By Glenn Chapman (AFP) – 12 hours ago
LAS VEGAS, Nevada — Hackers at an infamous DefCon gathering are proving that old-fashioned smooth talk rivals slick software skills when it comes to pulling off attacks on computer networks.
A first-ever "social engineering" contest here challenges hackers to call workers at 10 companies including technology titans Google, Apple, Cisco, and Microsoft and get them to reveal too much information to strangers.
"Out of all the companies called today, not one company shut us down," said Offensive Security operations manager Christopher Hadnagy, part of the social-engineer.org team behind the competition that kicked off on Friday.
The team kept hackers within the boundaries of the law, but had them coax out enough information to show that workers would have unintentionally made it easier to attack networks.
Workers that unknowingly ended up on calls with hackers ranged from a chief technical officer to IT support personnel and sales people.
One employee was conned into opening programs on a company computer to read off specifications regarding types of software being used, details that would let a hacker tailor viruses to launch at the system.
"You often have to crack through firewalls and burn the perimeter in order to get into the internal organization," said Mati Aharoni of Offensive Security, a company that tests company computer defenses.
"It is much easier to use social engineering techniques to get to the same place."
Other companies targeted were Pepsi, Coca Cola, Shell, BP, Ford, and Proctor & Gamble.
The contest, which continues Saturday at DefCon and promises the winner an Apple iPad tablet computer, is intended to show that hardened computer networks remain vulnerable if people using them are soft touches.
"We didn't want anyone fired or feeling bad at the end of the day," Aharoni said. "We wanted to show that social engineering is a legitimate attack vector."
A saying that long ago made it onto T-shirts at the annual DefCon event is "There is no patch for human stupidity."
"Companies don't think their people will fall for something as simple as someone calling and just asking a few questions," Hadnagy said.
"It doesn't require a very technical level of attacker," Aharoni added. "It requires someone with an ability to schmooze well."
One worker nearly foiled a hacker by insisting he send his questions in an email that would be reviewed and answered if appropriate.
The hacker convinced the worker to change his mind by claiming to be under pressure to finish a report for a boss by that evening.
"As humans, we naturally want to help other people," Hadgagy said. "I'm not advocating not helping people. Just think about what you say before you say it."
Companies that got word of the social engineering contest before DefCon called in the FBI, which was assured by the event organizers that nothing illegal was afoot.
Information about "exploiting human vulnerabilities" was available at the social-engineer.org websit.
Showing posts with label hacker. Show all posts
Showing posts with label hacker. Show all posts
Saturday, July 31, 2010
Attacking the edges of secure Internet traffic
By JORDAN ROBERTSON (AP)
LAS VEGAS — Researchers have uncovered new ways that criminals can spy on Internet users even if they're using secure connections to banks, online retailers or other sensitive Web sites.
The attacks demonstrated at the Black Hat conference here show how determined hackers can sniff around the edges of encrypted Internet traffic to pick up clues about what their targets are up to.
It's like tapping a telephone conversation and hearing muffled voices that hint at the tone of the conversation.
The problem lies in the way Web browsers handle Secure Sockets Layer, or SSL, encryption technology, according to Robert Hansen and Josh Sokol, who spoke to a packed room of several hundred security experts.
Encryption forms a kind of tunnel between a browser and a website's servers. It scrambles data so it's indecipherable to prying eyes.
SSL is widely used on sites trafficking in sensitive information, such as credit card numbers, and its presence is shown as a padlock in the browser's address bar.
SSL is a widely attacked technology, but the approach by Hansen and Sokol wasn't to break it. They wanted to see instead what they could learn from what are essentially the breadcrumbs from people's secure Internet surfing that browsers leave behind and that skilled hackers can follow.
Their attacks would yield all sorts of information. It could be relatively minor, such as browser settings or the number of Web pages visited. It could be quite substantial, including whether someone is vulnerable to having the "cookies" that store usernames and passwords misappropriated by hackers to log into secure sites.
Hansen said all major browsers are affected by at least some of the issues.
"This points to a larger problem — we need to reconsider how we do electronic commerce," he said in an interview before the conference, an annual gathering devoted to exposing the latest computer-security vulnerabilities.
For the average Internet user, the research reinforces the importance of being careful on public Wi-Fi networks, where an attacker could plant himself in a position to look at your traffic. For the attacks to work, the attacker must first have access to the victim's network.
Hansen and Sokol outlined two dozen problems they found. They acknowledged attacks using those weaknesses would be hard to pull off.
The vulnerabilities arise out of the fact people can surf the Internet with multiple tabs open in their browsers at the same time, and that unsecured traffic in one tab can affect secure traffic in another tab, said Hansen, chief executive of consulting firm SecTheory. Sokol is a security manager at National Instruments Corp.
Their talk isn't the first time researchers have looked at ways to scour secure Internet traffic for clues about what's happening behind the curtain of encryption. It does expand on existing research in key ways, though.
"Nobody's getting hacked with this tomorrow, but it's innovative research," said Jon Miller, an SSL expert who wasn't involved in the research.
Miller, director of Accuvant Labs, praised Hansen and Sokol for taking a different approach to attacking SSL.
"Everybody's knocking on the front door, and this is, 'let's take a look at the windows,'" he said. "I never would have thought about doing something like this in a million years. I would have thought it would be a waste of time. It's neat because it's a little different."
Another popular talk at Black Hat concerned a new attack affecting potentially millions of home routers. The attack could be used to launch the kinds of attacks described by Hansen and Sokol.
Researcher Craig Heffner examined 30 different types of home routers from companies including Actiontec Electronics Inc. and Cisco Systems Inc.'s Linksys and found that more than half of them were vulnerable to his attack.
He tricked Web browsers that use those routers into letting him access administrative menus that only the routers' owners should be able to see. Heffner said the vulnerability is in the browsers and illustrates a larger security problem involving how browsers determine that the sites they visit are trustworthy.
The caveat is he has to first trick someone into visiting a malicious site, and it helps if the victim hasn't changed the router's default password.
Still: "Once you're on the router, you're invisible — you can do all kinds of things," such as controlling where the victim goes on the Internet, Heffner said.
LAS VEGAS — Researchers have uncovered new ways that criminals can spy on Internet users even if they're using secure connections to banks, online retailers or other sensitive Web sites.
The attacks demonstrated at the Black Hat conference here show how determined hackers can sniff around the edges of encrypted Internet traffic to pick up clues about what their targets are up to.
It's like tapping a telephone conversation and hearing muffled voices that hint at the tone of the conversation.
The problem lies in the way Web browsers handle Secure Sockets Layer, or SSL, encryption technology, according to Robert Hansen and Josh Sokol, who spoke to a packed room of several hundred security experts.
Encryption forms a kind of tunnel between a browser and a website's servers. It scrambles data so it's indecipherable to prying eyes.
SSL is widely used on sites trafficking in sensitive information, such as credit card numbers, and its presence is shown as a padlock in the browser's address bar.
SSL is a widely attacked technology, but the approach by Hansen and Sokol wasn't to break it. They wanted to see instead what they could learn from what are essentially the breadcrumbs from people's secure Internet surfing that browsers leave behind and that skilled hackers can follow.
Their attacks would yield all sorts of information. It could be relatively minor, such as browser settings or the number of Web pages visited. It could be quite substantial, including whether someone is vulnerable to having the "cookies" that store usernames and passwords misappropriated by hackers to log into secure sites.
Hansen said all major browsers are affected by at least some of the issues.
"This points to a larger problem — we need to reconsider how we do electronic commerce," he said in an interview before the conference, an annual gathering devoted to exposing the latest computer-security vulnerabilities.
For the average Internet user, the research reinforces the importance of being careful on public Wi-Fi networks, where an attacker could plant himself in a position to look at your traffic. For the attacks to work, the attacker must first have access to the victim's network.
Hansen and Sokol outlined two dozen problems they found. They acknowledged attacks using those weaknesses would be hard to pull off.
The vulnerabilities arise out of the fact people can surf the Internet with multiple tabs open in their browsers at the same time, and that unsecured traffic in one tab can affect secure traffic in another tab, said Hansen, chief executive of consulting firm SecTheory. Sokol is a security manager at National Instruments Corp.
Their talk isn't the first time researchers have looked at ways to scour secure Internet traffic for clues about what's happening behind the curtain of encryption. It does expand on existing research in key ways, though.
"Nobody's getting hacked with this tomorrow, but it's innovative research," said Jon Miller, an SSL expert who wasn't involved in the research.
Miller, director of Accuvant Labs, praised Hansen and Sokol for taking a different approach to attacking SSL.
"Everybody's knocking on the front door, and this is, 'let's take a look at the windows,'" he said. "I never would have thought about doing something like this in a million years. I would have thought it would be a waste of time. It's neat because it's a little different."
Another popular talk at Black Hat concerned a new attack affecting potentially millions of home routers. The attack could be used to launch the kinds of attacks described by Hansen and Sokol.
Researcher Craig Heffner examined 30 different types of home routers from companies including Actiontec Electronics Inc. and Cisco Systems Inc.'s Linksys and found that more than half of them were vulnerable to his attack.
He tricked Web browsers that use those routers into letting him access administrative menus that only the routers' owners should be able to see. Heffner said the vulnerability is in the browsers and illustrates a larger security problem involving how browsers determine that the sites they visit are trustworthy.
The caveat is he has to first trick someone into visiting a malicious site, and it helps if the victim hasn't changed the router's default password.
Still: "Once you're on the router, you're invisible — you can do all kinds of things," such as controlling where the victim goes on the Internet, Heffner said.
Thursday, February 25, 2010
Microsoft uses law to cripple hacker spam network
The software titan's Digital Crime Unit got clearance from a US judge to virtually sever the cyber criminals' command computers from hundreds of thousands of machines worldwide infected with a Waledac virus.
"We decided the best tactic would be to literally build a wall between the bot-herder, the command computer, and all of the other computers -- effectively cutting the umbilical cord," said Microsoft attorney Richard Boscovich.
Microsoft got a US judge to grant an ex parte temporary restraining order that let the firm erect the cyber blockade without warning bot-herders, masters of the "botnet."
"It was of crucial importance that when we went out to sever the connection between the bot herder and the bots, that severing had to be done without him knowing," said Boscovich, who works in the digital crime unit.
Microsoft drafted a complaint that made a case to the court that the damage to computer owners worldwide, and to the software firm, was major enough to warrant "this rather extraordinary order," Boscovich said.
The mission to take down one of the ten largest botnets in the United States was referred to internally at Microsoft as "Operation b49."
Waledac is estimated to have infected hundreds of thousands of computers worldwide, letting its masters mine machines for information or secretly use them to fire off spam email.
Hackers typically infect computers with malicious codes by tricking owners into clicking on booby-trapped email messages or Internet links that plant viruses.
Bot-herders are then free to hire out botnets for nefarious tasks such as spewing spam or overwhelming legitimate websites with myriad simultaneously requests in what are known as distributed-denial-of-service attacks.
The Waledac botnet was believed to be capable of sending more than 1.5 billion spam email messages daily.
During a three week period in December, Waledac-infected machines sent approximately 651 million spam email messages to users of Microsoft's free Hotmail service, according to the software firm.
The spam included messages pitching online pharmacies, knock-off goods, and penny stocks. smh.com
Saturday, December 5, 2009
Suspect hacker calling residents
Identifying himself only as "Mark", he does not state a surname or a company, but says he is phoning regarding a complaint of slow internet connection.
He then asks the computer user to give him remote access by typing in logmein123.com.
The instructions should not be followed and people should contact their service provider, police have said. BBC
Thursday, October 1, 2009
Hackers Breach Payroll Giant, Target Customers
Morrestown, N.J. based PayChoice, provides direct payroll processing services and licenses its online employee payroll management product to at least 240 other payroll processing firms, serving 125,000 organizations.
Last Wednesday, a number of PayChoice customers received an e-mail warning them that they needed to download a Web browser plug-in in order to maintain uninterrupted access to onlineemployer.com, the portal for PayChoice's online payroll service. The supposed plug-in was instead malicious software designed to steal the victim's user names and passwords.
Unlike typical so-called "phishing" scams -- which are sent indiscriminately to large numbers of people in the hopes that some percentage of recipients are customers of the targeted institution -- this attack addressed PayChoice customers by name in the body of the message. The missives also included reference to each recipient's onlineemployer.com user name and a portion of his or her password for the site.
In a statement e-mailed to Security Fix, PayChoice said the company discovered on Sept 23 that its online systems had been breached. The company said it immediately shut down the onlineemployer.com site and instituted fresh security measures to protect client information, such as requiring users to change their passwords.
"We are handling this incident with the highest level of attention as well as concern for our clients, software customers and the employees they serve," said PayChoice Chief Executive Robert Digby.
Several PayChoice customers who received the initial scam e-mails shared with Security Fix follow-up correspondence sent by Paychoice to its customers in the wake of the attack.
An Sept. 28 e-mail states: "Our analysis has indicated that the email addresses, Login ID and some valid partial passwords were included in the emails sent to some registered users."
According to the PayChoice e-mails to customers, the fraudulent missives were sent via the free Yahoo! Web mail service -- and directed recipients to either download a malicious file or visit one of several Web sites that were hosted on servers located in Poland. PayChoice told customers that the malware sites linked to in the messages tried to exploit several Web browser security flaws that would enable them to install malicious software, including vulnerabilities in Microsoft's Internet Explorer Web browser and security holes in Adobe Flash and Adobe Reader software applications.
If successful, PayChoice said, the malicious sites downloaded a Trojan horse program called TrojanDownloader:Win32/Bredolab.X, which according to Microsoft is a malware program that tries to download additional malicious files and disable security software on the infected PC.
According to Steve Friedl, a blogger and security expert who writes the Unixwiz blog and who had several customers who received the malicious e-mails, the malware used in the attack is poorly detected by most anti-virus products on the market today: As of last Thursday afternoon, more than a day after the attack began, Friedl said, the malware was detected by just five of the 41 commerical and retail anti-virus scanners in use at virustotal.com (full disclosure: Friedl also consults for a competitor of PayChoice, called Evolution Payroll).
Mike LaPilla, manager of malicious code operations for iDefense, a security firm owned by Mountain View, Calif.-based Verisign Inc., said attacks like the one against PayChoice's customers typically are designed to steal the online banking credentials for individuals that manage corporate payroll accounts.
"In these kinds of attacks, there's a high probability that the fake e-mails will go to someone who has access to their employer's commercial bank account online," LaPilla said.
Washington Post
Subscribe to:
Posts (Atom)
Posts
