I know a lot of you haven't heard from me for a while - I'm still sorting through and typing up all the INCREDIBLE information I received from the 2014 Maryland Cybersecurity Symposium. However, today I had to take a break from all this, because of current events affecting users on the Internet.
In case you hadn't heard, Microsoft convinced a federal court to seize 22 of No-IP.com's domains, taking down most of No-IP's free subdomains and impacting millions of users. Microsoft's justification was that No-IP.com subdomains are used by malware creators.
According to No-IP, Microsoft's intention was only to "filter out" the bad sub-domains, and continue to serve traffic for the valid ones. However, Microsoft's infrastructure was unable to handle the load, and stopped serving No-IP content completely. Even if Microsoft's infrastructure would have been able to handle the load, the privacy implications for this kind of court order are astounding, and disturbing.
To put this in context, this would be no different from another company convincing a Federal court to seize Outlook.com or Live.com "because spammers and scammers use it to contact victims". Then, monitor every single email address, and make sure it's not being used by a scammer.
Disturbed yet? You should be. Common uses for No-IP include VPN/remote desktop to home systems, monitoring home security systems and IP-cameras, and private game servers. And the only way Microsoft would know for sure if a domain was used by a malware creator would be to inspect the traffic for each and every subdomain. It's no wonder Microsoft's infrastructure wasn't able to handle the load.
Another use which I have personally used No-IP for in the past on multiple occasions is for seeding honeypot URLs. You can see some of the results of my honeypot over at the CaffSec Malware Analysis Lab, including a LOT of previously unknown malware. So, in Microsoft's attempts to make the Internet a safer place, they have seriously hindered my (and most likely others') honeypots ability to collect new malware samples.
Additionally - sometimes it's not always the right step to shutdown a malware command and control center. Sometimes, the better approach is to simply monitor the known command and control center, in order to trace back its origins. Otherwise, when that C&C server is shutdown, investigators lose future sources of intelligence. It is sometimes much more effective to monitor malware creators than play a never-ending game of whack-a-mole with their servers.
So, with that said, who's going to step up to the plate and sieze Microsoft's free email system? I'm sure they won't mind, since they had no problems seizing domains from No-IP.
Showing posts with label Privacy. Show all posts
Showing posts with label Privacy. Show all posts
Crowdfunding RFID Security Research
I've been thinking about doing some research on the security of RFID tags/access cards/etc.
This is the same topic which the Mythbusters have been banned from discussing by the Discovery Channel due toconcerns by the network's advertisers reasons unknown.
RFID is used by retailers for inventory control, building access control, livestock tracking, credit cards, passports, and even medical uses. And yet, there have been very few in-depth security studies of RFID technology.
Unfortunately, RFID equipment isn't cheap, and there are a lot of different RFID tags out there. So, I'm probably going to need to turn to crowdfunding to get the project going.
I've never used crowdfunding, and I'm aware there are a lot of different options. Any suggestions? I'm open to any helpful ideas.
This is the same topic which the Mythbusters have been banned from discussing by the Discovery Channel due to
RFID is used by retailers for inventory control, building access control, livestock tracking, credit cards, passports, and even medical uses. And yet, there have been very few in-depth security studies of RFID technology.
Unfortunately, RFID equipment isn't cheap, and there are a lot of different RFID tags out there. So, I'm probably going to need to turn to crowdfunding to get the project going.
I've never used crowdfunding, and I'm aware there are a lot of different options. Any suggestions? I'm open to any helpful ideas.
What the FBI probably knows about Tor Users
Vlad Tsyrklevich has posted an excellent analysis of the payload delivered by the Tor Browser Bundle exploit.
This payload was delivered to every Tor Browser Bundle user who visited a Freedom Hosting hosted Tor Hidden Service, including Tormail.
According to Vlad, the exploit sends the hostname and MAC address of the local system to 65.222.202.54 over HTTP, then crashes.
So, what can the FBI do with this information?
Well, they now have a record of what systems were visiting all sites on Freedom Hosting.
It is also safe to assume that the FBI now has all emails and logs stored by Tormail.
The Tormail emails can be an excellent datamine without any additional info. Many Tormail users could have possibly revealed sensitive information over Tormail, including their name and home address, especially if using Tor to order illicit goods or services.
However, the hostname and MAC address can also be useful.
For example, the FBI can use the MAC address to subpoena a computer manufacturer to find out who purchased the computer. They can then use the hostname to verify they have the right person.
For example, let's say the FBI got a hostname of "DOE-PC" and a MAC address matching a Dell laptop.
The FBI contacts Dell with a subpoena "Did you sell a computer to someone named Doe with MAC address XX:XX:XX:XX", Dell can send them the transaction information, including home address.
This is a big win for law enforcement worldwide, and should help to end some of the illegal activities occurring on Tor.
Just remember kiddies, there is no such thing as "private" on the Internet. Not even on Tor.
NOTE: You can review the deobfuscated JavaScript at my Malware Analysis Google Code site: https://code.google.com/p/caffsec-malware-analysis/source/browse/trunk/TorFreedomHosting/
This payload was delivered to every Tor Browser Bundle user who visited a Freedom Hosting hosted Tor Hidden Service, including Tormail.
According to Vlad, the exploit sends the hostname and MAC address of the local system to 65.222.202.54 over HTTP, then crashes.
So, what can the FBI do with this information?
Well, they now have a record of what systems were visiting all sites on Freedom Hosting.
It is also safe to assume that the FBI now has all emails and logs stored by Tormail.
The Tormail emails can be an excellent datamine without any additional info. Many Tormail users could have possibly revealed sensitive information over Tormail, including their name and home address, especially if using Tor to order illicit goods or services.
However, the hostname and MAC address can also be useful.
For example, the FBI can use the MAC address to subpoena a computer manufacturer to find out who purchased the computer. They can then use the hostname to verify they have the right person.
For example, let's say the FBI got a hostname of "DOE-PC" and a MAC address matching a Dell laptop.
The FBI contacts Dell with a subpoena "Did you sell a computer to someone named Doe with MAC address XX:XX:XX:XX", Dell can send them the transaction information, including home address.
This is a big win for law enforcement worldwide, and should help to end some of the illegal activities occurring on Tor.
Just remember kiddies, there is no such thing as "private" on the Internet. Not even on Tor.
NOTE: You can review the deobfuscated JavaScript at my Malware Analysis Google Code site: https://code.google.com/p/caffsec-malware-analysis/source/browse/trunk/TorFreedomHosting/
Massive TOR Hidden Service Compromise
It was announced today on Twitter that one of the major "hidden services" hosting companies, has been delivering malicious content and the hosted sites shutdown after a raid by law enforcement.
Supposed, among the compromised services include "TorMail", which provides anonymized email services.
If TorMail has been compromised, this could have broader reaching effects, including giving the FBI and Interpol the ability to directly access associated accounts outside of Tor hidden services. It would then be easy for the authorities to request from associated websites a log of associated IP addresses.
This spells bad news for anyone who uses Tor for illegal purposes, and a major win for the law enforcement community.
NOTE: You can view deobfuscated versions of the malicious code at my Malware Analysis Google Code site: https://code.google.com/p/caffsec-malware-analysis/source/browse/trunk/TorFreedomHosting/
Supposed, among the compromised services include "TorMail", which provides anonymized email services.
If TorMail has been compromised, this could have broader reaching effects, including giving the FBI and Interpol the ability to directly access associated accounts outside of Tor hidden services. It would then be easy for the authorities to request from associated websites a log of associated IP addresses.
This spells bad news for anyone who uses Tor for illegal purposes, and a major win for the law enforcement community.
NOTE: You can view deobfuscated versions of the malicious code at my Malware Analysis Google Code site: https://code.google.com/p/caffsec-malware-analysis/source/browse/trunk/TorFreedomHosting/
Snapchat Covert Screen Capture for Android Revealed
 |
| Capture of a SnapChat image. |
At a family gathering today, a relative introduced me to SnapChat, and showed me how it only temporarily stores images, then deletes them when you're finished looking at them.
For those who don't know SnapChat is a "temporary" image service. The concept is simple - images are sent, viewed, and destroyed within 10 seconds. If a user attempts to take a screenshot of the image, the sender is sent a notification. I tested the "screenshot detection" and sure enough...if you take a screenshot with your Android phone it really does send a notification!
It was recently revealed that there is a method of capturing SnapChat images for iOS without the sender knowing by accessing the files directly on the device's storage drive. But this only works on iPhone or iPod Touch.
Always up for a challenge, I decided to see if I could bypass SnapChat's "temporary" storage and save a permanent copy of photos I receive.
After performing some analysis of how SnapChat works, today I'm going to reveal how to permanently save incoming SnapChat photos on any Android phone.
Android phones have a feature called "USB Debugging" which is commonly only used by tech savvy users or developers. This feature allows you to connect your Android phone to your computer and monitor its activities using the Android SDK.
One of the features of the Android SDK is, you guessed it, a screen capture utility.
By simply following these instructions from AddictiveTips.com you can capture the current screen without alerting the SnapChat app. Simply time clicking the "Refresh" button just right and you'll be able to capture that "secret" photo.
Note that this is not a flaw in the SnapChat app - this is the intentional design of the Android operating system.
This is a "high tech" method of defeating SnapChat. A "low tech" undetectable method would be to simply take a picture of you phone's screen using a camera from another device.
So what should users take away from this? A simple security lesson - if you don't want someone to be able to save something you send them, and don't want to risk that knowledge or picture from being posted publicly, then don't send it to anyone in the first place.
Default Facebook Privacy Settings Randomly Not Working
It has come to my attention that the default Facebook privacy settings are not properly functioning at seemingly random times. Unfortunately you have no idea the settings aren't working correctly until after you post something...
Despite my default setting of "Friends Only", I've noticed multiple posts being available to everyone, as indicated by the globe icon below.
It may be worth checking your old posts to see who has access to them. You may be surprised to find some of your posts were set to public.
I have posted about this issue on Facebook's support page, but expect little response.
One possible workaround to this issue is to go into your Facebook Privacy Settings, change your post privacy to public, then back to Friends Only. This appears to have corrected the issue for me, for now.
If anyone else has encountered this issue, I encourage you to post a comment, and if you managed to fix it or not.
Despite my default setting of "Friends Only", I've noticed multiple posts being available to everyone, as indicated by the globe icon below.
It may be worth checking your old posts to see who has access to them. You may be surprised to find some of your posts were set to public.
I have posted about this issue on Facebook's support page, but expect little response.
One possible workaround to this issue is to go into your Facebook Privacy Settings, change your post privacy to public, then back to Friends Only. This appears to have corrected the issue for me, for now.
If anyone else has encountered this issue, I encourage you to post a comment, and if you managed to fix it or not.
Facebook Location Sharing Enabled by Default - Another Threat to your Privacy and Safety
I noticed something disturbing today. Ever since about the 15th of March (noticed this on some of my Friends posts going back to the 13th), my Facebook posts have started including my location. That's pretty disturbing, because I never enabled Facebook to share my location. It would seem Facebook has enabled this setting by default.In fact, if I wanted everyone to know where I am, I would have typed my location in my Facebook post.
This really becomes problematic if I were to use Facebook while on vacation. Suddenly my posts will tell everyone I'm not home, and depending on my privacy settings, that's pretty much telling the world "hey, he's on vacation, go steal stuff from his house!".
I've noticed most of my friends posts are including this information as well.
Facebook does provide instructions on disabling location sharing (https://www.facebook.com/about/location) but it's not very clear if these settings stick.
I urge you the next time you post on Facebook, check to see if there is a small gray box below your post which includes your approximate location. If there is, click the X inside that box to disable location sharing.
Share this message with your friends and family on Facebook, and help them be safe online too!
Monitoring for Leaked Company Documents through Google Alerts
This article is part of a series on using Google Alerts to protect you, your family, and your company through early notification of data breaches and leaks.
Previous Articles:
Misuse of Your Personal Information and Google Alerts
Monitoring for New Zero Day Exploits through Google Alerts
If you're following good security practices, all of your internal company documents are properly labeled with important labels such as "Company Proprietary", "Company Sensitive" or "Do Not Distribute".
In fact your company has probably established a standardized header for use on all sensitive documents.
So, when's the last time you performed a Google search for this header?
When's the last time you searched to see what documents are being exposed to the web hosted on your domain?
The results might surprise you.
The Google Hacking Database has some excellent information on how to use Google to find sensitive files. It's very easy to use some of the search queries there, add your company name or standard header, and see what happens.
In fact, even if you find no results, it would be a great idea to setup Google Alerts to monitor for documents posted (accidentally or otherwise) which appear to be internal company documents.
Here's an example, which should produce results for (hopefully!) intentionally posted documents:
Beware: Many hackers already know these tricks, and will use them to perform reconnaissance on your company before initiating an attack. Even the most mundane documents, such as a list of email addresses and phone numbers, could be used to assist in launching a spear phishing (targeted phishing) attack against your company.
Previous Articles:
Misuse of Your Personal Information and Google Alerts
Monitoring for New Zero Day Exploits through Google Alerts
If you're following good security practices, all of your internal company documents are properly labeled with important labels such as "Company Proprietary", "Company Sensitive" or "Do Not Distribute".
In fact your company has probably established a standardized header for use on all sensitive documents.
So, when's the last time you performed a Google search for this header?
When's the last time you searched to see what documents are being exposed to the web hosted on your domain?
The results might surprise you.
The Google Hacking Database has some excellent information on how to use Google to find sensitive files. It's very easy to use some of the search queries there, add your company name or standard header, and see what happens.
In fact, even if you find no results, it would be a great idea to setup Google Alerts to monitor for documents posted (accidentally or otherwise) which appear to be internal company documents.
Here's an example, which should produce results for (hopefully!) intentionally posted documents:
site:blogspot.com filetype:doc OR filetype:xls OR filetype:pdfThe above query will return common office documents which are hosted on blogspot.com, or any subdomains. Replace blogspot.com with your main domain, and see what results you find.
Beware: Many hackers already know these tricks, and will use them to perform reconnaissance on your company before initiating an attack. Even the most mundane documents, such as a list of email addresses and phone numbers, could be used to assist in launching a spear phishing (targeted phishing) attack against your company.
Protect Insider Data By Googling First, Often
Dark Reading has an excellent article called "Protect Insider Data By Googling First, Often". The summary of the article states:
Sensitive company data is often leaked via Google, Bing, and other search engines -- find it before the bad guys canSound advice, and excellent example of why it's important to setup Google Alerts to monitor for privacy breaches, as I described in a previous post.
Anonymous: Friend or Foe?
Is Anonymous a force for good, or just another threat online? This video has been posted in response to the Stratfor hacking incident.
Protect Your Family While Using Social Media
Cyberbullying and sexual predators are an ever increasing threat online, especially with social media sites like Facebook. See how to protect your children with this great informational video!
The (VERY) Unofficial Guide To Facebook Privacy
To fully understand the privacy of Facebook and how it's likely to evolve, you need to understand one thing...Facebook executives want everyone to be public.
As the service evolves, executives tend to favor our open access to information, meaning information you think is private will slowly become public, but that doesn't mean you can be private if you want to. Facebook gives its users the option to lock things down, but users need to be aware of their controls, how to use them and how to prepare for future Facebook privacy changes. Facebook has not and will not make information obvious, and that's where this guide comes in.
Get your copy today!
And please share this link with your friends and family, so they can better protect their privacy as well!
As the service evolves, executives tend to favor our open access to information, meaning information you think is private will slowly become public, but that doesn't mean you can be private if you want to. Facebook gives its users the option to lock things down, but users need to be aware of their controls, how to use them and how to prepare for future Facebook privacy changes. Facebook has not and will not make information obvious, and that's where this guide comes in.
Get your copy today!
And please share this link with your friends and family, so they can better protect their privacy as well!
Misuse of Your Personal Information and Google Alerts
It's always a good idea to keep tabs on your online presence. This can help prevent embarrassing situations, such as an ex girlfriend posting all your dirty laundry for the world to see, or keep someone from stealing your identity, or using your name or address for fraudulent activities, resulting in the police knocking on YOUR door instead of theirs.
Here is an excellent example...
One of my former co-workers had a rather interesting event happen to him after moving in to his new house... Someone was running a "women's retreat" business from his home address!
He found this out through randomly searching for his own home address using Google.
Apparently someone had setup an entire website for this fake business using the real estate information from his home before purchase.
Luckily, this site did not remain online for long, but things could have become really interesting if someone showed up with suitcases in hand expecting to spend a weekend at the "retreat" they already paid for in full...
A few other situations which could happen...
So how can you protect yourself from these situations?
Here is an excellent example...
One of my former co-workers had a rather interesting event happen to him after moving in to his new house... Someone was running a "women's retreat" business from his home address!
He found this out through randomly searching for his own home address using Google.
Apparently someone had setup an entire website for this fake business using the real estate information from his home before purchase.
Luckily, this site did not remain online for long, but things could have become really interesting if someone showed up with suitcases in hand expecting to spend a weekend at the "retreat" they already paid for in full...
A few other situations which could happen...
- Someone decides to try to rent or sell your house without your knowledge
- Someone posts your address for a "everything for free" event on Craigslist as a cover for looting your house
- A former co-worker or client posts your personal information on an online bulletin board accusing you of something "bad", resulting in harassing phone calls from thousands of complete strangers
- An online group such as Anonymous posts your name and address on bulletin boards to coordinate a "prank SWAT raid"
- Your college or university accidentally publishes a list of student names and social security numbers
So how can you protect yourself from these situations?
See who's trying to hack your Facebook profile!
Many links claim to let you see who's "stalking" you on Facebook. This link claims to let you see who's trying to HACK your Facebook profile!
http://bit.ly/vXjiBw
Were you brought to this blog post by a shortened link on Facebook? Why did you click that?
Haven't we learned yet not to click on strange links?
After all these years, users are STILL being infected with malware and helping to propagate it by clicking on links they shouldn't. (And yes, that link is safe)
URL shorteners such as bit.ly can be very conveniently used to hide malicious links.
Here's a little trick to help keep you safer.
There are actually URL "unshorteners" such as UnFwd4Me and Unshorten.com which will reveal the true address of a shotened URL.
So, now that your security awareness has been raised, please, share this link with others by copying the text below, and help them raise their security awareness as well! To be more effective, please turn the URL preview OFF.
See who's trying to hack your Facebook profile! http://bit.ly/vXjiBw
http://bit.ly/vXjiBw
Were you brought to this blog post by a shortened link on Facebook? Why did you click that?
Haven't we learned yet not to click on strange links?
After all these years, users are STILL being infected with malware and helping to propagate it by clicking on links they shouldn't. (And yes, that link is safe)
URL shorteners such as bit.ly can be very conveniently used to hide malicious links.
Here's a little trick to help keep you safer.
There are actually URL "unshorteners" such as UnFwd4Me and Unshorten.com which will reveal the true address of a shotened URL.
So, now that your security awareness has been raised, please, share this link with others by copying the text below, and help them raise their security awareness as well! To be more effective, please turn the URL preview OFF.
See who's trying to hack your Facebook profile! http://bit.ly/vXjiBw
Related Reading:
Subscribe to:
Posts (Atom)