Author Archives: Sean Gallagher

DNS enhancement catches malware sites by understanding sneaky domain names

A researcher at OpenDNS Security Labs has developed a new way to automatically detect and block sites used to distribute malware almost instantaneously without having to scan them. The approach, initially developed by researcher Jeremiah O’Connor, uses natural language processing and other analytics to detect malicious domains before they can attack by spotting host names that are designed as camouflage. Called NLPRank, it spots DNS requests for sites that have names similar to legitimate sites, but with IP addresses that are outside the expected address blocks and other related data that hints at sketchiness.

The practice of using look-alike domain names as part of an effort to fool victims into visiting websites or approving downloads is a well-worn approach in computer crime. But recent crafted attacks via “phishing” links in e-mails and social media have gone past the well-worn “typo-squatting” approach by using domain names that appear close to those of trusted sites, registered just in time for attacks to fly under reputation-scoring security tools to make blacklisting them harder. Fake domain names such as update-java.net and adobe-update.net, for example, were used in the recently discovered “Carbanak” attacks on banks that allowed criminals to gain access to financial institutions’ networks starting in January 2013 and steal over $1 billion over the next two years.

Many security services can screen out malicious sites based on techniques such as reputation analysis—checking a centralized database to see if a site name has been associated with any malware attacks. But because attackers are able to rapidly register new domains with scripted systems that look relatively legitimate to the average computer user, they can often bypass reputation checks—especially when using their specially crafted domain names in highly targeted attacks.

Read 4 remaining paragraphs | Comments

Drone Maker to Add No-Fly Firmware to Prevent Future White House Buzzing

In the wake of a National Geospatial-Intelligence Agency employee’s late-night drunken mischief with a DJi Phantom 2 consumer quadrocopter drone over White House airspace, President Barack Obama called for new laws to govern the use of unmanned aerial vehicles. Meanwhile, the company that manufactured the drone used in the ill-fated flight has announced that it will issue a mandatory upgrade to the firmware for its Phantom 2 line of products to make sure that customers comply with the FAA’s no-fly zone around DC.

In a press release issued this morning, DJI announced that the firmware update “will help users comply with the FAA’s Notice to Airmen (NOTAM) 0/8326, which restricts unmanned flight around the Washington, DC metropolitan area.The updated firmware (V3.10) will be released in the coming days and adds a No-Fly Zone centered on downtown Washington, DC and extends for a 25 kilometer (15.5 mile) radius in all directions. Phantom pilots in this area will not be able to take off from or fly into this airspace.”

DJI’s Phantom 2 drones already have firmware settings that prevent them from being flown near airports and other places where officials have set restrictions on flight. According to the company’s statement, DJI is also continuing to update the no-fly zone list for future firmware releases to prevent flights in other sensitive areas—and to prevent drones from being flown across national borders.

Read 4 remaining paragraphs | Comments

Drunken Spy Satellite Agency Employee Crashed Drone on White House Lawn

The curious incident of the drone in the night-time has been made a bit less mysterious today, as the Secret Service revealed new details into their investigation—including a confession by the pilot himself. According to the Secret Service, an unnamed employee of the National Geospatial Intelligence Agency (NGA) claimed responsibility for crashing a remote-controlled quadrocopter into a tree on the grounds of the White House.

The yet-unnamed employee reported the incident to his superiors at NGA. He claimed to have been drinking at an apartment near the White House when he decided early Monday morning to fly a friend’s new DJI Phantom drone. He claimed that he then lost control of the drone. Soon after the drone slipped unnoticed over the White House fence, it was spotted flying low over the grounds before it crashed into a tree.

The White House has a radar system to detect incoming aerial threats, but it did not detect the drone, which has the radar cross-section of a large bird at best. According to The New York Times, the Secret Service has been studying ways for the past few years to develop a defense against small drones, which could conceivably carry small explosives or other threats.

Read 1 remaining paragraphs | Comments

Playing NSA, Hardware Hackers Build USB Cable That Can Attack

Just over a year ago, Jacob Appelbaum and Der Spiegel revealed pages from the National Security Agency’s ANT catalog, a sort of “wish book” for spies that listed technology that could be used to exploit the computer and network hardware of targets for espionage. One of those tools was a USB cable with embedded hardware called Cottonmouth-I—a cable that can turn the computer’s USB connections into a remote wiretap or even a remote control.

Cottonmouth-I is the sort of man-in-the-middle attack that hackers dream of. Built into keyboard or accessory cables, it allows an attacker to implant and communicate with malware even on a computer that’s “airgapped”—completely off a network. And its hardware all fit neatly into a USB plug. Because of the sophistication of the hardware, the advertised price for Cottonmouth-I was over $1 million per lot of 50—meaning each single device cost $20,000.

But soon, you’ll be able to make one in your basement for less than $20 in parts, plus a little bit of solder. At Shmoocon in Washington, DC, this past weekend, Michael Ossman, a wireless security researcher and founder of Great Scott Gadgets, and a contributor to the NSA Playset–a set of projects seeking to duplicate in open source the capabilities in the NSA’s toolbox, showed off his progress on TURNIPSCHOOL, a man-in-the-middle USB cable project under development that fits a USB hub-on-a-chip and a microprocessor with a built-in radio onto a circuit board that fits into a molded USB plug.

Read 5 remaining paragraphs | Comments

A Hacked DDoS-on-demand Site Offers a Look into Mind of “Booter” Users

A leaked database from a hacked denial-of-service site has provided some insight into what sorts of targets individuals will pay to knock offline for a few dollars or bitcoin. And it’s safe to say that a significant percentage of them are not the brightest stars in the sky. To get an idea of who would use such a service and for what purposes, Ars analyzed the data from a recently hacked DDoS for hire site: LizardSquad’s LizardStresser.

“Booter” or “stresser” sites offer users the ability to pay for distributed denial of service attacks against a target, and these sites promise to try to disguise the nature of the attack with the fig leaf of being legitimate load testing sites. That wasn’t so much the case with LizardStresser, the botnet-for-hire set up by the distributed denial of service crew known as LizardSquad. The group used its Christmas week DDoS attacks on Microsoft’s Xbox Live network and Sony’s Playstation Network as a form of advertising for the new service.

Since then, attacks on gamers have made up a significant percentage of the LizardStresser’s workload. While more than half of the attacks launched by customers of the service have been against Web servers, a significant portion have targeted individuals or small community gaming servers—including Minecraft servers.

Read 12 remaining paragraphs | Comments

US (Sort of) Points to “Smoking Gun” Linking North Korea to Sony Hack

Citing anonymous sources in and close to the US government, The New York Times reports that the fingering of North Korea as responsible for the attack on the network of Sony Pictures Entertainment was through evidence gathered by National Security Agency surveillance. This includes software taps into networks associated with North Korea’s network warfare and espionage unit, Bureau 121, among others. The actual evidence, however, will likely never see the light of day because of the highly classified nature of how it was obtained.

David Sanger and Martin Fackler of the Times report that the NSA started to ramp up efforts to penetrate North Korea’s networks in 2010 to monitor the growth of Bureau 121 and the rest of the country’s “computer network exploitation” capabilities:

A classified security agency program expanded into an ambitious effort, officials said, to place malware that could track the internal workings of many of the computers and networks used by the North’s hackers, a force that South Korea’s military recently said numbers roughly 6,000 people. Most are commanded by the country’s main intelligence service, called the Reconnaissance General Bureau, and Bureau 121, its secretive hacking unit, with a large outpost in China.

The evidence gathered by the “early warning radar” of software painstakingly hidden to monitor North Korea’s activities proved critical in persuading President Obama to accuse the government of Kim Jong-un of ordering the Sony attack, according to the officials and experts, who spoke on the condition of anonymity about the classified NSA operation.

The NSA’s Tailored Access Office, according to the report, “drilled into the Chinese networks that connect North Korea to the outside world, picked through connections in Malaysia favored by North Korean hackers, and penetrated directly into the North with the help of South Korea and other American allies.” According to NSA documents released by Der Spiegel, some of South Korea’s initial assistance was not voluntary—the NSA secretly exploited South Korea’s existing hacks of North Korea to gain intelligence information. But despite the level of access they gained, according to an unnamed investigator into the Sony Pictures attack, the NSA and other US agencies “couldn’t really understand the severity” of the attack that would be launched against Sony when they began on November 24.

Read on Ars Technica | Comments

NSA Secretly Hijacked Existing Malware to Spy on N. Korea, Others

A new wave of documents from Edward Snowden’s cache of National Security Agency data published by Der Spiegel demonstrates how the agency has used its network exploitation capabilities both to defend military networks from attack and to co-opt other organizations’ hacks for intelligence collection and other purposes. In one case, the NSA secretly tapped into South Korean network espionage on North Korean networks to gather intelligence.

The documents were published as part of an analysis by Jacob Appelbaum and others working for Der Spiegel of how the NSA has developed an offensive cyberwarfare capability over the past decade. According to a report by the New York Times, the access the NSA gained into North Korea’s networks—which initially leveraged South Korean “implants” on North Korean systems, but eventually consisted of the NSA’s own malware—played a role in attributing the attack on Sony Pictures to North Korean state-sponsored actors.

Included with the documents released by Der Spiegel are details on how the NSA built up its Remote Operations Center to carry out “Tailored Access Operations” on a variety of targets, while also building the capability to do permanent damage to adversaries’ information systems, including internal NSA newsletter interviews and training materials. Also included was a malware sample for a keylogger, apparently developed by the NSA and possibly other members of the “Five Eyes” intelligence community, which was also included in the dump. The code appears to be from the Five Eyes joint program “Warriorpride,” a set of tools shared by the NSA, the United Kingdom’s GCHQ, the Australian Signals Directorate, Canada’s Communications Security Establishment, and New Zealand’s Government Communications Security Bureau.

Read 8 remaining paragraphs | Comments

Surprise! North Korea’s Official News Site Delivers Malware, Too

A security researcher examining the website of North Korea’s official news service, the Korean Central News Agency, has discovered that the site delivers more than just the latest photo spread of Democratic Peoples’ Republic of Korea leader Kim Jong Un inspecting mushroom farms. There’s a little extra surprise hidden in the site’s code—malware. The news site appears to double as a way for North Korea to deliver a “watering hole” attack against individuals who want to keep tabs on the “activities” of the DPRK’s dear leader.

Ars has independently verified a reference within part of the site’s JavaScript code called from the home page to a download named “FlashPlayer10.zip.” The file, which is set as a JavaScript variable “FlashPlayer” on the site’s main page and on other site pages, contains two files labeled as Windows executable installers containing updates for the long-since obsolete Flash Player 10—one for an alleged ActiveX control, and the other for a browser plug in. Both are identical files, and they contain a well-known Windows malware dropper, based on an analysis through the malware screening site Virustotal.

Read 3 remaining paragraphs | Comments

Heads Up, Dear Leader: Security Hole Found in North Korea’s Home-Grown OS

North Korea is a technological island in many ways. Almost all of the country’s “Internet” is run as a private network, with all connections to the greater global Internet through a collection of proxies. And the majority of the people of the Democratic People’s Republic of Korea who have access to that network rely on the country’s official operating system: a Linux variant called Red Star OS.

Red Star OS, first introduced in 2003, was originally derived from Red Hat Linux. In theory, it gave North Korea an improved level of security against outside attack—a Security Enhanced Linux operating system based on Red Hat that could enforce strict government access controls on the few who got to use it.

However, because Red Star has had so few people with access to it, one of the ironic side effects has been that security holes in the operating system may have gone undetected. And as a security researcher who tested the latest release of Red Star’s desktop version reported today, one flaw in the system would allow any user to elevate their privileges to those of the system’s root account and bypass all those security policies put in place by the North Korean regime.

Read 6 remaining paragraphs | Comments

FBI Director says Sony Hackers “Got Sloppy,” Exposed North Korea Connection [Updated]

In a speech at the International Conference on Cyber Security (ICCS) today in New York, FBI Director James Comey reiterated the bureau’s confidence that North Korea was involved in the cyber attack on Sony Pictures Entertainment. “There’s not much I have high confidence about,” Comey said, as reported by the FBI New York field office’s official Twitter feed. “I have very high confidence… on North Korea.” And he downplayed suggestions by outsiders that others might be responsible, saying that critics “don’t have the facts that I have, they don’t see what I see.”

In a separate speech today at the ICCS, Director of National Intelligence James Clapper said that the attack on Sony demonstrated a new type of threat posed by North Korea. During a meeting last year with a North Korean general to negotiate the release of two American prisoners in North Korea, Clapper said that the general told him the regime is “deadly serious” about perceived insults by the US to its “supreme leader” and that North Koreans feel that the US has put their country under siege.

While the Sony attackers had largely concealed their identity by using proxy servers, Comey said that on several occasions they “got sloppy” and connected directly, revealing their own IP address. It was those slip-ups, he said, that provided evidence linking North Korea to the attack on Sony’s network. Comey also said that analysts at the FBI found the patterns of writing and other identifying data from the attack matched previous attacks attributed to North Korea. Additionally, there was other evidence, Comey said, that he could not share publicly.

Read 3 remaining paragraphs | Comments

South Korea Says North Korea Doubled Size of Its “Cyber Forces,” Can Nuke US

A report published by South Korea’s Defense Ministry on December 6 estimates that North Korea has further increased its focus on network and electronic warfare over the last year, doubling the size of its “cyber forces” to 6,000 soldiers. The report also warned that North Korea has made significant advances in its nuclear weapons technology and could now have the capability of threatening the mainland of the United States with a nuclear strike.

The report, the ministry’s 2014 Defense White Paper, is a biennial review of South Korea’s defense policy similar to the US Department of Defense’s Quadrennial Review, intended to define the government’s defense policy. Defense Ministry officials stated in the report that North Korea’s efforts in cyber-warfare and other “asymmetric” capabilities are part of an effort to cause “physical and psychological paralysis inside South Korea such as causing troubles for military operations and national infrastructures.”

The Defense Ministry report also claimed that North Korea had made advances in miniaturization of nuclear warheads, which
would allow them to be mounted more readily on intercontinental ballistic missiles. “The ability to miniaturize nuclear weapons seems to be at an early but significant level and is estimated as having the ability to threaten the US mainland through a long-range missile,” a Defense Ministry spokesperson said in a summary of the report. The assessment is based on estimates of North Korea’s production of highly enriched uranium.

Read on Ars Technica | Comments

Sony Pictures hack gets uglier; North Korea won’t deny responsibility [Updated]

More evidence has emerged that makes the Sony Pictures hack look similar to a suspected attack on South Korean companies over a year ago. And a spokesperson for the North Korean government, rather than denying his country’s involvement, is playing coy as the damage to Sony appears to be growing daily.

When contacted by the BBC, a spokesperson for North Korea’s mission to the United Nations said, “The hostile forces are relating everything to [North Korea]. I kindly advise you to just wait and see.”

Sony Pictures’ computers were reportedly the victim of wiper malware which erased all the data on infected PCs and the servers they were connected to. As Ars reported yesterday, this is similar to the attack on two South Korean broadcasters and a bank that was launched in 2013. As security reporter Brian Krebs reports, the FBI sent out a “Flash Alert” to law enforcement warning of a cyber attacker using “wiper” malware this week—malicious software that erases the entire contents of the infected machine’s hard drives as well as the contents of the master boot record of the computer. The FBI shared a Snort intrusion detection signature for the malware file, and as Krebs noted, “the language pack referenced by the malicious files is Korean.”

Read 7 remaining paragraphs | Comments

Craigslist DNS Hijacked, Redirected at Infamous “Prank” Site for Hours

Around 5:00pm PST on November 23, the Domain Name Service records for at least some of the sites hosted by the online classified ad and discussion service Craigslist were hijacked. At least some Craigslist visitors found their Web requests redirected toward an underground Web forum previously associated with selling stolen celebrity photos and other malicious activities.

In a blog post, Craigslist CEO Jim Buckmaster said that the DNS records for Craigslist sites were altered to direct incoming traffic to what he characterized as “various non-craigslist sites.” The account was restored, and while the DNS records have been corrected at the registrar, some DNS servers were still redirecting traffic to other servers as late as this afternoon.

Craigslist’s domain registrar is Network Solutions, which is owned by Web.com. [Update, 5:32 PM EST November 24: John Herbkersman, a spokesperson for Web.com, told Ars,“The issue has been resolved. At this time we are continuing to investigate the incident.”]

Read 4 remaining paragraphs | Comments

Four-year-old Comment Security Bug Affects 86 Percent of WordPress Sites

A Finnish IT company has uncovered a bug in WordPress 3 sites that could be used to launch a wide variety of malicious script-based attacks on site visitors’ browsers. Based on current WordPress usage statistics, the vulnerability could affect up to 86 percent of existing WordPress-powered sites.

The vulnerability, discovered by Jouko Pynnonen of Klikki Oy, allows an attacker to craft a comment on a blog post that includes malicious JavaScript code. On sites that allow comments without authentication—the default setting for WordPress—this could allow anyone to post malicious scripts within comments that could target site visitors or administrators. A proof of concept attack developed by Klikky Oy was able to hijack a WordPress site administrator’s session and create a new WordPress administrative account with a known password, change the current administrative password, and launch malicious PHP code on the server. That means an attacker could essentially lock the existing site administrator out and hijack the WordPress installation for malicious purposes.

“For instance, our [proof of concept] exploits first clean up traces of the injected script from the database,” the Klikki Oy team wrote in a blog post on the vulnerability, “then perform other administrative tasks such as changing the current user’s password, adding a new administrator account, or using the plugin editor to write attacker-supplied PHP code on the server (this impact applies to any WordPress XSS if triggered by an administrator). These operations happen in the background without the user seeing anything out of the ordinary. If the attacker writes new PHP code on the server via the plugin editor, another AJAX request can be used to execute it instantaneously, whereby the attacker gains operating system level access on the server.”

Read 1 remaining paragraphs | Comments

Target to Judge: Banks’ Losses in Our Card Breach Aren’t Our Problem

Target’s massive data breach, in which criminals were able to drop malware onto point-of-sale systems and compromise at least 40 million credit and debit cards, is now the subject of a federal lawsuit by banks who issued those cards. And Target is arguing in court today that those claims should be thrown out, Bloomberg reports—because the company claims it had no obligation to protect the banks from damages.

The suit has been brought by five banks—First Federal Savings, Village Bank, Umpqua Bank, Mutual Bank, and Louisiana’s CSE Federal Credit Union. As a group, the banks are claiming losses because the breach exceeded $5 million. The lawsuit is playing out as representatives from financial organizations, including the US’ two major credit union industry associations, are pressing Congress to take action to hold retailers more accountable for payment data breaches and to bring them under the same privacy standards as financial institutions with regard to financial data.

Major retailer data breaches over the past year, including the ones at Target and Home Depot, have caused banks and credit unions to have to reissue hundreds of millions of payment cards. The Home Depot breach, first reported in September, was revealed last week to have exposed 53 million customer e-mail addresses, as well as 56 million payment cards.

Read 2 remaining paragraphs | Comments

Six Journalists Sue Over Surveillance by UK “Extremist” Police Unit

Six members of the United Kingdom’s National Union of Journalists—including comedian and journalist Mark Thomas—have filed suit against London’s Metropolitan Police after discovering that their daily activities were being monitored and recorded in a police database. The database is gathered by the National Domestic Extremists and Disorder Intelligence Unit, a task force led by the Metropolitan Police Service that tracks political and religious groups in the UK and monitors protests.

In an interview on BBC Radio 4, Thomas said that the surveillance was discovered through information uncovered by a request under the UK’s Data Protection Act—a law similar to the US’ Freedom of Information Act. “The police are gathering information under the domestic extremist list about journalist and NUJ members, “ he said. “And we know this because six of us have applied to the police using the Data Protection Act to get some of the information the police are holding on us on these lists. And what they are doing is monitoring journalists’ activities and putting them under surveillance and creating databases about them.”

Thomas has used the Data Protection Act in the name of both journalism and comedy. In 2001, he launched a contest in which he encouraged people to do creative performances in front of surveillance cameras and then submit the videos to him after obtaining them through Data Protection Act requests.

Read 2 remaining paragraphs | Comments

Missouri Man Fired for Posting Pictures of DHS Vans to Facebook

Images posted of rows of federal police vehicles in a Missouri hotel garage got the employee who took them fired—and branded as a terrorist and traitor by the hotel’s security chief.
Mark Paffrath via Facebook

Mark Paffrath, a Navy veteran who worked as a housekeeper for the Drury hotel chain, claims he was fired from his job on Saturday after posting photos and video on Facebook of dozens of vehicles from the Department of Homeland Security massed in a Missouri hotel garage. Paffrath told CNN that Drury’s head of security “called me a terrorist, saying that I dishonorably served my country for posting those pictures and videos on Facebook.”

The vehicles and a large number of people from Homeland Security’s Federal Protection Services arrived last week, apparently in preparation for the announcement of a grand jury decision on whether to charge police officer Darren Wilson in the death of teenager Michael Brown. They were parked at the hotel where Paffrath worked, a short drive from Ferguson in suburban St. Louis. Paffrath posted the video and images of rows of federal vehicles on Thursday, including one with the caption “Why are all these vehicles here, I wonder if it has anything to do with Ferguson? #Ferguson, #No justice, no peace.”

Paffrath’s former employer would not comment on how the hotel learned of the posted images, some of which are still publicly viewable on Paffrath’s Facebook page. A Drury hotel spokesperson told CNN, “We do not publicly discuss confidential personnel matters. The safety and privacy of our guests and our team members has always been and will remain our top priority.” The hotel management may have seen the photos as a violation of the privacy of guests.

Read on Ars Technica | Comments

DARPA Wants to Turn Existing Planes into Drone Motherships

A DARPA artist’s concept of how a flying drone carrier’s takeoff and landing pattern might look.
DARPA

The Defense Advanced Research Projects Agency (DARPA) kicked off a program seeking ways to convert existing large aircraft into drone carriers that could launch waves of unmanned aircraft a safe distance from a target to carry out a mission and then recover them—all while in flight. DARPA issued a request for information (RFI) kicking off the program November 7.

“We want to find ways to make smaller aircraft more effective, and one promising idea is enabling existing large aircraft, with minimal modification, to become ‘aircraft carriers in the sky’,” Dan Patt, program manager for DARPA’s Tactical Technology Office, said in an official statement issued by the agency.

The RFI document says that DARPA is seeking to prove “the feasibility and potential value of the ability to launch and recover volleys of small UAS [unmanned aircraft systems] from one or more existing large platforms (e.g., B-52, B-1, C-130, etc.).” The drones would carry payloads of less than 100 points and would need to be low-cost to be produced in large quantities for the sort of capability DARPA envisions.

Read 1 remaining paragraphs | Comments

White House Unclassified Network Hacked, Apparently by Russians

The unclassified network of the Executive Office of the President—the administrative network of the White House—was breached by attackers thought to be working for the Russian government, according to multiple reports. The Washington Post reported that an investigation is ongoing, and White House officials are not saying what data, if any, was stolen from the computers on the network. “We are still assessing the activity of concern,” an unnamed White House official told the Post.

According to the Post’s anonymous sources, the breach was discovered in early October after a friendly foreign government alerted US officials. The network’s virtual private network access was shut down, and some staff members were told to change passwords. “We took immediate measures to evaluate and mitigate the activity,” the Post’s source at the White House said. “Unfortunately, some of that resulted in the disruption of regular services to users. But people were on it and are dealing with it.”

This isn’t the first time attackers, apparently sponsored by a foreign state, have targeted the White House’s network. In 2008 and 2012, Chinese hackers penetrated the White House’s network. On the first occasion, the attackers gained access to the White House’s e-mail server; in 2012, a phishing attack against White House staffers gave attackers access to the network, though officials said no sensitive data was exposed.

Read 1 remaining paragraphs | Comments

Chinese Government Launches Man-in-Middle Attack Against iCloud

A screen capture shows the warning of a fake iCloud.com certificate—signed by an official Chinese certificate authority.
GreatFire.org

GreatFire.org, a group that monitors censorship by the Chinese government’s national firewall system (often referred to as the “Great Firewall”), reports that China is using the system as part of a man-in-the-middle (MITM) attack on users of Apple’s iCloud service within the country. The attacks come as Apple begins the official rollout of the iPhone 6 and 6 Plus on the Chinese mainland.

The attack, which uses a fake certificate and Domain Name Service address for the iCloud service, is affecting users nationwide in China. The GreatFire.org team speculates that the attack is an effort to help the government circumvent the improved security features of the new phones by compromising their iCloud credentials and allowing the government to gain access to cloud-stored content such as phone backups.

Chinese iCloud users attempting to log in with Firefox and Chrome browsers would have been alerted to the fraudulent certificate. However, those using Mac OS X’s built-in iCloud login or another browser may not have been aware of the rerouting, and their iCloud credentials would have been immediately compromised. Using two-step verification would prevent the hijacking of compromised accounts.

Read 1 remaining paragraphs | Comments