STE WILLIAMS

Internet Explorer becomes Korean election issue

Microsoft’s Internet Explorer market share may soon take a tumble in South Korea if presidential candidate Ahn Cheol-soo wins looming elections. The hot seat hopeful plans to abolish an anachronistic government crypto standard which has effectively locked users into Internet Explorer for over a decade.

At the tail end of the 1990s, the Korean government decided in its wisdom to develop a home-grown 128-bit SSL encryption standard to increase security around e-commerce.

SEED, as it was known, was then mandated for all online transactions.

The only problem with this new system was that it requires users to install Microsoft ActiveX plug-in to work and therefore needs Internet Explorer.

The result: a decade-long monopoly for IE as banking, shopping and other transactional sites were optimised specifically and exclusively for the Microsoft browser.

Although SEED was made non-mandatory back in 2010, its use is still widespread because the government-led approvals process for alternatives is so rigorous, according to Korea Times.

In the meantime, Internet Explorer market share in South Korea stands at a whopping 75 per cent as of October, with nearest rival Chrome down on 17 per cent, according to StatCounter. By contrast, IE is on just 26 per cent in Europe.

Protest group OpenWeb, which has challenged the Korean government over SEED in the courts, argues that the situation is not just anti-competitive and a massive hassle for individual users but also provides huge challenges to home-grown internet start-ups.

It said the following in a blog post:

Web pages riddled with quirks and bugs threaten end-users’ web accessibility. They are ‘enemies’ of free, open and fair internet. However, a country’s institutional and regulatory frameworks may also be mired with quirks and bugs. They threaten competing software companies’ market access to the country. Local software companies suffer as well. End-users, too.

Presidential hopeful Ahn set out his plans on Monday to support alternatives to SEED and put an end to the isolationist certificate system, according to the Wall Street Journal.

He should know what he’s talking about in the security space too, as the founder of popular Korean AV firm Ahn Lab.

The only threat to the plans could be his status as presidential hopeful.

The latest reports suggest independent candidate Ahn could be set to join forces with opposition party candidate Moon Jae In in a bid to stop ruling party candidate Park Geun Hye from winning election. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/11/14/ahn_lab_internet_explorer_seed_replace_korea/

Skype IDs hijackable by ANY FOOL who knows your email address

A vulnerability in Skype allows anyone to hijack its users’ accounts just by knowing or guessing a punter’s registered email address.

The embarrassing security hole, which is trivial to abuse, was first discussed on a Russian underground forum three months ago. Last night a Russian blog publicised the bug, and details of the flaw circulated the internet. The hijack is triggered by signing up for a new Skype account using the email address of another registered user. No access to the victim’s inbox is required; one just simply needs to know the address.

Creating an account this way generates a warning that the email address is already associated with another user, but crucially the voice-chat website does not prevent the opening of the new account. From there it’s possible to request a new password for the victim’s account; a security token is sent to the attacker’s Skype client, allowing the login credential to be reset.

Armed with this token, it is possible to download private chat logs for the compromised account while the actual owner is locked out.

In a holding statement, the Microsoft-owned VoIP biz confirmed it has disabled the password reset mechanism as a temporary measure:

We have had reports of a new security vulnerability issue. As a precautionary step we have temporarily disabled password reset as we continue to investigate the issue further. We apologize for the inconvenience but user experience and safety is our first priority.

This is a good move because, as Rik Ferguson of Trend Micro warns, the bug makes account hijacking “child’s play”.

“In essence the procedure is so simple it could be carried out by even the most inexperienced of computer users,” Ferguson explains. “All that was necessary was to create a new Skype ID, and associate it with the email address of your victim.

“Once this procedure is complete, a flaw in the password reset procedure allowed the attacker to assume control over the victim account by using the online password reset form. This would lock the victim out of their Skype account and allow the hacker to receive and respond to all messages destined for that victim until further notice. I tested the vulnerability and the entire process took only a matter of minutes.”

Before Skype temporarily disabled password resets, the only way to mitigate against the vulnerability was to register a secret email address with one’s Skype account. Costin Raiu, senior security researcher at Kaspersky Lab, reports that the Skype account of Russian opposition leader Alexey Navalny was hacked using the exploit. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/11/14/skype_disables_password_reset_bug/

Skype IDs hijackable by ANY FOOL who knows your email address

A vulnerability in Skype allows anyone to hijack its users’ accounts just by knowing or guessing a punter’s registered email address.

The embarrassing security hole, which is trivial to abuse, was first discussed on a Russian underground forum three months ago. Last night a Russian blog publicised the bug, and details of the flaw circulated the internet. The hijack is triggered by signing up for a new Skype account using the email address of another registered user. No access to the victim’s inbox is required; one just simply needs to know the address.

Creating an account this way generates a warning that the email address is already associated with another user, but crucially the voice-chat website does not prevent the opening of the new account. From there it’s possible to request a new password for the victim’s account; a security token is sent to the attacker’s Skype client, allowing the login credential to be reset.

Armed with this token, it is possible to download private chat logs for the compromised account while the actual owner is locked out.

In a holding statement, the Microsoft-owned VoIP biz confirmed it has disabled the password reset mechanism as a temporary measure:

We have had reports of a new security vulnerability issue. As a precautionary step we have temporarily disabled password reset as we continue to investigate the issue further. We apologize for the inconvenience but user experience and safety is our first priority.

This is a good move because, as Rik Ferguson of Trend Micro warns, the bug makes account hijacking “child’s play”.

“In essence the procedure is so simple it could be carried out by even the most inexperienced of computer users,” Ferguson explains. “All that was necessary was to create a new Skype ID, and associate it with the email address of your victim.

“Once this procedure is complete, a flaw in the password reset procedure allowed the attacker to assume control over the victim account by using the online password reset form. This would lock the victim out of their Skype account and allow the hacker to receive and respond to all messages destined for that victim until further notice. I tested the vulnerability and the entire process took only a matter of minutes.”

Before Skype temporarily disabled password resets, the only way to mitigate against the vulnerability was to register a secret email address with one’s Skype account. Costin Raiu, senior security researcher at Kaspersky Lab, reports that the Skype account of Russian opposition leader Alexey Navalny was hacked using the exploit. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/11/14/skype_disables_password_reset_bug/

Killing IE becomes Korean election issue

Microsoft’s Internet Explorer market share may soon take a tumble in South Korea if presidential candidate Ahn Cheol-soo wins looming elections. The hot seat hopeful plans to abolish an anachronistic government crypto standard which has effectively locked users into Internet Explorer for over a decade.

At the tail end of the 1990s, the Korean government decided in its wisdom to develop a home-grown 128-bit SSL encryption standard to increase security around e-commerce.

SEED, as it was known, was then mandated for all online transactions.

The only problem with this new system was that it requires users to install Microsoft ActiveX plug-in to work and therefore needs Internet Explorer.

The result: a decade-long monopoly for IE as banking, shopping and other transactional sites were optimised specifically and exclusively for the Microsoft browser.

Although SEED was made non-mandatory back in 2010, its use is still widespread because the government-led approvals process for alternatives is so rigorous, according to Korea Times.

In the meantime, Internet Explorer market share in South Korea stands at a whopping 75 per cent as of October, with nearest rival Chrome down on 17 per cent, according to StatCounter. By contrast, IE is on just 26 per cent in Europe.

Protest group OpenWeb, which has challenged the Korean government over SEED in the courts, argues that the situation is not just anti-competitive and a massive hassle for individual users but also provides huge challenges to home-grown internet start-ups.

It said the following in a blog post:

Web pages riddled with quirks and bugs threaten end-users’ web accessibility. They are ‘enemies’ of free, open and fair internet. However, a country’s institutional and regulatory frameworks may also be mired with quirks and bugs. They threaten competing software companies’ market access to the country. Local software companies suffer as well. End-users, too.

Presidential hopeful Ahn set out his plans on Monday to support alternatives to SEED and put an end to the isolationist certificate system, according to the Wall Street Journal.

He should know what he’s talking about in the security space too, as the founder of popular Korean AV firm Ahn Lab.

The only threat to the plans could be his status as presidential hopeful.

The latest reports suggest independent candidate Ahn could be set to join forces with opposition party candidate Moon Jae In in a bid to stop ruling party candidate Park Geun Hye from winning election. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/11/14/ahn_lab_internet_explorer_seed_replace_korea/

Lockheed to cyber-armour its supply chain against ‘the Adversary’

Top Pentagon supplier Lockheed Martin says its computer networks are under increasing heavy fire from hackers, forcing it to beef up its supply chain’s defences.

Lockheed veep and chief information security officer Chandra McMahon said about a fifth of the assaults were considered “advanced persistent threats”, which are attacks by a nation or well-organised group trying to steal data or mess up the firm’s operations.

“The number of campaigns has increased dramatically over the last several years,” McMahon told a news conference. “The pace has picked up.”

Not only are there more attacks, they’re also more sophisticated. And the hackers are targeting Lockheed’s suppliers to get the information they can’t steal from the main organisation’s networks, she added.

The famous cyber-attack against Lockheed in May 2011 was a result of hacks at two of its suppliers, McMahon said: RSA, the security division of EMC, and another firm.

“The adversary was able to get information from RSA and then they were also able to steal information from another supplier of ours, and they were able to put those two pieces of information together and launch an attack on us,” McMahon said.

“It’s just one example of how the adversary has been very significant and tenacious and has really been targeting the defence industrial base.”

She said Lockheed had been tracking that particular enemy for years before the attack and was able to stop it getting into its own systems. Now the company realises it has to share its knowledge with others in the defence sector and with suppliers. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/11/13/lockheed_to_help_suppliers_security/

Windows 8 security is like a swiss cheese flak jacket

The knives are out for Windows Defender, the basic anti-malware protection bundled with Windows 8: makers of rival antivirus products are lining up to criticise Microsoft’s efforts to secure its operating system.

Windows 8 can be infected by 16 percent of the most common malware families, even with Windows Defender activated, according to tests by Romanian antivirus vendor Bitdefender.

The latest version of Microsoft’s OS was compromised by 61 of 385 malware samples flung at it by BitDefender. In addition, one software nasty bypassed Windows Defender but crashed on execution, while another ran but was blocked by User Account Control (UAC), so no malicious payload was delivered.

Malware that successfully bypassed Windows Defender was capable of opening backdoors to allow hackers to remotely control the attacked x86 PC, intercepting keystrokes, stealing online gaming credentials, and more.

Bitdefender has a vested interest in talking up the security shortcomings of Windows 8 as it touts its own paid-for virus-zapping packages.

However, the company used malware collected over the last six months, which is not ideal: the test sample won’t include every threat, according to Simon Edwards, technical director at Dennis Technology Labs. And every antivirus product misses some software nasties from time to time, despite what marketing departments’ rhetoric would have us believe.

Bitdefender also tests malware by fetching a copy of the malicious code from an internal FTP server and executing it to see how far the malware progresses – as opposed to visiting a booby-trapped web page that attempts to comprise the PC, which is a more common method of infection. In theory, there should be little difference, but this methodology bypasses Windows Defender’s SmartScreen that filters out phishing attacks and malware downloads when using Internet Explorer.

By way of defence, a Bitdefender analyst told El Reg: “We did not rely on tests over the internet because they are highly subjective and their success rate is – most of the times – dependent on the tech skills of the user operating the PC; our goal was to see how vulnerable the system without the user’s intervention is. In other words we’ve simulated a hapless user.”

In addition, Bitdefender omitted to detect whether the successfully installed malware managed to survive a reboot on Windows 8. “Some of Windows 8’s security mechanisms should prevent Master Boot Records from being infected, which is one way the bad guys keep systems infected over time,” Edwards explained.

“All vendors have a very strong motivation to demonstrate that Windows 8 is vulnerable and that alternatives to [Windows] Defender are necessary to provide the best security. I suspect that testing will show they are right, but there aren’t any good tests published yet, as far as I know, so they’re probably trying to race each other to show this themselves.”

Microsoft Security Essentials in Windows 8

Security lab AV-Test, which sells analysis of malware to antivirus makers, also has reservations about Windows Defender following a preliminary review. The company drew its conclusions after throwing malicious code at Windows 7’s Microsoft Security Essentials, which has been rebranded Windows Defender in Windows 8. AV-Test plans to formally review the effectiveness of Windows 8’s built-in protection, and that offered by third-party security tools, in January.

“We saw rather similar results [to Bitdefender’s] in our tests when we look at Microsoft Security Essentials, which is actually the new Windows Defender in Windows 8,” the lab’s chief exec Andreas Marx told El Reg.

“Microsoft offers a basic protection in their OS, so it’s better than nothing, however the results are not good enough to replace existing free or paid security products.”

Marx added that at least Windows Defender is capable of repairing the operating system if damaged. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/11/13/win_defender_inadequate/

Petraeus sex’n’menaces webmail trail leads to NATO A’stan general

The top US Army commander in Afghanistan has been dragged into an investigation that led to the resignation of former CIA Director David Petraeus over an extramarital affair.

General John Allen faces allegations of allegedly inappropriate communication with Jill Kelley, a central figure in the unfolding scandal.

Kelley is a friend of the Petraeus family from Tampa, Florida, who serves as volunteer social liaison with military families at MacDill Air Force Base. Kelley’s complaint about email harassment prompted an investigation that led to Paula Broadwell, Petraeus’ biographer and secret lover.

Email records unearthed during the investigation exposed the affair and led to Petraeus’ resignation as America’s top spook on Friday.

The same investigation uncovered between 20,000 and 30,000 pages of communications – mostly emails sent between 2010 to 2012 – between Allen and Kelley, AP reports. The news agency cites an unnamed US official as a source of the shock revelation. The official declined to detail the nature of the allegedly inappropriate exchanges. The possibility that these exchange might, at least in part, have involved secrets therefore remains open.

Defense Secretary Leon Panetta and President Obama have agreed to delay Allen’s nomination to be Commander of U.S. European Command and Supreme Allied Commander Europe. He was due to face Senate confirmation hearings on Thursday. Plans to appoint General Joseph Dunford as Allen’s successor in Afghanistan have also been put on hold.

What began beck in May as a simple simple cyberstalking case has mushroomed into a full-blown national security investigation.

“While the matter is under investigation and before the facts are determined, General Allen will remain commander of ISAF,” Panetta told Reuters, referring to leadership of NATO’s force in Afghanistan – held by Petraeus before Allen took over the role.

The FBI have passed on the handling of the Allen case onto military investigators, the NYT reports. Allen reportedly denies any wrongdoing.

Love quadrangle?

According to various accounts, Petraeus engaged in an affair with Broadwell (after he left the military to become CIA chief) between September 2011 and the summer of 2012, apparently breaking off the relationship around the time he discovered that Broadwell had been harassing Kelley by email. Kelley had reported the anonymous threatening email to the FBI in spring, prompting an investigation.

The Feds traced the emails to Broadwell and began monitoring her communications, stumbling across the fact that Broadwell appeared to be exchanging intimate messages with Petraeus using a Gmail account. The lovers reportedly used shared access to the same Gmail account, set up by Petraeus under a pseudonym, to exchange sexy chitchat.

Messages sent between different account would have left an obvious trail to follow. So instead messages for each other were left in a draft folder, which the other partner read when they next logged into the account.

Broadwell maintained a Yahoo webmail address exposed by the Anonymous hack on private intelligence firm Strafor. As previously reported the fairly strong password she used for her Stratfor account was crackable by brute force alone, so if she made the mistake of using this password on other accounts then hackers could have obtain early access to some extremely juicy correspondence.

It seems Broadwell suspected Kelley of hitting on Petraeus and warned her to “stay away from” the general. These threatening messages may have included extracts of sexually suggestive messages sent by Petraeus. The messages also contained potentially sensitive information that prompted FBI investigators to delve deeper in the case, the BBC reports.

The FBI quickly escalated the investigation because the threatening emails regularly quoted detailed information about the private movements of generals involved with the US Central and Southern Commands. Both are run out of MacDill Air Force Base in Tampa.

The investigation almost stalled because the email accounts from which the messages originated had been registered anonymously. However, what was not concealed was the IP (internet protocol) address of the computers from which the messages were sent.

Investigators seem to have established that harassing e-mails sent to Kelley were sent from IP addresses traced to an address Broadwell shared with her husband in North Carolina. On other occasions the threatening emails were sent from locations or hotels where Broadwell was staying, allowing Feds to use location-based information to identify Broadwell as the likely culprit. At that point her electronic communications were more closely monitored and the illicit sex chat exchanges with Petraeus were exposed. Wired has more on how location-based data allowed Feds to uncover Petraeus’ affair here.

Investigators eventually obtained a warrant to search Broadwell’s computer, identifying secret documents on the system, Wired adds. Petraeus has been cleared of supplying these documents to Broadwell.

In yet another further twist it seems that the FBI agent who initiated the investigation was a friend of Kelley’s, and faces possible disciplinary action after allegedly getting too involved in the case. The Wall Street Journal adds that the as yet unnamed agent sent shirtless pictures of himself to Kelley before the investigation began.

The agent involved initially handed the case over to the bureau’s cyber crimes unit. However the agent didn’t leave things there instead relaying his concerns as the months passed that the investigation was been blocked by the Obama administration to a Republican member of congress, David Reichert. The agent is under investigation by the Office of Professional Responsibility over his conduct, which violated instructions by his superiors to leave the case alone, the WSJ adds. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/11/13/petraeus_probe/

Trend Micro squishes ‘stuck in a loop’ SafeSync bug

Trend Micro squishes ‘stuck in a loop’ SafeSync bug

  • alert
  • print
  • comment
  • tweet

Safesunk more like, grumbles user

Free whitepaper – The Benefits of a Hybrid Security Architecture

Trend Micro has issued software patches for its SafeSync product after some users complained that the software was not syncing files between two or more devices properly.

Posts of complaints on a user forum, and a tip from a Reg reader, suggested the software’s synchronisation of files between devices was not functioning and that a fix wouldn’t be available until the next version of the product was released.

SafeSync is a Dropbox-like file synchronisation product that is free to personal users but comes at a price (and with more features) for business users. The technology is designed to synch files between PCs, smartphones and tablets. In a statement (below), Trend said that the the issue was more that SafeSync gets “stuck in loop”, something that ought to be fixed with recent patches to its server and client-side SafeSync software.

We did recently identify some syncing issues between endpoints and these were promptly addressed by implementing hotfixes. The issue was not that files in general could not be synchronised between two PCs, but rather only some individual files were not being synchronised correctly between devices, causing SafeSync to be in a ‘continuous sync’ state.

Two server-side hotfixes were deployed on Oct 22 25 and one client hotfix was released through technical support on Oct 24.

As far as we can determine all customers that did experience such issues and reported them to support, have come back to say that SafeSync is synchronising correctly now. For any clients currently encountering issues, the new client build 5.1.0.1328 is available through technical support as required.

Trend is planning a separate revamp of its SafeSync client software, which is due to be published on 19 November.

Our tipster told The Reg that SafeSync would have better been described as SafeSunk during the duration of the problem. The source (who expressed a desire to remain anonymous) said the problem had persisted for several weeks. ®

Free whitepaper – Nemertes Research: Mobile Security Challenge Emerges

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/11/13/safesync_synchro_bug/

Devs cook up ‘leakproof’ all-Tor untrackable platform

Developers are brewing an anonymous general purpose computing platform, dubbed Whonix.

Whonix is designed to ensure that applications (such as Flash and Java etc) can only connect through Tor. The design goal, at least, is that direct connections (leaks) ought to be impossible. “This is the only way we know of that can reliably protect your anonymity from client application vulnerabilities and IP/DNS and protocol leaks,” the developers explain.

The main goal is to prevent the determination of users’ IP address and location. Not even malware that has buried deep into machines can access IP address information. In this way, Whonix aims to be safer than Tor anonymity software alone.

Whonix can be used in conjunction with VPN technology – routing networks through isolated remote computer networks – for even greater security.

The technology is better described as design approach or platform than as an operating system. In one example, the implementation of anonymity is provided around Tor on two virtual machines using VirtualBox and Debian GNU/Linux. Whonix can be installed on every computer capable of running Virtual Box (virtualisation software), so it supports Windows, OS X, Linux, BSD and Solaris. Running the technology on physically separate machines (a Whonix gateway and a Whonix workstation) would also work, and might provide greater security, say the devs.

The technology is currently only at an Alpha stage of early development, making it suitable for use only for the computing equivalent of test pilots.

In a post to a full disclosure mailing list last week, the main developer behind the project explains its goal and requests help from other members of the development community.

More details on the emerging computing platform can be found in a development Wiki here. The developers are pretty open about the tradeoff in using their technology (more complex set-up, potentially slower) as well as the anonymity advantages of their approach.

Paul Ducklin, head of technology in Asia Pacific for Sophos, said the approach followed by Whonix is different from the Live CDs associated with more traditional anonymity systems. This brings advantages as well as some drawbacks.

“Whonix is different from most existing ‘all-in-one anonymity’ systems inasmuch as the lead developer decided not to stick to the idea of a Live CD but to go with a set of virtual machines that don’t need to fit on a CD or to boot from one,” Ducklin explained.

“This allows much greater functionality and easier security updating.”

The main disadvantage is that Whonix is more complex than comparable systems.

“The safety and security of your Whonix environment is dependent on the safety and security of your host OS, of the virtualisation software and of its configuration,” Ducklin told El Reg. “The anonymity system then becomes, at worst, no more secure than the host itself. So you just took one problem (guest anonymity) and made it two problems (guest anonymity and host security).

“Whonix’s size also makes its internal surface area larger than is strictly necessary. That in turn brings its own risks.”

Ducklin added that there are many “tricks and traps of anonymity online”, many covered by the Whonix developer. He added that users would be well advised to review these before placing their faith in Whonix (or any other approach) to shield their identity online. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/11/13/whonix/

Even a CHILD can make a Trojan to pillage Windows Phone 8

A teenager has crafted prototype malware for Windows Phone 8 just weeks after the official unveiling of the smartphone platform.

The proof-of-concept code is due to be demonstrated by Shantanu Gawde at the International Malware Conference (MalCon) in New Delhi, India on 24 November. Gawde, who is a member of the Indian government-backed National Security Database program of infosec professionals, last year at the age of 15 created malware that attacked Microsoft’s Xbox Kinect.

Documents posted on the MalCon website ahead of the talk suggest Gawde has developed a Trojan that poses as a legitimate application before stealing users’ data, including contact numbers, text messages and photos.

Details are thin so it’s unclear whether the malware exploits a vulnerability in Windows Phone 8 or it simply tricks users into doing something daft, such as installing malicious code posing as a game or utility. The MalCon website announced:

The Windows Phone Malware prototype will demonstrate approaches and techniques for infecting the Windows Phone!. Demonstration will include how to steal contacts, upload pictures and steal private data of users, gain access to text messages etc.

MalCon is supposed to showcase next-generation malware research. Gawde has promised to share the prototype Windows Phone 8 malware with antivirus vendors after his demonstration, The Hacker News reports.

Windows Phone 8 is based on the Windows NT-derived family of kernels, and shares many components with Windows 8. It’s a radical change from previous builds of Windows for mobile devices, but as Gawde’s work suggests, the operating system is far from immune to security problems. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/11/13/windows_phone_8_malware/