STE WILLIAMS

A rogue website has leaked what’s claimed to be the detailed financial records of US celebs, politicians and other public figures.

The site has published the alleged financial lowdown on US first lady Michelle Obama, blowhard Donald Trump, Arnold Schwarzenegger and both Paris Hilton and Britney Spears, among many others. Vice President Joe Biden, FBI director Robert Mueller, former Secretary of State Hillary Clinton, LAPD Chief Charlie Beck, Sarah Palin, Beyonce and Mel Gibson are also on the list.

The practice of posting personal info on public individuals – for the purpose of allowing online activists to deliver pizzas and otherwise wreak havoc with the data – is known as “doxing”.

The data dump includes what the doxers claim are the Social Security numbers, dates of birth, home addresses and contact information of most of the supposed victims of the leak, as well as “credit reports” and other financial information on some.

According to the Associated Press, the LAPD is investigating the posts.

In the case of Joe Biden, Donald Trump and Hillary Clinton, the hackers released only their alleged Social Security Numbers and places of residence, but the shlebs got the full treatment.

One document among the cache of “leaked” information would have you believe that rapper Jay-Z has a mortgage with HSBC. Phone numbers in the data leak for Jay-Z’s missus, Beyonce, include a number that was answered by staff at Gelfand, Rennert Feldman, a business management firm that handles the finances of the wealthy, Russia Today reports.

The supposed Paris Hilton credit report suggests she has taken out a five-year repayment deal on a Toyota for $5,600 (£3,770) a month and is paying off a $2.9m (£1.95m) 30-year mortgage. Paris also lost a credit card (limit $100k/£67k) she took out with Bank of America in early 2011. Her credit rating, if accurate, is very good.

LAPD chief Charlie Beck’s supposed credit report is branded as originating from credit reference agency Equifax. Both Michelle Obama and Mel Gibson’s supposed credit reports are allegedly from TransUnion. Each profile except for that of Michele Obama features an unflattering portrait of the particular victim. Some feature accompanying music. Dates on the “reports” suggest they were compiled as recently as last Sunday (our Paris).

The provenance of the data remains unclear, although some of it might have been sourced from public records and then combined with free credit reports obtained using this information. The motives of the unknown pranksters likewise remains a mystery.

An LAPD police spokesman told AP that it was investigating how the personal information of its chief ended up on the site, so police are taking the claims seriously. However the silence of normally highly vocal celebs such as Donald Trump* on the issue is out of character and it’s possible the whole thing might turn out to be a massive trolling exercise aimed at exposing the credulous nature of much mainstream reporting on hacking issues. If the credit reports were forgeries then someone has taken a lot of trouble in making them look convincing.

The website is registered under the .su domain, the country code for the former USSR between 1990 to 1991, before the Soviet Union collapsed. The domain still exists and is administered by the Russian Institute for Public Networks. But it looks like the pranksters might not be Russians themselves. As Russia Today points out, the updates to the pranksters’ Twitter account are “partly written in bad Russian, as though the messages were translated by machine”.

The site shows an image of a girl holding her forefinger up to her mouth, links featuring the names of the individuals allegedly hacked and the quote: “If you believe that God makes miracles, you have to wonder if Satan has a few up his sleeve” – marking out whoever created the site as a fan of TV show Dexter.

Bootnote

* Trump has been busy tweeting about golf, The Apprentice and the possibility of changing his hairstyle, among other pressing matters. Palin, Hilton and Spears are serial victims of hack attacks after previously suffering high profile webmail, T-Mobile Sidekick mobile phone and (multiple) Twitter profile hacks, respectively.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/12/celeb_doxing/

An Indian hacker known as “Godzilla” taken down several Pakistani government web sites.

The hacker told The Hacker News that it acted in retaliation for the government’s alleged support of terrorist activities, adding: “all network owned including switches because they deserve it, I have not touched any innocent website because target is only government”.

At the time of writing, four of the 15 sites targeted were back online, while most others displayed an error message. Those still unreachable include the Ministry of Railways; Ministry of Science and Technology; and Ministry of Environment.

The Pakistani government apparently runs many of its servers through a proxy server located at 202.83.164.6 in a bid to thwart cyber attacks. However, it managed to configure the proxy in a such a way that local IP 192.168.70.103 was running through it.

The hacker apparently breached the local IBM server at this address with Layer 2-3 Gigabit Ethernet Switch Module for IBM eServer, BladeCenter.

“They are running [the proxy] through a local system 192.168.70.103 which is been shut down as we have access of the switch”, Godzilla told the hacker news site.

Pakistani and Indian hacktivists have a long and colourful history of tit-for-tat attacks on each other’s web sites as hostilities between the two fierce rivals frequently spill over into the online world.

However, neither side appears to be doing very well at stopping such attacks. According to the latest stats from the India CERT, there were 873 defacements of .in sites in January 2013, up slightly from the previous year. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/12/godzilla_india_pakistan_web_site_government/

IT security firm Tripwire has agreed to acquire vulnerability management specialists nCircle. Terms of the deal, announced Monday, were undisclosed.

Combining forces will allow the development of technologies that will enable senior security officers to make risk-based security decisions that align with business priorities and goals, according to a statement by the two would-be partners.

The two companies’ combined sales for 2012 reached approximately $140 million; together they had over 500 employees and more than 7,000 customers in 96 countries. The Tripwire/nCircle combo – assuming the deal goes through – will compete in the security and vulnerability management market against the likes of IBM, EMC, Symantec, and McAfee.

“Security experts know that continuous monitoring — the process of finding and eliminating vulnerabilities before they can be exploited — is a foundational component of any security framework and the most cost effective way to reduce the risk of security breaches,” said nCircle CEO Abe Kleinfeld. “The combination of Tripwire and nCircle brings together the industry’s leading researchers and the broadest and deepest solutions for reducing risk.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/11/tripwire_ncircle/

A 28-year-old chemist is the new UK Cyber Security Champion after triumphing in a year-long competition that tested computer defence skills.

Stephen Miller, from Hertfordshire, beat thousands of other hopefuls after competing in several online and face-to-face heats over the past 12 months. Miller, who works as a lab team manager at a major pharmaceutical company, has taken part in the tournament since it launched in 2010, building up his skills along the way. Although he has no formal computer security training, examiners praised his abilities.

He was named as Blighty’s e-champion after the final masterclass round of 2013’s Cyber Security Challenge UK on Sunday. Miller’s prize includes free access to industry training courses. The runner-up was Steve Jarvis, a 24-year-old from Southampton, who works in the IT team for a hedge fund and also has had no formal cyber-security training.

This year’s final was organised by security teams at HP and Cassidian Cyber Security. The 40 finalists took on the role of infosec professionals at a fictitious technology communications supplier to a Formula 1 racing team, which had been hacked in the lead up to a Grand Prix.

Players had to spot signs of malicious attacks and come up with the best counter-measures, both technical and policy based, to fix them. The competition was designed to test contestants with problems facing real IT security pros in many sectors across industry and government.

“To succeed in this competition and become the UK’s new cyber security champion, Stephen has had to demonstrate not only exceptional technical skills but also an ability to relate them to a common business scenario,” said Jonathan Bathurst of HP’s UK public sector biz.

“This requires an ability to weigh up risk, take into account budgets and operational limitations and be able to present a coherent case to a non-technical audience with sensible measures that are in the best interest of the organisation for the future. It is this skill set that employers value highest of all and the competition was designed to identify.”

‘A powerful demonstration of the hidden talent’

Stephanie Daman, chief exec of Cyber Security Challenge UK, added: “Stephen’s success in the challenge, as a chemist with no formal training in this profession, is a powerful demonstration of the hidden talent that exists in people from across all types of professional backgrounds.”

The culmination of this season’s competition was immediately followed by the launch of a new programme of competitions for the 2013-14 Cyber Security Challenge UK. Registrations are now open at www.cybersecuritychallenge.org.uk.

The fourth season of the challenge will include rounds designed specifically for school pupils through to regional training camps delivered in partnership with universities. The season will also include a greater range of tests including mobile forensics, incident response, malware analysis, and software vulnerabilities.

Prizes will include a bursary for a master’s degree in cyber security, sponsored by the Institute of Engineering and Technology, at three UK universities. This year also sees the debut of a Cyber Security Challenge app for iOS and Android. The app will distribute kill tests, news on the challenge and an access point for advice on computer security careers. It has been launched with a brand new cipher to crack from PwC, available through the app.

Cyber Security Challenge UK runs a series of national competitions ultimately aimed at attracting talented people into the profession, and supporting interested people with information about cyber security careers and learning opportunities. The scheme is supported by government departments, IT firms, universities and trade groups including the Cabinet Office, PwC, BT, GCHQ, QinetiQ, the SANS Institute, Sophos and Blighty’s Serious Organised Crime Agency (SOCA). ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/11/cyber_security_challenge_final/

Australia’s Reserve Bank has confirmed it has been attacked, after a report in the Australian Financial Review claimed its “… computer networks have been repeatedly and successfully hacked in a series of cyber-attacks to infiltrate sensitive internal information, including by Chinese-developed malicious software”.

The Reserve Bank (RBA) is Australia’s central bank and has functions broadly comparable to those of the Bank of England or the US Federal Reserve.

The AFR report mentions hacks on France that resulted in several thousand confidential documents supposedly making their way in the general direction of China, but does not say if Australian documents were lost.

The RBA has since issued a statement admitting to detecting attacks but has classified them as mere “virus attacks”. Here’s what the RBA had to say:

“As reported in today’s media, the Bank has on occasion been the target of cyber attacks. The Bank has comprehensive security arrangements in place which have isolated these attacks and ensured that viruses have not been spread across the Bank’s network or systems. At no point have these attacks caused the Bank’s data or information to be lost or its systems to be corrupted. The Bank’s IT systems operate safely, securely and with a high degree of resilience.”

If online criminal activity is as prevalent as security companies constantly tell us, one would expect a high-value target like a Reserve Bank to be a target. One would also expect it to attract expert and motivated attackers, if only because it is hard to imagine the phishers and identity thieves of the world caring much about the Bank’s sensitive information or being interested in the almost-certainly complex chore of finding buyers for it.

Something else that is almost certain is that this story will run for a while: a media outlet with a story of this seeming importance will have more than one followup planned, probably with additional revelations.

Whether those followups mention this Deutsche Telecom data will be interesting, as it suggests China is far from the world’s most active source of hack attacks. That “prize” goes to the Russian Federation, followed by “rogue” Chinese province/democratic Chinese breakaway state Taiwan.

As the Gartner blog post that brought the Deutsche Telecom data to Vulture South’s attention says, “It is fairly well known  by most security professionals that the best hackers on the planet often originate from Russia,  however it is  more newsworthy to talk about  a country such as China whom we trust with many of our manufacturing facilities and research and development activities and have greater resources at their disposal if they intended to inflict harm.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/11/reserve_bank_of_australia_attacked/

Microsoft plans to deliver seven bulletins next week, four critical, and three important, as part of the March edition of its regular Patch Tuesday update cycle.

The most troublesome of the critical vulnerabilities carries a remote code execution risk and affects every version of Windows – from XP SP3 up to Windows 8 and Windows RT as well as all versions of Internet Explorer.

A second critical update addresses critical vulnerabilities in Microsoft Silverlight both on Windows and Mac OS X. Silverlight is widely used as an alternative to Flash, in particular to run media applications, for example Netflix.

Third on the critical list is a vulnerability in Visio and the Microsoft Office Filter Pack.

The final critical update covers a privilege elevation flaw in SharePoint, Microsoft’s portal and content management enterprise server software.

The practical upshot is that ALL versions of Windows, some Office components and many consumer Mac OS X installations and more will need updating because of a myriad of security flaws.

The “important” bulletins cover an update to Microsoft Office for Mac 2008 and 2011 as well as an elevation of privilege security bug in Windows that affects XP SP3 up to Windows 8.

Last, and probably least, comes at “important” update for OneNote, Microsoft’s note-taking software. Microsoft’s pre-release advisory is here.

In related news, the ZDI’s Pwn2Own competition at CanSecWest security conference in Vancouver led to the discovery of all manner of new vulnerabilities in browser platforms (IE, Chrome and Firefox), Java and Adobe apps. This is likely to produce plenty of patching action over upcoming weeks, especially if past form is any guide.

Commentary on all this and more can be found in a blog post by Wolfgang Kandek, CTO of Qualys, here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/08/ms_patch_tuesday_pre_alert/

Twitter’s private OAuth login keys, used by the website’s official applications to get preferential treatment from the micro-blogging site, have apparently been leaked. The secret credentials could now allow any software to masquerade as an approved Twitter client.

A set of key pairs uploaded to Github are supposedly used by Twitter for iPhone, Android, iPad, Mac OS X and Windows Phone, Twitter for Google TV, and TweetDeck. Once authenticated, these programs get access to features unavailable to clients that don’t have Twitter’s approval. But they need to store the keys somewhere on the user’s computer or gadget, and it appears someone has found them.

The keys were first posted on the GitHub website five months ago, but were updated within the past day; GitHubbers claim the data is genuine.

So now unapproved apps could send this information to Twitter to impersonate the legitimate clients, circumventing access controls and blocks Twitter imposes on unofficial third-party software, Kaspersky Lab’s news service Threatpost noted.

The micro-blogging site can create new keys and secrets for its apps, roll out updated versions of its software with the new login data, and only accept the new credentials – however, that’ll break access to anyone who hasn’t upgraded.

But before that happens, anyone can, in theory, write any old code that presents itself as an official app to Twitter and thus enjoy all the services available exclusively to the website’s own gear, if the leak is genuine.

Twitter has used OAuth to authenticate approved third-party apps such as TweetDeck and others since August 2010. Facebook also uses the technology.

OAuth offers users the ability to sign into Twitter from software clients without having to faff around with usernames and passwords: third-party apps don’t store the user’s login credentials and their access can be revoked.

But the technology is not without its problems. For example, when Twitter detected a breach last month, and advised 250,000 early adopters of the micro-blogging service to change their passwords, the use of OAuth meant it was still possible for authenticated Twitter clients to post tweets without prompting user for their new password. In effect, Twitter for iPhone, Android, TweetDeck and the rest effectively stayed signed-in.

In the case of this week’s Github post, the keys will need to be revoked and new credentials issued in order to resolve the problem – an effort that may just push Twitter into axing support for third-party applications altogether. We have approached Twitter for comment and will update this story if they get back to us. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/08/twitter_oauth_leaked_keys/

Yahoo! has blamed cross-site scripting security bugs, which it claims to have squashed, for a recent upsurge in webmail account takeovers.

Over the last few days several Reg readers have been in touch to complain that their Yahoo! webmail accounts have been hijacked or to point us towards complaints on various support forums about the issue.

One tipster told us: “Lots of Yahoo! Mail accounts were broken into last week by computers all over the world. It seems a botnet was used to do it. The hackers might have accessed some of the accounts through Apple iPhone’s Yahoo! Mail app, as account security logs show that as one of the hack entry points.”

BT has a tie-up with Yahoo! and the tipster pointed us towards tales of webmail account hacking woe from the telco’s customers, including one from someone who works for a support organisation and another from a computer company in Devon. The latter ruled out a virus infection at their end and suggested a security flaw in the Yahoo! mobile app might be to blame for the problem.

The thread on the BT support forum, running to many pages, and the posts on a broadband support forum both suggest that Yahoo! webmail hijack problems flared up last weekend.

Back in January, Yahoo! said that it had squashed a cross-site scripting (XSS) vulnerability in its webmail service which was blamed for a spate of account hijackings. The compromised accounts were used to send spam.

The vulnerability, which was triggered by tricking users into clicking on a malicious link, appears to be the same bug offered for sale for about $700 on an underground forum in November. Offensive Security warned at the time that Yahoo!’s fix was ineffective, leaving the bug in play.

Meanwhile, last month security firm BitDefender warned of an apparently separate attack aimed at harvesting Yahoo! webmail account cookies that relied in part on a buggy version of WordPress on Yahoo! Developers Blog, malicious JavaScript and cross-site scripting flaws. It’s not clear if the two events were connected.

We asked Yahoo! about the recent upsurge in reports of Yahoo! webmail takeovers. In response, it fingered an XSS problem, but did not confirm if it was the same problem it told us it had squashed in January. We’ll update you when we have an answer.

Yahoo! added that it is working hard to seek out and restore and hijacked accounts.

The XSS flaws reported to Yahoo! have been fixed and we continue to aggressively investigate reports of any email accounts exhibiting anomalous behaviour. We’re committed to protecting our users and their data. We strongly urge our users to change their passwords frequently and to use unique, alphanumeric passwords for each online site they visit.

Separately, another Reg reader, who asked not to be named, complained that his email account archives had been deleted.

“I am a Yahoo! Mail Plus subscriber,” our source explained. “I signed up six months ago for a year. This means that I will avoid deactivation for not signing in for four months. However, on March 1st 2013 my account was deactivated, and all my previous emails were deleted without warning.”

Posts on a Yahoo! support forum Down Under in New Zealand suggest this incident is far from isolated.

The situation remains confusing. TheNextWeb reports the continuation of Yahoo! webmail account hijacking despite attempts by Yahoo! to plug holes in its systems. The website carries a timeline of the problem, which remains an issue 10 weeks after it was first reported in early January. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/08/yahoo_webmail_hijack_flare_on/

It’s back to the drawing board for coders at Microsoft, Google, Adobe, Mozilla, and Oracle after entrants in the annual Pwn2Own contest waltzed off with over half a million dollars in prizes for exploiting security holes in popular software.

At this year’s CanSecWest security conference in Vancouver, contestants had a choice of two hacking contests; the traditional Pwn2Own trial against Internet Explorer 10, Firefox, Chrome, Java, and Adobe’s Reader and Flash, plus Google’s own Pwnium contest – which this time focused on cracking Chrome OS.

HP provided most of the sponsorship for Pwn2Own this year, and Brian Gorenc, head of its DVLabs team, told The Register that the company had paid out $480,000 in cash to the crackers, along with laptops and subscriptions that brings the total prize pot to over half a million dollars.

“It’s a really good investment,” he explained. “It puts us on the cutting edge of security research and we get to see the latest and greatest attack techniques, which we can then feed into our other security products,” Gorenc said.

In the first day of cracking on Wednesday, Internet Explorer 10, Firefox, Chrome, and Java all fell prey to the skill of the security researchers, and on Thursday Flash, Adobe Reader, and IE 10 on the Surface Pro were successfully hacked (despite some frantic last-minute patching) – with some of the hacks beating expectations at what was possible.

“VUPEN Security’s crack on IE 10 running on Surface Pro was an eye-opener,” Gorenc said. “The vulnerability was so elegant it didn’t even crash the browser. They launched the process from outside the sandbox so the user wouldn’t even know if they had been hacked.”

Meanwhile, two researchers from MWR Lab managed to subvert Google’s Chrome browser so completely that they compromised the entire target system it was installed on, which Gorenc praised as “highly skilled.”

But there will still be a lot of smiles down at the Chocolate Factory after Google appears to have come to the end of its Pwnium challenge against Chrome OS without having to pay a penny from the $3.14159m prize pot that it put up for grabs.

“Pwnium 3 has completed and we did not receive any winning entries. We are evaluating some work that may qualify as partial credit,” Google told El Reg in an emailed statement. “Working with the security community is one of the best ways we know to keep our users safe, so we’re grateful to the researchers who take the time to help us in these efforts.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/08/pwn2own_contest_cansecwest/

Kaspersky Lab has fixed a bug that could freeze PCs with Kaspersky Internet Security 2013 installed if they received a specially malformed IPv6 packet.

Earlier this week infosec bod Marc Heuse reported that sending a fragmented IPv6 network packet with multiple extension headers, one of which is unusually long, to a Windows computer with Kaspersky Internet Security 2013 installed will freeze up the machine completely. The Russian security biz confirmed the flaw, which it has fixed in its software, and apologised for the coding error.

In a statement, Kaspersky Lab stressed that the bug only crashed PCs, rather than creating a means to take control of them:

After receiving feedback from the researcher, Kaspersky Lab quickly fixed the error. A private patch is currently available on demand and an autopatch will soon be released to fix the problem automatically on every computer protected by Kaspersky Internet Security 2013.

Although Kaspersky Lab acknowledges the issue, it would like to stress that there was no threat of malicious activity affecting the PCs of any users who may have experienced this rare problem.

Kaspersky Lab would like to apologise for any inconvenience caused. Actions have been taken to prevent such incidents from occurring in the future.

In his advisory, Heuse revealed that the freeze flaw is not restricted to KIS 2013 but also affects any other Kaspersky products that bundle the same buggy firewall functionality.

Heuse said he only went public on Monday after failing to get a response from Kaspersky on the issue, which he first reported to the security firm in late January. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/03/08/kaspersky_ipv6_lock_up_bug/