STE WILLIAMS

Vid An alleged computer hacker implicated in the theft of millions of dollars from US banks accounts has been arrested in Bangkok, Thailand.

Hamza Bendelladj, 24, is accused of raiding private accounts held with 217 banks and financial companies worldwide in order to fund a lavish lifestyle. His alleged exploits reportedly propelled Bendelladj towards the top of an FBI most-wanted cyber-criminals list. The Feds has been tracking the computer science graduate for three years.

Bendelladj, originally from Algeria, was arrested at Bangkok’s Suvarnabhumi Airport after arriving from Malaysia for a connecting flight to Cairo, Egypt. He was later paraded before the world’s media, apparently untroubled by impending extradition proceedings and sported a wide grin – as this video shows:

“When asked what he did with the money, he said he spent it on traveling and a luxurious life like flying first class and staying in luxury places,” Thai Immigration Police chief Phanu Kerdlabphol told reporters, AFP reports. The Bankok Post said Thai police cuffed and detained Bendelladj following a tip-off from the FBI. It’s alleged Bendelladj’s main tools were a notebook computer and a satellite phone, the paper adds.

He now faces extradition from Thailand to the United States. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/08/cybercrook_suspect_thai_arrest/

The Los Alamos National Laboratory, home of some US research into nuclear weapons, has replaced networking kit from Chinese vendor H3C over security concerns, according to Reuters.

Reuters says it has read internal correspondence suggesting the removal of the H3C devices was undertaken as part of a wider review of risks posed by equipment suppliers, but that no specific threat posed by the devices was identified.

Instead, the kit seems to have been replaced on the basis of suspicion alone.

If that’s the case, it signals a new level of paranoia for US government entities about Chinese networking equipment vendors, given that H3C is now in HP’s hands.

The company ended up with HP after its genesis as a China-based joint venture between Huawei and 3Com. The former company tried to acquire 3Com in 2008, but was rebuffed by US authorities on security grounds. HP later scooped up 3Com in 2010.

The removal of the kit from Los Alamos shows US authorities are keen on Congress’ assessment that Huawei and ZTE should not be allowed to sell their products from sea to shining sea.

Both companies have objected strongly to that assessment, attributing it to protectionism and/or insisting they are in no way puppets of the Chinese regime.

It’s also worth pointing out that, to date, no-one has detected – or detected and publicised – either a stream of packets flowing from a Chinese networking device to an unintended destination or a back door Chinese vendors can access without users’ knowledge.

The lack of a smoking gun hasn’t stopped Australia from barring Huawei from supplying any products for its national broadband network, a decision made not long after a visit by President Obama said at the time to have included very high-level briefings on Chinese networking vendors.

Elsewhere, Huawei has been rather better received, with the company sinking huge sums into a UK RD centre. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/08/us_nuke_lab_dumps_h3c_kit/

A US government website was broken into by hackers exploiting a directory traversal vulnerability, according to security researchers.

Hacktivist group NullCrew announced it compromised studyinthestates.dhs.gov, a US Department of Homeland Security website, on Friday. The site advises foreigners seeking permission to study at American schools, colleges and universities.

The website was vulnerable to a directory traversal vulnerability, a class of bug that allows visitors to poke around a website server’s file system and access sensitive files, according to Paul Ducklin of Sophos.

This particular programming flaw allowed anyone to pull up a configuration file, which included a database password, for the WordPress blogging software used by the Study in the States website. The data was then dumped onto a public Pastebin page.

“In really bad cases, attackers might even be able to hoist themselves out of your web server’s directory tree altogether, and into the rest of the filing system,” said Ducklin, Sophos’s head of technology for Asia Pacific. “This might give them access to password and configuration files for the operating system itself, or for other software running on the same server.”

Ducklin went on to detail what is believed to be the vulnerability in the DHS web code:

Poor handling of upward-leading filenames seems to have been what was wrong on the Study in the States website. It looks as though a PHP script responsible for a download repository was incautious in its argument handling. A URL of the sort: http://example.org/known/dir/download.php?file=somename.dat could be abused with a request like this: http://example.org/known/dir/download.php?file=../../private.dat

This, it seems, caused the ill-configured download script to navigate upwards in the web server’s directory tree, retrieving from the inside a file that would have been blocked if it had been downloaded directly from the outside.

The fault seems to have been patched now, but if NullCrew are to be believed (and let’s assume they are), this hole was used to fetch the WordPress configuration file, apparently including the backend database location and password. This configuration file was then published on a publicly available drop site.

Ducklin added that, although the directory traversal vulnerability that apparently facilitated NullCrew’s hack has been plugged, other problems remain: the Study in the States website is running Apache 2.2.3 on Red Hat and PHP 5.3.3. These are not the latest version numbers for the web server and scripting language platform and thus they may need up-to-date patches, plus other sites would do well to learn lessons from the minor DHS website’s mistakes, Ducklin added. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/07/nullcrew_dhs_hack/

Infosec daredevil John McAfee claims he became a spymaster in Belize after giving laptops infected with espionage malware to police and government officials.

McAfee, who moved to the central American low-tax haven some years ago, further claimed he supervised a ring of 23 women and six men as operatives, and tasked them with striking up relationships with targets and extracting secrets.

The eccentric millionaire hatched the scheme after a crack Belizean cop squad raided one of his properties, shot one his dogs and seized hundreds of thousands of dollars in kit. The Gang Suppression Unit was searching for a supposed meth lab and guns but found nothing. No charges were brought but the incident put the founder of antivirus biz McAfee Inc at loggerheads with the authorities.

In a quest to exact revenge after receiving no apology for the bungled bust, McAfee to set himself up as a spymaster, as he explained in a lengthy blog entry of his official WhoIsMcafee.com blog:

I purchased 75 cheap laptop computers and, with trusted help, installed invisible keystroke logging software on all of them – the kind that calls home (to me) and disgorges the text files. It also, on command, turns on and off the microphone and camera – and sends these files on command.

I had the computers re-packaged as if new. I began giving these away as presents to select people – government employees, police officers, cabinet minister’s assistants, girlfriends of powerful men, boyfriends of powerful women.

I hired four trusted people full time to monitor the text files and provide myself with the subsequent passwords for everyone’s email, Facebook, private message boards and other passworded accounts. The keystroke monitoring continued after password collection, in order to document text input that would later be deleted. So nothing was missed…

I next collected my human resources for the complex social engineering I would have to do. I arranged with 23 women and six men to be my operatives. Eight of the women were so accomplished that they ended up living with me. It was amazingly more efficient and they were easily convinced to check up on each other. One was so accomplished that she became a double agent and nearly got me killed.

The tech tycoon claimed he infiltrated two national telcos using his operatives in order to tap the phone lines of his enemies. He further claimed various social engineering tricks were put into play.

In all, McAfee reckons he set up an extensive spook network with tentacles into every aspect of life in Belize. By his own account, the malware maverick was looking for evidence of corruption to turn the tables on those who trashed his property.

But what he apparently found was details of extramarital affairs and far more disturbing information. He alleged data uncovered showed that officials were helping Hezbollah-aligned terrorists to get Belizean passports and identification cards.

Mostly this supposed intelligence came from electronic taps on immigration department computers but McAfee claims he had some human intelligence as well:

I had located an individual working in immigration who was trustworthy and willing to talk. I discovered that an average of eleven Lebanese males were given new identities each month. One month there were sixteen.

McAfee claims he sent one of his female operatives to befriend one of these Lebanese militants, who supposedly turned out to be sexually violent and intent on using Belizean papers to gain entry to the United States:

Belize is clearly the central player in a larger network whose goal is to infiltrate the US with individuals having links to terrorist organizations. What is different today from the wholesale Belizean passport selling of ten years ago, is that the false citizenships that are created for these men are coupled with a network of handlers designed to move the individuals, and their cargo, into the US

Next page: ‘I’m not an idiot… the US government is letting the ricin plot happen’

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/07/john_mcafee_spymaster/

A security researcher has developed a method to circumvent Microsoft’s temporary fix for a zero-day Internet Explorer browser vulnerability.

Redmond release a temporary Fix It to defend against the flaw last week, pending the development of a more complete patch which it later emerged would not arrive with updates due to be delivered on Patch Tuesday tomorrow. However, Peter Vreugdenhil, of the vulnerability analysis firm Exodus Intelligence was able to sidestep that protection with a variation of a variation of a proof-of-concept exploit it developed to attack the IE bug.

“After less than a day of reverse-engineering, we found that we were able to bypass the fix and compromise a fully-patched system with a variation of the exploit we developed earlier this week,” Vreugdenhil explained in a blog post.

The development will increase pressure for Redmond to develop a patch sooner rather than later. The vulnerability is older versions of Microsoft’s browser software has been used to mount attacks on surfers visiting the Council for Foreign Relations website and other internet locations including Capstone Turbine, a US manufacturer of gas-powered micro-turbines. If security analysts at Exodus Intelligence can circumvent the fix then the implication is that cybercriminals might be able to do something similar, leaving the FixIt redundant. Exodus has reported its findings to Microsoft as well as making details of its discovery available to customers of its security feed.

The CVE-2012-4792 vulnerability affects IE6, IE7 and IE8 – obsolete but still widely used versions of Microsoft’s web browser software browsers, released between 2006 and 2009. Both IE 9 and 10 are immune to attack, so upgrading or switching to alternative browser software is the best approach to take, especially for consumers. Enterprise workers may need older versions of IE to access (internal) intranet applications, hence the need to develop patches rather than simply encouraging everyone to upgrade. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/07/ms_ie_bug_fix_bypassed/

Ubisoft is investigating a recent spate of hijackings of gaming accounts belonging to users of its Uplay platform.

Complaints about account hijacking flared up around 30 December, leading to numerous posts on support forums. “There is no one at Ubi manning the support system, and the DRM requires access to your account,” one victim, who tipped us off about the problem, told El Reg.

Many of the compromised accounts have had their email addresses changed to uplay[somenumber]@playbay.su, suggesting one group of hackers (or perhaps an individual) is behind the attack. An official update to Ubisoft’s Facebook support page said the games publisher has begun investigating the problem.

We are investigating the origin of these hijackings. In the mean time, if you have had your account compromised make sure you check and change the passwords of all of your important online services. We’ve heard people mention services like Yahoo, Amazon, and EA were also compromised at the same time.

To make your Uplay account more secure, link Facebook. This is my personal suggestion. If you have a Facebook account attached you can always go back to uplay.com and take your account back because the user cannot unlink this account.

Customer support is here to help while the security team works on it and we are giving the accounts back to the rightful owners.

Rumours are flying around that Ubisoft’s UPlay service was hacked by Russian hackers but these rumors are unsubstantiated and probably best ignored until a clearer picture of what’s happening emerges.

“While there’s a rash of account compromises being listed on the Ubisoft forums and Facebook page, I’m not seeing much on dedicated gaming portals with high traffic such as the Steam forum, NeoGAF and elsewhere,” said Chris Boyd AKA PaperGhost, a senior threat researcher at GFI Software and an expert in gaming security.

“Additionally, many users deny using so-called ‘trainers’ (cheat programs) which might have been emailing credentials back to base so there’s not a lot to go on at the moment. One of the biggest problems with PC gaming is the amount of logins required to play the games – anyone purchasing Ubisoft’s Far Cry 3 through Steam will still need to load UPlay to play it. It’s quite possible that password reuse is rampant in gaming circles right now, which certainly doesn’t help.”

An informative blog post by Boyd on gaming account login overload can be found here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/04/ubisoft_gaming_account_hijack_caper/

German firm Tchibo has admitted to selling a photographic slide scanner that came pre-packaged with malware.

The €60 (£48) 35mm slide scanner, sold by retail outlets and through Tchibo’s online store, and manufactured by electronics accessory maker Hama, was infected with the infamous Conficker worm.

In an advisory to customers, Tchibo offered affected customers refunds while pointing out that the device can be safely used after the virus has been removed with a modern antivirus application.

Conficker-B is present on the DCIM.exe and autorun.inf files of infected devices, Heise Security reports. Two years ago, Microsoft disabled the Autorun feature that served as worm bait during the original Conficker outbreak of 2009, so running the executable is the most likely means of infection.

Cases where consumer electronic devices are sold pre-infected with malware are far from infrequent. Normally the problem stems from an infected computer passing on the pox during the manufacturing or testing process. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/04/slide_scanner_malware/

Ubisoft is investigating a recent spate of hijackings of gaming accounts belonging to users of its Uplay platform.

Complaints about account hijacking flared up around 30 December, leading to numerous posts on support forums. “There is no one at Ubi manning the support system, and the DRM requires access to your account,” one victim, who tipped us off about the problem, told El Reg.

Many of the compromised accounts have had their email addresses changed to uplay[somenumber]@playbay.su, suggesting one group of hackers (or perhaps an individual) is behind the attack. An official update to Ubisoft’s Facebook support page said the games publisher has begun investigating the problem.

We are investigating the origin of these hijackings. In the mean time, if you have had your account compromised make sure you check and change the passwords of all of your important online services. We’ve heard people mention services like Yahoo, Amazon, and EA were also compromised at the same time.

To make your Uplay account more secure, link Facebook. This is my personal suggestion. If you have a Facebook account attached you can always go back to uplay.com and take your account back because the user cannot unlink this account.

Customer support is here to help while the security team works on it and we are giving the accounts back to the rightful owners.

Rumours are flying around that Ubisoft’s UPlay service was hacked by Russian hackers but these rumors are unsubstantiated and probably best ignored until a clearer picture of what’s happening emerges.

“While there’s a rash of account compromises being listed on the Ubisoft forums and Facebook page, I’m not seeing much on dedicated gaming portals with high traffic such as the Steam forum, NeoGAF and elsewhere,” said Chris Boyd AKA PaperGhost, a senior threat researcher at GFI Software and an expert in gaming security.

“Additionally, many users deny using so-called ‘trainers’ (cheat programs) which might have been emailing credentials back to base so there’s not a lot to go on at the moment. One of the biggest problems with PC gaming is the amount of logins required to play the games – anyone purchasing Ubisoft’s Far Cry 3 through Steam will still need to load UPlay to play it. It’s quite possible that password reuse is rampant in gaming circles right now, which certainly doesn’t help.”

An informative blog post by Boyd on gaming account login overload can be found here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/04/ubisoft_gaming_account_hijack_caper/

Google and other browser vendors have taken steps to block an unauthorized digital certificate for the ” *.google.com” domain that fraudsters could have used to impersonate the search giant’s online services.

According to a blog post by software engineer Adam Langley, Google’s Chrome team first discovered a site using the fraudulent certificate on Christmas Eve. Upon investigation, they were able to trace the phony credential back to Turkish certificate authority Turktrust, which quickly owned up to the problem.

It seems that in August 2011, Turktrust mistakenly issued two intermediate certificates to one of its customers, instead of the ordinary SSL certificates it should have issued. It was one of these more trusted certificates that allowed the customer to generate the fake ” *.google.com” certificate, unbeknownst to Turktrust or Google.

Armed with such a certificate, attackers can potentially create fraudulent websites that pose as Google websites, which can then be used to spoof content, launch phishing attacks, or perform man-in-the-middle attacks to intercept data from Google services.

Such attacks would be more insidious than your garden-variety online fraud because the spoofed certificate would cause users’ browsers to report the fake sites as genuine.

According to Turktrust’s own website, “Turktrust is the one and only local enterprise in Turkey that is recognized by Microsoft (Internet Explorer), Mozilla (Firefox), Opera and Safari web browsers and whose SSL server certificates are valid throughout the world.”

That status could be in jeopardy, however, because the only solution to the spoofed-certificate problem, now that the cat is out of the bag, is to revoke the authority of some or all certificates issued by Turktrust.

On Thursday, Google’s Langley said that the search giant has already updated the certificate-revocation metadata of its Chrome browser to invalidate both of Turktrust’s wrongly-issued intermediate certificates – one on Christmas Day and the other the day after – and that further actions are forthcoming.

“Given the severity of the situation, we will update Chrome again in January to no longer indicate Extended Validation status for certificates issued by Turktrust, though connections to Turktrust-validated HTTPS servers may continue to be allowed,” Langley wrote.

In a separate security advisory, Microsoft said it had similarly updated the Certificate Trust List to revoke the authority of the problem certificates for all supported versions of Windows, which currently means Windows XP Service Pack 3 and later.

But the Mozilla Foundation went even further, not merely revoking the two certificates, but also suspending inclusion of Turktrust’s root certificate with the Firefox browser “pending further review.”

“We are concerned that at least one of the mis-issued intermediate certificates was used for man-in-the-middle (MITM) traffic management of domain names that the customer did not legitimately own or control,” Mozilla director of security assurance Michael Coates wrote in a blog post. “We are also concerned that the private keys for these certificates were not kept as secure as would be expected for intermediate certificates.”

As usual, users of all browsers are advised to make sure they are up to date with the latest security fixes, although some browsers – such as Chrome – install such fixes automatically.

Coates added that any additional action regarding Turktrust would be discussed in the Mozilla Foundation’s mozilla.dev.security.policy forum. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/04/turkish_fake_google_site_certificate/

Microsoft has issued its pre–Patch Tuesday report, saying it will issue seven patches fixing 12 code flaws next week – but it won’t provide a permanent fix for the exploit discovered during the recent holidays that is already being used in the wild.

“With 2013 starting on a Tuesday, our monthly bulletin release is upon us a bit earlier than usual,” says Dustin Childs, group manager of Microsoft Trustworthy Computing.”

“Next Tuesday we’ll release seven bulletins; two Critical and five Important, which address 12 vulnerabilities. The Critical-rated bulletins address issues in Microsoft Windows, Office, Developer Tools and Microsoft Server Software.”

The full patches, along with advisory notices for IT managers on the recommended deployment strategy, will be released on January 8 at 10am PST (6pm UTC.)

One rather glaring omission from the list, however, are any fixes for the recently discovered problems with Internet Explorer. Over the Christmas/Saturnalia/Kwanzaa/Festivus/Chanukah holidays, researchers at FireEye found a flaw that allows code injection via infected websites, and warned that it is currently being exploited by online criminals.

Microsoft issued a security alert on the matter on December 29, two days after the full report, and issued a workaround for the problem that should keep browsers safe. But this evidently wasn’t enough time to get a proper fix out there.

Cynics might suggest that the flaw isn’t too high on Microsoft’s To Do list since it only affects older versions of its browser. But, given the amount of testing required for each new patch across all Microsoft’s operating systems, it was unlikely we’d see a full patch for the most recent flaw this month.

Questions will be asked if it isn’t sorted out by next month, however.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/01/04/microsoft_patch_tuesday/