STE WILLIAMS

The Internet Engineering Task Force (IETF) aims to strengthen the basic protocols of the internet, with a way to stop route, or IP, hijacking. IETF experts say the proposed fix is simpler to implement than previous suggestions.

IP hijacking exploits a fundamental weakness of the internet, Data and messages sent across the internet are transmitted via routers, and those routers are blindly trusted. No measures are in place to verify if they have been tampered with to re-direct or intercept traffic.

In 2008, Pakistan Telecom took advantage of this blind trust to send YouTube briefly into a global blackhole. CNET’s Declan McCullagh wrote at the time:

By accident or design, the company broadcast instructions worldwide claiming to be the legitimate destination for anyone trying to reach YouTube’s range of Internet addresses.

The security weakness lies in why those false instructions, which took YouTube offline for two hours on Sunday, were believed by routers around the globe. That’s because Hong Kong-based PCCW, which provides the Internet link to Pakistan Telecom, did not stop the misleading broadcast – which is what most large providers in the United States and Europe do.

Traffic mismanagement

The same fundamental weakness in BGP (Border Gateway Protocol), a core routing protocol that maps preferred paths for traffic to flow over the internet, was used to hijack the network at the Defcon hacker conference in Las Vegas in 2008. Everything looked the same to delegates after the hijack, but all unencrypted traffic sent over the network was open to wiretapping.

In 2010, China Telecom rerouted up to 15 per cent of the world’s internet destinations on two brief occasions, using false BGP route information to direct traffic through its own networks.

The hijackings sparked a security scare in the US. Even without the China dimension, America’s dismay is understandable:

The [April 8] hijacking, which lasted 18 minutes, affected email and web traffic traveling to and from .gov and .mil domains, including those for the US Senate, four branches of the military, the office of the secretary of defense, and NASA, among other US governmental agencies, according to the report. It also affected traffic for large businesses, including Dell, IBM, Microsoft and Yahoo.

Similar tricks might be used to steal corporate communications, without leaving a trace or even, at least theoretically, making entire countries unreachable via IP communications. BGP has no built-in security. Routers might accept bogus routes from peers, internet exchanges or transit suppliers. Dodgy routers, however accepted, can have local, regional or global effects.

“Someone can advertise your address space and a route to get there and routers don’t know any better,” explained Joe Gersch of Secure64, a Domain Name System vendor. “They are just looking for the shortest path.”

“It doesn’t necessarily have to be malicious for something to go wrong. It could be accidental. Admins could type something wrong into router and this information would still propagate.”

The issue has been known for about 10 years but previous attempts to find a fix floundered because proposed solutions were too complex or too expensive, Gersch says. More recently, governments have taken greater interest in the issue, increasing the pressure to find a fix.

Look it up

At an IETF meeting in Paris last month, a working group proposed a solution that seeks to safeguard the integrity of networking kit.

The proposal involves publishing preferred routes to sites in DNS records before applying a second step, using utilities to verify that the instructions are trustworthy.

This latter step would use DNSSEC, or DNS Security Extensions, a separate security mechanism which is gradually rolling out as a defence against cache-poisoning attacks.

The whole scheme is called ROVER, or BGP Route Origin Verification (via DNS).

Rover calls for the use of reverse DNS records to periodically publish route announcements, a process that would be done by sites themselves, before carrying out real-time verifications of BGP route announcements.

Rover uses “best effort” data retrieval with worldwide data distribution, redundancy and local caching. If the data is unreachable, the default is that routing would proceed as normal but without any checks.

Gersch said the working group (the Secure Inter-domain Routing Group, of which he is a member) believes the proposed approach has the potential to succeed because of its simplicity, in contrast with other ideas such as BGPSec or RPKI.

“Rover is a simpler method to publish your authoritative data,” Gersch explained. “I own it, and you can look it up. The process can be automated.”

Gersch described Rover as an “enabling technology”. Preliminary discussions have already been held with members of Cisco’s secure networking group on how to interface the technology with routers.

Several early adopter telcos and ISPs are in the process of publishing route origins in their reverse DNS and signing with DNSSEC. In addition, Secure64 has established a Rover Testbed available at “rover.secure64.com” (registration required).

Deployment of Rover is simple, as no changes need be made to existing routers, IOS or policies, according to backers of the technology. The system builds on DNSSEC, which firms ought to be deploying anyway – although in practice roll-out have been slow.

The Secure Inter-domain Routing Group at the IETF has worked on alternatives to Rover such as BGPSec and RPKI for at least six years.

“Rover uses something that’s already there, DNSSEC crypto keys, rather than having to build out a new system,” Gersch explained.

“All the ideas for preventing IP hijacking are proceeding forward. The systems can co-exist but I still expect there will be a fierce debate over which is best,” he added. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/23/ip_hijack_prevention/

Hackers claiming to be from Anonymous have taken down the official Formula One website as protests grow over this weekend’s controversial Grand Prix in the Kingdom of Bahrain.

“The F1 Grand Prix in Bahrain should be strongly opposed. The Al Khalifa regime stands to profit heavily off the race and has promised to use live ammunition against protestors in preparation,” the group said in a statement.

“They have already begun issuing collective punishment to entire villages for protests and have promised further retribution ‘to keep order’ for the F1 events in Bahrain. The Formula 1 racing authority was well-aware of the Human Rights situation in Bahrain and still chose to contribute to the regime’s oppression of civilians and will be punished.”

The statement also called for the release of Abdulhadi Alkhawaja, a prominent local human rights activist who was arrested at his home in April 2011 and sentenced to life in prison two months later on charges of aiding terrorist organizations. Amnesty International has declared him a ‘prisoner of conscience’ and he is now in the 70th day of a hunger strike.

So far the race looks like it will be going ahead anyway, although some members of the Force India team have left the country following an incident earlier in the week where they were caught in a riot and tear gassed. The country’s Crown Prince said to cancel the race now would “empower extremists,” Reuters reports.

Bahrain was the first Middle Eastern state to hold a Formula One race in 2004 and the ruling family has a significant stake in the McLaren racing team. The 2011 race was cancelled after protests erupted across the country.

The protests began on Valentine’s Day last year, as part of the wave of uprisings across the Arab world. While uprisings in Tunisia, Egypt and Libya were successful (with some help from NATO in the last case,) the Bahraini uprising, which saw over 100,000 people take to the streets, was quickly crushed when the royal family asked the Saudi Arabian army to intervene. The US Navy 5th Fleet, which is based in Bahrain, did not take part.

After the initial uprising the former Metropolitan Police assistant commissioner John Yates, who resigned after being heavily criticized for his conduct of an investigation into the News of The World hacking scandal, was hired by the Bahraini royal family to investigate human rights abuses that may or may not have taken place.

Yates reportedly wrote to Formula One boss Jean Todt earlier this month, telling him that the protests were not as serious as the media was reporting and said he felt safer in Bahrain than he did in some parts of London.

“These are criminal acts being perpetrated against an unarmed police force who, in the face of such attacks, are acting with remarkable restraint,” he wrote. “They are not representative of the vast majority of delightful, law-abiding citizens that represent the real Bahrain that I see every day.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/20/f1_anonymous_bahrain/

Five weeks after a man was cuffed by police for swiping around 10,000 records of women who registered with British Pregnancy Advisory Service (BPAS), the site remains under sustained hack attempts, the BBC reports.

The man in question – 27-year-old James Jeffery from Wednesbury, West Midlands – was jailed for two years and eight months over a hacking attack against Britain’s biggest abortion provider in March this year.

But since his arrest, the BBC said that other unsuccessful hack attempts on BPAS’s systems have happened around 2,500 times, with around half of the IP addresses of the computers used originating from the US, which did not mean that all or indeed any of the miscreants were necessarily located Stateside.

The abortion provider – which also provides emergency contraception, free pregnancy testing and vasectomy services – said that the details of women who had registered with the site were safeguarded against the failed attacks.

At the time of Jeffery’s sentencing earlier this week, BPAS chief executive Ann Furedi said:

“This was one of the most extreme examples of anti-abortion activity we have seen. We are grateful to the police for the swift action they took to apprehend Mr Jeffery and are glad the matter is now resolved.”

The provider hears from roughly 60,000 women and supervises around 53,000 abortions in the UK each year. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/20/bbc_says_2500_attempts_made_to_hack_bpas/

Five weeks after a man was cuffed by police for swiping around 10,000 records of women who registered with British Pregnancy Advisory Service (BPAS), the site remains under sustained hack attempts, the BBC reports.

The man in question – 27-year-old James Jeffery from Wednesbury, West Midlands – was jailed for two years and eight months over a hacking attack against Britain’s biggest abortion provider in March this year.

But since his arrest, the BBC said that other unsuccessful hack attempts on BPAS’s systems have happened around 2,500 times, with around half of the IP addresses of the computers used originating from the US, which did not mean that all or indeed any of the miscreants were necessarily located Stateside.

The abortion provider – which also provides emergency contraception, free pregnancy testing and vasectomy services – said that the details of women who had registered with the site were safeguarded against the failed attacks.

At the time of Jeffery’s sentencing earlier this week, BPAS chief executive Ann Furedi said:

“This was one of the most extreme examples of anti-abortion activity we have seen. We are grateful to the police for the swift action they took to apprehend Mr Jeffery and are glad the matter is now resolved.”

The provider hears from roughly 60,000 women and supervises around 53,000 abortions in the UK each year. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/20/bbc_says_2500_attempts_made_to_hack_bpas/

Five weeks after a man was cuffed by police for swiping around 10,000 records of women who registered with British Pregnancy Advisory Service (BPAS), the site remains under sustained hack attempts, the BBC reports.

The man in question – 27-year-old James Jeffery from Wednesbury, West Midlands – was jailed for two years and eight months over a hacking attack against Britain’s biggest abortion provider in March this year.

But since his arrest, the BBC said that other unsuccessful hack attempts on BPAS’s systems have happened around 2,500 times, with around half of the IP addresses of the computers used originating from the US, which did not mean that all or indeed any of the miscreants were necessarily located Stateside.

The abortion provider – which also provides emergency contraception, free pregnancy testing and vasectomy services – said that the details of women who had registered with the site were safeguarded against the failed attacks.

At the time of Jeffery’s sentencing earlier this week, BPAS chief executive Ann Furedi said:

“This was one of the most extreme examples of anti-abortion activity we have seen. We are grateful to the police for the swift action they took to apprehend Mr Jeffery and are glad the matter is now resolved.”

The provider hears from roughly 60,000 women and supervises around 53,000 abortions in the UK each year. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/20/bbc_says_2500_attempts_made_to_hack_bpas/

Five weeks after a man was cuffed by police for swiping around 10,000 records of women who registered with British Pregnancy Advisory Service (BPAS), the site remains under sustained hack attempts, the BBC reports.

The man in question – 27-year-old James Jeffery from Wednesbury, West Midlands – was jailed for two years and eight months over a hacking attack against Britain’s biggest abortion provider in March this year.

But since his arrest, the BBC said that other unsuccessful hack attempts on BPAS’s systems have happened around 2,500 times, with around half of the IP addresses of the computers used originating from the US, which did not mean that all or indeed any of the miscreants were necessarily located Stateside.

The abortion provider – which also provides emergency contraception, free pregnancy testing and vasectomy services – said that the details of women who had registered with the site were safeguarded against the failed attacks.

At the time of Jeffery’s sentencing earlier this week, BPAS chief executive Ann Furedi said:

“This was one of the most extreme examples of anti-abortion activity we have seen. We are grateful to the police for the swift action they took to apprehend Mr Jeffery and are glad the matter is now resolved.”

The provider hears from roughly 60,000 women and supervises around 53,000 abortions in the UK each year. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/20/bbc_says_2500_attempts_made_to_hack_bpas/

Five weeks after a man was cuffed by police for swiping around 10,000 records of women who registered with British Pregnancy Advisory Service (BPAS), the site remains under sustained hack attempts, the BBC reports.

The man in question – 27-year-old James Jeffery from Wednesbury, West Midlands – was jailed for two years and eight months over a hacking attack against Britain’s biggest abortion provider in March this year.

But since his arrest, the BBC said that other unsuccessful hack attempts on BPAS’s systems have happened around 2,500 times, with around half of the IP addresses of the computers used originating from the US, which did not mean that all or indeed any of the miscreants were necessarily located Stateside.

The abortion provider – which also provides emergency contraception, free pregnancy testing and vasectomy services – said that the details of women who had registered with the site were safeguarded against the failed attacks.

At the time of Jeffery’s sentencing earlier this week, BPAS chief executive Ann Furedi said:

“This was one of the most extreme examples of anti-abortion activity we have seen. We are grateful to the police for the swift action they took to apprehend Mr Jeffery and are glad the matter is now resolved.”

The provider hears from roughly 60,000 women and supervises around 53,000 abortions in the UK each year. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/20/bbc_says_2500_attempts_made_to_hack_bpas/

Five weeks after a man was cuffed by police for swiping around 10,000 records of women who registered with British Pregnancy Advisory Service (BPAS), the site remains under sustained hack attempts, the BBC reports.

The man in question – 27-year-old James Jeffery from Wednesbury, West Midlands – was jailed for two years and eight months over a hacking attack against Britain’s biggest abortion provider in March this year.

But since his arrest, the BBC said that other unsuccessful hack attempts on BPAS’s systems have happened around 2,500 times, with around half of the IP addresses of the computers used originating from the US, which did not mean that all or indeed any of the miscreants were necessarily located Stateside.

The abortion provider – which also provides emergency contraception, free pregnancy testing and vasectomy services – said that the details of women who had registered with the site were safeguarded against the failed attacks.

At the time of Jeffery’s sentencing earlier this week, BPAS chief executive Ann Furedi said:

“This was one of the most extreme examples of anti-abortion activity we have seen. We are grateful to the police for the swift action they took to apprehend Mr Jeffery and are glad the matter is now resolved.”

The provider hears from roughly 60,000 women and supervises around 53,000 abortions in the UK each year. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/20/bbc_says_2500_attempts_made_to_hack_bpas/

Non-profit Riseup claims the FBI has seized a Mixmaster server from a colo shared by Riseup Networks in New York City.

The organization has issued a media release linking the siezure to investigations into Mixmaster as part of its investigation into ongoing bomb threats against the University of Pittsburgh.

The university has received more than 90 bomb threats since February.

According to Riseup, another user of the facility, May First/People Link, says the server was removed under an FBI search warrant. As well as a Mixmaster remailer, Riseup claims the server, operated by the European Counter Network, hosted an Italian cyber rights mailing list and a Mexican migrant solidarity group.

“Over 300 e-mail accounts, between 50-80 email lists, and several other Websites have been taken off the Internet by this action,” Riseup says. “None are alleged to be involved in the anonymous bomb threats.”

Riseup also criticizes the action on the basis that the Mixmaster server is unlikely to yield any useful information, because the anonymous remailer “does not record logs of connections, details of who sent messages, or how they were routed”. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/19/mixmaster_servers_seized/

Computer scientists in Ireland have developed a technology for Google Docs that allows for the “real-time” encryption of data before it is uploaded to the Google servers.

The CipherDocs system, developed by computer scientists at Trinity College, Dublin, is designed so that Google would not have access to the keys necessary to unscramble data held on its systems. The four computer scientists behind the technology are looking to establish a startup based on their work, based on initial seed funding from government agency Enterprise Ireland.

“It [the technology] means that enterprises can finally start to make use of the low-cost Google Apps suite in a serious way with the knowledge that their sensitive data is stored securely on Google’s servers,” said Hitesh Tewari, of the Department of Computer Science at Trinity College, Dublin.

“We are an early stage startup with four employees and have received €100,000 in funding. Our mission is to provide users and enterprises with simple and transparent encryption products that allow them to make the most out of the cloud computing,” he added.

Although the initial connection between a Google Docs and Google’s servers is secure, the user data is stored unencrypted on Google servers, leaving it open to viewing for anyone who has or obtains the right level of access. This can pose problems for organisations and individuals that wish to store sensitive information (such as financial data, project plans, patient records etc) in their documents.

The CipherDocs software plugin encrypts user data in “real-time” (ie, as the user is typing into their browser window), prior to it being sent to Google’s servers, addressing this problem. The technology is initially available as a Firefox plugin that uses Advanced Encryption Standard (AES-256) to encrypt data.

Although it was initially available only for Word-style document files, the team behind the technology is looking to extend its functionality to support spreadsheets and presentations as well as on browsers including Chrome and Internet Explorer.

The technology already goes beyond simple document encryption. Google Docs lets users share their documents and allows multiple people to collaboratively edit a document. CipherDocs preserves this core functionality and allows for the secure sharing of Google Docs. This is accomplished by “transparently and securely sharing the document encryption key between the intended recipients” through a KeyHub service. A mobile keychain add-on means the user can access their documents from any machine, providing they have the plugin installed.

“In the event a user loses their laptop or the hard disk dies, they do not lose access to their documents,” the CipherDocs team explain. “At no point do we have access to user decryption keys as these are at all times protected by a user-chosen master password.”

A screenshot of the CipherDocs technology in action from the website (click to enlarge)

Next page: A work in progress…

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/19/cipherdocs_beta/