ITACS 5211: Introduction to Ethical Hacking

Wade Mackay

Mengqi He

‘Frighteningly Easy’ Hack Guesses Full Credit Card Details in 6 Seconds.

by 2 Comments

Researchers from the UK’s Newcastle University have developed a so-called Distributed Guess Attack that essentially circumvents all security features for protecting online payments to steal card number, CVV and expiration date of any Visa card. The attack takes advantage of the manner that different online merchants request different types of information for processing a credit or debt card payment, even though most of them at a minimum require the card number or and expiry date. In addition, there is no mechanism currently in place to detect multiple invalid payment request made on the same card yet from different online merchant sites. Therefore, it is possible that a hacker to make unlimited times of guess on a card’s CVV or expiration date by spreading the guesses across multiple sites. Based on these two manners, an attacker can obtain full card details by automatically generating and verifying different combinations, and the process can be done through 1,060 and 60,000 attempts and takes only six seconds. The guessing attack worked only on Visa’s network. MasterCard’s network would quickly detect the guessing attack.

I was surprised that Visa would have such a great vulnerability in its credit and debt card payment process. As one of the world largest financial service corporation, Visa processed 100 billion transactions with a total volume of US $6.8 trillion. Over 1.5 billion credit cards are Visa cards. With such a large number of users and transaction volume, this vulnerability is an great challenge to Visa that it has to figure out an appropriate solution to improve this security issue and protect its customer information.

 

Link: http://www.darkreading.com/vulnerabilities—threats/frighteningly-easy-hack-guesses-full-credit-card-details-in-6-seconds/d/d-id/1327632

“Researchers Demo Method For Turning A PC Into An Eavesdropping Device”

by Leave a Comment

 

Recently, researchers at Israel’s Ben-Gurion University have devised a way to turn any computer into an eavesdropping device by surreptitiously getting connected headphones or earphones to function like microphones. This is made possible by reconfiguring an audio jacks from line-out to line-in. The malware takes advantage of the manner that some audio chipsets in motherboards and soundcards support a little-used jack re-mapping or a jack re-tasking option for changing the function of the audio ports from line-in to line-out via software. The fact that audio jacks can be programmatically switched from output only to input jacks creates a vulnerability that allows attackers be able to turn any computer into an eavesdropping device. A good news is that researchers also said that this was not easy to conduct this attack using the malware because it requires attackers to have full access to the computer and anti-malware tools would also likely spot and block the malware from working. However, to a company, the vulnerability on headphones should be paid attention as an important security risk. In this case, external attacks would be hard, but internal attacks are not. A resentful employee may get physical access to a manager’s computer and thus be able to install the malware that turns the computer into an eavesdropping device for monetary reason or revenge.

 

Link: http://www.darkreading.com/attacks-breaches/researchers-demo-method-for-turning-a-pc-into-an-eavesdropping-device-/d/d-id/1327567

“Shoppers Up Their Online Security Game, Survey Says”

by 1 Comment

In a recent Computop report, a survey of over 1,900 consumers in the US and UK indicated that 71% of consumers would check that SSL certificates of ecommerce sites they shopped, and 61% would check the liability policies. Respondents were also asked which biometric features they’d use for authentication, and fingerprints was the top choice (35%), but 41% rejected biometric authentication altogether. It was pleased to see that so many consumers are aware of the importance of ecommerce security. However, online sales kept growing because even though consumers knew the security risks of ecommerce, its convenience outweighed its security concerns.

The Black Friday and Cyber Monday are coming soon, and ecommerce companies are preparing for the boosting sales. On the other hand, fraudsters and cyber-gangs are also preparing for attacks targeting on both retailers and shoppers. Retailers should ensure that all site extensions are updated, the proper firewalls are configured on sites. Shopper need to avoid clicking on sketchy advertisements。

 

Link: http://www.darkreading.com/endpoint/shoppers-up-their-online-security-game-survey-says/d/d-id/1327463

“Some SuperPAC Websites Are Not Super-Secure”

by 1 Comment

A recent research found gaping security holes in several SuperPAC public websites that may expose personal information of donors and other sensitive data. These vulnerabilities range from weak or nonsexist encryption and open ports to old and outdated server platforms. Security firm UpGuard assessed the security posture of top SuperPACs actives in the 2016 US election, and found that most of them could reach the average level of security. SuperPACs do not store payment information, but they keep donors’ personal information. Exposing donors’ identifies is a great issue because the purpose of these organizations is to hide who’s giving money. The main vulnerabilities are due to lack of encryption, no email authentication to avoid phishing scams, open SQL ports, and no DNSSEC adoption.

Link: http://www.darkreading.com/vulnerabilities—threats/some-superpac-websites-are-not-super-secure/d/d-id/1327430

 

“Microsoft Launches Security Program for Azure IoT”

by Leave a Comment

Microsoft has launched a new security program for its Azure cloud platform to help improve customer’s security when they are dealing with the IoT. It is a response to customer requests fro increased security assurances as they deploy IoT products. Microsoft has partnered with security auditors to evaluate customers’ IoT infrastructure, detect security problems, and provide recommendations. Partners so far include Praetorian, Casaba Security, CyberX, and Tech Mahindra. The massive DDoS attacks on Dyn through IoT was a wakeup call for business that vulnerable IoT devices such as webcams, routers, printers and DVRs would easily become the security targets of attackers. IoT product teams struggles a balance between quickly releasing products to market and the risk of insecurity. IT experts said the security issues of IoT requires the entire ecosystem to work together and collaborate to ensure security.

One of the biggest IT news last week was the IoT-Based DDoS Attacks on Dyn. IoT security problems suddenly attracted everyone’s attention. Vulnerable devices in the IoT system with default setting were turned into “bots” under control of a malware to attack DNS. Since IoT products are increasingly used within organizations, their security and privacy issues should be the top concerns of organizations before implementation.

 

Link: http://www.darkreading.com/iot/microsoft-launches-security-program-for-azure-iot/d/d-id/1327350

“How To Crash A Drone By Hacking Its 3D Propeller Design”

by 1 Comment

Recently, researchers have demonstrated that how attackers can cause fatal equipment failures by destroying the integrity of 3D-printed parts. In a proof-of-concept experiment, they sabotaged the 3D printed replacement propeller of a quadcopter by maliciously modifying its design, and thus caused the quadcopter to fall from the sky. Researchers simulated how attackers could use spear phishing emails to obtain access to the target controller PC for 3D printing, and install malwares on the target. The malware then downloaded the blueprint, and replaced the original blueprint with the one with developed sabotaged design. In the experiment, researchers modified the design file by inserting 0.1mm internal rectangular gaps into the joint, and the sabotage would remain unnoticed by a simple visual inspection. The propeller performed normally in the first three test cycles, but broke apart in the fourth cycle. This experiment is designed to expose the threat additive manufacturing companies face from increasing use of 3D printing. There are increasing industries started to use 3D printed parts in their products, such as aerospace and automotive industries. The growth of additive manufacture also attracts attention of hackers from criminal gangs or terrorists.

One thing I think interesting is that the design defect could not be noticed through visual inspections, and the quadcopter could even normally perform in the initial test. This would be very dangerous if this kind of attack happens in the real life. For example, if the 3D printing blueprint of a replacement part of an airplane is maliciously modified, the airplane may be still able to pass the visual inspection and flight mechanical test. However, the unnoticed defect may lead to airplane failures or even air crash later in real flight. In addition, I think this kind of attacks can hardly be conducted by an individual, because it requires both IT experts and experts with knowledge and experiences in the targeted industry. Therefore, this kind of attacks may attract more attention of terrorist organizations with adequate resources rather than normal hackers. This would become a great threat to governments, since many countries have already used 3D printing for weapon and aircraft manufacturing.

 

Link: http://www.darkreading.com/endpoint/how-to-crash-a-drone-by-hacking-its-3d-propeller-design/d/d-id/1327244

“Public Wi-Fi Use Grows, Despite Security Risks”

by 3 Comments

People expect public Wi-Fi at nearly all the places we go and expect to be connected all the time. Wi-FI users regularly connect to Wi-Fi in their homes, but they require mobility. According to the survey of Xirrus, a Wi-Fi tech company, 49% of them connect to public Wi-Fi at least three times a week, and 31% connect everyday. 89% of users connect to more than one network a day because people would switch to home and work Wi-Fi networks which are private, safe and only accessible to selected users. In addition, 70% of users are even willing to change hotels for better connection and security, but the need to be connected overcomes security concerns. Few public Wi-Fi networks encrypt and protect our data when we connect. This means private information are at risk of being stolen every time a person connect to a public Wi-Fi. Although 91% of the respondents admit that public Wi-Fi is insecure, 89% use it anyway. That means most of users are aware of the security risk of public Wi-Fi, but most of them decide to ignore it. The good news is that most public Wi-Fi networks holding by restaurants, airports or hotels are required to upgrade to provide better security for customers. Over public Wi-Fi, 83% of users access their emails, 68% of users access social medias, and 18% even log in for online banking. Although most of users know phishing, but there are still 30% of users unfamiliar to ransomware that is a malware installed on a victim’s computer, executes attacks to encrypt or access to your data and demands a payment to decrypt it or not publish it. The number of victims and the amount of demanded payment keeps increasing. 85% of users would blame themselves for.  hacks, while only 32% would blame Wi-Fi vendors and 24% would blame the venue. Wi-Fi users have to take the burden because most business do not educate their employees or provide necessary tools to help them stay safe. 46% of employees said that they didn’t receive any security training, and only 39% said they received one to two trainings in the past year. Companies should have their employees educated and trained regularly to ensure that they are always aware of the importance of security and won’t put their personal or work-related information under the risk of being exposed. However, there is still a large gap between employers encourage secure behavior and those do not. 47% employees are encouraged to use VPN for working when they are traveling for business. The good news is that most public Wi-Fi networks holding by restaurants, airports or hotels are required to upgrade to provide better security for customers.

 

Link: http://www.darkreading.com/cloud/public-wi-fi-use-grows-despite-security-risks/d/d-id/1327206

“Businesses Sacrifice Security to Get Apps Released Faster”

by 2 Comments

Recently, many organizations that struggled to deliver strong protection under the pressure of the app economy, decided to compromise on security to get apps released faster. This would be a great risk to both companies and their customers or app users. Since the app economy is bringing new cyber security challenges, companies should increase the complexity of their security practice to better protect customer’s information against attacks, instead of cutting corners. Customers also expect rapid and secure experiences. If they think that app is not secure, they would switch to an alternative app immediately. One way the article mentioned to respond to the new challenges of app economy is identity-centric security. The identity-centric approach uses behavioral analytics and predictive strategies to verify identities and mange identity-related activities without sacrificing the customer experience. In addition, the security team must work together with app development team in every phase of the development process to ensure security is integrated into the app.

Security is usually the greatest concern on e-commerce and e-banking. Even though the company is under intense pressure due to fierce competition in the market and the rising demand of customers. It is obviously not a wise decision to compromise on security for faster release. This compromise will cause serious risks to the company. The app will be vulnerable to hacking or malicious attacks, and hackers may steal customers’ information or credentials for financial purpose or illegal use. Therefore, the company may involve into litigations. Their reputation may be damaged and customers will switch to other apps since there are so many similar apps available in the market. The risk of loss outweighs the benefit of faster release.

 

Link: http://www.darkreading.com/application-security/businesses-sacrifice-security-to-get-apps-released-faster/d/d-id/1327151

“How A Pair of Cybercriminals Scales Its Carder Business”

by 4 Comments

Security vendor FireEye recently published a report describing the carder business of two cyber criminals called “Vendetta Brothers.” The two cyber criminals are likely operating out of Spain and Eastern Europe. They currently operate an underground website for selling stolen credit and debit card data from 639 banks in 41 countries via phishing attacks. They offer about 10,000 cards for sale, which is relatively small comparing to other carder business. One interesting thing is that how the brothers operated to scale their criminal business. They diversified their business using legitimate business tactics like outsourcing. One tactic is that they partnered with hacker without malware to obtain card data but have gained access to POS terminals remotely or physically. The brothers have the hackers to di the dirty work and so they can focus on higher-level planning. One thing I’m surprised is that the data of 10,000 stolen cards is still considered as small carder business. If 100,000 cards are considered as a large business and there are 10 carder businesses exist, 0.1% of world’s credit card information may be stolen, since the number of world’s credit cards is around 1 billion in 2015. Another thing is that even hackers now are able to use business tactics to mange and scale their operations. They use legitimate tactics to do illegal business. It makes me think about one of the largest criminal organization, Yamaguchi-gumi in Japan. It operates more like a company rather than a criminal organization. It does have criminal activities like arms trafficking and bank fraud, but it also does legitimate business.

 

Link: http://www.darkreading.com/vulnerabilities—threats/how-a-pair-of-cybercriminals-scales-its-carder-business/d/d-id/1327066