STE WILLIAMS

Firefox developers searching for a way to protect users against a new attack that decrypts sensitive web traffic are seriously considering an update that stops the open-source browser from working with Oracle’s Java software framework.

The move, which would prevent Firefox from working with scores of popular websites and crucial enterprise tools, is one way to thwart a recently unveiled attack that decrypts traffic protected by SSL, the cryptographic protocol that millions of websites use to safeguard social security numbers and other sensitive data. In a demonstration last Friday, it took less than two minutes for researchers Thai Duong and Juliano Rizzo to wield the exploit to recover an encrypted authentication cookie used to access a PayPal user account.

Short for Browser Exploit Against SSL/TLS, BEAST injects JavaScript into an SSL session to recover secret information that’s transmitted repeatedly in a predictable location in the data stream. For Friday’s implementation of BEAST to work, Duong and Rizzo had to subvert a safety mechanism built into the web known as the same-origin policy, which dictates that data set by one internet domain can’t be read or modified by a different address.

The researchers settled on a Java applet as their means to bypass SOP, leading Firefox developers to discuss blocking the framework in a future version of the browser.

“I recommend that we blocklist all versions of the Java Plugin,” Firefox developer Brian Smith wrote on Tuesday in a discussion on Mozilla’s online bug forum. “My understanding is that Oracle may or may not be aware of the details of the same-origin exploit. As of now, we have no ETA for a fix for the Java plugin.”

About four hours later, fellow developer Justin Scott updated the thread, writing:

“In the interest of keeping this bug updated with the latest status, this morning I asked Johnath for some help in understanding the balance between the horrible user experience this would cause and the severity/prevalence of the security issue and am waiting to hear back. We also discussed this in the Products team meeting today and definitely need better understanding of that before putting the block in place.”

On Wednesday morning, Johnath, the alias for Firefox Director of Engineering Johnathan Nightingale, weighed in: “Yeah – this is a hard call. Killing Java means disabling user functionality like facebook video chat, as well as various java-based corporate apps (I feel like Citrix uses Java, for instance?)”

He went on to say that Firefox already has a mechanism for “soft-blocking” Java that allows users to re-enable the plugin from the browser’s addons manager or in response to a dialogue box that appears in certain cases.

“Click to play or domain-specific whitelisting will provide some measure of benefit, but I suspect that enough users will whitelist, e.g., facebook that even with those mechanisms (which don’t currently exist!) in place, we’d have a lot of users potentially exposed to java weaknesses.”

The Draconian move under consideration is in stark contrast to the approach developers of Google’s Chrome browser have taken. Last week, they updated the developer and beta versions of Chrome to split certain messages into fragments to reduce the attacker’s control over the plaintext about to be encrypted. By adding unexpected randomness to the encryption process, the new behavior in Chrome is intended to throw BEAST off the scent of the decryption process by feeding it confusing information.

The update has created incompatibilities between Chrome and at least some websites, as this Chromium bug report shows. Google has yet to push out the update to the vast majority of Chrome users who rely on the stable version of the browser.

Microsoft, meanwhile, has recommended that users apply several workaround fixes while it develops a permanent patch. The company hasn’t outlined the approach it plans to take.

The prospect of Firefox no longer working with Java could cause a variety of serious problems for users, particularly those in large corporations and government organizations that rely on the framework to make their browsers work with virtual private networks, intranet tools, and web-conferencing applications such as Cisco Systems’ WebEx.

Presumably, Java would be killed by adding it to the Mozilla Blocklisting Policy.

“Whatever decision we make here, I really hope Oracle gets an update of their own out,” Nightingale wrote. “It’s the only way to keep their users affirmatively safe.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/29/firefox_killing_java/

Computer scientists have demonstrated a hack that uses off-the-shelf hardware to tamper with electronic voting machines that millions of Americans will use to cast ballots in the 2012 presidential elections.

The attack on the Diebold AccuVote TS electronic voting machine, which is now marketed by Election Systems Software, relies on a small circuit board that an attacker inserts between the components connecting the touch screen of the device to its microprocessor. The $10.50 card then controls the information flowing into the machine’s internal processor, allowing attackers to change votes with almost no visible sign of what’s taking place.

In a video demonstration, researchers from the Vulnerability Assessment Team at the Argonne National Laboratory in Illinois showed how the card could be used to briefly kill the power to the voting machine’s touch screen to temporarily black out what’s displayed so voters can’t see their choices being modified. Using optional hardware costing about $15, they showed how attackers can remotely tamper with machines from distances as far away as half a mile.

Anyone with a eighth grade education could construct the cards using standard tools and off-the-shelf components, said the researchers.

“This is an attack that requires less skill, so you don’t have to have people hacking the software,” said David Dill, a Stanford University computer science professor and a critic of electronic voting machines, who reviewed the demonstration. “On the other hand, this does involve messing with a lot of individual machines, so it might be a little harder to change very large numbers of votes without getting caught.”

Another hurdle to be cleared is getting physical access to the targeted machines. In theory, they’re subject to chain of custody procedures to prevent unauthorized modifications to the internals. But as Princeton University computer science professor Ed Felton has documented on numerous occasions (most recently here), voting machines are routinely left unattended in the days and hours ahead of election day, making it possible for attackers to tamper with them.

The AccuVote TS is used in several states, including Maryland and Georgia, although voting officials in some jurisdictions have phased out its use because the DRE, or Direct Recording Electronic, voting system typically offers no print out. That makes it particularly hard to audit results.

The Argonne researchers said they’ve devised an even more powerful attack against the Sequoia Advantage AVC (PDF here), a competing electronic voting machine that’s now marketed by Dominion Voting Systems. Whereas the hack of the Diebold machines allows the control of data sent only from the touch screen to the microprocessor, the attack on the Sequoia device allows “bidirectional” control, they said.

The researchers went on to say they believe their attack will work on a wide variety of electronic voting machines.

“I haven’t seen this particular attack described and actually carried out experimentally,” said Avi Rubin, a computer science professor at Johns Hopkins University. “Definitely, many including myself have theorized about something like this, but seeing that they actually implemented it and that it was inexpensive and relatively easy, I think, is a significant result.”

Defenders of electronic voting are quick to point out that any system used to record hundreds of millions of ballots is vulnerable to tampering. Critics say e-voting is different because it affords fewer opportunities for officials to audit votes to gauge the accuracy of the results.

“There are a million ways to hack these machines, and there are a million ways these machines can just make mistakes because they have software bugs in them,” Dill said. “You have no way of checking independently of any computer whether the vote was accurately recorded and counted.”

The Diebold machine used in the demonstration was lent to the researchers by VelvetRevolution.us, a political advocacy group co-founded by Brad Friedman, who reported the scientist’s demonstration for Salon. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/28/diebold_electronic_vote_tampering/

OnStar has backed down from a proposed change in its terms and conditions that would have seen the vehicle info system collecting car monitoring data on former customers.

The OnStar system, operated as part of General Motors, embeds a mobile phone and GPS in customer’s cars and relays a constant stream of data back to the company recording basic speed and location, whether the driver is wearing a seat belt, and tire pressure, as well as reporting accidents. This latter function is the system’s principal selling point, and numerous lives have been saved by the car alerting emergency services that a crash has occurred.

But last week OnStar decided to change its terms and conditions, so that if a customer cancelled the service it would still collect the data. To make matters worse it retained the right to sell it to any third party – unless it received a specific opt-out request. Such information would be a valuable commodity for advertisers, but under the new terms OnStar could conceivably have sold the data to law enforcement looking to issue tickets or insurance investigators examining crash claims.

The move provoked something of a storm among the public, and prompted Democratic senators Al Franken of Minnesota, Chris Coons of Delaware, and Charles Schumer of New York to contact the company about its policy, the latter calling it “one of the most brazen invasions of privacy in recent memory” and suggesting a Federal Trade Commission investigation. Now, barely a week later, OnStar has abandoned the proposed changes.

“We realize that our proposed amendments did not satisfy our subscribers,” OnStar president Linda Marshall said in a statement. “This is why we are leaving the decision in our customers’ hands. We listened, we responded and we hope to maintain the trust of our customers.”

While the company has backed down on its initial proposal, the move has also sparked an investigation by some customers into what OnStar can do with their private data under the current terms and conditions.

“I’m glad to see OnStar responding to its customers, however simply amending their terms and conditions to stop monitoring a vehicle after the user cancels is not enough to satisfy the level of privacy OnStar customers received prior to these updates,” writes forensic scientist, customer, and part-time hacker Jonathan Zdziarski.

“To win back the respect of the many customers who must have canceled over the new terms, OnStar will need to make a full 180 and agree not to collect customer GPS information “for any purpose, at any time”, but only when the customer would expect it to be collected, as the old contract enforced.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/28/onstar_gps_tracking_former_customers/

A middle-aged heroine was hailed by Scotland Yard today for her part in helping the Flying Squad arrest a gang of violent crooks who were attempting a robbery at her golf club.

According to the Yard, the famous Flying Squad had got wind of the gang’s plan to snatch cash as it was being removed from the Perivale Golf Club by a cash-in-transit operator. Detectives from the squad, backed by specialist armed officers from the Metropolitan Police firearms team CO19 were at the scene as the three masked robbers struck.

The gang were plainly hard cases, menacing the armoured-van operative at knifepoint and seizing a box containing £3,500 in cash. They then fled the scene – straight into the arms of the waiting police. According to a Met statement, cuffing the trio was no simple matter: the robber with the cash box hit an armed CO19 SWAT-cop with it, concussing him, breaking several bones in his hand and causing head injuries which later necessitated 19 stitches. The blagger was then brought down by other CO19 cops.

Meanwhile the cashbox crim’s two accomplices were also trying to make good an escape. One was arrested nearby, but the third ran into the unnamed heroine of the story, a 66-year-old lady who had just arrived at the club for her golf lesson. According to the cops the courageous golfer “initially grabbed” the fleeing blagger before pursuing plods arrived and took over.

According to the Met statement:

A 20-year-old man was charged with robbery, possession of an offensive weapon and GBH with intent to resist arrest. A 21-year-old man and a 19-year-old man were charged with robbery. They appeared at Tower Bridge Magistrates’ Court on Tuesday 27 September and were remanded in custody to appear at the Old Bailey in January 2012.

“I pay tribute to the professionalism of all the officers involved and to the member of the public who had the courage to assist police,” said Acting Detective Chief Superintendent Brian Dillon. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/28/heroic_golf_granny/

Hackers have developed a new ruse designed to trick recipients into opening malicious email messages that come loaded with malware.

The trick involves sending emails that pose as scanned documents from office printers or scanners, forwarded by a work colleague. The unlikely source of attack is liable to fool many users, net security firm Symantec warns.

“The idea of an office printer sending malware is perhaps an unlikely one, as printers and scanners were not actually used in these attacks, but perhaps this sense of security is all that is required for such a socially engineered attack to succeed in the future,” said Paul Wood, Senior Intelligence Analyst, Symantec.cloud (formerly MessageLabs).

Symantec said in its September 2011 report that spam levels in the UK have hovered around 75.5 per cent for the month, a decrease of 1.1 percentage points when compared with its August 2011 report. One in 129.9 emails (0.77 per cent) was blocked as malicious during September. Spam emails containing links to compromised websites containing vulnerable WordPress installations rose during the month.

Its September report said Symantec had each day identified an average of 3,474 websites harbouring malware, an increase of 1 per cent from August 2011.

Spammers, like malware pedlars before them, are increasingly using JavaScript-redirection techniques, Symantec reports.

“For spammers, hosting simple JavaScript obfuscation pages on free hosting sites can increase the lifetime of that site before the site operator realises the page is being used for malicious activity,” Wood commented. “JavaScript is popularly used for redirecting visitors of a compromised website to the spammers’ landing page. While some of these techniques have been common in malware distribution for some time, spammers are increasingly using them.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/28/smart_printer_malware_ruse/

Popular IRC service UKChatterbox is advising users to change their passwords following a series of hacks which culminated in an attack that may have compromised user details.

The password reset follows on from a succession of outages – previously attributed to maintenance upgrades – dating back to the start of the summer. In a notice to users this week, UKChatterbox advises users to change their passwords and not to re-use them on other sites.

The UKChatterbox website has recently been the target of several attacks intended to disrupt services, and as part of an ongoing security update, all UKChatterbox users are being asked to change their passwords as a precautionary measure.

Although one user accused UKChatterbox of a succession of basic security errors and subsequent cover-ups, we have a lot of sympathy for the site. Running an IRC channel – which often becomes a magnet for flame wars, hack attacks and squabbles – is often a thankless and difficult task.

We asked UKChatterbox to comment on what led up to the password reset incident and will update this story as and when we hear back from the site. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/28/ukchatterbox_security_snafu/

Failure to patch third-party applications has become the main reason that Windows machines get infected with malware.

Drive-by download attacks from hacker-controlled websites loaded with exploits replaced infected email attachments as the main distribution method for malware somewhere between three to five years ago. At the start of this period browser exploits were the main stock-in-trade for VXers but this has changed over time, as a study by Danish security firm CSIS and published on Tuesday illustrates.

Up to 85 per cent of all virus infections happen as the result of drive-by attacks served up via commercial exploit kits, CSIS reports. The security consultancy, which specialises in e-crime research, monitored the behaviour of 50 different exploit kits over a period of three months, analysing the causes of infection of both commercial and consumer systems.

The study discovered that 31.3 per cent of 500,000 users who were exposed to exploit toolkits were secretly force-fed malware as a result of missing security updates.

Systems running vulnerable versions of Java JRE, Adobe Reader and Acrobat, and Adobe Flash were particularly at risk of attack. Vulnerabilities in Internet Explorer, by contrast, only cropped up in 10 per cent of attacks. By contrast, Java flaws (37 per cent), Adobe Reader/Acrobat (32 per cent) and Flash (16 per cent) were far more productive routes towards exploit. Apple QuickTime holes were poked in two per cent of attacks. Infected systems are typically loaded with a cocktail of malware, often including fake anti-virus software (AKA scareware) and information-stealing spyware.

CSIS concludes that “99.8 per cent of all virus/malware infections caused by commercial exploit kits are a direct result of the lack of updating five specific software packages”.

More information of the study – which illustrates the primary importance of patching alongside anti-virus defences – can be found here. CSIS research Peter Kruse explained that anti-virus still has a role to play in guarding against malware infection while stressing the point that relying on security software without improving patching practices is bound to result in trouble.

“Anti-virus is still needed however the ways to circumvent AV detection are many and works at different levels eg, the exploit kit authors sometime provide SLA (Service Level Agreement) and guarantees that the code is not picked up by AV,” Kruse told El Reg. “This is usually done by slightly changing the code and obfuscating it. The payload is often tricked past AV using complex packers.”

“Obviously this put the pressure on both private end users and companies to patch regularly. For most companies the patch management is sometimes troublesome and time consuming but very much needed to avoid modern malware,” he added. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/28/window_malware_infection_exposed/

Apple has updated the malware protection built into its Mac operating system to flag a recently discovered trojan that hijacks users’ machines by masquerading as a benign document. Malware disguised as an Adobe Flash installer, meanwhile, remained unchecked.

The file quarantine, which Apple snuck into a prerelease version of Snow Leopard in 2009, was updated to include a definition for Trojan-Dropper: OSX/Revir.A, which antivirus provider F-Secure disclosed on Friday. According to an update on F-Secure’s blog, the malware disguises itself as a PDF file in an attempt to trick users into clicking on it.

“The malware then proceeds to install a backdoor, Backdoor:OSX/Imuler.A, in the background,” stated the F-Secure analysis, which was posted Monday. “As of this writing, the CC of the malware is just a bare Apache installation and is not capable of communicating with the backdoor yet.”

By Tuesday morning, Apple had added a definition for Revir.A into the file quarantine feature, our review of a Mac running OS X Lion, aka 10.7, has shown. By our count, it’s the 10th definition to be included, although two of them cover malware with the identical label of “OSX.HellRTS.” The definitions are stored in a file called XProtect.plist tucked away in the /System/Library/CoreTypes.bundle/Contents/Resources/ folder.

Apple engineers pushed out the update around the same time that a new trojan was discovered menacing Mac users. According to Mac antivirus provider Intego, the Flashback trojan is built on a sophisticated code base that installs a backdoor on infected machines, and covers its tracks by using encryption when communicating with remote servers.

This isn’t the Flash installer you’re looking for

“The backdoor is able to download further software, but, for now, we are not seeing this activity,” Intego’s analysis stated. “It is also able to update itself, and creates an Sha1 hash of the malware to see if it has changed. If the Sha1 of the software version on the server is different from that installed, this means that an update is necessary.”

With the explosive growth of Macs, iPhones, and iPads, malware purveyors have finally begun targeting Apple products after years of almost exclusive focus on Microsoft users. Earlier this year, an outbreak of fraudulent Mac antivirus products ignited a huge spike in support calls from frantic Mac users who had been tricked into installing a piece of malware called MacDefender. Apple eventually added definitions for it to its file quarantine, as well.

This story to be continued. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/27/apple_updates_mac_malware_protection/

Microsoft said it delivered a fatal legal blow to Kelihos, a botnet that stole sensitive personal information stored on computers it infected, and was capable of delivering almost 4 billion spam messages per day.

The takedown was achieved in part by obtaining a secret court order shutting down 21 internet addresses, including cz.cc, a free domain name registration service based in the Czech Republic. The underlying lawsuit was unsealed only after the command and control servers that relied on the domains were severed from the internet, making it impossible for the 42,000 or so infected computers to receive updated software and instructions from the Kelihos operators.

The knockout is the third time Microsoft has combined its technical and legal might to disrupt a botnet menacing its customers. In March, Redmond took credit for bringing down Rustock, a rogue network that turned about 1.6 million PCs into spam-spewing monsters. That achievement came after Microsoft worked to identify the domains and servers used to administer Rustock, so they could be confiscated all at once.

Ironically, Kelihos code bore a striking technical resemblance to Waledac, another spam botnet that Microsoft disabled early last year. Redmond’s lawyers swooped down on Kelihos after some researchers suspected it was an attempt to rebuild Waledac.

“The Kelihos takedown is intended to send a strong message to those behind botnets that it’s unwise for them to simply try to update their code and rebuild a botnet once we’ve dismantled it,” Richard Domingues Boscovich, a senior attorney in Microsoft’s Digital Crimes Unit, wrote in a blog post published Tuesday. “When Microsoft takes a botnet down, we intend to keep it down – and we will continue to take action to protect our customers and platforms and hold bot herders accountable for their actions.”

A complaint filed in US District Court in Alexandria, Virginia, named 22 John Doe defendants, along with dotFREE SRO and Dominique Alexander Piatti, the business and individual owners respectively of the cz.cc service that issued more than 3,700 subdomains that infected computers that were used to connect to the Kelihos command and control servers. Kelihos operators then sent instructions causing the machines to pump out spam promoting illegal pharmaceutical drugs and to upload email addresses, FTP login credentials, and Bitcoin wallets.

According to Boscovich, Piatti’s service was associated with other internet scams, including a bogus piece of antivirus software called MacDefender, which caused Apple support calls to spike earlier this year when huge numbers of Mac users were tricked into installing it. In May, Google blocked more than 200,000 cz.cc subdomains and reported that they were hosting malware before eventually reinstating them.

Now that Microsoft has obtained the cz.cc domain, it is working with Piatti to determine which ones are being used legitimately, so customers of his can get back online quickly.

According to IDG News, which reported the takedown earlier, Piatti declined to comment for the article except to say: “I would be glad to give you my side of the story, but I feel that I should hire a lawyer first.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/27/microsoft_kelihos_botnet_takedown/

A Mac developer was surprised to discover both emails and stored passwords on a second-hand Amstrad E-m@iler Plus he picked up at a charity store.

The E-m@iler Plus was a quirky phone with internet and email capabilities launched by Lord Alan Sugar’s Amstrad in 2002. The low-cost technology relied on a premium-rate number to fetch and send emails at a time when unmetered dial-up technology was already widespread and computers were falling in price. It was a commercial flop, mainly because very few people used the E-m@iler for email.

Graham Lee was therefore surprised to find stored emails and passwords on an E-m@iler Plus he bought at a charity shop. The user, whom Lee outs as Colin, failed to delete the two accounts he had set up before flogging his phone. The dial-up service the E-m@iler relies on was discontinued by the service’s eventual owner, BSkyB, earlier this year.

That meant Lee couldn’t download new emails, even if he had been inclined to do so, but he could still browse through old messages stored on the device. Worse still, he could access the passwords used by Colin via the device’s configuration screen. If Colin had used the same passwords elsewhere on the net, a more than plausible scenario, these accounts would be exposed to a heightened risk of attack as a result of the security snafu. The whole incident, as Lee concludes, illustrates the “need to ensure there’s no sensitive information stored on old computers before you dispose of them, particularly if you’re going to sell them on to other users”.

Lee told El Reg he had picked up the E-m@iler Plus – which he describes as an “oddball” old computer – for £7 at the Helen Douglas House charity shop in Oxford. “It still works as a phone, but the e-mail/surf features are no longer supported,” he added.

More details on the data disposal gaffe – including obfuscated screenshots from the device – can be found in a blog post on Sophos’s Security Naked Security blog here. Lee worked at Sophos prior to founding software start-up Fuzzy Aliens. ®

One from the archives

El Reg‘s review of the E-m@iler Plus, described by former staffer Tim Richardson as a “phone with a small screen bolted on and a funny little keypad”, can be found here. Richardson liked the device’s looks and quirks, but found issue with its pricing strategy.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/27/emailer_plus_undeleted_data/