Online Crime Bytes

DEFCON Kids?

August 8, 2011, LAS VEGAS—Counting stopped at 10,000 when they ran out of the cool titanium badges that hang around attendee’s necks for the annual hacker conference in the desert, DEFCON 19. By estimates, some 15,000 to 25,000 hackers, cybercops and cyberkids attended DEFCON’s new, upgraded digs at the Rio this past weekend. 

That’s right—cyberkids—of which there were an estimated 60 in attendance. Again these numbers are estimated because DEFCON doesn’t take data on attendees, only their cash, which is nominal at $150 per head given the depth and breath of classes and contests on lock picking, device hacking, computer and protocol attacks and defenses and so much more. 

The kids were hard to miss as they were tended by adult guardians and taken through a variety of exercises, puzzles, games and competitions that their grown up counterparts have become adept at. As part of the program, these young cyber talents were shown the ropes and entered into their own “Wall of Sheep” hack and defend competition (rather than the more brutal adult version). They also enjoyed their own panel with the feds and a social hour geared toward youth.

When asked, the kids (ages 8-16) were all about winning their respective games and competitions, while toddlers and babies could be found conked out on mom or dad’s shoulder.  One of those moms, sporting a toddler on her hip and with two kids in the DEFCON Kids program, said this was just the beginning and to expect next year’s DEFCON Kids participation to double or triple.   

The point, say organizers, is to foster the next group of cyber warriors to defend networks and users from increasingly sophisticated cyberthreats. By nurturing their curiosity and desire to test the limits of technology, organizers also helped kids learn the value of responsible disclosure and how hacker research like the data and experiences presented at DEFCON can lead to systemic improvements.

Many other government and private sector organizations are also working to bring up the next generation of cyber warriors and responsible users, including the Executive Women’s Forum. At the Black Hat Briefings at Caesar’s Palace (held during the two days proceeding DEFCON), EWF founder Joyce Brocaglia hosted a receptio to recruit more volunteers for the Cyber Security School Challenge. Founded by the EWF, the challenge is a collaborative outreach program in partnership with Carnegie Mellon University, (ISC)², the National Cyber Security Alliance, and OwnYourSpace® to help educate youth on the topics of online security, privacy, and safety.

Educating and challenging our next generation of users and cyber warriors is a noble endeavor on all levels. Some, however, feel that the venue, Las Vegas with all its wicked ways, is not the place for impressionable youth. Having children present among hardcore (mostly good guy) hackers who playfully mess with the ATMS, slots and elevators, who insult and shock talk from the stage (sometimes lewdly), can also be a parental nightmare.

“Bringing kids to DEFCON is a bad idea,” says one father, a system admin who left two children home to attend DEFCON. “Las Vegas is no place to bring kids period.”

From how it seemed, the youngest kids were fully insulated from the late night Hacker Jeopardy and other events that get a little raunchy. The pre teens and teens that did attend the later sessions seemed to take the drunken game players, the partial strip downs and other antics in stride.  Some of the young actually instigated the trip to DEFCON, bringing along their non-technical parents who’s eyes were wide with wonder ...

 

 

 

 

 

Hacker Wars, Social Revolution and The End of the World: All at RSA 2011

SAN FRANCISCO—A hacker war erupted just before the start of the RSA Security Conference at the San Francisco Moscone Center on February 14-17. The Federal arm of well-known security consulting company, HBGary, succumbed to a sophisticated social engineering attack by the Anonymous hacker group that accessed and sent HBGary’s internal emails and customer information to Bit Torrent.  

Also leading up to this annual conference were several other interesting cyber events that commanded attention:

    • The peaceful transfer of power in Egypt wherein social Networking was identified as the key  instrument for a mostly-peaceful transfer of power in Egypt.  

    • A widespread attack called Night Dragon against Exxon and several other oil and gas companies on the heels of Stuxnet’s targeting of specific SCADA control systems within Iraq’s nuclear plants.

The churn of these and other cyber events was felt at parties and meetings and on the showroom floor where the predominant theme was one of pending disaster.

“If you ask them, half the people at this conference would say the next big threat landscape is digital 9-1-1 involving SCADA control systems,” said Dan Holden, director of H-P Security’s DV (Digital Vaccine) Labs, during an interview. “But people forget that small yet highly vulnerable browser, which is still the major cause of most exploits.”

Holden’s group sponsored a pwn2own contest at Cansec West hacker conference in Vancouver last March (2010). In the contest, every major brand of browser was broken easily and quickly using multiple zero days the browsers were vulnerable to.

Browsers are a big problem because they are everywhere, including and in particular on phones, which are increasingly problematic for Executive Security Firm, the Guidry Group.

“On the kidnap and ransom side, cell phones are making it increasingly difficult to protect our executives and their families,” said Michael Guidry, founder and CEO, during a mobile symposium panel held outside of RSA on Tuesday. “Youngsters are twittering where they are with their families and their chats can be intercepted. And smart phones can be hacked and used as recording devices to steal intellectual property during executive meetings.”

In addition to browser and e-mail risks, Rob Smith, founding CTO of Mobile Active Defense, says that applications are also a serious concern. Apple cannot vet each of the tens of thousands of applications hosted at the iTunes store beyond ‘does this application work as it says it does?’ As a result, he says, logic bombs and time-released attack code can be hiding in the games, which can then go off after the applications been approved and posted to the iTunes store.

As risks get more complex and persistent, and as demand for access, mobile and even cloud applications continue to rise, organizations need to rethink security on every level, say experts.

So far, that thinking has led to new standards and work to unify security and embed it into operations wherever possible. For example, IF-MAP (Interface for Metadata Access Points), part of the Trusted Computing Group’s Trusted Network Computing (TNC) binds security state of end points to access controls and requests under the SOAP architecture. Version 2.0 of IF-MAP includes frameworks for industrial control systems, smart grid and cloud environments.

Using open standards and other technology, vendors are trying to unify security and operational controls where it makes most sense.

For example, in the authentication and access control space, vendors such as five-year-old SecureAuth have developed access control management frameworks that take away the complexity of managing access through multiple applications. SecureAuth CEO Craig Lund says it took two years to develop their technology, which takes advantage of ActiveDirectory to create a one touch provisioning of access across web, VPN and cloud applications.

In addition to access controls, there are many areas in which consolidation is occurring to help make security management and compliance easier. These include advanced firewalls and end point management, with such enhancements announced by Check Point and Lumension, respectively. Security management and continuous monitoring by companies such as NetWitness, Splunk and H-P/Fortinet/ArcSight are also evidenced across other vendors in these categories.

While many may not think of these improvements as glittery and new, the fact is we’re buried in too many security products to sanely manage risk in this increasingly open, consumer-driven and hostile environment. Whatever the industry can do to streamline its security and compliance operations, the better the chances of improving the IT experience for all users by enabling secure, compliant lines of business.

Stupid Check Scammers

The beauty of the below email scooped from my inbox is that the criminals are actually TELLING US what banks they're defrauding and what types of accounts--Wells Fargo checkingand savings accounts, Bank of America credit accounts ... Classic phishing and check forwarding scams combine in one mail which happens to be full of nasty iFrames hidden in the HTML code no less.

Hey banking institutions, if I were you, I'd have my ear to the ground for scams like these and send investigators after the sendorss of the e-mails like the one below:

    Date: Jun 29, 2010
    Subject: EASY JOB OFFER FOR YOU.
    To:
    Hello,
    How are you today? I want to introduce you to a job offer i think you will like.
    Simply , You will Receive Instant Money Transactions through Bank of America Credit Card Account or
    Checking Account/Saving Account or Wells Fargo Bank Account direct transfers.
    You can easily withdraw the money at the bank or ATM.
    You will keep Up to 10% of the total amount you received.
    (on each $10000 you will keep $1000)
    Forward the money after deducting your 10% to any of our designated agents.
    Please fill the information below if you are interested in our offer.
    Name:
    Address:
    Country:
    State:
    Zipe Code:
    Phone Number:
    Bank Name:
    This Job is available 7 days a week (MON~SUN)
    If you are interested please send your response ASAP. You should have a Bank of America or Wells    Fargo Bank accounts or willing to open one if you must apply.
    Thank you and kindest Regards
    Spencer. Anthony

Scammed via Spam on Smart Phones

“Can somebody help me?”

It was the soft, pleading voice of a young woman who didn’t look well.

I was at my Chase branch, angry with Chase’s changes to what were once Wa Mu accounts (resulting in Chase losing several thousands worth of my mortgage payments—which is another story).

The young woman was talking over me to the branch manager who was on the phone to her new headquarters trying to sort my mess out. The girl looked as though she’d had a hard life, she and her young boyfriend a little too skinny; he, at least, possibly strung out, with stubble on his shaved head and beard.

As the bank manager held on the phone, the girl started talking in a voice you had to strain to hear, which we all did as the branch went otherwise silent.

“It’s about $895 we spent on this Internet program. We need to know if we should send them more. Or if we can get our money back.”

The girl, with blond streaked hair, locked her glassy eyes with mine as I turned to acknowledge what she was saying. She held up her iPhone, adding “See, they sent us this contract, it’s all legal, right? We sent them the $895 dollars. And now they’re asking for more.”

Young, very young, maybe emancipated … and she's recovering from surgery she then tells me.

“So now they’re asking us for more money,” says the girl again, who by now is at the teller while her boyfriend sits back on a blue couch behind her. "Do we give it to them?"

When the tellers and I inform these poor youngsters that they'd been scammed and to stop sending them any money, the young man leaps from the couch and says “I Thought SO!”

It all happened over her iPhone, entering in via her e-mail and costing these people probably all the money they had in the world. No, she couldn’t put a stop on the check because they sent the money via Western Union. Yes, she should report it to the local police, the teller explained to her.

As they left the branch, the girl was propped the boy’s arm for support, the pain meds from her surgery wearing off. As they left, all I could do was hand them the scribbled down web address to the Internet Crime Complaint Center for filing a report.

Real victims. Real crimes. Now anyone with any type of smart phone is a target. 

For some of those people, such unfettered access to the Internet over their phones is new. And criminals know, it’s the newbies that always make the best targets because they aren’t wise to the criminal's ways.

I predict a huge wave of crime to hit smart phone users as everyone who didn’t use to have computers now has a computer carried right in their purses and pockets wherever they go.

Getting Hacked at Defcon

LAS VEGAS--All these years I’ve outsmarted the Defcon hackers with one simple rule: Carry no computer into the Defcon melee.  Just a pen and paper to record to notate events is all that's needed—which are kinda hard to hack unless the notes are wrestled away or lost (which has been known to happen after too many Vegas parties).

But this was my first year with my new iPhone, and boy, was I reminded about how much of a computer these smart phones have become.

It happened after I went on the air with a local Las Vegas radio station on a show called “The Usual Suspects.”

The broadcast was being hosted live from a skybox looking down over the Defcon gaming area. Host SMAction (Scott Miller), GiD (no real name available) and R0d3nt (Andrew Strutt) asked about my impressions of Black Hat (see previous blog), government pay for hacking talent, and so on. And I asked whether or not they should be cleaning the microphone between uses. (They put the mic right up to your lips, man).

Once downstairs in the gaming area, two of my pals (one from Air Force, one formerly Army and Homeland Security) asked if my iPhone was sending a wireless signal. Bluetooth was off. Accept no new networks was on (so no network could connect to my phone without me requesting the connection). But I hadn’t thought about how the iPhone is always looking for a wireless signal to connect to the Internet.

We turned Wi-Fi off, no harm done. But after leaving my friends and heading toward the Hacker Jeopardy game, a gray highlighted message appeared on my iPhone screen that read, “Do you want to know your location? Yes  Cancel.”

Clicking cancel just made the message come back. Like a DoS (denial of service), it kept interrupting important texts with my friends. (“Where’s the parties?” “Delchi mixing, Top of the Riv [short for Riviera, the hotel venue for Defcon].” “What are u doing?” “303 party in Skybox!” “Where r you now?”)

For help, I stopped three Defcon Goons in the hall and showed them the message that kept looping. Goons are the big hacker guys in red t-shirts with radios and other gear who make sure some order is followed (for example preventing stampedes and throwing out Dateline reporters who appear undercover  after being warned ahead of time about Defcon media rules). 

The three Goons determined the DoS to be a direct attack on the phone’s GPS (global positioning system used for getting maps), which was also sending out a signal.  Once they clicked that off, the messages stopped. Thanks, Goons.

The experience has forever embedded in me that phones really are computers. And they’re promiscuous at that—constantly reaching out to other networks and devices hoping to connect.

Phones aren’t all that is reaching out. So, too, are the chips and magnetic stripes on passports, driver’s licenses and banking/credit cards. So now I am shopping for a wallet that blocks RFID readers from doing passby downloads off all the cards I carry with me.

At least at the conference, the hacks are done for sport, no identities are really stolen, and when user passwords to phones and such are caught, they’re pasted up on the Defcon wall of shame in a way that will not overly-expose the victims. Only part of a user name and password captured by hackers appears on the wall of shame (the rest is xxxd out). So the wall posts just enough for the victim to know it was his/her password and username that was intercepted, but not enough for anyone to use the data to gain access.

Looking forward to next year, hackers. Hopefully by then I’ll be more prepared.

 

Black Hat 2009: Nothing’s Safe

LAS VEGAS—For years hackers have been telling us that everything in the digital world is already owned. “No, everything,” is part of a logo for the Smoo Group, for example. But there’s always been small comfort that some technologies are too difficult for hackers to break and therefore safer to use.

The MacIntosh operating system, our carrier-bound wireless phones (in the U.S. anyway), virtual machine-to-host system connections, and sub-layers in the physical hardware are examples of technologies in which I’ve had some level of faith in the past. Not anymore.

In the third and fourth-floor ballrooms at Caesar’s Palace, all of these technologies were shown to be broken during Black Hat 2009 in Las Vegas this week.

All research demonstrated at Black Hat was done so responsibly—specific vulnerabilities have been patched by the technology vendors who where alerted to the problems by the researchers presenting at Black Hat this year. Nevertheless, these harbingers have stripped away any delusion that there is a single technology we could consider “safe” from attacks and abuse.

Imagine, if you will, rampant phishing directly off wireless devices, and the carrier is powerless to protect because the attacks being conducted are invisible to the carrier. This is entirely possible by tricking SMS into buffer overflowing a place in memory to accept remote commands, as demoed on the iPhone by Charlie Miller and Collin Mulliner.

“You’re phone is your most ‘personal’ personal computer,” said John Hering in a followup session. Hering sat on a panel that essentially described how to use similar techniques in the iPhone hack to look for these bugs in all smart phones.  The tool they developed is called Fuzzit.

Work like this is taking place ahead of the crime wave that will ultimately follow as more zero day vulnerabilities are discovered by the real criminals that are not part of the ethical research community at Black Hat. 

Ahead of the curve research like this offers some comfort. So, too, does the unprecedented cooperation between vendors and researchers this year—a far cry from the Cisco/ISS gaffe against researcher Michael Lynn in 2005.

Still, there’s so much work to be done it’s overwhelming, which was particularly evident during the panel on Washington, in which government, security and privacy experts couldn’t agree on who should handle the cyber security problem or how it should be handled. But it was clear to all that today’s Band Aid solutions to each individual problem will only hold up so long.

Ultimately, this begs the question that was asked more than once at Black Hat: Should we tear up the Internet as we know it and rebuild a backbone structure that starts with security first? Or should we hope that the current model of playing Whack a Mole with patches and standards holds up for our future generations?  

Harassment is Harasment

It looks like a beast of a woman who dressed up as a boy on MySpace to harass a 13-year-old into committing suicide is getting away with it. 

Why? 

Because monster woman conducted her harassment on the Internet and the justice system couldn't find a law that applied.

My question has been and always will be "Why do we need a different law because it happened in cyberspace?"

This is a case of harassment. Why not just charge that monster mother for harassment of a child? A child died directly because of that harassment. 

Why do we get hung up on the technology over which the harassment was conducted? 

As a mother, this case sickens me more ways than one. It turns my stomach that a girl died young, alone and utterly distraught, and worse that there will be no justice. It sickens me further because throughout the public ordeal, monster mom has shown no remorse.

Makes you wonder if she, the spoiled brat daughter she was 'protecting,' or others reading about this injustice will repeat such evil.

RSA: Final Thoughts

SAN FRANCISCO—Attendance was down enough to dull what’s usually a loud roar to a low buzz in the cavernous expo hall at the RSA Security Conference last week. Yet, examples of innovation and security maturation were still in abundance. In particular, there was a lot of standards-based innovation around authentication, managing peoples’ online identities, encryption and data management.

“What the market is moving toward is end-to-end trust, both preventive and reactive,” said Scott Charney, Microsoft’s corporate VP of Trustworthy Computing, during a Tuesday morning keynote. “This includes root trust in the hardware store, and trust of the people requesting access, and protection of personal and confidential data.”

Vista includes full volume encryption with Trusted Bit Locker based on the Trusted Platform Module (chip security) framework, and has a browser application to accept only digitally signed data. For Windows 7, Microsoft has partnered with EMC/RSA for technology to create secure, peer-to-peer IPV6 log-in sessions using IPsec (Internet Protocol Security).

In another project, code-named ‘Sterling,’ Microsoft is developing an API for third parties to create an “identity meta system” akin to how birth certificates are used in the real world, according to Charney. (As I blogged previously, some security vendors are even looking at becoming the overall vetting service for online identities, akin to what Verisign does with digital certificates.)

There was also a lot of development around OATH (Initiative for Open Authentication), an open standard for two-factor authentication, which is happening on cards, tokens and phones, says Don Malloy, business developer manager at NagraID and marketing chair for OATH. 

Integration between applications and network security was also announced by security lifecycle management startup, Tufin Technologies, which released TOP (Tufin Open Platform) open APIs for developers. Already it partners with F5 and Blue Coat for policy management, and is deeply integrated with Check Point, Juniper, Cisco and Fortinet.

Also at the application level, another leap in database security appears to have happened, with database security vendor Secerno going beyond the external database firewall model we’re seeing today to include access controls, encryption management, and filtering at the database kernel level.

Improvements in Web and cloud application security are also beginning to emerge that go beyond the traditional Web application firewalls. Mykonos, at a classy reception atop the Sir Francis Drake Hotel, launched a secure end to end framework for Ajax application developers. It includes encryption, digital signatures, logging, and auditing against SQL injections, session hijacking and other common problems associated with Web applications.

Particularly during this economic downturn, this type of unsexy, low-level, standards-based development is exactly what the industry needs in order to emerge from the recession prepared for customer demands, says Tom Corn, VP of marketing for RSA.

“We’ve got to stop playing Whack-a-Mole with all these new security issues and solutions that come up,” he says. “We need to decouple authentication from individual applications to enforce policies that span identities, infrastructure and information controls.”

RSA First Impressions: Virtualization and Identity Innovations

SAN FRANCISCO—Virtualization as a security mechanism, starting with virtual vaulted machines for different levels of use, is one idea to come out of Symantec’s innovator’s meeting today at RSA.

In this model, there would be the primary VM the same as most computers today; least secure “playground” (players, peer to peer, etc.)” and super securest, preconfigured with minimal applications (o/s, browser) for use during the HTTPS session.  All this would roll over flawlessly without user notice … in fact they had to put up funny little icons to show when they were switching between Virtual Machines during the demonstration.

This is a backward take on what I’ve been thinking about security as a virtualization device in that it can hide the security software beneath the O/S and therefore not get rootkitted. They have plans to go there, too, but they started first with the virtual desktop piece.

I’m not thoroughly satisfied with their answer to my question on upkeep (patching, configuration) for the three machines: Their answer is the master is still controlled like they would a single physical machine with their auto updates turned on, etc. The necessary updates will hit them all where they apply, but somehow Symantec will have to ensure that the uber secure machine, at least, is continuously configured securely.

Symantec also had this idea of identity layer that would require a middleman to vet identities for uber secure accounts and later for the masses once we get all the standards, vendors and new layer of middlemen sorted out.  Symantec says customers are begging them to manage their identities.   In this model, Symantec would act like the master Verisign type service only deeper. But how is this different than the vetting type ID services in action today?

Think about dating sites, says Brian Hernacki, Symantec Architect. Serious customers would pay extra for a stamp or a star saying they’ve been vetted enough to know they’re not making things up.  So they’ll pay extra to be snooped upon?  Now that’s a turn of events.

Help! I'm Stuck in London and I've Been Robbed!

The scam got one of my daughter's college friends to send $300 to a total stranger in London. How? 

First the scammers somehow hijacked her Facebook account, then sent an urgent message to all her Facebook Friends. The message said she'd been robbed in London, had no money or passport and to please wire money. My daughter's sweetest of friends sent the money without question, which is what the scammers want. They want to elicit such a strong emotion that the recipient acts first, asks questions later.

Question are what I started asking after my daughter contacted me about the scam. An FBI spokesperson said they've recently received multiple complaints reporting their Facebook accounts and other e-mail accounts were being hijacked and mails sent to all the addresses in their email lists with the same or similar message.

Although it sounds suspiciously like a Facebook problem, a spokesperson from Facebook told me that this was a manual attack, these accounts are getting picked off one at a time. He also said that the accounts were likely taken over by someone who got their passwords somewhere else - most often through another online account  using the same email and password. This makes sense to some degree, as my daughter said she did have a problem with her Paypal account about a month earlier in which Paypal alerted her that her account had been "accessed by a third party."  And she used the same password and email address for both accounts.

But why, all of a sudden, this rash of these scams over Facebook specifically? I still hazard it might be a Facebook problem. 

But it's also just as likely that accounts were accessed through another hacked account, for example from a hacked Paypal account to a Facebook account. To me, that means that there is a secondary market for stolen credentials. In the primary market, financial information is phished and derived directly from compromised accounts. When the activity caught and the account closed, they then peddle the credentials off to somewhere labor is cheap. In this secondary market, they scour around for Facebook and email accounts that are used by the same people, test the credentials, and viola! they're in.

It's making my head spin.  

Bottom line is DON'T FALL for these scams. Second, if you use the same password for multiple accounts, you might want to rethink that. Or at the least, change passwords to all accounts using that password should one go awry.