Fingerprints stolen? - Sounds weird but it happened. Now. have you thought of the consequences?

Nice one from my all time favorite Security Guru

From the article:

The news from the Office of Personnel Management hack keeps getting worse. In addition to the personal records of over 20 million US government employees, we've now learned that the hackers stole fingerprint files for 5.6 million of them.

There are three basic kinds of data that can be stolen. 

1. The first, and most common, is authentication credentials.
2. The second kind of data stolen is personal information
3. The third - Biometric data

The problem with biometrics is that they can't be replaced. So while it's easy to update your password or get a new credit card number, you can't get a new finger.

And we really don't know the future value of this data. If, in twenty years, we routinely use our fingerprints at ATM machines, that fingerprint database will become very profitable to criminals. If fingerprints start being used on our computers to authorize our access to files and data, that database will become very profitable to spies.

Not every use of biometrics requires the biometric data to be stored in a central server somewhere. Apple's system, for example, only stores the data locally: on your phone. That way there's no central repository to be hacked. And many systems don't store the biometric data at all, only a mathematical function of the data that can be used for authentication but can't be used to reconstruct the actual biometric. Unfortunately, OPM stored copies of actual fingerprints.

For More info:

http://motherboard.vice.com/read/stealing-fingerprints

TSA compatible locks are not useful any more - Time to use regular locks

Oh Yeah, the article also talks about Backdoor in the Phone switch and the NSA backdoor. All of which are now exposed and can be exploited

From the Article:

A  TSA agent and the Washington Post revealed the secret.  All it takes to duplicate a physical key is a photograph, since it is the pattern of the teeth, not the key itself, that tells you how to open the lock.

Any phone switch sold in the US must include the ability to efficiently tap a large number of calls.  And since the US represents such a major market, this means virtually every phone switch sold worldwide contains “lawful intercept” functionality.  

The final backdoor, Dual_EC_DRBG, was surreptitiously developed by the NSA.  This trap-doored pseudo-"random" number generator enables the NSA (or anyone who knows a secret number) to efficiently decrypt communication.  Yet as many cryptographers were suspicious of both Dual_EC's poor performance and "backdoor-capable" nature, the NSA also needed to use its market power to encourage adoption, including reportedly bribing RSA Data Security $10M to make it the default pRNG.

All three backdoors introduced significant problems.  TSA locks can be opened by anyone despite their promise of security, the CALEA interface has been used for nation-state spying, and the biggest potential victim of the Dual_EC backdoor is probably the US government.

For More info

https://www.lawfareblog.com/tale-three-backdoors

Hacked data on millions of US gov't workers is bad news, "Data was NOT encrypted" - this is very very bad

Encryption  - One of the important layer for Security - Why are people still not doing it.

From the Article:

Cox wrote in the letter, a copy of which was provided to IDG News Service. "Worst, we believe that Social Security numbers were not encrypted, a cybersecurity failure that is absolutely indefensible and outrageous."

More information:

http://www.computerworld.com/article/2935132/cybercrime-hacking/hacked-data-on-millions-of-us-govt-workers-was-unencrypted.html

WireTapping - Now OutSourced

• We can't trust the ISP but we know them
• We can't trust Government but we know that,
• Now we have shady middle men (organization) that do the dirty work and we don't know them

From the Article

But when one Atlanta, Georgia-based Internet provider was served a top-secret data request, there wasn't a suited-and-booted federal agent in sight.

Why? Because the order was served on a so-called "trusted third-party," which handles the request, served fresh from the secretive Washington D.C.-based Foreign Intelligence Surveillance (FISA) Court. With permission from their ISP customers, these third-parties discreetly wiretap their networks at the behest of law enforcement agencies, like the Federal Bureau of Investigation (FBI), and even intelligence agencies like the National Security Agency (NSA).

By implementing these government data requests with precision and accuracy, trusted third-parties — like Neustar, Subsentio, and Yaana — can turn reasonable profits for their services.

Little is known about these types of companies, which act as outsourced data brokers between small and major U.S. ISPs and phone companies, and the federal government.

Follow this link for additional details:

http://www.zdnet.com/the-most-important-tech-companies-you-have-never-heard-of-7000032573/

Hacking Traffic Lights Is Apparently Really Easy

It is not the headline that bothered me.

What shocked me is what makes it easy

The Michigan team identified three main weaknesses in traffic control systems in the U.S.: 

1. use of un-encrypted wireless communication signals 
2. default usernames and passwords, 
3. use of a traffic controller—the machine that interprets sensor data and controls lights and walk signs, etc.—that is vulnerable to known hacks.

Follow this link for additional details:

http://time.com/3146147/hacking-traffic-lights-is-apparently-really-easy/

NUKE REGULATOR HACKED BY SUSPECTED FOREIGN POWERS

Not once but, THRICE.

The methods adopted by the hackers is really interesting

1. Malware in the cloud
2. Email from legitimate account

From the Article

Nuclear Regulatory Commission computers within the past three years were successfully hacked by foreigners twice and also by an unidentifiable individual,

One incident involved emails sent to about 215 NRC employees in "a logon-credential harvesting attempt,"

A dozen NRC personnel took the bait and clicked the link. 

hackers also attacked commission employees with targeted spearphishing emails that linked to malicious software. A URL embedded in the emails connected to "a cloud-based Microsoft Skydrive storage site," which housed the malware,

In another case, intruders broke into the personal email account of an NRC employee and sent malware to 16 other personnel in the employee's contact list. A PDF attachment in the email contained a JavaScript security vulnerability. One of the employees who received the message became infected by opening the attachment, McIntyre said. 

Follow this link for additional details:

http://www.nextgov.com/cybersecurity/2014/08/exclusive-nuke-regulator-hacked-suspected-foreign-powers/91643/

What is PNR - it is something that contains your full credit card # and sent to government by Booking agencies.

This one shocks me!

PNR -  Passenger Name Records

From the Article

My own PNRs include not just every mailing address, e-mail, and phone number I've ever used; some of them also contain:

The IP address that I used to buy the ticket

My credit card number (in full)

The language I used

Notes on my phone calls to airlines, even for something as minor as a seat change

Follow this link for additional details:

http://arstechnica.com/tech-policy/2014/07/ars-editor-learns-feds-have-his-old-ip-addresses-full-credit-card-numbers/

You think only IT guys screw up , how about guys who store viruses and bacteria.

The first paragraph from the article:
The same federal scientist who recently found forgotten samples of smallpox at a federal lab also uncovered over 300 additional vials, many bearing the names of highly contagious viruses and bacteria.


The link below has more information:-

http://www.koaa.com/news/300-vials-labeled-influenza-dengue-found-at-lab/

Gogo in-flight Wi-Fi provider - Voluntarily decided to turn your data over to the government.

How Nice!

And Gogo not the only one

According to the article:-

According to a letter Gogo submitted to the Federal Communications Commission, the company voluntarily exceeded the requirements of the Communications Assistance for Law Enforcement Act, or CALEA, by adding capabilities to its service at the request of law enforcement. The revelation alarms civil liberties groups, which say companies should not be cutting deals with the government that may enhance the ability to monitor or track users.

Although FCC rules “do not require licensees to implement capabilities to support law enforcement beyond those outlined in CALEA…,” Hastings noted, “[n]evertheless, Gogo worked with federal agencies to reach agreement regarding a set of additional capabilities to accommodate law enforcement interests. Gogo then implemented those functionalities into its system design.”

But it apparently is not the only company cutting deals with law enforcement. An FCC notice of proposed rule making (.pdf) published in December notes that Panasonic Avionics negotiated with law enforcement “regarding lawful interception … and network security functionality to be deployed” in the company’s eXConnect system, which provides Wi-Fi to American Airlines and United.

“The Gogo document and Panasonic documents really reflect this process of these companies sitting down with the government and making deals so the FCC wouldn’t get on their back. These are not agreements that are taking place in the sunlight. These are secret deals that are definitely not being made in the best interest of the public.”

The link below has more information:-

http://www.wired.com/2014/04/gogo-collaboration-feds/

Was NSA exploiting the Heartbleed bug? - "YES" , according to Bloomberg

I am sure everyone had this in their mind, and now we have an answer.

According to the article:-

Friday afternoon, Bloomberg reported that the National Security Agency has been aware of and actively exploiting the Heartbleed bug for at least two full years, citing "two people familiar with the matter."

The link below has more information:-

http://www.computerworld.com/s/article/9247642/NSA_secretly_exploited_devastating_Heartbleed_bug_for_years_report_says

TCP/IP could have been more secure, if NSA would have allowed

This is coming from Vint Serf , the Internet Guru


According to the article:- 

Vint Cerf revealed that he did have access to some really bleeding edge cryptographic technology back then that might have been used to implement strong, protocol-level security into the earliest specifications of TCP/IP. Why weren't they used, then? The culprit is one that’s well known now: the National Security Agency.

Cerf told host Leo Laporte that the crypto tools were part of a classified project he was working on at Stanford in the mid 1970s to build a secure, classified Internet for the National Security Agency.

“During the mid 1970s while I was still at Stanford and working on this, I also worked with the NSA on a secure version of the Internet, but one that used classified cryptographic technology. At the time I couldn’t share that with my friends,” Cerf said. “So I was leading this kind of schizoid existence for a while.”

The link below has more information:-

http://blog.veracode.com/2014/04/cerf-classified-nsa-work-mucked-up-security-for-early-tcpip/

RSA and NSA relationship - Deeper than what we thought?

RSA was wishing this problem would disappear but, it only got worse.

According to the article:- 

Security industry pioneer RSA adopted not just one but two encryption tools developed by the U.S. National Security Agency.

Group of professors from Johns Hopkins, the University of Wisconsin, the University of Illinois and elsewhere now say they have discovered that a second NSA tool exacerbated the RSA software's vulnerability

The professors found that the tool, known as the "Extended Random" extension for secure websites, could help crack a version of RSA's Dual Elliptic Curve software tens of thousands of times faster, according to an advance copy of their research shared with Reuters.

RSA, now owned by EMC Corp, did not dispute the research when contacted by Reuters for comment. The company said it had not intentionally weakened security on any product 

"If using Dual Elliptic Curve is like playing with matches, then adding Extended Random is like dousing yourself with gasoline," Green said.

The academic researchers said it took about an hour to crack a free version of BSafe for Java using about $40,000 worth of computer equipment. It would have been 65,000 times faster in versions using Extended Random, dropping the time needed to seconds, according to Stephen Checkoway of Johns Hopkins.

The link below has more information:-

http://www.reuters.com/article/2014/03/31/us-usa-security-nsa-rsa-idUSBREA2U0TY20140331

Can Surveillance be a business model of the Internet?

The headline says it all and it is written by Bruce Schneier and I respect his views.

According to the article:- 

The main focus of massive Internet companies and government agencies both still largely align: to keep us all under constant surveillance. When they bicker, it’s mostly role-playing designed to keep us blasé about what's really going on.

These companies are doing their best to convince users that their data is secure. But they're relying on their users not understanding what real security looks like.

And IBM’s spending $1.2B on data centers outside the U.S. will only reassure customers who don’t realize that National Security Letters require a company to turn over data, regardless of where in the world it is stored.

Google  could encrypt your e-mail so only you could decrypt and read it. It could provide for secure voice and video so no one outside the conversations could eavesdrop.

It doesn’t. And neither does Microsoft, Facebook, Yahoo, Apple, or any of the others.

Why not? They don’t partly because they want to keep the ability to eavesdrop on your conversations. Surveillance is still the business model of the Internet, and every one of those companies wants access to your communications and your metadata. Your private thoughts and conversations are the product they sell to their customers. We also have learned that they read your e-mail for their own internal investigations.

The biggest Internet companies don’t offer real security because the U.S. government won't permit it.

This isn't paranoia. We know that the U.S. government ordered the secure e-mail provider Lavabit to turn over its master keys and compromise every one of its users.

The link below has more information:-

http://www.theatlantic.com/technology/archive/2014/03/don-t-listen-to-google-and-facebook-the-public-private-surveillance-partnership-is-still-going-strong/284612/

Interesting question - How Do the FBI and Secret Service Know Your Network has Been Breached Before You Do?

We think we know the answer but, some details in this article could surprise you

According to the article:- 

In the course of all of this monitoring, Henry says, law enforcement often finds itself in the odd position of having to show companies evidence they have been victimized. And they aren't always thanked for their efforts. Sometimes, Henry says, companies say "'Please just go away.'" He adds,  "It happens all the time."

How frequently do the Secret Service and FBI come calling? "About 40% to 50% of our customer base have regular conversations with the FBI and other agencies that have warned that they have been breached," says Simon Crosby

In the course of that investigation it was discovered a laptop had malware on it that eluded anti-virus tools and the malware had been in contact with a botnet command-and-control server on the Internet. A "The FBI happened to be monitoring the C&C center" for that botnet, Stahl says.

One of the main questions then becomes, are the companies victimized ready to investigate it? Unfortunately, often they are not, say security experts at Solutionary, 

Solutionary last year was hired by a bank to conduct a forensics examination after the FBI showed up with evidence of a major breach that turned out to have been caused by SQL Injection attacks on the bank's website and had been going on for months. One difficulty, says Kraus, is the bank's logging system was weak and only stored log data for 2 and 1/2 months. Solutionary believes incident response capabilities remain tepid at best in companies today.

This raises the all-important question of how well companies defend their networks and whether their logging capabilities are sufficient to give them a clue about anything after a breach.

The links below has more information:-

http://www.networkworld.com/news/2014/032614-fbi-secret-service-breach-280126.html?source=NWWNLE_nlt_daily_am_2014-03-27

Bruce has a few open questions for IBM - Based on their Open letter about Government access to their data

IBM wrote the following  few days back

http://asmarterplanet.com/blog/2014/03/open-letter-data.html


Now, Bruce has a few questions for IBM.
As usual he does not disappoint us.




Check it out:
https://www.schneier.com/blog/archives/2014/03/an_open_letter_.html

Who is Hacking who? - I am totally confused.

First Huawei equipments were supposed to have Chinese Bugs

Now, it is supposed to have been hacked by NSA.

So, I am going to simply presume that at any given point of time , one or more of the United Nations member states are  listing and collecting data from device (of their interest).

According to the article:- 

According to new reports over the weekend from The New York Times and Der Spiegel and based on documents leaked by Snowden, the NSA succeeded in penetrating equipment at Huawei headquarters in a plan to monitor communications on the company's networking equipment worldwide.

Among the information cited by newspaper was a 2010 document detailing Shotgiant operations. However, covert operations against Huawei go as far back as 2007, 

U.S. government officials for years have suspected that Chinese networking companies have worked with the PLA. For example, a congressional committee concluded an inquiry in 2012 with members still in doubt about the security of networking equipment from Huawei and ZTE

In addition to selling networking equipment, Huwaei is also the third-largest vendor of smartphones in the world. 

The links below has more information:

http://www.cio.com/article/750143/NSA_hacked_into_servers_at_Huawei_headquarters_reports_say

NSA Fires back - They ( Google, Microsoft and others )knew the government was collecting their user data

I guess this story is not going to end and the claims and denials will continue with carefully worded statements

According to the article:- 

" Data collection under PRISM, he said, was a "compulsory legal process, that any recipient company would receive."

"If you have to go back to court every time you look at the information in your custody, you can imagine that would be quite burdensome," testified Brad Wiegmann, deputy assistant attorney general. 

Google CEO Larry Page echoed those statements, and added, "[W]e had never heard of the broad type of order that Verizon received -- an order that appears to have required them to hand over millions of users' call records."

The links below has more information:

http://news.cnet.com/8301-13578_3-57620600-38/nsa-top-lawyer-says-tech-giants-knew-about-data-collection

Interesting - Ron Miller wonders why NSA can track every email, but it can't find a plane

He has a few valid points:- 

We are led to believe that if we collect enough information -- indeed, if we collect all of the information -- we can see the connections and make the leaps and stop attacks before they happen.

That's what we're told. That's the justification for all this surveillance. And yet if we can't find a jumbo jet after nine days in a world covered by satellite cameras and radar facilities, are we supposed to believe that collecting every one of our emails and listening to every one of our phone calls and following every one of us around as we move through our lives will make us safer?

The links below has more information:


http://www.computerworld.com/s/article/9247007/Ron_Miller_NSA_can_track_every_email_but_it_can_t_find_a_plane?source=rss_latest_content

NATO Attacked - I mean DDoS Attack from pro-Russian Ukrainian hackers

I hope there was no compromise of sensitive data.

I wonder why we have referendums when they can be VETOed. 

According to the article:- 

The attacks came on the eve of Sunday's referendum on whether Ukraine's Crimea region should join Russia. The UN Security Council introduced a resolution declaring the referendum invalid, but Russia vetoed the resolution Saturday

The links below has more information:

http://news.cnet.com/8301-1009_3-57620399-83/ukrainian-hackers-claim-takedown-of-nato-web-sites

Cyberespionage gets interesting - Agent.btz worm may have some cousins circulating the Internet.

I am confident that cyber espionage is going to be one area that is going  to get more intersting and SCARY.

According to the Article:

Agent.btz may have some cousins circulating the Internet, namely the recently-revealed Turla malware - also known as Snake - as well as the infamous Flame, Gauss and Red October malware.

The Agent.btz worm has a long history in cyberattacks. In 2008, it was at the center of an incident eventually dubbed "the most significant breach of U.S. military computers ever" by former Deputy Defense Secretary William J. Lynn III

Turla has also been linked to attacks in the United States, as well as attacks on other countries such as the Ukraine.

The Red October developers must have known about Agent.btz's functionality, as their USB stealer module searches for the worm's data containers. Those containers hold information about infected systems and activity logs.

Both the notorious Flame and Gauss malware use similar naming conventions as Agent.btz, such as '*.ocx' files and 'thumb*.db'.

The following link has more information:

http://www.darkreading.com/attacks-breaches/cyberespionage-worm-may-have-ties-to-mul/240166658