The first Cyber Grand Challenge; using AI to hunt bugs. What could go wrong?

Subject: General Tech | February 6, 2017 - 06:36 PM |
Tagged: darpa, ai, security, Usenix Enigma 2017

DARPA hosted the first Cyber Grand Challenge last summer, in which the software from seven machine learning projects competed to find and patch vulnerabilities in a network, and to attack each other.  While the specific vulnerabilities discovered have not been made public you can read a bit about what was revealed about the contest at Usenix Enigma 2017 over at The Register.  For instance, one of the programs managed to find a flaw in the OS all the machines were running on and then hack into another to steal data.  A different machine noticed this occurring and patched itself on the fly, making sure that it was protected from that particular attack.  Also worth noting is that the entire contest was over in 20 minutes. 

enigma-logo.png

"The exact nature of these new bug types remains under wraps, although we hear that at least one involves exploitable vulnerabilities in data queues."

Here is some more Tech News from around the web:

Tech Talk

 

Source: The Register

Dropbox now offering randomly accessible memories

Subject: General Tech | January 24, 2017 - 05:35 PM |
Tagged: security, dropbox

Dropbox has been around long enough that you see it used in a variety of situations, sharing recipes, press releases and holiday snaps, all perfectly reasonable scenarios.  Unfortunately you also see it used as an alternative to SFTP in business, as some clients and executives are less afraid of the pretty blue colours than they are of the folder lists and text that FTP programs present. 

This can present a security problem and possible legal risk as the terms and conditions Dropbox sets may not exactly match what you and your client agreed to.  Case and point today is the news that many users were gifted with a trip down memory lane as files deleted from Dropbox years ago suddenly made a reappearance.  Dropbox states in their retention policy that files which are deleted should be unrecoverable after 30 days but it seems we have more proof that the Cloud never truly forgets.  Think back to what you, or people you know, might have shared on Dropbox and consider it coming back to haunt you a decade down the line before you upload.  You can follow the links from [H]ard|OCP back to the initial forum report and Dropbox's response.

f5821a10f83327805232a4bf2ccb3036.jpg

"This article is merely entertaining if you stay within the headline, but it becomes disturbing once you get into the story and realize that Dropbox’s policy is to keep deleted files only for 30 days. Ever the cynic, I will go ahead and consider the possibility that the file hosting service has been consciously keeping files around forever."

Here is some more Tech News from around the web:

Tech Talk

Source: [H]ard|OCP

Symantec's Sorta Secure Sockets Layer

Subject: General Tech | January 23, 2017 - 05:21 PM |
Tagged: SSL, security, symantec

Symantec may not have chosen their partners wisely as once again we see some questionable SSL certs being released into the wild by one of their audited partners.  For a while last week, some rather questionable domains had Symantec issued SSLs, offering a wide variety of possible attack vectors for anyone nefarious enough to take advantage of the fact.  Thankfully this does not happen often, though The Inquirer points out that it is nothing new, as it casts doubt on how secure an SSL site actually is.  Symantec promises to investigate what happened and release that information publicly; we can only hope they also learn from it.

symantecnewlogo.0.png

"Andrew Ayer of certificate vendor and wrangler SSLMate went public with his discovery last week. The mis-issued certs were issued for example.com, and a bunch of variations of test.com (test1.com, test2.com and so on)."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register

Practice safe programming

Subject: General Tech | January 18, 2017 - 05:39 PM |
Tagged: security, mostly harmless, google play, andriod

Fallible is a security firm which developed an automated tool for reverse engineering Android apps and used it to take a look at a large portion of the top apps on Google Play.  They found quite a few things that really should not have been there, including keys to Amazon Web Services which would grant them the ability to start and stop instances under the developers account.  In total they found 2500 apps with at least some sensitive information contained within them, in many cases those keys were necessary for the proper functioning of the app but in some cases they were secrets which did not need to be there.  Follow The Register's advice and think long and hard before hard coding keys into any apps you might be developing.

index.png

"A security firm has reverse engineered 16,000 Android apps on Google's Play store and found that over 304 contain sensitive secret keys."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register

Hack inflight entertainment crashes planes! Ya, not so much ya nutter

Subject: General Tech | December 20, 2016 - 06:04 PM |
Tagged: security, fud

You will probably see a headline picked up from the Telegraph warning of how hackers can use the in-flight entertainment systems to cause planes to crash; please ignore it.  Pilots do not generally log into a secret part of the interface on your setback screen to control the airplane, they have a separate system which is not about to be overridden by someone screwing with that system.  On the other hand they could force everyone to watch a Rob Schneider movie, which might be worse.  The Inquirer also suggests playing with cabin lighting or broadcasting fake announcements, as annoying as the teenager chatting away on the phone next to you or the child screaming in the background.  There were some reasonable suggestions in the article, which you can see here.

images.jpg

"LADIES AND GENTLEMEN, THIS IS YOUR PILOT SPEAKING. It turns out that hackers may be able to fiddle with the in-flight entertainment system on board and take control of the plane."

Here is some more Tech News from around the web:

Tech Talk

Source: The Inquirer

Stop paying the ransomware you idiots! You get nothing back and encourage them to continue!

Subject: General Tech | December 16, 2016 - 05:47 PM |
Tagged: ransomware, security, idiots, backup

To anyone working in the field, it will come as no surprise that almost half of the 1600 businesses and consumers in the survey quoted at The Inquirer have been the victim of a ransomware attack.  What will come as a disappointment to you is that 70% of those who were infected paid the the ransom, 25% of them between $20,000 to $40,000.  Shockingly the majority of those who paid the ransom got nothing back; after all how could someone who makes money by purposefully infecting machines not honour their word?

If you are infected with ransomware you have lost the data, pure and simple.  Reimage and move on, this is why you have backups.  It is painful and frustrating but if you pay the bitcoins you are not going to get anything back and are encouraging them to continue by making this a lucrative business.  Just as it is with spam, it takes only a tiny percentage to fall for it to make it profitable.  Go and back your stuff up, twice.  If you need a stocking stuffer for someone get them an external drive or a subscription to an online backup service, look into CryptoDrop or a similar program.  Just don't give them bitcoins

536px-Triple-facepalm.jpg

"The report suggested that as many as 46 per cent of the respondents had been affected by ransomware and that 70 per cent of these had admitted to paying the ransom, contrary to the advice of law enforcement agencies."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register

Friends don't let friends perform unattended updates ... or Bitlocker be broken

Subject: General Tech | November 30, 2016 - 07:10 PM |
Tagged: bitlocker, microsoft, windows 10, security, hack

Is Bitlocker cramping your voyeuristic cravings and preventing you from snooping on your loved ones or strangers?  Assuming you do not instead seek medical help for your problem, all you need to do is wait for Windows to perform a version update and for the user to get bored and walk away.  Hop onto their machine and press SHIFT+F10 to get a command prompt which will be running at root privileges and take advantage of the fact that Windows disables Bitlocker while installing an updated version of Windows.  This will not work for all updates, it needs to be a major OS update such as the move to Anniversary Edition which changes the version of Windows installed on the machine.

Microsoft is working on a fix, in the meantime sticking with Windows Long Term Service Branch or slighly modifying how updates are pushed via WSUS or SCCM will ensure this vulnerability cannot be leveraged.  You can also take the simple measure of sticking around when major updates occur.  Pop over to Slashdot for more information.

windows-10-update-stuck-at-32.jpg

"This [update procedure] has a feature for troubleshooting that allows you to press SHIFT + F10 to get a Command Prompt," Laiho writes on his blog. "The real issue here is the Elevation of Privilege that takes a non-admin to SYSTEM (the root of Windows) even on a BitLocker (Microsoft's hard disk encryption) protected machine." Laiho informed Microsoft of the issue and the company is apparently working on a fix."

Here is some more Tech News from around the web:

Tech Talk

Source: Slashdot

Tesla stores your Owner Authentication token in plain text ... which leads to a bad Ashton Kutcher movie

Subject: General Tech | November 25, 2016 - 05:52 PM |
Tagged: Android, Malware, hack, tesla, security

You might expect better from Tesla and Elon Musk but apparently you would be dissappointed as the OAuth token in your cars mobile app is stored in plain text.  The token is used to control your Tesla and is generated when you enter in your username and password.  It is good for 90 days, after which it requires you to log in again so a new token can be created.  Unfortunately, since that token is stored as plain text, someone who gains access to your Android phone can use that token to open your cars doors, start the engine and drive away.  Getting an Android user to install a malicious app which would allow someone to take over their device has proven depressingly easy.  Comments on Slashdot suggest it is unreasonable to blame Tesla for security issues in your devices OS, which is hard to argue; on the other hand it is impossible for Telsa to defend choosing to store your OAuth in plain text.

images.jpg

"By leveraging security flaws in the Tesla Android app, an attacker can steal Tesla cars. The only hard part is tricking Tesla owners into installing an Android app on their phones, which isn't that difficult according to a demo video from Norwegian firm Promon. This malicious app can use many of the freely available Android rooting exploits to take over the user's phone, steal the OAuth token from the Tesla app and the user's login credentials."

Here is some more Tech News from around the web:

Tech Talk

Source: Slashdot

Have tape over your webcam? Might want to fill your headphones with wax as well!

Subject: General Tech | November 24, 2016 - 05:35 PM |
Tagged: security, hack, audio, Realtec

Security researchers have discovered a way to flip an output channel on onboard Realtec audio into an input channel, thus turning your headphones into an unpowered microphone.  The ability of a speaker or headphone to be used as a microphone is not news to anyone who has played around with headphones or input jacks, but it is possible some readers had deprived childhoods and have never tried this.  While you cannot mitigate this vulnerability permanently you could certainly notice it as your headphones would no longer play audio if the port is configured as input. 

Drop by Slashdot a link, and if you have never tried this out before you really should find an old pair of headphones and experiment with ports as well as snipping off one side of a pair of earbuds.  One supposes iPhone 7 users need not worry.

main-qimg-6c2713171e56fb4f0dda88717a6faae7-c.jpg

"In short, the headphones were nearly as good as an unpowered microphone at picking up audio in a room. It essentially "retasks" the RealTek audio codec chip output found in many desktop computers into an input channel. This means you can plug your headphones into a seemingly output-only jack and hackers can still listen in. This isn't a driver fix, either."

Here is some more Tech News from around the web:

Tech Talk

Source: Slashdot

Touchless jackpotting, making ATM's disgorge their contents remotely

Subject: General Tech | November 23, 2016 - 05:50 PM |
Tagged: hack, bank, atm, security, cobalt

Imagine walking down the street, only to notice an ATM spewing money out of its slots and into a bag held by a shady looking character; but not in a video game.  In at least 14 countries including Russia, the UK, the Netherlands and Malaysia, hackers are using a program dubbed Cobalt to conduct remote logical attacks on ATMs.  These attacks cause the ATM to empty itself, into the waiting hands of an accomplice who only needs to show up at the appropriate time.  As the attacks are conducted remotely the mule may have only the slightest connection to the hackers that compromised the banking system which makes them very hard to catch.  The Inquirer has links to more information on Cobalt, unfortunately they do not have any details on fortunate times or locations to be present at.

ATM-hack.jpg

"HACKERS HAVE MANAGED to hack cash machines so that they do what everyone who has ever used one has wanted them to do, which is just spit out cash like it was going out of fashion."

Here is some more Tech News from around the web:

Tech Talk

Source: The Inquirer