STE WILLIAMS

Cracking the passwords of some WPA2 Wi-Fi networks just got easier

The folks behind the password-cracking tool Hashcat claim they’ve found a new way to crack some wireless network passwords in far less time than previously needed.

Jens Steube, creator of the open-source software, said the new technique, discovered by accident, would potentially allow someone to get all the information they need to brute force decrypt a Wi-Fi password, by snooping on a single data packet going over the air.

Previously, an attacker would need to wait for someone to log into a network, capture the four-way handshake process used to authenticate users with a wireless access point, and use that to brute-force search for the password.

This particular technique specifically works against WPA and WPA2-secured Wi-Fi networks with PMKID-based roaming features enabled, and it can be used to recover the PSK (Pre-Shared Key) login passwords.

Wi-fi symbol made out of clouds. Photo by Shutterstock

With WPA3, Wi-Fi will be secure this time, really, wireless bods promise

READ MORE

“This attack was discovered accidentally while looking for new ways to attack the new WPA3 security standard,” Syeube explained late last week, adding that it won’t work against next-gen wireless security protocol WPA3.

“WPA3 will be much harder to attack because of its modern key establishment protocol called Simultaneous Authentication of Equals (SAE).

“The main difference from existing attacks is that in this attack, capture of a full EAPOL 4-way handshake is not required. The new attack is performed on the RSN IE (Robust Security Network Information Element) of a single EAPOL frame.”

The team found that, when an attacker has the RSN IE information, the PMKID (the key needed to establish a connection between a user and an access point) can be pulled out via a packet capture tool and then brute-force decrypted with Hashcat. Steube noted that this can often be done in around 10 minutes or so, depending on noise over the Wi-Fi channel.

“Since the PMK is the same as in a regular EAPOL 4-way handshake this is an ideal attacking vector,” Steube explained. “We receive all the data we need in the first EAPOL frame from the AP.”

As a result, the attacker would be able to break into a vulnerable wireless network in far less time without needing to get any other information from other users or devices, only information the router itself provides to all users, authenticated or otherwise.

Steube said that while he does not yet know which brands and models of routers are specifically at risk to the technique, he believes “most modern routers” using IEEE 802.11i/p/q/r protocols with roaming functions enabled would be exploitable. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/06/wpa2_wifi_pmkid_hashcat/

BlackBerry claims it can do to ransomware what Apple did to its phones

Black Hat While ransomware continues to extort factories, hospitals, schools, businesses, and ordinary netizens, BlackBerry reckons it can quickly rescue peeps from malware infections.

The Canadian biz’s days as the smartphone king long gone, with Apple making quick work of its hardware. And although it still sells a few handsets, BlackBerry now focuses on software. It is using this year’s Black Hat USA security show, held this week in Las Vegas, to unveil what it claims is a fast response to ransomware infections.

The new code is a free update to BlackBerry Workspaces, and allows IT managers to work out precisely which files and folders have been scrambled, and roll back just the affected documents and data to the point before the extortionware hit.

This is, we’re told, supposed to be more efficient for businesses than restoring all files on a company-wide basis. On the one hand, it means downtime, due to wiping and restoring systems from backups, is reduced. On the other hand, you might think a deep network-wide clean-and-restore would be better as it would ensure no trace of the malware remains.

typewriter_wtf_648

Alaskan borough dusts off the typewriters after ransomware crims pwn entire network

READ MORE

“Beyond data loss, opportunity costs, and reputational risks, downtime resulting from ransomware attacks can inflict real harm on customers in any industry, including healthcare or public safety, where the consequences of any delay can be catastrophic,” said Billy Ho, VP of enterprise products at BlackBerry.

“Organizations need to have a strong culture of security to minimize the risk of an attack – something that our Cybersecurity Consulting team has been supporting for the last several years. And in a worst-case scenario, it’s critical that organizations also have a layered defense model in place and an enterprise technology stack that is designed with the inevitable breach in mind.”

BlackBerry claims its technology can handle backups going back an unlimited amount of time as well as working at an individual file level to avoid wiping data on staff machines that weren’t hijacked. The system will work on Windows PCs, macOS Macs, Android and iOS devices, and the few holdouts still using the BlackBerry 10 mobile OS.

Of course, there are various competing anti-ransomware defenses available, from paid-for solutions in antivirus packages to operating system-level protections in Windows 10, to free tools, such as RansomWhere? for Macs – and regular organized offline backups are rather nice, too. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/06/blackberry_ransomware/

IBM, ATMs – WTF? Big Blue to probe cash machines, IoT, vehicles, etc in new security labs

Black Hat IBM has promised to open four research centers that will hunt for security vulnerabilities in technology – including a team dedicated to probing cash machines for flaws.

It has been eight years since the late, great hacker Barnaby Jack took to the stage at the Black Hat USA conference in Las Vegas, and showed attendees how in just a few steps an ATM can be tricked into spewing dollar bills onto the floor for free…

Youtube Video

The technique, dubbed jackpotting, was at first dismissed by ATM makers as impractical. However, in the past few years, criminals have weaponized Jack’s findings, and have exploited them to steal more than $1m in the US alone. Now IBM has used 2018’s Black Hat USA event, held this week in Vegas, to announce X-Force Red Labs: four research centers that will seek to counter ATM hacking among other things.

“IBM X-Force Red has one mission – hack anything to secure everything,” said Charles Henderson, global managing partner at IBM X-Force Red, earlier today.

US cashpoint. Pic: Tax Credits

What do you call an old, unpatched and easily hacked PC? An ATM

READ MORE

“Via X-Force Red Labs, we have the ability to do just that, in a secure and controlled environment. Whether it’s the newest smartphone that hasn’t been released, an internet-connected refrigerator or a new ATM, we have the capability to test, identify, and help our clients remediate vulnerabilities before the bad guys can exploit them.”

The labs will, we’re told, be run by Big Blue’s X-Force Red crew of veteran hackers, and will dive into consumer and industrial Internet of Things gear, cars and other vehicles, phones, and, as mentioned, ATMs. The IBMers will search for security vulnerabilities in order to develop mitigations for weaknesses and disclose flaws to manufacturers.

IBM said that in the past 12 months, it has seen a 300 per cent increase in enquiries regarding preventing cash-machine hacking. For years, manufacturers dismissed claims their hardware was vulnerable, however, it seems the latest wave of thefts has sparked a change of heart.

Big Blue’s ATM-probing squad will analyze cash machine hardware, develop penetration tests against the rigs, provide security guidance for engineers building new ATMs, and provide real-time vulnerability disclosure on the systems, we’re told.

The four labs will be set up in Atlanta and Austin in the US, Melbourne in Australia, and at IBM’s UK facility in Hursley. Big Blue’s hacking teams are also hoping to use the Black Hat show to recruit canny staff. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/06/ibm_atm_security_research/

Battle lines drawn over US mass surveillance as senators probe NSA’s bonfire of phone records

Analysis A fight has begun over another of the US government’s mass surveillance systems – with two Senators raising questions about an unusual data deletion by the National Security Agency (NSA).

Senators Ron Wyden (D-OR) and Rand Paul (R-KY) have sent a letter [PDF] to the NSA’s inspector general asking him to look into the agency’s torching of metadata for hundreds of millions of phone calls.

“We write to request that you conduct an investigation into the circumstances surrounding, and any systemic problems that may have led to, the deletion by the National Security Agency (NSA) of certain call detail records (CDRs) collected from telecommunications service providers pursuant to Title V of the Foreign Intelligence Surveillance Act (FISA),” the letter begins.

That deletion was announced back in June, one month after the spy agency revealed in a “statistical transparency report” [PDF] that it had collected 534 million call details in 2017, a tripling of the number from the previous year.

The NSA blamed “technical irregularities” for the receipt and storing of an unspecified amount of phone call data, and said that, since it was not possible to discern between legitimately and illegally gathered details, it was going to “delete all CDRs acquired since 2015.”

At the time, both the report and the admission of record deletion sparked concerns and questions over what going on behind the scenes of the highly secretive spying program – authorized through Section 215 of the Foreign Intelligence Surveillance Act (FISA).

Section 215 is particularly controversial, because despite the F in FISA standing for Foreign, it can and has been used to indiscriminately vacuum up metadata on people in the US, which arguably violates their Fourth Amendment protections against warrantless search. It was supposed to be used extremely sparingly in the pursuit of terrorists, and not to clumsily slurp potentially hundreds of millions of call records of innocent Americans.

Stand up and be discounted

Wyden and Paul have proven to be two of the very few congressmen and women willing to challenge the powerful intelligence agencies, and in the letter ask eight questions of NSA’s data bonfire, focused on identifying contradictory elements.

For example, they ask how the NSA can square a statement that its spying is “accurate, relevant, timely and complete” with its subsequent statement that it was “infeasible to identify and isolate properly produced data.” Either the system allows the NSA to identify data or it doesn’t, in which case, which is it?

In essence, the senators want to know what happened, and why, and what changes have been made to ensure it doesn’t happen again.

The questions are not academic either: Section 215 was at the center of Edward Snowden’s revelations in which it was revealed the intelligence agencies were abusing the law to engage in mass, rather than focused, surveillance.

Following a critical report by the Privacy and Civil Liberties Oversight Board (PCLOB) in 2014, Congress amended the law to restrict data gathering by the NSA itself: now it has to request the records from phone companies – rather than intercept and snatch them off the wire itself – and those requests have to approved by the secretive Foreign Intelligence Services Court (FISC).

Crucially, Section 215 is up for renewal in December 2019, meaning that in congressional terms, lawmakers need to start looking into the program now, long before the deadline, if they are to get an idea of what has been going on.

“We request that this investigation be completed well in advance of the sunset of these collection authorities, on December 15, 2019,” Wyden and Paul’s letter states. “We further request that, to the extent possible, your report on this investigation be unclassified so that it can inform a public debate concerning that reauthorization.”

First move in a longer game

As such, the letter is the opening salvo in what will be a long battle between some lawmakers and the intelligence services over their spying programs, whiich typically comprise secret and highly dubious interpretations of the law.

Wyden in particular will be hoping that he is more successful than his previous effort to restrict the use of another spying program – authorized through Section 702 of the same FISA law – that allows for the gathering of internet activity of foreign intelligence threats.

In January, Congress reauthorized Section 702 for six years despite a determined multi-year effort to add extra accountability to the program, including the requirement for the intelligence services to get a warrant before searching the communications of a US citizen. If you’re a foreigner, no warrant is needed: you’re fair game to Uncle Sam’s snoops.

The program is almost certainly being used for broad-based surveillance of millions of American citizens with the intelligence agencies claiming, erroneously, that information on US citizens is gathered “incidentally.” In other words, in chasing foreign targets, the communications of US persons are conveniently swept up into the NSA’s databases, where they linger.

In the case of Section 702, Wyden repeatedly asked the director of national intelligence (DNI) for more than year before reauthorization to provide an estimate of how many American citizens were in the Section 702 database, despite the law specifically noting that it was not to be used for US citizens.

The intelligence services strung out Wyden’s repeat requests, at first saying such an estimate wasn’t possible, then promising to provide one, before reneging at the last minute and arguing in a public hearing that “working to do it is different from doing it.” That sparked a furious response by the senator in which he accused the DNI, Dan Coats, of adopting a “very, very damaging position.”

Opening the black box

There is likely to be a similar fight over Section 215, and Wyden and Paul are starting 16 months out, using the data deletion admission as a tool to pry open the sealed box of spying programs in an effort to see whether and how they are being abused again.

It remains to be seen whether lawmakers are able to take their experiences from last year over Section 702, and see if they can apply them to Section 215 to introduce real reform – or whether the intelligence services will manage to delay and obfuscate the issue close enough to the deadline that they can appeal to Congress’ national security fears and so sidestep efforts at improved accountability.

Unfortunately, this time around, lawmakers will not be able to rely on the Privacy and Civil Liberties Oversight Board (PCLOB). Its critical report in 2014 was key to Congress being able to force reforms onto the program.

But the PCLOB paid for its willingness to criticize the intelligence agencies, and within two years, it had been stripped of all of its independence and most of its budget, resulting in the resignation or removal of all but one of its board members.

The PCLOB was then kept on life support before President Trump announced a new chair in August 2017 – Adam Klein – and then two new board members in March 2018. That revival of the watchdog was almost certainly at the instigation of the intelligence services, which need it to act as a buffer between themselves and Congress in the lead-up to reauthorization.

Toothless watchdog

This time around, the PCLOB can be expected to be determinedly pro-NSA: one month before Klein was offered the job, he wrote an op-ed in the Wall Street Journal that argued in favor of Section 702, and at his confirmation hearing, he went out of his way to give vague and meandering answers to questions about spying programs.

So far, none of the three new proposed members – Klein, Ed Felten and Jane Nitze – have been approved by the Senate, where Democrats are holding up their nominations in just one tiny part of Washington’s partisan gridlock.

The one wild card in the entire saga is President Trump who, as is his norm, has staked out extreme conflicting positions on NSA spying, depending on whether he feels it benefits him personally or not.

Trump put forward Klein for the PCLOB position, and has signed off on numerous spying programs, while at the same time undercutting the intelligence services over issues like Russian election interference.

As for the data deletion that sparked Wyden and Paul’s letter this week, Trump has his own strongly worded view on the matter, tweeting: “Wow! The NSA has deleted 685 million phone calls and text messages. Privacy violations? They blame technical irregularities. Such a disgrace. The Witch Hunt continues!” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/06/us_spying_programs/

Salesforce Customer Data Possibly Exposed in API Glitch

The issue was discovered and fixed on July 18.

Salesforce said in a post last week that it had alerted customers to a data leak caused by an API error.

According to Salesforce, during an update to its Marketing Cloud service that was rolled out between June 4 and July 7, 2018, a code change produced an API glitch that “may have caused a small subset of REST API calls to improperly retrieve or write data from one customer’s account to another.”

The company’s security team discovered the problem on July 18, and at that time corrected the error. “We have no evidence of malicious behavior associated with this issue,” Salesforce said.

Read more here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/salesforce-customer-data-possibly-exposed-in-api-glitch/d/d-id/1332492?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Google Details Tech Built into Shielded VMs

Specialized virtual machines, recently released in beta mode, ensure cloud workloads haven’t been compromised.

Google recently rolled out in beta specialized virtual machines, called Shielded VMs, so account holders on Google Cloud Platform (GCP) could run workloads without fear of running compromised code.

Now the company is publishing details on how Shielded VMs keep the cloud secure from attack vectors, including guest system firmware, guest OS via malicious guest-VM kernel or user-mode vulnerabilities, and malicious customer insiders tampering with guest VM images. Threats like boot malware or firmware rootkits often lay undetected while the compromised VM boots.

Shielded VMs come with security features to protect code in the cloud, which Google explains in a blog post released today by Nelly Porter, Google Cloud senior product manager, and Sergey Simakov, technical program manager for Google Cloud Security. They start with the firmware, which is based on UEFI 2.3.1 to replace legacy BIOS subsystems and enable UEFI Secure Boot.

The virtual Trusted Platform Module (vTPM) validates guest VM preboot integrity and generates and secures encryption keys. It allows the guest OS to create and protect keys and sensitive data. VTPM is required to launch Measured Boot, providing guest VM instances and cryptographically verifying the stack before the VM is permitted to access data stored in the cloud.

“The goal of the vTPM service is to provide guest VM instances with TPM functionality that is TPM2.0 compatible and FIPS 140-2 L1 certified,” Porter and Simakov write. Google software engineer Josh Zimmerman further expands on vTPM security functionalities in a separate post.

vTPMs work like TPMs, which use platform configuration registers (PCRs) to log system states. Using the TPM’s keys, the vTPM provides a “quote” of PCR values so remote servers can verify the state of a system. The TPM can protect sensitive data – for example, drive decryption keys, so they can be accessed only if a system state is valid.

Measured Boot, along with Secure Boot, helps defend Shielded VMs against boot- and kernel-level malware and rootkits. The two also ensure a user’s VM launches a known firmware and kernel software stack. Secure Boot ensures the system runs legitimate software; Measured Boot verifies the integrity of the system software and VM boot process.

Users can access integrity reports for Shielded VMs via Stackdriver; they also can define their own policies and custom actions if the report indicates their VMs don’t meet their security standards.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/cloud/google-details-tech-built-into-shielded-vms/d/d-id/1332493?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Facebook Launches Fizz Library for Dev Speed, Security

New open source TLS library aims to help developers incorporate speed and security into apps and services.

Facebook today announced Fizz, an open source developer library built to implement TLS 1.3, the latest generation of the Transport Layer Security protocol designed to better secure Internet traffic.

More than half of the company’s online traffic is secured with TLS 1.3, which uses encrypting handshake messages to keep certificates private, redesigns the way secret keys are derived, and uses a zero round-trip connection setup to accelerate requests. More than a billion people use Facebook, and TLS 1.3 secures data in transit from apps to its corporate servers.

Both Fizz and TLS 1.3 have been globally deployed in Facebook’s mobile apps, its C++ HTTP framework Proxygen, load balancers, internal servers, and its QUIC library. The company is open-sourcing Fizz to help drive deployments of TLS 1.3 across the Internet and to make apps and services faster and more secure.

Facebook anticipates its percentage of Internet traffic secured with TLS 1.3 will continue to grow as browsers and apps continue to add support for it.

Read more details here.  

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/facebook-launches-fizz-library-for-dev-speed-security/d/d-id/1332496?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Guilty! Court sinks children’s hospital attacker found stranded on a boat

A hacker who attacked Boston Children’s Hospital (BCH), fled the US when the Feds came knocking, and was subsequently plucked off a sailboat bobbing off the coast of Cuba has been found guilty.

A federal jury in Boston found Martin Gottesfeld guilty of one count of conspiracy to damage protected computers and one count of damaging protected computers, the Department of Justice (DOJ) announced on Wednesday.

In 2014, Gottesfeld affiliated himself with the Anonymous brand of hacktivism and left multiple hospitals hamstrung by flooding their computer networks with distributed denial of service (DDoS) e-garbage and putting out the standard, monotone Guy Fawkes call for others to join in.

It was done as, what he considered, justifiable payback for BCH’s “parentectomy” in the Justina Pelletier case, Gottesfeld said. As you might recall, starting 14 February 2013, then-15-year-old Justina was held in custody as a ward of the state in Massachusetts, at the order of a Boston hospital that decided her illness was all in her head, aggravated by what some doctors perceived to be medical abuse doled out by her parents.

The public and patients’ rights advocates were memorably outraged over the girl’s ordeal, which entailed strictly limited visitation with her parents, restriction of discussions of her medical issues in front of Justina, plus a gag rule imposed on her father (he broke it in order to tell the media her story; contempt charges were subsequently filed against him).

That outrage rose to a head in April 2014 and burst into cyber warfare. That’s when hacktivists who slapped themselves with the Anonymous label decided to inject themselves into the situation by launching #opJustina .

As the DOJ describes it, the first target was Wayside Youth and Family Support Network, the Framingham residential facility where Justina had been living under state custody. The DDoS attack crippled Wayside’s network for more than a week and caused the facility, which provides mental health counseling and family support services to children, to spend $18,000 on response and mitigation efforts.

Then, Gottesfeld went after BCH, launching a massive DDoS attack against the hospital’s network. The DOJ says he customized malware that he installed on 40,000 network routers that he was then able to control from his home computer.

He spent more than a week polishing that ball of bad. Then, he unleashed the attack on 19 April, 2014, directing so much e-flotsam at the hospital that it not only knocked BCH off the internet but it also spilled over and swamped several other hospitals in Boston’s Longwood Medical Area.

The attack flooded 65,000 IP addresses used by BCH and the other local hospitals. BCH’s network was out of commission for at least two weeks, interrupting access to internet services used to treat patients, preventing patients from talking to their doctors, and meaning that patients and medical personnel couldn’t access their online accounts, check appointments, or access test results and other case information.

All told, BCH claimed that the attack cost more than $300,000 in damage and remediation, plus another $300,000 or so loss in donations, given that the attack disabled the hospital’s fundraising portal.

The BCH attack was planned for maximum financial damage, Gottesfeld said: he knew that the hospital was planning a big fundraising drive and that most donors gave online.

Gottesfeld had posted a YouTube video on 23 March 2014, calling, in the name of Anonymous, for action against the hospital in response to its treatment of Justina. The video directed viewers to a Pastebin post that supplied information necessary to initiate a DDoS attack against the hospital’s server.

Multiple DDoS attacks hit Boston Children’s Hospital over the weekend of 19 April and on into the following week.

The FBI searched Gottesfeld’s apartment in October 2014, in connection with the attack. Then, he skipped town. The FBI tracked him down to a Disney cruise ship that came to his aid when the hacker and his wife wound up on a disabled sailboat, along with some luggage and three laptop computers.

After Disney rescued the couple, they dropped them off in Miami, into the arms of waiting FBI agents, who arrested Gottesfeld. He was charged in February 2016.

The charge of conspiracy could result in a sentence of no greater than five years in prison, three years of supervised release, a fine of $250,000 and restitution. The charge of damaging protected computers provides for a sentence of no greater than 10 years in prison, three years of supervised release, and a fine of up to $250,000. Maximum sentences are rarely handed out, though.

Gottesfeld’s sentencing is scheduled for 14 November, 2018.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/bFqpRLtVRDc/

‘Unhackable’ Bitfi hardware rooted within a week

Whaddya mean there’s no such thing as an unhackable device? John McAfee sputtered last week. I got a $100K bounty for anybody who can hack my spiffy, new, unbreakable breakthrough, the wowee-wow world’s first and only completely unhackable, most advanced digital thingie ever, cryptocurrency wallet!

Then, hardware maker Bitfi upped the ante with its own offer of a 250K bounty.

It allegedly took a week. Whether BS walked or pulled up a chair to discuss that $100K… or $250K… is debatable, though, as McAfee is happy to explain.

Press are indeed claiming that the Bitfi wallet has been hacked. It was released the week prior to the hack/not-a-hack with great fanfare and greeted with great guffaws, as well as by people who decided to give the breakage a go.

As CNet reported on Friday, a “self-described IT geek in the Netherlands” who goes by the Twitter handle @OverSoftNL tweeted on Wednesday that they’d gained root access to the crypto-wallet. @OverSoftNL went on to say they had help from @cybergibbons, also known as Andrew Tierney, a security consultant at Pen Test Partners, and from Graham Sutherland (@gsuberland)… all three of whom got royally peeved at what Sutherland called a “clueless and misleading attitude to security.”

The wallet comes from antivirus software pioneer, former Belize man-about-town/government spy/fugitive, current US fugitive McAfee, together with hardware crypto-wallet maker Bitfi. McAfee (the man, not the brand owned by Intel Security) and Bitfi had claimed that the thing had “absolute” security.

Ah. Well. For its part, OverSoftNL claims Bitfi cryptography implementation is “terribad.”

For one thing, the “most sophisticated instrument in the world” turns out to be nothing more than a cheap touchscreen Android phone that’s been gutted – particularly, stripped of its cellular connectivity innards. What it has in their place is a touchscreen that uses a protocol that’s easily intercepted. As Pen Test Partners wrote in Part 1 of its Hacking the Bitfi series:

All you need is a logic analyser to capture the finger movements on the screen and therefore the wallet passphrase as it is entered on to the screen.

The upshot, according to Tierney:

A lack of anti-tamper measures means that the back of the Bitfi can be popped off, the hardware reprogrammed or bugged, the case closed up again, and the handheld handed to a victim. Whatever passphrase they then type in can be captured and sent to an attacker via whatever backdoor they’ve built into it.

What gall, Tierney said:

…he also shared a link to a USD $35-ish phone using that same chip set.

Regarding those bounties: apparently, Bitfi and McAfee don’t define gaining root access, and patched firmware to be successful “hacking,” they say.

Rather, Bitfi’s bounty program defines a legitimate hack as one in which the hacker receives a Bitfi phone preloaded with $50 in crypto-coins, secured by an unknown passphrase, and gets the coins off the device.

The terms highlight what critics say is the device’s one genuine security feature: it doesn’t store the key needed to access the crypto-currency on the device itself.

But as Tierney put it, that means that the challenge only covers one specific method of theft: getting at the coins on a stolen device. That’s pretty narrow for something to be called “unhackable,” though.

In fact, Tierney says, the bounty is a sham:

The bounty deliberately only includes only one attack: key recovery from a genuine, unaltered device. And the device doesn’t store the key.

The only way to win the bounty is to recover a key from a device which doesn’t store a key.

The most obvious way to hack the device, he said:

Modifying the device so that it records and sends the key to a malicious third party. But this is excluded from the bounty. Why is this? Because the bounty is a sham.

But there are “many, many more attacks such a device is vulnerable to,” Tierney said.

On Friday, OverSoftNL echoed Tierney, dismissing the bounty as a “sham” and adding that the ability to gain root access does in fact mean that the wallet isn’t secure. Bitfi doesn’t “even have $250k free on hand at this moment,” they claimed.

Bitfi, which hadn’t responded to CNet’s request for comment as of Friday, also offered a second, $10,000 bounty with a plea for help. The tweet from CEO Daniel Khesin:

Dear friends, we’re announcing second bounty to help us assist potential security weaknesses of the Bitfi device. We would greatly appreciate assistance from the infosec community, we need help.

OverSoftNL called it chump change. Get real, they said, instead of trying to weasel out of paying for a real penetration test:

John McAfee has since appeared in a promoted video (an advertisement) on Twitter explaining that his role is to drum up publicity for the Bitfi device and that there is no easier way to do that than with the instant controversy calling something “unhackable” creates.

So, is he right, and will you be rushing out to buy a Bitfi device to store your cryptocoins?


Image courtesy of bitfi.com

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Qw0bPBrXl_o/

Man arrested for blackmailing women with porn fakes

Revenge porn using real images is a horrific abuse, and the most repeated advice is that you can only stop it by not creating revealing, digital images of yourself in the first place.

That advice is looking increasingly threadbare though, thanks to another kind of threat – faked images that use only your face to create embarrassing photos of you. This week, police arrested a man in India for blackmailing women with digitally manipulated images putting them in compromising positions.

On Tuesday, a resident of Gurugram, a city near Delhi, was arrested for blackmailing women through Facebook. At least one woman has accused the individual, identified in news stories only as “Vijay”, of trying to extort her using fake social media accounts and pictures.

Vijay, a helper at the Indira Gandhi International Airport who had recently lost his job, admitted to police that he created fake Facebook accounts in women’s names, and used them to send friend requests to random women. When some accepted, he would steal images from their accounts.

He would then approach them again using other Facebook accounts registered in men’s names, making lewd propositions. If they refused to interact with him, he would send them altered photographs (presumably of a sexual nature). If they continued to ignore him, he would post the photographs on Facebook to embarrass his victims.

Vijay had been blackmailing over 200 women, police said, adding that one account in his control had 353 ‘friends’ on it.

An ongoing issue

This isn’t the first time that people have altered images for nefarious ends. In April, Glasgow-based Sean McCuaig got three years in jail for blackmailing nine girls aged between 12 and 17 on social media. He would persuade them to send him pictures, which he would then superimpose onto nude images. He would show these images to the girls and threaten to upload them to Facebook if they didn’t send him real nude images of themselves.

In 2016, another man, also in the UK, stole photos of a 15 year-old girl from her Facebook page, superimposed them onto porn images and then uploaded them onto a porn site for others to see. The man, who had other victims, was arrested after the girl went to the police. However, anti-revenge porn activists heavily criticized the police force after he was only cautioned rather than being charged with an offence.

In 2015, crooks tried to blackmail two Chinese officials with altered pictures superimposing their faces onto porn, asking them to send money. The officials went to the authorities with the badly-Photoshopped images instead. Two years earlier, crooks elsewhere in China successfully extorted 255,000 yuan (about £28,600) with fake sex photos, in what was becoming a growing problem in China even then.

While some Photoshop forgers are laughably amateurish, a skilled manipulator can produce an image that would fool people even with close scrutiny. The worry is that this problem may get worse as faked images evolve into fake videos. Videos that superimpose people into fake situations, dubbed ‘DeepFakes’, have been used to create fake celebrity porn and have now been banned by a range of social media sites, with some porn sites following suit.

Advocates against domestic violence have already found people producing fake videos of non-celebrities and are exploring legal responses to what they see as a serious emerging evolution of revenge porn.

If you or someone you know has been approached by a blackmailer with compromising images – real or fake – we recommend you contact the police immediately.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/4qyka0Z7-gU/