Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

Ethereum Contracts Are Going To Be Candy For Hackers by Peter Vessenes.

From the post:

Smart Contracts and Programming Defects

Ethereum promises that contracts will ‘live forever’ in the default case. And, in fact, unless the contract contains a suicide clause, they are not destroyable.

This is a double-edged sword. On the one hand, the default suicide mode for a contract is to return all funds embedded in the contract to the owner; it’s clearly unworkable to have a “zero trust” system in which the owner of a contract can at will claim all money.

So, it’s good to let people reason about the contract longevity. On the other hand, I have been reviewing some Ethereum contracts recently, and the code quality is somewhere between “optimistic as to required quality” and “terrible” for code that is supposed to run forever.

Dan Mayer cites research showing industry average bugs per 1000 lines of code at 15-50 and Microsoft released code at 0.5 per 1000, and 0(!) defects in 500,000 lines of code for NASA, with a very expensive and time consuming process.

Ethereum Smart Contract Bugs per Line of Code exceeds 100 per 1000

My review of Ethereum Smart Contracts available for inspection at dapps.ethercasts.com shows a likely error rate of something like 100 per 1000, maybe higher.
…

If you haven’t seen Ethereum, now is the time to visit.

From the homepage:

Ethereum is a decentralized platform that runs smart contracts: applications that run exactly as programmed without any possibility of downtime, censorship, fraud or third party interference.

These apps run on a custom built blockchain, an enormously powerful shared global infrastructure that can move value around and represent the ownership of property. This enables developers to create markets, store registries of debts or promises, move funds in accordance with instructions given long in the past (like a will or a futures contract) and many other things that have not been invented yet, all without a middle man or counterparty risk.

The project was crowdfunded during August 2014 by fans all around the world. It is developed by the Ethereum Foundation, a Swiss nonprofit, with contributions from great minds across the globe.

Early in the life cycle and some contracts will be better written than others.

Vulnerabilities will be Authors x Contracts so the future looks bright for hackers.

Experts Warn of Super-Stealthy Furtim Malware by Phil Muncaster.

From the post:

Security experts are warning of newly discovered credential-stealing malware which prioritizes stealth, scoring a 0% detection rate in VirusTotal.

Furtim, a Latin word meaning “by stealth,” was first spotted by researcher @hFireF0X and consists of a driver, a downloader and three payloads, according to enSilo researcher Yotam Gottesman.

The payloads are: a power-saving configuration tool which ensures a victim’s machine is always on and communicating with Furtim’s C&C server; Pony Stealer – a powerful commercial credential stealer; and a third file that communicates back to the server but has yet to be fully analyzed.

Interestingly, Furtim goes to great lengths to stay hidden, going well beyond most malware in checking for the presence of over 400 security tools on the targeted PC, Gottesman claimed.
…

Phil’s post summarizes some of the better ideas used in this particular bit of malware.

The post by enSilo researcher Yotam Gottesman includes this description:

…
Upon initial communication, Furtim collects unique information from the device it is running on, such as the computer name and installation date and sends that information to a specific server. The server stores the received details about the infected machine to ensure that the payload is sent only once.
…

That reminds me of the search warrant Ben Cox posted in Here Is the Warrant the FBI Used to Hack Over a Thousand Computers, which reads in part:

From any “activating” computer described in Attachment A:

1. The “activating” computer’s actual IP address, and the date and time that the NIT determines what that IP address is;

2. a unique identifier generated by the NIT (e.g., a series of numbers, letters, and/or special characters) to distinguish data from that of other “activating” comptuers, that will be sent with and collected by the NIT;

3. the type of operating system running on the computer, including type (e.g., Windows), version (e.g., Windows 7), and architecture (e.g., x 86);

4. information about whether the NIT has already been delivered to the “activating” computer;

5. the “activating” computer’s Host name;

6. the “activating” computer’s active operating system username; and

7. the “activating” computer’s media access control (“MAC”) address;

….

I mention that because if the FBI can’t prove its NIT’s capabilities against the users computer, who knows where they got the information they now claim to have originated from a child porn website?

Considering the FBI knowingly gave flawed testimony for twenty years, including in death penalty cases, when prosecutors were aware of those flaws, absence both source code and a demonstration of its use against the defendant’s computer as it existed then, the NIT evidence should be excluded at trial.

Or at the very least, a jury instruction that recites the FBI’s history of flawed technical testimony in detail and cautioning the jury that they should view all FBI “evidence” as originating from habitual liars.

Could be telling the truth, but that hasn’t been their habit. (Judicial notice of the FBI practice of providing flawed evidence.)

No, don’t waste your breath blaming victims.

Do use this list and similar lists as checks on allowable passwords.

One really good starting place would be: Today I Am Releasing Ten Million Passwords by Mark Burnett.

My day started with reading WhatsApp Message Hacked By John McAfee And Crew by Steve Morgan.

I thought it made the important point that while the WhatsApp message is secured by bank vault quality encryption:

By LoKiLeCh (Own work) [GFDL, CC-BY-SA-3.0, CC BY-SA 2.5-2.0-1.0, GFDL, CC-BY-SA-3.0 or CC BY-SA 2.5-2.0-1.0], via Wikimedia Commons

When you enlarge the little yellow note on the front (think Android) you find:

While your message encryption may be Shannon secure end-to-end, the security of your OS, to say nothing of your personal, organizational, etc., security counts whether the message is indeed “secure.”

A better illustration would be to show McAfee and crew taking the vault out of the wall (think OS) but my graphic skills aren’t up to that task. 😉

That’s a useful lesson and to be honest, McAfee says as much, in the fifth paragraph of the story.

So I almost fell off my perch when later in the morning I read:

John McAfee Apparently Tried to Trick Reporters Into Thinking He Hacked WhatsApp by William Turton.

Here’s the lead paragraph:

John McAfee, noted liar and one-time creator of anti-virus software, apparently tried to convince reporters that he hacked the encryption used on WhatsApp. To do this, he attempted to send them phones with preinstalled malware and then convince them he was reading their encrypted conversations.
…

Just in case you don’t follow the “noted liar” link, that’s another post written by William Turton.

The “admitted lie” was one of simplification, compressing an iPhone hack into sound bite length.

Ever explain (attempt) computer technology to the c-suite? You are guilty of the same type of lies.

If someone divested themselves of their interest in WhatsApp because they didn’t read to the fifth paragraph of the original story, I’m sorry.

Read before you re-tweet/re-post and/or change your investments. Whether it’s a John McAfee story or not.

Famous Nulled.io Hacking Forum Suffers Devastating Data Breach by Catalin Cimpanu.

From the post:

…
According to security firm Risk Based Security, the leaked data was offered as a 1.3 GB tar archive that decompressed to a 9.45 GB db.sql file, which was a database dump of the entire forum’s database.

Everything from user accounts to private messages, and from VIP forum posts to financial transactions were included. More precisely, the data contained 536,064 user accounts, 800,593 user personal messages, 5,582 purchase records, and 12,600 invoices.

For each user, leaked data included his forum username, email address, hashed password, join date, IP records, and other forum-related tidbits such as titles and post counts.

Crime investigation agencies are most likely to be interested in this leak since it also includes 907,162 authentication logs with geolocation data that will allow them to tie various criminal activity to IPs, forum usernames, and email addresses.
…

I am waiting to see Oliver Keyes, OKCupid data and Scientific Censorship, ride in to condemn this unknown hacker for breaching the privacy of the users of Nulled.io and for the data not being anonymised.

Or in Oliver’s words on another data breach:

…this is without a doubt one of the most grossly unprofessional, unethical and reprehensible data releases I have ever seen.

I wonder where this one ranks?

Considering that criminal charges are a distinct possibility from the data breach?

I haven’t looked at the data, yet, but if hackers failed to take steps to conceal their identities on a site devoted to hacking, user education on security may be a lost cause.

World Password Day

Yeah, there is a website for “World Password Day.”

What Brian Barrett over at Wired refers to as a “made-up holiday.” 7 Password Experts on How to Lock Down Your Online Security.

I won’t tell Brian that all holidays are “made-up” if you don’t. Promise.

Read Brian’s post anyway because he does report seven tips that will make your password stronger than the average password.

Notice I did not say your password will be secure, just more secure than passwords on average.

Use this as a reminder to check your passwords.

I first saw this in Excellent advice for generating and maintaining your passwords by Cory Doctorow.

BeautifulPeople.com Leaks Very Private Data of 1.1 Million ‘Elite’ Daters — And It’s All For Sale by Thomas Fox-Brewster.

From the post:

Sexual preference. Relationship status. Income. Address. These are just some details applicants for the controversial dating site BeautifulPeople.com are asked to supply before their physical appeal is judged by the existing user base, who vote on who is allowed in to the “elite” club based on looks alone. All of this, of course, is supposed to remain confidential. But much of that supposedly-private information is now public, thanks to the leak of a database containing sensitive data of 1.1 million BeautifulPeople.com users. The leak, according to one researcher, also included 15 million private messages between users. Another said the data is now being sold by traders lurking in the murky corners of the web.

News of the breach was passed to FORBES initially in December 2015 by researcher Chris Vickery. At the time, BeautifulPeople.com said the compromised data came from a test server, which was quickly locked up. It did not appear to be a serious incident.

But the information – which now appears to be real user data despite being hosted on a non-production server – was taken by one or more less-than-scrupulous individuals before the lockdown, making it out into the dirty world of data trading this year.

…

“We’re looking at in excess of 100 individual data attributes per person,” Hunt told FORBES. “Everything you’d expect from a site of this nature is in there.”

Vickery said the database he’d obtained contained 15 million messages between users. One exchange shown to FORBES involved users asking for prurient pictures of one another. A separate message read: “I didn’t even think to look for a better photo because the brits, on average, are some ugly motherf***ers anyway.” This would appear to chime with BeautifulPeople.com’s own “research”.

…

Don’t be in the act of drinking any hot or cold beverages when you visit “BeautifulPeople.com’s own “research”.” You may hurt yourself or ruin a keyboard. Fair warning.

The relative inaccessibility of these hacked data sets prevents leaks from acting as incentives for online services to improve their data security.

Imagine Forbes running data market pricing for “beautiful people,” living in Stockholm, for example. A very large number of people would imagine themselves to be in that set, which would set the price of that sub-set accordingly.

Moreover, it would be harder for BeautifulPeople.com to recruit new members, who are aware of the company’s lack security practices.

Thomas says that the leak was from a non-production MongoDB server.

That’s one of those databases that installs with no password for root and no obvious (in the manual) way to set it. I say “not obvious,” take a look at page 396 of the MongoDB Reference Manual, Release 3.2.5, April 25, 2016, where you will find:

The localhost exception allows you to enable access control and then create the first user in the system. With the localhost exception, after you enable access control, connect to the localhost interface and create the first user in the admin database. The first user must have privileges to create other users, such as a user with the userAdmin (page 488) or userAdminAnyDatabase (page 493) role.

Changed in version 3.0: The localhost exception changed so that these connections only have access to create the first user on the admin database. In previous versions, connections that gained access using the localhost exception had unrestricted access to the MongoDB instance.

The localhost exception applies only when there are no users created in the MongoDB instance.

First mention of password in the manual.

Should you encounter a MongoDB instance in the wild, 3.0 or earlier….

U.S. Army Finds Its New Communications Network Is Vulnerable to Hackers by Aaron Pressman.

From the post:

The U.S. Army’s new $12 billion mobile communications system remains vulnerable to hackers, according to a recent assessment by outside security experts, prompting a series of further improvements.

Already in use in Iraq and Afghanistan, the Warfighter Information Network-Tactical Increment 2, or WIN-T, system is supposed to allow for protected voice, video, and data communications by troops on the move. In June, General Dynamics won a $219 million order for communications systems to go in more than 300 vehicles.

Government overseers have regularly criticized cyber security features of WIN-T in reports over the past few years, prompting an outside review by Johns Hopkins University and the Army Research Laboratory. The public reports do not disclose specific vulnerabilities, however.
…

Do you appreciate the use of “finds” rather than “admits to” flaws in their $12 billion mobile communication center?

Public reports not “…disclos[ing] specific vulnerabilities” was very likely in the interest of saving space in the reports.

Or as noted in the DOE&T report on the WIN-T:

WIN-T Increment 2 is not survivable. Although improved, WIN-T Increment 2 continues to demonstrate cybersecurity vulnerabilities. This is a complex challenge for the Army since WIN-T is dependent upon the cyber defense capabilities of all mission command systems connected to the network. (Emphasis added.) at page WIN-T 156.

Listing all the vulnerabilities of the WIN-T Increment 2 or Increment 3, would be equivalent to detailing all the vulnerabilities of the Sony network.

Interesting in a cataloging sort of way but only just.

Besides, its more sporting to challenge hackers to find vulnerabilities in WIN-T Increment 2 or Increment 3 without a detailed listing.

PS: Talk about an attack surface: General Dynamics Receives $219 Million for U.S. Army’s WIN-T Increment 2 Systems

General Dynamics Mission Systems and more than 500 suppliers nationwide will continue to work together to build and deliver WIN-T Increment 2 systems, the Army’s “Digital Guardian Angel.”

That doesn’t include all the insecure systems that tie into the WIN-T.

Maybe they will change the acronym to RDS – Rolling Digital Sieve?

Windows Users Warned to Dump QuickTime Pronto by David Jones.

From the post:

The U.S. Department of Homeland Security on Thursday issued a warning to remove Apple’s QuickTime for Windows. The alert came in response to Trend Micro‘s report of two security flaws in the software, which will never be patched because Apple has ended support for QuickTime for Windows.

Computers running QuickTime are open to increased risk of malicious attack or data loss, US-CERT warned, and remote attackers could take control of a victim’s computer system. US-CERT is part of DHS’ National Cybersecurity and Communications Integration Center.

“We alerted DHS because we felt the situation was broad enough that people having unpatched vulnerabilities on their system needed to be made aware,” said Christopher Budd, global threat communication manager at Trend Micro.
…

The a few days later, Adobe clouds that warning as reported in: Don’t be too quick to uninstall QuickTime for Windows warns Adobe by Graham Cluley.

Adobe issued this notice, pointing out that removing QuickTime for Windows may bite you if you are a Creative Cloud user.

Along with no date from removing QuickTime dependencies.

BTW, Apple has announced that the vulnerabilities that lead to these conflicting announcements, will not be fixed.

In terms of impact, I did find these statistics on website usage of QuickTime but wasn’t able to locate statistics on user installations of QuickTime on Windows boxes.

My guess is that QuickTime on Windows machines at government installations resembles a rash. Diaper rash that is.

This is story to keep in mind when planning dependencies on software or data that is not under your control.

PS: I would uninstall it but then I don’t run Flash either. No one is completely safe but sleeping outside, naked, is just inviting trouble. That’s the analog equivalent of running either QuickTime or Flash.

3.2 Million Machines Found Vulnerable to Ransomware Campaign by David Bisson

From the post:

Researchers have found 3.2 million machines that are vulnerable of being targeted in a ransomware campaign.

According to a post published by the Cisco Talos Security Intelligence and Research Group, attackers can leverage vulnerabilities found in WildFly, an application server that also goes by the name JBoss, as an initial point of compromise to target upwards of 3.2 million machines.

Once they have established a foothold, bad actors can download malware onto the compromised machines and move laterally across the network to infect other computers.

Such was the case in a recent Samsam ransomware campaign, where attackers used a tool known as “JexBoss” to exploit JBoss application servers.

Further investigation by the Cisco Talos research team has uncovered 2,100 JBoss backdoors that have already been installed on 1,600 unique IP addresses.
…

There are far more than 3.2 million systems vulnerable to ransomware campaigns but here you have the advantage of targeting information and good odds of finding one of those targets.

Not that I advocate the use of ransomware but increases in cyberattacks drives the need for better information management of hacking information for “white,” “gray,” and “black” hats alike.

Or as they say:

It’s an ill wind indeed that doesn’t blow anyone good.

Ask yourself how much prose do you have to sift every day, day in, day out, just to remain partially current on security issues?

No, I’m not interested in fostering yet another meta-collection, rather a view into all existing collections, meta or not. Build upon what already exists and is useful.

Interested?

PS: I’m not concerned with your hat color. That’s between you and your local law enforcement officials.

HackBack! A DIY Guide

From the introduction:

You’ll notice the change in language since the last edition [1]. The English-speaking world already has tons of books, talks, guides, and info about hacking. In that world, there’s plenty of hackers better than me, but they misuse their talents working for “defense” contractors, for intelligence agencies, to protect banks and corporations, and to defend the status quo. Hacker culture was born in the US as a counterculture, but that origin only remains in its aesthetics – the rest has been assimilated. At least they can wear a t-shirt, dye their hair blue, use their hacker names, and feel like rebels while they work for the Man.

You used to have to sneak into offices to leak documents [2]. You used to need a gun to rob a bank. Now you can do both from bed with a laptop in hand [3][4]. Like the CNT said after the Gamma Group hack: “Let’s take a step forward with new forms of struggle” [5]. Hacking is a powerful tool, let’s learn and fight!

[1] http://pastebin.com/raw.php?i=cRYvK4jb
[2] https://en.wikipedia.org/wiki/Citizens%27_Commission_to_ Investigate_the_FBI
[3] http://www.aljazeera.com/news/2015/09/algerian-hacker-hero-hoodlum-150921083914167.html
[4] https://securelist.com/files/2015/02/Carbanak_APT_eng.pdf
[5] http://madrid.cnt.es/noticia/consideraciones-sobre-el-ataque-informatico-a-gamma-group

I thought the shout out to hard working Russian hackers was a nice touch!

If you are serious about your enterprise security, task one of your better inforsec people to use HackBack! A DIY Guide as a starting point against your own network.

Think of it as a realistic test of your network security.

For “everybody a programmer” advocates, consider setting up networks booting off read-only media and specific combinations of vulnerable software to encourage practice hacking of those systems.

Think of hacking “practice” systems as validation of hacking skills. Not to mention being great training for future infosec types.

PS: Check computer surplus if you want to duplicate some current government IT systems.

I first saw this in FinFisher’s Account of How He Broke Into Hacking Team Servers by Catalin Cimpanu.