Facebook riddled by 'my first ever status message' scam app

Friday, January 7, 2011

A new survey scam has hoodwinked thousands on Facebook.

Users are being induced into filling out a worthless survey on the false promise of a dubious reward - a reminder of their first ever status message on the social networking website. These false promises appear as status messages from already fooled surfers, touting a rogue application.

Surfers who install the application grant it account privileges thus allowing it to post from a user's account, a facility used to spam followers of a compromised account with spam come-ons, continuing the infection cycle.

Users who fall victim to the scam are taken to survey websites. Each completed survey gains the time-wasters behind the scam a commission. If previous experience is anything to go by, users might also be induced to sign-up to premium rate text message services of dubious utility.

Net security firm Sophos reports that the first supposed first status message offered by the rogue application is in itself false, simply consisting of a random message with an arbitrary date stamp.

The ruse is the latest in a series of survey scams linked to rogue applications that have become endemic on Facebook over recent months. Previous examples have included a dodgy web application that supposedly allows users to "unlike" something, among various other ruses. The latest scam is noteworthy not because of its basic premise, which is unoriginal, but because it has spread widely in a short period of time since first appearing on Thursday.

Google battles Derby cops over access to Street View data

Google has turned the boys in blue red with rage by refusing to hand over private data without a court order.

Police want to trace a vehicle snapped by Google's Street View cameras next to a caravan that was stolen shortly afterwards.

The thief struck in June 2009, while the Soanes family, from Linton, Derbyshire, were out. The police investigation stalled until March 2010, when 11-year-old Reuben found the family home on Street View and saw and the unidentified 4x4 and its driver had been captured on the driveway.

A public appeal for information was issued in November, using the the publicly available version of the photograph, in which the number plate of the 4x4 is automatically blurred by Google to comply with privacy laws. At the same time police asked for the non-anonymised version, but were rebuffed.

It apparently drew no leads, and now Derbyshire Police are pressing Google to release the image without the inconvenience of obtaining a court order.

Investigators have roped in local Tory MP Heather Wheeler to put pressure on the search giant to bend its rules.

"I am disappointed that Google's initial reaction is to refuse," she told the Derby Telegraph.

"It would be sensible for them to enter into a protocol with British police forces to receive and acquiesce to police requests. Of course, the police can get a court order but what a waste of public money in order to do that."

Google remains unmoved however.

"It's very important to Google and our users that we only provide information if valid process is followed, as laid down by governments in law," it said in a statement.

"We have a team specifically trained to evaluate and respond to requests when they are received, and we will of course co-operate with police requests as long as they are legally valid and follow the correct processes."

The rules on when authorities require court backing to obtain private data vary. Most notably for a company such as Google, under the Regulation of Investigatory Powers Act, intelligence agencies and police can obtain communications data records of who communicated with whom, when, where and how, but not of what was said without routine outside scrutiny.

No such special legislation exists to ease access to Street View-type data.

Mac App Store giving away pay apps for free

Security oversights mean that many of the applications in Apple's newly launched Mac App Store can easily be obtained without payment.

A significant number of developers have disregarded Apple's advice on validating App Store receipts before making their software available through the store. As a result, many applications can be pirated.

Applications bought through the store can be modified to run by any Apple user (not just restricted to a specific Apple ID, prompting users to log into an account associated with a sale) without any further purchase. The omitted App Store receipt technology would have prevented this.

Popular application Angry Birds, for example, only checks for a valid receipt (of any type) and not whether this is a receipt for a purchase of this software tied to a specified account. A receipt from any legitimate Mac App Store download - including applications that come free of charge will allow a bootleg download of Angry Birds to run, as explained here.

As things stand, some Mac App Store developers are potentially out of pocket while Apple misses out on its percentage from legitimate software sales. The App Store, launched along with the publication of OS X 10.6.6, provides a portal for the sale of desktop Mac applications. Customers benefit because it restricts the number of firms with which they are obliged to share their payment details.

The snafu also raises concerns that applications modified to include back doors might be uploaded to the App Store.

"Some applications downloaded from the App Store can easily be modified to include any sort of executable code you wish," warns Sophos security consultant Chester Wisniewski. "It wouldn't surprise me to see a surge in markets for pirated applications that might just be booby-trapped to include unexpected surprises."

Zero-day backdoors to be left unplugged on Patch Tuesday

Microsoft plans to release two updates one critical as part of the next edition of its Patch Tuesday security bulletin cycle on 11 January.

The critical vulnerability affects all supported versions of Windows (including Windows 7 and 2008R2) while the less serious fix is particular to a flaw that's restricted to Windows Vista. The light patch batch omits fixes for two recently discovered zero-day vulnerabilities in Windows, separate bugs in Windows Graphics Rendering Engine and an earlier Internet Explorer flaw.

Microsoft has issued mitigation advice covering both flaws, each of which has been the subject of targeted attacks, pending the availability of more comprehensive fixes.

Wolfgang Kandek, CTO of patch management firm Qualys, said that the security community is also discussing two additional vulnerabilities in Internet Explorer. Proof of concept code for these flaws validates concerns that each is genuine. "We expect Microsoft to acknowledge them soon," Kandek said.

The security veteran concludes that, all things considered, it is probable that the bulletins due on Tuesday will not be the only security fixes from Microsoft this month. Microsoft periodically releases out-of-band fixes, normally after a vulnerability either is widely exploited or the subject of targeted attacks against important customers, such as government agencies.

No need to pay for antivirus: report

Free security software is "adequate".

Computers are safer than security firms would have us think, according to a report from Which? Computing.

The consumer rights group has published a report claiming free antivirus is good enough to keep most users safe online, as long as they exercise their common sense.

Which? set up five computers with a variety of protection, between wholly unprotected and fully secured with the latest, paid for antivirus and firewall.

Over a month, the PCs were used to visit a variety of webpages, from reputable ones such as Amazon to malware-riddled bit-torrent sites. None of the machines became infected.

Which? said that result shows people need not be so afraid when surfing online. The group's own survey found 62% of those polled were worried about internet security, with 49% refusing to bank online because of it. A third won't shop online, while a quarter avoid social networking to stay safe.

Which? editor Sarah Kidner said the security industry had perhaps been too successful with its “strong message about security threats”.

“It’s like anything: you need to exercise due care, but there’s no reason why you shouldn’t be enjoying a rich online experience,” she said.

While the consumer group admitted it only takes one successful attack to take out a computer or a user's data, it said keeping software updated, using basic free antivirus, and common sense was "adequate protection".

Symantec said it agreed with the report's finding that software protection is necessary, whether it's paid-for or free, but added its own paid-for Norton products out-perform free versions in independent testing. "Paid products generally offer consumers enhanced efficiencies and performance," a spokesperson told PC Pro.

Tony Anscombe from AVG agreed. “The difference between a paid antivirus solution and a free one is typically the features that are included," he told PC Pro. "In the case of AVG, both solutions offer the same malware detection engine, but the [paid-for] Suite product offers an integrated approach to securing the machine with additional features like a firewall and anti-spam."

He added that more advanced users would be comfortable heading to online forums when trouble strikes, but less savvy computer owners might prefer the professional support that comes with most paid-for antivirus.

Which? admitted that commercial versions did perform better in their tests, but believed most people didn't need perfect protection.

“We actually did a test... and the paid for security software comes out better than the free stuff, but [free] Microsoft Security Essentials scored very healthily," Kidner said. “People don’t need to pay for it when there’s an equally adequate free solution out there.”

This article originally appeared at pcpro.co.uk

Copyright © PC Pro, Dennis Publishing


Researcher breaks security sandbox in Adobe Flash

A security researcher has found a way to bypass a measure in Adobe's Flash Player that's designed to harden it against hack attacks.

Billy Rios, a Google researcher who published the method on his personal website, said it circumvents the local-with-filesystem sandbox, which is supposed to prevent Flash files loaded locally from passing data to remote systems.

By design, the so-called SWF files are locked in perimeter that can't communicate with the outside world. That's intended to thwart malicious Flash content that would otherwise locate sensitive user data and send it to machines controlled by attackers.

Rios found that the measure can be circumvented using a file:// request to a network machine. After snatching sensitive data, an attacker can simply pass it along using the GET protocol to an address such as file://\\192.168.1.1. That works on local area networks. To pass information to remote servers on the internet, attackers can use various protocol handlers that haven't been blacklisted by Adobe developers.

One such protocol is the mhtml handler, which is available on Windows and can be used without any prompts.

Using the mhtml protocol handler, it's easy to bypass the Flash sandbox, Rios wrote.

Well, sort of.

An Adobe spokeswoman issued a statement that read:

An attacker would first need to gain access to the user's system to place a malicious SWF file in a directory on the local machine before being able to trick the user into launching an application that can run the SWF file natively. In the majority of use scenarios, the malicious SWF file could not simply be launched by double-clicking on it; the user would have to manually open the file from within the application itself.

The company's security team has rated the bug moderate.

Feds Charge Two for Allegedly Exploiting Bug in Video Poker Machines

Federal prosecutors this week leveled conspiracy charges against two men who allegedly used an exploit against a line of video poker machines to win hundreds of thousands of dollars in unearned jackpots.

John Kane, 52, of Las Vegas, and Andre Nestor, 39, of western Pennsylvania, allegedly pulled the caper in Las Vegas casinos over six weeks in the Spring of 2009. According to a criminal complaint filed in Las Vegas (.pdf) on Monday, the men would make small bets over and over again until finally winning a hand, then use a special button sequence to change the credits to a higher denomination and “access the previous winning hand of cards”, triggering a jackpot.

It was Kane who first learned of the exploit, and after testing it, contacted his friend Nestor in Pennsylvania and told him to come to Vegas, the complaint alleges.

A separate state case accused Nestor of pulling the same hack at the Meadows Racetrack and Casino near Pittsburgh, Pennsylvania, where he allegedly won over $400,000. He was about to begin a trial on those charges on Monday. Instead, the FBI intervened to arrest him in the new federal case in Las Vegas.

Before he was hauled away from the Pennsylvania courthouse, Nestor (pictured above)told WTAE-TV that what he did was the equivalent of counting cards in blackjack — he’d found a way to get an edge on the house, and, naturally, exploited it.

“I’m being arrested federally for winning on a slot machine,” he said, in apparent amazement. “It’s just like if someone taught you how to count cards, which we all know is not illegal. You know. Someone told me that there are machines that had programming that gave a player an advantage over the house. And that’s all there is to it Who would not win as much money as they could on a machine that says, ‘Jackpot’? That’s the whole idea!”

The men were part of a ring of at least four lucky gamers, according to local news reports. Posing as high-rollers at the casinos, they often had to persuade the casino staff to open up the machines and activate the “Double Up” option — a prerequisite to exploiting the bug, the Las Vegas Review Journal reports.

The game was reportedly the Draw Poker machine made by Reno-based International Game Technology. The two defendants are accused of conspiracy to commit computer fraud.


Police Publish Images of Two Sought in Codebreakers Death

In an effort to identify two people who may be connected to the mysterious death of a top British codebreaker, authorities have published images of a man and woman who entered his apartment building weeks before his death.

Gareth Williams, 31, was found dead and naked in a North Face duffel bag in the bathtub of his flat last August. The sports bag was padlocked on the outside.

The two, said to be in their twenties and of Mediterranean appearance, were let in to Williams’ building by another tenant in late June or July. They told the tenant they had keys to Williams’s flat but indicated they knew him as Pier Paolo.

Williams, described by those who knew him as a math genius, worked for the UK’s Government Communications Headquarters (GCHQ) helping to break coded Taliban communications, among other things. He was just completing a year-long stint with MI6, Britains secret intelligence service, when he died. The flat in which he lived was part of a network of flats registered to an offshore front company and rented out to GCHQ workers.

Williams had been dead for at least a week when his body was found. His mobile phone and a number of SIM cards were laid out on a table near the body, according to news reports. There were no signs of forced entry to the apartment and no signs of a struggle. The keys to the padlock on the duffel bag were found inside the bag beneath Williams’ body.

The codebreaker reportedly had made repeated visits to the U.S. to meet with the National Security Agency and worked closely with British and U.S. spy agencies to intercept and examine communications that passed between an al Qaeda official in Pakistan and three men who were convicted last year of plotting to bomb transcontinental flights.

Investigators havent ruled out the possibility that Williams was killed over something related to his work but believe his death may have been related to his personal life. Investigators believe Pier Paolo was an alias Williams may have used that was borrowed from Pier Paolo Pasolini, a controversial Italian filmmaker who made films that included sexual violence. According to recent reports, Williams had accessed five bondage web sites prior to his death.

Williams flew up to four times a year to the U.S. to the NSAs headquarters at Fort Meade HQ, according to the British paper the Mirror. His uncle, Michael Hughes, told the paper that Williams would mysteriously disappear for three or four weeks.

The trips were very hush-hush, Hughes said. They were so secret that I only recently found out about them and were a very close family. It had become part of his job in the past few years. His last trip out there was a few weeks ago, but he was regularly back and forth.

Williams was said to have worked with the NSA on e-mails intercepted between Abdullah Ahmed Ali and Assad Sarwar and Rashid Rauf, a British national in Pakistan who was allegedly director of European operations for al Qaeda. The e-mails, intercepted by the NSA in 2006, allegedly contained coded messages.

The NSA shared the e-mails with British prosecutors but wouldnt allow them to use the evidence in an early trial of the suspects out of fear of tipping off Rauf that he was under surveillance. It was only after Rauf was reportedly killed in a U.S. drone attack that the NSA allowed prosecutors to use the e-mails to convict the other suspects. Its never been known whether the NSA intercepted the messages overseas or siphoned them as they passed through internet nodes on U.S. soil as part of the NSAs controversial and unconstitutional warrantless wiretapping program.

An unidentified Western intelligence source told the Mirror that Williams job would have had him participating in crucial high-level meetings with American intelligence officers. His job would have been crucial to the security of the UK and our interests abroad and also to America and Europe. Although not particularly high up the GCHQ ladder, the importance of his role should not be underestimated. The man was a mathematical genius.

His landlady, Jenny Elliott, told the Telegraph, Occasionally you could hear tapes whirring from his flat, which must have been audio cassettes he used for work, but he never told me what they were.


iPhone-wielding chumps rush to give data to phish sites

Mobile users are three times more likely to respond to phishing scams than their PC-using counterparts, according to stats prised from fraudulent websites.

An analysis of logs from several phishing websites by transaction security firm Trusteer revealed that not only were they among the first visitors to arrive at a phishing website (an important factor since most scam websites are short-lived), but they were three times more likely to submit their login credentials than desktop PC users.

Trusteer also found that eight times more iPhone users than BlackBerry users visited dodgy websites.

Mobile users are "always online" and therefore more likely to read and respond to email messages soon after they arrive. Most fraudulent emails that form the basis of phishing scams pose as messages from a bank's security team or similar so its therefore no great surprise that anyone taken in by this ruse would act quickly. This rapid response is a huge benefit to scammers since their sites are typically either taken down or blocked by phasing filters within a matter of hours.

Users of mobile phone who arrive at dodgy websites are far more likely to submit their login credentials than their desktop counterparts because it's harder to spot a phishing website on a mobile device than on a computer, according to Trusteer.

This difference is particularly marked on iPhones, which display only the beginning of the URL of a potentially fraudulent site. BlackBerries, by comparison, display the full URL as well as asking if a user wants to visit a site. However, Trusteer concludes it is equally difficult to spot phishing websites on BlackBerry and iPhone devices.

BlackBerries are as commonly used in the US, for example, as iPhones; but BlackBerries are more commonly issued by corporates and by business users, who are perhaps more likely to be savvy about the general possibility of phishing threats. More importantly, perhaps, they are more likely to be protected by corporate spam filters so that scam emails never reach their inbox.

More details of Trusteer's analysis can be found in a blog post here.

Disappearing filth leads to dropped charges in extreme smut case

The stumbling progress of extreme porn case law continues with Newcastle magistrates dropping a charge of possessing a single image of extreme porn because local police and prosecution appear to have lost the evidence.

Not only is this embarrassing, but anyone out and about in the Newcastle area who happens across the dodgy material is strongly advised not to pick it up and hand it in: possession is a strict liability offence and there is no guarantee that the hander-in would not themselves be prosecuted.

A spokeswoman for the CPS told us: "When we made the original decision [to charge], the image was provided to us on disc. The defence requested details of where the image was on the computer and when the computer was checked, the image was no longer there. In light of that, we felt we could no longer go ahead with the case."

For further information, they advised us to speak to Northumbria Police, who re-assuringly told us: "Every effort will be made to ensure something like this doesn't happen again in future".

South African wireless traffic lights pillaged by SIM-card thieves

The Johannesburg Road Agency is in talks with suppliers to try and stop thieves targeting its shiny new traffic lights for the SIM cards they contain.

The Agency has been forking out thousands of rand on phone calls the thieves subsequently make using the snaffled SIMs.

Thulani Makhubela, spokesman for the JRA, said: The JRA has been severely affected with this crime and this now means we have to fork out more money on something that we should not have spent a cent on.

Makubela said the agency was now cancelling the SIMs stolen from the GPRS units inside some of the traffic lights and working with Johannesburg police to stop the traffic light thefts. Ordinary lights have not been targeted by the gangs although there were some thefts of traffic light poles last year for their scrap value.

The spokesman said the JRA was also in talks with suppliers to make the lights' components more secure.

He told the Guardian the attacks were "systematic and co-ordinated" and thieves knew which lights to attack and "clearly have information".

Four hundred out of 600 SIM-equipped traffic lights have been hit in the last three months and it will cost R8.8m (838,000) to replace missing components and repair them.

Anonymous takes on Tunisian Government

Thursday, January 6, 2011

Fighting against "oppression".

Hacking group Anonymous has turned its attention to Tunisia and appears to have had success in taking down the Government’s official website.

At the current time, the www.tunisia.gov.tn site is not loading following a call from Anonymous to help Tunisians break free of what the group called “oppression.”

“This is a warning to the Tunisian government: attacks at the freedom of speech and information of its citizens will not be tolerated,” a statement from Anonymous on AnonNews read.

“It's on the hands of the Tunisian government to stop this situation. Free the net, and attacks will cease, keep on that attitude and this will just be the beginning.”

The new campaign comes hot on the heels of another Anonymous call to launch strikes against Zimbabwean websites. Again, human rights issues were the focus of the hacktivists’ ire.

Operation Zimbabwe included distributed denial of service (DDoS) attacks against various websites, including those of the Zimbabwe African National Union - Patriotic Front (ZANU-PF) and the Finance Ministry.

Anonymous said it had taken all news content from the Finance Ministry's site offline, replacing it with the following message: "We are Anonymous. We are Legion. We do not forgive. We do not forget. Expect us."

A person speaking on behalf of Anonymous said: “We are targeting Mugabe and his regime in the ZanuPF who have outlawed the free press and threaten to sue anyone publishing WikiLeaks.”

The Anonymous group became famous in 2010 for its work against organisations that dropped support for WikiLeaks, in particular MasterCard and PayPal.

 

This article originally appeared at itpro.co.uk

Copyright © ITPro, Dennis Publishing


Spam volumes shrink over festive season

Spam volumes have witnessed a dramatic drop of more than 50 per cent since Christmas.

Global junk mail volumes have reached their lowest level since the November 2008 shutdown of rogue ISP McColo, Symantec's net filtering business MessageLabs reports.

MessageLabs attributes the drop to a production break from the Rustock, Lethic and Xarvester botnets. Rustock has all but shut down while the fiendish hackers behind the Lethic and Xarvester have also gone quiet.

By contrast, two other significant sources of spam - Gheg and Cutwail - are pumping out junk mail at much the same volumes as ever, as a graph from MessageLabs explains.

MessageLabs reckons the drop is unlikely to be anything more than a temporary respite from the (almost) relentless torrent of nuisance email messages touting penis pills, "investment opportunities", smut and other assorted tat.

Mathew Nisbet, a malware data analyst at MessageLabs Symantec, writes: "At present we don't know why these botnets have stopped spamming, perhaps the botnet herders have decided they need a holiday too?

"Whilst this is an excellent gift over the holiday season for anyone who regularlyuses email, we would not expect the level of spam to stay this low for long."

WikiLeaks Assange Threatened Lawsuit Over Leaked Diplomatic Cables

Just weeks prior to unveiling a giant cache of leaked U.S. State Department cables, WikiLeaks founder Julian Assange threatened to sue the Guardian newspaper in Britain over publication of the documents, according to a fascinating Vanity Fair article published Thursday that explores in detail the often rocky relationship between WikiLeaks and the newspapers with which it partnered last year.

After receiving the database of a quarter-million cables from Assange under embargo last August, the Guardian obtained a second copy of the database via a WikiLeaks insider without conditions — which led the newspaper to conclude it was no longer bound by a signed agreement with Assange that it wouldn’t publish the documents until he gave the go-ahead.

Assange, suddenly faced with having lost control of documents that WikiLeaks itself had received from a source, asserted that he owned the information and had a financial interest in how and when it was released, the magazine reports.

Assange was pallid and sweaty, his thin frame racked by a cough that had been plaguing him for weeks. He was also angry, and his message was simple: he would sue the newspaper if it went ahead and published stories based on the quarter of a million documents that he had handed over to The Guardian just three months earlier. . . . Assanges position was rife with ironies. An unwavering advocate of full, unfettered disclosure of primary-source material, Assange was now seeking to keep highly sensitive information from reaching a broader audience. He had become the victim of his own methods: someone at WikiLeaks, where there was no shortage of disgruntled volunteers, had leaked the last big segment of the documents, and they ended up at The Guardian in such a way that the paper was released from its previous agreement with Assangethat The Guardian would publish its stories only when Assange gave his permission. Enraged that he had lost control, Assange unleashed his threat, arguing that he owned the information and had a financial interest in how and when it was released.

A marathon negotiation ensued between Assange and the Guardian. Some at the Guardian wanted to sever their relationship with Assange entirely, but the two sides managed to reach an uneasy agreement. However, the already precarious relationship never fully recovered from this and other bones of contention, according to writer Sarah Ellison, who also wrote the book War at the Wall Street Journal.

Ellison spoke with editors of the Guardian and the New York Times for her Vanity Fair story, as well as with WikiLeaks insiders to compile a look at how the unprecedented media partnership progressed. [Vanity Fair and Wired.com are both owned by Cond Nast.]

The relationship began when Guardian investigative reporter Nick Davies tracked Assange down last June, about two months after WikiLeaks had published its first significant leak - a classified video showing a U.S. helicopter shooting and killing civilians in Iraq — and shortly after the arrest of suspected leaker Pfc. Bradley Manning. Davies sought out Assange to propose a partnership with the Guardian to publish other documents Assange might possess. He asked Assange for a description of what kinds of documents he had in his cache.

Assange replied, in his slow baritone, I have a record of every single episode involving the U.S. military in Afghanistan for the last seven years. Davies said, Holy Moly!” Indeed, Assange went on, he had more than that: I have a record of every single episode involving the U.S. military in Iraq since March 2003. Assange also made reference to a third cache of documentsdiplomatic cablesand to a fourth cache, containing the personal files of all prisoners who had been held at Guantnamo.

The last reference — the personal files of all prisoners who had been held at Guantnamo” — potentially explains once-puzzling statements made by Manning in his May 2010 chats with Adrian Lamo, the ex-hacker who turned him in.

Detainees walk around the exercise yard in Camp 4, the medium security facility within Camp Delta at Naval Station Guantanamo Bay, Cuba. (Photo: Department of Defense)

Manning told Lamo that his leaks to WikiLeaks included something he called the Gitmo Papers and “the JTF GTMO papers” — references to Guantnamo. He didnt specify the nature of the documents, and Lamo appeared to assume Manning was referencing two Guantnamo operation manuals WikiLeaks famously published in 2007.

But those 2007 leaks occurred years before the time Manning claimed to have begun providing material to WikiLeaks. Assange’s statements describing a new and more significant Guantnamo leak could explain what Manning meant by the offhand comments — that he’d leaked the files of Guantnamo prisoners. At the height of its operation, the Guantnamo facility held more than 700 prisoners.

The Vanity Fair article is silent on any plans to publish the Guantnamo files, so it’s not clear if the Guardian brokered a deal with WikiLeaks to publish them, or if WikiLeaks has any plans to release the documents with other media partners or on its own.

Once Assange and Davies came to agreement over the other documents Assange mentioned in their discussion, Assange passed Davies a password he could use to get at the initial trove, the magazine reports.

They agreed that they wouldnt talk about the project on cell phones. They agreed that, in two days, Assange would send Davies an e-mail with the address of a website that hadnt previously existed, and that would exist for only an hour or two. Assange took a paper napkin with the hotels name and logo and circled various words. At the top he wrote, no spaces. By linking the words together, Davies had his password.

It didn’t take long after this exchange for cracks in the relationship to appear, not only between Assange and the media outlets in general but between Assange and Davies personally. The two have both said publicly that they had a fallout and no longer speak to each other, but have never explained the nature of it.

According to Ellison, the dispute involved the first cache of documents the media partners published from a database of some 90,000 events from the Afghan war. The Guardian, the New York Times and Der Speigel all agreed with WikiLeaks they would begin to publish their stories on Sunday, July 25. But on July 24, Davies discovered that Assange had also passed the entire Afghan database to UKs Channel 4 television network without consulting the newspapers.

Davies was livid, Ellison writes. Assange got on the phone and explained, falsely, according to Davies, that it was always part of the agreement that I would introduce television at this stage. Davies and Assange have not spoken since that afternoon.

The article clears up one other issue as well, regarding public statements Assange made about the diplomatic cables he possessed. The timing of events chronicled in the piece makes clear that while Assange was publicly denying having them, he was privately making plans to publish them with WikiLeaks’ media partners.

Last June, when Threat Level broke the news that Manning had discussed leaking 260,000 U.S. State Department cables to WikiLeaks, the organization issued a denial the same day on Twitter:

Allegations in Wired that we have been sent 260,000 classified US embassy cables are, as far as we can tell, incorrect, Assange or someone else connected to the group wrote. The group also tweeted: “If Brad Manning, 22, is the ‘Collateral Murder’ & Garani massacre whistleblower then, without doubt, he’s a national hero.”

Assange repeated the denial at the TEDGlobal conference in Britain in July, after he had already told Davies privately that he possessed a cache of diplomatic cables. When asked by TED curator Chris Anderson (not related to Wired Magazine Editor-in-Chief Chris Anderson) if he possessed the cables (Anderson mistakenly said 280,000 cables instead of 260,000), Assange replied, Well, we have denied receiving those cables.”

Anderson then started to say, “if you did receive thousands of U.S. embassy diplomatic cables …,” when Assange jumped in and replied, We would have released them.

WikiLeaks has since acknowledged it has 251,287 U.S. State Department cables. The organization began to publish them in November with its media partners.

Photo: Julian Assange
Lily Mihalik/Wired.com

See also:

  • Report: Federal Grand Jury Considering Charges Against WikiLeaks Assange
  • Unpublished Iraq War Logs Trigger Internal WikiLeaks Revolt
  • Newspapers Reveal Diplomatic Cables Provided By WikiLeaks
  • Suspected Wikileaks Source Described Crisis of Conscience Leading to Leaks
  • U.S. Intelligence Analyst Arrested in Wikileaks Video Probe

NoTW editor suspended as phone-hacking stink persists

The News of the World has suspended an assistant editor over claims he authorised the voicemail hacking of phones used by actress Sienna Miller and her friends.

Ian Edmondson, the tabloid's assistant editor, faces an internal inquiry over allegations of phone hacking in 2005, dating from the time was edited by Andy Coulson, the prime minister's director of communications. Disgraced former royal editor Clive Goodman and private investigator Glenn Mulcaire were jailed back in 2005 after they pleaded guilty to hacking into the mobile phones of royal aides and intercepting voicemail messages in the hunt for celebrity gossip.

News Group has consistently maintained since that the pair acted alone and without the authorisation or knowledge of senior staff at the paper. But the company's assertions of innocence have come under increased pressure, first from a series of lawsuits stemming from the original allegations, and later from dogged investigative work by The Guardian that resulted in the re-opening of a parliamentary inquiry last year.

Privacy lawsuits by celebrities and public figures whose phones were allegedly tapped by Mulcaire include football players' union boss Gordon Taylor, Sienna Miller and others. Court papers obtained as part of the legal disclosure process in the ongoing Miller lawsuit include papers police seized from Mulcaire in August 2006 include "handwritten notes that imply Edmondson instructed him to intercept Miller's voicemail", The Guardian reports. The mobile phone of Jude Law, Miller's partner at the time, was also the target of interception along with those of Miller's personal assistant and others.

Edmondson was hired by Coulson, a factor that increases the pressure on the PM's chief spin doctor. The internal investigation against Edmondson also raises awkward questions about why the police only ever targeted Goodman and Mulcaire when seized papers and mobile phone records obtained during their investigation provided evidence that others might have been involved in mobile phone hacking.

Sophos warns over fake MS update worm

Spammers target users with bogus attachment.

Security firm Sophos is warning Windows users to beware of a fake security update scam that installs a worm in target machines.

The attack arrives in the form of a spam email that appears to come from Microsoft, warning users to update their operating system.

Anyone opening the email is advised to follow instructions, which involve installing the attached KB453396-ENU.zip file.

Microsoft never sends out such emails, instead using its own update system, but Sophos believes the scam could fool some users because it looks official.

“In the current example, they've spammed out an email containing a worm, which even quotes the real name of a senior member of Microsoft's security team - Steve Lipner - to try to fool you into believing it is genuine,” the company said on its Naked Security blog.

The emails have a subject line of "Update your Windows".

This article originally appeared at pcpro.co.uk

Copyright © PC Pro, Dennis Publishing


Assange 'threatened to sue' Grauniad over leak of WikiLeak

Julian Assange threatened to sue The Guardian last year when he learned it planned to publish stories based on leaked US diplomatic cables without his permission, it's claimed today.

The Wikileaks founder's gripe: That the paper had obtained the documents it intended to use not via him, but from a leaker within his organisation.

In November, Assange stormed into the office of editor Alan Rusbridger with lawyer in tow, a new Vanity Fair article says. The Australian had previously had the newspaper sign an undertaking that no stories based on the cables would be published until he gave the go-ahead.

However, The Guardian has subsequently obtained a second copy of the 1.6GB cache of 250,000 documents (only a few hundred have been published to date) via Heather Brooke*, a freelance journalist with contacts inside Wikileaks. The newspaper believed this separate, "unofficial" source released it from any confidentiality covenants with Assange.

He disagreed. According to Vanity Fair he was "enraged that he had lost control... arguing that he owned the information and had a financial interest in how and when it was released".

Assange was eventually calmed by the promise of a short delay to allow him to brief French and Spanish newpapers that the release was imminent, plus "a great deal of coffee followed by a great deal of wine".

"Much to come on the Wikileaks story," Brooke wrote on Twitter this morning. "Vanity Fair article is just the tip."

Like Assange, and his former colleague Daniel Domscheit-Berg, who left Wikileaks last year criticising his leadership, Brooke is preparing a book covering the organisation's year in the spotlight.

Nevertheless, today's story casts new light on the breakdown of relations between Wikileaks and The Guardian, the newspaper associated most closely with its mega-releases of intelligence reports from Afghanistan and Iraq, and the US diplomatic cables. The antipathy was first exposed before Christmas, when Assange complained to other newspapers about how his erstwhile primary media partner had reported on a leaked document relating to the sex charges he faces in Sweden.

It has been widely noted that both disputes suggest Assange has a rather a weak grasp of irony.

Nick Davies, the journalist who obtained the Swedish file, and brokered the original deal between Wikileaks and The Guardian, fell out with Assange long before his legal threat, Vanity Fair also reports. The pair have not spoken since late July, it's claimed, after Assange told Davies he had given the Afghan files to Channel 4, which the latter believed broke their exclusivity agreement.

Davies has since accused Assange and his lawyers of issuing misleading statements over the sex allegations against him. The Wikileaker-in-chief is due in court next Tuesday for the preliminary hearing in Sweden's attempt to extradite him over the sex allegations made against him by two women.

Body of murdered cyberwar expert found in landfill

The body of a decorated US Army officer was found dumped in a Delaware landfill on New Years Eve day, a few days after he expressed concern that the nation wasn't adequately prepared for cyber warfare, according to news reports following the bizarre whodunit.

Events surrounding the murder of John P. Wheeler III, who most recently worked part-time for defense contractor Mitre Corporation on cyber defense topics, read like a Tom Clancy novel. The 66-year-old worked for three Republican administrations, was special assistant to the Secretary of the Air Force, served in the office of the Secretary of Defense, and penned a manual on the effectiveness of biological and chemical weapons, which urged US forces to show restraint.

The day after Christmas five days before his body was found as it was being dumped from a trash truck into the Cherry Island Landfill in Wilmington Wheeler sent longtime friend Richard Radez an email expressing concern that the US wasn't sufficiently prepared for cyber warfare, according to The Associated Press.

This was something that had preoccupied him over the last couple of years, Radez told the news organization.

Wheeler's focus on computer warfare, and his ties to Mitre, have already attracted conspiracy theories involving the military industrial complex, but there are plenty of other intriguing details that don't immediately fit into such a plot.

Among them are revelations that Wheeler was seen on December 29 and 30 in a confused and disoriented state in downtown Wilmington. During that last appearance, which occurred some 14 hours before his body was discovered, he was wandering inside an office building a few blocks from an attorney who was handling a contentious lawsuit Wheeler filed to stop neighbors from building a home near his. He refused help from several people who approached him.

A day earlier, he approached a parking garage attendant wearing a black suit with no tie and only one shoe, according to the AP report. He carried the missing shoe in his hand and wore no overcoat, despite the frigid temperature. He told the attendant he had been robbed of his briefcase and said repeatedly he wasn't drunk.

To further the intrigue, Delaware police have reportedly found evidence that Wheeler may have been involved in an attempted arson on the same neighbors he was suing. The attempted arson on December 28 came after someone tossed several smoke bombs used for rodent control into the neighbors' house, scorching the floors.

What's more, the AP has reported that yellow police evidence tape was seen surrounding two wooden chairs in Wheeler's kitchen, where several wooden floorboards were missing, even though Delaware police have said the victim's home is not considered a crime scene. A neighbor, according to Examiner.com, said Wheeler's television blared continuously in the days preceding his death.

Those details, combined with the fact that someone went to considerable effort to hide Wheeler's body in a trash dumpster in nearby Newark, Delaware, would suggest the homicide wasn't a random mugging.

The FBI has offered technical assistance to the Delaware police, and judging from the facts as they are so far know, they're going to need it.

Women Sue Over Secret Camera in Tanning Salon

Two Pennsylvania women are suing the owner of a tanning salon for invasion of privacy after discovering videos of themselves disrobing on online porn sites.

The lawsuits, filed in Westmoreland County court in Pennsylvania, alleges that there was a camera in the ceiling of the salon that captured numerous videos of women disrobing at the Sunkissed Tanning and Spa salon in Mount Pleasant, Pennsylvania, according to Courthouse News.

Jessica Kaylor alleges that sometime in 2006, she was secretly recorded as she disrobed to get into the tanning bed. But Kaylor only discovered the videos online on adult websites in 2010.

Kaylor alleges that the owner, Toni Tomei, neglected to make sure the facility wasn’t bugged, and that authorities had previously investigated similar complaints.

“As a direct result of the aforesaid conduct of defendant[...], plaintiff has been, and in future, will be, subject to great humiliation, embarrassment and shame,” (.pdf) according to the complaint.

An attempt to reach Sunkissed Tanning and Spa by phone was unsuccessful.

The suits seeks punitive damages.

Copy of the lawsuit courtesy Courthouse News

See Also:
  • Russias Hookers-and-Hidden-Cameras Unit Strikes Again
  • Art Exhibit Chronicles History of Photographic Intrusion
  • Spy Tech: Hidden Camera Detector for the Paranoid
  • Narcos Want Purse-Cams and Other Spy Gear for Panama Ops
  • Walmart Sued Over Surveillance Camera in Bathroom
  • Cheap Plastic Box Detects Cameras and Spy Wi-Fi

Disappearing filth leads to dropped charges in extreme smut case

The stumbling progress of extreme porn case law continues with Newcastle magistrates dropping a charge of possessing a single image of extreme porn because local police and prosecution appear to have lost the evidence.

Not only is this embarrassing, but anyone out and about in the Newcastle area who happens across the dodgy material is strongly advised not to pick it up and hand it in: possession is a strict liability offence and there is no guarantee that the hander-in would not themselves be prosecuted.

A spokeswoman for the CPS told us: "When we made the original decision [to charge], the image was provided to us on disc. The defence requested details of where the image was on the computer and when the computer was checked, the image was no longer there. In light of that, we felt we could no longer go ahead with the case."

For further information, they advised us to speak to Northumbria Police, who re-assuringly told us: "Every effort will be made to ensure something like this doesn't happen again in future".

Assange 'threatened to sue' Grauniad over leak of WikiLeak

Julian Assange threatened to sue The Guardian last year when he learned it planned to publish stories based on leaked US diplomatic cables without his permission, it's claimed today.

The Wikileaks founder's gripe: That the paper had obtained the documents it intended to use not via him, but from a leaker within his organisation.

In November, Assange stormed into the office of editor Alan Rusbridger with lawyer in tow, a new Vanity Fair article says. The Australian had previously had the newspaper sign an undertaking that no stories based on the cables would be published until he gave the go-ahead.

However, The Guardian has subsequently obtained a second copy of the 1.6GB cache of 250,000 documents (only a few hundred have been published to date) via Heather Brooke*, a freelance journalist with contacts inside Wikileaks. The newspaper believed this separate, "unofficial" source released it from any confidentiality covenants with Assange.

He disagreed. According to Vanity Fair he was "enraged that he had lost control... arguing that he owned the information and had a financial interest in how and when it was released".

Assange was eventually calmed by the promise of a short delay to allow him to brief French and Spanish newpapers that the release was imminent, plus "a great deal of coffee followed by a great deal of wine".

"Much to come on the Wikileaks story," Brooke wrote on Twitter this morning. "Vanity Fair article is just the tip."

Like Assange, and his former colleague Daniel Domscheit-Berg, who left Wikileaks last year criticising his leadership, Brooke is preparing a book covering the organisation's year in the spotlight.

Nevertheless, today's story casts new light on the breakdown of relations between Wikileaks and The Guardian, the newspaper associated most closely with its mega-releases of intelligence reports from Afghanistan and Iraq, and the US diplomatic cables. The antipathy was first exposed before Christmas, when Assange complained to other newspapers about how his erstwhile primary media partner had reported on a leaked document relating to the sex charges he faces in Sweden.

It has been widely noted that both disputes suggest Assange has a rather a weak grasp of irony.

Nick Davies, the journalist who obtained the Swedish file, and brokered the original deal between Wikileaks and The Guardian, fell out with Assange long before his legal threat, Vanity Fair also reports. The pair have not spoken since late July, it's claimed, after Assange told Davies he had given the Afghan files to Channel 4, which the latter believed broke their exclusivity agreement.

Davies has since accused Assange and his lawyers of issuing misleading statements over the sex allegations against him. The Wikileaker-in-chief is due in court next Tuesday for the preliminary hearing in Sweden's attempt to extradite him over the sex allegations made against him by two women.

NoTW editor suspended as phone-hacking stink persists

The News of the World has suspended an assistant editor over claims he authorised the voicemail hacking of phones used by actress Sienna Miller and her friends.

Ian Edmondson, the tabloid's assistant editor, faces an internal inquiry over allegations of phone hacking in 2005, dating from the time was edited by Andy Coulson, the prime minister's director of communications. Disgraced former royal editor Clive Goodman and private investigator Glenn Mulcaire were jailed back in 2005 after they pleaded guilty to hacking into the mobile phones of royal aides and intercepting voicemail messages in the hunt for celebrity gossip.

News Group has consistently maintained since that the pair acted alone and without the authorisation or knowledge of senior staff at the paper. But the company's assertions of innocence have come under increased pressure, first from a series of lawsuits stemming from the original allegations, and later from dogged investigative work by The Guardian that resulted in the re-opening of a parliamentary inquiry last year.

Privacy lawsuits by celebrities and public figures whose phones were allegedly tapped by Mulcaire include football players' union boss Gordon Taylor, Sienna Miller and others. Court papers obtained as part of the legal disclosure process in the ongoing Miller lawsuit include papers police seized from Mulcaire in August 2006 include "handwritten notes that imply Edmondson instructed him to intercept Miller's voicemail", The Guardian reports. The mobile phone of Jude Law, Miller's partner at the time, was also the target of interception along with those of Miller's personal assistant and others.

Edmondson was hired by Coulson, a factor that increases the pressure on the PM's chief spin doctor. The internal investigation against Edmondson also raises awkward questions about why the police only ever targeted Goodman and Mulcaire when seized papers and mobile phone records obtained during their investigation provided evidence that others might have been involved in mobile phone hacking.

Spam volumes shrink over festive season

Spam volumes have witnessed a dramatic drop of more than 50 per cent since Christmas.

Global junk mail volumes have reached their lowest level since the November 2008 shutdown of rogue ISP McColo, Symantec's net filtering business MessageLabs reports.

MessageLabs attributes the drop to a production break from the Rustock, Lethic and Xarvester botnets. Rustock has all but shut down while the fiendish hackers behind the Lethic and Xarvester have also gone quiet.

By contrast, two other significant sources of spam - Gheg and Cutwail - are pumping out junk mail at much the same volumes as ever, as a graph from MessageLabs explains.

MessageLabs reckons the drop is unlikely to be anything more than a temporary respite from the (almost) relentless torrent of nuisance email messages touting penis pills, "investment opportunities", smut and other assorted tat.

Mathew Nisbet, a malware data analyst at MessageLabs Symantec, writes: "At present we don't know why these botnets have stopped spamming, perhaps the botnet herders have decided they need a holiday too?

"Whilst this is an excellent gift over the holiday season for anyone who regularlyuses email, we would not expect the level of spam to stay this low for long."

WikiLeaks Assange Threatened Lawsuit Over Leaked Diplomatic Cables

Just weeks prior to unveiling a giant cache of leaked U.S. State Department cables, WikiLeaks founder Julian Assange threatened to sue the Guardian newspaper in Britain over publication of the documents, as the relationship between the secret-spilling site and its media partners spun out of control, according to a fascinating Vanity Fair article published Thursday that explores in detail the often rocky relationship between WikiLeaks and the newspapers with which it partnered last year.

After receiving the database of a quarter-million cables from Assange under embargo last August, the Guardian obtained a second copy of the database via a WikiLeaks insider without conditions — which led the newspaper to conclude it was no longer bound by a signed agreement with Assange that it wouldn’t publish the documents until he gave the go-ahead.

Assange, suddenly faced with having lost control of documents that WikiLeaks itself had received from a source, asserted that he owned the information and had a financial interest in how and when it was released, the magazine reports.

Assange was pallid and sweaty, his thin frame racked by a cough that had been plaguing him for weeks. He was also angry, and his message was simple: he would sue the newspaper if it went ahead and published stories based on the quarter of a million documents that he had handed over to The Guardian just three months earlier. . . . Assanges position was rife with ironies. An unwavering advocate of full, unfettered disclosure of primary-source material, Assange was now seeking to keep highly sensitive information from reaching a broader audience. He had become the victim of his own methods: someone at WikiLeaks, where there was no shortage of disgruntled volunteers, had leaked the last big segment of the documents, and they ended up at The Guardian in such a way that the paper was released from its previous agreement with Assangethat The Guardian would publish its stories only when Assange gave his permission. Enraged that he had lost control, Assange unleashed his threat, arguing that he owned the information and had a financial interest in how and when it was released.

A marathon negotiation ensued between Assange and the Guardian. Some at the Guardian wanted to sever their relationship with Assange entirely, but the two sides managed to reach an uneasy agreement. However, the already precarious relationship never fully recovered from this and other bones of contention, according to writer Sarah Ellison, who also wrote the book War at the Wall Street Journal.

Ellison spoke with editors of the Guardian and the New York Times for her Vanity Fair story, as well as with WikiLeaks insiders to compile a look at how the unprecedented media partnership progressed. [Vanity Fair and Wired.com are both owned by Cond Nast.]

The relationship began when Guardian investigative reporter Nick Davies tracked Assange down last June, about two months after WikiLeaks had published its first significant leak - a classified video showing a U.S. helicopter shooting and killing civilians in Iraq — and shortly after the arrest of suspected leaker Pfc. Bradley Manning. Davies sought out Assange to propose a partnership with the Guardian to publish other documents Assange might possess. He asked Assange for a description of what kinds of documents he had in his cache.

Assange replied, in his slow baritone, I have a record of every single episode involving the U.S. military in Afghanistan for the last seven years. Davies said, Holy Moly!” Indeed, Assange went on, he had more than that: I have a record of every single episode involving the U.S. military in Iraq since March 2003. Assange also made reference to a third cache of documentsdiplomatic cablesand to a fourth cache, containing the personal files of all prisoners who had been held at Guantnamo.

The last reference — the personal files of all prisoners who had been held at Guantnamo” — potentially explains once-puzzling statements made by Manning in his May 2010 chats with Adrian Lamo, the ex-hacker who turned him in.

Manning told Lamo that his leaks to WikiLeaks included something he called the Gitmo Papers and “the JTF GTMO papers” — references to Guantnamo. He didnt specify the nature of the documents, and Lamo appeared to assume Manning was referencing two Guantnamo operation manuals WikiLeaks famously published in 2007.

But those leaks occurred well before the time when Manning claimed to have begun leaking. Assange’s statements describing a new and more significant Guantnamo leak could explain what Manning meant by the offhand comments — that he’d leaked the files of Guantnamo prisoners. At the height of its operation, the Guantnamo facility held more than 700 prisoners.

The Vanity Fair article is silent on any plans to publish the Guantnamo files, so it’s not clear if the Guardian brokered a deal with WikiLeaks to publish them, or if WikiLeaks has any plans to release the documents with other media partners or on its own.


Once Assange and Davies came to agreement over the other documents Assange mentioned in their discussion, Assange passed Davies a password he could use to get at the initial trove, the magazine reports.

They agreed that they wouldnt talk about the project on cell phones. They agreed that, in two days, Assange would send Davies an e-mail with the address of a website that hadnt previously existed, and that would exist for only an hour or two. Assange took a paper napkin with the hotels name and logo and circled various words. At the top he wrote, no spaces. By linking the words together, Davies had his password.

It didn’t take long after this exchange for cracks in the relationship to appear, not only between Assange and the media outlets in general but between Assange and Davies personally. The two have both said publicly that they had a fallout and no longer speak to each other, but have never explained the nature of it.

According to Ellison, the dispute involved the first cache of documents the media partners published from a database of some 90,000 events from the Afghan war. The Guardian, the New York Times and Der Speigel all agreed with WikiLeaks they would begin to publish their stories on Sunday, July 25. But on July 24, Davies discovered that Assange had also passed the entire Afghan database to UKs Channel 4 television network without consulting the newspapers.

Davies was livid, Ellison writes. Assange got on the phone and explained, falsely, according to Davies, that it was always part of the agreement that I would introduce television at this stage. Davies and Assange have not spoken since that afternoon.

The article clears up one other issue as well, regarding public statements Assange made about the diplomatic cables he possessed. The timing of events chronicled in the piece makes clear that while Assange was publicly denying having them, he was privately making plans to publish them with WikiLeaks’ media partners.

Last June, when Threat Level broke the news that Manning had discussed leaking 260,000 U.S. State Department cables to WikiLeaks, the organization denied it the same day on Twitter:

Allegations in Wired that we have been sent 260,000 classified US embassy cables are, as far as we can tell, incorrect, Assange or someone else connected to the group wrote. The group also tweeted: “If Brad Manning, 22, is the ‘Collateral Murder’ & Garani massacre whistleblower then, without doubt, he’s a national hero.”

Assange repeated the denial at the TEDGlobal conference in Britain in July, after he had already told Davies privately that he possessed a cache of diplomatic cables. When asked by TED curator Chris Anderson (not related to Wired Magazine Editor-in-Chief Chris Anderson) if he possessed the cables (Anderson mistakenly said 280,000 cables instead of 260,000), Assange replied, Well, we have denied receiving those cables.”

Anderson then started to say, “if you did receive thousands of U.S. embassy diplomatic cables …,” when Assange jumped in and replied, We would have released them.

It has since been established that WikiLeaks has 251,287 U.S. State Department cables. The organization began to publish them in November with its media partners.

Photo: Julian Assange
Lily Mihalik/Wired.com

See also:

  • Report: Federal Grand Jury Considering Charges Against WikiLeaks Assange
  • Unpublished Iraq War Logs Trigger Internal WikiLeaks Revolt
  • Newspapers Reveal Diplomatic Cables Provided By WikiLeaks
  • Suspected Wikileaks Source Described Crisis of Conscience Leading to Leaks
  • U.S. Intelligence Analyst Arrested in Wikileaks Video Probe

Anonymous takes on Tunisian Government

Fighting against "oppression".

Hacking group Anonymous has turned its attention to Tunisia and appears to have had success in taking down the Government’s official website.

At the current time, the www.tunisia.gov.tn site is not loading following a call from Anonymous to help Tunisians break free of what the group called “oppression.”

“This is a warning to the Tunisian government: attacks at the freedom of speech and information of its citizens will not be tolerated,” a statement from Anonymous on AnonNews read.

“It's on the hands of the Tunisian government to stop this situation. Free the net, and attacks will cease, keep on that attitude and this will just be the beginning.”

The new campaign comes hot on the heels of another Anonymous call to launch strikes against Zimbabwean websites. Again, human rights issues were the focus of the hacktivists’ ire.

Operation Zimbabwe included distributed denial of service (DDoS) attacks against various websites, including those of the Zimbabwe African National Union - Patriotic Front (ZANU-PF) and the Finance Ministry.

Anonymous said it had taken all news content from the Finance Ministry's site offline, replacing it with the following message: "We are Anonymous. We are Legion. We do not forgive. We do not forget. Expect us."

A person speaking on behalf of Anonymous said: “We are targeting Mugabe and his regime in the ZanuPF who have outlawed the free press and threaten to sue anyone publishing WikiLeaks.”

The Anonymous group became famous in 2010 for its work against organisations that dropped support for WikiLeaks, in particular MasterCard and PayPal.

 

This article originally appeared at itpro.co.uk

Copyright © ITPro, Dennis Publishing


Sophos warns over fake MS update worm

Spammers target users with bogus attachment.

Security firm Sophos is warning Windows users to beware of a fake security update scam that installs a worm in target machines.

The attack arrives in the form of a spam email that appears to come from Microsoft, warning users to update their operating system.

Anyone opening the email is advised to follow instructions, which involve installing the attached KB453396-ENU.zip file.

Microsoft never sends out such emails, instead using its own update system, but Sophos believes the scam could fool some users because it looks official.

“In the current example, they've spammed out an email containing a worm, which even quotes the real name of a senior member of Microsoft's security team - Steve Lipner - to try to fool you into believing it is genuine,” the company said on its Naked Security blog.

The emails have a subject line of "Update your Windows".

This article originally appeared at pcpro.co.uk

Copyright © PC Pro, Dennis Publishing


Body of murdered cyberwar expert found in landfill

The body of a decorated US Army officer was found dumped in a Delaware landfill on New Years Eve day, a few days after he expressed concern that the nation wasn't adequately prepared for cyber warfare, according to news reports following the bizarre whodunit.

Events surrounding the murder of John P. Wheeler III, who most recently worked part-time for defense contractor Mitre Corporation on cyber defense topics, read like a Tom Clancy novel. The 66-year-old worked for three Republican administrations, was special assistant to the Secretary of the Air Force, served in the office of the Secretary of Defense, and penned a manual on the effectiveness of biological and chemical weapons, which urged US forces to show restraint.

The day after Christmas five days before his body was found as it was being dumped from a trash truck into the Cherry Island Landfill in Wilmington Wheeler sent longtime friend Richard Radez an email expressing concern that the US wasn't sufficiently prepared for cyber warfare, according to The Associated Press.

This was something that had preoccupied him over the last couple of years, Radez told the news organization.

Wheeler's focus on computer warfare, and his ties to Mitre, have already attracted conspiracy theories involving the military industrial complex, but there are plenty of other intriguing details that don't immediately fit into such a plot.

Among them are revelations that Wheeler was seen on December 29 and 30 in a confused and disoriented state in downtown Wilmington. During that last appearance, which occurred some 14 hours before his body was discovered, he was wandering inside an office building a few blocks from an attorney who was handling a contentious lawsuit Wheeler filed to stop neighbors from building a home near his. He refused help from several people who approached him.

A day earlier, he approached a parking garage attendant wearing a black suit with no tie and only one shoe, according to the AP report. He carried the missing shoe in his hand and wore no overcoat, despite the frigid temperature. He told the attendant he had been robbed of his briefcase and said repeatedly he wasn't drunk.

To further the intrigue, Delaware police have reportedly found evidence that Wheeler may have been involved in an attempted arson on the same neighbors he was suing. The attempted arson on December 28 came after someone tossed several smoke bombs used for rodent control into the neighbors' house, scorching the floors.

What's more, the AP has reported that yellow police evidence tape was seen surrounding two wooden chairs in Wheeler's kitchen, where several wooden floorboards were missing, even though Delaware police have said the victim's home is not considered a crime scene. A neighbor, according to Examiner.com, said Wheeler's television blared continuously in the days preceding his death.

Those details, combined with the fact that someone went to considerable effort to hide Wheeler's body in a trash dumpster in nearby Newark, Delaware, would suggest the homicide wasn't a random mugging.

The FBI has offered technical assistance to the Delaware police, and judging from the facts as they are so far know, they're going to need it.

Women Sue Over Secret Camera in Tanning Salon

Two Pennsylvania women are suing the owner of a tanning salon for invasion of privacy after discovering videos of themselves disrobing available on online porn sites.

The lawsuits, filed in Westmoreland County court in Pennsylvania, alleges that there was a camera in the ceiling of the salon that captured numerous videos of women disrobing at the Sunkissed Tanning and Spa salon in Mount Pleasant, Pennsylvania, according to Courthouse News.

Jessica Kaylor alleges that sometime in 2006, she was secretly recorded as she disrobed to get into the tanning bed. But Kaylor only discovered the videos online on numerous adult websites in 2010.

Kaylor alleges that the owner, Toni Tomei, neglected to make sure the facility wasn’t bugged, and that authorities had previously investigated similiar complaints.

“As a direct resoult of the aforesaid conduct of defendant[...], plaintiff has been, and in future, will be, subject to great humiliation, embarassment and shame,” according to the complaint (.pdf).

An attempt to reach Sunkissed Tanning and Spa by phone was unsuccessful.

The suits seeks punitive damages.

Copy of the lawsuit courtesy Courthouse News

See Also:
  • Russias Hookers-and-Hidden-Cameras Unit Strikes Again
  • Art Exhibit Chronicles History of Photographic Intrusion
  • Spy Tech: Hidden Camera Detector for the Paranoid
  • Narcos Want Purse-Cams and Other Spy Gear for Panama Ops
  • Walmart Sued Over Surveillance Camera in Bathroom
  • Cheap Plastic Box Detects Cameras and Spy Wi-Fi

Dubai assassins used email trojan to track Hamas victim

Wednesday, January 5, 2011

The successful operation to kill a Hamas commander in Dubai in January 2009 followed a botched attempt by the same Israeli hit squad to kill the same target two months previously, according to reports.

Assassins tried to poison Mahmud al-Mabhouh in Dubai in November 2008, but even though the unknown poison was administered it proved only debilitating and not fatal. al-Mabhouh recovered from what he thought was an illness only to be killed two months later, according to a new investigation by investigative journalist Ronen Bergman published in GQ magazine.

The basic scenario behind the successful hit is well known, but Bergman fleshes out a number of details and adds information about an earlier failed attempt on the Hamas commander's life.

Suspected members of the hit squad, numbering more than 27, gained entry to the UAE in January 2009 using forged passports. A dozen of these passports were older UK passports without biometric chips, which were standard issue before 2006. Other suspected hit squad members used Irish, French, German or Australian travel documents.

The team knew of al-Mabhouhs movement partly because they had bugged his computer with a Trojan horse that allowed them to monitor his email. Although they knew he was travelling to Dubai they did not know which hotel he was staying at, necessitating the use of a team to trail him to the Al Bustan Rotana Hotel. Other hit squad members staked out hotels al-Mabhouh had used in previous trips to the UAE.

While al-Mabhouh met with Iranian armed forces representatives to discuss the shipments of weapons to Hamas, members of the hit squad reprogrammed the lock of his door allowing them to enter his room and lie in wait. Crucially, this was carried out so that al-Mabhouhs electronic key continued to work.

Once he returned al-Mabhouh was killed by suffocation, following the injection of a muscle relaxant.

However, the assassins made a number of mistakes that blew their cover and left them unable to carry out further missions. For example, two agents were caught on surveillance camera entering and leaving a toilet in order to apply disguises.

In general, the assassins chronically underestimated the competency of Dubai police or the extent to which their movements were monitored by surveillance camera, a factor that allowed Dubai police to quickly identify the suspects and issue their photographs. Dubai police were also able to cross-reference a list of people who had arrived and left the country around the time of the murder, cross-referencing this with entries around the times of al-Mabhouhs previous visits, to draw up a shortlist of suspects.

A video of the alleged assassins, as captured on surveillance tapes can be found via Wired here.

Police discovered that members of the hit squad were communicating via a private switchboard in Austria. Call records from this line of inquiry as well, as the use of pre-paid debit cards from US-based company Payoneer, allowed UAE police to firmly identify suspects and issue stop and detain notices via Interpol.

Passport pictures from the suspects were subsequently published in newspapers around the world as well as kept on international police databases, a factor that means members of the team are unlikely to be able to participate in any assassinations in future.

The misuse of Western passports by the hit squad sparked a huge diplomatic row in the UK and elsewhere. One Israeli diplomat was expelled from London. The British government also sought assurances from Israel that its identity documents would not be abused again.

Wired reports that Meir Dagan, the intelligence officer who revived the use by Israel of hit squads, was sacked as head of Mossad in the wake of the operation.

'Operation eMule' feds bust duo with 500+ eBay, PayPal accounts

Federal investigators on the trail of a multi-million dollar identity theft ring have raided the homes of two Vietnamese exchange students in Minnesota.

The duo are suspected of selling discounted goods such as video games and Apple gift cards, which were purchased using counterfeit credit cards, through online marketplaces such as eBay. Online marketplaces are left holding the can after the legitimate owners of abused credit cards object.

Online merchants including PayPal, Amazon, Apple, Dell, Verizon Wireless and translation software firm Rosetta Stone have also been left out of pocket as a result of the scam.

The two Winona State University students ran more than 180 eBay accounts and 360 PayPal accounts that were established under false names, according to an affidavit by federal investigators from the Department of Homeland Security.

Investigators reckon as much as $1.25m in illicit funds passed through the compromised accounts, the Minneapolis Star-Tribune reports.

These funds were allegedly wired from the US-based money mules to the masterminds behind the scam, based in Vietnam and Canada.

The raid against the suspects - Tram Vo and Khoi Van, both 22 - is part of a larger investigation, Operation eMule, by the DHS into cybercrime scams masterminded from Vietnam.

MOSSAD SPY VULTURE seized in Saudi Arabia

A cunning Israeli plan to use Mossad-operated spy vultures to glean valuable intelligence on Arab nations went seriously awry when one of the feathered spooks was arrested in rural Saudi Arabia.

According to Israel's Ha'aretz, government operatives' attempts to disguise the bird as a participant in a vulture migratory study - by equipping it with a GPS transmitter and a tag bearing the ID code "R65" and "Tel Aviv University" - didn't fool locals, who quickly alerted the powers that be.

Residents and on-the-spot reporters were happy to denounce this "Zionist plot" to Saudi Arabia's Al-Weeam newspaper, and the black helicopters were soon circling in force as the accusations went viral and "hundreds of posts on Arabic-language websites and forums" decried the vulturine black op.

Claims that Israel is mounting a zoological assault outside its borders are not without precedent. Sinai regional governer Mohamed Abdel Fadil Shousha recently suggested that a shark which killed and maimed tourists off the Egyptian Red Sea resort of Sharm el Sheikh was playing Jaws at the behest of Israeli agents.

Reports that the beast was equipped with a frikkin' laser stamped "Made in USA" are unconfirmed.

Microsoft upset over Google researcher's tool release

100 vulnerabilities in various browsers identified.

Microsoft is again at odds with a Google security researcher over what the software giant believes was the premature release of vulnerability information.

Well-known bug hunter Michal Zalewski, who uses the online alias "lcamtuf", last week released a web browser fuzzing tool that identified about 100 vulnerabilities in various browsers.

One of those – a potentially exploitable zero-day vulnerability in Microsoft's Internet Explorer (IE) browser – may have been discovered by hackers in China, he said.

The tool, called “cross_fuzz,” also found flaws affecting Firefox, Opera, Chrome, Safari and other browsers that use the open-source web browser engine WebKit.

“I have reasons to believe that the evidently exploitable vulnerability discoverable by cross_fuzz ... is independently known to third parties in China,” Zalewski said of the IE flaw.

A developer working to address cross_fuzz crashes in WebKit “accidentally leaked” the address of the fuzzer prior to its release, he said. As a result, Google then indexed the cross_fuzz directory.

In late December, Zalewski came across search queries from an IP address in China that matched keywords mentioned in one of the indexed cross_fuzz files. The search queries were looking for information about two IE functions unique to the vulnerability in question, Zalewski said. At the time, there was no other information online about the flaw.

“The person had no apparent knowledge of cross_fuzz itself, poked around the directory for a while, and downloaded all the accessible files,” Zalewski wrote. "The pattern is very strongly indicative of an independent discovery of the same fault condition in [IE].”

In a statement sent to SCMagazineUS.com, a Microsoft spokesman said the company is aware of the “potentially exploitable crash” and is still working to determine if the flaw is exploitable.

“At this point, we're not aware of any exploits or attacks for the reported issue and are continuing to investigate and monitor the threat environment for any changes,” Jerry Bryant, group manager of response communications for trustworthy computing at Microsoft, wrote in the statement.

The fuzzing tool was published by Zalewski despite Microsoft's request that the release be postponed.

“Since they have not provided a compelling explanation as to why these issues could not have been investigated earlier, I refused,” Zalewski wrote in a blog post.

Zalewski originally submitted a report to Microsoft about the cross_fuzz tool in July, noting multiple crashes and corruption issues, according to a timeline of his communications with the software giant. The researcher then reached out to Microsoft several more times before notifying the company on December 20 that he planned to release the tool in early January.

In its statement, Microsoft acknowledged receiving Zalewski's initial report in July, but denied that the tool identified any problems in IE at the time. Microsoft said it was provided a different version of the tool on December 21, along with information about the potentially exploitable crash, which was found by this updated version. 

“We will continue to investigate this issue and take appropriate action to help protect customers,” Microsoft said.

Meanwhile, Zalewski also notified the WebKit Open Source project, Mozilla and Opera about the flaws in July, and many have since been fixed. However, several hard-to-patch issues remain unresolved in Firefox, Opera and WebKit.

This is not the first time Microsoft and Google have disagreed over the disclosure of an unpatched vulnerability.

In June 2010, Google security engineer Tavis Ormandy published details about an unpatched Windows kernel vulnerability after giving Microsoft just five days' notice about the flaw. Ormandy's actions attracted a wave of criticism from members of the security community, but the researcher said he went public with the information in the best interest of security. 

Not long after, Microsoft unveiled a new initiative around vulnerability reporting, known as coordinated disclosure.

This article originally appeared at scmagazineus.com

Secure Computing Magazine


US authorities zeroing in on Vietnamese-based fraud ring

Operation eMule kicks into gear.

The US Department of Homeland Security (DHS) has zeroed in on two Vietnamese foreign exchange students believed to be part of an international criminal operation that has duped US retailers out of millions of dollars.

Early last month federal investigators raided the Minnesota home of Winona State University students Tram Vo and Khoi Van, seizing computers, thumb drives, documents and other items.

The investigation, called Operation eMule, began in September 2009 and is targeting a Vietnamese-based international fraud gang made up of numerous individuals in different roles – including computer hackers, fraud managers and sellers of stolen personal identity and financial information, according to a search warrant affidavit obtained by the Minnesota Star Tribune, which first reported on the investigation. The fraud operation also relies on an extensive ring of money transfer mules in the United States.

According to the search warrant affidavit, members of the fraud ring use stolen identities to open accounts with eBay, PayPal and U.S. banks. The fraudsters then list popular items – like Rosetta Stone software, video games, textbooks and Apple iTunes gift cards – at discounted prices for sale on eBay.

Once a buyer has paid for an item via PayPal, the scammers fill the order by purchasing the merchandise online from legitimate retailers using stolen credit card information and have the item shipped directly to the eBay buyer. The legitimate retailers ultimately lose money when identity theft victims protest the charges.

Lastly, money mules transfer the illegal funds from PayPal into various US bank accounts, then ultimately to other accounts overseas.

“The communication is conducted through a secured internet website accessed by vetted members only,” the search warrant affidavit states. “The illicit funds and high end electronic merchandise that are part of the Vietnam Underground economy are estimated to exceed hundreds of millions of dollars.”

Vo and Van are believed to have controlled hundreds of eBay and PayPal accounts that were opened using the stolen identities of US victims. According to the search warrant affidavit, they collected more than US$1.2 million in illicit funds and transferred much of the money to accounts in Vietnam and Canada. Public records currently show no criminal charges against the students.

Operation eMule is ongoing. Federal law enforcement officers with the Homeland Security Investigations in Minnesota are working on the case with the National Cyber Crimes Center, part of the US Immigration and Customs Enforcement.

This article originally appeared at scmagazineus.com

Secure Computing Magazine


Microsoft confirms graphics engine flaw

Out-of-band patch unlikely.

Microsoft has confirmed the existence of a vulnerability affecting the graphics rendering engine of some Windows operating systems.

The Redmond giant said it was working on a patch but that it was unlikely to be released separately as an emergency out-of-band update.

"We are not aware of any affected customers, nor of any active attacks targeting customers [using this vulnerability]," Microsoft's senior marketing communications manager for trustworthy computing Angela Gunn said.

The vulnerability was first disclosed at a security conference in South Korea last month, according to the SANS Technology Institute.

According to the Institute's Johannes Ullrich, the vulnerability affected all current versions of Windows, barring Windows 7 and 2008 R2.

"The vulnerability is exploited via malicious thumbnail images that may be attached to various documents (e.g. Microsoft Office documents)," Ullrich stated.

"The most likely exploit vector would use e-mail attachments. However, it is also possible to use network shares."

Copyright © iTnews.com.au . All rights reserved.


Dubai Assassination Followed Failed Attempt by Same Team

The successful assassination of a high-ranking member of Hamas earlier this year in Dubai followed an unsuccessful attempt by the same hit team two months earlier, according to a magazine story out this month.

The elite team suspected of orchestrating the kill tried to poison Mahmoud Al-Mabhouh in November 2009 in Dubai, according to GQ magazine. The unknown toxin, possibly slipped into a drink or placed on fixtures in a hotel room, left Al-Mabhouh mysteriously ill but not fatally so. Al-Mabhouh, who was codenamed Plasma Screen by the Mossad, recovered from the illness without knowing he’d been poisoned, only to be killed by the same team about two months later on January 19.

Most of the details in the article have been previously reported, but the piece does add some new information.

Israeli spies, for example, had been monitoring Al-Mabhouh’s e-mail and online activities via a Trojan horse planted on his computer, and therefore knew when he’d be arriving in Dubai, according to Ronen Bergman, an Israeli investigative journalist and author who wrote the GQ story. They did not, however, know which hotel he’d be staying at, which forced the well-prepared hit squad to improvise a bit.

Surveillance teams staked out every hotel their target was known to have stayed at during previous visits to Dubai, and another team waited at the airport and followed him to the Al Bustan Rotana Hotel, where he ended up taking a room. As previously disclosed, in order to kill Al-Mabhouh, who was reportedly in Dubai to arrange shipments of weapons to Hamas, the team re-programmed the electronic lock on his hotel room door while he was out for a four-hour meeting.

They had to rig it so that the hit men could enter the room with an unregistered electronic key while at the same time not disabling it for Al-Mabhouh’s key. The hotel’s electronic records later showed someone tampering with the lock about half an hour before the hit occurred.

Bergman writes that the fact that the team waited until half an hour before their target returned to reprogram the lock suggests the assassins had “considerable confidence” in their ability to disable the lock. Since they did not know in advance in which hotel Al-Mabhouh would be staying, they likely practiced disabling every type of electronic lock used in all of Dubai’s major hotels, he writes. The room had no balcony or windows that opened.

Assassins entered his room and waited for him to return, at which point he was injected with poison that causes muscular paralysis and, once the muscles used for breathing cease, death. They managed to leave the room with no sign of a struggle — the police report disputes this, but Bergman disputes the police report — and with the door latched from inside.

But despite what appeared to be a well-executed mission — Al Mabhouh’s body was discovered only about 17 hours after his death and long after the hit team had exited the country — the squad made a number of surprising mistakes and miscalculations, such as having two operatives use the bathroom facility at the same hotel to don disguises. They were caught on surveillance tape entering and leaving the bathrooms.

But most importantly, Bergman writes, they failed to anticipate the meticulous and efficient way Dubai authorities would piece together hundreds of hours of surveillance camera footage to identify more than two dozen suspects and track their movements throughout Dubai over many months.

“The laughable attempts of the Mossad operatives to disguise their appearance made for good television coverage, but the more fundamental errors committed by the team had less to do with cloak-and-dagger disguises than with a kind of arrogance that seems to have pervaded the planning and execution of the mission,” he writes.

Their activities were tracked in part through transactions on pre-paid debit cards, which made connecting them to each other fairly easy. Several of the team members used the same type of card issued through MetaBank in Iowa. The payroll-style cards were issued by the U.S.-based company Payoneer, whose CEO, Yuval Tal, is an Israeli-American businessman and a former Israeli Special Forces commando.

The operatives were also connected through phone call records. Although they avoided calling one another directly during the operation, they called a handful of numbers in Austria that served as a private switchboard through which the calls were then routed to one another.

“But since dozens of calls were made to and from this short list of Austrian numbers over a period of less than two days,” Bergman writes, “the moment that the cover of a single operative was blown and his cell phone records became available to the authorities, all others who called or received calls from the same numbers were at risk of being identified.”

Once Dubai authorities determined a murder had occurred, they searched databases to identify anyone who entered and left Dubai shortly before and after the killing and cross-referenced it against lists of visitors who were in Dubai during Al-Mabhouh’s previous visits to the United Arab Emirates. The whittled down list was then checked against hotel registries, and surveillance camera footage was used to match faces with names at the point the person had checked in to a hotel. Authorities searched for those faces in other footage to track their movements. Two of the operatives reportedly hung out in Al-Mabhouh’s hotel lobby for hours wearing tennis gear but showing no sign of interest in heading to the courts.

Dubai authorities then published a spectacular video compilation showing the operatives trailing Al-Mabhouh from the airport to his hotel room and lurking near his room at the time of the assassination.

Bergman leaves no question that Israel was behind the attack.

Most members of the team suspected of masterminding the attack belong to a secretive Mossad unit known as Caesarea, he writes. Members of the team made a total of four trips to Dubai before they successfully killed Al-Mabhouh.

Caesarea, also known as Kidon, reportedly consists of only about 30 members. According to Bergman, they’re trained in a separate facility from other Mossad operatives to protect their identities and are “forbidden from ever using their real names, even in private conversations.”

“If the Mossad is the temple of Israel’s intelligence community,” a longtime member of Caeasarea told Bergman, “then Caesarea is its holy of holies.”

“Holy of holies” refers to the place where the tablets containing the Ten Commandments were said to have been stored in the ancient Jewish Temple in Jerusalem.

According to a 2002 London Sunday Times story, the squad’s members have a four-year-tour of duty and are all fluent in a foreign language. They often live as “sleepers” in foreign capitals until the command comes that springs them into immediate action, “be it the hiring of a vehicle for a secret commando operation or the assassination of a local target.”

A former squad member named Mishka Ben-David told the paper at the time that only one in a thousand applicants to the Mossad receives an offer to join the agency. Of those who then manage to graduate from the Mossad’s three-year cadet course, only one in a hundred is considered suitable for the Caesarea squad. During an assassination operation in a foreign city, “only one of the five to ten people on the ground” actually does the hit,” Ben-David said.

The unit is famous for having tracked down members of the Black September group, which was responsible for killing 11 Israeli athletes at the 1972 Munich Olympics. The group also famously misidentified and killed a Moroccan waiter who they mistakenly believed was the leader of Black September.

The group fell out of favor after a bungled assassination attempt in 1997 when members tried to kill Hamas leader Khaled Mashal by spraying him with poison while he walked down a street in Jordan. Bodyguards quickly captured the two assassins, and Israel was forced to hand over an antidote to the toxin.

The group was revived, however, in 2002 when Meir Dagan was appointed head of the Mossad. A number of successful assassinations followed. The squad is believed to have been responsible for killing Hezbollah’s military chief in Damascus in February 2008 when a bomb planted in the headrest of a rental car exploded, beheading him. Another murder attributed to the squad was that of General Mohammed Sulieman, who headed Syria’s nuclear program and coordinated military cooperation between Syria, Iran, Hamas and Hezbollah.

These and other successes ensured that Dagan’s tenure at the Mossad was repeatedly extended, making him one of the longest-serving directors of the agency, Bergman notes. In October 2009, three months before Al-Mabhouh’s murder, Prime Minister Binyamin Netanyahu extended it again.

But the mistakes made by the Dubai hit team — such as using forged passports from the U.K and other countries to enter Dubai — brought political repercussions to Israel, and Dagan was replaced last month by Tamir Pardo, the Mossad’s deputy director for the last three years.

He reportedly opposed the use of UK, Irish and Australian passports for the assassination, but his protests were ignored by Dagan.

Although Israel has never acknowledged or denied responsibility for the assassination, Pardo reportedly planned to apologize in private to UK authorities for the hit team’s use of UK passports and intended to promise that Israeli agents would never use fake UK documents again.

See also:

  • Dubai Assassination Was Work of Mossad and Likely Sanctioned by Prime Minister Says Former Intel Officer
  • Alleged Assassins Caught on Dubai Surveillance Tape

Microsoft confirms code execution bug in Windows

Microsoft has confirmed reports that several versions of Windows are vulnerable to exploits that allow remote attackers to take full control of users' computers using booby-trapped emails and websites.

In an advisory issued Tuesday, Microsoft said it was investigating new public reports of vulnerability in the XP, Server 2003, Vista, and Server 2008 versions of Windows. In fact, the first known report of the bug in the way those operating systems process thumbnail images came on December 15 at a security conference in South Korea. On Tuesday, exploit code was added to the Metasploit software framework for hackers.

This is a remote code execution vulnerability, the Microsoft advisory stated. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

The flaw resides in the Windows Graphics Rendering Engine and can be exploited when victims view a specially manipulated thumbnails on network-shared folders or drives or in online WebDAV-shared folders. It can also be targeted when email users open or preview Microsoft Word or PowerPoint files that contain the doctored images.

There are no known reports of attacks in the wild that exploit the vulnerability, and Windows 7 and Server 2008 R2 aren't susceptible.

The vulnerability is exploited by setting the number of color indexes in the color table to a negative number, Johannes Ullrich, chief research officer at the Sans Institute, blogged. Slides from the December 15 conference provide hints that the exploits can bypass security measures such as data execution prevention and safe exception handling, he added.

In a blog post, Microsoft Senior Marketing Communications Manager for Trustworthy Computing, Angela Gunn, said Microsoft was working on a patch, but that for the time being the circumstances around the issue do not currently meet the criteria for an out-of-band release. Microsoft's next patch release is scheduled for January 11, but it's highly unlikely a bug fix will be ready by then.

Workarounds include configuring Windows Access Control List to be more restrictive, which will interfere with the way the Graphics Rendering Engine displays media files.

The bug is at least the third unpatched vulnerability in a piece of Microsoft software. Two weeks ago, the company warned of a vulnerability in Internet Explorer that creates a means for hackers to inject malware onto vulnerable systems. On New Year's Day, security researcher Michal Zalewski disclosed a separate bug in the Microsoft browser that he believes also allows attackers to hijack user PCs.

PHP apps plagued by Mark of the Beast bug

Web developers are in a lather following the discovery of a bug in the PHP programming language that causes computers to freeze when they process certain numerical values with large numbers of decimal places.

The error in the way floating-point and double-precision numbers are handled sends 32-bit systems running Linux, Windows, and FreeBSD into an infinite loop that consumes 100 percent of their CPU's resources. Developers are still investigating, but they say the bug appears to affect versions 5.2 and 5.3 of PHP. They say it could be trivially exploited on many websites to cause them to crash by adding long numbers to certain URLs.

Since PHP drives everything from WordPress to Wikipedia, there could be a ton of vulnerable sites, H D Moore, CSO of Rapid7 and chief architect of the Metasploit project, told The Reg. The use case for this would be to quickly kill any web server hosting a vulnerable PHP instance and application.

The bug, which first came to light on the Exploring Binary blog, is triggered when PHP apps process statements such as:

<?php $d = 2.2250738585072011e-308; ?>

The crash is also triggered when the number is expressed without scientific notation, with 324 decimal places. As author Rick Regan notes, the value is the largest subnormal double-precision floating-point number. It's still not clear exactly what causes the crash, but participants on this Hacker News forum speculate it has something to do with the way 32-bit x86 processors calculate long values with a large number of decimals.

As a user names Pomax explains:

This is the nature of floating point numbers: they're not exactually [sic] "exact" at all. Converting a fixed fraction decimal number into a floating point means turning an exact number into its best approximation. In order to get the approximation as close as possible to the original number, a floating point conversion algorithm will perform several runs until the error between the original number and the floating point representation is smaller than some very small value. This leads to problems when either the error can't get smaller than the required precision, or when the error doesn't decrease per iteration. In both cases an algorithm that doesn't have error detection will be stuck in an infinite loop.

The user went on to say that the problem happens with values passed through the GET protocol, making it possible for people to trigger crashes by adding parameters to URLs that contain the number, a la /store.php?cat=22250738585072011.

PHP maintainers have yet to weigh in on the report. In the meantime, possible workarounds include adding a -ffloat-store flag to CFLAGS or stopping the execution of decimal versions of numbers that are passed as a parameter.

Most Recent Post

MORE ON ARCHIVE
Widget by Mad Tomato

Help Me Expose This Article in Bulk!

Bookmark & Share

- OR -

SELECT YOUR PREFERRED ONE:

Bookmark and Share