ATMs are surprisingly easy to hack according to CNET. From a report on ATMs, up to 90 percent of the ATMs in the U.K. could be at risk for worms, denial-of-service attacks, getting customer data intercepted, and having money stolen from their safes. Continue reading
Cold Temperatures Compromise Encryption Security
Researchers at Princeton University have found a very interesting and different approach to bypassing encryption. It has been demonstrated that when dynamic random access memory (DRAM) is frozen to extremely low temperatures, it retains whatever data is currently loaded onto the chip for minutes or even up to hours. On an encrypted system, when a computer is turned on or in use, the data contained on the RAM includes the key to whatever encryption structure is being used on the machine. This means that given physical access to a machine, an attacker can freeze the memory to retain that data that is currently on the RAM, then reboot the machine, and quickly copy the information off of the DRAM before the system has a chance to overwrite this sensitive information. Obviously once a key is obtained, the encryption of the system is useless. Given that DRAM is currently the most widely used type of memory chip in personal computing, the possibility of this sort of attack is cause for great concern. In the research attacks carried out, nothing more was used than multi-purpose duster spray cans turned upside down, which can freeze the RAM to temperatures as low as -60 degrees Fahrenheit, and a simple piece of software that copies the contents of the RAM that can easily be loaded from a network connection or USB device. These attacks worked both on the original compromised machine, or even when the DRAM was taken from the original machine and booted from a separate machine. This method of attack is a serious threat to the strength of such general disk encryption structures as Apple’s FileVault and Microsoft’s BitLocker.
It has been known since the 70’s that memory can retain it’s data for a prolonged period of time when frozen, but Princeton’s research in the area is the first time that this situation has been formally addressed from a security standpoint. It is unclear if or how much this tactic has been used in the past, since this was simply research on a possible attack that could be carried out and not on any particular use of the attack in the real world. However, knowing that it is possible will certainly cause security designers to re-think the structure of their products with this in mind. It seems that since this characteristic of the RAM has been known for so long (30-40 years), this attack possibility would have been forseen and addressed by this point. However, this is just another example of how Security vulnerabilities are always infinite, and there is no end to the strange and creative ways a system can be attacked.
Even though this attack is only possible when an attacker has physical access to the machine, this does not mean that it can be written off as unlikely and thus low-impact. This issue is especially important in a world where laptop and mobile computing is becoming the status-quo, causing full disk encryption to be a critical measure in security as physical compromise of personal computers becomes more and more likely. That is why companies like Apple and Microsoft have made large efforts to make sure that there is full disk encryption available on the systems that they produce. Now finding that such systems might not be nearly as secure as was once hoped will have a great impact on these companies, their customers, and the general computing community at large.
It is difficult to say how the industry will respond to this security threat. This is an issue that stems from a combination of hardware and software characteristics of current computing technology. Thus steps could be taken in a variety of directions, such as changing the common DRAM model so that this freezing tactic does not in fact cause the data to remain on the chip, or somehow reworking the full disk encryption model so that the key is not so readily accessible on the chip at any given time (which seems hard since the system needs the key in order to decrypt the data itself). Regardless of the direction the industry goes in response to this threat, the solution will not be easy and will certainly not be instantly carried out, since the characteristics that allow the attack to happen are deeply rooted in how personal computing works today (what type of memory that is used or how encryption schemes are set up). Consequently this could be a legitimate security concern for a long time to come.
Posted in Current Events
Comments Off on Cold Temperatures Compromise Encryption Security
[Collaborative] Chinese hackers: harmless scriptkiddies or a growing adversary?
CNN got an inside view of the so-called “Chinese cyber militia” when a group of three Chinese hackers agreed to be interviewed. This group of hackers claim that “no site is one hundred percent safe,” and that they’ve even broken into the Pentagon in the past. Should we write off these claims as hallow boasts from a group of fame chasers or is this something more?
First, let us consider who they are. Operating out of an apartment room in China, the group consists of a former computer operator in the People’s Liberation Army, a marketing graduate, and a self-taught programmer. In their cement-floored apartment with almost no furniture, the group leader quote sayings from Sun Tzu, “Know about both yourself and the enemy, and you will be invincible.”
They have been operating a hacking website with over 10,000 registered users, according to article, but CNN “decided to withhold” the address of the site. A quick search on Google leads to a site dedicated to being “Inside the World of Chinese Hackers,” which identifies their site as hack4.com. The front page of the hack4.com features a very comprehensive listing of articles, from discussing US-China relations, to reporting Fortify’s warnings of MySpace and Facebook vulnerabilities, to “Hacker’s Love Letters.” The website also compiles a large collection of downloads, from password crackers, to trojan generators, to overflow attack tools.
The group’s leader makes two bold claims:
1. That the group had successfully broken into the Pentagon network and downloaded information in the past.
2. That the Chinese government secretly pays them.
Of the Pentagon hack, he says, “They would not publicize this… It is very sensitive,” but does not discuss what information they obtained. Given that the Pentagon does report experiencing “multiple intrusions,” many originating from China, the Pentagon-hacking claim may be considered plausible. The second claim is less plausible, as it would require that they did obtain sensitive information and that the government would be willing to allow a group of rogue hackers to perform operations that could have international implications. In any case, no evidence whatsoever is provided to back the claims, so these can only be considered to be speculative.
What primarily distinguishes this group from merely a group of media hogs is (a) that they seem dedicated to hacking full-time and (b) that they have established what appears to be an authoritative site within the Chinese hacking community (if, in fact, they are not the people behind hack4.com, let’s suppose they are). Especially with the lofty goals of “ensuring the free sharing of the spirit of freedom” and “safeguarding China on the basis of our voices,” they do seem to take their work seriously. With about 10,000 users registered to hack4.com and given the existence other similar sites, Chinese hackers are indeed a growing fixture of the security landscape.
David W., Max A., Travis M.
Posted in Current Events, Miscellaneous
Comments Off on [Collaborative] Chinese hackers: harmless scriptkiddies or a growing adversary?
A little security humor
The Onion has posted quite a funny video taking advantage of the many security problems with the Diebold voting machines.
Posted in Miscellaneous
Comments Off on A little security humor
In the news this week…
There’s been a lot of security-related issues in the news this week (just like every week, actually). I thought I’d fuel the discussions by listing a few of them. I thought I’d also provide some links to topics that 3ric discussed on Friday. Please create new blog entries for the topics you’d like to explore further:
- RFID cards to help prevent underage smoking in Japan: http://www.taspo.jp/english/taspo/Introduction.html
- Homemade robots patrol Atlanta streets: http://hardware.slashdot.org/article.pl?sid=08/03/07/2029236
- Open source robot for household tasks: http://hardware.slashdot.org/article.pl?sid=08/03/07/012207
- Sat-nav dog collar that keeps track of Fido: http://women.timesonline.co.uk/tol/life_and_style/women/the_way_we_live/article3501141.ece
- Video of talk on reverse engineering crypto in an RFID chip: http://www.hackaday.com/2008/01/01/24c3-mifare-crypto1-rfid-completely-broken/
- H1kari’s work on intercepting GSM: http://www.hackaday.com/2008/02/15/shmoocon-2008-intercepting-gsm-traffic/
- Brain scanner can tell what you’re looking at: http://www.wired.com/science/discoveries/news/2008/03/mri_vision
- Attacking Chip & Pin credit card transactions: http://www.usenix.org/events/sec07/tech/drimer.html
Posted in Current Events
1 Comment
The Newton Virus spreads joy… and hopefully nothing else
The Newton Virus is a “harmless” virus that comes on a cute USB flash drive which copies itself onto the computer to which is attached (works for Mac only) and for only one time, it makes your desktop fall apart… Eventually the Newton Virus exits and goes away leaving no trace on your computer.
While the Newton Virus is harmless, a program like this could be used to spread harmful code, as a real virus would. If a real virus disguised itself as a harmless joke, it could spread rampantly as co-workers, children and friends “infect” computers for comical value…
Regardless the Newton Virus is quite hilarious, I strongly suggest that you watch the video in the original article here.
Posted in Current Events
Comments Off on The Newton Virus spreads joy… and hopefully nothing else
Facebook and XSS – a sample in action! :P
Today, I checked Facebook and got a spam wall post. I suspected it was an FB API + XSS exploit and looked into this matter. What a coincidence with the new project! =P
So after the first Google result I get a complete rundown on how to XSS exploit someone’s account.
http://www.cs.virginia.edu/felt/fbook/facebook-xss-censored.pdf
turns out it is fairly simple to execute!
This shows how even some of the most trusted sites where we share a lot of information can be manipulated to do malicious things. This is one of the real weaknesses of social networking and a open applications API, as javascript works across a whole page without private/public members that we are accustomed to in traditional OOP.
‘Swatting:’ A Very Personal Version of a ‘Smurf Attack’
Wired posted a story including a telephone version of the “Smurf Attack” we learned about in class. The story was posted because of new developments concerning the suspects but the actual attack was done back in 2005.
On May 1, 2005, Richard Gasper of Colorado Springs was woken at nearly 4am to a swarm of police deputies. The deputies, having expected a desperate gunman holding hostages, held Gasper for over 90 minutes despite the fact that he walked out of the house, unarmed and quite confused.
Gasper was the victim of what is called ‘swatting.’ Prank calls were made to Emergency services, making threats of murder and hostages while spoofing the caller ID to make it appear as if the calls were coming from inside Gasper’s home. The term comes from the potential swarms of SWAT teams that surround the victim’s house.
Spammers find a way to abuse out-of-office replies
We’ve all recieved those helpful out-of-office replies when someone is not going to respond to your email for a while. At work, I always like recieving these because then I know I shouldn’t hold my breath waiting for a response for whatever problem I am facing. I would have never thought these could be harmful, but, of course, spammers have found a way to abuse them.
Collaborative Current Event: Counterfeit Cisco Network Hardware Imported From China Seized
http://www.thestandard.com/news/2008/02/29/us-canadian-agencies-seize-counterfeit-cisco-gear
USA and Canadian law enforcement has seized US$78 million worth of Cisco routers, switches, and network cards in 400 seizures since the coordinated operation between the two nations was launched in 2005. The reason for the seizures is “illegal importation and sale of counterfeit network hardware”. Personally, I’m a little confused as to how network hardware can be imported legally, but apparently there are laws governing it. (If you’re wondering what “counterfeit” network hardware is, I’d imagine it’s the sale of previously illegally imported hardware). The involved agencies are the U.S. FBI’s Cyber Division, U.S. Immigration and Customs Enforcement, U.S. Customs and Border Protection, the Royal Canadian Mounted Police, and apparently, to some extent, the U.S. Department of Justice.
Posted in Current Events, Integrity, Policy
5 Comments