Attack Computer Wiz

On Monday, September 26, 2011, I visited the online news paper Plumasnews.com. I visit this and many other newspaper sites in my area on a daily basis. I was only somewhat surprised to see a "HACKED" splash screen indicating the the newspapers web server had been defaced. A couple days later (Wednesday) ThreatPost.com reported that this site and an estimated 700,000 other websites hosted by California based hosting provider InMotion had been exploited and defaced.

Todd Robinson of InMotion wrote, "The hacker used a system exploit to change a system password to allow him to access index files. We have blocked the exploit and changed the system password. As always though, it is recommended that you update your Cpanel and FTP passwords... Our systems team has blocked the exploit and is aggressively scanning for any other potential exploits."

The hacker using the handle Tiger-M@te claimed responsibility and stated in a message "I hack 700000 websites in one shot, this may be a new world Record. After submitting 200,000 domains,zone-h was going down again and again and became almost unresponsive in the end.so i was unable to submit all websites.so i’ve listed all domains in attachment. It was not just a server hack, actually whole data center got hacked."

Source: ThreatPost.com

Posted by Mike Wright

Just last week at the TED conference in Long Beach California, Celebrity Ashton Kutcher had his Twitter account hacked, this according to reporters over at Threat Post. As my readers may recall I posted about FireSheep back in November of last year. It is a FireFox plug in that allows a hacker to intercept social networking session over un-secured wireless connections.

A sample of the messages posted to Kutchers' account are:

"Ashton, you've been Punk'd. This account is not secure. Dude, where's my SSL?"

"P.S. This is for those young protesters around the world who deserve not to have their Facebook & Twitter accounts hacked like this. #SSL"

Posted by Mike Wright

"Recently, a lot of high profile .EDU and .GOV where hijacked to redirect users to fake online stores. Google searches related to buying software ("buy windows 7 key", where to buy microsoft, "purchase microsoft word", "buy microsoft office", etc.) contain a long list of websites running on non-standard ports: www.kidsforkidsfestival.org:8080, en.jurispedia.org:4444, >www.notiuno.com:4577, etc. These links redirect users to online stores which claim to sell software at a discounted price."

Go to the Zscaler Research website to read the whole story.

Posted by Mike Wright

For those of you who live in California you are likely used to the stupid laws that our legislators seem to get passed. No doubt they have nothing better to do then pass useless laws such as one that took affect on October 15, 2010 that banned the use of gas nozzle locks. As you can see in the below image I have come up with a simple, cheep, and effective hack to keep that nozzle flowing so that you can wash your windows, buy your Twinkies, or check on your Facebook.

Maybe our law makers can find something better to do? Might I suggest 1st degree murder for drunk and drugged drivers who kill people? Death penalty for child molesters?

Posted by Mike Wright

I stumbled upon a program called FireSheep today. This completely free utility can allow a hacker to access user accounts on websites such as FaceBook, Twitter, Flickr, and more. What is interesting and scary is that this application requires little to no technical know how to hack an account.

Here is how it works (and no it is not 100% effective 100% of the time):

1. The hacker installs the free application on their portable computer and travels to a free wireless network. You know, like the ones at McDonald's, Starbucks, the car wash, the hotel, your neighbors who does not secure their wireless access points.

2. Once connected the hacker presses the "Start Capturing" button and waits.

3. As soon as anyone on that network connects to a site that FireSheep knows about their information is displayed in the capture window. Now the hacker simply clicks the icon and they have just hijacked your account (see screen shot below).

How do you protect yourself? Don't use free wireless access points!

Posted by Mike Wright

Here is a good writeup about a scam going around. It is written by Rik Ferguson over at Trend Micro.


http://countermeasures.trendmicro.eu/an-unwanted-favour-from-india/

Posted by Mike Wright

David Kernell, son of Democratic Representative from Tennessee Mike Kernell, was convicted by jury of “Hacking” Sarah Palin’s Yahoo account. The 22 year old Kernell was convicted of unauthorized access to a computer and obstruction of justice.

Kernell used information that Palin herself made available to the public to guess her challenge questions that ultimately lead to his ability to gain access to her Yahoo account. Once he gained access to her account he changed her password and posted screen shots of emails on the internet.

On her Facebook page, Sarah Palin released the following statement (in part):

“My family and I are thankful that the jury thoroughly and carefully weighed the evidence and issued a just verdict. Besides the obvious invasion of privacy and security concerns surrounding this issue, many of us are concerned about the integrity of our country’s political elections. America’s elections depend upon fair competition. Violating the law, or simply invading someone’s privacy for political gain, has long been repugnant to Americans’ sense of fair play. As Watergate taught us, we rightfully reject illegally breaking into candidates’ private communications for political intrigue in an attempt to derail an election.”

Source: eWeek
Source: Facebook

Posted by Mike Wright

Would you open a PDF if you knew the sender? What if the PDF contained a script that could execute a command when you open it?

Well security researcher Didier Stevens has found a way using pdf scripting to "escape from PDF". His research with PDF's makes me think of macro exploits in Word. You can read about Didier's research here.

Jeremy Conway, has taken this research a step further and created a proof of concept that uses one PDF to infect another existing PDF. You can read about Jeremy's research here

All of this research was passed on to Adobe for analysis.

Mike found an article on the ZDNet Blog with the Adobe suggested work around to mitigate a pontential attack of this nature.

Posted by Jason

It was only one day after the release of the iPad before it was hacked. “MuscleNerd” posted on his Twitter and YouTube accounts that he was able to hack the iPad operating system and gain “root” access.

He did this using a variation of the same “Spirit” jailbreak hack that was used to break the code on the iPhone and the iPod Touch.

Just as with other “jail broken” devices, the hacked iPad will be able to run unauthorized third party applications and allow users to modify the system.

Besides the fact that you will most definitely void any warranty of your iPad by doing this hack you will also not be able to run any firmware or other official software updates. That is unless you need a $600 paper weight.

Source: MacNN

Posted by Mike Wright

Last week I was working in my yard when the meter reader stopped by to read my power meter. I apologized to him of the excess pile of toys that he had to navigate through to get to my meter. He told me that it was alright and it won’t be much longer and I will be fitted with a ‘Smart Meter’ that will transfer all of my meter data wirelessly.

My security hat immediately came on and I decided I would do some research and try to determine how a ‘Smart Meter’ worked. After about an hour of research it was pretty clear that they keep that information quite guarded, go figure.
Today though I was happy to find a story on Yahoo that addressed the concerns that I had and as it turns out these ‘Smart Meters’ have some gaping security issues, again, go figure.

The meters themselves are supposed to save money. They save the power company money by not having to send people out and read the meter and they save the consumer money by giving you a real time, anytime, view of your power consumption allowing you to adjust accordingly.

But according to Joshua Wright (no relation) a Senior Analyst with InGauardians Inc., there are “egregious” flaws in the meters and the technology that the utility companies are incorporating to handle the data from the meters.

Wright found security issues with five meters, each from different manufacturers. The security holes could lead to a hacker being able to intercept the encryption keys used by the meter to communicate with the access points that collect the meter information.

He discovered that a hacker may be able to change the usage reported to the access points raising a victim’s power bill or lowering it, depending on the shade of hacker. Wright said that while the technology of the meters is new, some of the security vulnerabilities he discovered have been around for 10 years.
While I do look forward to the ability to see my real-time usage I will be keeping tabs on this service in the same manner I do my credit card bill and would encourage everyone else to do the same.

Source: Yahoo!

Posted by Mike Wright

According to Wired, Albert Gonzalez the hacker convicted breaching the networks and stealing data from T.J. Maxx, Office Max, Dave and Busters and a handful of other companies, was today sentenced to 20 years in prison and a $25,000 fine. I reported earlier this week that he could have gotten as much as 25 years.

You can read Wired full story at the link below.

Wired.com

Posted by Mike Wright

GoDaddy is reporting today that they will stop the sale of registered domain names in china. This is on the heels of Google’s protests of cyber attacks and censorship from that country.

Christine Jones of GoDaddy states, "We believe that many of the current abuses of the Internet originating in China are due to a lack of enforcement against criminal activities by the Chinese government." Jones goes on to say that GoDaddy has been combating dozens of attacks that appear to be originating from China over the past three months.

GoDaddy will support current customers with domains based in China.

Reuters

Posted by Mike Wright

Albert Gonzalez, the convicted ring leader of the group of hackers that stole nearly 130 million credit card numbers from T.J. Maxx and other businesses, may be looking at 25 years in federal prison for his deeds.

If imposed, this sentence would be the longest ever for an identity theft case. Some interesting facts about this case are;

• Gonzalez has been linked to not only the TJX case but also hacks at Office Max, Dave and Busters, 7-Eleven, Heartland, BJ’s Wholesale, DSW, and Hannaford.
• He was going to use his money to buy a yacht and retire.
• It took him two years from the time that he hacked 11 million account from Office Max to decrypt and discover the PIN numbers.
• He was an information for the Secret Service during some of his crimes.
• He was almost hacked himself by outside consultants during the TJX hacking (reminds me of the Kevin Mitnick story).

This guy is quite a piece of work, I especially love this quote from the document:

“Gonzalez argues that he should not be held responsible because TJX, and by extension each of eight other corporate victims described in the Indictment, had sufficiently vulnerable computer networks and data protection that he and his organization could break in and steal payment card numbers.”

Government Brief courtesy of Wired

Posted by Mike Wright

A statement by Dmitry Zelenko, President of BroCo Investments, claims that allegations of stock manipulation by the U.S. Securities and Exchange Commission (SEC) are a mistake. The press release states:

“The account suspected in price manipulation in market belongs to Client of the company. The client performed his own trading and traded at his own responsibility. Our company together with Genesis only procures technical and brokerage facilities. Thus BroCo Company is not associated with trading on above-mentioned account.”

The client accused by BroCo has not been released but Zelenko stated that he and BroCo Investments would be cooperating fully with the SEC in the investigation and that they hope for a prompt resolution.

The release goes on to say that the “Russian mass media did not investigate the situation thoroughly and published wrong information”. This comes too late for BroCo Investments however as a court order was issued on Tuesday by a U.S. federal Judge in New York to freeze their assets.

Official statement.
My previous story from 3/18.

Posted by Mike Wright

By now most everyone is familiar with the recording breaking data theft that occurred at T.J. Maxx. Hackers used poorly secured wireless access points to intercept customer records. But big business is not the only and not the most common target of wireless hacking.

The hacking technique known as wardriving is the act of scanning for wireless access points, or networks, from a moving vehicle. With the right tools the hacker has the ability to see, record, log, and locate nearly any wireless access point. Once upon a time hackers would mark the curb or street where the access point was located so that they and their cohorts could locate it again, this was known as 'chalking'. However technology has changed this and finding wireless access is a simple mouse click away.

Wigle.net is an online repository of wireless access points located all over the world. From this site anyone can simply browse an interactive Google map and locate millions of wireless access points, according to their site 19,776,866 to be exact. The information from this site does not guarantee that a hacker will be able to gain access to the networks. But is does give the would-be wireless leach a good place to start looking.

In 2004, 100 students in Seattle Washington were able to locate 5,225 wireless access points in the Seattle area. Of those 52% of them were not configured with any security and were ‘open’ for anyone to connect to. (source)

While those numbers are outdated, it is still not uncommon to find a huge number of wireless networks that use no security or poor outdated security. The ‘out of the box’ configuration of most any wireless access points would allow a hacker to not only gain access to the wireless network, but gain access to devices on that network.

Once connected the hacker could be able to intercept any communications and data. They could inject malicious code, reconfigure devices, or deny the network owner access to their own network. They could intercept banking transactions, prescription and medical information, credit card information, Social Security Numbers, and anything else traveling across the network or even stored on computer in the network.

It is important that you not simply unpack that new wireless device and plug it in without reviewing the documentation and configuring the security mechanisms on the device. Stay away from the WEP security as it is outdated and is now easily hacked. WPA or preferably WPA-2 should be your first choice in 'out of the box' configuration of your wireless access points.

Beyond configuration of the devices, think about where you are going to place the device. Things like walls, trees, insulation and other solid objects will reduce the signal of the device making it harder for someone to connect from the street or sidewalk. It may be better to place your access point in the back of your house rather than the front of your house. Some devices come with two antennas, can you remove one antenna to reduce the signal while still getting access, maybe? And it is a great idea to change that administrator password that is printed in the documentation.

Go to Wigle.net and see if your access point is recorded on that site. If you live in a populated area, the odds are, it is.

Posted by Mike Wright

If you get an email that appears to be from Facebook with the subject "Facebook Password Reset Confirmation! Customer Support." or anything similar to that, beware. The mail looks innocent enough to the untrained eye but there is a very dangerous attachment that could spell the end of your Facebook account as you know it.

The attachment looks like a zip file but is actually an application that installs on your computer once you run it. The application will log your Facebook user name and password and send it to whoever wrote the program. Also, the program will run for anyone who logs into the computer that you installed it on. So if you share this computer with family members or if it is a work computer, anyone who uses Facebook on that computer will also have their information stolen.

How can you protect yourself?

1. Don't open emails and especially don’t execute attachments from anyone you don’t know or recognize. Maybe even if you do know them?
2. Be sure your computer is up to date with the most current updates for your operating system and internet browser, at least.
3. And ensure that you have current and effective anti virus software enabled and running.

Source: McAfee

Posted by Mike Wright

The below is a cut and paste from the invitation. Seats are limited.

"Black Hat Webcast Series - Auditing/Assessment - Pen Testing the Web with Firefox Auditing/Assessment - Pen Testing the Web with Firefox Date: March 18, 2010 Time: 1:00 pm PT/4:00 pm ET Hacking the web has never been easier. Whether you're using Firefox as a standalone tool for information gathering, modifying your browser with innovative extensions, or using Firefox as a web front-end for other penetration testing tools, you can hack all within the potentially anonymous cozy confines of your customized browser. Putting it all together brings your hack-foo one step further. DNS lookups, uptime reports, hosted hash crackers and online scanners are at your browser's fingertips. With Firefox's innovative add-on feature, a number of powerful extensions have been developed for security scanning, ethical hacking, penetration testing, and general security auditing. Finally, a number of penetration testing applications are built specifically with web-based front-ends. Add in a few recommendations for your setup and a few places to test your hacking skills, and your recipe for hack soup is complete.

Speaker: Michael Schearer ("theprez98")

Michael is a government contractor who spent nearly nine years in the United States Navy as a combat-experienced EA-6B Prowler Electronic Countermeasures Officer. He also spent nine months on the ground doing counter-IED work with the U.S. Army. He is a graduate of Georgetown University's National Security Studies Program and a presenter at DEFCON, ShmooCon, HOPE and internationally at CONFidence (Poland) and HackCon (Norway) as well as other numerous conferences. Michael is a licensed amateur radio operator and an active member of the Church of WiFi. He lives in Maryland with his wife and four children."

https://www2.gotomeeting.com/register/167462547

Posted by Mike Wright