Hackers Plan to Clobber the Cloud, Spy on Blackberries

October 05, 2009 — IDG News Service — A new era of computing is on the rise and viruses, spies and malware developers are tagging along for the ride.

The new playground for hackers is "the cloud," the term for computer applications and services hosted on the Internet. Some of the devices making the cloud more popular these days are BlackBerries and other smartphones.

"The focus [of security] is definitely moving towards 'the cloud' and to the security of embedded devices (Android, iPhone) to more advanced client-side attacks which leverage on Web 2.0 technologies, such as attacks on Facebook, Twitter and other popular sites," said Dhillon Andrew Kannabhiran, host and organizer of the Hack In The Box (HITB) security conference in Kuala Lumpur, Malaysia this week.

HITB is one of the most prominent security conferences in Asia and now runs twice a year. The big show is in Malaysia, while the newer, yet smaller HITB is held in Dubai. The conference brings together leading security experts and draws self-proclaimed hackers, but Kannabhiran says it's not a wild hacker party. It offers knowledgeable presentations by leading experts in an informal setting, where people can ask questions and meet presenters at events throughout the week.

"Clobbering the Cloud" and "Spying on BlackBerry Users for Fun" are actually titles of two presentations slated for the HITB conference on Wednesday. Other interesting titles include "How to Own the World - One Desktop at a Time" and "Offensive Cloud Computing With Hadoop and Backtrack." .. More >>

'The Analyzer' Hack Probe Widens; $10 Million Allegedly Stolen From U.S. Banks

Ehud Tenenbaum, an Israeli hacker arrested in Canada last year for allegedly stealing about $1.5 million from Canadian banks, also allegedly hacked two U.S. banks, a credit and debit card distribution company and a payment processor in what U.S. authorities are calling a global "cashout" conspiracy.

The U.S. hacks have resulted in at least $10 million in losses, according to court records obtained by Threat Level, and are just part of a larger international conspiracy to hack financial institutions in the United States and abroad. .. More >>

Electronics Firm Faces FTC Lawsuit Following Multiple Hacks

Warning to security professionals: If you don't do your job right, then it might not only be a firing offense -- it might be a federal offense.

Case in point: An online seller of computer supplies and other consumer electronics today agreed to settle Federal Trade Commission (FTC) charges that it violated federal law by failing to provide reasonable security to protect sensitive customer data. The FTC is charging that the company didn't do enough to prevent SQL injection attacks that compromised customer data. >> More ..

Israel hacks Arab TV station - Cyberspace becomes battleground in Gaza conflict

Israeli military forces have reportedly hacked into a Hamas-run TV station to broadcast propaganda. >> More ..

Hack Turns Application Code Against Itself ... New attack uses application flaws to force good code to go rogue

Turns out you don't need malware to exploit a security flaw in an application: A pair of researchers has found a way to automatically make good code do bad things.

Researchers from the University of California at San Diego (UCSD) have devised a technique that basically lets an attacker bypass built-in system defenses aimed at blocking malware, and then execute instructions from inside the application. The process uses an application's vulnerability to turn it against the system on which it runs.

An attacker could take advantage of a flaw in a Web browser, for instance, to force the browser to spam the user's address book using only the browser's own code, according to the researchers. .. More >>

Revealed: The Internet's Biggest Security Hole

Two security researchers have demonstrated a new technique to stealthily intercept internet traffic on a scale previously presumed to be unavailable to anyone outside of intelligence agencies like the National Security Agency.

The tactic exploits the internet routing protocol BGP (Border Gateway Protocol) to let an attacker surreptitiously monitor unencrypted internet traffic anywhere in the world, and even modify it before it reaches its destination.

The demonstration is only the latest attack to highlight fundamental security weaknesses in some of the internet's core protocols. Those protocols were largely developed in the 1970s with the assumption that every node on the then-nascent network would be trustworthy. The world was reminded of the quaintness of that assumption in July, when researcher Dan Kaminsky disclosed a serious vulnerability in the DNS system. Experts say the new demonstration targets a potentially larger weakness. .. More ..

Hacked Texas National Guard site serves up malware

Attackers have hacked the Web site of the Texas National Guard and are using it to serve up offers of fake security software and plant rootkits on unpatched PCs. .. More..

Hackers find a way to crack popular smartcard in minutes

People are starting to wake up to the fact that RFID-enabled smartcards now can be far more easily, and cheaply, cracked than ever before, as a trio of young computer experts recently showed.

These are a particular type of processor-embedded cards, and are different from credit cards. The actual decryption work by the researchers was done on the widely deployed Mifare Classic wireless smartcard, now manufactured by a Philips spinoff, NXP Semiconductors. Decrypted, the cards can be counterfeited, and users' personal and bank data is exposed. >> More ..

Trend Micro Hit by Massive Web Hack

Security vendor Trend Micro has fallen victim to a widespread Web attack that splashed malicious software onto hundreds of legitimate Web sites in recent days.

A Trend Micro spokesman confirmed that the company’s site had been hacked Thursday, saying that the attack took place earlier in the week. "A portion of our site -- some pages were attacked," said Mike Sweeny, a Trend Micro spokesman. "We took the pages down overnight Tuesday night -- and took corrective action." >> More ..

Hackers Gone Wild ... Hacks on a massive scale

While previously hacks may be one off incidents posing threats to a small segment. Today the scenario is different.

We're looking at massive, well-organized plans to take over vast portions of the Net. Case in point: The SQL Injection exploit that infected more 70,000 sites .. more.

The 5 Coolest Hacks of 2007

Hackers are creative folk, for sure. But some researchers are more imaginative and crafty than others. We're talking the kind of guys who aren't content with finding the next bug in Windows or a Cisco router. Instead, they go after the everyday things we take for granted even more than our PCs -- our cars, our wireless connections, and (gulp) the electronic financial trading systems that record our stock purchases and other online transactions. >> More ..

Israel suspected of 'hacking' Syrian air defences

Questions are mounting over how Israeli planes were able to sneak past Syria's defences and bomb a "strategic target" in the country in September 2007

Israeli F-15s and F-16s bombed a military construction site on 6 September. Earlier reports of the attack were confirmed this week when Israeli Army radio said Israeli planes had attacked a military target "deep inside Syria", quoting the military censor.

The motives for the strike, much less what was hit and what damage was caused, remain unclear. One theory is that a fledgling nuclear research centre, the fruits of alleged collaboration between Syria and North Korea, may have been hit. Others speculate that a store of arms shipments bound for the Lebanese militant group Hezbollah might have been targeted. A test against Syria's air defences has also being suggested in some quarters. None of these theories appear to be much better than educated guesswork.

Bombers carrying out the raid are believed to have entered Syrian airspace from the Mediterranean Sea. Unmarked fuel drop tanks were later found on Turkish soil near the Syrian border, providing evidence of a possible escape route. Witnesses said the Israeli jets were engaged by Syrian air defences in Tall al-Abyad, near the border with Turkey.

This location is deep within Turkey, prompting questions about how the fighters avoided detection until so long into their mission. Neither F-15s nor F-16s used by the Israeli air force in the raids are fitted with stealth technology. >> More..

Two charged with hacking PeopleSoft to fix grades

Two Cal State-Fresno students face up to 20 years in prison and fines up to $250,000 for hacking into the school's PeopleSoft system to change their grades. >> More..

US regional bank hacked

Hackers infiltrated the systems of Commerce Bank and accessed the records of 20 customers, the US regional bank said in October 2007.

The attack by persons unknown was partially thwarted - but not before a database of 3,000 records was hacked into and the data of 20 exposed. Compromised data included personal information such as names, addresses, Social Security numbers, phone numbers and, in a few cases, Commerce Bank account numbers, the Columbia Business Journal reports

Security staff shut down the attack and called in police to investigate after uncovering the breach a week ago. The FBI is investigating.

The method used in the attack is unclear, and something the bank will be keen that it stays unclear, to avoid the possibility of copycat attacks. There are many avenues of assault, of which one common tactic is to exploit web application vulnerabilities by using SQL injection attacksto access information of back-end databases. >> More ..

Website for Computer Security Experts Hacked

It can happen to anybody's website, including a security website..

First Forensic Forum - a UK based association of computer security professionals - has been hacked.

F3.org's website was defaced with a message poking fun at the association of computer forensic experts. The timing of the defacement on Thursday was fortuitous (or well planned) since the organisation is coming to the end of a two day conference.
document.

The perpetrator of the attack posted a message taunting the organisation. "The F3 For Security Hacked. What's Happened In The world. Thay Are No Security Or What," S4udi-S3curity-T3rror writes. >> More ..

Ooops: DC Feds Delete CA.Gov In Response to Hackers

When an organisation does not have a proper response plan to incidents, a bad incident can get worse.

"Case in point: A hacker's diversion of traffic from a California county government Web site to a porn purveyor spiraled into IT chaos yesterday after a countermeasure applied from Washington essentially "deleted the ca.gov domain."

The original story can be found here.

America's Hackable Backbone

This article is a MUST READ article. It highlights the vulnerability of SCADA systems.

SCADA systems are used around the country to control infrastructure like water filtration and
distribution, trains and subways, natural gas and oil pipelines, and practically every kind of industrial manufacturing. And as some security professionals are pointing out, those weaknesses are increasingly connected to the Internet, leaving large parts of America's critical infrastructure exposed to anyone with moderate information technology training and a laptop.

The full article can be found here.

However those who want a pictorial rundown of the story can find it here. The pictorial story covers incidents and potential vulnerabilities of SCADA systems controlling power plants, oil and gas pipelines, transportation, dams, manufacturing, water distribution.

Bank of India site hacked, serves up 22 exploits

The Bank of India Web site was hacked sometime Wednesday night (U.S. time) and seeded with a wide, wild array of malware that infected any users running unpatched browsers, security researchers said Friday.

See this link for the full news.

France Joins Chinese Hacking Row

France has become the fourth country to speak out against hackers in China following an attack on French government systems. More..

US blames China for Pentagon Hack

American officials are claiming that the Chinese military successfully hacked computers inside the Pentagon in June.

The Pentagon has told the Financial Times that it had to shut down computers used by Robert Gates, the current defence secretary and ex-head of the CIA, after hackers managed to crack the systems.

The officials said that they had a "very high level of confidence .... trending towards total certainty" that the attacks came from the People's Liberation Army [PLA]. More ..