STE WILLIAMS

Some 1,000 sex-obsessed civil servants in Taiwan have been sent on an internet security course after being caught in a kind of online honey trap set up by their local government employer.

The government of New Taipei City, next door to the Taiwanese capital, sent an email to its 6,000 employees in order to test their resolve, AFP reported.

The email used classic social engineering techniques to encourage recipients to open it – claiming to contain a salacious video relating to a popular celebrity sex scandal currently doing the rounds in the country.

Around a sixth of employees couldn’t resist having a peek, despite the checking of non-work emails being strictly forbidden for government workers. Those who clicked on the message will be forced to sit through a two hour course on internet security.

It remains to be seen whether this kind of extreme approach to user security awareness-raising and education will do the trick, but it’s certainly a novel way to keep the staff on their toes.

“This is an extreme example of educating employees in the importance their actions have in maintaining an organisation’s security stance, however it does reinforce the point that employees’ actions are critical in maintaining security to avoid the introduction of malware onto networks,” said Check Point’s UK MD, Terry Greer-King. “Obviously this was quite a harsh lesson in security practice, but it shows that internet usage and security policies alone are not enough to ensure appropriate behaviour, and there needs to be active reinforcement of those policies.”

The scandal in question, which has been doing the rounds in Taiwan for several months, involves 27-year-old playboy and socialite Justin Lee, who allegedly drugged and sexually assaulted scores of local models and actresses.

Prosecutors are currently investigating the case, according to AFP. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/09/20/taiwan_government_traps_staff_email/

The consumer website of JPMorgan Chase was unavailable on Wednesday afternoon, possibly due to the same hack attack that caused Bank of America to go intermittently dark on Tuesday after threats from a group incensed by the execrable Innocence of Muslims film that has caused turmoil in the Islamic world.

“We’re experiencing intermittent issues with Chase.com,” a JPMorgan Chase spokesman told MSN Money. “We apologize for any inconvenience and are working to restore full connectivity.”

Bank of America suffered similar problems yesterday. A bank spokesman told Reuters at the time that “We are working to ensure full availability,” and assuring customers that “We continuously take proactive measures to secure our systems.”

The problems that both banks have experienced come after an unverifiable Pastebin message from a group calling itself the “Cyber fighters of Izz ad-din Al qassam” saying that they would “attack the Bank of America and New York Stock Exchange for the first step” in their retaliation for what they called a “Sacrilegious movie insulting all the religions not only Islam.”

If, indeed, Bank of America and JPMorgan Chase are being attacked by the Islamic “Cyber fighters”, they may not be the last. “This attack will continue till the Erasing of that nasty movie,” the Pastebin message says. “Beware this attack can vary in type.”

Neither bank has identified the type of attack aimed at their websites, but DDoS is, of course, one suspect.

“All the Muslim youths who are active in the Cyber world will attack to American and Zionist Web bases as much as needed such that they say that they are sorry about that insult,” say the Cyber fighters of Izz ad-din Al qassam. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/09/19/chase_website_outage/

Microsoft has promised it will release a fix “in the next few days” to address the recently-identified flaw in Internet Explorer. At the time of writing, it is only possible to work around the bug, or stop using Internet Explorer, if one wishes to avoid the potential effects of attacks exploiting the vulnerability.

In a new TechNet post, Microsoft’s Director of Trustworthy Computing Yunsun Wee writes that Redmond will issue a fix he describes as “an easy-to-use, one-click, full-strength solution any Internet Explorer user can install.”

But the fix Redmond issues won’t be the end of the matter, as Wee goes on to say “it will provide full protection against this issue until an update is available.”

Which sounds an awful lot like an interim patch, rather than the final and definitive fix.

The sole piece of good news is Wee’s statement that the wound in IE isn’t being poked at by many attackers. He insists “we have only seen a few attempts to exploit the issue, impacting an extremely limited number of people”. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/09/19/ie_flaw_fix_plan/

Security researchers have discovered security shortcomings in Windows 8 that create a means to infect the upcoming operating system with rootkit-style malware.

Italian security consultants ITSEC discovered the security hole following an analysis of the Unified Extensible Firmware Interface (UEFI), a successor to the legacy BIOS firmware interface, that Microsoft began fully supporting with 64-bit versions of Windows 7.

ITSEC analysed the UEFI platform now that Microsoft has ported old BIOS and MBR’s boot loader to the new UEFI technology in Windows 8. Andrea Allievi, a senior security researcher at ITSEC, was able to use the research to cook up what’s billed as the first ever UEFI bootkit designed to hit Windows 8. The proof-of-concept malware is able to defeat Windows 8’s Kernel Patch Protection and Driver Signature Enforcement policy.

The UEFI boot loader developed by Allievi overwrites the legitimate Windows 8 UEFI bootloader, bypassing security defences in the process.

“Our bootloader hooked the UEFI disk I/O routines and it intercepted the loading of the Windows 8 kernel, thus our bootkit tampered the kernel by disabling the security features used by Windows to prevent the loading of unsigned drivers,” explains Marco Giuliani, a director of ITSEC.

The bootkit developed by ITSEC is comparable to forms of older MBR (Master Boot Record) rootkits that overwrite system files of older version of Windows. Bootkits capable of taking over Windows 8 machines have been around since last November but these earlier proof-of-concept nasties didn’t circumvent UEFI, unlike the latest research.

Previously boot loaders and rootkits had to be developed in assembly language. But UEFI creates a means to develop system loaders much more straightforwardly using the easier C programming language, making thing easier for both legitimate developers and VXers.

“Our research attempts to show the industry that the new UEFI platform is still as insecure as the old BIOS technology, it’s still vulnerable to the old attacks if the SecureBoot technology is not turned on by default,” Giuliani told El Reg. “Writing a bootkit couldn’t be an easier task for virus writers with the UEFI framework available, much easier than before when they needed to code in pure assembly.

“The UEFI platform will soon become the new field of war between malware writers and the security industry unless SecureBoot is used to ensure that only digitally signed UEFI bootloaders can be executed at the system bootup.”

Giuliani also said that – although it’s desirable from a security perspective – enabling SecureBoot by default effectively limits user choice.

ITSEC’s detailed technical analysis of the Windows 8 implementation of UEFI, and its potential security shortcomings, can be found here.

The research by ITSEC follows the creation of a UEFI bootkit able to infect Mac’s OS X operating systems, which was unveiled at this year’s edition of the BlackHat Conference in Las Vegas by Australian security researchers Assurance. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/09/19/win8_rootkit/

GCHQ, the nerve centre for UK eavesdropping spooks, has launched a new attempt to persuade tech-savvy Brits to defend their nation rather than seek lucrative employment in private companies.

Officials at the Government Communications Headquarters are after potential cyber spooks aged 16 and over who are not already working in computer security and could possibly guard the country’s networks against the hacking ambitions of hostile states, crooks and script kiddies.

But the spook hopefuls must first triumph in a Balancing the Defence game. The participants will analyse a fake government’s networks for possible paths of intrusion, figure out the threats they face and suggest ways to defend them – while taking into account the increasingly tight purse-strings of the UK. The Q-Branch wannabes will have just one week, starting on 1 October, to be briefed on the scenario and submit their report.

“We hope this competition will uncover those who have the vital mix of technical ability and business awareness to make tough decisions in the best interest of an organisation,” said Karl, the “architect” of the competition and such a secret spy his surname wasn’t given.

“At GCHQ we are committed to finding and developing the new cyber security skills in the UK and these are the skills sets employers including ourselves are most interested in,” he added in a tinned statement.

This latest test is part of the Cyber Security Challenge UK programme, which was started in 2010. Winners of Balancing the Defence will be invited onto the next stage of the programme, a face-to-face competition that will further whittle down the candidates. Another virtual competition will follow, after which the remaining contenders will get a real-life challenge with an Aston Martin Racing team and the IT infrastructure the crew relies on.

The final few will reach a Masterclass and Awards weekend in March, where a “range of career enhancing prizes” will be on offer. GCHQ bods didn’t specifically say that a spook spot was waiting for anyone, mentioning bursaries, university courses and internships instead, but then, secrecy is in their nature.

The eavesdropping collective may a bit embarrassed to admit how much one of their crack specialists would earn, since another of its competitions, Can You Crack It?, yielded a job with a starting salary of just £25k.

Then again, a number of GCHQ’s code-cracking conundrums have had hidden solutions within the main puzzle for top-notch spy wannabes to crack and stand out from the humdrum candidates. The masters of misdirection may well be diverting attention from the Bond-esque lifestyle they reallyoffers. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/09/19/gchq_cyber_security_competition/

Cybercrooks behind the resilient Pushdo botnet are bombarding legitimate small websites with bogus traffic in order to camouflage requests to the zombie network’s command and control servers.

A varying cast of around 300 genuine (mostly smaller) websites is at the receiving end of queries from zombie drones infected with the latest variant of Pushdo, according to Brett Stone-Gross, a senior security researcher at Dell SecureWorks’ Counter Threat Unit (CTU).

“In some cases these fake web server requests are overwhelming small web sites,” Stone-Gross explained.

Previous variants of the malware that appeared around two years ago spewed bogus requests buried in SSL traffic to large websites (CIA, PayPal etc) – for reasons that have never been adequately explained. The latest behaviour is arguably even more noxious because it might easily be to blame for exhausting the bandwidth limits of small websites.

“The purpose of these fake HTTP requests is to make Pushdo’s command and control (C2) traffic, which also uses HTTP, blend in with legitimate traffic,” a blog post by Dell SecureWorks on the latest Pushdo botnet trickery explains.

The Pushdo botnet first appeared around 2007 and has been associated with the spam-pushing Cutwail botnet throughout that time. Stone-Gross reckons both Pushdo and Cutwail are the work of the same well-resourced eastern European gang. Pushdo creates a backdoor onto infected machines through which bot-herders can push Cutwail. The same approach has also been used to distribute variants of the infamous ZeuS banking Trojan and other similar nasties.

Despite four takedowns over five years Pushdo continues to flourish.

“The group behind the botnet is well funded and every takedown is only temporary,” Stone-Gross said. The botmasters behind Pushdo have recently begun sending spam to eastern Europe and Russia: but not the phishing emails or malware that users in the west are bombarded with.

The latest variant of Pushdo is using a combination of spam and drive-by downloads to spread. The population of infected drones has varied from 112,000 to 200,000 bots in recent months, according to monitoring stats from Dell SecureWorks. ®

Bot-note

Fake HTTP GET/POST requests generated by the latest variant of Pushdo variant can be spotted by the anomalous requests that follow the format “http : //domain/?xclzve_[30 random characters]”. Website owners affected by Pushdo may filter the requests using a web server rule dropping traffic that matches this pattern.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/09/19/pushdo_spews_fake_traffic/

Fraud and identity theft are serious problems threatening Universal Credit, Blighty’s soon-to-be-launched web-based benefits system, ministers said yesterday.

Pensions Secretary Iain Duncan Smith and welfare reform minister Lord Freud were grilled by the Work and Pensions Select Committee over the new programme, designed to take over and merge separate public-funded payouts such as jobseeker’s allowance and housing benefits.

Lord Freud admitted that he saw online security as a risk and worried about being able to prove people’s identities online to stop benefit fraud.

“I’ll say what the challenges are, what we need to get right to get the security system working properly,” said the great grandson of Sigmund Freud.

Former Tory leader Duncan Smith said that the government would also have to ensure that the new system was always online: “We must always be ready for the moment we need to pay people the money.”

The ministers said the project, now in the final stages of development, was adopting security systems used by banks, and the team behind it was in talks with internet companies including Amazon for advice on how to keep availability high.

But they also said that programmers still hadn’t tested the bridge that is supposed to link data from HMRC and the Department of Work and Pensions.

“We’re testing that bridge, the mechanics of the bridge with dummy data, and we will be getting live feeds for our trial in April,” Lord Freud said, adding that there was no need for a Plan B in case the bridge didn’t work – because he has a “comfort level” about it sorting itself out.

Like most major reforms to government policy, the Universal Credit system is facing an all-round backlash: Treasury officials questioned whether it can stick to its implementation timetable, charities and interest groups claimed the system will leave Brits out of pocket, and Labour lambasted the project. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/09/18/universal_credit_cyber_security_concerns/

Two Romanian nationals who were extradited to the US in May have confessed their involvement in a $10m scam aimed at stealing credit and debit card data from payment terminals at hundreds of Subway restaurants and other merchants across the US, according to the United States Attorney’s Office.

Iulian Dolan, 28, of Craiova, Romania, pleaded guilty to conspiracy to commit computer fraud and two counts of conspiracy to commit access device fraud. Cezar Butu, 27, of Ploiesti, Romania, pleaded guilty to one count of conspiracy to commit access device fraud. Each agreed to plead guilty in return for lesser sentences as part of a plea-bargaining agreement that will see Dolan jailed for no more than seven years and Butu for no more than 21 months, providing a sentencing judge approves the deal.

The pair were among four Romanian nationals extradited in May after being charged last December with hacking into Subway vulnerable point-of-sale computers between 2009 and 2011. The scheme led to the compromise of more than 146,000 payment cards and more than $10m in losses.

The hack against point-of-sale terminals relied on identifying machines running exploitable remote desktop software applications. The US Dept of Justice said Dolan had hacked into these systems to install keystroke logging applications, which subsequently recorded card data from swiped cards before transferring this information to dump sites. In some cases Dolan had to crack passwords in order to circumvent the remote desktop applications, which in normal use were used to update the software on PoS terminals.

Butu has admitted to attempting to make fraudulent transactions using the stolen credit card data as well as selling the plastic cards data to co-conspirators. The confessions implicate alleged ring-leader Adrian-Tiberiu Opera, a Romanian national extradited to the US and awaiting trial in New Hampshire over his alleged involvement in the scam.

A US DoJ statement on the case can be found here. Subway is not named as the target of the scam by the DoJ in its latest statement but it is named in prior DoJ statements as being one of the victims of the hack – along with around 50 other merchants. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/09/18/romanian_cybercrooks_plead_guilty/

Miscreants can crash or infiltrate banks and help desks’ touch-tone and voice-controlled phone systems with a single call, a security researcher warns.

Rahul Sasi, who works for iSight Partners, said audio processing algorithms in office telephone networks and speech-driven command software are liable to crash when bombarded with unusual data in so-called fuzzing attacks.

Certain DTMF (Dual-Tone Multi-Frequency) signals can cause these private branch exchanges (PBX) and interactive voice response (IVR) systems to raise exceptions and bail out, much in the same way that unexpected input data can knacker applications running on a desktop computer or server.

PBX and IVR machines are often used to run phone banking, call centres and other interactive telephone systems. Given the appropriate DTMF input, it may be possible to crash backend application servers or convince them to cough up sensitive information. Repeating the trick to bring down a machine effectively launches a denial-of-service attack on the phone line as a paper [PDF] by Sasi on the topic explained:

If an attacker could trigger an exception in DTMF-processing algorithms, then they could crash the entire application server by making a single phone call, causing the entire phone banking to become inaccessible, or no calls from the customer goes through. One such denial of service could cause a lot of panic and the amount of damage would be pretty huge. We will be demonstrating a lot of amusing remote DTMF attacks on phone banking, tele-voting, and customer support applications using DTMF.

Sasi (@fb1h2s) delivered his findings at the Hack in the Box conference in Kuala Lumpur, Malaysia. He is due to repeat his research at the Nullcon Delhi conference later this month and at Ruxcon in Melbourne, Australia, in October.

The paper, How I DOS’ed My Bank, reckons the attack technique can be refined to lift data from targeted systems: “We would be able to extract sensitive information about the application’s hosted environment with these sorts of bugs. Since applications that use DTMF algorithms are mainly phone-based, it was possible to extract output in the form of audio data.”

It sounds completely infeasible, yet Sasi claimed it was possible to extract customer PINs from an unnamed Indian bank, SC Magazine reports. Systems spew out error messages in response to invalid inputs that leak potentially useful information to attackers, as illustrated in a video posted on Vimeo.

Sasi said banks and call centres need to wake up to the issue, and realise that voice-based systems are far from invulnerable to attack.

“No banks or organisations are testing IVRs because they think the systems are secure, but in reality they are not,” he said according to SC Magazine. “No firewall or CAPTCHAs monitor voice traffic.”

The content of attacks is restricted to characters available within DTMF signalling: 16 characters limited to the digits 0-9, #, *, a, b, c, and d. Susi is developing a fuzzing program that combines different DTMF input algorithms at variable frequencies. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/09/18/dtmf_phone_system_hack_attack/

Internet Explorer users have been told to ditch the application and switch to another browser, pronto.

The warning comes from Rapid7, which describes a hole that’s exploitable by visiting a malicious Website (and, of course, in the world of Twitter and shortened URLs, it’s so much easier to get users to visit such sites).

Visiting a malicious site gives the attacker the same privileges as the current user, according to Rapid7’s post, here. Although the published exploit targets XP, Rapid7 says the attack works on IE 7 through 9 running on XP, Vista and Windows 7.

The discoverer of the exploit, Eric Romang, says the zero-day drops a file, Exploit.html, on the target. This, in turn, creates files with img and swf suffixes, which IE treats as Flash.

Romang claims the exploit was created by the same group – Nitro – that recently released a Java zero-day into the wild.

Rapid7’s HD Moore, also chief architect of Metasploit, told Ars that he’s surprised to see the exploit work across Windows Vista and 7: “This is one of the few times that a vulnerability has been successfully exploited across all the production shipping versions of the browser and OS”, he said. The attack bypasses ASLR – address space layout randomization – that’s meant to help defend the newer operating systems against attack.

Microsoft is looking at the exploit now, and has stated that it will “take the necessary steps” once it has a fix ready. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/09/17/yet_another_explorer_zero_day/