security – Page 3181 – STE WILLIAMS

Firefox burns Chrome in our trustworthy browser poll

library
crime | hacking | security

About a month ago I asked Naked Security readers Which web browser do you trust? Your answer was emphatic: it’s Firefox.

I asked this question because trustworthiness has become an important selection criteria for web browsers and there is no objective test for it.

Modern web browsers are mature and complex products and, despite inflated version numbers and conspicuously busy release cycles, their feature sets evolve quite slowly.

Selecting the right web browser is no longer a question of what the software can do, it’s about whether or not it can do the things we expect it to do quickly, securely and with due regard for our privacy.

Our poll offered readers the chance to vote for one of the six most popular web browsers – Chrome, Firefox, Internet Explorer, Opera, Safari and Chromium – and asked which you trusted the most.

Mozilla’s Firefox, the linear descendant of both Netscape Navigator and the original ‘graphical web browser’ the NCSA Mosaic, was a runaway winner.

Firefox accrued almost double the number of votes of its nearest rival, Google Chrome, and more than six times the votes awarded to perennial rival and fellow ‘browser wars’ veteran Internet Explorer.

The results are even more emphatic when you consider how many people actually use each browser.

Below is a table that compares the number of votes each browser received in the poll against the number of unique article pageviews from each of those browsers over the same period.

Results are ranked in order of conversion rate – the rate at which page views by a given browser correlate with votes for that browser (Chrome and Chromium identify themselves in the same way and we can’t separate their unique page views so their results are combined in this table).

Top of the table is Opera which was the only browser that scored more votes for trustworthiness than it had users, although it did so with much smaller totals than its competitors.

You could probably sum up the entire history of the Opera browser with the phrase “small but loyal following” and despite the regard in which its users hold it Opera seems destined to remain the perennial bridesmaid of the browser world.

The poor showing of Internet Explorer is notable but perhaps not surprising given that it is often imposed on users as a matter of corporate policy.

What stands out at me is the difference between the Mozilla and Google products. Both browsers are well established and well known open source projects, they both run on Windows, Mac and Linux and unlike Explorer or Safari neither come bundled with an operating system.

Perhaps Chrome users are more cynical or more realistic about where they place their trust. Or perhaps people who choose Chrome are also people who don’t vote in internet polls.

We don’t know but I suspect, as the comments on our poll seem to suggest, that the reason for Chrome’s poor showing is that Google’s claim to Do No Evil is simply no longer convincing.

The untrustworthiness of Google is a consistent theme across the most highly rated comments on the poll:

frankly I trust Google the least, as they have too many data points for comparison.

I don’t trust Google as far as I could throw ’em. As a company, it’s entirely uninterested in my security or privacy, especially if it can make money by selling my personal information.

Trusting any software completely is a bit foolish, but anyone who actively trusts Chrome is a good subject for psychological study.

You get the idea.

Of course this is only an online poll and and not a scientific experiment so my conclusions should be taken with a liberal pinch of salt.

Let me know what you think in our comments below.

Follow @NakedSecurity
Follow @MarkStockley

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/sOZNmpeQ9a4/

Monday review

library
crime | hacking | security

Get yourself up to date with everything we’ve written in the last seven days – it’s weekly roundup time. Watch the top news in 60 seconds, and then check out the individual links to read in more detail.

Monday 16 September

Tuesday 17 September

Wednesday 18 September

Thursday 19 September

Friday 20 September

Saturday 21 September

Sunday 22 September

Would you like to keep up with all the stories we write? Why not sign up for our daily newsletter to make sure you don’t miss anything. You can easily unsubscribe if you decide you no longer want it.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/r2KTfD1t8z8/

‘Occupy’ affiliate claims Intel bakes SECRET 3G radio into vPro CPUs

library
crime | hacking | security

Free ESG report : Seamless data management with Avere FXT

Intel has apparently turned up one of the holiest of holy grails in the tech sector, accidentally creating an zero-power-consumption on-chip 3G communications platform as an NSA backdoor.

The scoop comes courtesy of tinfoil socialist site Popular Resistance, in this piece written by freelance truther Jim Stone, who has just discovered the wake-on-LAN capabilities in vPro processors. He writes:

“The new Intel Core vPro processors contain a new remote access feature which allows 100 percent remote access to a PC 100 percent of the time, even if the computer is turned off. Core vPro processors contain a second physical processor embedded within the main processor which has it’s own operating system embedded on the chip itself. As long as the power supply is available and and in working condition, it can be woken up by the Core vPro processor, which runs on the system’s phantom power and is able to quietly turn individual hardware components on and access anything on them.”

A little background: Popular Resistance was formed in 2011 and was part of the ‘Occupy’ movement, having done its bit in Washington DC. It now promotes an anti-capitalist agenda.

Back to Stone, who says Intel can do all the stuff vPro enables thanks to an undocumented 3G radio buried on its chips apparently extends wake-on-LAN to wake-on-mobile:

“Core vPro processors work in conjunction with Intel’s new Anti Theft 3.0, which put 3g connectivity into every Intel CPU after the Sandy Bridge version of the I3/5/7 processors. Users do not get to know about that 3g connection, but it IS there,” he writes, “anti theft 3.0 always has that 3G connection on also, even if the computer is turned off” (emphasis added).

No evidence is offered for the assertions detailed above.

And with that, El Reg will now happily open the floor to the commentards … ®

Free ESG report : Seamless data management with Avere FXT

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/23/intel_stuns_world_with_wakeon3g/

DeputyDog attack targets latest IE zero day

library
crime | hacking | security

Free ESG report : Seamless data management with Avere FXT

Security researchers have spotted two new targeted attack campaigns aimed at organisations in Japan, China and elsewhere in Asia, one of which exploits a zero day exploit in Internet Explorer revealed only last week.

Operation DeputyDog is targeted at “entities in Japan”, using the IE vulnerability CVE-2013-3893 which Microsoft released an emergency patch for last Tuesday, according to security firm FireEye.

The payload for the attack, first detected by FireEye at the end of August, was hosted on a server in Hong Kong disguised as a .jpg file. The malware was then observed connecting to a host in South Korea.

FireEye also claimed the group responsible for DeputyDog is the same one that compromised security firm Bit9 back in February 2013, thanks to a connection with the IP address 180.150.228.102.

It explained in more detail as follows:

According to Bit9, the attackers that penetrated their network dropped two variants of the HiKit rootkit. One of these Hitkit samples connected to a command and control server at downloadmp3server[.]servemp3[.]com that resolved to 66.153.86.14. This same IP address also hosted www[.]yahooeast[.]net, a known malicious domain, between March 6, 2012 and April 22, 2012.

The domain yahooeast[.]net was registered to [email protected]. This email address was also used to register blankchair[.]com – the domain that we see was pointed to the 180.150.228.102 IP, which is the callback associated with sample 58dc05118ef8b11dcb5f5c596ab772fd, and has been already correlated back to the attack leveraging the CVE-2013-3893 zero-day vulnerability.

Researchers at Symantec last week claimed that the Bit9 attacks could have been carried out by a sophisticated Chinese hacking group, Hidden Lynx, which is also implicated in the infamous Operation Aurora raid on Google and over 30 other technology firms back in 2009.

Meanwhile, threat analysts over at Trend Micro highlighted a new malware family being used in targeted attacks against mainly government organisations in Asia.

EvilGrab is so-named because it has been designed to grab audio and video files, take screenshots and log keystrokes from infected machines before uploading them to a remote server.

The malware has been spotted targeting mainly Chinese (36 per cent) and Japanese (16 per cent) organisations, with 89 per cent of victims hailing from the government sector.

Interestingly, EvilGrab has also been specially crafted to steal info from popular Chinese instant messaging app Tencent QQ, according to Trend Micro.

The discovery is part of the security vendor’s first quarterly report on targeted attacks. ®

Free ESG report : Seamless data management with Avere FXT

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/23/apt_deputydog_evilgrab_target_asian_firms/

Chaos Computer Club claims to have “cracked” the iPhone 5s fingerprint sensor

library
crime | hacking | security

The biometrics team of Germany’s well-known Chaos Computer Club (CCC) claims it has “cracked” Apple’s Touch ID system.

Touch ID is the fingerprint sensor and the associated software that provides a biometric lock for the brand new iPhone 5s.

Fingerprint readers have been common add-ons to laptops for many years, but never really caught on.

Here’s why.

Firstly, fingerprints aren’t secret.

All of us inadvertently leave good-quality prints on many surfaces, such as glass, metal and hard plastics.

Additionally (in many countries in the post-9/11 world) many of us deliberately, often unavoidably, have allowed the authorities, our employers and even businesses such as banks to take high-quality copies of our prints, and to keep them pretty much for ever.

Secondly, you can’t change fingerprints if there’s a breach, like you can an ephemeral password.

Thirdly, fingerprint sensor technology has been found wanting in the past, with glue, gelatin and even photocopies with a very thick layer of toner being used as copies that would pass muster as a real finger.

Fourthly, when you’re logging into your laptop, being able to use your fingerprint doesn’t add an awful lot of convenience.

You’ve already got a perfectly servicable keyboard in front of you when you open up your laptop, on which you are probably going to type your username anyway, so why not just stick with what you know: a typed-in password?

Fifthly, there’s something unappealing to many people about using biometric data such as fingerprints, DNA or retina scans for anything but the most serious matters of identification.

Biometric objections typically lie somewhere between the visceral and the spiritual, which makes them hard to quantify.

But it is perfectly understandable (laudable, even) to be uneasy about using “something you are” as a way of identifying yourself, especially if it’s merely to use a piece of computer hardware you already own outright.

Nevertheless, despite these objections, Apple’s Touch ID is supposed to be – may yet still be! – the biometric implementation that will change all this.

It’s built in to the new iPhone 5s, right in the button you press to start everything up anyway; it seems to work reliably, so it doesn’t lock you out all the time; and it doesn’t store digital copies of your fingerprints centrally where they might leak to the world in a data breach.

Better yet, it means you don’t need to type in a complicated password on the iPhone’s fiddly on-screen keyboard.

Best of all, it works conveniently even for people who would rather do without a regular passcode altogether, so for many users, it might succeed entirely on the basis that “something’s better than nothing.”

As Apple itself very proudly points out on its website:

You check your iPhone dozens and dozens of times a day, probably more. Entering a passcode each time just slows you down. But you do it because making sure no one else has access to your iPhone is important. With iPhone 5s, getting into your phone is faster, easier, and even a little futuristic. Introducing Touch ID — a new fingerprint identity sensor.

Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password.

The only fly in the ointment now is that it looks as though Touch ID isn’t “highly secure,” after all.

It’s perhaps not as futuristic as Apple thought, either: the CCC hackers say that they used a technique documented in CCC materials back in 2004.

Greatly simplified, the fingerprint cloning process works like this:

Take a hi-res (2400dpi) photograph of the fingerprint.
Digitally invert the image so that the valleys of the print are black.
Laser print (1200dpi) the image with a very thick toner setting.
Smear white woodglue (or latex) over the printout and allow to set.
Carefully peel off the glue or latex sheet.
Breathe on the surface so it’s slightly moist and conductive.
Unlock phone.

So last decade!

The really intriguing aspect of the claim is that the CCC guys didn’t start with a photograph taken directly from a finger, which would typically require some sort of co-operation (or heavy inebriation) on the part of the victim.

They say that they used:

…the fingerprint of the phone user, photographed from a glass surface.

The next question is, will they, can they, claim the crowdsourced prizes on offer for doing what they say they did?

And the final question: should you use Touch ID?

I’m the wrong person to ask, because I’d probably say, “No!” on the basis of point 5 alone – a visceral sense that I’d simply rather not do so, especially since I know how to type perfectly well.

My advice, then, is to consider points 1, 2 and 3 above.

If you’re happy in the face of those objections, and you aren’t fussed by point 5, then…

…hey, it’s better than no passcode at all!

Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/kPZenY6Vgx4/

iPhone 5 TouchID broken by Chaos Computer Club

library
crime | hacking | security

Supercharge your infrastructure

Well, that lasted a long time: the Chaos Computer Club has already broken Apple’s TouchID fingerprint lock, and warns owners against using biometric ID to protect their data.

As the group explains here, it seems that the main advance in Cupertino’s biometrics was that it uses a high resolution fingerprint scan. The post states:

A lot of bogus speculation about the marvels of the new technology and how hard to defeat it supposedly is had dominated the international technology press for days.

“In reality, Apple’s sensor has just a higher resolution compared to the sensors so far. So we only needed to ramp up the resolution of our fake”, said the hacker with the nickname Starbug, who performed the critical experiments that led to the successful circumvention of the fingerprint locking.

All the CCC needed to defeat the scanner was an image of a user’s fingerprint at 2,400 dpi resolution. That scan was “cleaned up”, inverted, and printed into a transparent sheet. The image of the print is then lifted from the sheet using latex milk or woodglue.

“After it cures, the thin latex sheet is lifted from the sheet, breathed on to make it a tiny bit moist and then placed onto the sensor to unlock the phone,” the post states, adding that this technique can be used against “the vast majority” of fingerprint scanners.

At the time of writing, the CCC hadn’t announced whether it will claim any of the prizes on offer for a successful attack.

The video below demonstrates the attack. ®

Watch Video

Supercharge your infrastructure

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/22/iphone_5_touchid_broken_by_chaos_computer_club/

Another iOS 7 lockscreen hole opens up – call anywhere in the world for free!

library
crime | hacking | security

Another iOS 7 lockscreen bypass has surfaced.

This one lets you make calls anywhere in the world for free.

OK, not really “for free.”

You may not have to pay, but someone does, and that person is the owner, who probably assumed that the “lock” on the phone actually did – how can I put this without sounding tautological? – lock the phone part of the phone.

A keen iOS 7 early adopter from Ramallah in the West Bank, Karam Daoud, now apparently a business development guy but who worked in bug testing in the mobile space in a previous life, found the flaw.

By all accounts, it is reliably exploitable.

Unlike the first widely-publicised lockscreen bypass, there isn’t an easy workaround for this one.

The previous one was the “all your photos are belong to a social network whether you wanted it or not” flaw we wrote about last week.

That one can be worked around by removing access to Control Center from the lockscreen.

The new flaw involves telling the lockscreen you want to make an emergency call, which is a option that, understandably, can’t be turned off. (You can even make emergency calls without a SIM card, let alone with the phone locked – and that really is a feature, not a bug.)

Then you simply dial the number you want – the emergency call interface apparently doesn’t limit what you can dial, merely where you can connect after doing so.

Instead of just pressing [Call], however, you apply bug-finder’s dexterity and press [Call] repeatedly and rapidly.

It seems that if you are insistent enough, and get the cadence of your clicks just right, iOS gives in and connects you to the number anyway.

→ An earlier iOS lockscreen hole involved actally placing emergency calls and then hanging up, hopefully before they went through. We strongly urged you not to try that exploit, even on your own device, as we considered it a rotten, and very likely illegal, thing to do. Here, you use the emergency call screen merely to get the option to dial, but no emergency call is made.

In other news, there’s already been an iOS 7 update, taking superearly adopters to 7.0.1.

But that update doesn’t appear to be a response to either of lockscreen bugs.

Instead, reports Ars Technica, it’s a fix for the fact that:

…the fingerprint scanner’s ability to enable iTunes purchases didn’t quite work correctly — the iPhone 5S would prompt for a password instead of simply accepting the fingerprint.

So, there’s a bug fix to improve your ability to spend money easily in Apple’s cloud.

Let’s hope there’s another bug fix really quickly that removes the ability for other people to spend your money easily on the mobile network, and to share your private photos with the world.

In the meantime:

Consider removing the Control Center from the lockscreen to prevent the “photo sharing” lockscreen hole. (See image above.)
Be wary whom you hand your new iPhone to “so they can have a look-see.”
If your phone gets lost or stolen, use a mobile control application or contact your service provider to have it locked out of the network as soon as you can.
Consider sticking with iOS 6.1.3 for the time being, since iOS 7 is much more about new features that security fixes.

Of course, sticking with iOS 6.1.3 leave you open to the “six characters to crash” bug and the “juicejacking” hole that lets a dodgy charger infect your iDevice with malware.

But the first of those bugs doesn’t seem to be exploitable for remote code execution; and the second is easily avoided simply by charging your device yourself from a known-good charger or PC.

Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/rsloKACWaNg/

Chaos Computer Club claims to have “cracked” the iPhone 5s fingerprint sensor

library
crime | hacking | security

The biometrics team of Germany’s well-known Chaos Computer Club (CCC) claims it has “cracked” Apple’s Touch ID system.

Touch ID is the fingerprint sensor and the associated software that provides a biometric lock for the brand new iPhone 5s.

Fingerprint readers have been common add-ons to laptops for many years, but never really caught on.

Here’s why.

Firstly, fingerprints aren’t secret.

All of us inadvertently leave good-quality prints on many surfaces, such as glass, metal and hard plastics.

Secondly, you can’t change fingerprints if there’s a breach, like you can an ephemeral password.

Fourthly, when you’re logging into your laptop, being able to use your fingerprint doesn’t add an awful lot of convenience.

Fifthly, there’s something unappealing to many people about using biometric data such as fingerprints, DNA or retina scans for anything but the most serious matters of identification.

Biometric objections typically lie somewhere between the visceral and the spiritual, which makes them hard to quantify.

Nevertheless, despite these objections, Apple’s Touch ID is supposed to be – may yet still be! – the biometric implementation that will change all this.

Better yet, it means you don’t need to type in a complicated password on the iPhone’s fiddly on-screen keyboard.

As Apple itself very proudly points out on its website:

You check your iPhone dozens and dozens of times a day, probably more. Entering a passcode each time just slows you down. But you do it because making sure no one else has access to your iPhone is important. With iPhone 5s, getting into your phone is faster, easier, and even a little futuristic. Introducing Touch ID — a new fingerprint identity sensor.

Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password.

The only fly in the ointment now is that it looks as though Touch ID isn’t “highly secure,” after all.

It’s perhaps not as futuristic as Apple thought, either: the CCC hackers say that they used a technique documented in CCC materials back in 2004.

Greatly simplified, the fingerprint cloning process works like this:

Take a hi-res (2400dpi) photograph of the fingerprint.
Digitally invert the image so that the valleys of the print are black.
Laser print (1200dpi) the image with a very thick toner setting.
Smear white woodglue (or latex) over the printout and allow to set.
Carefully peel off the glue or latex sheet.
Breathe on the surface so it’s slightly moist and conductive.
Unlock phone.

So last decade!

They say that they used:

…the fingerprint of the phone user, photographed from a glass surface.

The next question is, will they, can they, claim the crowdsourced prizes on offer for doing what they say they did?

And the final question: should you use Touch ID?

My advice, then, is to consider points 1, 2 and 3 above.

If you’re happy in the face of those objections, and you aren’t fussed by point 5, then…

…hey, it’s better than no passcode at all!

Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/WzH8FdO-Ksk/

Flaw In iOS 7 Lets Attackers Take Control Of Users’ iPhones

library
crime | hacking | security

A security flaw in Apple’s iOS 7 operating system could enable unauthorized users to send messages or make social network postings on an iPhone owner’s behalf — even when the phone is locked, researchers reported Friday.

The vulnerability, which was disclosed Friday by researchers at application security vendor Cenzic, enables an attacker or prankster to use the SIRI personal voice assistant to crack a locked iPhone and execute tasks that would normally require user permission, such as sending email or posting to Facebook.

In a blog describing the iPhone flaw, the Cenzic researchers said they were able to use a locked iPhone belonging to a third party to send email and texts, make calls, access contact information and make updates to Facebook and Twitter, all with the user’s accounts and without the user’s knowledge.

“Imagine someone stealing your iPhone and — without knowing your passcode – sending messages, email, or social network postings to your friends and contacts, posing as you,” the blog says.

The researchers posted a YouTube videodemonstrating the ability to use SIRI on a third party’s locked iPhone to make an update on the third party’s Facebook page. They also reported the ability to collect and steal the personal information of contacts stored in the iPhone.

The flaw also works on some tasks under iOS 6, the researchers say. End users should take care not to let others use their iPhones, and may want to consider disabling SIRI until Apple fixes the problem, the blog states.

Have a comment on this story? Please click “Add a Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/privacy/flaw-in-ios-7-lets-attackers-take-contro/240161623

Another iOS 7 lockscreen hole opens up

library
crime | hacking | security

Another iOS 7 lockscreen bypass has surfaced.

This one lets you make calls anywhere in the world for free.

OK, not really “for free.”

A keen iOS 7 early adopter from Ramallah in the West Bank, Karam Daoud, now apparently a business development guy but who worked in bug testing in the mobile space in a previous life, found the flaw.

By all accounts, it is reliably exploitable.

Unlike the first widely-publicised lockscreen bypass, there isn’t an easy workaround for this one.

The previous one was the “all your photos are belong to a social network whether you wanted it or not” flaw we wrote about last week.

That one can be worked around by removing access to Control Center from the lockscreen.

Then you simply dial the number you want – the emergency call interface apparently doesn’t limit what you can dial, merely where you can connect after doing do.

Instead of just pressing [Call], however, you apply bug-finder’s dexterity and press [Call] repeatedly and rapidly.

It seems that if you are insistent enough, and get the cadence of your clicks just right, iOS gives in and connects you to the number anyway.

In other news, there’s already been an iOS 7 update, taking superearly adopters to 7.0.1.

But that update doesn’t appear to be a response to either of lockscreen bugs.

Instead, reports Ars Technica, it’s a fix for the fact that:

…the fingerprint scanner’s ability to enable iTunes purchases didn’t quite work correctly — the iPhone 5S would prompt for a password instead of simply accepting the fingerprint.

So, there’s a bug fix to improve your ability to spend money easily in Apple’s cloud.

Let’s hope there’s another bug fix really quickly that removes the ability for other people to spend your money easily on the mobile network, and to share your private photos with the world.

In the meantime:

Consider removing the Control Center from the lockscreen to prevent the “photo sharing” lockscreen hole. (See image above.)
Be wary whom you hand your new iPhone to “so they can have a look-see.”
If your phone gets lost or stolen, use a mobile control application or contact your service provider to have it locked out of the network as soon as you can.
Consider sticking with iOS 6.1.3 for the time being, since iOS 7 is much more about new features that security fixes.

Of course, sticking with iOS 6.1.3 leave you open to the “six characters to crash” bug and the “juicejacking” hole that lets a dodgy charger infect your iDevice with malware.

But the first of those bugs doesn’t seem to be exploitable for remote code execution; and the second is easily avoided simply by charging your device yourself from a known-good charger or PC.

Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/KOzT0PPbqy8/