78 government websites under hacking attacks till June - CERT IN

   
      A total of 78 government websites were hacked and 16,035 incidents related to spam, malware infection and system break-in were reported this year so far, Minister of State for Communications & IT Milind Deora said. "As per the information reported to and tracked by Indian Computer Response Team (CERT-In), a total number of 308, 371 and 78 government websites were hacked during the years 2011, 2012 and 2013 (up to June) respectively," Deora said in a written reply to the Lok Sabha. The Minister said 16,035 security incidents related to scanning, spam, malware infection, denial of service and system break-in including that of government, Defence and public sector undertakings were reported up to June this year. The number of security breach incidents stood at 13,301 in 2011 and 22,060 in 2012, he added.
"It has been observed that attackers are compromising computer systems located in different parts of the world and use masquerading techniques and hidden servers to hide the identity of actual system from which the attacks are being launched. It is difficult to attribute the origin of cyber attacks," he added. In order to detect and prevent cyber attacks, the government has taken various measures including release of a National Cyber Security Policy 2013, which addresses protection of information and infrastructure in cyber space and building capabilities to prevent cyber threats.
"All new government websites and applications are to be audited with respect to cyber security prior to their hosting," Deora said. It has also been mandated that all government websites to be hosted on infrastructure of NIC, ERNET or any other secure infrastructure service provider in the country. The Information Technology Act, 2000 provides legal framework to address the issues connected with cyber attacks, Deora added.

Researcher builds botnet-powered distributed file storage system using JavaScript

 The botnet-type system is called HiveMind and was built by Sean T. Malone, a principal security consultant at penetration testing firm FusionX.
HiveMind uses technologies like HTML5 WebSockets and Web Storage that are also used by legitimate Web applications.
There are no malicious exploits being used, so there is nothing that can be patched to prevent it, Malone said. However, building the botnet by getting other people's browsers to load a piece of JavaScript code and storing data on their computers falls into a legally gray area, he said.
"This was a research project, not production software" he said. "I'm not a lawyer, so I don't intend to give anyone legal advice with this," he said, adding that everyone is responsible for what they decide do with the software he plans to release later this week.
The HiveMind JavaScript code can be distributed to browsers in several ways, including hosting the JavaScript code on legitimate or compromised websites or by distributing the code through an advertising network, which would place it on multiple websites.
For his research, Malone set up an anonymous Web proxy server that later got added to proxy lists and started being used by people. Every time someone used the proxy server to browse to a Web page, the server would inject the HiveMind JavaScript code into that page.
According to the researcher, his proxy server was getting connections from 20,000 unique IP addresses every ten minutes, which then became nodes in the botnet.
HiveMind has a C&C (command and control) server that uses a SQL database to keep a record of all files and the nodes -- browsers running the JavaScript code -- they're distributed on.
When a file is uploaded to the server, it is encrypted using the AES (Advanced Encryption Standard) with a password provided by the uploader. The encrypted file then gets split into multiple blocks and those blocks are distributed across different nodes.
Every file can have a different password, Malone said.
Because the botnet is highly dynamic, with nodes constantly disappearing when users close their browsers, every file block is distributed across multiple nodes to achieve redundancy.
The nodes constantly announce their presence and the list of blocks they have back to the server, so that a particular block can be redistributed to new nodes if the number of nodes storing it drops under a certain threshold.
After a file is uploaded, encrypted and distributed to the nodes, it is no longer kept on the server. Only a record of the nodes that contain its different blocks is stored, because this is necessary to rebuild the file, Malone said.
If a government agency were to seize the server and take it away, the block replication process would fail because the nodes would start going offline, which would make the file unrecoverable, Malone said. There are a few ways to recover the data, but it is very difficult and it involves seizing a large number of nodes or compromising the server while it's still online and coercing the owner to provide the passwords necessary to decrypt the files.
There is a way to provide "plausible deniability" for the owner and it involves initially seeding the server with a large number of dummy files that contain random data, but this functionality is not yet built into the system, Malone said.
The user can say that he created the system, but did not put any real data in it, even though he did also upload some real files along with the dummy ones.
Because the random data in the dummy files looks the same as the random data in encrypted files, when trying to recover a file there is no way to tell if the password supplied by the user was correct and a dummy was decrypted, or if the password was wrong, the researcher said.
In this way, the user can supply the wrong password for the files he knows are real and the other party would have no way to prove that the password was correct or incorrect.
While the legality of building such a botnet is questionable, this system could also be set up as a collaborative effort, where users volunteer their browsers themselves and are able to upload files to the system, Malone said.