Gregarius » éléments par Cameron Camp

éléments par Cameron Camp

BetaNews.Com

Blizzard hacked for real this time -- change your passwords NOW!

Publié: août 10, 2012, 3:45pm CEST par Cameron Camp

In May we read that game maker Blizzard, developer of a series of popular games including World of Warcraft, Diablo III and Starcraft, was hacked, but that turned out to just be individual compromised accounts from some of its users. Now we read, from Blizzard itself rather than a third party, that they have been hacked and information compromised on their networks. So how are they doing with the breach?

"This week, our security team found an unauthorized and illegal access into our internal network here at Blizzard", the company says. So did they respond well? It seems they got the jump on things and responded quickly, a smart move: "We quickly took steps to close off this access and began working with law enforcement and security experts to investigate what happened."

Next they were specific with what classes of data were, and weren’t compromised, another smart move: "Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China". Interesting data point: China users seemed to be exempt. Also they note: "We also know that cryptographically scrambled versions of Battle.net passwords (not actual passwords) for players on North American servers were taken".

But what steps were in place to slow down or stymie would-be hackers? Blizzard continues: "We use Secure Remote Password protocol (SRP) to protect these passwords, which is designed to make it extremely difficult to extract the actual password, and also means that each password would have to be deciphered individually".

And Blizzard took precautions notifying their userbase: "As a precaution, however, we recommend that players on North American servers change their password". Blizzard includes a link to do so, which is helpful. They also suggest changing other passwords you may have used which are similar on other websites, which is a good idea.

While the exact details of the method of breaching their systems still remain to be investigated, it seems they are keeping their users well-informed and provide helpful recommendations, a step in the right direction. While no one wants to be on the receiving side of a breach, importantly, Blizzard pushes information out to the users from the source though a FAQ here, which is proactive. A lot of consumer-facing websites could learn from the things Blizzard is doing right.

If you are a Blizzard user, my colleague David Harley identifies passwords to avoid. Go for a new password that is long (over 8 characters) and hard to guess (not based on things other people might know about you) and use a mixture of upper- and lower-case letters with numbers and punctuation characters if allowed (KerAZg3nes!).

Reprinted with permission

Cameron Camp is a researcher for global security provider ESET and has played a critical role in building the ESET North America Research Lab. Cameron has been building critical technology infrastructures for more than 20 years, beginning as an assembly language programmer in 1987 and eventually becoming an evangelist for Linux and open-source technologies with an emphasis on the security sector. Prior to joining ESET, he founded Logical Web Host in 1998, a data-driven web services company.
Have you looked at your .htacess file recently? Your Apache server may not be secure

Publié: juillet 30, 2012, 8:13pm CEST par Cameron Camp

If your organization’s website runs on Apache, and many do, you might wonder if the webserver’s .htaccess controls are securely configured. If you believe the demo we saw on July 27 at Black Hat by Matias Katz and Maximiliano Soler, the answer is a resounding ‘NO!’ What Katz and Soler describe in their session is not some rare “corner case” hack that could only possibly occur in a lab with billions of automated attempts, this is easily testable in the real world, and the tools to exploit it are freely available.

It turns out that Apache, the most commonly-used web server in the world, has an arrangement where it hands off PHP-based requests within .htaccess to PHP itself, which has worked fine on millions and millions of websites for years. But with .htaccess, you can specify what requests get sent to PHP to try to interpret. The usual methods are GET and POST, but if you feed the .htaccess process some non-standard input, PHP automatically (unless otherwise instructed) treats it as a GET request, and allows the utility to start saving the PHP files on a webserver to your local filesystem.

Then it gets worse. Once the process has identified links buried in the files it just saved, it goes hunting down those links, requesting to save them all. It also checks to see if it already saved the file that the link points to, and in this way, won’t download duplicates, keeping the fileset fresh.

But wait, there’s more. After it saves all those linked files, it scours them as well, searching for files located wherever they link to, and so the process goes. With so many pages linking to other resources, it’s easy to see how a bad actor can pull down all the PHP files that run the site. These may well contain references to login credentials for databases, passwords, personally identifiable information and a host of other goodies that can be sold on the black market or used to enable further exploits.

Want to protect yourself? Turns out you can get very specific in your .htaccess file about what types of requests get handed to PHP by using the “LimitExcept” directive instead of the more commonly used “Limit”. You can also fix the issue within your PHP code as well.

So, now might be a good time to check your website configuration to make sure you’re protected, before the bad guys go scouring around trying to use this type of exploit. And if you’re not the person in charge of your website, you might want to point out this problem to the person who is, they may thank you, a lot.

Reprinted with permission

Photo Credit: Sergej Khakimullin/Shutterstock

Cameron Camp is a researcher for global security provider ESET and has played a critical role in building the ESET North America Research Lab. Cameron has been building critical technology infrastructures for more than 20 years, beginning as an assembly language programmer in 1987 and eventually becoming an evangelist for Linux and open-source technologies with an emphasis on the security sector. Prior to joining ESET, he founded Logical Web Host in 1998, a data-driven web services company.
5 ways to put hackers on the defensive

Publié: juillet 26, 2012, 8:29pm CEST par Cameron Camp

Black Hat keynote speaker Shawn Henry, the former executive assistant director of the FBI’s Criminal, Cyber, Response and Service Branch, started off the day after opening remarks from Jeff Moss, founder of Blackhat. Moss wondered if now was the time for the cyber-security sector to take a more aggressive/offensive approach. Moss mentioned working for a former employer years back, a firewall manufacturer that had a product that would launch specially crafted code in response to an attacker, sort of an early offensive DoS attack. This was an early attempt by security professionals to cause pain by going on the offensive.

But since DoS attacks aren’t exactly a legal offensive tactic nowadays, what to do? He recommends civil action, a la recent Facebook actions where attackers were sued in civil court. But what happens when attackers are overseas? Mr. Moss is hopeful that responding in a civil manner would “encourage” other countries to implement legal protections to stop current and future attack attempts abroad.

What can we do besides sue? Mr. Henry proposes advancing technologies like deception, network decoys and other trickery, along with heavy network segmentation as a possibility to turn the tide. He also pushes for more legislation that would make tactics more effective at nabbing bad actors. But this sort of legislative pressure is famous for riling up privacy pundits, who are sure to respond with counterpoints to perceived privacy erosion. Still, he argues current laws are archaic and do not allow adequate response to the current threatscape.

Most Attacks Undisclosed

In the meantime, Mr. Henry says today’s headlines reflect only a tiny sliver of what is actually happening, attack-wise. Companies, he said, vastly under-report hacks, and in fact the FBI frequently has the dubious honor of notifying companies that they have been breached after their private data has been found in the public domain during other investigations.

To give an idea of the total size of attacks, Mr. Henry estimates close to 90 percent of the real attack activity is happening in the classified environment, sort of “below the water line” to use an iceberg analogy. This means we are only seeing a tiny slice of an even tinier slice of the real threat, to use his characterization.

He calls the Internet a great attack equalizer, allowing any of the billions of Internet users to plan and possibly launch an attack, and paints this threat theater as one of the top threats faced in the world today, aside from WMD. And Internet threats are far easier to carry out than deploying Weapons of Mass Destruction.

But all attacks aren’t created equal, the motivations vary. If, for example, a company you plan to do business with has conducted network exploits against you, they may already know what kind of financial position you are in, what intellectual property you really have, and would therefore be in a much stronger negotiation position, possibly tilting the tables heavily in their favor. Mr. Henry compares this to taking a test where you already know all the answers, and therefore are heavily favored to win.

What does He Recommend?

First he tries to glean wisdom from more tradition physical attacks and adapt them to the attacker.

These include:

1. Denial and deception. Keeping the attackers out of your core network by sending them on wild goose chases using network tricks.

2. Decoys. Serve up fake information, designed to foil attempts to gain intelligence, sort of poisoning their intel, and helping them along with same wild goose chase.

3. Raise the network defense bar. Cause them considerable pain (and the cost of buying more advanced tools), make them spend months of effort trying to get in.

4. Heavy use of defense-in-depth tactics. Don’t put all the “crown jewels” one level deep from the perimeter, but make attackers have to penetrate multiple levels.

5. Log everything you can. This will help greatly when trying to find a “smoking gun” during an investigation. This means both inbound and outbound traffic, and especially watch for abnormal outbound traffic, a telltale sign something bad is happening.

Will it be Enough?

These steps will certainly raise the bar of difficulty for people attacking companies, and therefore raise the cost to the attacker, which is a major factors when an attacker picks a target. If the costs become too high, they may go elsewhere or give up. They may also pick an easier target to exploit, and your company would be out of harm’s way.

But tactics change, and so does the threatscape. And if the last several years are any indication of what’s yet to come, hang on for a wild ride. Also, the old boxing admonition to “protect yourself at all times” certainly still applies.

Reprinted with permission

Photo Credit: NinaMalyna/Shutterstock

Cameron Camp is a researcher for global security provider ESET and has played a critical role in building the ESET North America Research Lab. Cameron has been building critical technology infrastructures for more than 20 years, beginning as an assembly language programmer in 1987 and eventually becoming an evangelist for Linux and open-source technologies with an emphasis on the security sector. Prior to joining ESET, he founded Logical Web Host in 1998, a data-driven web services company.
Scam sites lure victims with fake YouTube-to-mp3 converters

Publié: juillet 25, 2012, 6:35am CEST par Cameron Camp

Want to access the music tracks of YouTube.com videos on your iPod but don’t want to pay? You’re not alone. Recently, a crop of websites have popped up offering to convert the audio from videos to .mp3 files that you can then download at no charge. Sounds great, right? The catch: scammers are trying to capture the popular click traffic and redirect users to scam websites, where you might get more than you bargained for, in the form of free malware and other unpleasantness as a bonus.

Recently, we hosted a “cyber boot camp”, teaching high school students to attack and defend networks. One of our presenters, John Moffat, who often delivers security awareness seminars to teenagers and stresses the dangers of the “free” Internet, referenced this scam in his presentation. While Mr. Moffat doesn’t claim to be a malware expert, he knows a scam when he sees one, and does his best to help others avoid falling prey.

So what happens if you fall for one of these types of scams? Below we follow the trail of one example, with screenshots of what you might see.

In this example, I clicked on a highly ranked Google search results link, which pointed to a YouTube video itself, purporting to give instructions on how to convert their videos to .mp3’s.

When I did, it showed a non-video screenshot inside their video player, which directed me to visit a website directly. The video description came completely stuffed with keywords in the description to inflate rankings. Here’s a screenshot of what I was presented with:

When I typed the URL into a browser that the “video” recommended, I was taken to a site heavily laden with javascript (which my browser blocked with a plugin), third party content providers and Google Analytics, that said I had to complete a survey to get my “$500 Best Buy gift card”, which would also unlock the download of the free video-to-mp3 converter. Since I’d like a $500 gift card as much as the next guy, I clicked on that link.

I chose the Best Buy gift card offer. When I clicked on it, it took me to a page that shows that I could get a $1,000 gift card, even better!

I also noticed that the page wanted to use extensive javascript and third party content, triggering an ESET Smart Security warning that a website was blocked that was trying to send me tracking cookies. I also notice the site used significant bandwidth trying to load all its goodies, presumably to enable the successful completion of my 3 questions to get the $1,000 gift card right?

But surprise, after I completed the last question, I then had to enter my email, presumably to get the gift card. When I entered a fake email, I was then taken to a screen where I had to enter much more personal information, including my physical address, age, sex, and phone number. I also had to consent to being called by third parties about magazine subscriptions, etc:

Once you click ‘continue’ you get the next screen:

At this point, I notice that the original password that was promised to unlock my video converter download never materialized. It seemed clear that this rabbit trail I was following would not likely end any time soon, so I exited the websites, and finished up this article, hoping this accounting of what happens if you take the bait would dissuade others from falling for similar scams.

What’s the payoff for scammers? For some time now they have continually adapted their scam platforms to match new potential streams of traffic, and this is no exception. By gaining high search rankings through BlackHat SEO (BHSEO), every time a user clicks, their search popularity rankings, and associated ad revenue, goes up. Even if the user doesn’t fall for installing a “free premium .mp3 player” (laden with malware) or some such because they’re the “lucky one thousandth viewer” of the website, the scam website still makes money by cashing in on the traffic.

And many users might be convinced to download a premium, java-based player, with free malware as a bonus.

But to recount, this scam (so far) has attempted to send things that were blocked by ESET Smart Security, wanted to silently run questionable javascript on multiple pages, harvest my email address, along with physical address, age, sex, phone number, and get me to signify that I was over 18 years of age, and consent to the whole process. That doesn’t sound very close to free, it sounds like the beginning of a long string of nastiness.

At that point, I went to my favorite reputable .mp3 vendor and purchased a great blues track from yesteryear for 99 cents, and decided to forego the personal information harvest “for free”.

Photo Credit: Lasse Kristensen/Shutterstock

Reprinted with permission; screen captures courtesy ESET.

Cameron Camp is a researcher for global security provider ESET and has played a critical role in building the ESET North America Research Lab. Cameron has been building critical technology infrastructures for more than 20 years, beginning as an assembly language programmer in 1987 and eventually becoming an evangelist for Linux and open-source technologies with an emphasis on the security sector. Prior to joining ESET, he founded Logical Web Host in 1998, a data-driven web services company.
Nation-state hackers attack small businesses, too

Publié: juillet 10, 2012, 2:32pm CEST par Cameron Camp

Small businesses have their hands full these days in light of a down economy, tightening budgets and the steepening pace of business, but with nation-state hacks front and center in the threatscape, should you worry about those, too, or are you (and your customers) safe?

Nation-state hacks bring to mind images of large defense contractors, big government offices, and/or high profile financial institutions. After all, if a bad actor overseas stole the cutting edge design of a new nuclear reactor, it would be quite a haul for that government and its cronies -- and worth their time, money and effort to go after. But you’re a small business, too small to garner that kind of attention, right?

What Happened in Peru

Architect firms in Peru no doubt thought along those same lines, up until the time that critical design documents started “magically” exfiltrating out over the Internet. The malicious software called ACAD/Medre.A, which we wrote about here, and which was doing that exfiltration, taught us that even if you’re small, you still might posses critical data, and losing that data can have a real impact on your viability as a business.

Suppose your bid to build a skyscraper includes highly detailed designs reflecting much hard work and due diligence, which are then stolen by a competitor with close ties to the government and who significantly undercuts you because they don't need to spend and recoup the cost of preparing the bid. You could see an eerily-familiar-looking building when the contractor is finished, just like the one you designed.

What if you had some dealings with a government entity on small contracts? Georbot, which we wrote about here, taught us that remote spy software was searching for key government terms on users’ computers, and then silently attempted to exfiltrate them to far-flung regions to be data mined for nuggets.

What if you’re a small systems integrator that works on electrical plants? With the recent rash of SCADA angled attacks, your small business might be worth scouring around for access credentials to critical infrastructure controls, as a platform for ransom schemes or other nastiness.

The sad reality is that the typical small business doesn’t have in place adequate defenses against this type of threat. We're talking well-financed, well-orchestrated attacks, that specifically target you (or similar targets in your market segment). That means the attackers have the time to do it right. And if they’re after information that could be worth a lot, they can spend to get it.

So how do you protect yourself? The first part of a nation state attack is likely to be intelligence gathering. They want to know and understand your network. Think of it like getting a blueprint of the bank prior to a bank robbery, you’re not primarily interested in the blueprint, but what information it provides to facilitate your endeavor.

Rogue Processes are Red Flags

In a cyber-assault on your company the first stage of a nation state attack might be to try to pierce your perimeter network defenses and look around. So here’s the part that’s critical: rogue processes that suddenly appear and start scouring your internal networks are a red flag that someone’s trying to gather intelligence. Stop them here and you’ll go a long ways toward fending off successive stages. Without a map of what they’re looking for, it’s much tougher for them to find it.

Second, watch outbound attempts to transfer data to strange places, especially at strange times, and more especially in large spikes of traffic. Those are several key indicators that bad things are happening, and your network sensors should alert you quickly.

Third, the endpoint tends to be the weak point and most frequently exploited. Someone lets in the bad guys accidentally or they get in because someone is not using adequate endpoint security. This breach of defenses may come in the form of a rogue attachment on an email, or in a social network message. If a user doesn’t know better and clicks on the wrong thing, and they are not running antimalware, then your troubles may just be starting.

The good news? With a few pieces of network hardware and time spent educating users (and good endpoint security), you can go a long way toward stopping nastiness. Many modern business routers have intrusion detection defenses built in. These can be enabled by simply checking boxes on the router control panel. They also support notifications via email if bad things appear to be happening. This hardware is well within the reach of most small businesses, budget-wise.

Yes, there are better (and more complex/expensive) defenses, but that’s a good start and makes you more secure than many businesses that don’t even have the basics in place yet. These steps can go a long ways toward keeping you safe, particularly if your users also know how to spot a malicious scam attachment in their email and not click on it.

Reprinted with permission.

Photo Credit: Blazej Lyjak/Shutterstock

Cameron Camp is a researcher for global security provider ESET and has played a critical role in building the ESET North America Research Lab. Cameron has been building critical technology infrastructures for more than 20 years, beginning as an assembly language programmer in 1987 and eventually becoming an evangelist for Linux and open-source technologies with an emphasis on the security sector. Prior to joining ESET, he founded Logical Web Host in 1998, a data-driven web services company.
That Facebook account verification email in your inbox is a scam

Publié: juin 16, 2012, 1:36am CEST par Cameron Camp

If the scary email or app notification, and subsequent webpage, is to be believed, you have only a few days to verify your Facebook account or you’ll be out of luck. But don’t worry, a few days later you will magically get a few more days to verify, and so the scam goes.

A Twitter follower with the handle of @chasapple sent us a tip on an app message they received, here’s a screenshot of what happens if you clicked the link.

Notice how target-word-rich this example is: There is scary sounding language about the SOPA ACT (and a few misspelled words and syntax errors, a tip the author probably doesn’t speak English as a first language). The call to action is in RED, apparently for added effect. The second thing to note is that the website is definitely NOT facebook.com, but some other domain name, which clearly wouldn’t be a host of an official notification with the ability to suspend your account.

Notice also that the Firefox NoScript add-on, which I have enabled on my system, caught 13 different scripts trying to execute when the page loaded. Along with a mix of ad revenue sites, there were various other scripts as well. Also, both buttons would lead a user to the same link, and potentially set them up for a host of ensuing nastiness no matter which one chosen.

It seems that tapping into the vast pool of over 900 million Facebook users is a favorite strategy among scammers these days, and this is no exception. But as my friend Randy Abrams has pointed out for some time, much of the nastiness could be averted simply by educating/imploring users not to click on suspicious-looking emails. The same is true of apps these days. The problem, he opines, is that the average user doesn’t really have a clear sense of what a suspicious-looking email/app is, and how to tell the difference between legitimate ones and scams.

While user education is an ongoing challenge, the simple version is to tell users to visit a website directly through their web browser and navigate from there, rather than clicking on an email/app link. But it’s not so simple in practice as our inboxes are exploding with email messages these days and the time to take a few extra steps can be hard to carve out. But it takes a lot longer to respond to having your account compromised, so there’s the tradeoff. It’s also a good idea to install script blocking technology in case the temptation to click on links is too strong, then add domains like this one to a network-based blacklist.

Reprinted with permission.

Cameron Camp is a researcher for global security provider ESET and has played a critical role in building the ESET North America Research Lab. Cameron has been building critical technology infrastructures for more than 20 years, beginning as an assembly language programmer in 1987 and eventually becoming an evangelist for Linux and open-source technologies with an emphasis on the security sector. Prior to joining ESET, he founded Logical Web Host in 1998, a data-driven web services company.
How will the LinkedIn hack affect you?

Publié: juin 7, 2012, 12:48am CEST par Cameron Camp

This morning when I logged into LinkedIn I was greeted with several front page references to the reported hacking of the site, and instructions for changing my password, which I did immediately. This is a good time to change all of your social media passwords, making sure you create a fresh password that is hard to guess and unique to each site. It is not unusual for malicious parties who grab a bunch of passwords from one site to try those same passwords on other sites.

Over 6.5 million account passwords showed up on a Russian forum in SHA-1 (hashed) format to prove that the hackers had indeed succeeded in penetrating LinkedIn. There is a good chance that if the hacker(s) achieved access to LinkedIn passwords then they also know the corresponding LinkedIn usernames, i.e. the matching email address of the account owner.

The difference with this hack, as opposed to many others, is that people put their real information about themselves -- their professional information -- on the site, not just what party they plan on attending, or which games they are playing, which you might see on other networks like Facebook. Furthermore, every time one of your LinkedIn contacts updates their profile, you get updates from LinkedIn showing what’s happening. This has the aggregate effect of a form of peer review on what you post about yourself, knowing that it is exposed to those business or career contacts that have a direct impact on your life. This causes people to tend toward being very accurate and honest on their LinkedIn profile. In other words, mess with somebody’s professional profile on LinkedIn, and you’re messing with their life, and their contacts know about it.

A broader question is how to assess the aggregate value of this level of business intelligence about an individual, let alone a whole business sector? This is the kind of information that advertisers and bad actors alike drool over. If, for example, you determined from LinkedIn that a competitor was losing staff at a rapid pace, it might affect a merger/acquisition negotiation, potentially swinging the value of the deal significantly. Also, since LinkedIn can be used as a sort of timeline of a user's real history, there are deep stacks of historic business intelligence that can be garnered.

It all adds up to a very bad day for LinkedIn, and we hope they take very proactive steps to assure users and protect data going forward. In the meantime, besides changing your password, it's a good idea to review your user settings and try to understand/limit/narrow access to your key information to those with whom you intend to share. In this way you can help prevent unintended data sprawl, also meaning other user accounts which might become compromised won't have as much of a direct effect on your personal information.

Several people have notified us that they received emails today asking them to confirm their LinkedIn email addresses and we have determined that these are scams. We are investigating the exact details but in the meantime please do not click on links in email to change or verify account information, at LinkedIn.com or on any other membership site. Instead, navigate to the site directly by typing in the address bar in your browser.

[Note that the first link --"Click here" -- is the one that takes you to somewhere other than LinkedIn. In this case the destination is an illegal online pharmacy selling Viagra and similar products. Because similar emails have been circulating for some time it is hard to say if this is an example of a coordinated scam designed to leverage the security breach made public today, or simply a coincidence (like getting a phishing email asking you to reset your Bank of America online banking password two days after you opened an account there). Sadly, we are likely to see more of these emails as LinkedIn tries to rebuild trust among members.]

Reprinted with permission.

Photo Credit: Feng Yu/Shutterstock.com

Cameron Camp is a researcher for global security provider ESET and has played a critical role in building the ESET North America Research Lab. Cameron has been building critical technology infrastructures for more than 20 years, beginning as an assembly language programmer in 1987 and eventually becoming an evangelist for Linux and open-source technologies with an emphasis on the security sector. Prior to joining ESET, he founded Logical Web Host in 1998, a data-driven web services company.

Gregarius » éléments par Cameron Camp

Canaux

éléments par Cameron Camp

Publié: août 10, 2012, 3:45pm CEST par Cameron Camp

Publié: juillet 30, 2012, 8:13pm CEST par Cameron Camp

Publié: juillet 26, 2012, 8:29pm CEST par Cameron Camp

Publié: juillet 25, 2012, 6:35am CEST par Cameron Camp

Publié: juillet 10, 2012, 2:32pm CEST par Cameron Camp

Publié: juin 16, 2012, 1:36am CEST par Cameron Camp

Publié: juin 7, 2012, 12:48am CEST par Cameron Camp