Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

Sherlock

Sherlock self-describes as: “Find usernames across social networks”

What caught my eye was a tweet saying Sherlock searches across 94 social networks.

Are users likely to use the same password across multiple social media sites? That alone could make Sherlock quite useful.

Do password repeaters use the same password in more secure settings?

Volume 21 of the Hacker Digest Released

From the post:

Volume 21 of The Hacker Digest is now out. If you’re a lifetime digital subscriber, you will have already received this edition. Volume 21 is comprised of issues from 2004, our 20th anniversary and a year where we embraced propaganda, at least on all of our covers. It was a time of soul searching in the hacker community, the year of The Fifth HOPE, and a changing country.

You can click here to buy Volume 21 or become a lifetime digital subscriber here. If you do the latter, you will receive digital copies of everything we have published to date, plus everything that we publish in the future. We have now digitized 31 out of our 34 years.

If you also want paper copies, we have a special offer here. And if you’re an existing paper lifetime subscriber who wants to upgrade to digital at a discounted rate, just click here.

The current list price is $260 for a lifetime digital subscription. A real bargain considering many of the hacks are still viable today.

Remotely Hijacking Zoom Clients by David Wells.

From the post:

I would like to walkthrough a severe logic flaw vulnerability found in Zoom’s Desktop Conferencing Application. This logic flaw (CVE-2018–15715) affects Zoom clients for MacOS, Linux, and Windows and allows an attacker (doesn’t even have to be meeting attendee) to hijack various components of a live meeting such as forcefully enable desktop control permissions and send keystrokes to meeting attendees sharing their screen. Zoom has released an update for MacOS and Windows and users of Zoom should make sure they are running the most up-to-date version.

Great description of a vulnerability, even if Wells reports that Zoom servers now appear to be patched.

Telecommuting Trend Data from GlobalWorkplaceAnalytics.com leaves no doubt that remote work by employees is increasing, meaning so are avenues into corporate computer infrastructures.

To say nothing of moves towards telecommuting by the United States government, led by of all agencies, the IRS. Telecommuting Options in Government Jobs

Vulnerabilities in telecommuting and/or video conferencing software may result is a bountiful harvest of data. But you won’t know if you don’t look for them.

Hacking eBooks Free Download 2018 – (90+) Best Hacking eBooks by Mukesh Bhardwaj.

From the post:

Here are a top and a long list of Best Hacking eBooks released in 2018. I pick these PDF best hacking eBooks from top sources with latest hacking articles inside these eBooks. These download links are spam free and ads free. However, you will also get all hacking guides as well. We Give You Best Ads Free Download Links. (emphasis in original)
…

This listing dates from January 4, 2018, so as of November 22, 2018, it’s due for an update.

The items I have examined look useful but it’s not clear what criteria were used for “best.”

Do you have a suggestion for general or more specific hacking resources to use as benchmarks for best?

Top 20 Hacker Holiday Gifts of 2018

From the post:

For the uninitiated, it can be difficult to buy that special hacker in your life a perfect holiday gift. That’s why we’ve taken out the guesswork and curated a list of the top 20 most popular items our readers are buying. Whether you’re buying a gift for a friend or have been dying to share this list with someone shopping for you, we’ve got you covered with our 2018 selection of hacker holiday gifts.

For more ideas, make sure to check out our holiday hacker gift guide from last year, as well as Distortion’s excellent post for gear every hacker should try out. As for this year’s recommendations, they’re split up into different price points, so you can jump to each using the following links.
…

Great list of potential gifts for someone you know is hacking or who you want to encourage to hack.

Imagine the degree of transparency if hacking was taught as widely as keyboarding.

One Hacker One Computer – #OHOC

Enjoy!

Types of Hackers and What They Do: White, Black, and Grey:

Hackers are lumped into three (3) categories:

…

A black-hat hacker is an individual who attempts to gain unauthorized entry into a system or network to exploit them for malicious reasons. The black-hat hacker does not have any permission or authority to compromise their targets.

…

White-hat hackers, on the other hand, are deemed to be the good guys, working with organizations to strengthen the security of a system. A white hat has permission to engage the targets and to compromise them within the prescribed rules of engagement.

…

Grey hats exploit networks and computer systems in the way that black hats do, but do so without any malicious intent, disclosing all loopholes and vulnerabilities to law enforcement agencies or intelligence agencies.

…

I suppose but where is the category Customer-hat?

Customer-hat hackers carry out actions contracted for by a customer.

The customer-hat hacker designation avoids the attempts to pre-define moral or ethical dimensions to the work of hackers, generally summarized under the rubrics of black, white and grey hats.

Picking a recent post at random: Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign, you quickly get the impression that APT29 is a black-hat, i.e., is non-American.

As a contractor or customer, I’m more comfortable wearing a customer-hat. Are you?

PS: I’m aware that the black/grey/white hat designations are attempts to shame people into joining to protect institutions and systems unworthy of respect and/or protection. I decline the invitation.

One definition of Black Friday reads:

The Day After Thanksgiving (Friday) is known as Black Friday. This used to be unofficially or officially the start of holiday shopping season. Almost all stores come out with Doorbuster Sales with the early bird special to attract consumers to their shop. People stand in line hours before the stores are opened, to grab the bargains of the year. In last few years, we have witnessed a trend towards bringing those Black Friday Sales online before Friday.

Suffice it to say it is an orgy of consumerism and consumption, which originated in the United States but it has spread to other countries.

One constant at shopping locations, Black Friday or no, is the presence of ATM (Automated Teller Machines) machines. ATM finder services are offered by Visa and Mastercard. A search using “atm location” reveals many others.

I mention all that because I encountered Most ATMs can be hacked in under 20 minutes by Catalin Cimpanu.

From the post:

“More often than not, security mechanisms are a mere nuisance for attackers: our testers found ways to bypass protection in almost every case,” the PT team said. “Since banks tend to use the same configuration on large numbers of ATMs, a successful attack on a single ATM can be easily replicated at greater scale.” (emphasis added)

Cimpanu includes a list of the ATMs tested. Nothing is more innocent than using an ATM on Black Friday and noting its type and model number. Privacy is required for the attacks described but usually for less than 20 minutes.

Armed with a list of ATM with model numbers and locations, plus the attacks as described in the original report, you may have a reason to celebrate early this holiday season. (BTW, strictly for research purposes, did you know they sell ATMs on eBay?)

A Systematic Evaluation of Transient Execution Attacks and Defenses by Claudio Canella, et al.

Abstract:

Modern processor optimizations such as branch prediction and out-of-order execution are crucial for performance. Recent research on transient execution attacks including Spectre and Meltdown showed, however, that exception or branch misprediction events may leave secret-dependent traces in the CPU’s microarchitectural state. This observation led to a proliferation of new Spectre and Meltdown attack variants and even more ad-hoc defenses (e.g., microcode and software patches). Unfortunately, both the industry and academia are now focusing on finding efficient defenses that mostly address only one specific variant or exploitation methodology. This is highly problematic, as the state-of-the-art provides only limited insight on residual attack surface and the completeness of the proposed defenses.

In this paper, we present a sound and extensible systematization of transient execution attacks. Our systematization uncovers 7 (new) transient execution attacks that have been overlooked and not been investigated so far. This includes 2 new Meltdown variants: Meltdown-PK on Intel, and Meltdown-BR on Intel and AMD. It also includes 5 new Spectre mistraining strategies. We evaluate all 7 attacks in proof-of-concept implementations on 3 major processor vendors (Intel, AMD, ARM). Our systematization does not only yield a complete picture of the attack surface, but also allows a systematic evaluation of defenses. Through this systematic evaluation, we discover that we can still mount transient execution attacks that are supposed to be mitigated by rolled out patches.

If you guessed from the title (or experience) that being systematic wins the prize, you’re right!

Between the failure to patch behavior of users and the “good enough” responses of vendors to vulnerabilities, it’s surprising cybersecurity is in the dictionary at all. Other than as a marketing term like “salvation,” etc.

Just in time for the 2018 holiday season, Black Hat USA 2018 videos have been posted on Youtube! Abstracts/presentation materials.

I count one-hundred and twenty-five (125) videos!

I’m not suggesting you would pwn the TV remote, video game controller or surf the local mall’s wifi if forced to go shopping, but with the Black Hat videos, visions of the same can dance in your head!

Enjoy!

PS: Be sure to give a big shout out to Black Hat and presenters for all videos that stand out to you.

Adobe ColdFusion servers under attack from APT group by Catalin Cimpanu.

A cyber-espionage group appears to have reverse engineered an Adobe security patch and is currently going after unpatched ColdFusion servers.

If you review the Adobe Security Bulletin, I don’t think “reverse engineer” is the term I would use in this case:

Nor would I use “Advanced Persistent Threat (APT)” for this vulnerability.

The Adobe fail here is the equivalent to leaving a liquor store unattended with the door propped open and the lights on. Theft there doesn’t require a criminal mastermind.

Given patch rates, reading patches could be the easiest way to add exploits to your toolkit.

RunCode.

From the webpage:

Complete challenges to attain points. Attain points to impress your friends. Impress your friends to… lol, you don’t have any friends, what are you talking about!

…

The competition will begin at Nov 10 0900(EST) and run until Nov 12 0900(EST). The top 10 players will be able to pick a prize out of our prize list. In order to receive the prize you must provide the RunCode team your physical mailing address as we will be shipping you the prize. If you’d rather donate your prize instead of giving us your physical mailing address, we will give the prize of your choice or donate the equivalent monetary amount to a charity you choose. If you’re looking for the list of prizes, they can be found on our twitter. Good luck in the competition, and if you have any questions feel free to reach out to us on our slack chat server for support (you’ll get an email invite to our slack after making an account).

If you’d like to practice on some of our previous challenges. Head over to our main website where we have all of our previous challenges available for you to work on (the logins/accounts for the competition site and the main site are separate).

Sign up! Not many hours left!

I’ve got a full weekend of editing on tap already but registering will give me incentive to at least try some of the challenges.

I first read about the RunCode event in: Codewarz, reloaded: programming contest ads pwning, prizes as RunCode by Sean Gallagher.

Mathew Ingram writes in Pressure increases on Bloomberg to verify its China hack story:

It was a certified bombshell: Bloomberg News reported on October 4 that the Chinese government had been able to infiltrate both Apple and Amazon’s hardware systems by putting hacked microchips into the third-party motherboards they used in their servers. But as the days following the report have turned into weeks, doubts about the validity of the story have continued to grow, while the amount of independent verification and/or supporting material proving such a hack actually occurred remains at zero.

In a column on Tuesday, Washington Post media critic Erik Wemple argued the chorus of voices in opposition to the allegations in the piece—including strenuous and detailed denials from the companies involved—have put the onus on Bloomberg to come up with additional verification, or else risk casting even more doubt on its scoop. “The relentlessness of the denials and doubts from companies and government officials obligate Bloomberg to add the sort of proof that will make believers of its skeptics,” Wemple wrote. “Assign more reporters to the story, re-interview sources, ask for photos and emails. Should it fail in this effort, it’ll need to retract the entire thing.” Wemple also criticized the news outlet for using a photo of a generic microchip on the cover of Bloomberg BusinessWeek magazine, despite the fact that the news outlet has no photos of the actual chip that was allegedly used in the hacks.
… (emphasis in original)

Ingram has collected links to a number of the posts and refutations of the original Bloomberg claims.

But you don’t need the protests of innocence and/or deep technical analysis to be wary of the Bloomberg story.

On the face of the original report, how many people do you think would “know” about the subversion of the motherboards?

1. Designers of the subversive chip
2. Motherboard designers to create a motherboard that uses the subversive chip
3. Development and testing staff for the chip and the motherboards
4. Users of capabilities offered by the subversive chips
5. Handlers of the intelligence produced by the subversive chips
6. Funders for #1 – #5

Would you concede those in the “know” about the chips would have to number in the thousands?

I ask because research on conspiracies estimates to keep a secret for five years, the maximum number of participants has an upper limit of 2521 agents. On the Viability of Conspiratorial Beliefs, David Robert Grimes, PLOS, Published: January 26, 2016, https://doi.org/10.1371/journal.pone.0147905.

On the face of it, the ‘China Hack’ more closely resembles the NASA Moon-landing conspiracy than technological legerdemain.

Especially given Bloomberg’s explanation for the absence of any motherboard with the “extra” chip:

…
In the three years since the briefing in McLean, no commercially viable way to detect attacks like the one on Supermicro’s motherboards has emerged—or has looked likely to emerge. Few companies have the resources of Apple and Amazon, and it took some luck even for them to spot the problem. “This stuff is at the cutting edge of the cutting edge, and there is no easy technological solution,” one of the people present in McLean says. “You have to invest in things that the world wants. You cannot invest in things that the world is not ready to accept yet.”

Failure to detect becomes evidence of the cleverness of these conspirators.

Looks like a conspiracy theory, walks like a conspiracy theory, talks like a conspiracy theory, the absence of evidence proves the conspiracy theory, all suggests Bloomberg’s “China Hack” is a conspiracy theory.

Why You Should Start Doing CTFs by Oryan De Paz.

From the post:

Capture The Flag (CTF) is a competition in the Information Security field. The main idea is to simulate different kinds of attack concepts with various challenges such as Reverse Engineering, Networks and Protocols, Programming, Crypto, Web Security, Exploits, etc.

All these challenges have one goal — capture the flag: solve the puzzle and use your skills in order to find a string that you can eventually type-in as your solution. If the solution is correct — you get the challenge points, which depend on the task difficulty. These days you can find CTF competitions in many of the infosec conferences.
…

De Paz has five (5) good reasons for doing Capture The Flag (CTF) exercises and pointers to additional resources.

De Paz mentions these reverse engineers as guideposts for her journey into CTF (in a Twitter thread on her post):

• @Baot_IL (Israeli community of women in R&D)
• @0xgalz
• @cbelle1234
• @Dafna_Mordechai
• @OphirHarpaz

Great advice and leads to exploring CTF for yourself!

Millions at risk from default webcam passwords

From the post:

…
The vulnerability lies in a feature called XMEye P2P Cloud, which is enabled on all Xiongmai devices by default. It lets people access their devices remotely over the internet, so that they can see what’s happening on their IP cameras or set up recording on their DVRs.

Using a variety of apps, users log into their devices via Xiongmai’s cloud infrastructure. This means that they don’t have to set up complex firewall port forwarding or UPnP rules on their home routers, but it also means that it opens up a hole in the user’s network. That places the onus on Xiongmai to make the site secure. But it didn’t.
…

The article goes on to point out how to locate these insecure devices, which are estimated at a population of 9 million around the world.

Suggestions on AI-assisted recognition software to distinguish baby pics from more interesting content?

Lesser Skilled Cybercriminals Adopt Nation-State Hacking Methods by Jai Vijayan.

From this long prose ad for CrowdStrike:

Relatively unskilled, criminally motivated hackers are increasingly adopting the tactics, techniques and procedures (TTPs) typically used by more sophisticated nation-stated backed adversaries.

New analysis by security vendor CrowdStrike’s Falcon OverWatch threat-hunting team of intrusion detection engagements at customer locations between January and June this year shows a continued blurring of lines between methods employed by criminals and known nation-state actors.

This trend spells trouble for enterprises because it means that no one is really safe from sophisticated attacks, says Jennifer Ayers, vice president of CrowdStrike’s OverWatch and security response team. “Sophisticated techniques are becoming a little more commoditized,” she says. “Anything goes. Anyone can be a target.”

One example is cybercriminals increasingly using TeamViewer software to gain remote access to targets. TeamViewer is a legitimate tool for connecting to remote computers for desktop sharing and collaboration and enabling remote support, among other uses.
…

In addition to being gratuitiously ugly to hackers who use tools developed by others, Vijayan includes CrowdStrike attributed remarks about Russian hackers, of course.

When you have no evidence to present, throw off on the Russians. At least this season. Not so long ago it was those masterminds of everything digital, the North Koreans. Then the Chinese, or is it now the Chinese?

Check with the ministry of truth, sorry, Department of Homeland Security to see who the current “enemy” and greatest cyberthreat is today. It changes.

You are very unlikely to have written your own compiler, debugger, or other tools you use in cybersecurity. Building on the work of others, even nation-states, carries no shame.

By analogy, you could claim people are “lesser skilled” drivers because they didn’t assemble their own cars. Try that in a bar and watch other patrons start to edge away from you. Keep it up long enough and you will have public accomodations for the night (jail).

Find, use, build upon and share any “…tactics, techniques and procedures (TTPs)…” that you find, nation-state or otherwise.

So will I.