Researchers: Anonymous and Lulzsec Need to Focus their Chaos

The online vigilante groups Anonymous and LulzSec are weakening their cause with scattershot attacks and need to get more intelligent and focused, according to a panel of computer security experts at the DefCon hacker conference in Las Vegas.

We have an opportunity to not just cause chaos, but to cause organized chaos, said Josh Corman, research director at the analyst firm 451 Group, who said the groups are burying their message in noisy denial-of-service and SQL attacks. Im suggesting the actions in pursuit of their own goal compromise their goal. Theres a way to render more specific what they want to accomplish.

The loosely affiliated groups have launched controversial denial-of-service attacks on PayPal and MasterCard, after the money services stopped processing donations for WikiLeaks, as well as PBS.com after they took issue with a PBS documentary about alleged WikiLeaks source Bradley Manning. Theyve also masterminded hacks of government contractors, and participated in hacks of Sony.

But Corman said the groups would be better off focusing their energy on more significant things like taking down child-exploitation sites.

Thats something we can all get behind, Corman said.

Another panelist, unimpressed with Anonymouss recent hack of defense contractor ManTech International, said the groups should focus on finding evidence of corrupt governments and exposing things like the Collateral Murder video that WikiLeaks published in 2010, which showed an Army gunship opening fire on a group of civilians in Iraq.

If youre going to do this, then find the real dirt, said the panelist, who initially appeared on stage in disguise, wearing sunglasses and a scarf to cover his head and the lower half of his face. After audience members called for him to reveal himself, he removed the disguise and identified himself as security blogger Krypt3ia.

The disguise highlighted the fact that many security people fear speaking out publicly against Anonymous and LulzSec after Anonymous hacked the network of HBGary Federal and exposed thousands of emails from the companys then-CEO Aaron Barr. Anonymous targeted the company after Barr was quoted in a news article asserting that he knew the identities of some Anonymous members and would be providing the information to the FBI.

Barr and his company faced intense scrutiny after his exposed emails revealed that they were involved in a shady undercover operation to discredit WikiLeaks and some of the people who support the group and Barr was eventually fired, in an effort by the company to distance itself from the controversial plan.

Barr was scheduled to appear on the DefCon panel but withdrew after HBGary threatened to sue him and his current employer if he spoke about the hack and his companys anti-WikiLeaks project.

Corman said that in the companys effort to suppress discussion of the issue, it had put a big target on themselves.

Ive had people come up to me saying guess who my next target is? HB Gary, he said.

The provocative panel, moderated by Paul Roberts, editor of the ThreatPost security blog, also included Jericho, a founding member of Attrition.org, a computer security site that specializes in exposing investigating and exposing industry frauds.

The panel discussion touched on the ethics of Barrs activities, but focused primarily on the activities of Anonymous and LulzSec.

Krypt3ia accused the groups of not having real goals but of simply wanting to smash things and then coming up with a cause for their hacks afterward to defend their actions. He noted that due to the nebulous nature of Anonymous and LulzSec that allows any hacker to claim hes a member of the groups, corporate spies and nation-state actors can now hide their activities under the umbrella of Anonymous to draw suspicion away from them.

Jericho called on the community to build a better anonymous to create one that wouldnt cause as much collateral damage from its actions and could have a beneficial effect on the security industry. He suggested that Anonymous and LulzSec might have a role to play in improving computer security by hacking companies that fail to secure their systems despite repeated warnings that theyre vulnerable.

If companies dont do the security they need to do why not force them to get it, he said. Youre not learning your lessons, so maybe it is time for Anonymous or LulzSec to come in . . . and wake them up.

Another fair target he said would be companies that sue researchers who uncover vulnerabilities in their systems or products. Sony, which has experienced ongoing hacks over the last months, was initially hacked over the companys choice to sue SonyPlaystation 3 tinkerer George Hotz.

Hacking Home Automation Systems Through Your Power Lines

The X10 jammer designed by researchers to hack home automation systems through power lines. Photo courtesy of David Kennedy and Rob Simon

LAS VEGAS Hacking the grid took on new meaning at the DefCon hacker conference on Friday when two independent security researchers demonstrated two tools they designed to hack home and business automation and security systems that operate though power lines.

The automation systems let users control a multitude of devices, such as lights, electronic locks, heating and air conditioning systems, and security alarms and cameras. The systems operate on Ethernet networks that communicate over the existing power lines in a house or office building, sending signals back and forth to control devices.

The problem is that all of these signals are sent unencrypted, and the systems dont require devices connected to them to be authenticated. This means that someone can connect a sniffer device to the broadband power network through an electrical outlet and sniff the signals to gather intelligence about whats going on in a building where the systems are installed such as monitor the movements of people in houses where security systems with motion sensors are enabled. They can also send commands through the network to control devices that are connected to it — for example, to turn lights on or off or to disable alarms and security cameras.

None of the manufacturers have implemented really any security whatsoever on these devices, said Dave Kennedy, one of the researchers. Its such an immature technology.

Kennedy, aka Rel1k, and Rob Simon, aka Kc57, spent two months researching and designing their open-source tools to conduct the hacks. The tools focus on home-automation systems that are based on the X10 protocol, which doesnt support encryption. They also looked at the ZWave protocol, which does support AES encryption, but the one device they found that was using it, implemented the encryption incorrectly – the key exchange was done in the clear so an attacker could intercept the keys and decrypt all of the communication.

The tools, which theyre releasing to the public, include the X10 Sniffer to determine whats connected to the power network and monitor what the devices are doing, and the X10 Blackout, which can jam signals to interfere with the operation of lights, alarms, security cameras and other devices.

The researchers demonstrated the Sniffer and Blackout devices they designed that plug into a power socket inside or outside a house or even into an outlet in a house nextdoor, since signals can leak out from a house and carry for some distance. Kennedy said that while testing one of the devices from his house in Ohio, he picked up signals from home automation systems belonging to 15 neighbors.

The tools need to be preprogrammed with commands the hackers want to send. For example, the tools can be preprogrammed to send a jamming signal if a security system is triggered by someone opening a door or window. This would prevent an alarm from sounding and alerts being sent out to police and the property owner. The researchers are working on a GSM-enabled tool that would allow attackers to receive sniffed data remotely to their cell phones (currently the sniffed data is written to external storage) as well as send commands in real-time back to the tool via text messaging.

Thieves could monitor a house to determine when the occupants are generally gone based on signals indicating when lights are turned off, doors and windows are closed and the alarm system is enabled. Then they could send out jamming signals from the tool to disable motion sensors and alarms before breaking into the house. They could also completely fry the system by overloading it with rapidfire commands, though Kennedy acknowledged that this could potentially cause a fire.

The researchers said they hadnt notified the makers of automation systems about the vulnerabilities in their systems, but said they are hoping their project will bring attention to the security problems.

DIY Spy Drone Sniffs Wi-Fi, Intercepts Phone Calls

LAS VEGAS — What do you do when the target you’re spying on slips behind his home-security gates and beyond your reach?

Launch your personal, specially-equipped WASP drone — short for Wireless Aerial Surveillance Platform — to fly overhead and sniff his Wi-Fi network, intercept his cellphone calls, or launch denial-of-service attacks with jamming signals.

These are just a few of the uses of the unmanned aerial vehicle that security researchers Mike Tassey and Rick Perkins demonstrated at the Black Hat security conference here Wednesday.

At a cost of about $6,000, the two converted a surplus FMQ-117B U.S. Army target drone into their personal remote-controlled spy plane, complete with WiFi and hacking tools, such as an IMSI catcher and antenna to spoof a GSM cell tower and intercept calls, as well as a network sniffing tool and a dictionary of 340 million words for brute-forcing network passwords.

The GSM hack was inspired by a talk given at last years DefCon hacker conference by Chris Paget, who showed how to create a cell phone base station that tricks nearby handsets into routing their outbound calls through it instead of commercial cell towers, allowing someone to intercept even encrypted calls in the clear. The device tricks phones into disabling encryption, and records call details and content before theyre routed on their way to their intended receiver through voice-over-IP or redirected to anywhere else the hacker wishes.

The drone takes that concept and gives it flight. The plane weighs 14 pounds and is six feet long, and per FAA regulations can legally fly only under 400 feet and within line of sight. But the height is sufficient to quiet any noise the drone might produce which is minimal the researchers said – and still allow the plane to circle overhead unobtrusively. It can be programmed with GPS coordinates and Google maps to fly a pre-determined course, but requires remote control help to take off and land.

The two created the spy plane as a proof-of-concept to show what criminals, terrorists and others might also soon be using for their nefarious activities.

Tassey, a security consultant to Wall Street and the U.S. intelligence community, told the conference crowd that if the two of them could think up and build a personal spy drone, others were likely already thinking about it, too.

The spy drones have multiple uses, both good and bad. Hackers could use them to fly above corporations to steal intellectual property and other data from a network, as well as launch denial-of-service or man-in-the-middle attacks. They could also transmit a cell phone jamming signal to frustrate an enemy’s communications.

Its hard to keep something thats flying from getting over your facility, Tassey said.

A drone could also be used to single out a target, using the target’s cell phone to identify him in a crowd, and then follow his movements. And it would be handy for drug smuggling, or for terrorists to trigger a dirty bomb.

But the drones dont just have malicious uses. The researchers point out that they would be great for providing emergency cellular access to regions hit by a disaster.

The drones could also be outfitted with infrared cameras and shape-recognition technology to run search-and-rescue missions for lost hikers. The military could use them for electronic countermeasures for jamming enemy signals or as communication relays flown over remote areas to allow soldiers on two sides of a mountain, for example, to communicate.

You dont need a PhD from MIT to do this, Perkins said.

Black Hat 2011: Database threats and mitigations

Black Hat 2011: Android attacks and smartphone privacy leaks

Black Hat 2011: SIM rule maker on attacks and defenses

Former CIA official cites rise in government cybersecurity awareness

LAS VEGAS Both white hat and black hat security researchers alike today received a soberingwarning from the Central Intelligence Agencys former director of operations: The opportunity hasnever been greater to foster governmentcybersecurity awareness, now that the threat paradigm at a national defense level has evolvedto include cybersecurity.

Cyber is going to be a key component of future conflict againstnations or terror groups.

Cofer Black, former director of operations, Central Intelligence Agency

During a keynote address at the BlackHat 2011 conference, Cofer Black urged the security community to influence and educategovernment decision makers, many of whom are ignorant of the threats posed by cybercriminals andnations carrying out online attacks that target major corporations, government agencies and thedefense industry.

The issues that youre involved in are today are of great value to decision makers, Blackstressed. That is huge.

Black said cybersecurity is prominent among the different categories, alongside kinetic andbacteriological attacks, featured the governments ongoing threat assessments. As a comparison, hesaid during the Cold War, intelligence agencies progressed from highlighting potential chemicalattacks, to later emphasizing bacteriological, radiological and nuclear attacks.

Black spent 28 years working for the CIA and was appointed director of the agencysCounterterrorist Center in 1999 and coordinator for counterterrorism for the Department of State.Hes seen the threat of the Cold War, the rise of terrorism and now threats to industry andnational security from online attacks. He cautioned that the signs are present and discussions arebeing held that allow for the contingency that physical, kinetic attacks could accompany serioushacks.

I am here to tell you the Stuxnetattack is the rubicon of our future, Black said. I cant say I understand how it wasexecuted, but the important point is this is expensive to pull off, which means a nation-state wasinvolved. Another important point is, things happening in your world may lead to physicaldestruction of national resources. This is huge.

Responses to cyberattacks, however, are tricky because of the difficulty in tracing the originof attacks and the lack of international coordination in such cases.

Cyber is going to be a key component of future conflict against nations or terror groups,Black said. The problem is decision makers dont understand the threats completely because theyhave not personally experienced them. They may hear it, but they dont believe it.

Blacks keynote comes a little more than a month before the tenth anniversary of the September11 attacks on New York and Washington. Black drew parallels between the intelligence gatheredpre-9/11 and what is happening with cybersecurity today.

In the years and months leading up to September 11, Black recalls the dismissive attitudedecision makers had about Al Qaeda and Osama Bin Laden, viewing the terror group and its leader asmore a of financier of terror, and not an initiator. The threat from Al Qaeda was labeled overblowninside some government circles and by the press as well. This remained the case, even as attacksescalated against Americans overseas, including the 1998 U.S. embassy bombings in Tanzania andKenya, and in October 2000 against the U.S.S. Cole.

Black Hat 2011

See all our news coverage and exclusive videos from BlackHat 2011.

Black recalls advising the Bush administration as the transference of power from the Clintonadministration began, that terrorism would be its greatest threat. However, Black said, there wasno personal experience, no validation of the threat, and it was downplayed. In the summer of 2001,as the volume of intelligence grew about a major impending attack on the U.S., decision makers werebriefed and advised to go to a war footing, yet, Black said, there were delays in taking actionbecause the threat had yet to be validated.

Mens minds have difficulty adapting to things they have not personally experienced, Blacksaid.

Blacks point is the lead-up to 9/11 may be analogous to whats happening with targetedpersistent attacks carried out against the defense industry and other high-profile targets.

The validation of that threat will come into your world, Black said. There is an analogy tothe tech world in all of this and the situation in your world is far more challenging than you mayappreciate.

Hard-Coded Password and Other Security Holes Found in Siemens Control Systems

A so-called Easter egg hidden in the firmware of a Siemens PLC depicts dancing chimpanzees and a German phrase. Siemens was unaware one of its programmers had inserted the egg into its program. (Courtesy NSS Labs)

LAS VEGAS — A security researcher has uncovered a slew of vulnerabilities in Siemens industrial control systems, including a hard-coded password, that would let attackers reprogram the systems with malicious commands to sabotage critical infrastructures and even lock out legitimate administrators.

The vulnerabilities exist in several models of Siemens programmable logic controllers, or PLCs — the same devices that were targeted by the Stuxnet superworm and that are used in nuclear facilities and other critical infrastructures, as well as in commercial manufacturing plants that make everything from pharmaceuticals to automobiles.

Stuxnet was discovered on systems in Iran last year and is believed to have been aimed at destroying uranium-enrichment centrifuges at the Natanz nuclear facility in that country. It targeted Siemens Simatic Step7 software, which is used to monitor and program Siemens PLCs. It then intercepted legitimate commands going from the Step7 system to PLCs and replaced them with malicious commands aimed at sabotaging processes controlled by the PLC; in this case the spinning of centrifuges.

The newly discovered vulnerabilities go a step further than Stuxnet, however, in that they allow an attacker to communicate directly with a Siemens PLC without needing to compromise, or even use, the Step7 software.

One of the most serious security holes is a six-letter hardcoded username and password — both “Basisk” — that Siemens engineers had left embedded in some versions of firmware on its S7-300 PLC model. The credentials are effectively a backdoor into the PLC that yield a command shell, allowing an attacker to dump the device’s memory — in order to map the entire control system and devices connected to it — and reprogram the unit at will.

“I was able to log in via telnet and http, which allowed me to dump memory, delete files and execute commands,” says Dillon Beresford, the security researcher with NSS Labs who discovered the password, and at least a dozen more subtle security holes.

Beresford, a security researcher with NSS Labs, had planned to discuss a few of the vulnerabilities at TakeDownCon in Texas in May, but pulled the talk at the last minute after Siemens and the Department of Homeland Security expressed concern about disclosing the security holes before Siemens could patch them.

Since then, he discovered additional vulnerabilities in several models of Siemens PLCs that would variously allow attackers to bypass authentication protection in the PLCs and reprogram them, or issue a “stop” command to halt them. They all require the attacker to have access to the network on which the PLCs run. That might be accomplished by infecting a legitimate computer on the network, such as with a phishing attack targeted at an employee, or through an infected USB stick — the method Stuxnet used.

Beresford will be presenting his findings on Wednesday at the Black Hat security conference in Las Vegas, but spoke with Threat Level in advance of his talk.

He’s been working with DHS’s Industrial Control Systems Cyber Emergency Response Team, or ICS-CERT, to validate and disclose the vulnerabilities and plans to withhold some information, as well as actual exploit code, until Siemens has a chance to patch the vulnerabilities that can be fixed. Not all of the vulnerabilities affect every model. Some of the vulnerabilities are inherent in the architecture of the systems and would require more than a patch.

One of the main vulnerabilities, he says, is that the systems have no defense against a so-called “replay attack”. An attacker could intercept commands going from any Step7 control system to any PLC — including a system in his own lab that he controls — and later play them back to any other PLC.

The attacker, for example, can capture a CPU stop command going from his own Step7 engineering workstation to his PLC, then replay the command back to another PLC to shut it down. He could also sabotage whatever the PLC is controlling by replaying malicious commands that would, for example, cause the speed of motors or rotors to increase on a centrifuge or cause valves to open or close on a pipeline.

If I could only replay the same traffic into my own PLC, that would constitute a vulnerability,” Beresford said. “The fact that I can record traffic going to and from my own PLC, and play them back to any PLC, thats what makes it a big issue.”

Generally, this kind of captured traffic should have a session ID that expires. But the Siemens PLC session never expires, Beresford said, so an attacker can use the captured traffic repeatedly, unless the PLC he’s attacking crashes and an administrator physically re-cycles it and then issues a run command to restart it.

Last May, Beresford revealed that he could conduct the replay attack against Siemens S7-1200 PLC model. Siemens said at the time that it believed the flaw did not affect other models of its PLCs, and last month the company announced that it had fixed the flaw in the S7-1200. But Beresford found that the flaw also exists in the S7-200, S7-300 and S7-400 models of Siemens PLCs.

It’s possible for an attacker to communicate directly with the PLC, without needing to use Siemens Step7 system, because Siemens’ PLCs dont restrict or otherwise limit which computers communicate with them. There are no rules in the PLC limiting traffic or commands to specific IP addresses or to specific computers with Step7 installed on them, Beresford said. The PLCs also do not keep logs to identify the computers that send them commands, so trying to identify the source of a malicious command a PLC received would be difficult.

Siemens did not respond to a request for specific comment about the vulnerabilities but said the company had sent several representatives to the BlackHat conference and is working with Beresford to understand and patch the vulnerabilities.

“ICS-CERT and Siemens have issued technical alerts/updates on this topic, and will continue to do so on an as-needed basis,” said Frank Garrabrant from Siemens SIMATIC Security Industry Automation Division, in a written statement.

Previously, Siemens has asserted that the attacks Beresford describes could be thwarted by air-gapping PLCs and their control computers from the internet. But according to Vik Phatak, CTO of NSS Labs, not all companies have a complete understanding of what constitutes an air-gapped system.

Weve talked to a number of different companies that have told us that their version of an air-gapped network [means] theres no inbound connection, but they definitely have outbound connections to the internet for their employees, Phatak said.

Even air-gapping a system would not work if someone plugged removable media containing malware into the system.

The only thing on the PLCs that would prevent an attacker on the network from communicating directly with the devices is an authenticated packet that passes from the Step7 machine to the PLC. But Beresford found a way to bypass this authentication protection.

Step7 machines authenticate themselves to a PLC using a hash generated from a password. The hash is stored inside a project file that gets sent from the Step7 machine to a PLC. If the hash matches a hash stored on the PLC, a switch on the PLC is flipped that allows a programmer to then read and write to the PLC. Beresford found that he could bypass this by capturing the authentication packet and replaying it to a PLC.

If you capture it, you have the authenticated packet, theres nothing the PLC can do to stop you, Beresford said.

Beresford could also do a replay attack to disable the authentication protection on a PLC. He’d simply issue a command to his own PLC to disable the password protection, then capture that command as it passed to his PLC and replay it to the PLC he wanted to attack.

“I can even change their password, so if I wanted to lock them out of their own PLC I could do that as well,” he said.

To find a PLC on a network, an intruder could introduce malware designed to scan the network for any devices operating on port 102 — the port the PLCs use to communicate — and map all of the PLCs on a network in order to attack them all, or target specific ones.

As for the hard-coded password, “Basisk,” that he found in the S7-300 firmware, Beresford says it was obfuscated by a basic shift sequence that involved swapping characters and shifting them to the right. It took him two and a half hours to decode the password. Beresford could only confirm that the hardcoded password existed in a specific version of the firmware on his S7-300 PLC — firmware version 2.3.4.

The credential would give a user command shell access on the PLC, allowing someone to reprogram the PLC or otherwise completely control it. The password also gives access to a memory dumping tool, that would allow an attacker to dump memory from the PLC in real time in order to gather intelligence on the PLC to devise a targeted attack.

He found he could dump SDRAM, uncached and cached, NOR flash, as well as other parts of RAM and scratchpad data. He could also obtain the serial numbers and tag names of devices connected to the PLC. All of these would allow an attacker to discover new vulnerabilities in the system and to determine what’s connected to the PLC and what normal operating conditions exist for those devices in order to design a worm like Stuxnet to attack them. An attacker could also write a worm that copied itself to a PLC — so that anyone who communicated with the PLC would be infected — or use the PLC to launch attacks against other machines on the same network.

Siemens has acknowledged that the password existed and said that developers had put it in the system for testing purposes, but then forgot to remove it.

ICS-CERT has issued an alert about the password (.pdf). According to the alert, Siemens discovered the password in 2009 and removed it from subsequent systems. But anyone using pre-2009 versions of the S7-300 firmware would likely still have the password installed.

Anything before October 2009, for the PLCs, in terms of the S7-300, would be affected by the hardcoded password, Beresford said.

Finally, Beresford also found an Easter egg in two versions of the S7-300 PLC firmware — versions 2.3.2 and 2.3.4. Its an html file that depicts a handful of dancing chimpanzees and a German proverb that is the equivalent of the English phrase, “All work and no play makes Jack a dull boy.”

Siemens was not aware the Easter egg was in the firmware. “They werent exactly happy,” Beresford said. “Considering where these devices are deployed, they didnt think it was very funny.”

While the Easter egg may have simply been a developer’s idea of fun, Beresford says he’s still examining it to see if its possible to send commands through the html page back to the PLC.

Siemens is beginning to move out patches for some of the vulnerabilities this week, but others will take longer.

See also:

• Fearing Industrial Destruction, Researcher Delays Disclosure of New Siemens SCADA Holes

McAfees Operation Shady RAT exposes national cybersecurity lapses

In conjunction with this weeks BlackHat 2011 hacker conference, security vendor McAfee Inc. has released details on what itdescribes as the most comprehensive revelation and analysis of previously undisclosed intrusions,which may threaten the national security of the U.S. and other nations.

I am convinced that every company in every conceivable industry with significant size andvaluable intellectual property and trade secrets has been compromised (or will be shortly).

Dmitri Alperovitch, vice president of threat research, McAfeeLabs

Today the security vendor unveiled Operation Shady RAT, asMcAfee has named it, a five-year research effort that led to the identification of 72 compromised,intruded parties, all relevant to the national security posture of the U.S. or other nations,broken down into 32 unique organization categories in 14 different countries.

The security firm legally gained access to a particular command-and-control server used by theintruders who perpetrated the attacks and collected their logs, revealing the full extent of thevictim population and the duration of the breaches since mid-2006, though its unclear whether theintrusions began earlier.

I am convinced that every company in every conceivable industry with significant size andvaluable intellectual property and trade secrets has been compromised (or will be shortly), saidDmitri Alperovitch, vice president of threat research for McAfee Labs. In fact, I divide theentire set of Fortune Global 2000 firms into two categories: those that know theyve beencompromised, and those that dont know yet.

                                                                                                                                                     Accordingto the report, theres enormous diversity among the victim organizations, including the UnitedNations, a multinational Fortune 100 company, and a national Olympic team. Alperovitch said thereport only analyzed the logs on one particular server and the number of intrusions perpetrated bythe attacker organization is well into the thousands.

The report explains the intrusions were rather standard procedure: typically a spear-phishingemail containing an exploit is sent to a trusted insider with privileged access at the targetorganization. When the email is opened on an unpatched system, a download begins and implantsmalware. That malware then allows a backdoor communication channel to the command-and-controlserver where live intruders can access the infected machine.

According to research by McAfee, which was acquired by Intel Corp. in February, these types ofattacks have occurred relentlessly for the past half decade, at least. And the motivation isntimmediate financial gratification like most cybercrime, but rather the hunger for secrets andintellectual property, the report explains.

Much of the information McAfee said has been compromised over the past five years includesclosely guarded and classified national secrets, negotiation plans and exploration details for newoil and gas field auctions, SCADA configurations, design schematics and numerous other pieces ofsensitive information.

The report explains that even if a fraction of it is used to build better competing products orbeat a competitor at a key negotiation the loss represents a massive economic threat not just toindividual companies and industries, but to entire countries. These countries national securitycan be completely impacted with the loss of highly classified and important intelligence anddefense information.

Black Hat 2011

See all our news coverage and exclusive videos from BlackHat 2011.

While the United States may be the most targeted and intruded country by the attackers, it isntthe only one. Others include Canada, South Korea, Taiwan, Japan, Switzerland, the UK, Indonesia,Vietnam, Denmark, Singapore, Hong Kong, Germany and India, and, as McAfee explained, that was justfrom one server.

However, Graham Cluley, senior technology consultant with security vendor Sophos plc, questionedthe relevance of McAfees findings.

To be honest, there's nothing particularly surprising in McAfee's report to those of us whohave an interest in computer security, Cluley wrote in ablog entry Wednesday. What the report doesn't make clear is precisely whatinformation was stolen from the targeted organizations, and how many computers at eachbusiness were affected.

The report claims a single actor or group conducted these intrusions as one specific operation;Alperovitch sought to clarify he doesnt want to point fingers. Theres no hard evidence of whois behind the attacks, he said, so it would only be speculation.

This could easily escalate from stealing to modifying and potential exists for more dangerousactivity, Alperovitch added.

This is a problem of massive scale that affects nearly every industry and sector of theeconomies of numerous countries, and the only organizations that are exempt from this threat arethose that dont have anything valuable or interesting worth stealing, the report stated.

Purported Miley Cyrus Hacker Pleads Guilty to Spamming From Hacked Celebrity Accounts

A hacker who boasted that he was responsible for stealing and posting provocative pictures stolen from Miley Cyrus’ Gmail account pleaded guilty on Monday to other charges involving credit card fraud and hacking.

Josh Holly, 21, pleaded guilty to possessing about 200 stolen credit card numbers, and to breaching celebrity MySpace pages in a spamming scheme that earned him at least $100,000.

Holly has never been charged with hacking Cyrus’s e-mail account, but after bragging online about this and other activity, and taunting authorities that they would never find him, his apartment in Murfreesboro, Tennessee, was raided in October 2007, at which point authorities found evidence of the cards and spamming scheme.

Holly, who went by the screen names “TrainReq,” “Rockz” and “h4x,” told Threat Level in 2008 that he had gained access to a Gmail account Cyrus had used (messagemebaby@gmail.com) and found images the Hannah Montana actress had purportedly sent to singer Nick Jonas of the Jonas Brothers.

Holly claimed that he tried to sell the pictures to TMZ.com and other celebrity outlets, but no one would buy them, given the illegal manner by which he’d obtained them. He then posted some of them online at digitalgangster.com, after which numerous gossip and celebrity websites published them for free. More photos followed thereafter.

The images showed the then-15-year-old Cyrus in a wet T-shirt in the shower, baring her midriff while blowing a kiss to a mirror, and posing seductively in her underwear and bathing suit.

Holly told Threat Level he got access to Cyrus’s Gmail account after obtaining unauthorized access to a MySpace administrative panel where he found passwords for MySpace accounts stored in cleartext. Holly said he obtained access to the administrative panel by social engineering a MySpace employee. Once inside the panel, he found the password Cyrus used for her MySpace account Loco92 and tried it on a Gmail account she was known to use.

In addition to stealing Cyrus’s password, he reset MySpace account passwords for a number of other celebrity MySpace users, then used their accounts for a spamming scheme that he said netted him about $50,000.

According to an affidavit (.pdf), Holly admitted to the FBI that beginning in 2005 he had hijacked numerous celebrity internet accounts to conduct spamming. An investigation of his bank records showed that between November 2007 and July 2008, he received more than $110,000 from companies for spamming on their behalf. Holly told Threat Level that half of his illicit income went to an accomplice in Israel who used the online nickname elul21 (Elul is the Hebrew name of a month on the Jewish calendar).

Holly also said that the celebrity MySpace accounts he accessed to conduct his spamming activity belonged mainly to recording artists and groups — Chris Brown, Rihanna, Linkin Park, Fall Out Boy. He accessed about 20 accounts. Once he had passwords to the accounts, he used the accounts to send bulletins to all of the friends on the MySpace accounts advertising a ringtone or call service for the recording artist. For example, he’d send out a bulletin from Fall Out Boy’s MySpace account telling fans that the band would call their phone and send them a ringtone if they clicked on a link and entered their details.

Holly said the advertising affiliates he worked for paid him between $5 and $12 per person who responded to the ad. The affiliates didn’t know he was spamming customers, he said, and when they found out they terminated their work with him and refused to pay him outstanding earnings.

Asked at the time charges were filed against him if he was concerned about the repercussions of his actions, he replied, “Theres no way I can get out of this at all. Not even OJ’s lawyers or Michael Jackson’s lawyers can get me out of this. To be blunt, I was an idiot and I didnt delete any of my [hard drives]. I never thought they would raid me. Theyre going to get full proof evidence of everything that Ive said Ive done.”

Holly’s sentencing hearing is set for October 31.

Photo: Mug shot of Josh Holly courtesy of The Smoking Gun

See also:

• Miley Cyrus Hacker Raided by FBI
• Miley Cyrus Hacker Used Celebrity MySpace Accounts for Spamming
  

Report warns of Android security issues, increased malware, Web attacks

LAS VEGAS According to a new report from Lookout Inc., smartphones running operating systemsbased on Google Inc.s Android mobile platform are now 2.5 times more likely to be infected by Androidphone malware than they were a mere six months ago.

Malware writers have become increasingly creative with the tactics they use to get users todownload malware.

 Kevin Mahaffey, co-founder and CTO, LookoutInc.

The San Francisco-based mobile security vendor issued its 2011 Mobile Threat Report on the heels ofthe BlackHat 2011 security conference, highlighting the increasing threats to smartphones and thedangers of Android devices.  Kevin Mahaffey, co-founder and CTO of Lookout, said in astatement that to develop its analysis of Androidsecurity issues, his team aggregated data from more than 700,000 apps and 10 million devicesworldwide.

Malware writers have become increasingly creative with the tactics they use to get users todownload malware, Mahaffey wrote in a blog entry announcing the report. Monetary motivations seemto be the primary goal, but the sheer amount of personal information stored in our smartphones alsobecomes a target for attackers to get creative.

Despite smartphone makers increasing use of sandboxing,a security feature that isolates apps from critical device processes, attackers are finding ways tobypass the restrictions to take control of the phone, according to the report. Lookout also saidthree out of 10 Android owners are likely to encounter a Web-based threat on their device annually.Malicious links have become more prevalent, the report added, as attackers are using a variety ofcommon phishing scams to lure users to attack websites.

In addition, Lookout predicted the increasing use of new malware distribution techniques, suchas malvertising , upgrade attacks and multi-stage attacks. Malvertising copies the way legitimatedevelopers use in-app advertisements to trick users into downloading malware from phony websitesimitating the Android Market. In a technique, which Lookout calls upgrade attacks, the developer ofa legitimate app waits for a large user base and then simply updates the app with malware.Multi-stage attacks use hidden code inside what appears to be a legitimate app to change itsbehavior based on a configuration change downloaded from a server.

Black Hat 2011

See all our news coverage and exclusive videos from BlackHat 2011.

Lookout reported the number of Android apps infected with malware went from 80 in January ofthis year to more than 400 in June. This is in part because malware writers are using existingmalware to create new, more dangerous variants. For instance, DroidDreamvariants accounted for more than 80 infected applications under a variety of developer names.The authors of GGTracker have published 15 infected apps across third-party Android app stores andalternative Android download sites. GGTracker signs users up for a premium SMS ringtone service,adding charges to the users monthly mobile bill. 

Lookouts report also asserts Apple iPhone users are not immune to Web-based attacks or mobilemalware, but that Apples App Store security restrictions and review process have helped keepcybercriminals from distributing malicious mobile apps. Apple iOS smartphones can be jailbroken,allowing a user to load applications from third-party sources, which Lookout said puts users at anincreased risk of infection.

Mug-Shot Industry Will Dig Up Your Past, Charge You to Bury It Again

Ex-con Rob Wiggen gets hate mail daily for running a website that hosts 4 million mug shots. Photo by James Branaman/Wired.com

Philip Cabibi, a 31-year-old applications administrator in Utah, sat at his computer one recent Sunday evening and performed one of the compulsive rituals of the Internet Age: the ego search. He typed his name into Google to take a quick survey of how the internet sees him, like a glance in the mirror.

There were two LinkedIn hits, three White Pages listings, a post he made last year to a Meetup forum for Italian-Americans in the Salt Lake City area. Then, coming in 10th place — barely crawling onto the first page of search results — was a disturbing item.

Philip Cabibi Mugshot, read the title. The description was Mug shot for Philip Cabibi booked into the Pinellas County jail.

When he clicked through, Cabibi was greeted with his mug shot and booking information from his 2007 drunk-driving arrest in Florida. Its an incident in Cabibis life that he isnt proud of, and one that he didn’t expect to find prominently listed in his search results four years later, for all the world to see.

The website was florida.arrests.org, a privately run enterprise that siphons booking photos out of county-sheriff databases throughout the Sunshine State, and posts them where Googles web crawlers can see them for the first time. Desperate to get off the site, Cabibi quickly found an apparent ally: RemoveSlander.com. You are not a criminal, the website said reassuringly. “End this humiliating ordeal … Bail out of Google. We can delete the mug-shot photo.

Cabibi paid RemoveSlander $399 by credit card, and within a day, the site had come through. His mug shot was gone from florida.arrests.org, and his Google results were clean.

“The RemoveSlander site was perfect. It seemed like it was just tailored to the mug-shot site,” Cabibi said in a recent telephone interview from Orem, Utah. “I searched ‘how to remove mug shots from florida.arrests.org,’ and the site was the first result. And I paid.”

‘Of course I’m not going to have my mug on my site.’

With that, Cabibi passed through one of the latest niche industries on the web: the mug-shot racket. ExploitingFlorida’s liberal public-records laws and Google’s search algorithms, a handful of entrepreneurs are making real money by publicly shaming people who’ve run afoul of Florida law.Florida.arrests.org, the biggest player, now hosts more than 4 million mugs.

On the other side of the equation are firms like RemoveSlander, RemoveArrest.com and others that sometimes charge hundreds of dollars to get a mugshot removed. On the surface, the mug-shot sites and the reputation firms are mortal enemies. But behind the scenes, they have a symbiotic relationship that wrings cash out of the people exposed.

Florida.arrests.org is the brainchild of a computer-savvy Florida ex-con named Rob Wiggen. The 32-year-old served three years in federal prison for participating in a small-time credit-card-skimming operation (.pdf) out of a Mexican restaurant in Tallahassee.

When he got out of jail in 2007, he was looking for more legitimate opportunities. Last year he seized on the idea ofrepurposingthe booking photos that Florida police departments are obliged to make public under the state’s sunshine laws.

The front page of florida.mugshots.org

Getting the photos is not completely straightforward: There is no central government repository. Instead, the mugshots and booking details are available on about five dozen different searchable web databases run by local police and sheriff’s departments. Wiggen said he wrote screen-scraping software to perform searches on 37 of the counties, crawling to get arrests stretching back years, and continuously polling the sites for new busts, which he scarfs down at a rate of 1,500 a day.

Robert Wiggen's 2005 mug shot. Courtesy Leon County Sheriff's Office

Visitors to his site can comment on the photos, or browse them by tags like “Celebrity,” “Hotties,” “Trannies,” “Tatted up” and “WTF.” Most of the photos are of adults, but children as young as 11 are also on display if they’re accused of adult crimes.

Wiggen said he wasn’t setting out to shame or embarrass anyone: From his point of view, he’s getting free content, then monetizing it with Google AdSense banners hawking defense lawyers and bail bondsmen. But the end result is thatmug shots that were once hidden behind police CGI search scripts now display in Google searches, often prominently.

Wiggen’s own mug shot is noticeably absent from florida.arrests.org. “Of course I’m not going to have my mug on my site,” he told Wired.com.

His year-old business has earned him enemies. Wiggen said he receives about 100 angry e-mails, and a few snail-mail letters, every day from people whose booking photos are displayed on his site. “Obviously, they’re really nasty,” he said of the messages. “I never thought I’d get this backlash from individuals. I just never imagined it.”

Among his harshest public critics is the reputation-management company RemoveSlander.com. “Thousands of people are being criminalized by mug-shot websites that collect ad revenue at their expense!” snarls the company’s promotional YouTube video, “How To Remove Florida Arrests.org.”

“Even defendants whose cases were dismissed are finding their mugs hot on the internet,” the company’s website adds. “Every time someone clicks on your page to view your mug shots, sites like Florida Arrests earns a little more cash from Google…. We have perfected the art of fighting mug-shot websites.”

For $399, RemoveSlander promises to take that fight to florida.arrests.org, and force Wiggen to remove a mug shot. RemoveSlander’s owner, Tyronne Jacques — the author of How to Fight Google and Win! — said the removal fee pays for his crack legal team to deal with florida.arrests.org, and to force Google to get the URL removed from Google’s search index.

Asked how he accomplishes that, Jacques told Wired.com it was “a trade secret.” A recent press release from the company called the work “daunting.”

“It can’t happen by magic,” he said in a telephone interview. “There are legal means that we use…. There is a tremendous amount of work to get the photos down.”

Other sites offering the same service are also closed-mouthed about their methods. The site RemoveArrest.com often enjoys advertising right on Wiggen’s site through Google’s algorithm-driven AdSense program. Joe Ellis, the operator of RemoveArrest.com, said his method is “proprietary,” but that he’s used it to get “hundreds” of mugs removed at $129 each.

It turns out, though, removing mug shots from florida.arrest.org is not as labor-intensive or arcane a process as the reputation companies claim. The real trade secret is that Wiggen wants a small piece of the action.

Wiggen said he has provided RemoveSlander an URL for an automated takedown script on his site. A PayPal payment of just $9.95 willautomaticallypurge a mug shot from the site. For an expedited removal from Google’s index, which Wiggen’s code performs through Google’sWebmaster tools interface, the fee is $19.90. Wiggen said other removal sites also make use of that same URL, but he declined to name them.

RemoveSlander “presses a button and makes a payment, and my website handles it automatically,” Wiggen said.

Wired.com tried the interface independently, and for $19.90 we removed the mugshot of a randomly chosen misdemeanor defendant, which disappeared from the site inside 10 minutes.

Wiggen said about 750 mugs have been removed from florida.arrests.org since he launched the site last year — some of them he took down himself in response to e-mail requests, but most were performed by reputation-management firms like RemoveSlander. He appears content to let those companies take the lion’s share of the mug-shot removal profits.

The bulk of florida.arrests.org’s income comes from advertising, not mug-shot removal fees, he said, declining to otherwise discuss his revenue. “I’m not getting rich,” he said.

‘The business model seems to be to generate embarrassment and then remove the source of the embarrassment for a fee.’

The reputation companies, though, appear to be doing pretty well. Of the $399 that Cabibi paid to RemoveSlander, $19.90 would have wound up with the mug-shot site that exposed him in the first place, and $379.10 with the company that promised to “fight” for him. By its own count, RemoveSlander has removed more than 300 mug shots.

Wired.com asked RemoveSlander’s Jacques if it’s true he’s paying $19.90 for his $399 service. That end of the business, he said, was handled by a partner, who was not available to be interviewed. Ellis, the owner of RemoveArrest.com, would neither confirm nor deny his use of the automated takedown tool.

None of this appears to be illegal, but it demonstrates an unintended consequence of state transparency laws — of which Florida’s is among the nation’s strongest.

“The business model seems to be to generate embarrassment and then remove the source of the embarrassment for a fee,” said Steven Aftergood, director of the Project on Government Secrecy for the Federation of American Scientists, and one of the nation’s leading open-records advocates.

“So the whole practice is designed to exploit human weakness,” said Aftergood. “From an information policy point of view, it is also likely to have adverse consequences. People are more likely to say, ‘Who needs it, let’s seal all of these records.’ That would be an unfortunate consequence.”

The State of Florida is unapologetic about the market its mug-shot posts have enabled. “We are very public-recordfriendly. We are one of the most transparent states out there,” Kristi Gordon, a spokeswoman for the Florida Department of Law Enforcement, said. “As soon as a photo is taken at a booking facility, it becomes a public record.”

Craig Rockenstein, assistant general counsel for the department, declined to discuss the matter. “I’ve been here 25 years, and that’s the first time I was ever asked that,” he said.

The sudden ubiquity of mug-shot websites has prompted David Haenel, a Florida criminal-defense attorney, to advise clients to surrender themselves to small town sheriff’s departments where bookings are so infrequent that Wiggen and others won’t bother scraping their web sites for fresh mug shots.

“I have them go to a county I know they are not scraping the data from,” said Haenel, who practices in Sarasota, Florida.

If someone does wind up on florida.arrests.org, though, Haenel will get the photo removed for a $1,250 fee through his own website, hidemymugshot.com. Haenel said he has helped about 25 clients do that in the last two months. He said he doesn’t know anything about the $19.90 removal script, and declined to describe how he gets the mug shots removed.

Now $399 poorer, Cabibi said he feels like he’s been played.

He said his arrest came during a lapse in judgment, when he drove home intoxicated from a Florida bar after watching college football in 2007. His blood-alcohol was almost double the legal limit. He pleaded no contest, paid a fine and did six months’ probation. The Adobe applications administrator thought his past was behind him.

“You know, I did make a mistake back then,” he said. “There’s a difference between having it available on the county jail website … then to have it return on the first page in Google when you google your name. It seems like … extortion to me.”

See Also:

Computer Virus Leads to $20 Million Scam Targeting Pianist Cond Nast Got Hooked in $8 Million Spear-Phishing Scam Second Man Sentenced in Trojan Horse Bank Scam New York Times Reforms Online Ad Sales After Malware Scam Wisconsin Teen Gets 15 Years for Facebook Sex-Extortion Scam Malware Threatens to Sue BitTorrent Downloaders Costly Online Organ-Transplant Scam Results in Death, Arrest Lifelock Dinged $12 Million for Deceptive Business Practices

Black Hat 2011: Attack vectors, vulnerabilities and malware analysis

Hardcoded Password and Other Security Holes Found in Siemens Control Systems

A so-called Easter egg hidden in the firmware of a Siemens PLC depicts dancing chimpanzees and a German phrase. Siemens was unaware one of its programmers had inserted the egg into its program. Courtesy of NSS Labs

LAS VEGAS — A security researcher has uncovered a slew of vulnerabilities in Siemens industrial control systems, including a hardcoded password, that would let attackers reprogram the systems with malicious commands to sabotage critical infrastructures and even lock out legitimate administrators.

The vulnerabilities exist in several models of Siemens programmable logic controllers, or PLCs — the same devices that were targeted by the Stuxnet superworm and that are used in nuclear facilities and other critical infrastructures, as well as in commercial manufacturing plants that make everything from pharmaceuticals to automobiles.

Stuxnet was discovered on systems in Iran last year and is believed to have been aimed at destroying uranium-enrichment centrifuges at the Natanz nuclear facility in that country. It targeted Siemens Simatic Step7 software, which is used to monitor and program Siemens PLCs. It then intercepted legitimate commands going from the Step7 system to PLCs and replaced them with malicious commands aimed at sabotaging processes controlled by the PLC; in this case the spinning of centrifuges.

The newly discovered vulnerabilities go a step further than Stuxnet, however, in that they allow an attacker to communicate directly with a Siemens PLC without needing to compromise, or even use, the Step7 software.

One of the most serious security holes is a six-letter hardcoded username and password – “Basisk”; “Basisk” – that Siemens engineers had left embedded in some versions of firmware on its S7-300 PLC model. The credentials are effectively a backdoor into the PLC that yield a command shell, allowing an attacker to dump the device’s memory — in order to map the entire control system and devices connected to it — and reprogram the unit at will.

“I was able to log in via Telnet and http, which allowed me to dump memory, delete files and execute commands,” says Dillon Beresford, the security researcher with NSS Labs who discovered the password, and at least a dozen more subtle security holes.

Beresford, a security researcher with NSS Labs, had planned to discuss a few of the vulnerabilities at TakeDownCon in Texas in May, but pulled the talk at the last minute after Siemens and the Department of Homeland Security expressed concern about disclosing the security holes before Siemens could patch them.

Since then, he discovered additional vulnerabilities in several models of Siemens PLCs that would variously allow attackers to bypass authentication protection in the PLCs and reprogram them, or issue a “stop” command to halt them. They all require the attacker to have access to the network on which the PLCs run. That might be accomplished by infecting a legitimate computer on the network, such as with a phishing attack targeted at an employee, or through an infected USB stick — the method Stuxnet used.

Beresford will be presenting his findings on Wednesday at the Black Hat security conference in Las Vegas, but spoke with Threat Level in advance of his talk.

He’s been working with DHS’s Industrial Control Systems Cyber Emergency Response Team, or ICS-CERT, to validate and disclose the vulnerabilities and plans to withhold some information, as well as actual exploit code, until Siemens has a chance to patch the vulnerabilities that can be fixed. Not all of the vulnerabilities affect every model. Some of the vulnerabilities are inherent in the architecture of the systems and would require more than a patch.

One of the main vulnerabilities, he says, is that the systems have no defense against a so-called “replay attack”. An attacker could intercept commands going from any Step7 control system to any PLC – including a system in his own lab that he controls – and later play them back to any other PLC.

The attacker, for example, can capture a CPU stop command going from his own Step7 engineering workstation to his PLC, then replay the command back to another PLC to shut it down. He could also sabotage whatever the PLC is controlling by replaying malicious commands that would, for example, cause the speed of motors or rotors to increase on a centrifuge or cause valves to open or close on a pipeline.

If I could only replay the same traffic into my own PLC, that would constitute a vulnerability,” Beresford said. “The fact that I can record traffic going to and from my own PLC, and play them back to any PLC, thats what makes it a big issue.”

Generally, this kind of captured traffic should have a session ID that expires. But the Siemens PLC session never expires, Beresford said, so an attacker can use the captured traffic repeatedly, unless the PLC he’s attacking crashes and an administrator physically re-cycles it and then issues a run command to restart it.

Last May, Beresford revealed that he could conduct the replay attack against Siemens S7-1200 PLC model. Siemens said at the time that it believed the flaw did not affect other models of its PLCs, and last month the company announced that it had fixed the flaw in the S7-1200. But Beresford found that the flaw also exists in the S7-200, S7-300 and S7-400 models of Siemens PLCs.

It’s possible for an attacker to communicate directly with the PLC, without needing to use Siemens Step7 system, because Siemens’ PLCs dont restrict or otherwise limit which computers communicate with them. There are no rules in the PLC limiting traffic or commands to specific IP addresses or to specific computers with Step7 installed on them, Beresford said. The PLCs also do not keep logs to identify the computers that send them commands, so trying to identify the source of a malicious command a PLC received would be difficult.

Siemens did not respond to a request for specific comment about the vulnerabilities but said the company had sent several representatives to the BlackHat conference and is working with Beresford to understand and patch the vulnerabilities.

“ICS-CERT and Siemens have issued technical alerts/updates on this topic, and will continue to do so on an as-needed basis,” said Frank Garrabrant from Siemens SIMATIC Security Industry Automation Division, in a written statement.

Previously, Siemens has asserted that the attacks Beresford describes could be thwarted by air-gapping PLCs and their control computers from the internet. But according to Vik Phatak, CTO of NSS Labs, not all companies have a complete understanding of what constitutes an air-gapped system.

Weve talked to a number of different companies that have told us that their version of an air-gapped network [means] theres no inbound connection, but they definitely have outbound connections to the internet for their employees, Phatak said.

Even air-gapping a system would not work if someone plugged removable media containing malware into the system.

The only thing on the PLCs that would prevent an attacker on the network from communicating directly with the devices is an authenticated packet that passes from the Step7 machine to the PLC. But Beresford found a way to bypass this authentication protection.

Step7 machines authenticate themselves to a PLC using a hash generated from a password. The hash is stored inside a project file that gets sent from the Step7 machine to a PLC. If the hash matches a hash stored on the PLC, a switch on the PLC is flipped that allows a programmer to then read and write to the PLC. Beresford found that he could bypass this by capturing the authentication packet and replaying it to a PLC.

If you capture it, you have the authenticated packet, theres nothing the PLC can do to stop you, Beresford said.

Beresford could also do a replay attack to disable the authentication protection on a PLC. He’d simply issue a command to his own PLC to disable the password protection, then capture that command as it passed to his PLC and replay it to the PLC he wanted to attack.

“I can even change their password, so if I wanted to lock them out of their own PLC I could do that as well,” he said.

To find a PLC on a network, an intruder could introduce malware designed to scan the network for any devices operating on port 102 – the port the PLCs use to communicate – and map all of the PLCs on a network in order to attack them all, or target specific ones.

As for the hard-coded password, “Basisk,” that he found in the S7-300 firmware, Beresford says it was obfuscated by a basic shift sequence that involved swapping characters and shifting them to the right. It took him two and a half hours to decode the password. Beresford could only confirm that the hardcoded password existed in a specific version of the firmware on his S7-300 PLC – firmware version 2.3.4.

The credential would give a user command shell access on the PLC, allowing someone to reprogram the PLC or otherwise completely control it. The password also gives access to a memory dumping tool, that would allow an attacker to dump memory from the PLC in real time in order to gather intelligence on the PLC to devise a targeted attack.

He found he could dump SDRAM, uncached and cached, NOR flash, as well as other parts of RAM and scratchpad data. He could also obtain the serial numbers and tag names of devices connected to the PLC. All of these would allow an attacker to discover new vulnerabilities in the system and to determine what’s connected to the PLC and what normal operating conditions exist for those devices in order to design a worm like Stuxnet to attack them. An attacker could also write a worm that copied itself to a PLC – so that anyone who communicated with the PLC would be infected – or use the PLC to launch attacks against other machines on the same network.

Siemens has acknowledged that the password existed and said that developers had put it in the system for testing purposes, but then forgot to remove it.

ICS-CERT has issued an alert about the password (.pdf). According to the alert, Siemens discovered the password in 2009 and removed it from subsequent systems. But anyone using pre-2009 versions of the S7-300 firmware would likely still have the password installed.

Anything before October 2009, for the PLCs, in terms of the S7-300, would be affected by the hardcoded password, Beresford said.

Finally, Beresford also found an Easter egg in two versions of the S7-300 PLC firmware – versions 2.3.2 and 2.3.4. Its an html file that depicts a handful of dancing chimpanzees and a German proverb that is the equivalent of the English phrase, “All work and no play makes Jack a dull boy.”

Siemens was not aware the Easter egg was in the firmware. “They werent exactly happy,” Beresford said. “Considering where these devices are deployed, they didnt think it was very funny.”

While the Easter egg may have simply been a developer’s idea of fun, Beresford says he’s still examining it to see if its possible to send commands through the html page back to the PLC.

Siemens is beginning to move out patches for some of the vulnerabilities this week, but others will take longer.

See also:

• Fearing Industrial Destruction, Researcher Delays Disclosure of New Siemens SCADA Holes

Report warns of Android security issues, increased malware, Web attacks

LAS VEGAS According to a new report from Lookout Inc., smartphones running operating systemsbased on Google Inc.s Android mobile platform are now 2.5 times more likely to be infected by Androidphone malware than they were a mere six months ago.

Malware writers have become increasingly creative with the tactics they use to get users todownload malware.

 Kevin Mahaffey, co-founder and CTO, LookoutInc.

The San Francisco-based mobile security vendor issued its 2011 Mobile Threat Report on the heels ofthe BlackHat 2011 security conference, highlighting the increasing threats to smartphones and thedangers of Android devices.  Kevin Mahaffey, co-founder and CTO of Lookout, said in astatement that to develop its analysis of Androidsecurity issues, his team aggregated data from more than 700,000 apps and 10 million devicesworldwide.

Malware writers have become increasingly creative with the tactics they use to get users todownload malware, Mahaffey wrote in a blog entry announcing the report. Monetary motivations seemto be the primary goal, but the sheer amount of personal information stored in our smartphones alsobecomes a target for attackers to get creative.

Despite smartphone makers increasing use of sandboxing,a security feature that isolates apps from critical device processes, attackers are finding ways tobypass the restrictions to take control of the phone, according to the report. Lookout also saidthree out of 10 Android owners are likely to encounter a Web-based threat on their device annually.Malicious links have become more prevalent, the report added, as attackers are using a variety ofcommon phishing scams to lure users to attack websites.

In addition, Lookout predicted the increasing use of new malware distribution techniques, suchas malvertising , upgrade attacks and multi-stage attacks. Malvertising copies the way legitimatedevelopers use in-app advertisements to trick users into downloading malware from phony websitesimitating the Android Market. In a technique, which Lookout calls upgrade attacks, the developer ofa legitimate app waits for a large user base and then simply updates the app with malware.Multi-stage attacks use hidden code inside what appears to be a legitimate app to change itsbehavior based on a configuration change downloaded from a server.

Black Hat 2011

See all our news coverage and exclusive videos from BlackHat 2011.

Lookout reported the number of Android apps infected with malware went from 80 in January ofthis year to more than 400 in June. This is in part because malware writers are using existingmalware to create new, more dangerous variants. For instance, DroidDreamvariants accounted for more than 80 infected applications under a variety of developer names.The authors of GGTracker have published 15 infected apps across third-party Android app stores andalternative Android download sites. GGTracker signs users up for a premium SMS ringtone service,adding charges to the users monthly mobile bill. 

Lookouts report also asserts Apple iPhone users are not immune to Web-based attacks or mobilemalware, but that Apples App Store security restrictions and review process have helped keepcybercriminals from distributing malicious mobile apps. Apple iOS smartphones can be jailbroken,allowing a user to load applications from third-party sources, which Lookout said puts users at anincreased risk of infection.

Black Hat 2011: SIM rule maker on attacks and defenses

Black Hat 2011: Attack vectors, vulnerabilities and malware analysis

Mug-Shot Industry Will Dig Up Your Past, Charge You to Bury It Again

Ex-con Rob Wiggen gets hate mail daily for running a website that hosts 4 million mug shots.  Photo by James Branaman/Wired.com

Philip Cabibi, a 31-year-old applications administrator in Utah, sat at his computer one recent Sunday evening and performed one of the compulsive rituals of the Internet Age: the ego search. He typed his name into Google to take a quick survey of how the internet sees him, like a glance in the mirror.

There were two LinkedIn hits, three White Pages listings, a post he made last year to a Meetup forum for Italian-Americans in the Salt Lake City area. Then, coming in 10th place — barely crawling onto the first page of search results — was a disturbing item.

Philip Cabibi Mugshot, read the title. The description was Mug shot for Philip Cabibi booked into the Pinellas County jail.

When he clicked through, Cabibi was greeted with his mug shot and booking information from his 2007 drunk-driving arrest in Florida. Its an incident in Cabibis life that he isnt proud of, and one that he didn’t expect to find prominently listed in his search results four years later, for all the world to see.

The website was florida.arrests.org, a privately run enterprise that siphons booking photos out of county-sheriff databases throughout the Sunshine State, and posts them where Googles web crawlers can see them for the first time. Desperate to get off the site, Cabibi quickly found an apparent ally: RemoveSlander.com. You are not a criminal, the website said reassuringly. “End this humiliating ordeal … Bail out of Google. We can delete the mug-shot photo.

Cabibi paid RemoveSlander $399 by credit card, and within a day, the site had come through. His mug shot was gone from florida.arrests.org, and his Google results were clean.

“The RemoveSlander site was perfect. It seemed like it was just tailored to the mug-shot site,” Cabibi said in a recent telephone interview from Orem, Utah. “I searched ‘how to remove mug shots from florida.arrests.org,’ and the site was the first result. And I paid.”

‘Of course I’m not going to have my mug on my site.’

With that, Cabibi passed through one of the latest niche industries on the web: the mug-shot racket. ExploitingFlorida’s liberal public-records laws and Google’s search algorithms, a handful of entrepreneurs are making real money by publicly shaming people who’ve run afoul of Florida law.Florida.arrests.org, the biggest player, now hosts more than 4 million mugs.

On the other side of the equation are firms like RemoveSlander, RemoveArrest.com and others that sometimes charge hundreds of dollars to get a mugshot removed. On the surface, the mug-shot sites and the reputation firms are mortal enemies. But behind the scenes, they have a symbiotic relationship that wrings cash out of the people exposed.

Florida.arrests.org is the brainchild of a computer-savvy Florida ex-con named Rob Wiggen. The 32-year-old served three years in federal prison for participating in a small-time credit-card-skimming operation (.pdf) out of a Mexican restaurant in Tallahassee.

When he got out of jail in 2007, he was looking for more legitimate opportunities. Last year he seized on the idea ofrepurposingthe booking photos that Florida police departments are obliged to make public under the state’s sunshine laws.

Getting the photos is not completely straightforward: There is no central government repository. Instead, the mugshots and booking details are available on about five dozen different searchable web databases run by local police and sheriff’s departments. Wiggen said he wrote screen-scraping software to perform searches on 37 of the counties, crawling to get arrests stretching back years, and continuously polling the sites for new busts, which he scarfs down at a rate of 1,500 a day.

Robert Wiggen's 2005 mug shot.  Courtesy Leon County Sheriff's Office

Visitors to his site can comment on the photos, or browse them by tags like “Celebrity,” “Hotties,” “Trannies,” “Tatted up” and “WTF.” Most of the photos are of adults, but children as young as 11 are also on display if they’re accused of adult crimes.

Wiggen said he wasn’t setting out to shame or embarrass anyone: From his point of view, he’s getting free content, then monetizing it with Google AdSense banners hawking defense lawyers and bail bondsmen. But the end result is thatmug shots that were once hidden behind police CGI search scripts now display in Google searches, often prominently.

Wiggen’s own mug shot is noticeable absent from florida.arrests.org. “Of course I’m not going to have my mug on my site,” he told Wired.com.

His year-old business has earned him enemies. Wiggen said he receives about 100 angry e-mails, and a few snail-mail letters, every day from people whose booking photos are displayed on his site. “Obviously, they’re really nasty,” he said of the messages. “I never thought I’d get this backlash from individuals. I just never imagined it.”

Among his harshest public critics is the reputation-management company RemoveSlander.com. “Thousands of people are being criminalized by mug-shot websites that collect ad revenue at their expense!” snarls the company’s promotional YouTube video, “How To Remove Florida Arrests.org.”

“Even defendants whose cases were dismissed are finding their mugs hot on the internet,” the company’s website adds. “Every time someone clicks on your page to view your mug shots, sites like Florida Arrests earns a little more cash from Google…. We have perfected the art of fighting mug-shot websites.”

For $399, RemoveSlander promises to take that fight to florida.arrests.org, and force Wiggen to remove a mug shot. RemoveSlander’s owner, Tyronne Jacques — the author of How to Fight Google and Win! — said the removal fee pays for his crack legal team to deal with florida.arrests.org, and to force Google to get the URL removed from Google’s search index.

Asked how he accomplishes that, Jacques told Wired.com it was “a trade secret.” A recent press release from the company called the work “daunting.”

“It can’t happen by magic,” he said in a telephone interview. “There are legal means that we use…. There is a tremendous amount of work to get the photos down.”

Other sites offering the same service are also closed-mouthed about their methods. The site RemoveArrest.com often enjoys advertising right on Wiggen’s site through Google’s algorithm-driven AdSense program. Joe Ellis, the operator of RemoveArrest.com, said his method is “proprietary,” but that he’s used it to get “hundreds” of mugs removed at $129 each.

It turns out, though, removing mug shots from florida.arrest.org is not as labor-intensive or arcane a process as the reputation companies claim. The real trade secret is that Wiggen wants a small piece of the action.

Wiggen said he has provided RemoveSlander an URL for an automated takedown script on his site. A PayPal payment of just $9.95 willautomaticallypurge a mug shot from the site. For an expedited removal from Google’s index, which Wiggen’s code performs through Google’sWebmaster tools interface, the fee is $19.90. Wiggen said other removal sites also make use of that same URL, but he declined to name them.

RemoveSlander “presses a button and makes a payment, and my website handles it automatically,” Wiggen said.

Wired.com tried the interface independently, and for $19.90 we removed the mugshot of a randomly chosen misdemeanor defendant, which disappeared from the site inside 10 minutes.

Wiggen said about 750 mugs have been removed from florida.arrests.org since he launched the site last year — some of them he took down himself in response to e-mail requests, but most were performed by reputation-management firms like RemoveSlander. He appears content to let those companies take the lion’s share of the mug-shot removal profits.

The bulk of florida.arrests.org’s income comes from advertising, not mug-shot removal fees, he said, declining to otherwise discuss his revenue. “I’m not getting rich,” he said.

‘The business model seems to be to generate embarrassment and then remove the source of the embarrassment for a fee.’

The reputation companies, though, appear to be doing pretty well. Of the $399 that Cabibi paid to RemoveSlander, $19.90 would have wound up with the mug-shot site that exposed him in the first place, and $379.10 with the company that promised to “fight” for him. By its own count, RemoveSlander has removed more than 300 mug shots.

Wired.com asked RemoveSlander’s Jacques if it’s true he’s paying $19.90 for his $399 service. That end of the business, he said, was handled by a partner, who was not available to be interviewed. Ellis, the owner of RemoveArrest.com, would neither confirm nor deny his use of the automated takedown tool.

None of this appears to be illegal, but it demonstrates an unintended consequence of state transparency laws — of which Florida’s is among the nation’s strongest.

“The business model seems to be to generate embarrassment and then remove the source of the embarrassment for a fee,” said Steven Aftergood, director of the Project on Government Secrecy for the Federation of American Scientists, and one of the nation’s leading open-records advocates.

“So the whole practice is designed to exploit human weakness,” said Aftergood. “From an information policy point of view, it is also likely to have adverse consequences. People are more likely to say, ‘Who needs it, let’s seal all of these records.’ That would be an unfortunate consequence.”

The State of Florida is unapologetic about the market its mug-shot posts have enabled. “We are very public-record–friendly. We are one of the most transparent states out there,” Kristi Gordon, a spokeswoman for the Florida Department of Law Enforcement, said. “As soon as a photo is taken at a booking facility, it becomes a public record.”

Craig Rockenstein, assistant general counsel for the department, declined to discuss the matter. “I’ve been here 25 years, and that’s the first time I was ever asked that,” he said.

The sudden ubiquity of mug-shot websites has prompted David Haenel, a Florida criminal-defense attorney, to advise clients to surrender themselves to small town sheriff’s departments where bookings are so infrequent that Wiggen and others won’t bother scraping their web sites for fresh mug shots.

“I have them go to a county I know they are not scraping the data from,” said Haenel, who practices in Sarasota, Florida.

If someone does wind up on florida.arrests.org, though, Haenel will get the photo removed for a $1,250 fee through his own website, hidemymugshot.com. Haenel said he has helped about 25 clients do that in the last two months. He said he doesn’t know anything about the $19.90 removal script, and declined to describe how he gets the mug shots removed.

Now $399 poorer, Cabibi said he feels like he’s been played.

He said his arrest came during a lapse in judgment, when he drove home intoxicated from a Florida bar after watching college football in 2007. His blood-alcohol was almost double the legal limit. He pleaded no contest, paid a fine and did six months’ probation. The Adobe applications administrator thought his past was behind him.

“You know, I did make a mistake back then,” he said. “There’s a difference between having it available on the county jail website … then to have it return on the first page in Google when you google your name. It seems like … extortion to me.”

See Also:

Computer Virus Leads to $20 Million Scam Targeting Pianist Cond Nast Got Hooked in $8 Million Spear-Phishing Scam Second Man Sentenced in Trojan Horse Bank Scam New York Times Reforms Online Ad Sales After Malware Scam Wisconsin Teen Gets 15 Years for Facebook Sex-Extortion Scam Malware Threatens to Sue BitTorrent Downloaders Costly Online Organ-Transplant Scam Results in Death, Arrest Lifelock Dinged $12 Million for Deceptive Business Practices

Black Hat 2011 to focus on new hacking techniques, software flaws

LAS VEGAS The temperature is expected to be in the 100s in Nevada throughout this weeks BlackHat 2011 security conference, but the real heat will be on software companies and the peopleresponsible for securing their products.

The amount of mobile malware has been increasing.

Neil Daswani, CTO, Dasient Inc.

Security researchers will demonstrate newhacking techniques that probe networking devices, exploit holes in common database managementsystems and target vulnerabilities deep inside various operating systems. Other experts will revealresearch into the destructive power of new, more sophisticated malware strains designed to remainvirtually undetectable long after they penetrate target systems.

While the Black Hat presentations raise concern, nearly all security researchers hope their workwill aid in finding new ways to lock down sensitive systems and develop new threat-detectioncapabilities.

Security researcher Don Bailey will demonstrate how to remotely hijack a caralarm system, starting the vehicle by simply sending it a message. Bailey, a securityconsultant with security consultancy iSec Partners, has conducted extensive research intoweaknesses in GSM wireless phone networks. Bailey claims the attack is possible because most caralarms use a common interface and the GSM wireless network to receive commands. The attack iswide-reaching because it can work on traffic-control systems and GPS devices.

Bailey plans to release tools to help researchers identify devices that connect and remain idleon cellular networks. The software will allow mobile researchers to develop their own deviceprofiles and methods to interact with devices. The goal is to build in a set of new securitycontrols on the devices.

Meanwhile, another focus this week will be the Rustockspambot, a notorious botnet that was at one point responsible for 60% of the worlds spam. Tworesearchers at Milpitas, Calif.-based security vendor FireEye Inc. plan to show off theircontribution in taking down the botnet. Julia Wolf and Alex Lanstein of FireEyes MalwareIntelligence Labs said the techniques used in Operation b107, Microsofts coordinated legal andtechnical action against the botnet, can be generalized for the takedown of other botnets. The action enabled Microsoft to seize control of the servers behind Rustock, allowingresearchers to analyze their contents.

Law enforcement has a hard time prioritizing cases where you cant attach a dollar figure indamages to it, Lanstein said in an interview with SearchSecurity.com. Microsoft and Pfizer wereable to demonstrate that Waledeck and Rustock were able to show damages to their brand, whichhelped gain access to servers that we never had complete access to before.

Neil Daswani, CTO of Palo Alto, Calif.-based Dasient Inc., will demonstrate an attack against anAndroidsmartphone that uses a flaw in its Webkit browser engine and a coding error in Skype to bypassAndroids sandbox isolation security feature. Daswani said malware that targets smartphones willneed to be designed to find a way around most mobile operating system securityrestrictions. 

Black Hat 2011

Get more stories from Black Hat on our BlackHat 2011 special conference coverage page.

The amount of mobile malware has been increasing, Daswani said. Its not yet time to soundfive silent alarms, but if we are to make sure the future of mobile commerce is bright, we do needto ensure that threats do get addressed.

The focus will turn to weaknesses in cloud architecture when two members of WhiteHat SecurityInc.'s Threat Research Center, Matt Johansen and Kyle Osborn, show off serious holes in GoogleChromebooks, notebook computers that run the Google Chrome OS. Users of these new devicesprimarily use the Chrome browser to navigate the operating system and access email, files and otherdocuments on the Web.

In a Black Hat webinar last month, Johansen said the Chromebook platform is open to Web browserattack techniques. It uses a browser-extension trust model, Johansen said, and those extensions actlike Web applications, which can be attacked using the same techniques that cybercriminals havebeen using for years.

The exploits might look a little different, the target is not your hard drive or your CPUpower, but I want your information, Johansen said. We were able to steal your contacts and yoursession and I have some more cool things we were able to do that well demonstrate at BlackHat.

Alleged Miley Cyrus Hacker Pleads Guilty to Spamming From Hacked Celebrity Accounts

A hacker who boasted that he was responsible for stealing and posting provocative pictures stolen from Miley Cyrus’ Gmail account pleaded guilty on Monday to other charges involving credit card fraud and hacking.

Josh Holly, 21, pleaded guilty to possessing about 200 stolen credit card numbers, and to breaching celebrity MySpace pages in a spamming scheme that earned him at least $100,000.

Holly has never been charged with hacking Cyrus’s e-mail account, but after bragging online about this and other activity, and taunting authorities that they would never find him, his apartment in Murfreesboro, Tennessee, was raided in October 2007, at which point authorities found evidence of the cards and spamming scheme.

Holly, who went by the screen names “TrainReq,” “Rockz” and “h4x,” told Threat Level in 2008 that he had gained access to a Gmail account Cyrus had used (messagemebaby@gmail.com) and found images the Hannah Montana actress had purportedly sent to singer Nick Jonas of the Jonas Brothers.

Holly claimed that he tried to sell the pictures to TMZ.com and other celebrity outlets, but no one would buy them, given the illegal manner by which he’d obtained them. He then posted some of them online at digitalgangster.com, after which numerous gossip and celebrity websites published them for free. More photos followed thereafter.

The images showed the then-15-year-old Cyrus in a wet T-shirt in the shower, baring her midriff while blowing a kiss to a mirror, and posing seductively in her underwear and bathing suit.

Holly told Threat Level he got access to Cyrus’s Gmail account after obtaining unauthorized access to a MySpace administrative panel where he found passwords for MySpace accounts stored in cleartext. Holly said he obtained access to the administrative panel by social engineering a MySpace employee. Once inside the panel, he found the password Cyrus used for her MySpace account Loco92 and tried it on a Gmail account she was known to use.

In addition to stealing Cyrus’s password, he reset MySpace account passwords for a number of other celebrity MySpace users, then used their accounts for a spamming scheme that he said netted him about $50,000.

According to an affidavit (.pdf), Holly admitted to the FBI that beginning in 2005 he had hijacked numerous celebrity internet accounts to conduct spamming. An investigation of his bank records showed that between November 2007 and July 2008, he received more than $110,000 from companies for spamming on their behalf. Holly told Threat Level that half of his illicit income went to an accomplice in Israel who used the online nickname elul21 (Elul is the Hebrew name of a month on the Jewish calendar).

Holly also said that the celebrity MySpace accounts he accessed to conduct his spamming activity belonged mainly to recording artists and groups — Chris Brown, Rihanna, Linkin Park, Fall Out Boy. He accessed about 20 accounts. Once he had passwords to the accounts, he used the accounts to send bulletins to all of the friends on the MySpace accounts advertising a ringtone or call service for the recording artist. For example, he’d send out a bulletin from Fall Out Boy’s MySpace account telling fans that the band would call their phone and send them a ringtone if they clicked on a link and entered their details.

Holly said the advertising affiliates he worked for paid him between $5 and $12 per person who responded to the ad. The affiliates didn’t know he was spamming customers, he said, and when they found out they terminated their work with him and refused to pay him outstanding earnings.

Asked at the time charges were filed against him if he was concerned about the repercussions of his actions, he replied, “Theres no way I can get out of this at all. Not even OJ’s lawyers or Michael Jackson’s lawyers can get me out of this. To be blunt, I was an idiot and I didnt delete any of my [hard drives]. I never thought they would raid me. Theyre going to get full proof evidence of everything that Ive said Ive done.”

Holly’s sentencing hearing is set for October 31.

Photo: Mug shot of Josh Holly courtesy of The Smoking Gun

See also:

• Miley Cyrus Hacker Raided by FBI
• Miley Cyrus Hacker Used Celebrity MySpace Accounts for Spamming