pin – Jupiter Broadcasting

Cyber Liability | TechSNAP 314

chris — Wed, 12 Apr 2017 02:09:54 +0000

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Researchers demonstrate how PINs and other info can be gathered through phone movement

Team was able to crack four digit-PINs with 70 percent accuracy on the first try, with 100 percent accuracy by try number five
A site accessed with malicious code can open the device to such sensor-based monitoring working in the background when browser tabs are left open.
The team suggests a number of ways to help combat vulnerabilities, including regularly changing PINs and quitting out of any apps not currently in use
Dan suggests: Simple way around this: randomize the display of numbers on the keypad. I think this should be standard for all PIN entry. I recall seeing this somewhere, years ago, but I don’t recall where. I’ve always wondered why I’ve never seen it again. If the numbers have a narrow field of vision, nobody can watch over your shoulder.
A better article on the issue
The PDF of the study
From the PDF: . In the latest Apple Security Updates for iOS 9.3 (released in March 2016), Safari took a similar countermeasure by “suspending the availability of this [motion and orientation] data when the web view is hidden”x

Computer security is broken from top to bottom

Robert Watson spoke at the very first BSDCan
There are three main fundamental causes of insecurity: technology complexity, culture, an the economic incentives of the computer business.

Deep Dive starts with Dan’s first blog post about PostgreSQL

PostgreSQL
PostgreSQL < 9.6 has DATADIR is the same for all versions
PostgreSQL 9.6+ on FreeBSD, each major version has it’s own DATADIR
Installing in a FreeBSD jail means you can easily upgrading another jail, then start using it

Feedback

10 messages this past week. Requests for deep dives on PostgreSQL, DNS, ZFS, Jails.
The guy who asked us about that free DNS service, wrote in to say he has no connection with them.
Building pfsense box
Suggestion for a Simple Inventory & Change Management Software
Raidz-1 with hotspare vs raidz-2

Round Up:

The post Cyber Liability | TechSNAP 314 first appeared on Jupiter Broadcasting.

Metaphorically Exploited | TechSNAP 258

chris — Thu, 17 Mar 2016 16:40:16 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The theoretical Android flaw becomes reality, a simple phishing scam hits some major companies & why your PIN has already been leaked.

Plus great questions, our answers, a rocking round up & much, much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

W2 Phishing scams hit a number of companies

“Payday lending firm Moneytree is the latest company to alert current and former employees that their tax data — including Social Security numbers, salary and address information — was accidentally handed over directly to scam artists”
“Seattle-based Moneytree sent an email to employees on March 4 stating that “one of our team members fell victim to a phishing scam and revealed payroll information to an external source.”
“Moneytree was apparently targeted by a scam in which the scammer impersonated me (the company co-founder) and asked for an emailed copy of certain information about the Company’s payroll including Team Member names, home addresses, social security numbers, birthdates and W2 information,” Moneytree co-founder Dennis Bassford wrote to employees.”
Why that would even be a reasonable request, I don’t know
“Unfortunately, this request was not recognized as a scam, and the information about current and former Team Members who worked in the US at Moneytree in 2015 or were hired in early 2016 was disclosed. The good news is that our servers and security systems were not breached, and our millions of customer records were not affected. The bad news is that our Team Members’ information has been compromised.”
Moneytree joins a growing list of companies disclosing to employees that they were duped by W2 phishing scams, which this author first warned about in mid-February. Earlier this month, data storage giant Seagate acknowledged that a similar phishing scam had compromised the tax and personal data on thousands of current and past employees.
“On March 1, Seagate Technology learned that the 2015 W-2 tax form information for current and former U.S.-based employees was sent to an unauthorized third party in response to the phishing email scam. The information was sent by an employee who believed the phishing email was a legitimate internal company request.”
“W2 information is highly prized by fraudsters involved in tax refund fraud, a multi-billion dollar problem in which thieves claim a large refund in the victim’s name, and ask for the funds to be electronically deposited into an account the crooks control.”
“For better or worse, most companies that have notified employees about a W2 phish this year are offering employees the predictable free credit monitoring, which is of course useless to prevent tax fraud and many other types of identity theft. But in a refreshing departure from that tired playbook, Moneytree says it will be giving employees an extra $50 in their next paycheck to cover the initial cost of placing a credit freeze (for more information on the different between credit monitoring and a freeze and why a freeze might be a better idea, check out Credit Monitoring vs. Freeze and How I Learned to Stop Worrying and Embrace the Security Freeze).”
““When something like this happens, the right thing to do is to disclose what you know as soon as possible, take care of the people affected, and learn from what went wrong. To make good on that last point, we will be ramping up our information security efforts company-wide, because we never want to have to write an email like this to you again”.”

New exploit developed for Android Stagefright

“Security researchers have successfully exploited the Android-based Stagefright bug and remotely hacked a phone, which may leave millions devices vulnerable to attack.”
“Israeli software research company NorthBit claimed it had “properly” exploited the Android bug that was originally described as the “worst ever discovered”.”
“The exploitation, called Metaphor, is detailed in a research paper (PDF) from NorthBit and also a video showing the exploit being run on a Nexus 5. NorthBit said it had also successfully tested the exploit on a LG G3, HTC One and Samsung Galaxy S5.”
“The Stagefright vulnerability was first highlighted by security firm Zimperium in July 2015. The hack was said to be able to execute remote code on Android devices and could possibly affect up to 95 percent of Android devices.”
“A second critical vulnerability exploited issues in .mp3 and .mp4 files, which when opened were claimed to be able to remotely execute malicious code, was dubbed Stagefright 2.0 in October.”
The flaws were originally thought to not be easily exploitable, but this new research provides a simple remote exploit case
“The researchers from NorthBit say they have been able to create an exploit that can be used against Stagefright on Android 2.2, 4.0, 5.0 and 5.1. Other versions are not affected.”
Android 5.0 and above are protected by ASLR, however “Dabah claims the exploit “depicts a way to bypass” address space layout randomisation (ASLR)”
“”We managed to exploit it to make it work in the wild,” Dabah said. The research paper reads: “Breaking ASLR requires some information about the device, as different devices use slightly different configurations which may change some offsets or predictable addresses locations.”
“”I would be surprised if multiple professional hacking groups do not have working Stagefright exploits by now. Many devices out there are still vulnerable, so Zimperium has not published the second exploit in order to protect the ecosystem”.”
Researcher PDF
I am glad my phone runs Android 6.0.1 with the March 2016 Security Updates applied

PIN analysis

“There are 10,000 possible combinations that the digits 0-9 can be arranged to form a 4-digit pin code. Out of these ten thousand codes, which is the least commonly used?”
“People are notoriously bad at generating random passwords. I hope this article will scare you into being a little more careful in how you select your next PIN number. Are you curious about what the least commonly used PIN number might be?”
“I was able to find almost 3.4 million four digit passwords. Every single one of the of the 10,000 combinations of digits from 0000 through to 9999 were represented in the dataset”
“A staggering 26.83% of all passwords could be guessed by attempting the top 20 combinations”
“The first “puzzling” password I encountered was 2580 in position #22. What is the significance of these digits? Why should so many people select this code to make it appear so high up the list?”
This turns out to be straight down the middle of a telephone style number pad. Not the same as on on a computer, but most ABMs use the telephone style
“Another fascinating piece of trivia is that people seem to prefer even numbers over odd, and codes like 2468 occur higher than a odd number equivalent, such as 1357”
“Statistically, one third of all codes can be guessed by trying just 61 distinct combinations! The 50% cumulative chance threshold is passed at just 426 codes (far less than the 5,000 that a random uniformly distribution would predict)”
The most unpopular pin is: 8068
“Warning Now that we’ve learned that, historically, 8068 is (was?) the least commonly used password 4-digit PIN, please don’t go out and change yours to this! Hackers can read too! They will also be promoting 8068 up their attempt trees in order to catch people who read this (or similar) articles.”
“Many of the high frequency PIN numbers can be interpreted as years, e.g. 1967 1956 1937 … It appears that many people use a year of birth (or possibly an anniversary) as their PIN. This will certainly help them remember their code, but it greatly increases its predictability”
Pins that start with 19 dominate the top 10%, and all appear within the top 20%
The heatmap also shows that people tend to use Birthdays a lot as well (MMDD)

Feedback:

Round Up:

The post Metaphorically Exploited | TechSNAP 258 first appeared on Jupiter Broadcasting.

Garbled Transmission | TTT 235

chris — Tue, 08 Mar 2016 12:00:16 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Bittorrent client Transmission gets hit with Ransomware, Facebook pays out $15k to a hacker & Microsoft is bringing SQL to Linux. It’s a HUGE edition of Tech Talk Today!

Direct Download:

RSS Feeds:

Show Notes:

Episode Links

Kickstarter of the Week

The post Garbled Transmission | TTT 235 first appeared on Jupiter Broadcasting.

Dip the Chip | TechSNAP 255

chris — Thu, 25 Feb 2016 17:48:27 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

What’s taking the states so long to catch up to the rest of the civilized world and dip the chip? Turns out it’s really complicated, we explain. Plus keeping a Hospital secure is much more than following HIPAA, and an analysis of Keybase malware.

Plus great questions, our answers, and much much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

The great American EMV fake-out

“Many banks are now issuing customers more secure chip-based credit cards, and most retailers now have card terminals in their checkout lanes that can handle the “dip” of chip-card transactions (as opposed to the usual swipe of the card’s magnetic stripe).”
But how many people have been to a retailer and ended up swiping their chip card?
“Comparatively few retailers actually allow chip transactions: Most are still asking customers to swipe the stripe instead of dip the chip. This post will examine what’s going on here, why so many merchants are holding out on the dip, and where this all leaves consumers”
“Visa CEO Charles W. Scharf said in an earnings call late last month that more than 750,000 locations representing 17 percent of the U.S. face-to-face card-accepting merchant base are now enabled to handle chip-based transactions, also known as the EMV. Viewed another way, that means U.S. consumers currently can expect to find chip cards accepted in checkout lines at fewer than one in five brick-and-mortar merchants.”
This leaves the question of why more retailers are not using the chip. In Canada, and the EU, almost all transactions use chip-and-pin
“New MasterCard and Visa rules that went into effect Oct. 1, 2015 put merchants on the hook to absorb 100 percent of the costs of fraud associated with transactions in which the customer presented a chip-based card yet was not asked or able to dip the chip. The chip cards encrypt the cardholder data and are far more expensive and difficult for card thieves to clone.”
“Some merchants — particularly the larger ones — want to turn the often painful experience of training customers how to use the chip cards and terminals into someone else’s problem.” “They see [chip cards] as just slowing down lines and chose to wait until consumers learned what to do — and do it quickly — at someone else’s store”
It seems that even with the liability shift, which Visa and Mastercard hopes would push merchants to be ready on time, many merchants have not completed upgrades to their payment systems and cash registers. Apparently many of the acquiring banks have long queues to ‘certify’ the upgraded software, further causing delays
“Visa said based on recent client surveys it expects 50% of face-to-face card accepting merchants to have chip card transactions enabled by the end of this year. But even 50 percent adoption can mask a long tail of smaller merchants who will put off as long as they can the expensive software and hardware upgrades for accepting chip transactions.”
In Canada, the transition was fairly quick, although this might be due to the fact that many people use debit cards that already required a pin, so the change for the customer was just inserting the card rather than swiping it
“The United States is the last of the G20 nations to move to more secure chip-based cards. As late as the United States is on EMV implementation globally, the process of merchants shifting to all-EMV transactions is still going to take several more years. Visa has said it typically took about three years after the liability shifts in other countries before 90% of payment card transactions were “chip-on-chip,” or generated by a chip card used at a chip-based terminal.”
“Historically, software was developed by terminal manufacturers and some-few contract programmers who kept up with the old-school operating systems, software development kits and so on for each terminal manufacturer. It was so easy that merchants and processors installed specialized tweaks that created countless variants in the marketplace.”
Now the software is more complicated, as it involves correctly implementing cryptography, and the terminal vendors seem to be struggling to keep up
“There are very few EMV software developers who understand the U.S. market”
“There’s an invisible hand at work that is about to kick everyone in the pants and accelerate U.S. dipping into EMV slots,” Crowley said. “If you use a chip card at a point of sale that says swipe — and you later say that wasn’t me – there’s very little a merchant can do to dispute that charge. It’s going to happen because what people aren’t thinking about is the friendly fraud. When people are made aware that if I swipe and I have a chip card, that lunch can be free if I’m a bad consumer.”
Note that this is still fraud, and you could go to jail
“If you’re curious about chip card swipe adoption in your area, take an informal survey: My own decidedly unscientific survey involved a shopping spree one recent morning to no fewer than seven different retail locations, which revealed exactly seven different chip-capable payment terminals instructing customers to “Please Swipe Card.””
Does typing your pin really take much longer than signing the receipt?

Securing Hospitals

Researchers working for a hospital were able to compromise both Patient Monitors and the Drug Dispensary
“The research results from our assessment of 12 healthcare facilities, 2 health care data facilities, 2 active medical devices from one manufacturer, and 2 web applications that remote adversaries can easily deploy attacks that target and compromise patient health. We demonstrated that a variety of deadly remote attacks were possible within these facilities, of which four attack scenarios are presented in this report.”
“One overarching finding of our research is that the industry focuses almost exclusively on the protection of patient health records, and rarely addresses threats to or the protection of patient health from a cyber threat perspective. The background, motivating factors, nuances, and misunderstandings that perforate the healthcare industry with regard to security are discussed at length in this report. In summary, we find that different adversaries will target or pursue the compromise of patient health records, while others will target or pursue the compromise of patient health itself.”
“The two major flaws in the healthcare industry with regard to threat model are that 1) the focus is almost entirely on protecting patient records, and 2) the measures taken address only unsophisticated adversaries: essentially, only one of the adversaries listed above — the Individual or Small Group adversary highlighted above in yellow. The industry is aware and speaks to Organized Crime and Nation State adversaries, but underestimates their sophistication and motivation. The strategies aim to curtail blanket, untargeted (i.e., indiscriminate) attacks to obtain patient healthcare records, and ignores the motivations and strategies that would be employed if targeting patient health or specific victims’ health records. These motivations and scenarios are highlighted in red in the above table”
The protection of health records has been the focus for quite some time, even before records were computerized, but it seems the industry has not “noticed” that medical devices have been connected to the network, and are insufficiently protected from attack
Devices compromised during the testing were: an insulin infusion pump, a patient monitor station, and a barcode reader
The following attack surfaces / areas of vulnerability were identified:
- Patient Health
- Patient Records
- Service Availability
- Community Confidence and Trust
- R&D, Intellectual Property
- Business Advantage
- Hospital Finances
- Hospital Reputation
- Physician Reputation
PDF Report, 71 pages

KeyBase malware analysis

“The usage of a rather simple keylogger malware has gone through the roof after its builder got leaked online last summer”
“KeyBase is a spyware family that can capture keystrokes, steal data from the user’s clipboard, and take screenshots of the victim’s desktop at regular intervals”
“Caught red-handed, its author promised to stop working on the malware, closed down the website from where he was selling KeyBase for $50 / €45, and abandoned the project.”
“Researchers also discovered that while KeyBase’s control panel was secured with authentication, the folder in which images were sent for storage was not, meaning that after all this time, they could easily put together a simple script and find all the KeyBase panels available online.”
“Using this simple method, Palo Alto staff discovered 62 Web domains where the KeyBase control panel was installed, 82 different control panels, and 125,083 screenshots from 933 Windows computers.”
“Of all infected computers, 216 were workstations in corporate environments, 75 were personal computers, and 134 were used for both. 43 of the 933 computers also included details from more than one user, meaning they were shared assets, used by multiple family members or work colleagues.”
“Taking a look at the screenshots, researchers discovered images depicting banking portals, invoices, blueprints, video camera feeds, email inboxes, social media accounts, financial documents, booking software, and many more.”
Both personal and corporate banking details were seen, as well as a Hotel reservation system
“The set for educational institutions wasn’t notably attributable to any one panel, but equally distributed. What made it stand out though is that the same tactic for delivering the KeyBase phish was applied here and “Admissions” people were targeted. These individuals are constantly sent Word or PDF documents, allegedly from parents, so it’s no surprise they would open the malicious files”
“In the original KeyBase report, Palo Alto revealed that the malware’s creator managed to infect himself during the keylogger’s tests, and had his activities recorded through screenshots and then sent to the Web control panel. This apparently happened again, and 16 of the actors behind this new wave of KeyBase infections also managed to infect their computers. The screenshots saved from their PCs shows that while a few were just curious script kiddies, some of the other hackers were actually professionals involved in highly-targeted campaigns.”
These screenshots provide interesting insight into the attackers
“This next actor’s resolution was such that the screenshots only captured the top left portion of his or her screen; however, it was enough to make some interesting observations on tactics. The actor appears to be trying to engage in romance scams with multiple women, along with preying on seniors through dating sites”
“Our analysis provides a unique opportunity to see the entire life cycle of a malware infection. Commonly, we’d see the first image in a set to be the KeyBase executable or malicious document all the way through until the Anti-Virus alerts of an infection. Sometimes that happened all within one screenshot.”

Feedback:

Round Up:

The post Dip the Chip | TechSNAP 255 first appeared on Jupiter Broadcasting.

Cleaning up our Mess | TechSNAP 141

chris — Thu, 19 Dec 2013 17:52:50 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Target stores suffer a massive breach, we’ll round up everything you need to know. In light of recent events some of us have called for greater use of Encryption, but are we too late? Has the Internet already been broken? We’ll discuss.

Plus a batch of your questions, our answers, and much more!

Thanks to:

Direct Download:

RSS Feeds:

— Show Notes: —

Target PoS systems breached, more than 40 million credit and debit cards may have been compromised

“Target confirmed the breach and in a statement said 40 million credit and debit cards were accessed starting the day before Thanksgiving and that hackers had access to the company’s systems until Dec. 15”
“According to sources at two different top 10 credit card issuers, the breach extends to nearly all Target locations nationwide, and involves the theft of data stored on the magnetic stripe of cards used at the stores”
Because the breach was of the PoS system, the attackers have the full ‘track data’ from the magnetic stripe and could encode that data on blank cards (or gift cards) and use them to make fraudulent purchases
If the attackers also managed to capture PIN numbers of debit cards, they could also program new cards in order to make cash withdrawals at ATMs
It is not yet clear how the attackers compromised the Point-of-Sales systems
Official Statement
Additional Coverage
Additional Coverage

PHK: We made this mess…

Prolific software developer Poul-Henning Kamp (Varnish, FreeBSD, md5crypt) talks about how more encryption is not the answer, how the people who created and use the Internet need to fight politics with politics
“And that \”we\” is people like you and me, people who connected computers, people who wrote software, people who ran ISPs, and people who told everybody and their grandmother how great the Internet was. … without thinking it fully through.“ “In particular without fully thinking through what people who are not like us might use the Internet for.”
“Any attempt from now on to claw back the privacy which have been illegally removed from our lives, will be met by similar fierce resistance.”
“Resistance from the military industrial complex, for whom \”Cyberwar\” and \”Total Situational Awareness\” is the new cash-cow.”
“A lot of the \”we\”, are currently arguing that adding more encryption will solve the problem, but they are deceiving nobody but themselves: More encryption only means that more encryption will be broken, backdoored, trojaned or otherwise circumvented .”
“If you think you can solve political problems with technical means, you\’re going to fail: Politicians have armies and police forces, you do not.”
Also talks about how Jordan Hubbard (founder of the FreeBSD project) accidentically invented spam and warned that it needed to be controlled, as well as other examples of events the presaged the technical problems of the modern Internet

Krebs: RDP and weak passwords still a huge problem

“Businesses spend billions of dollars annually on software and hardware to block external cyberattacks, but a shocking number of these same organizations shoot themselves in the foot by poking gaping holes in their digital defenses and then advertising those vulnerabilities to attackers”
Many servers have remote administration tools enabled, like SSH or in the case of Windows servers, RDP
Just like the constant barrage of attacks against an SSH server, RDP is also subjected to constant brute force attack, however these servers are often less well defended
Worse yet, there are still prolific numbers of servers with easily guessed username/password combinations remote1/Remote1 and sisadmin/sisadmin
Krebs profiles a service advertised on cybercrime forums that sells credentials to these compromised servers
“Prices range from $3 to $10 based on a variety of qualities, such as the number of CPUs, the operating system version and the PC’s upload and download speeds”
Looking at the owners of the IP addresses, Krebs even wrote a little seasonal jingle

Feedback:

Round Up:

The post Cleaning up our Mess | TechSNAP 141 first appeared on Jupiter Broadcasting.

Wire-Shark | TechSNAP 78

chris — Thu, 04 Oct 2012 16:53:15 +0000

We’ve got the details on a critical flaw in the chip and pin credit card system. The future of secure hashing, doing proper backups with rsync, and how squirrels and sharks take down the Internet.

Plus a big batch of your questions, and our answers.

All that and more, on this week’s TechSNAP

Thanks to:

GoDaddy.com

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

BONOUS ROUND PROMO:

Get your .COMs just $5.99 per year up to 3 domains! Additional .COMs just $7.99 per year!
CODE: 599tech

Expires 10/31/12

SPECIAL OFFER! Save 20% off your order!
Code: go20off5

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Get TechSNAP on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Chip and Pin security flaw exposed by Cambridge Researchers

Chip and Pin technology replaces the traditional magnetic strip and signature method of authorizing a Credit Card or Debit Card transaction
The technology uses the chip embedded in the card to authenticate itself to the PoS (Point of Sale) terminal, once the PIN is entered, proving that it is not a forged or cloned card
This provides stronger authentication of the card holder, using the secret PIN rather than comparing signatures
The original idea behind this concept was to shift liability for fraudulent transactions to the card holder, since the transaction could only go through if the PIN was provided, the transaction must have been authorized by the card holder, or the card holder was careless with their PIN number
This liability shift was never enacted, due to various flaws found in the system, including one where a blank card, connected to a stolen card, could be used to access the funds on the stolen card with an arbitrary pin number
The most recent flaw takes the form of a pre-play attack, which allows the attacker to determine the information required to authorize a transaction without the PIN number
The authentication protocol used between the PoS and the Chip requires the PoS terminate to generate a nonce , referred to in the documentation as an ‘unpredictable number’. The purpose of the nonce is to ensure that the authentication is fresh, preventing an attacker from using an old authentication response
The problem is in the implementation, many PoS terminates do not generate a random (or even pseudo-random) number for the nonce, but rather use a timestamp or counter
This allows an attack, that from the logs at your bank, appears as if your card was cloned, which is supposed to be nearly impossible due to the chip embedded in your card
The researchers discovered this vulnerability while investigating the case of an HSBC customer who was refused a refund from his bank, who stated that he must have entered his PIN at the ATM where his cash was withdrawn, in a different country
At the behest of the researchers, he demanded the banks logs of the transaction
Date Time UN
2011–06–29 10:37:24 F1246E04
2011–06–29 10:37:59 F1241354
2011–06–29 10:38:34 F1244328
2011–06–29 10:39:08 F1247348
As you can see, the ‘unpredictable number’s do not seem very random at all, infact they appear to be a 17 bit fixed value, followed by a 15 bit counter that is incremented every few milliseconds, and rolls over every 3 or so minutes
The research discusses how this weakness could use used to execute a ‘pre-play’ attack
An employee working at a restaurant or retail store, could run your card through a device that would provide the authentication code required to access the card during some specific window of time in the future, allowing them to withdraw funds from your account at an ATM without knowing your PIN number. This attack could also be executed by malware built in to a PoS terminal or vending machine
The researchers built their own special card that could extract the unpredictable number from each transaction they performed, and by doing a number of ‘balance check’ transactions, where we able to assess the randomness of the UNs
Research Paper
Blog post by Reseacher

NIST chooses keccak as new SHA–3 hashing algorithm

Pronounced catch-ack
The algorithm was designed by Guido Bertoni, Joan Daemen and Gilles Van Assche of STMicroelectronics and Michaël Peeters of NXP Semiconductors, and was one of 63 entrants to the NIST competition
The competition started in 2007 when it looked like there may be issues with SHA–2
Those issues never surfaced and SHA–2 is still considered secure
Because keccak is not derivative of SHA–2, but entire different, it means that an attack against SHA–2 will be very unlikely to also be effective against SHA–3

Feedback:

Jupiter Broadcasting on Stitcher

Have some fun:

What will be in the news the week in October when Allan is at Euro BSD Con? Let make a prediction on the head lines or just make up funny stuff to read

What I wish the new hires “knew”

Round-Up:

The post Wire-Shark | TechSNAP 78 first appeared on Jupiter Broadcasting.

Not So Secret Answers | TechSNAP 70

chris — Thu, 09 Aug 2012 16:02:55 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

A Gawker Reporter’s entire online presence is hacked, and all his devices wiped. We’ll walk you through the details of this attack, and why it suggests we might be facing some fundamental challenges.

Plus: Your questions, our answers, and so much more.

On this week’s TechSNAP!

Thanks to:

GoDaddy.com

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

SPECIAL OFFER! Save 20% off your order!
Code: go20off5

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Gawker Reporter gets entire online presense hacked

Gawker Reporter and formed Wired editor Mat Honan had his entire digital life destroyed in a matter of minutes last week
A hacker going by the pseudonym Phobia, originally targeted Mat’s twitter account because of its 3 character username
The @mat twitter account linked to Mat’s personal website, which listed his gmail address
The attacker then started the password recovery process to reset the password of the gmail account
Since the gmail account had not been configured for two-factor authentication, the reset option was to send a new password to the alternate account configured in gmail
The address of this account is obscured and displayed so you know which email to go check, but when the alternate address for mhonan@gmail.com is displayed as m*****n@me.com it is pretty easy to guess the email address
Now, in order to reset the password of the AppleID, the attackers would normally need the answers to the account’s “Secret Questions”, however, there is a fallback method, when these cannot be provided by the customer
Apple only requires that you provide the billing address and last for digits of the credit card on file for the account
The billing address is fairly easy to come by (phone book, domain whois, people search, blog posts, etc), but the last four digits of the credit card number are less so
Since the hacker knew the victims email address, the next target of the attack was Amazon.com
The attacker had an associate call Amazon and claim to be the victim, wanting to add a new credit card to the account. This process only requires knowing the account holders name, billing address, and the new credit card (Adding a new credit card to your account does not seem like a high security operation, and it would seem to make sense for companies to make this process as easy as possible)
The trick is, you then call Amazon back, and now you are able to provide the account holders name, billing address, and current credit card number. With this information to verify your identity, you are able to change the email address on the account, to one that you control
Now that you control the Amazon account, you simply login, and look at the other cards on file, you don’t get to see the entire credit card number, but the first and last 4 digits are displayed, so that customers can identify which card is which
With that information in hand, it now time to call AppleCare, and reset the password on the AppleID, gaining you access to the iCloud account and @me.com email address of your victim
Next you can reset the password of the gmail account, and then once you control that, reset the password of the twitter account
Now, if you want to prevent your victim from interfering with your actions, you need to disable their ability to fight back. This is where iCloud’s ‘Find My’ service comes into play
The attacker used the service to initiate a remote wipe of the victim’s iPhone, iPad and MacBook, as part of this process, the devices are also locked with a PIN code, which only the attacker has
The next step was to delete the gmail account, so it couldn’t be used to regain control of the twitter account. Normally you are able to undelete a gmail account, however it requires external verification, in this case via a text message to the cell phone tied to the gmail account, which the victim had not yet regained control of
All of this points out that the serious weak link in most all security systems, are the people, and the ways around the security systems we put in place, for when people forget their passwords
As we have seen in other cases like this, with some basic personal information that is pretty easy to acquire, and attacker could have transferred the phone service from the victim’s cell phone to another device in order to intercept verification text messages from services such as gmail or the victim’s online banking
Mat Honan admits that a number of the security problems that made this attack possible were his own fault, not having recent backups of his devices, not using two-factor authentication for gmail and other services and having only a 7 character password for his AppleID (although this didn’t factor into this attack as originally believed, it is still a security failure)
Wired did its own tests using the methodology that the attacker claimed to have used, and was able to completely compromise two other Wired employees
Apple and Amazon have both since stopped doing password resets over the phone

Secret Questions Don’t Work

The problem with Secret Questions is that in order for a question to be general enough that it will apply to most people and static enough that the answer won’t change by time you need to use the questions to recover your password, the answers end up being very generic and can usually be found with a bit of research
You also have to consider who may be attacking your secret questions, if the question is “What was the name of your first Teacher”, what if the attacker is someone you went to school with?
Another problem is how strictly the answers are verified, a common security question when calling your credit card company is your mother’s maiden name. In a great deal of cases, if you just mumble something this will be accepted and you will be able to make changes to the account
A good security question must maximize these four criteria:
Definitive: there should only be one correct answer which does not change over time.
Applicable: the question should be possible to answer for as large a portion of users as possible (ideally, universal).
Memorable: the user should have little difficulty remembering it
Safe: it should be difficult to guess or find through research
Feedback: Send in your ideas for good secret questions, and we’ll critique some of the suggestions next week
Bruce Schneier on Secret Questions

Feedback:

Round-Up:

The post Not So Secret Answers | TechSNAP 70 first appeared on Jupiter Broadcasting.

Unsafe Wifi | TechSNAP 38

chris — Thu, 29 Dec 2011 19:09:08 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

A major implementation flaw in protected Wifi has been found, we’ll share the amazing details.

Also: A federally contracted think tank suffered a major breach this week, with needy charities being caught in the fall out!

Plus our end of year sign off, and so much more, in this week’s episode of TechSNAP!

Thanks to:

GoDaddy.com Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download Links:

Subscribe via RSS and iTunes:

Show Notes:

Breaking

New York Times subscriber list may have been compromised

This story was first reported minutes before the recording of this episode of TechSNAP, so further information and verification were not possible
An email was sent to users asking them to reconsider cancelling their home delivery subscription
The email seems to have been targeted at anyone with a NYTimes.com accounts, not just current home delivery subscribers
Some people who received the message say that the NYTimes was the only 3rd party that had their email address
The email appears to have a correct DKIM signature, meaning it was signed with the private key of the email.newyorktimes.com domain
The email was sent via Epsilon Interactive, a mass emailing company that has previously been compromised
NYTimes First Responses: Blog.NYTimes.com Twitter
Email Headers
It is unclear if the email was the result of the compromise of Epsilon’s servers (and the NYTimes private key), or was accidentally sent to all subscribers instead of the intended subset

WiFi Protected Setup (WPS) flaw exposes millions of devices to trivial attack

WPS was created to allow users to more easily setup secure wireless networks
WPS uses either an 8 digit PIN number, or a ‘push to connect’ button on both the AP and Client device
This security vulnerability specifically targets the 8 digit PIN number
The 8 digit PIN results in a key space of 10^8 (100 million) keys
However, the last digit in the PIN is actually a checksum, used to detect typographic errors
The attack described below exploits a flaw in WPS where the attacker is able to determine by the response from a failed attempt, that the first 4 digits of the PIN matched
This combined with the last digit being a checksum, effectively narrows the key space of possible PINs to 10^4 + 10^3 (11,000) keys
Even this key space should be enough to keep attackers out, however it was discovered that many devices do not implement any type of failed login banning, making brute force attacks much easier and faster
It was also observed that rapid brute force attempts also seemed to have a Denial of Service effect on the targeted AP, exhausting its processor time responding to the authentication requests
Affected vendors include: Belkin, Buffalo, D-Link, LinkSys, NetGear, TP-Link and ZyXel
As of yet, there have been no new firmware offerings to resolve this issue
DD-WRT does not support WPS so is not vulnerable
To work around the problem, you can disable WPS on your AP, or if it is supported, set a long lockout time for failed attempts
Technical Details
Vulnerability Announcement

GSM Phones vulnerable to hijacking

Security researcher Karsten Nohl, known for his research into exploiting GSM to tap/eavesdrop on mobile phone calls, is set to present new research that he says allows an attacker to impersonate your phone, making calls and sending text messages to expensive premium services operated by the attacker
Such attacks are commonly executed against corporate land line PBX systems, breaking in to systems and then placing expensive per-minute calls, collecting large sums of money, and then disappearing before the victim gets their next phone bill and notices the problem
In the days of dialup, computer viruses that cause your computer to much similar expensive phone calls in the middle of the night were also fairly common
The vulnerability only effects the older 2G GMS network, however most all phones still support GMS as a fallback when newer 3G networks are not available
“We can do it to hundreds of thousands of phones in a short time frame,” Nohl told Reuters
Security Research Labs (the company Nohl works for) runs a website where they rank the various mobile providers based on their ease of Impersonation, Interception and Tracking
“None of the networks protects users very well,” Nohl said.
SRLabs plans to release data collection software, allowing users to participate in data collection to grow the improve the database
SRLabs research is focused in Europe and did not review any North American telcos

Anonymous claims responsibility for compromise of StratFor website, releases customer information via pastebin

The website of US security think tank Strategic Forecasting Inc (Stratfor) was compromised by attackers under the banner of the Anonymous movement
Other members of Anonymous stated that the attack was not an official operation, and that because Stratfor is a media source, they are protected by freedom of the press, a highly valued principle in the Anonymous movement
The pastebin posts are only flagged as #antisec and #lulzxmas, and may have been falsely attributed to anonymous by the media
Stratfor has suspended the operation of its website and email
The attackers have obtained the credit card details, password, and addresses of 4000 of Startfor private clients
The attackers claimed to have stolen 200GB of data, including emails and research
The goal of the #lulzxmas campaign was apparently to make 1 million dollars in donations to charities using stolen credit cards
Other twitter posts claim the total number of stolen credit cards was in excess of 90,000. Of these, two lists containing 3956 items and 13,191 items respectively, have been published
The data is said to include the CVV values for the credit cards, it is against the PCI-DSS standard to store the CVV value specifically for this reason, so that when a database is compromised, the CVV value is NOT disclosed, so that online stores that use the CVV value can still prevent fraud
It also appears that the users’ passwords were stored in plain text. The data that was released via pastebin had the passwords MD5 hashed, but even if that is how they were stored in the database, that is insufficient protection
Most of these funds will likely be charged back, actually costing the charities money
Stratfor describes itself as a provider of strategic intelligence for business, economic, security and geopolitical affairs
Stratfor’s said that they were working with law enforcement to attempt to apprehend the attackers
“Stratfor’s relationship with its members and, in particular, the confidentiality of their subscriber information, are very important to Stratfor and me,” wrote Mr. Friedman (Chief Executive of Startfor) in an email to clients
“Contrary to this assertion the disclosure was merely a list of some of the members that have purchased our publications and does not comprise a list of individuals or entities that have a relationship with Stratfor beyond their purchase of our subscription-based publications,”
Purported Client List
Client Details

Round Up:

The post Unsafe Wifi | TechSNAP 38 first appeared on Jupiter Broadcasting.

Leaky Authentication | TechSNAP 12

chris — Thu, 30 Jun 2011 23:18:17 +0000

How many times have your credentials been leaked online? Think your safe? Chris thought he was. In today’s episode he’ll find out how many times his information has been leaked online, and we tell you how you check for your self.

Plus we’ll cover how to build your own layered spam defense, and why you probably want to leave that USB thumb drive, on the ground!

Sneak peek: Next week we’re going to be talking about the future of Cyber Warfare in our special episode #13. Please send us any stories, suggestions or questions you have so we can include them for next week.

Direct Download Links:

Subscribe via RSS and iTunes:

[ad#shownotes]

Show Notes:

Thanks to the TechSNAP Redditors!

Topic: Groupon India leaks SQL database, plain text passwords

Groupon’s Indian subsidiary Sosasta.com accidentally published an SQL dump of it’s users table, including email addresses and passwords. The file was indexed and cached by google, so even once it was taken down, it was still visible.
This raises the question as to why the passwords were ever stored in plain text, instead of as salted hashes
Does the North American version of Groupon also store user passwords in plain text?
Leaked data was found by a security researching using a google search query for “filetype:sql” “password” and “gmail”
Once Sosasta was notified of the issue, they started sending out emails to their customers recommending that they change their password. This is definitely the wrong approach, the passwords were leaked, in plain text. All accounts should have had their passwords forcibly reset and a password reset email sent to the customer. Otherwise, customers may have their account compromised before they can change their password, and customers who no longer use the service will have their personal information exposed.

shouldichangemypassword.com – Check your address

Submitted by: refuse2speak

Topic: EA Forums hacked, Sega Database Compromised

a “Highly sophisticated cyber attack” was used to compromise the database of the forums for Bioware’s Neverwinter Nights.
Stolen data included username, password, email, and birth date
How many users were effected was not specified
EA says no credit card information was in the stolen database
Sega was also compromised, 1.29 million customers had their data exposed via the website of the European unit’s “Sega Pass” website.
Again, username, password, email and birth date were exposed, but it appears that no financial information was leaked.

TechSNAP reminds you: use a different password for every service. We know it’s hard, but cleaning up behind an identity thief is worse.

Submitted by: Raventiger

Topic: US Government Study shows alarming attack vector

60% of Government or Contractor employees who found a USB stick or CD on the ground outside their office plugging the device in to their computer.
90% of the employees installed the software if it had an official looking logo on it.
This is reminiscent of the StuxNet worm, which targeted isolated computers that were not on the Internet. It is believed that they were infected via a hardware device containing the payload.

Topic: Research reveals that pin numbers are predictable

15% of iPhones could be unlocked in fewer than 10 tries using the most common pin codes
The most common first character in a pin number is 1
The most common second character is 2
The values 1980 through 2000 make up a huge portion of the top 100 pin codes, meaning if you know or can guess a users date of birth, you can increase your chance of cracking their code
Other popular codes include repeating digits or patterns, such as 2222 or 1212, or lines drawn on the input screen, such as 2580, 0852 or 1241
Another popular value is 5683, which didn’t seem to fit any pattern until you realize that is spells ‘love’ with standard phone letter substitution.
This means that if you know the users birthday and relationship status, you can increase your chance of cracking their pin code just by applying a little statistical analysis. If you can shoulder surf them, and further reduce the pool of possible codes, you can almost guarantee success.
Users tend to reuse passwords, if you guess their phone password, there is a good chance that is also their ATM pin. Either way, the exact same techniques can be applied to ATM, Voicemail and other pin codes.