy, where you can find a larger version of this image.)

You could, with enough searching, have put together all ten of these mini-maps, but then that effort would have to be repeated by everyone seeking the same information.

But, instead of duplicating an initial investment to identify players and their relationships, you can focus on identifying their IP addresses, process control machinery, employees, and other useful data.

What are your value-add of mapping examples?

« Newer PostsOlder Posts »

Powered by WordPress