It’s been a while since I’ve blogged on a security topic, but this one caught my eye today: researchers in Germany have revealed an intriguing new ATM exploit. In the past I’ve written about skimmers, devices installed on ATMs to steal card codes from ATM cards. Now thieves are targeting the ATMs directly, instead of user accounts.
…hackers have to physically cut holes into ATMs, then plug in USB drives that install code onto the cash dispenser.
Once the exploit has been installed, the attacker types in a 12-digit access code, selects the denominations to dispense, and voila! Payday! There’s even a non-collusion mechanism built in:
…the criminal at the cash point had to call another gang member for a numerical code to input before they could grab the bank notes.
Obviously, this sort of exploit would have to be targeted specifically at a particular ATM maker, maybe at a given software release, and perhaps even at a particular bank, if the bank was to customize the ATM code at all.
Still, somehow I feel safer that it’s not my bank account that’s being attacked, it’s the ATM itself. At least I don’t have to explain why my card and code were used, when in fact they were stolen.
Here’s a new method of command and control for malware:
Researchers from Trend Micro have spotted a piece of malicious software for Android that receives instructions from an encrypted blog
In the past, botnets have received their instructions primarily from IRC. This is an intriguing development!
I was out on a web site today, it doesn’t really matter which one, and was forced to create a profile for the (mis)use of the site’s owner. I found their password standards to be, well “stringent” would be a good word, especially considering the information (my profile) that I was securing. Their standards for passwords were, and I quote: Read more
Wow, it’s months I spend not saying anything about computer security, and then there are two in a row. Technology Review reports today that engineers at Intel have come up with a way to put a true random number generator on the processor die. This has implications for a number of cryptographic techniques that rely on random numbers to function.
Finding randomness in computers is surprisingly difficult, and over the years people have tried everything from dedicated hardware-based random number generator hardware to using a webcam with the cap left on, to lava lamps of all things as a source of randomness. In the past, the National Security Agency went so far as to use white noise from space to generate their random numbers, capturing the noise using radio telescopes.
The inclusion of this sort of random number generator strengthens protocols such as RSA, and HTTPS/SSL with the introduction of true, rather than pseudo-randomness. With the advances in quantum cryptography in the last few years however, we may soon see the end of this class of cryptography, as quantum computers would theoretically be able to break these protocols instantly.
This is cool, in a “people spying on my country” kind of way: Gizmodo reports that the recent break-up of a supposed Russian deep cover spy ring included the FBI discovering their use of Steganography. As a security and crypto guy, this is very interesting.
Steganography is the hiding of information in plain sight, much like the lemon juice you used to use to write secret messages when you were a kid. Digital steganography alters computer files, usually pictures or audio files, to hide information within them. This is the first case that I’m aware of that uses real stego as part of real espionage. Assuming it’s really espionage that is.
For the technically minded, one way that digital steganography works is by altering the low-order bits of photos or music files. If we change the least significant bit of a pixel in a digital photo, the difference between it’s original value and the new value that encodes information is likely unnoticable by the human eye. The same can be said of digital photos.
Detecting steganography is difficult: you need to know the program used, or you need to perform complicated statistical analysis to stand a chance of detecting it. It’s remarkable to me that we’ve at last seen this technology in the wild.
Have you ever looked at your address book and seen an entry for someone you haven’t talked to in years? I usually think to myself “I wonder if that phone number is still good.” Sometimes I even wonder if people are still alive.
A Dutch information security researcher wants to use a concept similar to that to try to protect all that information about us that’s stored on line, according to an article at the BBC. The idea would be to have your information “degrade” over time, just like your confidence in whether that email address for Joanne is still any good.
At initial use to secure a transaction or get useful information from a search all relevant details might be stored. Subsequently details would slowly be swapped for more general information.
It’s an interesting concept. I’ve always been intrigued by the idea of looking to the physical world for solutions to problems in the digital one. I’ve frequently thought it would be interesting to look into mimicking the animal immune system for a computer anti-virus system, for instance.
Of course, Europe has better controls, and a different view, of information security than the US. It’s likely that any system like the one outlined by Dr. Heerde could be mandated here, because unlike Europe, in the US businesses own the information they collect about you, rather than you owning your own information. Still, it’s an idea to feed to the grist mill, and perhaps something interesting will come out the other side.
For those who aren’t aware, there are folks out there who are stealing your ATM information not by breaking into the transaction processing company, but by stealing it from you at the ATM. This process is called “skimming,” and it involves installing a card reader and a camera on the ATM. The card reader gets the information on the magnetic stripe on the back of your card, and the camera watches what you enter for a PIN. I knew these were out there, but it was a surprise to me to see how advanced they were, transmitting information wirelessly to the thieves.
It’s a good idea to try to keep an eye out for these devices, but you have to know what to look for, so I was interested to see a guide on spotting a skimmer. It’s a brief PDF that’s worth the read.
It seems that if you steal enough credit cards, then you might actually get arrested. Last week I posted about the Heartland Payment Systems case, and today, Computerworld is reporting that the first arrests have happened in the case. This to me is remarkably swift justice.
The Leon County, Florida Sheriff’s office earlier this week announced the arrests of three area residents — Tony Acreus, Jeremy Frazier and Timothy Johns — for allegedly using stolen credit card numbers associated with the breach.
I was just reviewing some of the Payment Card Industry Data Security Standard information today, and was struck by the requirement to encrypt data when it was in transit. According to all the information I’ve seen so far, this breach happened because someone managed to get a network sniffer in place, and capture transaction data. I may be missing the point, but how were they able to read the traffic if it was encrypted? Did they have the keys, or was Heartland playing fast and loose with the DSS? I don’t understand enough about either the facts in the case, or the DSS to say if this is reasonable or not, but it sure seems like someone at Heartland could be in a world of trouble.
Perhaps I’m just getting to be an old timer. When I started managing computer systems for the telephone company in the late 1980s, the game was to break into systems primarily to learn something. Occasionally there were malicious attempts to access information, such as the phreak’s setting themselves up with free phone service, but for the most part, the damage to society at large was fairly limited.
Late in January, we learned about a security breach at Heartland Payment Systems. According to coverage at Computerworld, it seems the attackers placed some sort of malware into the Heartland network, and were able to capture an undisclosed number of credit card transactions, primarily from smaller businesses such as gas stations and convenience stores. Heartland isn’t saying how many accounts were compromised, but they process about 100,000,000 transactions per month, and they were apparently notified by the card companies of a possible problem last October, and well you do the math.
People breaking into computer systems these days aren’t doing it for fun, or to learn how things work, or at least they’re not the only ones breaking in. The naive period of hacking adolescence has passed. We’re not looking around in empty houses under construction, we’re breaking into occupied houses and robbing them while the owners are there.
Computer security is serious business, and business has given it very little attention. To make matters worse, the public really doesn’t seem to care either. TJX has a massive security breach: what happens to the stock? It goes up.
Until consumers start caring about how much money lax security is costing them, there will be no change. Since consumers aren’t showing any inclinations to care, the only hope for us is making a criminal negligence complaint against businesses that take absolutely no care of our identities.
I’ve blogged in the past about botnets, and it should be pretty clear that they can be powerful entities for good or evil. With human nature being what it is, they’re mostly used for evil. As a botnet controller, I imagine it must be very seductive to look at a popular service such as Facebook and drool at the prospect of all those computers we could recruit. But how to infect them?
Researchers in Greece apparently thought the same thing as well, and they’ve produced a research application called Picture of the Day. This little app claims to display a different picture from National Geographic on your page, and it does that. Unfortunately, it also serves up software to turn your computer into a botnet zombie.
It didn’t take much to get people to install it, apparently. According to the report on Dark Reading:
Interestingly, the researchers did not invite users via Facebook to download the application, but still managed to attract around 1,000 users who downloaded Facebot within the first few days it went live. They merely announced its availability to members of their research group and asked them to pass it to their colleagues. From there it apparently spread to other Facebook users.
As a security-type person, this sort of thing really concerns me. I know that the average user isn’t really all that concerned about security until it bites them in the hinder. I can’t even get developers to be concerned about it most of the time! The spread of social networking sites creates a target-rich environment for the spread of just these sorts of compromises, and it’s not at all clear how to fix it.keep looking »
- Ars Technica
- Dark Reading - IT Security
- Help Net Security
- SANS Internet Storm Center
- Schneier on Security - Dr. Bruce Schieier’s blog
- Security Info Watch
- What to Fix - Daniel Markham, fellow consultant
- Wired Gadget Lab
- Wordpress Documentation
- WordPress Planet
- Wordpress Support Forum