Archive for 2012/05/28

In 2007, Philippe Vannier, former head of Amesys and current chief executive of Bull, reportedly met with Abdullah Senussi, Libya’s head of intelligence, in Tripoli. A deal was signed that year, and beginning in 2008 Amesys engineers and technicians, many of them former French military personnel, traveled to Libya to set up several data and monitoring centers for the country’s Internal Security service. According to engineers at Libyan Internet provider LTT, two high-bandwidth “mirrors” were installed—one on the country’s main fiber-optic trunk and one inside the DSL switchboard—to copy all Internet traffic and feed it into the Eagle system, which became operational in 2009.

One of the monitoring centers, known as HQ 2, was located on the ground floor of a tan six-story Internal Security building on Sikka Street in Tripoli. The dreaded structure was sometimes called the Heretics House, after the Counter-Heresy Office—Gadhafi’s squad charged with combating Islamists—which was based there. Inside, a sign on an interior door bore the logos of both Amesys and the Libyan government and warned: help keep our classified business secret. don’t discuss classified information out of the hq. Behind it, analysts sat at their terminals and used a web browser to log on to the Eagle system, where they would peruse their latest intercepts or search for new targets to monitor using keywords, phone numbers, or email and IP addresses. The system was capable of collecting email, chat and voice-over-IP conversations, file transfers, and even browsing histories from anyone who used broadband or dialup Internet in Libya. The analysts could call up social-network diagrams for the targets they were hunting, with the links between each suspect showing the frequency and type of communication. Emails of interest were labeled “follow-up” for the security services.

A filing room with shelves of pink folders held thousands of printed-out emails and chat logs, case files with fingerprints and photographs of the targets, and transcripts of phone intercepts faxed to the center. The email intercepts (which are marked “https://eagle/interceptions” at the top, indicating they were printed from the Eagle system) typically contain the IP addresses and port numbers, and sometimes even usernames and passwords. They list everything from mundane conversations about building maintenance to business deals to political discussions among dissidents—a vast catalog of private lives.

In one intercept, a dissident’s search history is described as being “sexual in nature.” In another, dated December 2010, a well-known dissident living in Tripoli, Jamal al-Hajji, writes to a central figure in the then-ongoing Tunisian revolution, Munsif al-Marzouqi, advising him on resistance tactics: “Demonstrations in front of the UN’s offices in French, British, German, and American capitals, in conjunction with hunger strikes, will strengthen the Tunisian street, scare the regime, and limit its assaults.” Later, on January 19, an unnamed woman writes to Hajji, saying, “The revolution will be here very soon, by the will of the people.” At the outbreak of demonstrations in Libya, Hajji would be arrested, tortured, and imprisoned in a tiny cell for seven months.

Amesys, with its Eagle system, was just one of Libya’s partners in repression. A South African firm called VASTech had set up a sophisticated monitoring center in Tripoli that snooped on all inbound and outbound international phone calls, gathering and storing 30 million to 40 million minutes of mobile and landline conversations each month. ZTE Corporation, a Chinese firm whose gear powered much of Libya’s cell phone infrastructure, is believed to have set up a parallel Internet monitoring system for External Security: Photos from the basement of a makeshift surveillance site, obtained from Human Rights Watch, show components of its ZXMT system, comparable to Eagle. American firms likely bear some blame, as well. On February 15, just prior to the revolution, regime officials reportedly met in Barcelona with officials from Narus, a Boeing subsidiary, to discuss Internet-filtering software. And the Human Rights Watch photos also clearly show a manual for a satellite phone monitoring system sold by a subsidiary of L-3 Communications, a defense conglomerate based in New York. (Amesys, VASTech, ZTE and Narus did not respond to multiple interview requests; L-3 declined to comment.)

Much more:

http://www.wired.com/threatlevel/2012/05/ff_libya/all/1

Five years on, John McClane’s security nightmare is not so sci-fi.

Diligence and gritty determination may have helped Eugene Kaspersky become one of the software world’s most successful entrepreneurs, but there’s one thing the antivirus king can’t bear: Die Hard 4.0.

“I watched the movie for 20 minutes, then pressed pause, got a cigarette and a glass of Scotch. To me it was really scary: they were talking about real scenarios. It was like a user guide for cyber terrorists. I hated that movie,” the flamboyant Russian entrepreneur says.


http://www.smh.com.au/it-pro/security-it/be-afraid–die-hard-4-reveals-a-real-threat-20120528-1zeg0.html

See also:



And



We developed breakthrough silicon chip scanning technology to investigate these claims. We chose an American military chip that is highly secure with sophisticated encryption standard, manufactured in China. Our aim was to perform advanced code breaking and to see if there were any unexpected features on the chip. We scanned the silicon chip in an affordable time and found a previously unknown backdoor inserted by the manufacturer.

This backdoor has a key, which we were able to extract. If you use this key you can disable the chip or reprogram it at will, even if locked by the user with their own key. This particular chip is prevalent in many systems from weapons, nuclear power plants to public transport. In other words, this backdoor access could be turned into an advanced Stuxnet weapon to attack potentially millions of systems. The scale and range of possible attacks has huge implications for National Security and public infrastructure.

More:

http://www.cl.cam.ac.uk/~sps32/sec_news.html#Assurance

Dutch language news article:

http://www.security.nl/artikel/41666/1/Onderzoeker_kraakt_telefonisch_banksysteem.html

Presentation slides:

http://conference.hitb.org/hitbsecconf2012ams/materials/D2T2%20-%20Rahul%20Sasi%20-%20CXML%20VXML%20Auditing%20for%20IVR%20Pentesters.zip

An activist interrupted Tony Blair at a media ethics inquiry, breaking in to accuse the former PM of war crimes. But while the man was dragged out of sight, the allegations of unethical behavior will likely trail Blair for some time.

In a quintessentially British way, the activist greeted onlookers with an appeal to excuse him before launching into a tirade in which he shouted “This man [Tony Blair] should be arrested for war crimes!”

Onlookers both snickered and gasped in horror as the activist further accused Blair of “holding up” the Iraqi Central Bank and conducting an unethical relationship with US banking giant JPMorgan Chase.

Being dragged backwards with a security guard’s arm cranking on his neck, the man let out a final shout of “this man is a war criminal!” before being taken to the ground and subdued.

More:

http://www.rt.com/news/blair-testimony-war-criminal-399/

  • Work of Street View cars to be examined over allegations Google used them to download personal details
  • Emails, texts, photos and documents taken from wi-fi networks as cars photographed British roads
  • Engineer who designed software said a privacy lawyer should be consulted
  • Calls for police and Information Commissioner to investigate new evidence

Google is facing an inquiry into claims that it deliberately harvested information from millions of UK home computers.

The Information Commissioner data protection watchdog is expected to examine the work of the internet giant’s Street View cars.

They downloaded emails, text messages, photographs and documents from wi-fi networks as they photographed virtually every British road.

It is two years since Google first admitted stealing fragments of personal data, but claimed it was a ‘mistake’.

Now the full scale of its activities has emerged amid accusations of a cover-up after US regulators found a senior manager was warned as early as 2007 that the information was being captured as its cars trawled the country but did nothing.

Close links between Google and the Conservative Party were on display this weekend at the society wedding of senior Google executive Naomi Gummer. Miss Gummer, a former political secretary to Jeremy Hunt, married Henry Allsopp, 38, in an Oxfordshire ceremony attended by Prime Minister David Cameron and his wife Samantha, as well as the embattled Culture Secretary, who came with his wife and their two young children.

More:


http://www.dailymail.co.uk/news/article-2150606/Google-deliberately-stole-information-executives-covered-years.html

See also:

Google engineer in Street View probe identifies as a Palo Alto hacker Marius Milner

http://vrritti.com/2012/05/02/google-engineer-in-street-view-probe-identifies-as-a-palo-alto-hacker-marius-milner/


http://gizmodo.com/5913746/watching-injections-makes-them-hurt-more

How can we stop people from lying? In fact, that’s exactly what Ariely is working on now. He’s found that reinforcing moral codes—like the ten commandments—while people undertake tasks reduces the amount of lying that goes on.

While that sounds unfeasible in the real world, consider this: one of his recent projects involves moving the signature box on official forms to the top. That means that, when completing paperwork, the first thing people do is read the declaration “I promise that the information I am providing is true.” So far, his experiments show that even this minor tweak can make people lie less. Honest!

Much more:

http://gizmodo.com/5913730/scientific-proof-that-everyone-lies

A teenage girl is counting her grandmother’s savings with her. She posts a picture of the cash on Facebook, and a few hours later, two men arrive at her mother’s house with a knife and a wooden club


http://news.cnet.com/8301-17852_3-57442508-71/girl-posts-facebook-pic-of-cash-robbers-visit-mom/

Russian security firm Kaspersky Labs told the BBC they believed the malware, known as Flame, had been operating since August 2010. The company said it believed the attack was state-sponsored, but could not be sure of its exact origins.

They described Flame as “one of the most complex threats ever discovered”. Research into the attack was carried out in conjunction with the UN’s International Telecommunication Union.

“Once a system is infected, Flame begins a complex set of operations, including sniffing the network traffic, taking screenshots, recording audio conversations, intercepting the keyboard, and so on,” he said.

More than 600 specific targets were hit, Mr Kamluk said, ranging from individuals, businesses, academic institutions and government systems.

Iran’s National Computer Emergency Response Team posted a security alert stating that it believed Flame was responsible for “recent incidents of mass data loss” in the country.

The malware code itself is 20MB in size – making it some 20 times larger than the Stuxnet virus. The researchers said it could take several years to analyse.

More:

http://www.bbc.com/news/technology-18238326

And all of this in a peaceful way. A whole revolution against the powers that have created the current global crisis. This is why there hasn’t been any publicity during the last two years: What would happen if the rest of the EU citizens took this as an example? What would happen if the US citizens took this as an example.

More:

http://americanpatriottoday.net/2012/05/the-revolution-governments-world-wide-dont-want-you-to-know-about/

More:

http://conference.hitb.org/hitbsecconf2012ams/materials/D1T2%20-%20Adam%20Gowdiak%20-%20Security%20Vulnerabilities%20of%20DVB%20Chipsets.pdf

More:

http://conference.hitb.org/hitbsecconf2012ams/materials/D1T2%20-%20Adam%20Gowdiak%20-%20Security%20Threats%20in%20Digital%20Sat%20Televisions.pdf

Much more:

http://conference.hitb.org/hitbsecconf2012ams/materials/D2T1%20-%20Marco%20Balduzzi%20-%20SatanCloud.pdf

iPhone2G
• Brickable if the BL image flashed to NOR crashed due to bad code
• recoverable via original A17 hardware hack (makes BL look empty)

iPhone3G and iPhone3GS
• Brickable if only one of the two bootloader page is empty (normal BL spans two NOR pages)
• In this case, EBL is never given a chance to run
• Looks like unintended side effect (unanticipated condition?)

iPhone4
• Not brickable even with a partially erased or tampered bootloader
• Will just wait for an EBL image to be uploaded mto fix it

iPhone4S
• Not brickable (no persistent bootloader at all!)

More:


http://conference.hitb.org/hitbsecconf2012ams/materials/D1T2%20-%20MuscleNerd%20-%20Evolution%20of%20iPhone%20Baseband%20and%20Unlocks.pdf

See also:

http://conference.hitb.org/hitbsecconf2012ams/materials/

Much more:

http://www.ibtimes.co.uk/articles/346068/20120528/ios-5-1-untethered-jailbreak-sn0wbreeze-iphone.htm

See also:

http://conference.hitb.org/hitbsecconf2012ams/materials/

 

May 24th, 2012

We’re in Amsterdam attending the 2012 edition of the Hack in the Box security conference. It’s a great atmosphere down here, so we have decided to make a video overview of the event to show everyone what’s happening at the Okura hotel.

The day started with Andy Ellis, Akamai’s chief security officer, who held a speech on “Getting ahead of the security poverty line.” He is a great speaker and he has provided some wonderful examples of what companies should and should not do to keep their infrastructure and assets secure.

Ivo Pooters, a senior digital forensics investigator at Fox-IT, had a great presentation on “Turning Android inside out.” It was based on a scenario in which they analyzed a couple of phones involved in a murder. One of them was owned by the victim, “the dead guy,” and the other one by the criminal, “swiftlogic dude.”

There were a lot of other great speakers, including Sebastien Renaud and Kevin Szkudlapski, Itzhak ‘zuk’ Avraham and Nir Goldshlager, Claudio Guarnieri, Didier Stevens, Juan Pablo Echtegoyen, Arnauld Mascret, Gal Diskin, Jurriaan Bremer, and Marinus Kuivenhoven.

The closing keynote was held by Rop Gonggrijp, the well-known hacker and activist, who’s on a mission to convince information security experts to help people stay secure.

We’ve also had a few interviews today. We’ve had the honor of talking to Adam Gowdiak, the founder and CEO of Security Explorations, Roberto Suggi Liverani, principal security consultant at Security-Assesments.com, and Georgia Weidman, founder of Bulb Security LLC.

As many of you may know, this edition of HITB Amsterdam features a world premiere. For the first time ever, the members of the Chronic Dev Team and the iPhone Dev Team got together to present their work.
We’ve had the chance to speak to three of them: Joshua Hill, aka @p0sixninja, Cyril, aka @pod2g, and Nikias Bassen, or @pimskeks. You’ll have an opportunity to see the complete interview in a few days from now, but in the meantime we’ll try to provide you with the highlights of our discussions.

For tomorrow, the Apple jailbreak Dream Team has a big surprise planned, so stay tuned.
Another thing worth mentioning, which you can see in the video below, is that Google has sent its recruiters in search for fresh talent. Considering that there are a lot of great minds present at the event, we wouldn’t be surprised if they found what they were looking for.

In the meantime, check out the video overview of HITB 2012 Amsterdam and the speaker presentations:

Previously:

Hack In The Box Security Conference 2012, 21-25 May, Okura Hotel Amsterdam, The Netherlands

http://vrritti.com/2012/02/08/hack-in-the-box-security-conference-2012-21-25-may-okura-hotel-amsterdam-the-netherlands/


http://conference.hitb.org/hitbsecconf2012ams/pagelist2/draft-agenda/

The provider “chose not to man their abuse desk” and did not respond to the warnings.

Apparently all TalkTalk needed to do to get the ban lifted was reply to Trend Micro’s message, which was sent to their abuse desk at abuse@talktalkplc.com (perhaps it got stuck in their spam filter :)  .. no seriously).

Trend Micro’s Rik Ferguson said:

Once a Realtime Blackhole List (RBL) listing is made, we require the ISP to take effective action to stop the spam. We monitor this action, and if the investigator sees the spam stop, they will remove the listing.

Because there are multiple people involved with checking an RBL listing, it is exceedingly rare that a mistake is made. In each case of an RBL listing, we have spam-on-hand, and can produce that on request for the ISP. The size of the ISP behind any given IP address is not a factor in our decision to list on the RBL; the fact that we have spam from that address, and that there has been no action to reduce the spam, is.

Because the ISP receives at least two notices from us, we feel that they have adequate time to deal with the problem.”

A TalkTalk spokesperson told ISPreview.co.uk:

Some Pipex customers may have had difficulty sending emails to NHS and other government agencies after a number of customers’ computers were infected with malicious software and started sending out spam. We have taken measures to tackle the problem and reduced spam messages by 70 per cent since the start of May.”

More:


http://www.ispreview.co.uk/index.php/2012/05/pipex-email-servers-blacklisted-after-isp-ignored-a-crucial-warning.html

Because free websites + free attractive content makes for some good advertising opportunities. No matter whether those websites – or the content they’re providing access to - are legal or illegal.

That’s why there are so many who want the media and the public to believe that website blocking does not work.

In order to make that point, they start by arguing that website blocking is a useless remedy, since it does not address all possible instances of content piracy, and circumvention may still be possible.

But that’s beside the point. Big Content may not even be looking to eradicate 100% the piracy problem, much like Big Data is not looking to eradicate 100% of the botnet, spam, malware‘bad’ apps or illegal advertising problem.

It’s about limiting damages…limiting costs due to piracy or other illegal activities online. Technical solutions for online illegallity need to be able to at least achieve that goal.

And it turns out that even badly implemented site blocking remedies are able to achieve that, much like partially successful spam filtering campaigns.

Now imagine if ISPs and other online service providers would be able to make money by fighting piracy. Maybe that would cause even better technological remedies to pop up all of a sudden, not only addressing a significant part of the problem, but perhaps even the majority of it.

Only time will tell…

For the time being we’ll have to keep up with large quantities of propaganda that aims to leave attractive online clusters of (illegal) content intact for as much and as long as possible…

Of course this is hardly a surprise. In companies with thousands of employees there will always be people who use BitTorrent for illicit purposes. And in tech companies it’s probably even more common.

Microsoft is in good company also.

Previously we were able to show that unauthorized downloads occur even in the most unexpected of places, from the palace of the French President, via the Church of God, to the RIAA and the US House of Representatives.

Much more:

http://torrentfreak.com/busted-microsoft-harbors-bittorrent-pirates-120527/

I have 13,157 songs, in 57.58GB, in iTunes. In my home I keep all of this music on a network drive, and use Sonos to stream my music throughout the home. This works great when I’m home, but what about when I’m traveling or just out and about? Enter iTunes Match.


http://www.zdnet.com/blog/mobile-gadgeteer/itunes-match-is-a-hidden-gem-for-your-music-listening-pleasure/5759

Anarchists in Britain “don’t want rich tourists,” they want “civil war.” As the London Olympics draw nearer, those flying the black flag are going for gold in sabotage.

On the eve of the Olympic Games, the Federazione Anarchica Informale (FAI) seems fired up by unprecedented security measures being taken by British police. The British cell of the Italian anarchist group finds the “escalating police state frankly offensive.

In line with their ideological convictions, the Games set for July are viewed as a rightful cause to act.

We have no inhibition to use guerrilla activity to hurt the national image and paralyze the economy however we can. Because simply, we don’t want rich tourists – we want civil war,” reads a statement on their website.

More:

http://www.rt.com/news/uk-anarchists-police-olympics-340/

Much more:

http://news.cnet.com/8301-13579_3-57442283-37/a-glimpse-inside-foxconns-iphone-plant/