STE WILLIAMS

A rogue browser package has re-appeared online years after security researchers thought it was gone for good.

Yapbrowser first appeared in 2006, inciting marks to use what was touted as a full-function web browser client. In reality, the software was jammed packed with adware from notorious (now defunct) outfit Zango. Users attempting to visit any site using the browser were directed to a porn domain, as security watchers warned at the time.

Browser downloads were pulled shortly after the domain in question started featuring child abuse images. Weeks later Yapbrowser reappeared with claims it offered “full protection from virus attacks”. That eye-opening assertion was never substantiated and the browser, and its associated domain, disappeared shortly after it was acquired by a firm called SearchWebMe in June 2006. SearchWebMe never did much with the software and all the Yap domains were soon either dead or serving up generic advertisements.

Fast-forward five years and the Yapbrowser domain has now reappeared, offering what appears to be a 2006 vintage edition of Yapbrowser, marketing it using the same overblown security claims that first appeared half a decade ago. The reappearance of the download was spotted by security researcher Chris Boyd (AKA Paperghost) of GFI Software while he was researching a presentation on browser rogues for the VirusBulletin Conference last week. Boyd was shocked to discover the reappearance of the software, which he had thought was long dead.

“Not only is there a ‘2011’ notice at the bottom, there’s a link to the Yapbrowser executable. The file appears to be the original from 2006, the EULA looks identical (to the extent it lists ‘yapbrowserATyapsearchDOTcom’ as a contact, despite the fact that domain is long dead) and when fired up on a testbox it currently takes the end-user to Yapsearch, which is parked,” Boyd explained.

“Not only does it appear to be the same old file, the website blurb also makes the same ludicrous promises of security which are optimistic by any stretch of the imagination,” he adds.

Yapbrowser is being offered in two flavours: a regular and an “adult” version, both of which are offered at no charge alongside claims that “Your computer will be free from viruses breeding online” and “There is a 100% guarantee no system infection will occur when using our software”.

Both versions of the software can be downloaded via a site called filesurfing(dot)com, which offers to hunt content from download sites such as Rapidshare and Mediafire.

Boyd said surfers would be well advised to stay well clear of the Yapbrowser application in favour of established browsers. “Seeing this site lurch back into life, looking identical to how it did back in 2006 and with the browser download following close behind is quite a shock,” he writes. “I imagine anyone else who researched this one will be feeling much the same, and given the history of this program coupled with the (still) nonsensical claims of security and virus evasion it would be quite the leap of faith to want to download and use this program.”

Boyd has a full write-up of the history and reappearance of Yapbrowser – complete with screenshots – in a blog post here.

The Yapbrowser.com domain in registered to Chris Phillips in Harringay. “Chris Phillips” is named on the searchwebme site. We left messages on a phone number associated with the registration but were unable to confirm whether the two were the same by the time of publication. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/10/10/yapbrowser_zombie_reanimates/

Scientists have circumvented the encryption used to protect a smartcard that’s widely used to restrict access in corporate and government buildings, and to process payments in public transit systems, a feat that makes it possible to clone perfect replicas of the digital keys and steal or modify their contents.

The attack, developed by researchers at Germany’s Ruhr University, takes about seven hours to recover the secret key protecting the Mifare DESFire MF3ICD40. The hack leaves no trace that the card has been compromised, and requires equipment costing $3,000.

The contactless card, which some customers adopted following the cracking of the Mifare Classic in 2008, is used by transit agencies in San Francisco, Australia, and the Czech Republic. It was adopted by NASA in 2004, although it’s not clear if the agency has since upgraded.

The findings of researchers David Oswald and Christof Paar are the latest to shatter the protection in embedded electronic devices that millions of people rely on to secure homes, offices, and mobile payment accounts. In addition to the breaking of the Mifare Classic, a team of scientists that included Paar cracked the encryption of the Keeloq security system used by manufacturers of cars, garage door openers, and other devices.

Recipe for trouble

Like the previous two hacks, the latest attack recovered the card’s secret key, allowing an adversary to assume the digital identity of individuals who use it to prove they are who they say they are.

NXP has marketed the DESFire MF3ICD40 despite its growing vulnerability to attack

“It provides a recipe for how to extract the secret key material non-invasively, basically by pointing a radio probe at the card and monitoring it as it performs a transaction,” said cryptographer Nate Lawson, the principal of Root Labs, who has read the research. “This is something that’s easily replicable with a few thousand dollars and a little amount of time, so it’s practical.”

Oswald and Paar’s attack relied on side-channel analysis, a technique that records a device’s electromagnetic radiation or other physical characteristics to learn important clues about the encryption taking place inside. In much the way a safe cracker listens to pin clicks to figure out a vault’s combination, their differential power analysis allows them to recover the 112-bit secret key that locks digital information stored on the DESFire card.

It involves the use of a probe connected to an oscilloscope that records electrical emanations while the card is being read by an RFID, or radio-frequency identification, reader.

For the recovery to succeed, an attacker must first buy a DESFire card and spend months making detailed observations about its inner behaviors. It took the researchers about a year to “profile” their card, although Oswald told The Register that a trained engineer could probably cut that time in half. Using the findings in their paper, a hacker could probably shave even more time off the profiling.

With that task out of the way, all that’s required for them to compromise a card is to have physical access to it for about seven hours. When they’re done, they will have access to the secret key needed to clone the card and access or modify whatever data is stored on it. The hack can’t be detected later.

In a message to DESFire customers, Mifare representatives said the attack works only on the MF3ICD40 model of the card, which is being discontinued at the end of the year. They encouraged users to upgrade to the EV1 version of DESFire because it isn’t susceptible to the attack.

They also said customers of the weaker model can minimize the damage of attacks by assigning unique keys for each card they deploy. When the measure is accompanied by systems that monitor card readers and a key-revocation mechanism, cards that are lost or stolen can be blacklisted.

The failure of the MF3ICD40 is its almost complete lack of countermeasures to prevent differential power analysis. While the card skips a few random clock cycles in an attempt to misalign an attacker’s traces, that countermeasure is now considered insufficient when used alone.

Endowing the card with additional protections was considered cost-prohibitive in 2002, the year a division of Philips designed it. Despite the growing use of attacks that use the technique, the company, which eventually became Netherlands-based NXP Semiconductors, continued to market the smartcard.

Let the upgrades begin

NXP doesn’t provide figures on how many vulnerable cards have been purchased over the years, but earlier this year it did say it had sold 3.5 billion smartcards overall.

NXP says upgrading to the EV1 model is relatively painless because it is backwards-compatible with its vulnerable successor. But cryptographer Lawson said the logistics of swapping out tens of thousands or even millions of cards and updating back-end systems accordingly can make the task cumbersome.

With potentially billions of cards affected, shops that still rely on the card may want to think about dumping them soon. Let the upgrades begin. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/10/10/mifare_desfire_smartcard_broken/

A group with the Twitter handle @BlackHatGhosts says it is behind breaking into the systems of Australian educational sector employment site Unijobs, posting the usernames and passwords of around 600 users on Pastebin.

First reported at The Conversation, the break-in follows the now-boring pattern of picking a small, softish target of no particular ideological value, punishing its users by publishing their details, and swaggering at the blow struck against heaven-knows-what imaginary enemy.

The site is operated by an Australian organization, the CBT Corp Unit Trust, a busy organization in operating small Web operations. Some are similar to Unijobs – Jobs4nurses.com.au, Govjobs.com.au, Tafejobs.com.au, WorldUniversityJobs.com, and Unijobs.co.nz – while others spread the organisation’s resources into other specalities such as the horse set (Equine.com.au), and a fledgling shopping app (I-shop.com.au).

Given the number of properties operated by the company, The Register contacted Unijobs to ascertain whether the attack would require upgrades or patches to any of its other properties. At the time of writing, no response has been received.

It should be noted that if Unijobs’ claims about its 40,000 user base are accurate, then the attack only affected a small number of its subscribers. reg

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/10/09/unijobs_hacked_by_jerks/

The US Department of Homeland Security (DHS) has been testing its behavioral monitoring CCTV system on the public without the proper paperwork.

The Future Attribute Screening Technology (FAST) system uses high-resolution cameras and other “non-invasive” sensors to monitor human behavior, including “cardiovascular signals, pheromones, electrodermal activity, and respiratory measurements,” according to a 2008 DHS report on the project. This data is then fed into a computer system running matching algorithms that suggests which people should have their collars felt by local security.

The principle behind the whole system is that people with malicious intent will exhibit certain behaviors and biological responses that can be identified. The idea is to put these systems into US border-access points, and it’s a techniques which works very well in Israel – with the rather significant difference that the Israelis use people to do the analysis, rather than relying on software.

FAST has been under development for four years, under the auspices of the DHS Advanced Research Agency, and testing on the public was conducted this summer in the US Northeast. However, the DHS neglected to sort out the proper paperwork before using people as lab bunnies, according to documentation from a Freedom of Information request submitted by the Electronic Privacy Information Center (EPIC).

“Under the existing statutes, if they roll out a new technology like this there’s a need for a privacy-impact assessment,” Ginger McCall, open government counsel at EPIC, told The Register. “They didn’t do that.”

“It seems they would have a very high false positive rate, the best they say was that it’s 70 per cent effective,” McCall said. “When you consider the kinds of suspicions they raise it’s a lot of innocent people getting stopped.”

Well, a lot of innocent people might get stopped if the system were ever put into actual use. There are no “innocents” involved in current testing, however. A DHS source familiar with the testing told The Register that all the research was conducted on volunteers who were fully aware they were being watched. None of the data was stored after analysis, nor could it be tied to individual subjects.

In fact, the happy volunteers were even provided with tasty refreshments – no skulduggery here.

Our source said that the research – which monitors changes in thermal skin conductance, heart rate, respiration, pupil variation, and blink rate – is in the very early conceptual stages, and is in no way close to deployment.

The heavily-redacted testing report shows that around 200 people were put through the system on a two-day test run in Boston earlier this year. Judging from the photos in the report, the system isn’t ready for open deployment, but was instead used in a relatively enclosed space, suggesting a scanning unit similar to the millimeter wave detectors used today.

Hewing to the FAST facts as detailed in the 2008 report, deputy DHS press secretary Peter Boogaard told The Register in an email: “The Department’s Science and Technology Directorate has conducted preliminary research in operational settings to determine the feasibility of using non-invasive physiological and behavioral sensor technology and observational techniques to detect signs of stress, which are often associated with intent to do harm.

“The FAST program is only in the preliminary stages of research and there are no plans for acquiring or deploying this type of technology at this time.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/10/07/dhs_behavioral_scanning_on_public/

IE security hole sewn up for Patch Tuesday

• 
• 
• 
• 

It’s that time of the month. Again

By John Leyden • Get more from this author

Posted in Security, 7th October 2011 13:01 GMT

Free whitepaper – King’s College LondonUses IBM BNTRackSwitch for HPC

Microsoft is planning eight security updates next week – two critical – as part of its regular Patch Tuesday programme.

The obvious highlight of the batch is a critical update for Internet Explorer that affects all supported versions of Microsoft’s ubiquitous web browser, including IE 9. The second critical update covers flaws in Microsoft .NET Framework and Microsoft Silverlight that create a possible mechanism for miscreants to inject hostile code onto vulnerable systems.

The remaining six updates address lesser Windows vulnerabilities in Microsoft Forefront and Host Integration server. All six of these updates are rated as “important” and not all of them apply to all configurations. “IT administrators will have to evaluate to what degree they affect their networks, servers and workstation,” according to Wolfgang Kandek, CTO at security services firm Qualys.

As usual, more details on the flaws will emerge once Microsoft has published its patches on Tuesday. In the meantime all we have to go on is Redmond’s pre-release notice here. ®

Free whitepaper – Centre Hospitalier d’Avignon Secures Patient Records

• 6 commentsPost a comment

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/10/07/ms_patch_tuesday_oct_pre_release/

IE security hole sewn up for Patch Tuesday

• 
• 
• 
• 

It’s that time of the month. Again

By John Leyden • Get more from this author

Posted in Security, 7th October 2011 13:01 GMT

Free whitepaper – King’s College LondonUses IBM BNTRackSwitch for HPC

Microsoft is planning eight security updates next week – two critical – as part of its regular Patch Tuesday programme.

The obvious highlight of the batch is a critical update for Internet Explorer that affects all supported versions of Microsoft’s ubiquitous web browser, including IE 9. The second critical update covers flaws in Microsoft .NET Framework and Microsoft Silverlight that create a possible mechanism for miscreants to inject hostile code onto vulnerable systems.

The remaining six updates address lesser Windows vulnerabilities in Microsoft Forefront and Host Integration server. All six of these updates are rated as “important” and not all of them apply to all configurations. “IT administrators will have to evaluate to what degree they affect their networks, servers and workstation,” according to Wolfgang Kandek, CTO at security services firm Qualys.

As usual, more details on the flaws will emerge once Microsoft has published its patches on Tuesday. In the meantime all we have to go on is Redmond’s pre-release notice here. ®

Free whitepaper – Centre Hospitalier d’Avignon Secures Patient Records

• 6 commentsPost a comment

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/10/07/ms_patch_tuesday_oct_pre_release/

IE security hole sewn up for Patch Tuesday

• 
• 
• 
• 

It’s that time of the month. Again

By John Leyden • Get more from this author

Posted in Security, 7th October 2011 13:01 GMT

Free whitepaper – King’s College LondonUses IBM BNTRackSwitch for HPC

Microsoft is planning eight security updates next week – two critical – as part of its regular Patch Tuesday programme.

The obvious highlight of the batch is a critical update for Internet Explorer that affects all supported versions of Microsoft’s ubiquitous web browser, including IE 9. The second critical update covers flaws in Microsoft .NET Framework and Microsoft Silverlight that create a possible mechanism for miscreants to inject hostile code onto vulnerable systems.

The remaining six updates address lesser Windows vulnerabilities in Microsoft Forefront and Host Integration server. All six of these updates are rated as “important” and not all of them apply to all configurations. “IT administrators will have to evaluate to what degree they affect their networks, servers and workstation,” according to Wolfgang Kandek, CTO at security services firm Qualys.

As usual, more details on the flaws will emerge once Microsoft has published its patches on Tuesday. In the meantime all we have to go on is Redmond’s pre-release notice here. ®

Free whitepaper – Centre Hospitalier d’Avignon Secures Patient Records

• 6 commentsPost a comment

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/10/07/ms_patch_tuesday_oct_pre_release/

IE security hole sewn up for Patch Tuesday

• 
• 

It’s that time of the month. Again

By John Leyden • Get more from this author

Posted in Security, 7th October 2011 13:01 GMT

Free whitepaper – King’s College LondonUses IBM BNTRackSwitch for HPC

Microsoft is planning eight security updates next week – two critical – as part of its regular Patch Tuesday programme.

The obvious highlight of the batch is a critical update for Internet Explorer that affects all supported versions of Microsoft’s ubiquitous web browser, including IE 9. The second critical update covers flaws in Microsoft .NET Framework and Microsoft Silverlight that create a possible mechanism for miscreants to inject hostile code onto vulnerable systems.

The remaining six updates address lesser Windows vulnerabilities in Microsoft Forefront and Host Integration server. All six of these updates are rated as “important” and not all of them apply to all configurations. “IT administrators will have to evaluate to what degree they affect their networks, servers and workstation,” according to Wolfgang Kandek, CTO at security services firm Qualys.

As usual, more details on the flaws will emerge once Microsoft has published its patches on Tuesday. In the meantime all we have to go on is Redmond’s pre-release notice here. ®

Free whitepaper – Centre Hospitalier d’Avignon Secures Patient Records

• 6 commentsPost a comment

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/10/07/ms_patch_tuesday_oct_pre_release/

IE security hole sewn up for Patch Tuesday

• 
• 
• 
• 

It’s that time of the month. Again

By John Leyden • Get more from this author

Posted in Security, 7th October 2011 13:01 GMT

Free whitepaper – King’s College LondonUses IBM BNTRackSwitch for HPC

Microsoft is planning eight security updates next week – two critical – as part of its regular Patch Tuesday programme.

The obvious highlight of the batch is a critical update for Internet Explorer that affects all supported versions of Microsoft’s ubiquitous web browser, including IE 9. The second critical update covers flaws in Microsoft .NET Framework and Microsoft Silverlight that create a possible mechanism for miscreants to inject hostile code onto vulnerable systems.

The remaining six updates address lesser Windows vulnerabilities in Microsoft Forefront and Host Integration server. All six of these updates are rated as “important” and not all of them apply to all configurations. “IT administrators will have to evaluate to what degree they affect their networks, servers and workstation,” according to Wolfgang Kandek, CTO at security services firm Qualys.

As usual, more details on the flaws will emerge once Microsoft has published its patches on Tuesday. In the meantime all we have to go on is Redmond’s pre-release notice here. ®

Free whitepaper – Centre Hospitalier d’Avignon Secures Patient Records

• 6 commentsPost a comment

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/10/07/ms_patch_tuesday_oct_pre_release/

An alleged vulnerability on American Express site exposed customers to a serious security risk before the credit card giant closed down a portion of its site on Thursday afternoon.

Researcher Niklas Femerstrand claimed the problem arose because the debug mode of the americanexpress.com site had inexplicably been left on, thus providing access to vulnerable debug tools. The security shortcoming creating a possible mechanism to harvest users’ authentication cookies, according to Femerstrand.

American Express said the issue was confined to a test page it took down on Thursday afternoon. In a statement, issued to Financial News Network, it stressed that customer information was never at risk.

We learned this morning that an internal test page created to update promotional offers was temporarily accessible on our US website. The page did not contain CM information such as card number, name or address. The page in question has been taken down. We are not aware of any information at this time that this vulnerability was used for malicious purposes but we are continuing to investigate.

Femerstrand went public with his findings on Wednesday – posting what appears to be a harmless proof-of-concept illustration of the bug – after he struggled to report the bug directly to the credit card giant.

“The debugging tool is vulnerable to XSS [cross-site scripting] and it quickly becomes an issue when the debugging tools are called through unprotected GET parameters,” he said.

“The debug window refreshes itself so that injected code that doesn’t break the loop will execute infinitely. An attacker could inject a cookie stealer combined with jQuery’s .hide() and harvest cookies – which can, ironically enough, be exploited by using the admin panel provided by sloppy American Express developers.”

Femerstrand told El Reg on Thursday that the security vulnerability was still present hours after he went public about the flaw.

“The admin page is supposedly limited but debugging is still on and the vuln is still active,” he claimed via Twitter.

Reg reader David, who brought the issue to our attention, said any fix ought to have been easy to apply. “This should be simple to fix, but the potential for cookie harvesting and further exploration/exploitation is still there,” he said.

We asked American Express directly for comment on this story, which we’ll update as and when we hear more. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/10/07/amex_website_security_snafu/