Largest gathering of offensive hackers converges on Miami

Formidable American offensive security hackers are meeting in Miami with other top hackers from all over the world to hone their technical expertise, swap war stories – and compete in a little digital jiu-jitsu. And real jiu-jitsu. Really. INFILTRATE’s annual summit, focuses entirely on the technical aspects of offensive security issues, bringing together the best and brightest in the hacker community. It’s largest gathering of purely offensive information security experts on the planet, with more than 200 hackers from as far away as Israel, India, Sweden and China.

Organized and sponsored by Immunity, an education firm founded by former NSA hacker Dave Aitel, the conference ran April 11 and 12. Aitel stressed that it was just for offensive work. “Defensive information security tends to focus on potential protective measures,” he told FoxNews.com. “Offensive information security looks purely at getting into computers -- and staying there undetected.”

The hacker way

Offensive techniques are used by a wide range of people from governments and banks through to researchers working on protecting critical national infrastructure. “INFILTRATE is important because it is the only conference dedicated to offensive information security techniques. Deep down this is about the attendees, who all share a technical competence in the area, and a burning interest in learning more about it. There are, of course, plenty of security teams here. For example, Blackberry announced on their twitter feed they are here,” Aitel said. If you don’t understand what TTF Font Fuzzing and Vulnerability means, this is the wrong conference for you, in other words.

The show covers the latest in the field, from computer and network exploitation and vulnerability discovery through to rootkit and trojan covert protocols. And while it sounds esoteric and dry, it has profound ramifications for ordinary Americans. For example, legendary hacker “RenderMan,” also known as Brad Haines, gave an opening keynote on  “Attacking the Next Generation Air Traffic Control System” -- hacking the FAA’s monitoring system. “I came to INFILTRATE to spread knowledge of vulnerabilities in air traffic control in hopes that the attention and collaboration with other hackers would result in a safer and more secure air traffic control system,” 

“Ironically, I'm speaking about vulnerabilities in air traffic control and I have to fly home.  It’s in my best interests to help make it secure. The next generation air traffic control scares the hell out of me,” he added.

Other speakers include Chris Eagle, a lecturer in computer science at the Naval Postgraduate School, and Stephen Watt , a former cybercriminal convicted in 2008. While still under a court-ordered restriction that prohibit him from a wide range of ordinary tech, including owning an iPhone and running a non-Windows operating system on his government-monitored laptop, Watt continues to speak out against computer the commercialization of vulnerability. In addition to briefings by the rock stars of hacking, Immunity offers Master Class training courses in web hacking and unethical hacking. Attendees have also been competing in a wireless + web challenge to win the grand prize -- a free wireless penetration testing tool called SILICA.

Off the keyboard

It may come as some surprise to those outside the hacking community, but many of INFILTRATE 2013's attendees are avid practitioners of the Brazilian martial art jiu-jitsu, sometimes described as “physical chess.”

“Brazilian jiu-jitsu is a shared passion for many in the offensive information security field,” Aitel told FoxNews.com. “It combines large-scale strategic thinking with fast paced tactical technique. For every attack, there is a defense, and for every defense, a counter-attack.” Away from keyboards, INFILTRATE also provides the opportunity for hackers new to the sport to have a go under the supervision of an experienced blackbelt.

Share This on Twitter | Share This Link on Facebook | Share This on Linkedin

The latest wave of Denial of Service attacks

Hackers have been able to weasel their way into computer networks from nearly every direction. From malware to ransomware, and everything in between, cyber crooks are always looking for new ways to steal information and disrupt business-as-usual for monetary gains. While most companies understand the importance of securing their corporate networks, there is one area that is often overlooked, but is becoming an easy target: VoIP systems. VoIP systems are dynamic, complex, and oftentimes require different tools than what a legacy firewall can provide, making the issue of telephony security a challenging one. Companies need to ensure that lines of communication are open and working well, so many are reluctant to put too many layers of defense on top of their telephony solution.

Unfortunately, hackers have become aware of this likely gap in defense, and have started to take advantage of it. A new class of attack targeting call centers, called telephony denial of service (or TDoS), have started appearing by the dozens. Like other denial of service (DoS) attacks, TDoS attacks seek to clog lines and interrupt regular business with a flood of false traffic. In the case of TDoS attacks, the attacker floods telephone (VoIP or traditional) lines at a call center with repeated calls from spoofed numbers, clogging lines for up to several hours and inhibiting real users from connecting. The goal of these attacks may differ. In some cases, they could be the work of activists or pranksters just trying to cause trouble.

In other cases, attackers try to monetize the attack by first extorting the victim. In a recent case, attackers posed as collections agents and dialed a call center, demanding payment of thousands of dollars for a false debt when someone answered. When the victim refused to pay and hung up, the TDoS attackers started. As compared to large bandwidth DDoS attacks, TDoS attacks don't take many computing resources or technical know-how. It is fairly easy to clog a phone line by simply calling it over and over again. Attackers employ VoIP automation scripts to dial the victim's phone number, hang up, and then redial repeatedly, overwhelming the line and making it impossible for other calls to come through. And because the attackers are able to use spoofed numbers, it is difficult for the victim to differentiate between a TDoS call and a real call.

In the most recent TDoS attacks, that targets were emergency services, such as ambulance or air ambulance services. For organizations like these, it is critical that phone lines remain open and available to ensure prompt response to emergency situations. This is where the major concern lies in these types of phone system attacks.

Share This on Twitter | Share This Link on Facebook | Share This on Linkedin 

Employees admit to accessing or stealing private company information

      
   In a survey of 1,000 employers by LogRhythm, 80 percent do not believe any of their workers would view or steal confidential information, while three quarters (75 percent) admitted to having no enforceable systems in place to prevent unauthorised access to company data by employees. Interestingly, a third of those employers believe that they do not need such systems at all. In addition, around two thirds of companies surveyed (60 percent) do not regularly change passwords to stop ex-employees being able to access sites or documents. However, in a corresponding survey of 2,000 employees, 23 percent admitted to having accessed or taken confidential data from their workplace, with one in ten stating that they do it regularly. The most accessed confidential data related to details of colleague salaries (38 percent) and details of colleague bonus schemes (23 percent). 94 percent of those who had accessed confidential information or stolen company data had never been caught.

“There is a clear gap between businesses’ internal security procedures and the harsh reality of employee behaviour,” said Ross Brewer, vice president and managing director for international markets at LogRhythm. “In an era where data breaches are considered inevitable, and with the government urging for greater consideration of cyber threats within businesses, the amount of employers who are doing nothing about unauthorised access across their networks – and the even higher number who don’t perceive any risk at all when it comes to employee data theft – is staggering.” “Even more worrying than the lack of systems in place to stop employees stealing data is that many organisations still have no idea what’s happening on their networks at all. With recent government proposals to increase the sharing of cyber threat intelligence among businesses, the first stage must be to ensure that more employers have the right level of visibility to track suspicious or abnormal behavior on their own networks – but this is clearly not happening,” continued Brewer.

When asked, more than a quarter (27 percent) of employers could not identify the biggest threats to their confidential data, while 14 percent did not even know whether employees have stolen data – even though they believe employees would do so. “It’s one thing to place too much trust in your employees and consequently neglect to enforce any systems monitoring unauthorized access and stealing of data. However, the fact that 14 percent of employers think their employees would steal data, and yet have no idea whether or not this has actually happened to them, is simply unacceptable. One of the main reasons why the ‘era of the data breach’ is now hitting hard and fast is that organizations just don’t have the level of visibility into their IT networks needed to secure their ever growing infrastructures. Employers therefore need to ensure they are proactively monitoring every single activity that occurs across their entire IT estate – both from the inside and the outside – rather than placing too much trust in reactive perimeter defenses or security strategies focused on securing particular areas of the IT estate, which don’t give organisations any insight into anomalous network activity,” continued Brewer.

Share This on Twitter | Share This Link on Facebook | Share This on Linkedin

An Evil Email - Hacked Internship Email Sent Out

On March 28, a seemingly innocuous email was sent from the Staples Student Internship Program  (SIP) to all seniors enrolled in the program. The email asked seniors “to complete a very short survey at the end of the internship period.” However, this was no ordinary email. According to Lee Saveliff – head of the internship program – the program’s website was hacked.

“Someone hacked into the website and sent last year’s June email (the internship evaluation) to this year’s seniors and this year’s senior parents,” Saveliff said. As to why someone would do that, Saveliff is unsure.

“Maybe they had too much free time on their hands,” she joked. However, Staples students were not fooled by this prankster’s email. “I knew it wasn’t legit right when I saw it because the subject was ‘IMPORTANT INFORMATION’ and it was asking questions about how I liked the internship (we haven’t even started yet), so I knew something was up,” said Rebecca Finell ’13.

Rachel Shapiro ’13 concurred. “It seemed legitimate except for the fact that the internships hadn’t started yet and when I received the email, I got three or four of the same one, so it kind of seemed sketchy,” she said.

Zach Pensak ’13 added, “I did not respond, as I had nothing to say about an internship I had not done. I can’t tell the future.” A hacked email could adversely affect the internship program, though according to Saveliff, this hacking did no such thing.

“It didn’t really affect the SIP at all. Since I also have a senior, I also received the parent email and then quickly sent an email to all the parents asking them to ignore it,” Saveliff said. “Actually, because of the hacked email, and my email that followed, I was able to update about six incorrect parent emails that bounced back as the seniors accidentally inputted incorrect parent emails,” she added. At this time it is uncertain what the hacker’s purpose was, if he or she even had one. But Saveliff and the internship program are taking cautionary steps to ensure the program’s security. “The IT programmer put a password protection so this will not be able to happen again,” Saveliff said.

Share This on Twitter | Share This Link on Facebook | Share This on Linkedin

US says hacking undermines China's interests

U.S. Undersecretary of State for Economic Growth, Robert Hormats, center, shakes hands with Shang Bing, a vice minister from China's Ministry of Industry and Information Technology during the 6th US-China Internet Industry forum in Beijing, China, Tuesday, April 9, 2013. Hacking that originates inside China is undermining its relationship with the United States and harms Beijing’s long-term interests, the top U.S. diplomat said Tuesday, in the latest high-level public expression of concern over a problem that has prompted threats of commercial retaliation from Washington. He urged China to take firm action against hacking.

BEIJING (AP) — Hacking that originates inside China is undermining its relationship with the United States and harms Beijing's long-term interests, a U.S. diplomat said Tuesday, in the latest high-level public expression of concern over a problem that has prompted threats of commercial retaliation from Washington. The U.S. believes cyber intrusions originating from China that result in the theft of sensitive information have reached very high levels, adding to existing problems with the lack of protection for intellectual property rights, said Robert Hormats, the U.S. undersecretary of state for economic growth.

He urged China to take firm action against hacking and said Chinese officials need to question whether such activity "serves China's real interests" as it seeks to upgrade its economy, the world's second largest. "The long-term interest of the Chinese government is to investigate and halt these cyber intrusions wherever in this country they come from," Hormats said. "The U.S. government is taking an active role in addressing this issue and we continue to raise our concerns with senior Chinese officials." Hormats' comments in an address to an Internet industry conference in Beijing follow a forensically detailed report by Internet security company Mandiant that accused a Chinese military unit of carrying out a yearslong hacking attack against U.S. companies.

China's government and military deny carrying out cyberattacks. A senior Chinese official attending the conference repeated Beijing's contention that Beijing was itself a victim of hacking World. "Our opposition to all forms of hacking is clear and consistent," said Qian Xiaoqian, a vice minister and deputy director of the State Internet Information Office. "Lately people have been cooking up a theory of a Chinese Internet threat, which is just an extension of the old 'China threat' and just as groundless," Qian said. Such statements seem to be doing little to allay concerns over a suspected official role in wholesale hacking linked to China. Foreign military and government organizations have been targeted by the attacks, as well as private companies, including those in sensitive industries such as energy and aerospace.

Craig Mundie, a senior adviser to the CEO of Microsoft, a sponsor of the conference, said that regardless of whether China-based hacking was the work of rogue actors, Beijing's efforts to stop it are clearly not effective. "And given that China's policy position is that such activity is absolutely illegal, our two countries clearly need to work together to figure out how to enforce that policy more effectively, because right now the evidence suggests China's policy enforcement approaches are not working adequately," Mundie said.

Mandiant, a Virginia-based cybersecurity firm, released a torrent of details in February that tied a secret Chinese military unit in Shanghai to years of cyberattacks that compromised more than 140 companies. Mandiant linked the breaches to the People's Liberation Army's Unit 61398.

In response to the hacking reports, the Obama administration has been considering fines and other trade actions against China or any other country guilty of cyberespionage. However, the administration is expected to proceed cautiously because of the issue's sensitivity, and Hormats and other conference attendees repeatedly called for communication and joint efforts against hacking rather than outright confrontation.

Share This on Twitter | Share This Link on Facebook | Share This on Linkedin