STE WILLIAMS

Last week, T-Mobile scrambled to patch a vulnerability uncovered by two University of California Berkeley students that made its Wi-Fi calling feature susceptible to man-in-the-middle attacks.

At issue in the students’ research, published in full here (PDF), is the certificate implementation used in the feature. The now-patched bug in its Android feature used a certificate chain in which one certificate’s name was the IP address of the server, and the second self-signed root certificate “is not included in standard Certificate Authority (CA) distributions”.

“This can mean that the root certificate was either built-in to T-Mobile’s client software, or they did not implement certificate validation correctly. In fact, the client does not seem to have any problems with sslsniff intercepting the connection, making us conclude the latter,” the students, Jethro Beekman and Christopher Thompson, write.

With a man-in-the-middle attack initiated, the researchers write, an attacker can capture the SIP message that provides the encryption key to be used for the calling session – allowing them to record all incoming and outgoing calls or SMS messages using the Wi-Fi calling feature.

“We verified the ability to record outgoing calls and incoming and outgoing text messages. We also verified the ability to change the destination phone number on outgoing calls by modifying sslsniff to change all occurrences of sip: dest-phone#@msg.pc.t-mobile.com, replacing a single target phone number by a different one,” they continue.

The only vulnerable phones were those using the T-Mobile IMS stack, covering a number of Samsung and HTC phones. According to the researchers, T-Mobile claimed to have pushed an update to all affected users by 18 March. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/24/t_mobile_wi_fi_calling_bug/

Last week, T-Mobile scrambled to patch a vulnerability uncovered by two University of California Berkeley students that made its Wi-Fi calling feature susceptible to man-in-the-middle attacks.

At issue in the students’ research, published in full here (PDF), is the certificate implementation used in the feature. The now-patched bug in its Android feature used a certificate chain in which one certificate’s name was the IP address of the server, and the second self-signed root certificate “is not included in standard Certificate Authority (CA) distributions”.

“This can mean that the root certificate was either built-in to T-Mobile’s client software, or they did not implement certificate validation correctly. In fact, the client does not seem to have any problems with sslsniff intercepting the connection, making us conclude the latter,” the students, Jethro Beekman and Christopher Thompson, write.

With a man-in-the-middle attack initiated, the researchers write, an attacker can capture the SIP message that provides the encryption key to be used for the calling session – allowing them to record all incoming and outgoing calls or SMS messages using the Wi-Fi calling feature.

“We verified the ability to record outgoing calls and incoming and outgoing text messages. We also verified the ability to change the destination phone number on outgoing calls by modifying sslsniff to change all occurrences of sip: dest-phone#@msg.pc.t-mobile.com, replacing a single target phone number by a different one,” they continue.

The only vulnerable phones were those using the T-Mobile IMS stack, covering a number of Samsung and HTC phones. According to the researchers, T-Mobile claimed to have pushed an update to all affected users by 18 March. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/24/t_mobile_wi_fi_calling_bug/

Don’t get too hammered this Friday night in case you wake up to find you’ve forgotten your Apple password, as Cupertino has been forced to pull down its iForget service due to an embarrassing new security flaw.

This was supposed to be a good week for Apple on the security front. On Tuesday the company fixed a password-bypass flaw in iOS with its latest 6.1.3 update, and Apple finished the week with the introduction of two-factor authentication for its users on Friday.

But then came a tip to The Verge of a flaw in the iForget password retrieval system. With just the email address and date of birth of an Apple user, you could get a password reset request granted using a modified URL in the date-of-birth box on the iForgot security web page. Done correctly, this would allow an attacker full access to iTunes and iCloud accounts.

Step-by-step instructions detailing how to carry out the low-skill hack were found online, and Apple moved quickly to pull down the iForget system by 1pm PT (10pm UTC) Friday. It is working to fix the fatal flaw, but until it does, don’t forget your password.

“Apple takes customer privacy very seriously. We are aware of this issue, and working on a fix,” said the company in a statement.

When news of the bug broke, some of the more – ahem – excitable members of the anti-Apple movement pointed out that the only way to get around the flaw was to use Cupertino’s new two-factor security system, and wasn’t that convenient timing. Apple’s prompt iForget pull-down rather negates that argument but it won’t stop those fond of tin-foil headwear from speculating. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/23/apple_iforget_password_flaw/

Apple is now offering two-factor authentication to Apple ID users.

The move, which follows similar moves by Google, will make it far harder for hackers to steal Apple ID login credentials. These credentials are important because they are used in conjunction with iCloud to store content, and in downloading apps from the App Store as well as buying songs, movies, and TV shows from the iTunes Store.

The damage that can result if a hacker gets hold of an Apple ID was graphically highlighted last year after journalist Mat Honan famously had his digital life blitzed by grievers who tricked Apple support staff into resetting Honan’s Apple ID password. The cracker involved applied a remote wipe to Honan’s computers and smartphones, blitzing the data on his iPhone, iPad, and Macbook Air in the process. The miscreant also thrashed Honan’s online storage on iCloud, and for good measure also took over his Gmail account and various Twitter accounts.

At the time of the hack, Apple IDs were protected by additional “security questions” that applicants were challenged to answer if they wanted to reset login credentials. This modest insurance was better than nothing but proved to be inadequate, so Apple has taken the leap to introducing two-factor authentication – at least to some of its users.

Mac users in the US, UK, Australia, Ireland, and New Zealand can apply “two-step verification” to their account by associating it with a mobile number. A one-time passcode will be sent to this number via an SMS message, and users will be required to enter this code in addition to their regular password before been allowed to log into their accounts.

However, as Paul Ducklin, Sophos’s head of technology for Asia Pacific, notes, there’s “nothing to stop you getting Apple to send your SMS verification codes to the same device on which you actually use your Apple ID.” Because of this, the scheme is not quite as strong the “something you know, and something you have” approach of traditional two-factor authentication – but it’s a hell of a lot better than what was in place before.

Apple has also cut its own support staff entirely out of the password reset loop for anyone who enables two-step verification.

With two-step verification turned on, only you can reset your password, manage your trusted devices, or create a new recovery key.

Apple Support can help you with other aspects of your service, but they will not be able to update or recover these three things on your behalf.

Ducklin applauded the move as helping to minimise the possibility of social-engineering attacks.

“If Apple’s staff cannot recover or reset your password, then even the Mitnickest social engineer in the world won’t be able to talk them round,” he writes in a blog post, adding “take Apple’s advice, write down the 14-character emergency recovery key created when you enable two-step verification, and lock it away somewhere at home”.

Users should avoid the temptation to store the Recovery Key on their device or computer since that would give evildoers access to it and defeat the whole point of two-step verification, as Apple points out.

Apple’s FAQ about two-step verification for Apple IDs can be found here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/22/apple_id_lock/

The IT boss for the city of Hoboken, New Jersey – one of New York’s closest and most underrated neighbors – is facing 15 years in the Big House after pleading guilty to harvesting the emails of the mayor and her staff to inform their political rivals.

In 2009, Peter J. Cammarano III was elected major of Hoboken, beating his opponent Dawn Zimmer by just 161 votes. Just 22 days after being sworn in he was arrested by the FBI for extorting $25,000 in bribes (which later netted him a year in prison), and Zimmer was appointed to the role. This didn’t sit well with Zimmer’s opponents in City Hall.

“The investigation has revealed that many of the elected and appointed officials in the City retain strong ties with the previous administration and are otherwise politically opposed to the Mayor on a variety of municipal issues, large and small,” according to court documents.

“These officials included several members of the City Council,” the docs contend, “as well as high-ranking employees of different City municipal agencies, such as the Public Safety department, the Fire Department, and the OEM.”

Now you might be thinking this is another case of Republicans and Democrats taking a partisan position, but in fact both Cammarano and Zimmer are from the Democratic Party caucus – but Hoboken is one of those towns where they don’t bother to count Democratic votes over Republicans, they just weigh them, and politics is a cut-and-thrust business.

Patrick Ricciardi, who joined the city’s IT department in 1992 and rose to oversee the entire City network, admitted to FBI agents that he had joined the opposition cabal and set up a special archive that contained copies of all incoming and outgoing emails for Major Zimmer and her key staff.

Jersey represent! (credit: Claire Moses)

Network analysis showed that the emails were received by fire chief Richard Blohm and former public safety director Angel Alicea, according to testimony from former business administrator Arch Liston. His suspicions were aroused when he started to get Open Public Record Act requests for government documents he’d only been emailed the day before, Hoboken Patch reports.

Suspicions were further aroused in May 2011 when one of Zimmer’s staffers found a paper copy of a private email, and informed the mayor. She called in an independent security auditor to check out the city’s systems.

The scam was uncovered, in part, because Ricciardi wasn’t particularly smart about his spying – he put the archive on his personal PC rather than bury it in a server. His assistant Jonathon Cummins confessed in October 2011 that he had been the one who set up the archive, but recanted a week later when Ricciardi admitted his guilt to FBI agents in an interview at his home.

Ricciardi, 46, pleaded guilty to accessing a computer without authorization, interception of wire and electronic communications, and disclosure of intercepted wire and electronic communications, each of which carries a five-year maximum term. He will be sentenced in July. ®

Bootnote

The New Jersey city of Hoboken begins less than a mile from the seething heart of New York’s Manhattan Island, separated only by a narrow stretch (and occasional emergency landing spot) of the Hudson River.

New Yorkers scornfully refer to people who live there as “bridge and tunnelers”, on the basis of how they get home at night. The fact these same people also exchange a short commute for paying almost-sane property prices is seldom brought into the conversation.

But those visiting the Big Apple should take a trip across the river and check out this underrated gem. Hoboken has some beautiful spots, hosts the Stevens Institute of Technology (one of the New World’s oldest science and engineering institutions), and is also the birthplace of modern baseball after the first official game in 1846 when the New York Nines nailed the Knickerbocker Club 23 to 1 in four innings.

In this hack’s experience Hoboken is to New York as Canada is to America: all of the benefits of modern civilization with none of the attitude – City Hall politics notwithstanding.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/22/hoboken_cto_mayor_email_guilty/

Miscreants are coining it by infecting fanbois beloved Apple boxes with a well-known ad-injecting Trojan previously only found on Windows machines.

Trojan.Yontoo.1, the specially crafted Mac OS X version, penetrates computers running OS X by offering what purports to be a browser plugin necessary to view content, but is actually adware.

Once users have installed the plugin, the Trojan is downloaded onto the Apple machine, where it quickly installs the adware into Chrome, Firefox and Safari. Cybercrooks profit from the malware by tapping into affiliate ad network programmes.

To spread Yontoo, the VXers have set up fake movie trailer pages that prompt users to install a browser plugin supposedly need to view content – actually Yontoo-1. The Trojan also poses as a media player, a video quality enhancement program or a download accelerator.

The threat was detected by Russian software security firm Doctor Web, which describes it as part of a Mac-specific adware problem that has been growing since the start of 2013.

Windows adware has been a problem for years. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/22/mac_specific_adware/

Antivirus firms have identified the main malware behind a major internet attack that hit corporate computer networks in South Korea on Wednesday afternoon. However the source and motives behind the attack remain a mystery. Researchers have dubbed it DarkSeoul.

Computer networks at three South Korean TV stations and at least two major banks – Shinhan and NongHyup – were crippled by data-wiping malware. Internet banking and ATM services at Shinhan Bank were reportedly affected by the surprise assault. Broadcasters KBS, MBC and YTN remained able to stick to their programming schedule despite being left with many hobbled PCs.

Screenshots of affected machines posted on Twitter show machines that failed to boot up properly.

At around the same time the website of Korean network provider LG U+ was defaced by the “Whois Team.” The defacement featured a picture of three skulls together with alongside a taunting message that stated “User Accounts and All Data are in Our Hands. Unfortunately, We have deleted Your Data. We’ll be back Soon.”

LG U+ provided internet services for at least some of the firms involved and may have been a conduit in the attack.

The malware at the centre of the attack, dubbed DarkSeoul by Sophos and Jokra Trojan by Symantec, is not particularly sophisticated. “Sophos products have been able to detect the malware for nearly a year, and the various commands embedded in the malicious code have not been obfuscated,” the antivirus firm reports.

Sophos said that DarkSeoul/Jokra attempts to disable two popular antivirus products developed in South Korea – AhnLab and Hauri AV. An analysis by South Korean antivirus firm AhnLab fails to mention this but does explain the data-wiping behaviour of the malware in some depth.

The malware “is a simple piece of code that overwrites the MBR (Master Boot Record) making the affected system unable to start after reboot”, according to security tools firm AlienVault. AlienVault reckons a Chinese Exploit Kit named GonDad might have been involved in the spread of a family of related data-wiping malware. According to the security firm, Korean domains used to serve this exploit pack were registered using a Chinese email address. But hackers could easily have bought both the exploit kit and the email addresses from underground black markets so this doesn’t really prove anything.

Zombie attack?

The speed at which the attack spread suggests that the wiper malware might have been distributed to already compromised clients in a zombie network, although AlienVault’s Jaime Blasco is careful to note that his suspicion that a botnet was involved in the spread of the wiper malware remains only a theory.

Simon Edwards of AhnLab noted that a single Chinese IP address is being linked to the South Korea cyber-attack in some local reports. While the source of the attack remains unclear, restoration operations are underway, according to Edwards. He added that most locals appear to view the attacks as a continuation in the escalating tensions between North and South Korea over recent weeks following successful nuclear and rocket tests by Pyongyang.

A separate analysis by Symantec – which detects the same malware as the Jokra Trojan – has revealed that the malware contains a module for wiping Linux machines as well as the capability to wipe Windows PCs. The malware wipes the hard disks of infected computers and send them into a reboot, rendering them unusable in the process. The Jokra Trojan also attempts to wipe any drives attached or mapped to the compromised computer.

“While there are currently no indications of the source of this attack or the motivations behind it, it may be part of either a clandestine attack or the work of nationalistic hacktivists taking issues into their own hands,” Symantec explains in a blog post, which also notes some similarities between the South Korean malware and the Shamoon attack against the corporate PC networks of Saudi Aramco and Qatari gas giant RasGas last year.

Meanwhile Trend Micro compares the behaviour of the MBR wiping malware to that of some strains of ransomware.

Both North and South Korea reportedly have maintained cyberwarfare units for several years. Five years ago, South Korea’s military command and control centre was the target of a spyware attack from North Korea’s electronic warfare division. The Mata Hari character at the centre of the case was convicted of seducing army officers in exchange for military secrets and jailed for five years. The

A year later, in 2009, a massive DDoS attack crippled 26 South Korean and foreign governmental websites, including military sites. And two years after that, in 2011, the so-called “Ten Days of Rain” distributed denial-of-service [DDoS] attacks hit multiple government sites as well as the ground, air and naval divisions of the US armed forces stationed in South Korea.

Last week North Korea blamed the US and its allies for computer hacking attacks against its computer networks. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/22/sk_megahack/

Security researchers in Finland have turned up thousands of unsecured Internet-facing SCADA systems in that country, using the Shodan search engine.

The researchers, from Aalto University, ran their test in January, and found 2,915 exposed systems running functions from building automation to transport and water supply. Those responses were out of a total of 185,000 Finnish IP addresses that responded to an HTTP request.

Exposed building automation systems, the researchers claimed, included a bank, a gaol, and a hospital, according to communications and networking professor Jukka Manner. The researchers claimed that many systems were vulnerable through their remote user interfaces.

Interestingly, when the university re-ran its test in March, it found that a large number of the systems had been removed from the Internet, although 1,969 of the systems were still present. “A lot of problems can … still be hiding”, according to research assistant Seppo Tillkainen, since as much as 30 percent of the Finnish IP address space is still not mapped by Shodan.

While systems spotted in the Shodan search even included a wind turbine, the majority of poorly-secured systems were in office blocks and residential towers, the study says.

The researchers did not go as far as to actually try to penetrate the systems, citing Finland’s computer crimes laws.

A Google translation of the university’s press release is here. For Finnish readers, the whole study is here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/22/finland_scada_vulnerabilities/

Syrian hacktivists took over the BBC Weather Twitter account on Thursday afternoon.

Instead of getting the usual updates such as “partly cloudy over the British Isles with a chance of rain later” the 60,000 followers of the @BBCWeather account on Twitter were confronted with a series of bizarre messages. These updates included:

Hazardous fog warning for North Syria: [Turkish Prime Minister Recep Tayyip] Erdogan orders terrorists to launch chemical weapons at civilian areas

and

Saudi weather station down due to head on-collision with camel

A crew called the the Syrian Electronic Army, a pro-Assad group, took credit for the hijack. The same group also claimed responsibility for the hijack Al-Jazeera’s mobile news feed last year.

“Whether the legitimate owners of the @BBCWeather account were phished, had their password cracked, or made the mistake of using the same password in multiple places isn’t currently clear – but what is obvious is that right now they have no control over their account,” writes Graham Cluley of Sophos in a blog post.

The hack appears to have been motivated by a desire to push out propaganda to a wider audience rather than any intention to spread malicious links, or to promote diet scams, two popular reasons for Twitter account hijacks, which are becoming increasingly frequent.

Twitter’s putative plans to introduce two-factor authentication – the best method for frustrating basic account hijack hacks – can’t arrive too soon.

The @BBCWeather account was compromised for around two hours before the offending tweets were deleted and normality restored. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/21/bbc_weather_twijacked/

Computer security researchers say they have uncovered a decade-long espionage campaign against governments, businesses and human-rights activists in Eastern Europe and beyond.

We’re told the spying operation was partially pulled off by subverting TeamViewer – a legitimate tool for remotely controlling computers and holding meetings online. The snoopers installed the software on victims’ Windows PCs and modified the code’s behaviour with DLL hijacking to open a backdoor on the compromised machines. This successful tactic earned the campaign the nickname of TeamSpy and kept the hacking crew under the radar for years.

The researchers, who are based at the Laboratory of Cryptography and System Security (CrySyS Lab), said the spying team also used custom-built malware in days gone by.

Many of the compromised computers appeared to belong to ordinary punters, but some were within high-profile organisations involved in industry, scientific research or diplomacy. Hungary opened a joint investigation with the CrySyS Lab and the Hungarian National Security Authority after some of the country’s government computers were infiltrated by TeamSpy.

Other targeted bodies, according to the researchers, include an unnamed EU state’s embassy in Russia; an electronics company in the Middle East; multiple research and educational organisations in France and Belgium; and an industrial manufacturer in Russia.

The cyber-spies were interested in Microsoft Office documents and such files (e.g., those with the filename extensions .doc, .rtf, .xls or .mdb), PDF files, disk images (e.g., .tc or .vmdk), as well as files that potentially contain sensitive information such as encryption keys (e.g., .pgp, .p12) or passwords (e.g., files with the following strings in their names: pass, secret, saidumlo, секрет and парол).*

“Most likely the same attackers are behind the attacks that span for the last 10 years, as there are clear connections between samples used in different years and campaigns. Interestingly, the attacks began to gain new momentum in the second half of 2012,” CrySyS Lab concluded.

“The campaigns are a mix of targeted attacks and conventional cyber-crime activities, for example, banking crime operations such as the Sheldor campaign.”

CrySyS Lab reckoned the attacks are the work of a small and technically skilled team that has grown more sloppy over the years as complacency set in.

“The attackers use distinct tools for nearly every simple activity – this means that the group is most likely small, and technically professional people carry out all types of activities including strategic planning and executing the attacks,” the lab’s experts said.

“The attackers commit errors and produce a lot of garbage. One reason for this carelessness may be that after so many years of undetected operation, they are not afraid of detection.”

A summary of the research by Budapest-based CrySyS Lab and the Hungarian National Security Authority can be found here [PDF].

Staff at security biz Kaspersky Lab added that human-rights activists have also been targeted in the campaign. The researchers said the attackers were siphoning off Apple iOS device history data from iTunes, detailed OS and BIOS information, as well as logging victims’ keystrokes and screen-grabbing desktops on compromised devices. A blog post by Kaspersky contains tips on defeating computer espionage, such as blocking access from corporate machines to known command-and-control servers operated by hackers.

TeamSpy’s modus operandi is similar to the approach taken by the hackers behind the earlier Red October attack, although the two operations are not thought to be directly linked. The TeamSpy crew usually roped in victims using so-called waterhole attacks based on planting malicious code on websites frequently visited by people working at targeted organisations. That attack code was also injected into advertising networks that ran across the targeted regions.

A detailed technical analysis by Kaspersky Lab of TeamSpy can be found here [PDF]. ®

Bootnote

* “Saidumlo” means “secret” in Georgian; “секрет” means “secret” in Russian; and “парол” means “password”.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/21/teamspy_cyber_espionage/