The Shadow Brokers: Lifting the Shadows of the NSA’s Equation Group?.
A detailed summary of what is or isn’t known about The Shadow Brokers and the alleged hack of the Equation Group (NSA owned and operated).
The story is being updated at this location so check back for breaking details.
Enjoy!
Simple hack unlocks 100 million Volkswagen vehicles by Patrick Howell O’Neill.
From the post:
Some 100 million Volkswagens are vulnerable to hackers who discovered key vulnerabilities that allow them to unlock the doors of the most popular cars on earth, according to a new research paper first reported by Wired.
University of Birmingham computer scientist Flavio Garcia was already widely known for working with colleagues to find major security flaws in Volkswagens last year that enabled hackers to quickly takeover a keyless car.
The new attack could result in the theft of anything kept in a car.
When you put the two attacks together, you have a recipe for getting into and driving off with a stolen car in less than 60 seconds—Nic Cage-caliber grand theft auto.
Actually, you don’t need to be as good as Nic Cage at all. A thief can pull this off with cheap equipment like a TI Chronos smart watch.
…
In the interest of “responsible” disclosure, you will have to reconstruct some of the research for yourself.
There is a simple and absolute defense to this hack:
You can order one of these starting at $239.00.
Compared to the aggravation of having your Volkswagen stolen?
Thieves will pick an easier target.
(Be innovative in your security thinking.)
How To Detect and Find Rogue Cell Towers by Brian Benchoff
Great promise but less than great delivery. Detection rig is described in general terms, but so general that replication would be quite time consuming.
A generally available solution to detect rogue cell towers has yet to appear.
When they do, will this sign be useful?:
What about custom balloons with that logo?
Think of detection and warning of rogue cell towers as a civic duty.
Bungling Microsoft singlehandedly proves that golden backdoor keys are a terrible idea by Chris Williams.
From the post:
Microsoft leaked the golden keys that unlock Windows-powered tablets, phones and other devices sealed by Secure Boot – and is now scrambling to undo the blunder.
These skeleton keys can be used to install non-Redmond operating systems on locked-down computers. In other words, on devices that do not allow you to disable Secure Boot even if you have administrator rights – such as ARM-based Windows RT tablets – it is now possible to sidestep this block and run, say, GNU/Linux or Android.
What’s more, it is believed it will be impossible for Microsoft to fully revoke the leaked keys.
And perhaps most importantly: it is a reminder that demands by politicians and crimefighters for special keys, which can be used by investigators to unlock devices in criminal cases, will inevitably jeopardize the security of everyone.
Microsoft’s misstep was uncovered by two researchers, MY123 and Slipstream, who documented their findings here in a demoscene-themed writeup published on Tuesday. Slip believes Microsoft will find it impossible to undo its leak.
…
To understand the full technical implications of this Microsoft leak, let Chris take you through Secure Boot policies.
For representatives of the public, the summary is: Backdoor Key = Everyone has access.
Follow up question for representatives of the public: Is that what you want?
Have Lady GaGa CDs (Manning) or USB sticks labeled on one side NSA and the other Snowden to give anyone protesting government offices are secure. (Just me but I would put malware on both.)
Chris reports that as of 10 August 2016 that Microsoft has not commented on this story.
I hope MS puts on a brave face and says the leak was deliberate and done to illustrate the danger of golden backdoor keys.
They will no worse off than they are now and spun properly it could be a telling blow against backdoor keys.
A Monitor Darkly: Reversing and Exploiting Ubiquitous On-Screen-Display Controllers in Modern Monitors by Ang Cui, Jatin Kataria, Francois Charbonneau.
Abstract:
There are multiple x86 processors in your monitor! OSD, or on-screen-display controllers are ubiquitous components in nearly all modern monitors. OSDs are typically used to generate simple menus on the monitor, allowing the user to change settings like brightness, contrast and input source. However, OSDs are effectively independent general-purpose computers that can: read the content of the screen, change arbitrary pixel values, and execute arbitrary code supplied through numerous control channels. We demonstrate multiple methods of loading and executing arbitrary code in a modern monitor and discuss the security implication of this novel attack vector.
We also present a thorough analysis of an OSD system used in common Dell monitors and discuss attack scenarios ranging from active screen content manipulation and screen content snooping to active data exfiltration using Funtenna-like techniques. We demonstrate a multi-stage monitor implant capable of loading arbitrary code and data encoded in specially crafted images and documents through active monitor snooping. This code infiltration technique can be implemented through a single pixel, or through subtle variations of a large number of pixels. We discuss a step-by-step walk-through of our hardware and software reverse-analysis process of the Dell monitor. We present three demonstrations of monitoring exploitation to show active screen snooping, active screen content manipulation and covert data exfiltration using Funtenna.
Lastly, we discuss realistic attack delivery mechanisms, show a prototype implementation of our attack using the USB Armory and outline potential attack mitigation options. We will release sample code related to this attack prior to the presentation date.
This hack is surprising only in that discussions of the insecurity of the Internet of Things (IoT) have failed to mention the mini-Internet of Things sitting on our desktops.
The video of the presentation isn’t up on the BlackHat YouTube channel, yet. But check back.
Pro-tip: If you write about this hack, don’t say it uses “…unnoticeable sound waves…” to connect to a radio receiver. Radio waves != sound waves. Radio waves are electromagnetic radiation and sound waves are mechanical waves.
Delta Flights Grounded For Hours Due To Worldwide System Outage by Camila Domonoske.
From the post:
Delta flights around the world were delayed this morning due to a “computer outage,” the company says.
A power outage in Atlanta around 2:30 a.m. ET was responsible for the problem, the company said in a statement.
…
“We are aware that flight status systems, including airport screens, are incorrectly showing flights on time,” Delta says. Meanwhile, passengers attempting to check in online or through Delta’s app have reported seeing error messages.
The problem is “system-wide” and happening “everywhere,” the company has said.
….
No causes have been specified for the “power outage.”
But a good example of how imaginative hacking can bring down a worldwide transportation system, without ever breaching computer security.
Delta computer security is probably as good as airline security gets, but who needs root access when you can pull the power plug?
A real world denial of service (DoS) attack.
PS: How many degrees of separation does your computer security encompass?
While casting about for statistics on hacking I ran across two cyber security reports that need to be on your reading list:
Verizon’s 2016 Data Breach Investigations Report, in part because it shares its database of incident reports, a novelty in the area of cyber security.
2016 NTT Group, Global Threat Intelligence Report, which does not share the underlying data.
Both will repay a close reading several times over.
Enjoy!
PS: I extracted the statistics I needed for a post but I’m going to give both reports a slow read. My only regret is that the contents are trapped in dead PDF files, making it difficult to reuse or repurpose with other data.
I am reminded that Mark Logic has a xdmp:pdf-convert function.
NSA denies ‘Raiders of the Lost Ark’ stockpile of security vulnerabilities by Alex Hern.
From the post:
America’s National Security Agency (NSA) spends upwards of $25m in a year buying previously undisclosed security vulnerabilities – known as zero days, because that’s the length of time the target has had to fix them – but the large investment may not result in as much of a collection of hacking capabilities as is widely assumed.
Jason Healey, a senior research scholar at Columbia University and director at the Atlantic Council policy thinktank, argues that the true number of zero days stockpiled by the NSA is likely in the “dozens”, and that the agency only adds to that amount by a very small amount each year. “Right now it looks like single digits,” he says, adding that he has “high confidence in this assessment.”
…
One key piece of evidence comes from the NSA itself, which in 2015 claimed that 91% of vulnerabilities it procured were eventually disclosed to the vendors whose products were at risk. Of the other 9%, at least some of those weren’t disclosed because they were fixed before they could be, the agency adds.
Similarly, the White House has revealed that in one year since the current disclosure policy was implemented, it reviewed about 100 software vulnerabilities discovered by the NSA to determine if they should be disclose, and “kept only about two”. Healey adds that in the autumn of 2014, he was personally told that every single vulnerability which had come up for review had been disclosed.
…
No amount of factual reporting is likely to dispel the myth of an NSA horde of zero days.
However, the Verizon 2016 Data Breach Investigations Report makes it clear that zero days aren’t the main source of hacking danger:
That’s not an error! Vulnerabilities prior to 1999 are still in use.
You can spend your days discussing rumors of the latest zero day or you can insist that IT follow a verified application of patches process.
How effective is patching known vulnerabilities?
The top 10 internal vulnerabilities accounted for over 78 percent of all internal vulnerabilities during 2015. All 10 internal vulnerabilities are directly related to outdated patch levels on the target systems. (2016 NTT Group, Global Threat Intelligence Report, page 5. Emphasis in original.)
Routine patching can reduce your internal vulnerabilities by 78% (on average).
That’s a clear, actionable, measurable requirement.
Call up your IT department, ask for a list of all the software in your enterprise and a list of patches that have been applied to each instance and those waiting to be applied (as per the vendor).
Remember, a data breach maybe ITs “fault,” but it may be your job that is at risk.
PS: One of earliest uses of topic maps was to track software on a university network.
$hell on Earth: From Browser to System Compromise by Matt Molinyawe, Abdul-Aziz Hariri, and Jasiel Spelman.
From the paper:
The winning submissions to Pwn2Own 2016 provided unprecedented insight into the state-of-the-art techniques in software exploitation. Every successful submission provided remote code execution as the super user (SYSTEM/root) via the browser or a default browser plug-in. In most cases, these privileges were attained through the exploitation of the Microsoft Windows® or Apple OS X® kernel. Kernel exploitation, using the browser as an initial vector, was a rare sight in previous contests.
This white paper will detail the eight winning browser-to-super-user exploitation chains demonstrated at this year’s contest. Topics such as modern browser exploitation, the complexity of kernel use-after-free vulnerability exploitation, the simplicity of exploiting logic errors, and directory traversals in the kernel are also covered. This paper analyzes all attack vectors, root causes, exploitation techniques, and remediation for vulnerabilities.
Reducing attack surfaces with application sandboxing is a step in the right direction. However, the attack surface remains expansive and sandboxes only serve as minor obstacles on the way to complete compromise. Kernel exploitation is clearly a problem, which has not disappeared and is possibly on the rise. If you’re like us, you can’t get enough of it—it’s shell on earth.
Unless you are still reading Harry Potter and the cursed child, the $hell on Earth whitepaper will be your best read for the weekend.
Enjoy!
Tor Browser User Manual 6.0.1.
From About Tor Browser:
Tor Browser uses the Tor network to protect your privacy and anonymity. Using the Tor network has two main properties:
- Your internet activity, including the names and addresses of the websites you visit, will be hidden from your Internet service provider and from anyone watching your connection locally.
- The operators of the websites and services that you use, and anyone watching them, will see a connection coming from the Tor network instead of your real Internet (IP) address, and will not know who you are unless you explicitly identify yourself.
In addition, Tor Browser is designed to prevent websites from “fingerprinting” or identifying you based on your browser configuration.
By default, Tor Browser does not keep any browsing history. Cookies are only valid for a single session (until Tor Browser is exited or a New Identity is requested).
…
With intelligence agencies promising to obey laws in future, the saying:
Fool me once,
Shame on you;
Fool me twice,
Shame on me.
comes to mind.
Surf without Tor if you believe liars and law breakers won’t continue to be liars and law breakers, but for the rest of us the rule is:
Tor: Don’t surf the Internet Without It.
A secret group bought the ingredients for a dirty bomb — here in the U.S. by Patrick Malone.
From the post:
The clandestine group’s goal was clear: Obtain the building blocks of a radioactive “dirty bomb” — capable of poisoning a major city for a year or more — by openly purchasing the raw ingredients from authorized sellers inside the United States.
It should have been hard. The purchase of lethal radioactive materials — even modestly dangerous ones — requires a license from the Nuclear Regulatory Commission, a measure meant to keep them away from terrorists. Applicants must demonstrate they have a legitimate need and understand the NRC’s safety standards, and pass an on-site inspection of their equipment and storage.
But this secret group of fewer than 10 people — formed in April 2014 in North Dakota, Texas and Michigan — discovered that getting a license and then ordering enough materials to make a dirty bomb was strikingly simple in one of their three tries. Sellers were preparing shipments that together were enough to poison a city center when the operation was shut down.
The team’s members could have been anyone — a terrorist outfit, emissaries of a rival government, domestic extremists. In fact, they were undercover bureaucrats with the investigative arm of Congress. And they had pulled off the same stunt nine years before. Their fresh success has set off new alarms among some lawmakers and officials in Washington about risks that terrorists inside the United States could undertake a dirty bomb attack.
…
Fortunately, GAO investigators have shown no tendencies towards plotting overthrow of the United States government. If they had such tendencies, our government would have fallen long ago.
Malone provides an enjoyable account of the GAO romp through regulated access to radioactive materials.
Despite the language of Regulation of Radioactive Materials, the ease of obtaining radioactive materials will surprise you.
If you are interested in the security for hazardous biological materials, see: Preliminary Observations on Federal Efforts to Address Weaknesses Exposed by Recent Safety Lapses GAO-15-792T: Published: Jul 28, 2015. Publicly Released: Jul 28, 2015.
Puts our collective hand-wringing over SQL injection attacks into perspective. Yes?
How to Build Your Own Penetration Testing Drop Box by Beau Bullock.
With politics bleeding into even highly filtered feeds, thought it might be amusing to look at a hardware construction project.
I compared three single-board computers (SBC) against each other with a specific goal of finding which one would serve best as a “penetration testing drop box”, and maintain an overall price of around $110. Spoiler Alert: At the time I tested these Hardkernel’s ODROID-C2 absolutely destroyed the competition in this space. If you want to skip the SBC comparison and jump right to building your own pentest drop box you can find the instructions below and also here.
Overview
A few weeks ago I was scheduled for an upcoming Red Team exercise for a retail organization. In preparation for that assessment I started gathering all the gear I might need to properly infiltrate the organization, and gain access to their network. Social engineering attacks were explicitly removed from the scope for this engagement. This meant I wasn’t going to be able ask any employees to plug in USB devices, let me in certain rooms, or allow me to “check my email” on their terminals (yes this works).
Essentially, what were left at that point were physical attacks. Could I get access to a terminal left unlocked and perform a HID-based (think Rubber Ducky) attack? If the system wasn’t unlocked, perhaps a USB-Ethernet adapter (like the LAN Turtle) could be placed in line with the system to give me a remote shell to work from. Even if I could get physical access, without any prior knowledge of the network’s egress filtering setup, was I going to be able to get a shell out of the network? So this led me down the path of building a pentest drop box that I could place on a network, could command over a wireless adapter, automatically SSH out of a network, and just be an all-around pentesting box.
Some Device Requirements
Looking into the available options already out there it is very clear that I could either spend over $1,000 to buy something that did what I needed it to do, or try to build one comparable for significantly cheaper. So I set some very specific goals of what I wanted this device to do. Here they are:
- Device has to be relatively unnoticeable in size (could be plugged in under a desk unnoticed)
- Has to be able to be controlled over a wireless interface (bonus points if multiple wireless interfaces can be used so wireless management and wireless attacks can happen concurrently)
- Persistent reverse SSH tunnel to a command and control server
- Fully functional pentesting OS (not just a shell to route attacks through)
- Decent storage space (32-64GB)
- Actually be a usable pentesting box that is not sluggish due to hardware restrictions
- Cost around $110 total to build
…
I like that, requirements!
Assuming you have a briefcase or bulky coat, not a bad piece of hardware to have on you. Unless you anticipate physical searches. Can’t ever tell when you will be curious about something.
How foreign governments spy using PowerPoint and Twitter by Ron Deibert.
From the post:
News of the alleged Russian hack of the Democratic National Committee’s computers has riveted the world. But for many, this kind of behavior is a daily reality.
Take, for example, Syrian Nour Al-Ameer. A former vice president of the Syrian National Council, Al-Ameer was arrested and sent to infamous Adra prison in Damascus, where she was brutally tortured. Upon release, she became a refugee, fleeing to relative safety in Turkey.
Or so she thought.
Al-Ameer is a net savvy activist, and so when she received a legitimate looking email containing a PowerPoint attachment addressed to her and purporting to detail “Assad Crimes,” she could easily have opened it. Instead, she shared it with us at the Citizen Lab.
As we detail in a new report, the attachment led our researchers to uncover an elaborate cyberespionage campaign operating out of Iran. Among the malware was a malicious spyware, including a remote access tool called “Droidjack,” that allows attackers to silently control a mobile device. When Droidjack is installed, a remote user can turn on the microphone and camera, remove files, read encrypted messages, and send spoofed instant messages and emails. Had she opened it, she could have put herself, her friends, her family and her associates back in Syria in mortal danger.
Our organization has been documenting these type of targeted digital attacks against civil society for years. We’ve found that these organizations are assaulted by state-based cyberespionage the same way that governments and industry are. But they’re far less equipped to deal, and receive significantly less attention from policymakers.
…
A great post that quickly becomes disappointing because Ron cites only the usual suspects, China, Ethiopia, Latin America, Russia, Sudan, and the United Arab Emirates as governments that spy on civil society.
The United States has confessed to spying on its citizens. Illegally.
You can argue the United States hasn’t murdered its citizens on the basis of illegal surveillance (that we know of), but it has overthrown governments and inflicted hundreds of thousands of casualties upon civilian populations based on its spying efforts.
Every citizen, of all countries, deserves robust defenses against spying governments.
All governments, no exceptions.
From the webpage:
Tor 0.2.8.6 has been released! You can download the source from the Tor website. Packages should be available over the next week or so.
Tor 0.2.8.6 is the first stable version of the Tor 0.2.8 series.
The Tor 0.2.8 series improves client bootstrapping performance, completes the authority-side implementation of improved identity keys for relays, and includes numerous bugfixes and performance improvements throughout the program. This release continues to improve the coverage of Tor’s test suite.
Below is a list of the changes since Tor 0.2.7. For a list of only the changes that are new since 0.2.8.5-rc, please see the ChangeLog file.
…
Government agencies are upgrading and so should you.
The Transparency Toolkit has created the Surveillance Industry Index, which as of today (August 2, 2016), has 2350 entries.
Remembering the security incidents that have plagued some security firms, I wonder if this is a list of vendors, targets or perhaps both?
Yet another example of what is called “reader response” theory in action.
Enjoy!
Update: Data for the Surveillance Industry Index.
Will make your scanning of the vendors marginally easier.
After all, how much can you trust them, their products or services if they can’t keep you out?
After posting about truth telling being a threat to democracy, in the eyes of some, I encountered: Facebook Phishing Scam Using Pornographic Images to Steal Login Data, which reads in part:
There is no way to stop cyber criminals from stealing login credentials of innocent social media users — Recently, one of the HackRead’s writers found a Facebook phishing scam targeting users and stealing their login data. What makes this phishing scam dangerous is the fact that apparently non of the phishing filters have detected any wrongdoing with the links used in this campaign.
Cyber criminals behind this scam have three motives one is to steal users’ login credentials, the second is to get some likes on their Facebook page and third is to profit financially. It starts with scammers posting a link in the comments section of several Facebook groups with a large thumbnail of a nude girl but to make it look like a legit link scammers also mention that video already got hundreds of comments, shares plus thousands of views. The description on the link goes something like this ”groups teen-girl-japannese-18-[retracted]–010 Click HERE to view video recorded 2.381 Likes, 749 Comments, 9.185 Views, 571 Share.”
…
Now there’s a serious security issue!
Taking advantage of users who are surfing Facebook for porn.
Talk about fishing (sorry) in the shallow end of the security pool.
Hard to say what other access could be leveraged using Facebook logins of such users.
Nuclear launch computers, remote admin at NSA, White House switchboard, free pizza line at Papa Johns. I take that back, Papa Johns probably has better OpSec than the others I mentioned. (That’s sarcasm for all the literalists in the crowd.)
Phishing With Pornography would make a great book title but I don’t know what sort of animal(s) should go on the cover. (Something from National Lampoon perhaps?)
Suggestions?
PS: If you think this indicates I have little sympathy for victims of pornography-based phishing schemes, take a point for your house.
You already know I consider “…the Russians are coming, the Russians are coming…” claims in connection with the DNC hack to have, err, less than a firm factual basis (being polite).
Bruce Schneier, who needs no introduction to anyone concerned about computer security issues, has a quite different take on those claims.
Bruce writes:
Russia has attacked the U.S. in cyberspace in an attempt to influence our national election, many experts have concluded. We need to take this national security threat seriously and both respond and defend, despite the partisan nature of this particular attack.
There is virtually no debate about that, either from the technical experts who analyzed the attack last month or the FBI which is analyzing it now. The hackers have already released DNC emails and voicemails, and promise more data dumps.
While their motivation remains unclear, they could continue to attack our election from now to November — and beyond.
…
If you have read those “expert” reports carefully, you will remember that despite positive claims of Russian responsibility, the attribution dissolves into “…we have seen this before… (no offers of what has been seen before),” and “…this is characteristic of … (again, no data)” and similar statements.
Perhaps Bruce trusts these experts in the absence of data that connects all the dots.
But in any event, what do you make of his claim that truth telling about the DNC is “…a national security threat against our democracy…?”
So far as I know, no one has denied the documents leaked about the DNC. Given the time lapse and subsequent events, I take it that everyone accepts the documents are a truthful report of the emails and documents of the DNC.
People have been embarrassed, people have resigned, the public has been slightly disabused of any idealistic notions about the political process, a rare interjection of truth into the political process has occurred, but I’m not seeing “…a national security threat against our democracy….”
How can anyone, Bruce included, claim that truth telling ever rises to the level of a “…a national security threat against our democracy….”
I’m probably old-fashioned but I was taught that truth telling was the basis for meaningful democracy, not a threat to it.
Would you deprive voters of truthful information based on its point of origin?
Shouldn’t voters (who are voting after all) be allowed to decide what weight they will or will not give even truthful information?
PS: Attacks on voting machines and election mechanisms are in a different (criminal) category from the disclosure of truthful information. But we should be thankful that foreign powers haven’t adopted the US practice of assassination to influence elections.
It hasn’t taken long for the privileged to cry “boo, hoo, hoo,” over Justin Seitz’s releasing the results of using OnionScan on over 8,000 Dark Web sites. You can find Justin’s dump here.
Joseph Cox writes in: Hacker Mass-Scans Dark Web Sites for Vulnerabilities, Dumps Results:
…Sarah Jamie Lewis, the creator of OnionScan, warns that publishing the full dataset like this may lead to some Tor hidden services being unmasked. In her own reports, Lewis has not pointed to specific sites or released the detailed results publicly, and instead only provided summaries of what she found.
“If more people begin publishing these results then I imagine there are a whole range of deanonymization vectors that come from monitoring page changes over time. Part of the reason I destroy OnionScan results once I’m done with them is because people deserve a chance to fix the issue and move on—especially when it comes to deanonymization vectors,” Lewis told Motherboard in an email, and added that she has, when legally able to, contacted some sites to help them fix issues quietly.
…
Sarah Jamie Lewis and others who seek to keep vulnerability data secret are making two assumptions:
I agree only with #2 and it is the reason I support public and widespread distribution of data, all data.
Widespread access to data means it is your choices and abilities that determine its uses and not privilege of access.
BTW, Justin has the better of the exchange:
…
Seitz, meanwhile, thinks his script could be a useful tool to many people. “Too often we set the bar so high for the general practitioner (think journalists, detectives, data geeks) to do some of this larger scale data work that people just can’t get into it in a reasonable way. I wanted to give people a starting point,” he said.“I am a technologist, so it’s the technology and resulting data that interest me, not the moral pros and cons of data dumping, anonymity, etc. I leave that to others, and it is a grey area that as an offensive security guy I am no stranger to,” he continued.
…
The question is: Do you want privileged access to data for Sarah Jamie Lewis and a few others or do you think everyone should have equal access to data?
I know my answer.
What’s yours?
QRLJacking — Hacking Technique to Hijack QR Code Based Quick Login System by Swati Khandelwal.
I put today’s date in the title so several years from now when a “security expert” breathlessly reports on “terrorists” using QRLJcking, you can easily find that it has been in use for years.
For some reason, “security experts” fail to mention that governments, banks, privacy advocates and numerous others in all walks of life and business use cybersecure services. Maybe that’s not a selling point for them. You think?
In any event, Swati gives a great introduction to QRLJacking, starting with:
Do you know that you can access your WeChat, Line and WhatsApp chats on your desktop as well using an entirely different, but fastest authentication system?
It’s SQRL, or Secure Quick Response Login, a QR-code-based authentication system that allows users to quickly sign into a website without having to memorize or type in any username or password.
QR codes are two-dimensional barcodes that contain a significant amount of information such as a shared key or session cookie.
A website that implements QR-code-based authentication system would display a QR code on a computer screen and anyone who wants to log-in would scan that code with a mobile phone app.
Once scanned, the site would log the user in without typing in any username or password.
Since passwords can be stolen using a keylogger, a man-in-the-middle (MitM) attack, or even brute force attack, QR codes have been considered secure as it randomly generates a secret code, which is never revealed to anybody else.
But, no technology is immune to being hacked when hackers are motivated.
…
Following this post and the resources therein, you will be well prepared for when your usual targets decide to “upgrade” to SQRL, or Secure Quick Response Login.
Enjoy!
PS: There is a well-known pattern in this attack, one that is true for other online security systems. Do you see it?
No, no tips from “Russian hackers,” but rather from the fine staff at the Wall Street Journal (WSJ).
You may have heard of the WSJ. So far as I know, they have never been accused of collaboration with Russian hackers, Putin or the KGB.
Anyway, the WSJ posted: Get and analyze Hillary Clinton’s email, which reads in part as follows:
In response to a public records request, the U.S. State Department is releasing Hillary Clinton’s email messages from her time as secretary of state. Every month, newly released messages are posted to foia.state.gov as PDFs, with some metadata.
This collection of tools automates downloading and helps analyze the messages. The Wall Steet Journal’s interactive graphics team uses some of this code to power our Clinton inbox search interactive.
…
Great step-by-step instructions on getting setup to analyze Clinton’s emails, with the one caveat that I had to change:
pip install virtualenv
to
sudo pip install virtualenv
With that one change, everything ran flawlessly on my Ubuntu 14.04 box.
Go ahead and get setup to analyze the emails.
Tomorrow: Clues from this data set to help in the hunt for the 30K deleted Hillary Clinton emails.
Would-be strongman (US President) Donald Trump insulted North Korean, Chinese, East European, to say nothing of American hackers today:
Donald J. Trump said Wednesday that he hoped Russia had hacked Hillary Clinton’s email, essentially encouraging an adversarial foreign power’s cyberspying on a secretary of state’s correspondence.
“Russia, if you’re listening, I hope you’re able to find the 30,000 emails that are missing,” Mr. Trump said, staring directly into the cameras. “I think you will probably be rewarded mightily by our press.”
…
(Donald Trump Calls on Russia to Find Hillary Clinton’s Missing Emails by Ashley Parker.)
Russia’s name has been thrown around recently, like the “usual suspects” in Casablanca, but that’s no excuse for Trump to insult other worthy hackers.
No slight to Russian hackers but an open competition between all hackers is the best way to find the 30K deleted Clinton emails.
Trump hasn’t offered a cash prize but think of the street cred you would earn for your nation/group!
Don’t limit yourself to the deleted emails.
Making Clinton’s campaign security the equivalent of an extreme string bikini results in bragging rights as well.
The Jihadists’ Digital Toolbox: How ISIS Keeps Quiet on the Web by Jett Goldsmith.
From the post:
As the world dives deeper into the digital age, jihadist groups like ISIS and the Taliban have taken increasingly diverse measures to secure their communications and espouse their actions and ideas across the planet.
Propaganda has been a key measure of any jihadist group’s legitimacy since at least 2001, when al-Qaeda operative Adam Yahiye Gadahn established the media house As-Sahab, which was intended to spread the group’s message to a regional audience throughout Pakistan and Afghanistan.
Over the years, jihadist propaganda has taken a broader and more sophisticated tone. Al-Qaeda published the first issue of its digital newsmagazine, Inspire, in June of 2010. Inspire was aimed at an explicitly Western audience, and intended to call to jihad the would-be mujahideen throughout Europe and the United States.
When ISIS first took hold in Iraq and Syria, and formally declared its caliphate in the summer of 2014, the group capitalized on the groundwork laid by its predecessors and established an expansive, highly sophisticated media network to espouse its ideology. The group established local wilayat (provincial) media hubs, and members of its civil service distributed weekly newsletters, pamphlets, and magazines to citizens living under its caliphate. Billboards were posted in major cities under its control, including in Raqqah and Mosul; FM band radio broadcasts across 13 of its provinces were set up to deliver a variety of content, from fatwas and sharia lessons to daily news, poetry, and nasheeds; and Al-Hayat Media Center distributed its digital newsmagazine, Dabiq, in over a dozen languages to followers across the world.
…
Jeff covers:
That Jihadists or anyone else are using these tools maybe a surprise to some Fortune or Economist readers, but every conscious person associated with IT can probably name one or more instances for each category.
I’m sure some Jihadists drive cars, ride hoverboards, or bicycles, but dramatic recitations on those doesn’t advance a discussion of Jihadists or their goals.
Privacy software is a fact of life in all walks and levels of a digital environment.
Crying “Look! Over there! Someone might be doing something we don’t like!” isn’t going to lead to any useful answers, to anything. Including Jihadists.
PornHub Pays Hackers $20,000 to Find Zero-day Flaws in its Website by Wang Wei.
From the post:
Cyber attacks get bigger, smarter, more damaging.
PornHub launched its bug bounty program two months ago to encourage hackers and bug bounty hunters to find and responsibly report flaws in its services and get rewarded.
Now, it turns out that the world’s most popular pornography site has paid its first bounty payout. But how much?
US $20,000!
…
Not every day that a porn site pays users!
While PHP has fixed the issue, be mindful there are plenty of unpatched versions of PHP in the wild.
Details of this attack can be found at: How we broke PHP, hacked Pornhub and earned $20,000 and Fuzzing Unserialize.
Any estimate of how many non-patched PHP installations are on sites ending in .gov or .com?
Against the Law: Countering Lawful Abuses of Digital Surveillance by Andrew “bunnie’ Huang and Edward Snowden.
From the post:
Front-line journalists are high-value targets, and their enemies will spare no expense to silence them. Unfortunately, journalists can be betrayed by their own tools. Their smartphones are also the perfect tracking device. Because of the precedent set by the US’s “third-party doctrine,” which holds that metadata on such signals enjoys no meaningful legal protection, governments and powerful political institutions are gaining access to comprehensive records of phone emissions unwittingly broadcast by device owners. This leaves journalists, activists, and rights workers in a position of vulnerability. This work aims to give journalists the tools to know when their smart phones are tracking or disclosing their location when the devices are supposed to be in airplane mode. We propose to accomplish this via direct introspection of signals controlling the phone’s radio hardware. The introspection engine will be an open source, user-inspectable and field-verifiable module attached to an existing smart phone that makes no assumptions about the trustability of the phone’s operating system.
If that sounds great, you have to love their requirements:
Our introspection engine is designed with the following goals in mind:
- Completely open source and user-inspectable (“You don’t have to trust us”)
- Introspection operations are performed by an execution domain completely separated from the phone’s CPU (“don’t rely on those with impaired judgment to fairly judge their state”)
- Proper operation of introspection system can be field-verified (guard against “evil maid” attacks and hardware failures)
- Difficult to trigger a false positive (users ignore or disable security alerts when there are too many positives)
- Difficult to induce a false negative, even with signed firmware updates (“don’t trust the system vendor” – state-level adversaries with full cooperation of system vendors should not be able to craft signed firmware updates that spoof or bypass the introspection engine)
- As much as possible, the introspection system should be passive and difficult to detect by the phone’s operating system (prevent black-listing/targeting of users based on introspection engine signatures)
- Simple, intuitive user interface requiring no specialized knowledge to interpret or operate (avoid user error leading to false negatives; “journalists shouldn’t have to be cryptographers to be safe”)
- Final solution should be usable on a daily basis, with minimal impact on workflow (avoid forcing field reporters into the choice between their personal security and being an effective journalist)
This work is not just an academic exercise; ultimately we must provide a field-ready introspection solution to protect reporters at work.
You need to copy those eight requirements out to a file for editing. When anyone proposes a cybersecurity solution, reword as appropriate as your user requirements.
An artist conception of what protection for an iPhone might look like:
Interested in protecting reporters and personal privacy? Follow Andrew ‘bunnie’ Huang’s blog.
Why You Can’t Keep Secrets by William M. Arkin.
From the post:
I started thinking about this talk by polling friends in Washington to see if there were any good new jokes about secrecy. In other parts of the world, political jokes are often the purest expression of zeitgeist, so I thought a current favorite — you know, some knee slapper about the new Executive Order on classification, or one about the latest string of Bill Gertz’ leaks — would provide astute insight.
No dice though; people inside the beltway have never been renown for their humor.
In May, however, I was in Beirut, and the number of jokes about the Syrians were impressive.
Here’s my favorite.
Hafez Assad is with Bill Clinton and Jacques Chirac on the Mississippi River to negotiate Syria’s withdrawal from Lebanon. Assad drops his watch into the river and when he bend over the deck railing to look for it, snapping alligators thrust up from the deep. Clinton tells one of the Marine guards to retrieve President Assad’s watch. The Marine goes to the edge, looks over at the alligators and says to the President Mr. President, you know we live in the greatest country on earth, and therefore I can decline an unlawful order. If I jump in to retrieve Mr. Assad’s watch I would die, and besides I have a family…
So Chirac, thinking he can tweak the American nose says to a French soldier, jump in the water and retrieve Assad’s watch. The legionnaire snaps to attention and runs to dive in, but he then looks over and sees the snapping alligators, and turns to Chirac and says Monsieur President, you know our democracy is even older than America, and besides, I have a family…
So Assad whispers something in the ear of a Syrian soldier, who runs to the railing and without hesitation, jumps in the water, swims through the alligators, retrieves the watch, and returns safely to the boat. The Marine and the Legionnaire, both amazed, crowd around the Syrian to ask what Assad said.
Well, the soldier explains, I too have a family…
**
So what does this have to do with secrecy?
To me, it is a real world reminder that to level any kind of indictment about the evils of U.S. government secrecy is to be trivial. One only has to visit places like the Middle East to appreciate how free our system is.
…
Given the current events in Syria, a timely posting of a speech that Arkin made:
…twenty years ago to military and industry officers and officials at the annual U.S. Air Force National Security Leadership Course, Maxwell AFB, Alabama, delivered on 14 August 1996.
The central difficulty of secrecy and cybersecurity are both captured by the line:
Anyone knows that in order to preserve real secrets, they need to be identified.
As opposed to the blanket classification of nearly every document, memo, draft, email, etc., which is nearly the current practice in the Obama administration, you have to pick which secrets are truly worth protecting. And then protect them.
As Arkin points out, to do otherwise generates a climate where leaks are a routine part of government and generates suspicion even when the government, perhaps by accident, is telling the truth.
The same principle is true for cybersecurity. Have you identified the components of your network and the level of security appropriate to each one? Or do VPs still have write access to the accounting software?
For meaningful secrecy or cybersecurity, you must have explicit identification of what is to be secret/secure and what steps are taken to bring that about. Anything less and you won’t be able to keep secrets and/or have cybersecurity. (Ask the Office of Personnel Management (OPM) for example.)
The Troubling State of Security Cameras; Thousands of Devices Vulnerable by Ali Raza.
From the post:
The recent Lizard Squad hack which resulted in a lot of CCTV cameras targeted and hijacked by a DDOS attack has highlighted the need for better security cameras. A study conducted by Protection1 shows how many security agencies do not take things seriously, Protection1 report.
The Lizard Squad hack is not the first instance of security cameras being overridden and used to spy on people. The widespread hack has brought to light once again just how many security cameras are under operation without any sort of protection, making them sitting ducks for any hacker with moderate skills. The CCTV cameras in the US that were attacked by the Lizard Squad hack were used in a wide range of areas from home security and traffic cams to cameras in banks and restaurants.
The ease of carrying out this attack prompted security company Protection1 to investigate the matter. The rising levels of sophistication of hacking tools and the incompetence of security personnel to keep in touch with hackers have made hunting much simpler for hackers. In a bid to understand just how serious the situation is, Protection1 analyzed 6,000 unsecured or open cameras all over the United States of America to find out which companies do not take your security seriously. They pulled data from the cameras using insecam.org and mapped and analyzed the locations to generate results.
…
Ali re-uses all the graphics from the Protection1 report, which is itself written in a very summary fashion. No in depth coverage of the cameras and/or techniques to access them.
Be aware that Protection1 is a home/business security monitoring type company and not likely to interest cybersecurity fans.
As far as the “troubling state of security cameras,” that depends upon who you ask.
If you are selling security solutions, it is click-bait for customers who want to be more secure.
If you are selling surveillance, access and data collection services, such cameras are additional data sources.
How to See If Your VPN Is Leaking Your IP Address (and How to Stop It) by Alan Henry.
From the post:
…
To see if your VPN is affected:
Visit a site like What Is My IP Address and jot down your actual ISP-provided IP address. Log in to your VPN, choose an exit server in another country (or use whichever exit server you prefer) and verify you’re connected. Go back to What Is My IP Address and check your IP address again. You should see a new address, one that corresponds with your VPN and the country you selected. Visit Roseler’s WebRTC test page and note the IP address displayed on the page. If both tools show your VPN’s IP address, then you’re in the clear. However, if What Is My IP Address shows your VPN and the WebRTC test shows your normal IP address, then your browser is leaking your ISP-provided address to the world.
…
Attempting to conceal your IP address and at the same time leaking it (one assumes unknowingly), can lead to a false sense of security.
Follow the steps Alan outlines to test your setup.
BTW, Alan’s post includes suggestions for how to fix the leak.
If you blindly trust concealment measures and software, you may as well activate links in emails from your local bank.
Word for the Day: Trust – Synonym for pwned.
Verify your concealment on a regular basis.
Swati Khandelwal reports the departure of Lucky Green from the Tor project will result in the loss of several critical Tor nodes and require an update to Tor code. (Core Tor Contributor Leaves Project; Shutting Down Important Tor Nodes)
Here’s the Tonga (Bridge Authority) Permanent Shutdown Notice in full:
Dear friends,
Given recent events, it is no longer appropriate for me to materially contribute to the Tor Project either financially, as I have so generously throughout the years, nor by providing computing resources. This decision does not come lightly; I probably ran one of the first five nodes in the system and my involvement with Tor predates it being called “Tor” by many years.
Nonetheless, I feel that I have no reasonable choice left within the bounds of ethics, but to announce the discontinuation of all Tor-related services hosted on every system under my control.
Most notably, this includes the Tor node “Tonga”, the “Bridge Authority”, which I recognize is rather pivotal to the network
Tonga will be permanently shut down and all associated crytographic keys destroyed on 2016-08-31. This should give the Tor developers ample time to stand up a substitute. I will terminate the chron job we set up so many years ago at that time that copies over the descriptors.
In addition to Tonga, I will shut down a number of fast Tor relays, but the directory authorities should detect that shutdown quickly and no separate notice is needed here.
I wish the Tor Project nothing but the best moving forward through those difficult times,
–Lucky
As I mentioned in Going Dark With Whisper? Allies versus Soul-Mates it is having requirements other than success of a project that is so damaging to such efforts.
I could discover that IS is using the CIA to funnel money from the sales of drugs and conflict diamonds to fund the Tor project and it would not make any difference to me. Even if core members of the Tor project knew that and took steps to conceal it.
Whether intended or not, the only people who will benefit from Lucky’s decision will be opponents of personal privacy and the only losers will be people who need personal privacy.
Congratulations Lucky! You are duplicating a pattern of behavior that destroyed the Black Panthers, the SDS and a host of other groups and movements before and since then.
Let’s hope others don’t imitate Lucky’s “I’ll take my ball and go home” behavior.
After posting Safe Sex and Safe Chat, I asked a close friend if they used Signal from Open Whisper Systems, thinsing it would be good to practice before security is an absolute requirement.
In response I was sent a link to: Internet privacy, funded by spooks: A brief history of the BBG by Yasha Levine.
I take that to mean they aren’t using Whisper. 😉
Levine’s factual points about U.S. government funding of Tor, Whisper, etc., accord with my general impression of that history, but I do disagree with his concluding paragraph:
…
You’d think that anti-surveillance activists like Chris Soghoian, Jacob Appelbaum, Cory Doctorow and Jillian York would be staunchly against outfits like BBG and Radio Free Asia, and the role they have played — and continue to play — in working with defense and corporate interests to project and impose U.S. power abroad. Instead, these radical activists have knowingly joined the club, and in doing so, have become willing pitchmen for a wing of the very same U.S. National Security State they so adamantly oppose.
So long as privacy projects release open source code, I don’t see any source of funding as problematic. Drug cartels would have to launder their money first but even rumored drug money spends just like other. Terrorists should step up just to bother and confound the FBI, which sees informational darkness around every corner.
So long as the funding is toward the same goal, security in communication and all the work product is open source, then I see no natural limits on who can be allies of these projects.
I say allies because I mean just that, allies. Who may have their own reasons, some fair and some foul, for their participation and funding. So long as we are advancing towards a common goal, that in other arenas we have conflicts, is irrelevant.
One of the primary reasons why so many groups in the 1960’s failed is because everyone had to agree to be soul-mates on every issue. If you want a potpourri of splinter groups who spend more time fighting among themselves than with others, take that tack.
If, on the other hand, you want funded, effective research that may make a real difference to you and your allies, be more focused on the task at hand and less on the intrinsic goodness (or lack thereof) of your allies.
Matthew Haeck repeats the old dodge for bothering with encrypted communications:
If I’m doing nothing wrong, it doesn’t matter
in Secure Messaging Apps for Encrypted Chat.
Most of us, outside of subscribers to the Linux Journal, never imagine that we are under surveillance by government agencies. And we may not be.
But, that doesn’t mean our friends and acquaintances aren’t under surveillance by domestic and foreign governments, corporations and others.
You should think of encrypted communications, chat in this case, just like you do safe sex.
It not only protects yourself, but your present partner and all future partners the both of you may have.
The same is true for use of encrypted chat. The immediate benefit is for your and your partner, but secure chat, denies the government and others, the use of your chats against unknown future chat partners.
If you practice safe sex, practice safe chat.
Secure Messaging Apps for Encrypted Chat is a great start towards practicing safe chat.
Powered by WordPress