Researchers develop an ultrasonic mesh network to extract data from computer networks, Feedly and Evernote get attacked, and something is amiss with Windows 7.

Then its a great batch of your feedback, our answers, and much much more!

Thanks to:

— Show Notes: —

Exfiltrating data using an ultrasonic mesh network

• Researchers at the Fraunhofer institute in Germany have developed a protocol based on an underwater communications protocol, to pass messages between laptops using their speakers
• Fraunhofer Institute is famous for having invented the MP3 audio codec and being a significant contributor to the H.264/MPEG-4 AVC video codec.
• The paper describes a ‘Covert Channel’ that can be used to circumvent firewalls and intrusion detection systems
• The system uses ultrasonic sound, emitted by laptop speakers and received by laptop microphones
• The range is about 20 meters and the provides about 20 bits/second of bandwidth
• The general principle is to create a mesh network of laptops in order to exfiltrate data from a protected network or location
• The proof of concept was created by installing a keylogger on a laptop, which would then send the data back to the attacker by emitting the ultrasonic (inaudible to the human ear) sounds, which would then be picked up by another infected machine and repeated, extending the transmission range
• Eventually the signal may be able to reach a machine outside of the protected area or network, and be received by the attack, or re-transmitted by regular means
• As a countermeasure, they suggest possibly disabling the speakers/microphone entirely
• As a more useful countermeasure, they suggest a low-pass filter that would either remove the ultrasonic frequencies from the output, or shift them down to audible range so they can be detected by humans
• The paper also discusses a host-based intrusion detection system that analyzes audio input and output for suspect signals
• Full PDF

Feedly And Evernote Go Down As Attackers Demand Ransom

• After restoring its services after Wednesday’s attack, the Feedly team reported in a blog post Thursday morning that it had been hit by a second DoS attack. As of late Thursday morning, Feedly is down again.
• On Thursday June 12th Feedly Posted to their Blog: “2:04am PST – Criminals are attacking feedly with a distributed denial of service attack (DDoS). The attacker is trying to extort us for money to make it stop. We refused to give in and are working with our network providers to mitigate the attack as best as we can.”
• In Evernote’s case, the company noted yesterday evening that it was unavailable, and that it was working to neutralize a denial of service attack. A few hours later, a message on Evernote’s Twitter account said its service was restored – but it’s not out of the woods yet. “There may be a hiccup or two for the next 24 hours,” the tweet warned.
• At least in Feedly’s case the attackers demanded a ransom to stop the attack.
• It’s unknown as of now if the hackers are demanding ransom from Feedly on day two of the attack. The company has not responded to a request for comment.
• Denial of service attack [Neutralized] – Feedly Blog
• Feedly, Evernote And Others Become Latest Victims Of DDoS Attacks
• BBC News – Feedly and Evernote struck by denial of service cyber-attacks
• EuroBSDCon 2013 — Allan Jude — Mitigating DDoS Attacks at Layer 7

Microsoft patching flaws in Windows 8, but not Windows 7?

• Researchers found the gaps after they scanned 900 Windows libraries and uncovered a variety of security functions that were updated in Windows 8 but not in 7. They said the shortcoming could lead to the discovery of zero day vulnerabilities.
• The missing safe functions were part of Microsoft’s dedicated libraries intsafe.h and strsafe.h that help developers combat various attacks.
• Researcher Moti Joseph and malware analyst Marion Marschalek (@pinkflawd) developed a capable diffing (comparison) tool dubbed DiffRay which would compare Windows 8 with 7, and log any safe functions absent in the older platform.
• In a demonstration of DiffRay, the researchers found four missing safe functions in Windows 7 that were present in 8.
• Including:
  • bcrypt.dll!ConvertRsaPrivateBlobToFullRsa
  • netlogon.dll!NlpAddResourceGroupsToSamInfo
  • twext.dll!EscapeField (possible unpatched interger overflow in Windows 7, fixed in 8)
• Slides
• Video – What happens in Windows 7, stays in Windows 7

Feedback:

• SSD read-caching at hardware RAID level?

• What would you do to make a SoHo server the most reliable?

• GPG and Email encryption

• Regarding secure FTP clients…

• MPLS or VPN

Round Up:

• Replicating NSA’s gadgets using open source
  
• iOS 8 strikes an unexpected blow against location tracking
• Cisco patches cross-site-scripting flaws in security appliances that allowed unauthenticated remote code execution
• Massive TweetDeck outage may have been ‘accident’ caused by teen’s experiment
• Google engineer: We need more Web programming languages
• Microsoft Protests Order to Disclose Email Stored Abroad
• Juniper Networks Partner caught selling beta and pre-release hardware to Cisco. Cisco reverse engineering Junipter products to try to blunt competitive edge, claims it was looking for IP infringment
• Cyberbullying law would let police ‘remotely hack into computers, mobile devices, or cars’
• NSF Researcher banned after caught using super computers to mine bitcoins
• Canada: 14-Year-Olds Hack ATM Using Default Password Available on the Internet
• Krebs — P.F. Changs latest victim in credit card breach, started in March