What's The Lock Down?

An Alternative Cyber Security News Source

[decryptingthenews-blog]

The FBI didn’t require Apple’s co-operation in the end.

Despite Apple’s continuing refusal to create a backdoor to their iPhones for the FBI, the bureau has managed to gain access anyway by exploiting a Zero-Day Attack and are now not sharing the details of that attack with Apple.

In the past few months there has been a lot of discussion surrounding the FBI vs Apple case. The disagreement regards an iPhone recovered from one of the shooters involved in the San Bernadino, California, shootings last December. On February 16, the court ordered that Apply create a backdoor to their phones to aid the FBI’s counter terrorism measurements but the company refused in deference to their security obligations to their customers.

The latest development in the story is that the FBI have managed to create their own backdoor without Apple’s help and they are now refusing to share the details of their attack to the company because they do not want Apple patching it and blocking their access.

There is a suggestion now that the FBI us not working for the protection of the American people and has now, in fact, created a security risk that has a global impact. 

Most are in agreement that the hack will, at some point, leak. Probably soon. It will either happen because the FBI re-uses the method on many more devices, and not those just pertaining to the California case, which will create a much larger security risk or because the company that created the attack, and presumably sold it to the FBI, will sell it to other parties unknown. 

Apple is confident that, should and when the hack leaks, they will be able to patch the vulnerability quickly but the fact still remains that the FBI seems to be creating more issues than it is solving. The justification will rely on what the FBI manages to achieve with the information they can take from the San Bernadino phone.

Zero-Day Attack- A vulnerability that is completely unknown until it is exploited.

Sources: 

http://www.livescience.com/53977-apple-vs-fbi-whats-going-on.html

http://indianexpress.com/article/technology/tech-news-technology/fbis-trick-for-hacking-into-apple-iphone-likely-to-leak-soon-experts/

http://www.huffingtonpost.com/entry/apple-engineers-fbis-iphone-hack-will-leak-and-apple-will-plug-the-hole_us_570108b6e4b083f5c607ed4f

http://news.softpedia.com/news/apple-expects-fbi-s-iphone-hack-to-leak-502511.shtml

[decryptingthenews-blog]

New ransomware uses disk-level encryption

A new variant of ransomware, named ‘Petya’, doesn’t just encrypt data files: it encrypts your entire hard drive after compromising your PCs master boot record. 

After installing the ransomware, your system will automatically reboot and display what looks to be a system CHKDSK when in fact your system in being locked down by Petya that is in the process of encrypting the system disk.

Repairing the Master Boot Record is not a solution as it will not decrypt the ransomware and the attacks, who call themselves ‘Janus Cybercrime Solutions’ say that attempting to do so hinders the ability for the decryption key that can be purchased. 

Beyond disk-level encryption, the ransomware operates in the same way as any other ransomware. Demands for money, in the form of bitcoin, are made in exchange for the decryption key that can be used to recover the system.

Ransomware: A type of malware that encrypts files on your system in order for demands to be made in exchange for a key that can be used to recover your files.

Master Boot Record: The information in the first sector of the hard disk that identifies where the OS is located in order for the system to boot up.

Sources:

http://www.extremetech.com/computing/225681-new-ransomware-uses-disk-level-encryption-to-hold-your-computer-hostage

http://www.theregister.co.uk/2016/03/29/petya_ransomware/

https://securityintelligence.com/news/ransomware-ramp-up-boot-processes-powershell-under-attack/

[decryptingthenews-blog]

FBI dragging their heels in a court order to reveal how they exploited Tor

The FBI used an exploit against the Tor network to find the identity (and IP address) of a peadophile who’d been using the anonymous network to view child porn.

The case in question concerns a 62-year old school administrator, Jay Michaud, from Vancouver. We already know most of the details regarding the string: the FBI had seized control of a website that was supporting a forum that was hosting child pornography and, for two weeks, they used a hacking tool to track the IP address of people visiting the child pornography threads.

The court has ordered the FBI to disclose the source code of the hacking tool to the defenses malware analyst, primarily to see whether the tool exceeded the powers granted to the FBI in their warrant, which could be pivotal to the defense.

The FBI insist that revealing the source code would only reveal how the tool was deployed, not how it collected information. This would mean that the source code would not help the defense identify whether the FBI went beyond their legal means.

There is an interesting question posed here; in some instances, does the transparency of the legal system create problems as well as solve them. In this instance, would revealing the source code, which would be necessary in order to preserve transparency, hinder the FBI’s ability to capture future criminals? Should the source code be disclosed and subsequently leaked, wouldn’t this make it easier for criminals to evade capture by blocking the precise means by which the FBI investigate anonymous networks. More interestingly, a similar question is posed in the FBI Vs Apple case, but in this instance the FBI apparently believe that ‘revealing source code’ does nothing but help the legal system. Either way, it makes the whole thing very suspicious. It would seem the FBI have a ‘As long as its good for us’  mentality, which, to me, suggests that maybe the defense has the right idea and the means by which the FBI collected their information does go beyond the powers granted to them.

Tor: An anonymous network that bounces communications across a distributed network of relays, which prevents your internet connection from being watched and the websites that you visit being monitored.

Malware: Software designed for malicious purposes.

Sources:

http://www.zdnet.com/article/fbi-fights-back-against-court-order-demanding-tor-exploit-source-code/

http://www.bbc.co.uk/news/technology-35924859

http://www.infosecurity-magazine.com/news/fbi-refuses-to-reveal-details-of/

http://gizmodo.com/fbi-refuses-to-divulge-how-it-tracked-paedophiles-on-to-1767933079

[decryptingthenews-blog]

A dangerous self-protecting USB Trojan discovered

ESET (And IT Security company that’s based in Slovakia) have discovered a USB Trojan with unique, and potentially dangerous, qualities.

tl;dr: Everything’s cool so long as you’re not sticking unknown usb sticks into your computers.

Like most USB Trojans, the one discovered by ESET runs in the background on your computer system when an application stored on that drive is executed. These Trojans are undetectable because they operate from the USB stick; they leave no traces on the computer system.

What’s unique about this Trojan is that it protects itself by tying itself intinsically to the USB stick that it’s installed on. Should the files be moved from that USB stick, the Trojan would no longer run. That’s because its execution is linked with the file creation time. That makes it impossible to sample and analyse. 

The Trojan is not internet borne, so the vast majority of people have no cause for concern: its just another reminder that you should be wary of plugging unknown USB devices into your computer system.

Trojan: A type of malware that enters the systems by disguising itself as legitimate software.

Sources:

http://www.darkreading.com/attacks-breaches/dangerous-new-usb-trojan-discovered/d/d-id/1324853

http://betanews.com/2016/03/26/eset-discovers-win32psw-stealer-nai/

[decryptingthenews-blog]

Verizon, a company that offers secure communication solutions, suffers from a data breach

On the 24th of March 2016, a thread was created in an ‘underground cybercrime forum’ advertising the sale of a database containing Verizon Enterprise client information.

tl;dr: The king of all ironies. 

The whole database, advertised in an ‘underground cybercrime forum’ (which doesn’t sound even remotely like an official term), was offered at a price of $100,000 although chunks of the database were offered at a rate of £10,000.

The official statement from Verizon was that they’d discovered and remedied a vulnerability in the Verizon Enterprise client portal. They then reassured clients that only basic contact information was obtained by attackers and that no customer propriety network information was accessed during the attacks. If the statement is true then the biggest threat to clients is consequential phishing attacks.

The company haven’t been very forthright with how the breach specifically occurred but, because the database up for sale is presented in the format of MongoDB, many have speculated that the MongoDB platform was probably used to extract the contents of Verizon’s client information database.

Phishing: An attack whereby malicious persons attempt to gain sensitive information by masquerading as trusted persons over email. 

Sources:

https://krebsonsecurity.com/2016/03/crooks-steal-sell-verizon-enterprise-customer-data/

https://www.grahamcluley.com/2016/03/verizon-enterprise-suffers-data-breach-1-5-million-customers-info-offered-sale/

[decryptingthenews-blog]

Police chief says not to reimburse all victims of online fraud

Metropolitan Police Commissioner Sir Bernard Hogan-Howe has suggested that banks should not reimburse all victims of online crime in an effort to reduce the rising numbers of online fraud.

tl;dr: Hogan-Howe suggests we victim blame in fraud cases, apparently having decided that it wasn’t important to do any research into cyber security.

The idea behind Sir Hogan-Howe suggestion is that, with the present system, the public have no incentive to take security matters seriously. He proposes that, should a victim not have the latest anti-virus software or have not tightened their password, they should not be reimbursed in cases of online fraud.

While I can see the logic behind the idea, it is complete bull shit. 

If banks were to adopt a policy along these lines it would shift the responsibility of security off the shoulders of the business, which is exactly where that responsibility should lie. In terms of security passwords, in particularly those that are directly relevant to online banking accounts, the bank should have measures in place that enforce a certain standard (a certain number of special characters, a certain length, maybe a basic check to ensure the old foils of ‘password’, ‘qwertyuiop’, and ‘1234′ have not been used). 

The whole matter would be akin to legally enforcing victim blaming, the question of ‘what were you wearing’ becomes ‘what have you installed’ when, what should be remembered, is that these people are /victims/. To imagine that people are not bothered by their own security because ‘Hey, we could just get it reimbursed!’ is ignorant and dangerous. People have their whole lives turned upside down by online fraud and to suggest that they could be unaided by the law because they happen to have missed an update that came out twenty minutes before they were defrauded is absurd. Not least because such matters would have a much larger impact on the most vulnerable in society; those who did not grow up in the age of technology, are intimidated by talk of anti-virus software, and have faith in the system to do right by them. 

Cyber security is a ferociously difficult beast to manage to such an extent that even professionals recognise that all you can really do is lower risk, never eliminate it. Hogan-Howe seems to be suggesting that your everyday Joe on the street has it within their power to eliminate all risk where professionals have clearly failed. 

More over, it’s an excepted fact in the world of cyber security that almost all attacks originate from inside the business. I couldn’t pull out the exact statistics in fraud cases, but this would suggest that at least a decent amount of fraud originates from inside the banks themselves. All such a measure would do is de-incentivise banks from monitoring their employees and, indeed, would de-incentivise them from investing more into their own security because they would no longer be liable for the damages caused!

Hogan-Howe would do right to remember that the laws are in place to protect people, not re-assign blame. 

[decryptingthenews-blog]

Methodist Hospital In Kentucky Attacked By Ransomware

On Friday March of 18th, in an attack that lasted five days, patient files were withheld from staff at a Methodist Hospital in Henderson, Kentucky, in a ransomware attack.

On March 18th the Kentucky based hospital declared a state of internal emergency and a message was posted on their website explaining the situation. The ransomware had locked patient files and there was a demand for money in order for the files to be recovered and access restored.

The hospitals COO (David Park) stressed that the hospital wouldn’t be making any decisions regarding the possibly payment until such a time that they had assessed the extent of the damage done. 

As of March 23rd, the hospital is now out of the state of emergency. The official statement by the Methodist hospital is that the ransom was not paid and no patient files were compromised.

The FBI is in charge of investigating the attack, and this is not the first one they have seen. Just last month a Los Angeles based medical centre was similarly attacked by ransomware, in this instance the ransom was paid in order to recover files ($17,000 in bitcoin). Two other hospitals were also recently targeted: Chino Valley Medial Centre and Desert Valley Hospital  in California.

The problems faced when deciding whether or not to pay off ransomware are the as those faced by people considering negotiating with traditional ransomers. The information that would be returned may well be worth the price paid, particularly for those most affected by the lost information, but paying the ransom would encourage similar acts in the future. There is also no guarantee that the key given by the ransomers would work. There have been multiple occasions where the encryption method used could not be undone by the provided key, which is another risk. 

Ransomware: : ransomware is a particular type of malicious software that blocks access to a system, or data held on a system, until a ransom is paid. Typically, upon paying the ransom, the attacks (or designers of the ransomware) will provide the user with the key to recover the system or system data.

Sources:

http://www.wbtv.com/story/31514253/fbi-investigating-cyber-attack-at-methodist-hospital-in-henderson

http://www.govhealthit.com/news/methodist-hospital-latest-victim-ransomware-attack-says-it%E2%80%99s-back-and-running

http://www.beckershospitalreview.com/healthcare-information-technology/methodist-hospital-in-kentucky-declares-internal-emergency-due-to-ransomware-attack.html

http://www.healthcareitnews.com/news/methodist-hospital-recovering-five-day-ransomware-attack-claims-it-did-not-pay

http://www.bbc.co.uk/news/technology-35880610

[goodbyeobama2]

[hands-minds-boots]

"The issue came to light when the Robbins's child was disciplined for "improper behavior in his home" and the Vice Principal used a photo taken by the webcam as evidence."

what the actual fuck.

[decryptingthenews-blog]

Seconded. 

Bit late to the ‘fuck the fuck off’ train but I remember listening to this story when I was parsing through some ancient podcasts (circa 2010) a little while ago. The digital forensic guys who were on the podcast at the time seemed pretty shocked at it too. I hope that means it’s not a common occurence (I’d certainly pray that, when this story broke, anyone who thought this was a good idea had second thoughts).

The podcast was Forensic 4cast (https://forensic4cast.com/) if anyone was interested, although I think they’re not as active anymore. 

[decryptingthenews-blog]

Plenty of jobs to go around

Cyber security jobs are hot right now within the American government (which is not at all surprising if you know anything about the OPM hacks).

If you didn’t know, the OPM (Office Of Personnel Management) was hacked in June of 2015. As you can probably tell by the name of the department, the type of data that was stolen was hugely sensitive. In an unusual twist of common sense, the American government has responded by actually doing something sensible. They’re upping their security personnel with 1000 new openings in the OPM, which is great news for anyone who works in the industry and lives in the USA.

Not that the prospects are bad for anyone on the outside. A quick google on any given day will return headlines talking about the increase of Cyber Security professionals wanted all around the globe. Mo’ money I guess. If you can pass the security clearance requirements that is. 

I’ll leave some sources below

About the jobs:

 http://www.forbes.com/sites/stevemorgan/2016/01/31/help-wanted-1000-cybersecurity-jobs-at-opm-post-hack-hiring-approved-by-dhs/#795ed4432cd2

About the OPM hacks:

http://www.theguardian.com/technology/2015/jul/09/opm-hack-21-million-personal-information-stolen

If you want to read more about hiring increases around the globe:

http://www.timesofisrael.com/israels-cyber-sector-blooms-in-the-desert/

http://www.computerweekly.com/news/4500253422/Rise-in-IT-security-demand-triggers-surge-in-cyber-security-jobs