STE WILLIAMS

Security experts are downplaying the significance of a new denial-of-service (DoS) attack tool.

The HTTP Unbearable Load King (HULK) program was developed by a white-hat network security researcher, who shared it on his blog as a proof-of-concept demonstration of how to effortlessly knock over web servers. Nonetheless there is some concern that others might use it for more nefarious purposes.

Barry Shteiman, the developer of the HULK python script, was able to bring a Microsoft IIS 7 web server test system “to its knees” in under less a minute from a single host using the tool.

Neal Quinn, chief operating officer at DoS defence biz Prolexic, commented: “We’ve tested the tool internally and it is functional. What makes HULK dangerous is the fact that a single malicious actor with a single computer could feasibly take down a small, unhardened web server in minutes.”

HULK starts a load of threads to fire off a flood of HTTP GET requests with randomly generated header and URL parameter values. This randomisation makes it more difficult to distinguish the attack from legitimate traffic. However thwarting the tool is not especially difficult, according to Prolexic.

“Fortunately, this is not a very complex DoS tool,” he added. “We were quickly able to dissect its approach and stop it dead in its tracks. It is fairly simple to stop HULK attacks and neutralise this vulnerability with the proper configuration settings and rules.”

Prolexic has added rules to its distributed-DoS mitigation tools to defend against possible attacks that leverage HULK’s technique, as explained here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/06/06/hulk_ddos_threat/

Google is to warn Gmail customers if it thinks they’re being targeted by “suspected state-sponsored attacks”.

The warning, “We believe state-sponsored attackers may be attempting to compromise your computer”, is intended to spur users to take immediate measures to secure their account, Eric Grosse, Google’s security engineering veep, writes on the Google security blog.

Such steps include creating a strong password for the account (that is, the kind of password that’s only usable if you write it down), enable two-step account verification, and keep all software up-to-date.

El Reg anticipates three possible user responses to the warning:

• The kind of indifference or hostility that’s made it so hard for the world to remedy DNS Changer;
• Outright instant terror;
• a small subset of intelligent and sensible users who react calmly and quickly.

Google declined to detail the characteristics of attacks that would lead it to identify activity as state-sponsored, with Grosse writing that “we can’t go into the details without giving away information that would be helpful [to the] bad actors”.

As noted in Threatpost, Google accounts are a favourite target for government attacks (as well, we should add, as attacks by non-state actors, Nigerian scammers, hacktivists, and advertisers trying to sell stuff).

The Aurora attacks, emanating from China in 2010, are the best-known examples of alleged state-sponsored “spear-phishing”. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/06/06/google_state_sponsored_attack_warning/

Apple has published a guide to iOS security, detailing in one place the various safeguards that stop perps p0wning fondleslabs and iPhones.

Apple’s diagram of iOS security measures

The guide appears to have landed on Apple.com a couple of weeks ago without fanfare or PR flim-flammery, and opens with the proclamation that “Apple designed the iOS platform with security at its core.”

While we suspect the opposite can only be said for IE6, the guide offers more than chest-puffing. Four sections, one dedicated to architecture, encryption, network security and device access, offer decently comprehensive descriptions of Apple’s security approaches without giving away any crown jewels.

A few features that have until now been of little interests beyond the jailbreaking community – such as the Device Firmware Upgrade (DFU) mode – get a formal airing. There’s also a lengthy explanation of classes in iOS.

The presence of utterly anodyne passages – there’s a basic password primer Reg readers will have memorised in the cradle – and a glossary hint that impressing suits is at least as important as tickling techies down Cupertino way. It’s also worth noting that the document is not at all boastful – the conclusion says iOS offers “solid protection against viruses, malware, and other exploits that compromise the security of other platforms.” That’s our emphasis there, because it’s a long way from the usual hyperbole about security and therefore a little refreshing. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/06/04/ios_security_guide/

Hacktivist group SwaggSec is claiming the scalps of China Telecom and Warner Brothers after apparently taking advantage of poor security to infiltrate their networks and steal a sizeable booty of sensitive data.

The group, which broke onto the hacking scene in February after hitting electronics giant Foxconn, announced the news on Pastebin and provided a link to the data dump on The Pirate Bay.

SwaggSec said that hacking the Chinese teleco, which it did via a dodgy SQL server, “was as simple as we assumed it would be”, and claimed to have exposed poor security practices in harvesting the log-in data of over 900 admins:

China Telecom’s SQL server had an extremely low processing capacity, and with us being impatient, after about a month straight of downloading, we stopped. However, a few times we accidentally DDoS’d their SQL server. I guess they thought nothing of it, until we left them a little message signed by SwaggSec. They realised they were hacked, and simply moved their SQL server.

No changing of admin passwords, or alerting the media. At any moment, we could have and still could destroy their communication infrastructure leaving millions without communication.

China Telecom did not immediately respond to a request for comment.

SwaggSec said Warner Brothers’ security preparedness was no better, claiming it found confidential IT data about critical internal vulnerabilities after hacking the company’s intranet. Such data could be exploited in the future to hack Warner Bros sites.

The motivation for the attacks is unclear, although SwaggSec did reference “Chinese up in our shit, screwin’ with the Pentagon”. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/06/05/swaggsec_china_telecom_hack/

Google’s Bouncer malware detection system might not be as strong as the Chocolate Factory hopes, with a pair of security researchers demonstrating flaws in the system.

Duo Security’s Jon Oberheide and Charlie Miller, preparing a presentation for this week’s SummerCon in Brooklyn, have demonstrated that it’s possible to slip a malicious app past Bouncer’s protection and into the Android market.

The demonstration in video below shows Oberheide accessing the remote shell to, as he puts it, “look for interesting attributes of the Bouncer environment such as the version of the kernel it’s running, the contents of the filesystem, or information about some of the devices emulated by the Bouncer environment.”

Watch Video

The point, Oberheide says, is that by fingerprinting the Bouncer environment, it’s also possible to identify the characteristics that Bouncer is looking for to identify malicious apps – and to avoid triggering its alarms. He told Threatpost that malware authors are likely to create a library to help bypass Bouncer.

While it would always be safe to assume that Google tests submitted apps on a virtualized phone, Oberheid says by poking around in the virtualized environment, malware authors would be able to work out how to make an app play nice while being tested, and only activate an attack once it’s running on a real phone.

Oberheid’s test showed QEMU as the virtualization environment Google is using.

At the time of their test – since we can probably assume that Google is already revising the test architecture – the researchers have told Forbes the Bouncer test phone is registered to a single user account ([email protected]) and stores two pics (cat.jpg and ladygaga.jpg) as bait for malicious apps to try and steal. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/06/04/breaking_google_bouncer/

HP reckons it can claim the dedupe speed king crown, ingesting at 100TB/hour and spitting it our at 40TB/hour, faster by far than the dedupe dominator, Data Domain.

The enhanced dedupe performance was announced at the HP Discover event in Las Vegas on Monday. HP gets to such giddy heights by combining its StoreOnce Catalyst software with its high-end disk-to-disk B6200 backup array, announced in Vienna in November 2011.

HP says it “offers the industry’s highest-performing backup-and-restore throughput when combined with the enhanced HP StoreOnce B6200 Backup. Clients can recover in a single day what would take a full workweek with the competition.”

The B6200 is a virtual tape library or straight backup to disk target, with from 48TB to 768TB of raw capacity, 32TB to 512TB usable. It features 2TB SAS disk drives and has a scale-out cluster architecture supporting up to eight nodes and carries both Ethernet and Fibre Channel host connectivity.

HP claims it “delivers the industry’s only large-scale deduplication appliance with fully automated high-availability features.” It has an autonomic restart feature to ensure backup jobs complete if there is a major hardware failure; a reassuring capability.

EMC recently announced is biggest and fastest deduping array, the DD990 holding up to 65PB of logical data and deduping at up to 31TB/hour, with Boost, 15TB/hour un-Boosteds comfortably eclipsing the previous high-end system, the DD 890, which deduped at 14TB/hour.

HP has sold Sepaton’s S2100 ES2 big deduping array to customers with the most demanding dedupe needs, and the ES2 is a clusterable system with up to eight nodes and a 43.2TB/hour ingest rate.

Now, with the Catalyst-accelerated B6200 HP overtakes that, ingesting data more than twice as fast. We understand Sepaton might have an announcement of its own soon, but unless it dedupes significantly faster than 100TB/hour it looks as if its HP selling relationship is effectively over. What need is there for an 8-node Sepaton system when an 8-node Store Once system goes faster?

Boost involves the backup data sending system, the Backup Exec media server for example, doing some of the dedupe work and sending less data to the Data Domain box.

What does Catalyst do? It “allows clients to deduplicate data on application servers or backup servers before it is transferred to a centralised HP StoreOnce Backup system.” Its effectively Boost.

Customers can use Data Protector 7 Software, Symantec’s NetBackup or Backup Exec to manage deduplication and data movement in a Catalyst environment. Independent software vendors (ISVs) can achieve the same level of control with a StoreOnce Catalyst software development kit.

Data Protector 7

HP has also revved its Data Protector software with an injection of Autonomy’s IDOL (Intelligent Data Operating Layer). The claim is that users can “precisely protect, find and recover information based on the meaning and concepts contained within the data.”

Put another way it has “governance tools that enable contextual backup and recovery of information.” HP says it is the industry’s first universal information-protection product for enterprises, as opposed to data protection.

It claims users can retrieve all information relevant to a particular idea or topic, regardless of keywords or other search parameters. ”All information” is a big, a huge claim. HP is saying that you can use IDOL to selectively backup and retrieve data based on information meaning, if you wish, and that this goes beyond a process driven by key words.

This is, El Reg thinks, unique and a first. How useful will it be? Will it enable customers to find things in their backup data that they couldn’t have found before, or found much more slowly? Understanding that will require trial use we would think.

The Data Protector 7 product also “combines cloud-based backup to the world’s largest private cloud with on-premise physical and virtual information protection.”^* You can stick the backed-up data in a private cloud and not on a B6200 Backup array. Whether public cloud storage backends will be supported is a moot point.

HP has certainly seized the dedupe speed record and, with the IDOL software, has technology that EMC and other backup vendors have not. That’ll please its sales reps who will probably be very keen to let customers try this out as they work to repel the pirate EMC Data Domain boarders from HP accounts.

Data Protector 7 Software is available now directly from HP or its channel partners. The loud-based backup option is offered via a separate monthly subscription. StoreOnce Catalyst software is available immediately with a starting US list price of $37,500. It’s integrated with HP Data Protector 7 and Symantec’s NetBackup, with Backup Exec integration coming in August. ®

* The world’s largest private cloud? Could that be HP”s own cloud?

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/06/04/hp_boosted_dedupe/

Security researchers have discovered a tiny, but highly capable banking Trojan.

Tinba (Tiny Banker, or otherwise known as Zusy) hooks itself into browsers before stealing banking login information and snaffling network traffic.

The malware used injected code and Man in The Browser (MiTB) tricks to change the way banking websites are presented to victims on compromised machines.

The technique is designed to thwart added security protections, most specifically two-factor authentication technologies, that have come into deployment by some banks. ZeuS, the well-established banking Trojan, uses much the same trickery to achieve the same nefarious ends.

Weighing in at just 20KB, Tinba represents a new family of banking Trojan. Antivirus detection of the analyzed samples is low, according to researchers at CSIS Security, a Danish firm.

Tinba uses a RC4 encryption scheme when communication with its Command Control (CC) servers, located at four hardcoded domains. “Tinba proves that malware with data stealing capabilities does not have to be 20MB of size,” Peter Kruse, a researcher with CSIS, told El Reg.

His comments reference the avalanche of publicity that has accompanied the discovery of the Flame cyber-espionage toolkit, a portly 20MB chiefly notable for affecting systems in Iran and the ability to turn its worm like propagation routines on and off for added stealth.

CSIS has a detailed write-up of Tinba here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/06/04/small_banking_trojan/

Microsoft has noticed Flame, the malware supposedly burning up the middle east and spreading like wildfire to the rest of the world, and has taken steps to stop it before becoming an uncontrollable conflagration.

Redmond’s chief concern, according to Mike Reavey, a senior director of the Microsoft Trustworthy Computing effort, is that Flame pretends it’s a legitimate piece of Redmond-written code. He uses this blog post to describe how Flame pulls that off:

“We have discovered through our analysis that some components of the malware have been signed by certificates that allow software to appear as if it was produced by Microsoft. We identified that an older cryptography algorithm could be exploited and then be used to sign code as if it originated from Microsoft. Specifically, our Terminal Server Licensing Service, which allowed customers to authorize Remote Desktop services in their enterprise, used that older algorithm and provided certificates with the ability to sign code, thus permitting code to be signed as if it came from Microsoft.”

The company also feels the unsigned certificates could be used to “spoof content, perform phishing attacks, or perform man-in-the-middle attacks” on all versions of Windows.

That outcome, and the idea that Microsoft is behind Flame, are obviously not things Redmond wishes to spread widely, so it has tweaked the Terminal Server Licensing Service so it “no longer issues certificates that allow code to be signed.”

There’s also a new security advisory, lucky number 2718704, that starves Flame of oxygen before it can seriously singe your Windows setup. In what may well be the non-surprise of the year, Redmond suggests you apply the patch ASAP, lest you go up in smoke. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/06/04/microsoft_douses_flame/

Apple has published a guide to iOS security, detailing in one place the various safeguards that stop perps p0wning fondleslabs and iPhones.

Apple’s diagram of iOS security measures

The guide appears to have landed on Apple.com a couple of weeks ago without fanfare or PR flim-flammery, and opens with the proclamation that “Apple designed the iOS platform with security at its core.”

While we suspect the opposite can only be said for IE6, the guide offers more than chest-puffing. Four sections, one dedicated to architecture, encryption, network security and device access, offer decently comprehensive descriptions of Apple’s security approaches without giving away any crown jewels.

A few features that have until now been of little interests beyond the jailbreaking community – such as the Device Firmware Upgrade (DFU) mode – get a formal airing. There’s also a lengthy explanation of classes in iOS.

The presence of utterly anodyne passages – there’s a basic password primer Reg readers will have memorised in the cradle – and a glossary hint that impressing suits is at least as important as tickling techies down Cupertino way. It’s also worth noting that the document is not at all boastful – the conclusion says iOS offers “solid protection against viruses, malware, and other exploits that compromise the security of other platform.” That’s our emphasis there, because it’s a long way from the usual hyperbole about security and therefore a little refreshing. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/06/04/ios_security_guide/

A Chinese diplomat with links to the People’s Liberation Army has been accused of snooping on Japanese military technology data while working in Tokyo.

Police in the Japanese capital are preparing to send documents to district prosecutors which allege that 45-year-old Li Chunguang submitted false papers when renewing his alien registration card in 2008, and broke international diplomatic laws by engaging in business activities whilst working as first secretary at the Chinese Embassy.

Li is suspected to have snooped on confidential documents belonging to the Agriculture, Forestry and Fisheries ministry and also met several defence contractors whilst failing to mention his Chinese military background, the Yomiuri Shimbun reported.

There was no further information on exactly what kind of military tech was involved , although it was described as “state-of-the-art” by the ‘paper.

Unsurprisingly, the China government denied all the allegations against Li and neatly side-stepped the question of his involvement in the PLA. Foreign ministry spokesperson Liu Weimin responded with the following:

Li Chunguang is a scholar who has long been engaged in Japan studies. He was later seconded from the Chinese Academy of Social Sciences to the economic section of the Chinese Embassy in Japan. He has returned to China after the end of his term. The so-called press report of Li Chunguang engaging in espionage activities is totally groundless. With regard to other aspects of the information, competent Chinese authorities will verify them.

China often takes advantage of the diplomatic privileges afforded to embassy staff in order to engage in espionage away from the scrutiny of counter-intelligence agencies, the Yomiuri claimed.

Its other key method of pilfering top secret data from its rivals is of course cyber espionage.

In September 2011, defence contractor Mitsubishi Heavy Industries, which makes fighter jets and other kit for the Japan Self Defence Force, was hit by a large scale advanced attack using software containing simplified Chinese.

The Pentagon has stepped up its criticism of such activities recently as more damming evidence comes to light.

A report last month, for example, claimed that “Chinese actors are the world’s most active and persistent perpetrators of economic espionage”.

Not that the US can be entirely blameless in the cyber espionage stakes and risks an escalation in attacks against it, after more evidence emerged that Stuxnet was authorised from the very top during the Bush administration and then continued by president Obama. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/06/04/china_spy_japan_military_tech/