Saturday, 27 April 2013

Living Social Deals Website hacked



The company said today that customers' names, email addresses, dates of birth and encrypted passwords may have been compromised by the cyber attack. But it said the database that stores customer credit-card information was not accessed or affected. The Washington DC-based company said it was working with law enforcement officials to investigate the attack and was contacting customers in nearly all of the countries where it operates. A banner on its website today read: "Important notice for customers. If you haven't already updated your LivingSocial password, please update it now." In an email to customers, company chief executive Tim O'Shaughnessy requested that users reset their passwords, and he reminded them to disregard any emails claiming to be from LivingSocial that seek personal or account information.

"The security of your information is our priority," he wrote. "We always strive to ensure the security of our customer information, and we are redoubling efforts to prevent any issues in the future." The company did not immediately explain how the hacking occurred, except to describe it as a cyber attack that "resulted in unauthorised access to some customer data from our servers".

It's the latest bad news for LivingSocial, which offers deals on everything from restaurants to spa sessions. Last November, the company announced it was cutting 400 jobs worldwide, or about 9 per cent of its workforce, as the deals marked continued to face challenges. In recent years, online deals have gone from fad to a much-copied business model that's easy to set up but difficult to sustain. LivingSocial is one of the largest of the online deals companies.


Share This on Twitter | Share This Link on Facebook | Share This on Linkedin

Friday, 26 April 2013

Security analyst develops Android app that can hijack and crash airplanes


App uses an exploit framework which can command a plane to change course, altitude, speed and even crash.

A security analyst has revealed how simple it is to hack into the communication link-up between a plane and the air traffic control system, and the plane’s navigation system in order to change the plane’s route or even to crash it. Hugo Teso, an analyst with German IT security company N.Runs AG, and a licensed commercial pilot has developed an exploit framework called Simon which is used by an Android app to deliver data that can instigate an attack against an airplane.

While speaking at the Hack in the Box conference in Amsterdam, Teso revealed that he could exploit a plane’s Automatic Dependant Surveillance-Broadcast (ADS-B) system, the system that transmits the plane’s current navigation details to Air Traffic Controllers (ATC) and the Aircraft Communications Addressing and Reporting System (ACARS), a communication link between the plane and the ATC, to feed in false information and cause the plane to change course or get into an accident. Teso said that it took three years to develop the Simon framework which uses information from Flightsradar24, a free website that tracks flight paths in real-time, and publicly available Flight Management System hardware and software, both of which are very similar (but not exactly the same) as the ones used in the real world. Teso showed the audience at the conference that by sending the command “visit ground” through the app using radio signals, he could force the plane to change course and crash. He also showed how he could get a plane to change its speed, altitude and bearings using the same method.

Fortunately, Teso’s system can only be used virtually at present and a hijacker would only be able to remotely control a plane if it was within the antenna range of his hacking system. Also, if a pilot somehow was able to recognize the infiltration, he could take control of the plane manually, since Teso’s system can only influence the plane when it’s in autopilot mode. Teso stressed on how vulnerable the existing ACARS was and how a plane would have no way to determine if the data being transmitted through ACARS was valid.

Teso’s hacks have been developed keeping in mind the newly updated ADS-B system which will be implemented almost globally in the coming years as a result of a directive by the US government that states that by 2020, any flights operating in its airspace should have an ADS-B system installed. Teso says that he has been in touch with airlines to fix the vulnerabilities in the ADS-B system.

Along with Shodan, the search engine that can be used to control nuclear plants, Teso’s Simon makes the rest of the 21st century sound like a very dangerous time to live in. Fortunately, at least for the time being, both Shodan and Simon are almost exclusively being used by security experts and researchers to find and seal off security vulnerabilities rather than exploit them.


Share This on Twitter | Share This Link on Facebook | Share This on Linkedin

Thursday, 25 April 2013

No honeypot? Don't bother calling yourself a security pro


I'm constantly amazed by how many companies don't bother running honeypots, despite evidence that they're incredibly high-value, low-noise defense assets. A honeypot is a computer software or device that exists simply to be attacked. You can take any computer -- typically one you're getting ready to decommission because it's old and underpowered -- and use it as a honeypot. Because it's no longer a legitimate production asset, no person or service should be connecting to it. When something (such as a hacker or malware) connects to it, the honeypot sends an alert that can trigger an immediate incident response.

[ See Roger Grimes' comparative review: Intrusion detection honeypots simplify network security. | Learn how to secure your systems with the Web Browser Deep Dive PDF special report and Security Central newsletter, both from InfoWorld. ] Honeypots are excellent early-warning systems. After a little fine-tuning, they're incredibly low noise, producing few false positives -- unlike firewalls or IDSes (intrusion detection systems). They can easily capture zero-day exploits, freshly minted malware, and roaming APT hackers. Honeypots are great at detecting malicious activity from both outsiders and insiders; they turn up rogue exploits the other tools miss. Best of all, they do it at very low cost with little ongoing maintenance.

Sticky business: Honeypots compared In preparing for a recent customer engagement, I had the opportunity to check out the latest honeypot technology and see how the players were doing. Unfortunately, no one appears to be getting rich developing honeypot software. Of the 30 or so projects listed by the Honeynet Project, perhaps 90 percent are dead or headed in that direction. That's the bad news. The good news is that great open source and commercial honeypot projects are alive and well.

Glastopf is a low-interaction, open source honeypot that emulates a vulnerable Web server. Running on Python, PHP, and MySQL, Glastopf can emulate literally thousands of vulnerabilities and is intended to be Web crawled, a recognition that today's attackers frequently use search engines to find innocent websites to infect. Glastopf has GUI management and reporting features, and it's actively maintained and updated. Specter, a commercial honeypot, hasn't been updated significantly in years, but it's still actively sold and supported. It's GUI-based and has a few interesting features (it updates its own content, has "marker" files that can be used to trace hackers, and more) that make it a honeypot to check out. I also like the free USB emulation honeypot known as Ghost USB. It mounts as a fake USB drive to enable easier capture and analysis of malware that uses USB drives to replicate. It could come in very handy during the next USB worm outbreak.

But my favorite commercial honeypot, KFSensor, still leads the way by a large margin. It's easily the most feature-rich and mature honeypot product out there. Its developer continues to add new features, and while this post isn't an official Test Center review, I can't find anything else that holds a candle close to it. If you want a great commercial honeypot product with enterprise features, KFSensor is it. Just deploy it If you're not running a honeypot, now's the time. I can tell you from experience: They work. I've never installed a production honeypot that failed to catch some malicious behavior or software within a few days. If you're worried about zero days, APT hackers, or rogue insiders, you can't beat honeypots as a solid early-warning defense.

I don't care how well the malware is written or how good the hacker is -- a malicious actor moving laterally in a network is going to have to at least touch boxes. With a few honeypots deployed in strategic places, it's a lot easier to ferret out the bad guys and their rogue software. If you're not running one and you claim to care about security, what's your excuse?


Reuters editor charged with hacking: I was fired



SACRAMENTO, Calif. (AP) — A social media editor who has worked for two of the nation's largest news-gathering organizations is scheduled to appear in federal court Tuesday to face charges that he conspired with hackers to deface the website of the Los Angeles Times. The attorney for 26-year-old Matthew Keys said he will plead not guilty during the arraignment in Sacramento, his first court appearance since charges were filed last month. On Monday, Keys said via his Twitter account that he had been fired by his most recent employer, the Reuters news agency. The federal charges stem from an incident that occurred before he was employed by the company.

Keys is charged with giving the hacking group Anonymous the log-in credentials to the computer system of The Tribune Co., which owns the Los Angeles Times, Chicago Tribune, Baltimore Sun and other media properties. He was fired by a Sacramento television station owned by Tribune two months before the Times' website was hacked. The charging documents say a hacker identified as "Sharpie" used information Keys supplied in an Internet chat room to access the Times' web system and alter a headline on a December 2010 story. The headline was changed to read "Pressure builds in House to elect CHIPPY 1337," an apparent reference to another hacking group.

Keys, of Secaucus, N.J., said in a Facebook posting last month that he did not provide the log-in information. He "absolutely, 100 percent ... denies these allegations," said Keys' Ventura-based attorney, Jay Leiderman. He said his client is not talking to reporters. Prosecutors say Keys encouraged Anonymous members to hack into the Tribune's website and applauded their success. "Anyone can use any nickname in any chat room at any time," Leiderman said. "If in fact those things were said, they were not said by him."

Keys is charged with two counts that each carry a maximum penalty of 10 years in prison — transmitting and attempting to transmit information with the intent of damaging a protected computer. He faces a third count of conspiring to transmit that information, which carries a maximum sentence of five years. Legal experts say Keys likely would spend far less time in prison if convicted, especially if he has no prior criminal history. The indictment fed an ongoing debate over when an online prank becomes an Internet crime and whether the government is going too far in punishing the perpetrator.

The debate was sparked by the suicide in January of Aaron Swartz, a 26-year-old Internet activist who was found dead in his Brooklyn apartment as he awaited trial on allegations that he illegally downloaded millions of academic articles and helped post millions of court documents on the Internet. Tribune employees spent 333 hours responding to the 2010 hacking that Keys is charged with orchestrating, costing the company of $17,650 in labor costs alone, according to an October 2012 search warrant affidavit filed by the FBI. The FBI searched Keys' three-bedroom, two bathroom apartment looking for computer equipment. In the affidavit, FBI Special Agent Gabriel Andrews said there is probable cause to believe that Keys broke into the Tribune Media computer system after he was fired in October 2010 by the Tribune-owned FOX affiliate KTXL-TV in Sacramento. He stole an email list of FOX 40's customers, then "offered to sell this list to members of Anonymous," according to the affidavit.

"Keys also used this list to send spurious emails to FOX 40's customers and to disrupt the business operations of FOX 40," the affidavit said. Leiderman, his attorney, denied the allegations. The television station told the FBI that Keys also changed the passwords to the station's Twitter and Facebook accounts after he was fired. He deleted 6,000 followers from the station's Twitter account and posted news headlines from the station's competitors during the four days he had unauthorized control of the accounts, according to the affidavit. Leiderman said that involved "a dispute over ownership" of personal accounts Keys had been using on behalf of the station.

Keys was not charged with any of the alleged incidents involving FOX 40. The station referred requests for comment to Tribune Corp. spokesman Gary Weitman, who declined comment. Keys was working at Thomson Reuters Corp.'s New York office at the time the charges were announced and was suspended with pay. A company spokesman on Monday would not elaborate on why it no longer employed Keys, but the social media editor said in a Twitter posting that it was not because of the indictment. Rather, Keys tweeted a copy of a "final written warning" he said he received from Reuters in October, which admonished him for unprofessional behavior after he mocked a Google executive from a fake Twitter account. Keys said his union, the Newspaper Guild, would file a grievance on his behalf.


Share This on Twitter | Share This Link on Facebook | Share This on Linkedin

Wednesday, 24 April 2013

Google chairman talks about internet revolution in new book


Some illuminating books already have been written about Google's catalytic role in a technological upheaval that is redefining the way people work, play, learn, shop and communicate. Until now, though, there hasn't been a book providing an unfiltered look from inside Google's brain trust. Google executive chairman Eric Schmidt, who spent a decade as the company's CEO, shares his visions of digitally driven change and of a radically different future in " The New Digital Age," a book that goes on sale on Tuesday. 

It's a technology treatise that Schmidt wrote with another ruminator,Jared Cohen, a former State Department adviser who now runs Google Ideas, the internet company's version of a thinktank. The book is an exercise in "brainstorming the future," as Schmidt put it in a recent post on Twitter - just one example of a cultural phenomenon that didn't exist a decade ago. The ability for anyone with an internet-connected device to broadcast revelatory information and video is one of the reasons why Schmidt and Cohen wrote the book. The two met in Baghdad in 2009 and were both struck by how Iraqis were finding resourceful ways to use internet services to improve their lives, despite war-zone conditions. 

They decided it was time to delve into how the internet and mobile devices are empowering people, roiling autocratic governments and forcing long-established companies to make dramatic changes. The three years they spent researching the book took them around the world, including North Korea in January over the objections of the US State Department. They interviewed an eclectic group that included former secretary of state Henry Kissinger, Mexican mogul Carlos Slim Helu, WikiLeaks founder Julian Assange and the former prime ministers of Mongolia and Pakistan. They also drew on the insights of a long list of Google employees, including co-founders Larry Page and Sergey Brin. 

The resulting book is an exploration into the opportunities and challenges that lie ahead as the lines blur between the physical world around us and the virtual realm of the internet. Schmidt and Cohen also examine the loss of personal privacy as prominent companies such as Google and lesser-known data warehouses such as Acxiom compile digital dossiers about our electronic interactions on computers, smartphones and at check-out stands. "This will be the first generation of humans to have an indelible record," Schmidt and Cohen predict. To minimise the chances of youthful indiscretions stamping children with "digital scarlet letters" that they carry for years, online privacy education will become just as important, if not more so than sex education, according to Schmidt and Cohen. They argue parents should consider having a "privacy talk" with their kids well before they become curious about sex. 

Not surprisingly, the book doesn't dwell on Google's own practices, including privacy lapses that have gotten the company in trouble with regulators around the world. Among other things, Google has exposed the contact lists of its email users while trying to build a now-defunct social network called Buzz. It scooped up people's passwords and other sensitive information from unsecured Wi-Fi networks. Last year, Google was caught circumventing privacy controls on Safari Web browsers, resulting in a record $22.5 million fine by the US Federal Trade Commission. European regulators have a broad investigation open. 

Google apologised for those incidents without acknowledging wrongdoing. Schmidt and Cohen suggest that is an inevitable part of digital life. "The possibility that one's personal content will be published and become known one day - either by mistake or through criminal interference, will always exist," they write. The book doesn't offer any concrete solutions for protecting personal privacy, though the authors suspect that calls for tougher penalties and more stringent regulations will increase as more people realise how much of their lives are now in a state of "near-permanent storage." "The option to 'delete' data is largely an illusion," Schmidt and Cohen write. 

People can choose not to put any of their information online, but those that eschew the internet risk become irrelevant as online identities become increasingly important, the book asserts. Schmidt and Cohen foresee an option that will allow all of a person's online accounts - Facebook, Twitter, LinkedIn, Netflix and various other subscriptions, to be merged together into a "constellation" that will serve as a one-stop profile. If this book is right, there is no turning back from the revolution that is making internet access as vital as oxygen and mobile devices as important as our lungs. As much disruption as there already has been since Google's inception in 1998, Schmidt and Cohen contend that the most jarring changes are still to come as reductions in the cost of technology bring online another 5 billion people, mostly in less developed countries. At the same time, the combination of more powerful microprocessors, much-faster internet connections and entrepreneurial ingenuity will turn the stuff of science fiction into reality. 

Schmidt and Cohen are convinced that holograms will enable people to make virtual getaways to exotic beaches whenever they feel the need. Nasal implants will alert us to the first signs of a cold. Virtual assistants - the kind Google is developing with Google Now and Apple with Siri, will become constant companions that influence when we shop and what we buy. Those assistants will generally steer us in directions drawn from an analyses of our personal preferences vacuumed off the internet and stored in vast databases.These aren't far-out concepts to the tech cognoscenti, or even younger generations who can barely remember what it was like to surf the web on a dial-up modem, let alone use a typewriter. The ideas will be more unnerving to older generations still trying to figure out all the things that their smartphone can do. 

Schmidt, who will turn 58 on Saturday, can remember the days before there were personal computers. But he has been studying tech trends for decades, long before he became Google's CEO in 2001 and became a mentor and confidant to company co-founders Page and Brin. That collaboration established him as one of the world's best-known executives and minted him as a multibillionaire. Before joining Google, he was chief technology officer at Sun Microsystems and CEO of software maker Novell. Many of the book's themes expand upon topics that Schmidt regularly mused about in speeches and interviews that he gave as Google's CEO. Some of his past remarks, particularly about the loss of privacy, rankled critics who believe Google had become too aggressive in trying to learn more about people's individual interests so it could sell more ads, its chief source of revenue. 

Schmidt also won plenty of admirers in powerful places, including president Barack Obama, who called upon Schmidt's advice during his 2008 campaign. Political pundits once considered Schmidt to be a leading candidate to join Obama's cabinet, though Schmidt has said he never had any interest in a government job. Schmidt relinquished the CEO job to Page two years ago, freeing him to devote more time traveling to meet government leaders around the world. Cohen, 31, is regarded as a rising star in tech circles, though he isn't as well-known as his co-author. Time magazine just named Cohen as one of the world's 100 most influential people in its annual list. Cohen worked on State Department policy planning and counter-terrorism in both the Bush and Obama administrations. 

Schmidt and Cohen emerged from their research convinced that most governments don't fully understand the implications of ubiquitous internet access and mobile computing. They expect repressive regimes to do everything in their power control the flow of information and to abuse databases to spy on citizens. They also foresee smaller countries waging computer-based attacks on countries they would never target with troops and weapons. Even as they address the dark sides of technology, Schmidt and Cohen hypothesise that the world ultimately will be better off as more people spend more time connected to each other on the Internet. Societies will be more democratic, governments will become less corrupt as their transgressions are exposed and people will become smarter and better informed. "Never before in history have so many people, from so many places, had so much power at their fingertips," Schmidt and Cohen assert.

Share This on Twitter | Share This Link on Facebook | Share This on Linkedin