STE WILLIAMS

First Google wants to know all about you, now it wants a RING on your finger

Top Google bods are mulling over using cryptographic finger-rings and other ways for users to securely log into websites and other services.

The ad giant’s security veep Eric Grosse and engineer Mayank Upadhyay have submitted a paper on Authentication at Scale to the IEEE Security Privacy Magazine; their central argument is that weak passwords are a bigger threat to online security than malware infection, hacker attacks or espionage. Passwords, as they stand, need to go, in the pair’s opinion, but this process won’t happen overnight:

In working to keep cloud computing users’ data safe, we observe many threats – malware on the client, attacks on SSL, vulnerabilities in web applications, rogue insiders, espionage – but authentication related issues stand out amongst the biggest. When trying to help hundreds of millions of people from an unbelievable variety of endpoints, attitudes, and skill levels, what can possibly displace plain old passwords? No single thing, nothing overnight, and nothing perfect. A combination of risk-based checks, second-factor options, privacy-enhanced client certificates, and different forms of delegation is starting to find adoption towards making a discernible difference.

Google introduced a two-stage login process for its Gmail website two years ago. This optional two-factor verification adds an extra layer of security to Google accounts by linking them to a registered mobile phone number. Users are asked for a code sent to them by text every time they try to log into their accounts from a new computer, a minor inconvenience for legitimate users that makes life far trickier for account hijackers and other criminal hackers.

Looking further ahead, Google is experimenting with Yubico cryptographic USB cards that generate one-time passcodes (OTP) for logging into websites. The YubiKey combines a public ID number unique to the key with a series of bytes generated on the fly to produce a one-off code that, when used with an account username and password, will log the user into the service for that one particular session. The magic code consists of a secret value, a timestamp, some counters and a few random bytes encrypted using 128-bit AES, and then inputted into the computer via USB as if typed into a keyboard.

Pressing the gold disc-like button on the keyboard generates and outputs the new unique code; the incrementing counters ensure no one can copy and reuse the OTP, and the public ID number in the key links the gadget to the account username. One step on that would involve replacing the USB connection with wireless radio tech and building it into a finger-ring. And then getting enough websites and services to use it.

“We’d like your smartphone or smartcard-embedded finger ring to authorize a new computer via a tap on the computer, even in situations in which your phone might be without cellular connectivity,” Grosse and Upadhyay wrote.

“Others have tried similar approaches but achieved little success in the consumer world. Although we recognize that our initiative will likewise remain speculative until we’ve proven large scale acceptance, we’re eager to test it with other websites.”

It is understood Grosse and Upadhyay have developed a protocol for device-based authentication independent of Google that will also prevent websites from tracking users. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/21/google_password_alternative/

‘End of passwords’ predictions are premature

Advances in the power of computers won’t automatically make passwords obsolete, according to a top computer science researcher.

Joseph Bonneau, a postgrad researcher at Cambridge University, made set out to look into the perceived wisdom which runs along these lines: “since computers are getting exponentially faster, yet the human brain is constant then password crackers will eventually beat human memory …”

Remarks such as this are often made when the latest advances in increasingly powerful graphics processors for password cracking or similar stories hit the news. Bonneau doesn’t dispute that password cracking is getting faster or that easily guessable or reused passwords are toast. Instead he disputes the idea that well thought out, complex passwords stored using a sufficiently robust hash function with proper salting have had their day.

A hash function is a mathematical process that takes a “message” and forms a message digest or hash from it. Storing plain text passwords as part of an online authentication system is an obviously bad idea. If a website is broken into and the passwords are lifted then even well thought out passwords are exposed.

Instead websites need to store password hashes, protected by salting, in order to prevent brute force attacks using rainbow tables.

A password hash is computationally easy to create but working out the corresponding password from a hash ought to be nearly impossible, given a correctly implemented hash function. Rainbow tables circumvent this snag by creating a large data set of hashes from nearly every possible password. Faster number-crunching chips make it possible to derive and run through an increasing volume of possible passwords, increasing the potency of such brute force attacks.

Bonneau argues however that this points towards an arms race necessitating the development of better hashing algorithms rather than an inexorable move towards the end of days for passwords.

“Password cracking is certainly getting faster,” Bonneau explains. “In my thesis I charted 20 years of password cracking improvements and found an increase of about 1,000 in the number of guesses per second per unit cost that could be achieved, almost exactly a Moore’s Law-style doubling every two years.

“The good news though is that password hash functions can (and should) co-evolve to get proportionately costlier to evaluate over time. This is a classic arms race and keeping pace simply requires regularly increasing the number of iterations in a password hash. We can even improve against password cracking over time using memory-bound functions, because memory speeds aren’t increasing nearly as quickly and are harder to attack using parallelism,” he adds.

Bonneau cautions against complacency: hashing passwords isn’t going to get any more efficient over time and older algorithms will need to be replaced by more complex successors. As well as the brute force problem, hashing algorithms can come under increasing pressure from new types of cryptanalysis.

“Moore’s Law has indeed broken MD5 as a password hash and no serious application should still use it. Human memory isn’t more of a problem today than it used to be though. The problem is that we’ve chosen to let password verification become too cheap,” Bonneau argued.

Booneau’s remarks come days after Deloitte Canada warned that the password was doomed. It predicted more than 90 per cent of user-generated passwords will be vulnerable to hacking during the course of 2013.

“Passwords containing at least eight characters, one number, mixed-case letters and non-alphanumeric symbols were once believed to be robust. But these can be easily cracked with the emergence of advanced hardware and software,” Duncan Stewart, director, Deloitte Canada Research said. Deloitte Canada made the point while arguing for more widespread use of two-factor authentication using either tokens or mobile phone technology. Password vaults, secured by two-factor authentication, can play a role in driving the wider use of more complex passwords that users don’t necessarily have to remember, the management consultancy argues, adding that disaster beckons for continued use of current password choices.

“In a recent study of six million actual user-generated passwords, the 10,000 most common passwords would have accessed 98.1 percent of all accounts,” Deloitte Canada adds.

Easily guessable passwords are arguably a lesser problem than password re-use. The average user has 26 password-protected accounts, but only five different passwords across those accounts, according to a recent study by credit reference agency Experian.

Deloitte Canada’s prognosis on password problems can can be read on page 11 of a larger report on tech trends here (PDF). ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/21/passwords_not_doomed/

‘Anonymous’ hacks Oz Uni’s email to protest bulk iPad buy

Email servers at the University of Western Sydney, which last year announced it would hand iPads to all staff and over 10,000 incoming students, have been hacked by someone using the name ‘Anonymous’. The University is known to use Microsoft’s live@edu hosted email service.

The attacker has used the University’s servers to send spam and has also subscribed students to various commercial mailing lists.

The University has ‘fessed up to the incident on Facebook, where commenters report having received 300 or more unexpected emails.

One of those emails, signed by “Anonymous” and titled “When will UWS stop abusing and exploiting their student body?” protests the University’s decision to buy iPads for the student body.

In an 800-word rant sent to The Reg by a UWS student, the author criticises the cost of the iPads, lack of consultation with students before the fondleslab buy, the state of the University’s IT (apparently it takes five minutes to print in the Library) and suggests tablets have no proven impact on the quality of teaching or learning.

The author also believes the decision to buy iPads was made by the marketing department after research found plenty of would-be students would like one.

“If only they’d have surveyed how many students own luxury cars,” the author wrote, “they may have decided to gift students a free Mercedes-Benz SLK 55 AMG instead.”

The source of the email is also clearly no fan of Apple, offering the following criticism of the iPad as a platform

“The sad part in all of this is that the tablet they’ve chosen to gift the students is not only the most expensive to maintain, nor is it just fundamentally and significantly overpriced for the technical specifications it carries, but it is also extremely locked down in terms of scalability. Apple refuses to allow things such as saving files (other than photos), rendering Flash-based websites and videos, and does not even have a decent office suite available. It is no more than a toy, and for some reason UWS seems to think that the ability to play Angry Birds during lectures and tutorials will somehow provide a better learning experience.”

The UWS IT team has assured students that Spam is the only outcome and says it will offer more information once it learns more about the hack. The Reg expects that investigation will include some terse calls to Microsoft. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/21/uws_email_hack/

Paging Dr Evil: Philips medical device control kit ‘easily hacked’

Researchers have discovered security problems in management systems used to control X-ray machines and other medical devices.

Terry McCorkle and Billy Rios of security start-up Cylance used fuzzing approaches previously applied to unearth security holes in industrial control systems to find a way into the Xper Information Management system from Philips.

The tactic allowed the researchers to gain privileged user status onto the medical information management system. “Anything on it or what’s connected to it was owned, too,” Rios said during a presentation at Digital Bond’s annual SCADA Security Scientific Symposium (S4) conference, which took place in Miami this week.

The attack was in part enabled by weak remote authentication supported by the system, as well weaknesses that left it open to fuzzing – a tactic that involves throwing variable inputs at a test device until a fault condition that might be exploited occurs. The researchers obtained the kit which had been in service at a Utah hospital from an unnamed reseller.

“We noticed there was a port open, and we started basic fuzzing and found a heap overflow and wrote up a quick exploit for it,” Rios told SC Magazine. “The exploit runs as a privileged service, so we owned the entire box – we owned everything that it could do.”

Authentication logins, one with a username Philips and password Service01, may be hardcoded but Philips denies this.

Philips said that the flaw exists only in older version of Xper. It suggested that the vulnerability was in any case limited to data management features, rather than creating a mechanism for hackers to control connected medical kit.

“Current Xper IM systems do not use this version of software,” a Philips spokesman told Dark Reading. “If an Xper IM workstation is compromised by a potential vulnerability, that may affect the data management capability, but X-ray equipment continues to operate independently,” he added.

Both the US Department of Homeland Security (DHS) ICS-CERT, which normally deals with security issues involving industry control kit, and the US Food and Drug Administration (FDA) are reportedly taking an interest in the issue.

Information security shortcomings in medical equipment and devices has hit the news before. For example during a presentation at Black Hat 2011, Jerome Radcliffe showed how it might be possible to either remotely turn off or alter the settings on Medtronic’s insulin pumps. Radcliffe, himself a diabetic, was able to hack into the pumps without triggering alerts.

Last year Barnaby Jack, the security researcher best known for “jackpotting” an ATM live on stage at BlackHat 2010, warned that pacemakers and implanted defibrillators are vulnerable to wireless attacks. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/18/medical_device_control_kit_security/

Cybercrooks send in Bouncer to guide marks to phishing sites

Cybercrooks have begun bundling whitelisting technology with phishing kits in a bid to restrict access to phishing sites to only their intended victims.

The tactic of blacklisting IP addresses associated with security firms from accessing banking fraud sites has been in play for at least a few months now, but a new phishing toolkit called Bouncer goes one step further – restricting access ONLY to prospective marks.

Security analysts at RSA, which discovered the new phishing toolkit, said it has been used to target customers of banks in South Africa, Australia and Malaysia in recent weeks. Each campaign targeted an average number of 3,000 recipients with lists featuring a mixed bag of webmail users, corporate addresses and even some bank employees. The target list may have come from an earlier data breach.

Bouncer allows cybercrooks to generate a unique ID for each intended victim, which is embedded in the URL that intended victims are asked to click on in order to visit hijacked sites that serve as phishing scam hubs. Intended victims are redirected to a live site posing as their banking institution, where attempts are made to trick them into handing over their online banking login credentials, while everyone else gets a “404 page not found” error message.

The approach means that automated systems or researchers at security firms might be fooled into thinking an attack had already been pulled offline while in reality it’s still active, potentially extending the life expectancy of phishing fraud sites based on Bouncer.

“Traditional phishers like to cast as wide of a net as possible, but with this tactic the phisher is laser-focusing the campaign in an effort to collect only the most pertinent credentials for his purposes. Keeping out uninvited guests also means avoiding security companies and prompt take-downs of such attacks,” explained Limor Kessem, a cybercrime and online fraud specialist at RSA.

“The peculiar approach is likely the work of a gang or a fraud service vendor supplying credentials to specific geographical regions and targets,” she added.

As a prelude to Bouncer-based attacks, cybercrooks are taking advantage of WordPress plugin vulnerabilities to compromise and hijack websites before uploading a web-shell to hijacked sites, and then exploiting them as resources in phishing fraud campaigns.

Kessem added that Bouncer is an example of how “modern-day phishing kits are written with increasing complexity and sophistication, authored by programmers who adapt the kits to the phisher’s needs”.

A write-up of the threat can be found in a blog post by RSA here. ®

Bootnote

The total number of phishing attacks launched in 2012 was 445,004, up 59 per cent on the 279,580 attacks recorded in 2011. Estimated losses hit $1.5bn last year, up 22 per cent from 2011 figures, according to figures from RSA.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/18/black_hat_phishing_whitelist/

Did ZDI snub your 0-day attack? Packet Storm will buy it for $7k

Long-running computer security website Packet Storm has launched a bug bounty scheme to reward folks who find and report holes in software. Details of qualifying flaws will eventually be publicly disclosed.

Under the new scheme, contributors will be typically paid anywhere between a few hundred dollars and $7,000 for exploits that enable miscreants to execute arbitrary code on vulnerable systems. Holes uncovered in Adobe Reader, Adobe Flash and Internet Explorer are worth top dollar to the website. The site is not in the market for exploits that only crash computers, however.

All work will be vetted prior to payment, as an FAQ on the scheme explains:

The list of targets that we are looking for moves constantly. If you believe that you can offer us quality exploits that demonstrate proper code execution, it is worth a discussion. It is vitally important that you can articulate what is being exploited, how it is being exploited, what systems and patch levels can be exploited, and that your work is 100 per cent yours to sell. We will not accept exploits that already have public proof of concepts that provide code execution nor will we accept known plagiarized work.

Different issues and different levels of exploit offer different levels of compensation. Typical payout for a working exploit ranges from $1,000 – $7,000 USD. If you have a zero-day that you believe is worth a lot more, there is the opportunity for larger payouts, but that requires a different discussion. Nothing is off the table. That said, what is currently being solicited are code execution exploits for “0.5-day”* vulnerabilities in Microsoft Windows, Oracle Java, and more. As we will have to pay you money, we will need to know your real identity and also your complete honesty.

Several vendors including Google, Mozilla, Facebook and PayPal have offered bug bounties for security researchers who find flaws in their products or services. The money is typically paid out once the bugs are identified, fixed and patches rolled out to users. Google has been known to write cheques for $20,000.

Security technology vendors such as iDefense and HP TippingPoint’s Zero-Day Initiative (ZDI) also act as middlemen between bug-hunters and big software makers, by offering researchers between $500 and $20,000 for exclusive details of security bugs. This information can be used to warn vendors and corporations of upcoming attacks, using the logic that if one researcher can find the bug and report it then so can hackers.

Buying up vulnerability information also allows, for example, HP TippingPoint’s network defence products to detect and block new or anticipated assaults.

Packet Storm’s bug bounty probably isn’t as lucrative as the ZDI scheme, and much less what’s available through underground exploit marketplaces, but it offers a more open and community-focussed exchange of research.

“The big difference between us and other bug bounties is that we’re actually going to publicly release the exploit after 60 days (author-permitting) so the community can test their patches from vendors as well, instead of just hoarding it for our own personal test arsenal,” Todd Jarvis, chief exec of Packet Storm Security, told El Reg. ®

Bootnote

* 0.5-day, in this context, means vulnerabilities that are publicly known but only recently patched. This is in contrast to 0-day, meaning vulnerabilities in the wild that are unpatched and unknown but exploited.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/18/packet_storm_bug_bounty/

Brits’ privates furtled in TWO-THIRDS of UK fraud cases

Two out of three fraud cases in the UK involved identity theft, according to Blighty’s Fraud Prevention Service, CIFAS.

Brits are reminded to guard their private data as closely as they guard their wallets and purses.

The new figures suggest fraud rose to a record level in the UK in 2012 as more and more crooks obtained people’s personal details and used them to pocket ill-gotten gains. Of the 248,325 fraud cases reported last year, 65 per cent involved stolen identities.

Crims gathered this sensitive information by hacking victims’ computers, intercepting letters or carrying out other scams. Armed with this sensitive data, the thieves would typically hijack bank accounts and siphon off cash, or masquerade as their victims by creating new accounts in their names to then rip off companies.

On the plus side, individuals using their own accounts to commit fraud was down by 15 percent.

Kate Beddington-Brown, a spokeswoman for CIFAS – a nonprofit that tracks crime figures to help businesses and the public sector prevent fraud, said organisations are now “ensuring extra steps are taken to validate the identity of people with whom they are dealing”. In the meantime, make sure you look after your own privates yourself. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/18/personal_data_fraud_2012/

VXers exploit users’ confusion over Java to punt fake update

Cybercrooks have begun distributing an item of malware that poses as a Java security update.

Oracle released a new version of Java 7 (Java 7u11) on Sunday (13 January) to addresses zero-day vulnerability that has been exploited in the wild. The update was important because the underlying exploit had been “weaponised” and bundled in widely available black market exploit kits in the week prior to Oracle’s security update.

The security flap generated plenty of attention, especially after US CERT warned that despite the update it remained a bad idea to run Java plugins in browsers.

Cybercrooks have latched onto this publicity by pushing out a fake Java security update, net security firm Trend Micro warns. The fake updater actually opens a backdoor onto Windows systems, providing users download and apply it.

“Though the dropped malware does not exploit CVE-2012-3174 or any Java-related vulnerability, the bad guys behind this threat is clearly piggybacking on the Java zero-day incident and users’ fears,” said Paul Pajares, fraud analyst at Trend Micro in a blog post. “The use of fake software updates is an old social engineering tactic.”

Trend advises users to obtain their Java security updates directly from Oracle rather than from third-party websites.

Earlier this week ads for a Java exploit that supposedly attacks a brand-new vulnerability were offered for sale through an underground hacking forum at $5,000 a pop. The ad has since been pulled. Although the claim from cybercrooks that they have discovered yet another unpatched Java security hole remains unsubstantiated, the potential threat is all too credible.

Metasploit founder HD Moore reckons that Oracle is sitting on a backlog of Java flaws that will take up to two years to patch, even without the appearance of further problems.

“The ‘two-year’ comment was based on the types of problems that have been found in Java over the last 12 months, namely sandbox escapes [achieved] by abusing reflection APIs,” Moore explained in an email to El Reg. “These types of flaws are difficult to find and sometimes even harder to fix. Oracle has already spent a year working through these issues based on the initial Security Explorations report, but will likely need another two years to fix them completely.”

Separately Trend Micro warned earlier this week that the latest Java security update may be incomplete. The update attempts to address two security bugs but fails to quash one of these completely.

The security firm advises users to avoid Java where possible, particularly as a plugin to their browsers, where the main danger arises. Users obliged to use Java, perhaps on the small percentage of sites which require it or for work-related reasons, can minimise their exposure by disabling Java on their main day-to-day browser and using a secondary browser with an enabled Java plugin solely for those sites. This tactic for minimising exposure to Java-based attacks is advocated by many security firms. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/18/fake_java_update/

You’re not cool enough for some malware

As part of a review of phishing in 2012, RSA has outlined how phishers are now using “whitelists” to narrow down their attacks.

In what the company calls “bouncer list” phishing, RSA writes that attackers are now using “black hat whitelists”. Only those on the target list will see the malware page crafted by the attackers (presuming they’re tricked into following a link): anybody else will get a 404 error.

“Much like many high-profile nighttime hotspots – if your name is not on the list, you’re staying out!” writes RSA’s Cybercrime and Online Fraud Communications Specialist Limor Kessem.

The phishing kit uses a list of intended recipients, generating a unique ID and web page for those on the list. When someone follows the link, their ID is checked on-the-fly, Kessem writes, and the target page is only generated for verified victims.

“After the kit collects victim credentials it sends them to yet another hijacked website (taken over using the exact same method of vulnerability exploit and web-shell), where the password-protected attack page lies in wait to steal user credentials.”

The point of all this is to narrow down the attack to “invited guests” – which, the attackers would hope, also delays the detection of the attack, since many detection systems respond best to large numbers of reported attacks. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/18/rsa_bouncer_list_phising/

AV-Test boss dismisses Microsoft criticism of malware test results

A war of words has broken out over security testing, with Microsoft and the AV-Test Institute going head-to-head over Redmond’s failure to qualify for the last round of certification from the German testers.

On Tuesday, AV-Test announced its December round of security software evaluations, and both Microsoft’s Security Essentials and its Forefront suite failed to achieve certification for the second month running. The next day, Microsoft questioned the results in an extended blog post by Joe Blackbird, program manager at Microsoft’s Malware Protection Center.

“Our review showed that 0.0033 percent of our Microsoft Security Essentials and Microsoft Forefront Endpoint Protection customers were impacted by malware samples not detected during the test,” Blackbird said. “In addition, 94 percent of the malware samples not detected during the test didn’t impact our customers.”

But Andreas Marx, CEO of AV-Test, told El Reg that one would expect this. “I’m not surprised that in testing two months later they get different results,” he said.

The AV-Test results show that Microsoft’s twin security programs protected against 100 per cent of known threats, as did every other security suite. The two packages produce low rates of false positives in comparison to the competition and are significantly lighter on processor load during operations.

But where Redmond is falling down is in protecting against zero-day attacks. Security Essentials and Forefront both scored last in this regard among all the suites tested, getting 78 per cent of zero-days apiece. Blackbird said that AV-Test attached too much importance to the zero-day threat in its metrics, since that section of the testing accounts for 50 per cent of the final score, but Marx argued that zero-day performance was crucial to real-world threats.

He explained that many security tests rely on the “wild list” of malware in circulation among the community, but that the samples can be 80-90 days old in some cases and will therefore have been supplanted by newer varieties of core malware routines. As such, testing against current threats is key to the institute’s metric.

AV-Test teams take malware that is minutes old, Marx explained, and run the data into the security testing suite. A testing process carried out by Microsoft much later would be bound to cover the malware tested, since samples would already have been reported.

“Today, every two seconds we see three new malware samples, which are summing up to a few million samples per month. Instead of looking at millions of samples, our focus is on the unique families,” Marx explained.

“Out of every family, we select recent samples in order to use them in our tests. So the impact of these samples is indeed low, however, the impact of the malware family is considerably high.”

Overall AV-Tests did show that the effectiveness of antivirus code has declined. With this latest batch of tests, the average zero-day malware blocking success rate was 92 per cent. That doesn’t sound too bad, but given the colossal amount of crooked code out there, it still represents a big problem – not to mention the ever-present threat of completely unknown families of malware coming online.

BitDefender, Kaspersky, and Norton topped December’s consumer security rankings from AV-Test, with Kaspersky, F-Secure, and Sophos getting the best scores for business protection. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/17/avtest_microsoft_test_dispute/