Classifying Hacking in 4D: Impact, Illegality, Evilness and Complexity

This chart is an attempt to classify hacking events and methods with something more than the simple black, white and grey hat hacking classification. After looking through a number of different possible attributes, the ones I came up with were the following, each rated on a scale of 0 to 10.

• IMPACT
  what sort of damage has been done to systems or to finances. a score of 0 means an improvement was made to the system due to the hack.
  
• ILLEGALITY
  where on the legal scale does the event lie in the range of 100% legal to 100% illegal, or it might be a bit of a "grey area"?
  
• EVILNESS
  yes, a bit subjective I know, but can we generalize that the motivation of the attacker is good, evil or maybe something in between?
  
• COMPLEXITY
  how complex was the attack, is it a simple DDOS or an advanced threat like an online banking password stealing botnet?

Please note that this is just the first draft of the chart, and I've guesstimated the above data as best as I could. This is an attempt to see how the chart feels when classifying hacking methods.

Any comments would be most appreciated.

Follow @dodgy_coder

Subscribe to posts via RSS

Online Banking Safety

Specialist eBanking Malware

• Specialized trojan malware infecting PCs used for internet banking are becoming prevalent.
• For example the ZeuS Trojan or SpyEye Trojan are both designed to infect a Windows-based PC and enlist it into a botnet of controlled PCs, from which can be harvested online banking usernames, passwords and credit card credentials.

What Happens During An Attack

• The trojan malware only becomes active when a user on the infected computer connects to a bank website, during which the trojan starts to record account details, passwords and other confidential information.
• The trojan malware will typically add one or more new employees or payee accounts in the name of "money mules".
• A transfer between $1,000 and $10,000 will be made to a "money mule" account - a legitimate bank account held by a real customer. 
• Owners of these "money mule" accounts have agreed to transfer sums they receive to someone else, after taking a cut. They are often unaware of being involved in a crime, and are typically targeted by "work at home" type scams offering easy money, or given some other legitimate reason why they are required to transfer the money.
• By the time the police have investigated the attack, the recipient of the money will usually have collected the transferred money, and is usually residing outside of the country of both the victim, and the money mule.

The Source of the Problem

• The source code for the ZeuS Trojan was originally offered for sale for approx $10000 to enable criminal gangs to control their own botnet or customise it for their particular market's needs.
• The source code of the ZeuS trojan has now been leaked and is available for free (or at a nominal cost) on hacker forums.
• The leak of the ZeuS source on May 7, 2011 is described here.
• The SpyEye 'builder' crack was leaked on August 11, 2011, as described here. 
• French security researcher Xyliton, part of the Reverse Engineers Dream (RED) Crew reverse engineered the 'builder' (the tool that generates the SpyEye malware) and was able to crack its hardware identification (HWID) layer which locked the SpyEye builder to a particular physical device.
• The cracked SpyEye builder enables new trojan developers to avoid the attribution that was previously associated with the high-priced toolkit and launch their own, untraceable versions of SpyEye. Where previous trojans built using the kit could be traced back to the original buyer of the toolkit, this will make it more difficult to track SpyEye botnets back to the source, since they have no attribution.

A Virtual Turf War: ZeuS vs SpyEye 

The ZeuS malware package has been around long enough to earn the title "crimeware toolkit" from Symantec. The relatively newer SpyEye, first seen in 2010, includes a component called KillZeus that destroys its "competitor", ZeuS, on any machine they share. In addition to eliminating a competing botnet operator on an infected machine, being able to delete the older ZeuS Trojan gives the newer SpyEye operator a pre-configured bot which has already proven that its owner isn't going to discover the infection immediately. In both ZeuS and SpyEye, the malware developers have tried to build anti-kill functions into their own malware, so ZeuS can now defend itself against SpyEye's KillZeus module. It seems that in the world of botnet development, as with legitimate product sales, existing victims (read customers) are a lot more stable and valuable than new, unproven ones.

Attack Prevention and Mitigation Methods

• Ensure an up to date browser and operating system.
• Avoid Microsoft Internet Explorer if possible; Mozilla Firefox and Google Chrome are generally safer.
• Ensure an up to date and effective commercial anti-virus software is installed.
• If possible use a dedicated PC specifically for commercial internet banking only. This means it will see no general-purpose internet usage, and is therefore less likely to get infected.
• Change online banking passwords regularly, at least once per month for commercial internet banking.
• Implement two-factor authentication for banking/payroll transfers.
• Ask your bank to remove or restrict the capability to add new employees and/or new payee accounts from your online account. Replace this operation with a secure method, requiring at least two factor authentication and/or phone support.

Recent Cases of Businesses and Organisations Targeted by Banking Trojans

July, 2011   Total scammed: $217,000
Metropolitan Entertainment & Convention Authority (MECA), a nonprofit organization responsible for operating the Qwest Center in Omaha, Nebraska was targeted by unspecified malware infecting one computer via an email attachment. Details here.

July, 2011   Total scammed: $28,000
The Town of Eliot, Maine - the PC belonging to the town controller was infected with unspecified banking trojan malware. Details here.

February, 2011   Total scammed: $150,000
Port Austin, Michigan based United Shortline Insurance Service Inc., an insurance provider serving the railroad industry, discovered on Feb. 5 that the computer used by their firm’s controller had been infected with the ZeuS trojan. Details here.

January, 2011   Total scammed: $378,000
The town of Poughkeepsie, New York was hit by unspecified cyber criminals from Ukraine who took over control of their online bank account. Details here.

November, 2010   Total scammed: $63,000
Green Ford Sales of Abilene, Kansas was infected with the ZeuS trojan malware.  Details here.

October, 2010   Total scammed: $600,000
The city of Brigantine, New Jersey had their online banking credentials compromised by unspecified malware.  Details here.

March, 2010   Total scammed: $465,000
California-based real estate escrow company, Village View Escrow infected by the ZeuS trojan. Details here.

November, 2009   Total scammed: $200,000
Plano, Texas based Hillary Machinery Inc. was hit by cyber criminals from Romania and Italy who transferred $801,495 out of their account in 48 hours. In this case the bank, PlainsCapital, managed to retrieve roughly $600,000 of the money. Details here.

Follow @dodgy_coder

Subscribe to posts via RSS

2011 Year of the Hack: A Timetable of Ownage

Click to Enlarge...

Click to Enlarge...

Follow @dodgy_coder

Subscribe to posts via RSS

AntiSec Hacks US Law Enforcement: 10GB of Emails and Data Made Public

The home page of the website where AntiSec have dumped the leaked data

In retaliation for recent arrests, the AntiSec hacking group say they've released their "largest cache yet" of data stolen from law enforcement agencies in the US, and have dubbed it "Shooting Sheriffs Saturday".

The Leaked Data Contains:

• Over 300 email accounts from 56 law enforcement domains, totaling more than 200,000 messages.
• 7000+ home addresses, usernames, passwords, phone numbers, credit card numbers, and SSNs (Social Security Numbers) from the Missouri Sheriff account dump (mosheriffs.com).
• Online Police Training Academy files (PDFs, videos, HTML files).
• List of "Report a Crime" informants (60+ entries).
• Plesk (Website administration tool) server passwords giving access to FTP, SSH, Email, CPanel and .HTACCESS Protected directories.

Recent Arrests
Law enforcement around the globe have arrested several suspected Anonymous members in recent days, including the UK's Jake Davis who is suspected to be LulzSec spokesman Topiary. Before this came the arrests of 16 people in the US, four in the Netherlands, and a 16-year-old in London (suspected to be LulzSec member Tflow) as part of a global investigation into denial-of-service attacks on PayPal late last year in support of WikiLeaks, and other attacks. The AntiSec release says this attack was made "in solidarity with Topiary and the Anonymous PayPal LOIC defendants as well as all other political prisoners who are facing the gun of the crooked court system".

DHS Bulletin
One of the motives for AntiSec seems to be a recent DHS (US Department of Homeland Security) bulletin.

From AntiSec: "A recent DHS bulletin has called us "script kiddies" that lack "any capability to inflict damage to critical infrastructure" yet we continue to get in and out of any system we please, destroying and dropping dox on the mightiest of government systems that are supposed to be protecting their sick nightmare of "law and order". GIVE UP. You are losing the cyberwar, and the attacks against the governments, militaries, and corporations of the world will continue to escalate."

Here are the two relevant passages from the DHS bulletin which seem in particular to have irked AntiSec:

1. "The actors who make up the hacker group “Anonymous” and several likely related offshoots like “LulzSec”, continue to harass public and private sector entities with rudimentary exploits and tactics, techniques, and procedures (TTPs) commonly associated with less skilled hackers referred to as “Script Kiddies”. [Script Kiddie: Unskilled individuals who use scripts or programs developed by others to attack computer systems and networks and deface websites.] Members of Anonymous routinely claim to have an overt political agenda and have justified at least a portion of their exploits as retaliation for perceived ‘social injustices’ and ‘freedom of speech’ issues.  Attacks by associated groups such as LulzSec have essentially been executed entirely for their and their associates’ personal amusement, or in their own hacker jargon “for the lulz”. 
2. "So far, Anonymous has not demonstrated any capability to inflict damage to critical infrastructure, instead choosing to harass and embarrass its targets."

How they did it
The initial compromise to the sheriff websites was done about two weeks ago on Arkansas-based web designers Brooks-Jeffrey Marketing (BJM), which hosts sheriff association websites.  The hackers say they were easily able to get back into the compromised servers after they were taken offline to have their security beefed up by the law enforcement agencies. "We were surprised and delighted to see that not only did they relaunch a few sites less than a week later, but that their 'bigger, faster server that offers more security' carried over our backdoors from their original box. This time we were not going to hesitate to pull the trigger: in less than an hour we rooted their new server and defaced all 70+ domains while their root user was still logged in and active."

An internet security expert claims AntiSec may have gone after the sheriffs' offices because their hosting company was an easy target. Dick Mackey, vice-president of consulting at SystemExperts of Sudbury, Massachusetts, said many organizations did not see themselves as potential targets for international hackers, causing indifference that could leave them vulnerable. "It seems to me to be low-hanging fruit," he said. "If you want to go after someone and make a point and want to have their defences be low, go after someone who doesn't consider themselves a target."

In a further embarrassment, AntiSec used the stolen credit card details to make donations to the American Civil Liberties Union, the Electronic Frontier Foundation, and the Bradley Manning Support Network, according to the statement. They are strong supporters of whistle-blower site WikiLeaks and Manning, the Army soldier arrested last year for leaking classified data to the site.

Links

AntiSec's original media release: http://pastebin.com/iKsuRkUj

The AntiSec statement signs off with some poetry/rap:

I take a left at the light, turn off the headlights and ride real slow
Now holla at me when you see the 5-0
Alright Dirty, yall boys ready?
Bout to turn drive-bys revolutionary
*POW POW POW POW POW* YEAH MUTHAFUCKA YEAH!
*POW POW POW POW POW* YEAH MUTHAFUCKA YEAH!
Look at 'em run, too scared to pull they guns
Outta shape from them coffees and them cinnamon buns
This shit is fun, how I feel when the tables is turned
Hollow tips hit yah flesh through yo vests and it burn
That's a lesson you learn, comin straight from the slums
And it don't stop till we get full freedom

Follow @dodgy_coder

Subscribe to posts via RSS

McAfee Operation Shady RAT: A Media Storm is Unleashed

On Thursday morning August 4, I switched on the radio on the way to work to listen to the news headlines by the local radio station and was gobsmacked to be hearing them talking about the "biggest cyber attack" ever having been found by McAfee, dubbed Operation Shady RAT. For the first time I can every remember, an infosec story had made it on the news headlines of my local radio station, and in the process gained some valuable PR and credibility for McAfee...

How it played out

The storm of media interest was sparked at 9.14pm, Tuesday night US time, August 2, when the original blog post and research report was released by McAfee researcher Dmitri Alperovitch. The first media article appeared on Vanity Fair which was given the web exclusive story first.

Many thousands of other media outlets then ran with the story on the following day (Wednesday), typically
summarising the research report, with many claiming it to be the biggest cyber attack in history. Many also pointed the finger of blame squarely at China, without any real evidence. Jim Lewis, a cyber expert with the Center for Strategic and International Studies who was briefed on the hacking discovery by McAfee, said it was very likely China was behind the campaign because some of the targets had information that would be of particular interest to Beijing. "Everything points to China. It could be the Russians, but there is more that points to China than Russia," Lewis said.

The facts of the case, as presented by McAfee's report

• Botnet-like malware communicating with a single C&C (Command and Control) server was found on the 72 infected computers.
• A variety of different exploits were used to gain access to the victims computers, largely through spear phishing type attacks.
• 72 organisations were identified across a swathe of areas including government, industrial, technology, defense, sporting, corporate and non-profit NGOs.
• 49 of the victims were from the USA.
• There was no evidence presented of any specific or important data being lost.
• There was no mention of the total number of unique IP addresses that were found to be infected.

The research report clearly states that "In all, we identified 72 compromised parties (many more were present in the logs but without sufficient information to accurately identify them)". In an interview on Friday with Risky.biz, Sean Duca of McAfee Australia contradicted the research document by pointedly remarking that the total number of infected hosts was limited to only the 72 organisations listed in the report. However, in an interview with PC Mag, Dmitri Alperovitch said "I think it's fair to assume, that if you look at the totality of activity that's occurring, it's in the thousands of targets".

As Graham Cluley of Sophos' Naked Security Blog stated "What the report doesn't make clear is precisely what information was stolen from the targeted organisations, and how many computers at each business were affected." Cluley decried the way the media has rushed to blame China for the attacks. "I don't think we should be naive. I'm sure China does use the internet to spy on other countries. But I'm equally sure that just about *every* country around the world is using the internet to spy. Why wouldn't they? It's not very hard, and it's certainly cost effective compared to other types of espionage." he wrote.

Hon Lau from Symantec has poured cold water on the "biggest cyber attack" headlines surrounding the case - "While this attack is indeed significant, it is one of many similar attacks taking place daily." He also outlines the way the attackers used spear phishing to target individuals, typically through email attachments including Word documents, Excel documents, PDF files or PowerPoints. "These files are loaded with exploit code, so that when the user opens the file the exploit code is executed, resulting in the computer becoming compromised." he wrote.

One thing is for sure, it may not have been the biggest cyber attack in history, but it is certainly one of the most successful infosec media releases ever made, and for that McAfee must be congratulated: at least it has again focused some much needed attention in the media for such an important topic.


Follow @dodgy_coder

Subscribe to posts via RSS

Bitcoin Price vs Google Search Trend: Correlation

An interesting relationship has come to light between the closing price of Bitcoin (on the MtGox USD exchange) and the level of interest in Bitcoin as measured by Google Insights for search. The above data was taken for the last 90 days. The faint blue line represents the search interest in the term "bitcoin" and the dark black line represents the closing price of Bitcoin on the MtGox USD exchange.

Is Bitcoin a Bubble?

As the Bitcoin wiki itself states, yes, Bitcoin is a bubble, but only insofar that the US Dollar and Japanese Yen are also bubbles, i.e. they only have value in exchange and no value in use by themselves. If a loss of confidence occurred in any currency, its value could drop dramatically overnight.

The definition of a Speculative Bubble on wikipedia lists a number of possible causes, not least of which are those related to crowd psychology, such as the greater fool theory, which identifies bubbles as being driven by the behavior of irrationally exuberant market participants (the fools) who buy overvalued assets in anticipation of selling them to other speculators (the greater fools) at a much higher price. Another related explanation lies with herd behavior, the observation that speculators tend to buy or sell in the direction of the market trend. This is sometimes pushed along further by market analysts, who try precisely to detect those trends and follow them, which creates a self-fulfilling prophecy.

A well known side effect of a bubble is that market participants with overvalued assets will tend to spend more because they "feel" richer, due to the wealth effect. In history, bubbles have been observed repeatedly in experimental markets, wherever there is some degree of uncertainty, and when market participants find it difficult or impossible to calculate the intrinsic value of the assets.

The phases of a classic bubble

Now lets compare the bubble chart above with the actual year to date (up to Aug-11-2011) closing prices of Bitcoin on the MtGox exchange. Yeah, its looking more like a bubble every day, even if the scale doesn't quite match those of the classic bubble phases.

Follow @dodgy_coder

Subscribe to posts via RSS

Confessions of a Cyber-stalker: CA Criminal gets 4 years

A recent cyber-stalking case in a Californian court has highlited the weakness of password reset 'security questions' which can be easily guessed by the attacker when some basic details of the victim are already known or even already public on social media sites like Facebook.

George Bronk, of Sacramento, California, was sentenced to more than four years in prison after being convicted of computer intrusion and the cyber-stalking of 46 women across 17 states. He carried out the cyber-stalking for a total of 10 months, from December 2009 through to September 2010, when he was eventually caught. The case illustrates the vulnerability of all Internet users, said prosecuting attorney Robert Morgester of the state attorney general's office. "The victims we went to said `I had very robust passwords.'. But it didn't matter how robust the password was if the recovery question is easy." he said.

The method he used has revealed a major weakness in many password reset systems where a supposed secret question is posed to the account holder in order to recover a lost password. Such questions often include such basic choices as 'What is your favorite color?', 'Name of your high school?', 'Name of your first pet?', 'Town where you were born?'. Often, the answers to these questions can be quite easily gleaned from Facebook or other social network pages, which is exactly what Bronk did in this case.

His first step was to identify the email address of a potential victim on Facebook, and then try to determine the answer to their secret password reset question. After he changed their password and took over their email account, Bronk then searched email folders for nude or semi-nude photographs or videos they had sent to their husbands or boyfriends and then distributed them to the victims' contact list, prosecutors said.

The hacking method is similar to that of the famous Sarah Palin email hack, in which the hacker managed to reset her password simply by Googling for the answer to her secret question, which was “Where did you meet your spouse?”.

Academic research back in 2009 ran a user study to measure the reliability and security of the questions used by the four big webmail providers (AOL, Yahoo!, Microsoft and Google). They asked participants to answer these questions and then asked their acquaintances to guess their answers. Acquaintances were able to guess 17% of their answers on the first attempt. The researcher's conclusion was that the security of personal questions appears significantly weaker than passwords.

Another study showed that password recovery security questions are usually answered honestly. This study asked acquaintances of 32 webmail users to guess the answer to the secret question. Roughly 20% of these answers were guessed correctly.

The conclusion then is that password recovery security questions should probably not be answered honestly. Experienced users fill them out with password like characters which makes the answers significantly harder, and even more or less impossible to guess. These answers can then be stored in password managers as notes.

Further Reading:

• How to choose a good password
• Free online tool to find out if your email has been hacked

Follow @dodgy_coder

Subscribe to posts via RSS