This POODLE bites: exploiting the SSL 3.0 fallback



Tweet

SSL 3.0 is nearly 18 years old, but support for it remains widespread. Most importantly, nearly all browsers support it and, in order to work around bugs in HTTPS servers, browsers will retry failed connections with older protocol versions, including SSL 3.0. Because a network attacker can cause connection failures, they can trigger the use of SSL 3.0 and then exploit this issue.

Disabling SSL 3.0 support, or CBC-mode ciphers with SSL 3.0, is sufficient to mitigate this issue, but presents significant compatibility problems, even today. Therefore our recommended response is to support TLS_FALLBACK_SCSV. This is a mechanism that solves the problems caused by retrying failed connections and thus prevents attackers from inducing browsers to use SSL 3.0. It also prevents downgrades from TLS 1.2 to 1.1 or 1.0 and so may help prevent future attacks.

More:
http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html

Truly scary SSL 3.0 vuln to be revealed soon: sources



Tweet

Gird your loins, sysadmins: The Register has learned that news of yet another major security vulnerability - this time in SSL 3.0 - is probably imminent.

 

Maintainers have kept quiet about the vulnerability in the lead-up to a patch release expected in in the late European evening, or not far from high noon Pacific Time.

 

Details of the problem are under wraps due to the severity of the vulnerability.

 

To that end it is unknown what platforms were impacted, but as SSL is very widely used any flaw will require plenty of urgent attention ... and probably be unwelcome news to a tech community already reeling from the recent Shellshock vulnerability in Bash and the Heartbleed flaw.

 

The SSL flaw won't be the only thing keeping security bods and system administrators busy. A dangerous worm has been discovered exploiting a zero-day flaw (CVE 2014-4114) in all versions of Microsoft Windows and Server 2008 and 2012.

 

From:

http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_tomorrow/?mt=1413288787389

DEFCON Router Hacking Contest Reveals 15 Major Vulnerabilities



Tweet

According to the rules of the contest, an entry wasn't considered valid unless the contestant also showed proof of disclosure to the manufacturer. Here's a full list of routers in which 0-days were reported in Track 0, along with our current understanding of the fix in progress:

• ASUS AC66U; reported, but no response from the manufacturer.
• Netgear WNDR4700; reported, but no response from the manufacturer.
• D-LINK 865L; reported, and manufacturer confirms it is working on a fix, currently in beta.
• Belkin N900; reported, and manufacturer acknowledgedbut was unclear on providing a fix.
• TRENDnet TEW-812DRU; reported, and manufacturer claims all reported 0-days are fixed.
• Actiontec Q1000; reported, and manufacturer acknowledged the report.

For details please see the full contest results.

More:
https://www.eff.org/deeplinks/2014/08/def-con-router-hacking-contest-success-fun-learning-and-profit-many

OMB gives DHS new powers to scan some civilian agency networks for cyber threats



Tweet

OMB added this new requirement for DHS to scan civilian agency networks in the aftermath of the Heartbleed vulnerability. During that time, DHS had to get permission from agencies to scan their networks, which delayed its mitigation strategy by a few days.

DHS made it clear in May during a House hearing that it needed Congress to give it more authorities to scan agency networks.

Andy Ozment, the assistant secretary of the Office of Cybersecurity and Communications in DHS, told Federal News Radio in an interview before OMB issued the FISMA guidance that when DHS doesn't have the explicit authorities that it needs and Congress wants them to have, it makes everything harder.

More:

http://www.wtop.com/893/3715204/OMB-gives-DHS-new-powers-to-scan-some-civilian-agency-networks-for-cyber-threats

Hackers’ Attack on JPMorgan Chase Affects Millions -



Tweet

Until just a few weeks ago, executives at JPMorgan said they believed that only one million accounts were affected, according to several people with knowledge of the attacks.

As the severity of the intrusion — which began in June but was not discovered until July — became more clear in recent days, bank executives scrambled for the second time in three months to contain the fallout and to reassure skittish customers that no money had been taken and that their financial information remained secure.

The hackers appeared to have obtained a list of the applications and programs that run on JPMorgan's computers — a road map of sorts — which they could crosscheck with known vulnerabilities in each program and web application, in search of an entry point back into the bank's systems, according to several people with knowledge of the results of the bank's forensics investigation, all of whom spoke on the condition of anonymity.

More:
http://mobile.nytimes.com/blogs/dealbook/2014/10/02/jpmorgan-discovers-further-cyber-security-issues/

43% of companies had a data breach in the past year



Tweet

Even in companies that have breach plans in place, employees aren't convinced they will work. Only 30% of those responding to the survey said their organization was "effective or very effective" at creating such plans.

One reason might be that few companies seem to take the need seriously. Of the companies surveyed, just 3% looked at their plan of action each quarter. Thirty-seven percent hadn't reviewed or updated their plan since it was first put in place.

More:
http://www.11alive.com/story/news/2014/09/24/43-of-companies-had-a-data-breach-in-the-past-year/16144167/

World Wide Web inventor slams Internet fast lanes: ‘It’s bribery.’



Tweet

"We need rules," said Berners-Lee. "If businesses are to move here and start here rather than start in Europe or Brazil or Australia — they're going to look around and make sure, 'Oh, does the power stay up?' And they'll look for other things. "Is the Internet open?' Will they have to effectively bribe their ISPs to start a new service? That's what it looks like from the outside. It's bribery."

More:
http://www.washingtonpost.com/blogs/the-switch/wp/2014/09/19/world-wide-web-inventor-lashes-out-at-internet-fast-lanes-its-bribery/

CDC: 90% of kids who died last flu season didn't get vaccine



Tweet

SALT LAKE CITY — The flu took the lives of more than 100 children in the U.S. last flu season, and most of those kids didn't get a flu shot.

That's according to a new report by the Centers of Disease Control and Prevention, aimed to encourage Americans to get vaccinated now. The flu kills up to approximately 36,000 people each year, but less than half of the population gets an annual flu shot. That's something the CDC wants to change.

More:
http://m.ksl.com/index/story/sid/31615281

The Police Tool That Pervs Use to Steal Nude Pics From Apple’s iCloud



Tweet

On Tuesday afternoon, Apple issued a statement calling the security debacle a "very targeted attack on user names, passwords and security questions." It added that "none of the cases we have investigated has resulted from any breach in any of Apple's systems including iCloud® or Find my iPhone."

But the conversations on Anon-IB make clear the photo-stealing attacks aren't limited to a few celebrities. And Zdziarski argues that Apple may be defining a "breach" as not including a password-guessing attack like iBrute. Based on his analysis of the metadata from leaked photos of Kate Upton, he says he's determined that the photos came from a downloaded backup that would be consistent with the use of iBrute and EPPB. If a full device backup was accessed, he believes the rest of the backup's data may still be possessed by the hacker and could be used for blackmail or finding other targets. "You don't get the same level of access by logging into someone's [web] account as you can by emulating a phone that's doing a restore from an iCloud backup," says Zdziarski. "If we didn't have this law enforcement tool, we might not have the leaks we had."

More:
http://www.wired.com/2014/09/eppb-icloud/

US Air Force admits to quietly changing a regulation that now requires all personnel to swear an oath to God -- Airmen denied reenlistment for practicing constitutional rights



Tweet

...
The Air Force said it cannot change its AFI to make "so help me God" optional unless Congress changes the statute mandating it.

Miller pointed out that Article VI of the Constitution prohibits requiring religious tests to hold an office or public trust.

"Forcing [the airman] to swear to a supreme being as a condition of his reenlistment is tantamount to a 'religious test' and is therefore violative of this constitutional provision as well," Miller said
...

More:
http://www.airforcetimes.com/article/20140904/NEWS05/309040066/Group-Airman-denied-reenlistment-refusing-say-help-me-God-

Well, isn't that special... Army can't track spending on $4.3b system to track spending, IG finds



Tweet

The problem, according to the IG, is that the Army has failed to comply with a variety of federal laws that require agencies to standardize reporting and prepare auditable financial statements.

"This occurred because DOD and Army management did not have adequate controls, including procedures and annual reviews, in place to ensure GCSS-Army compliance with Treasury and DOD guidance," the IG report concludes.

"Although Army personnel have been responsive to correcting deficiencies identified during the audit, the Army has spent $725.7 million on a system that still has significant obstacles to overcome" to comply with federal financial reporting laws.

More:
http://m.washingtonexaminer.com/army-cant-track-spending-on-4.3b-system-to-track-spending-ig-finds/article/2552808

Apple says iCloud is safe and secure, stolen celebrity pics were targeted accounts



Tweet

Apple said it has completed more than 40 hours of investigation to date, and found that the iCloud accounts in question were compromised based on practices that are "all too common on the Internet."

The company's statement dispels rumors that a wider exploit of its iCloud services, including the Find My iPhone function, played a part in the leaks. Apple recommends that its users employ a strong password, and also enable two-step verification to maximize security.

More:
http://appleinsider.com/articles/14/09/02/apple-says-icloud-is-safe-and-secure-stolen-celebrity-pics-were-targeted

Android security mystery - 'fake’ cellphone towers found in U.S.



Tweet

"What we find suspicious is that a lot of these interceptors are right on top of U.S. military bases." says Goldsmith.  "Whose interceptor is it?  Who are they, that's listening to calls around military bases?  The point is: we don't really know whose they are."

Baseband attacks are considered extremely difficult – the details of the chips are closely guarded. "Interceptors" are costly devices – and hacking baseband chips is thought to be technically advanced beyond the reach of "ordinary" hackers, ESD says. The devices vary in form, and are sold to government agencies and others, but are computers with specialized software designed to defeat the encryption of cellphone networks. The towers target the "Baseband" operating system of cellphones – a secondary OS which sits "between" iOS or Android, for instance, and the cellular network.

More:
http://www.welivesecurity.com/2014/08/28/android-security-2/

Amazing image. User Pinged All Devices on the Internet, here's a Map of them [OC] : dataisbeautiful



Tweet

http://www.reddit.com/r/dataisbeautiful/comments/2evjkz/i_pinged_all_devices_on_the_internet_heres_a_map/

Good to know Tor isn't absolute protection... This scumbag needed to be caught.



Tweet

Cybersecurity official uses Tor but still gets caught with child porn

...One site frequented by DeFoggi was PedoBook, hosted by Aaron McGrath—a Nebraska man who was convicted earlier for his role in the operations. The websites were only accessible to users who installed Tor on their browsers. DeFoggi used names such as "fuckchrist" and "PTasseater" to register on the sites, where he could view more than 100 videos and more than 17,000 child porn images.

The FBI seized McGrath's site in late 2012 after monitoring him for a year. Then they kept it up and running for several more weeks, gathering private communications from DeFoggi and other users. The FBI used "various investigative techniques… to defeat the anonymous browsing technology afforded by the Tor network."...

More:

http://arstechnica.com/tech-policy/2014/08/federal-cybersecurity-official-going-to-jail-on-child-porn-charges/

I wonder how many lives 15 more minutes of fame might cost



Tweet

George Zimmerman Arrested While Visiting Ferguson - National Report

Zimmerman is heard yelling something again, and finally the teens stop. One of the teens rather articulately asks Zimmerman to leave him, his friend, and his town, alone. "Sir, sir, we don't… we don't have an issue with you, sir. Please leave us alone," the younger teenager says in the video, while Zimmerman continues to rant about something in the background. "Mr. Zimmerman, I don't know why you're here in Ferguson, but It's pretty damn insensitive, you showing up here. This town's been through enough already, we don't need you here intensifying things, okay? And my friend and I didn't say anything to you."

"I have a right to be here. It's a free country, we're on a public street," Zimmerman angrily says to the teens. "Why were you following me? Why were you harassing me?"

"We did no such thing, Mr. Zimmerman. You were leaving the store and we saw you and crossed the street," the younger teen replies. "You followed us for a whole block. We said nothing to you and we were not following you."

More:
http://nationalreport.net/george-zimmerman-arrested-visiting-ferguson/

Researchers find it’s terrifyingly easy to hack traffic lights



Tweet

--This can't end well...

Taking over a city's intersections and making all the lights green to cause chaos is a pretty bog-standard Evil Techno Bad Guy tactic on TV and in movies, but according to a research team at the University of Michigan, doing it in real life is within the realm of anyone with a laptop and the right kind of radio. In a paper published this month, the researchers describe how they very simply and very quickly seized control of an entire system of almost 100 intersections in an unnamed Michigan city from a single ingress point.

More:
http://arstechnica.com/security/2014/08/researchers-find-its-terrifyingly-easy-to-hack-traffic-lights/

Seriously? The Day Ferguson Cops Were Caught in a Bloody Lie



Tweet

Police in Ferguson, Missouri, once charged a man with destruction of property for bleeding on their uniforms while four of them allegedly beat him.

"On and/or about the 20th day of Sept. 20, 2009 at or near 222 S. Florissant within the corporate limits of Ferguson, Missouri, the above named defendant did then and there unlawfully commit the offense of 'property damage' to wit did transfer blood to the uniform," reads the charge sheet.

More:
http://www.thedailybeast.com/articles/2014/08/15/the-day-ferguson-cops-were-caught-in-a-bloody-lie.html

Decoding the Antikythera Mechanism



Tweet

I had not seen this before. Fascinating. Well worth less than an hour of your time. 

"Decoding the Antikythera Mechanism" 
 

Why, Unless You're Running With Amazon, Google and Microsoft, You Should Never Build Another Data Center - Forbes



Tweet

The Make-vs-Buy Question

The question every IT executive must answer is whether it's worth a $20+ million investment to build, own and operate a facility, which is probably still not state-of-the-art, but merely much sufficient for future needs and much better than existing facilities? Or would it be better to lease space in a veritable data center superstore that provides higher efficiency, better physical and perimeter network security, ample room for growth and far better network connections to major ISPs, wireless carriers and cloud services? I contend that for IT organizations both large and small, owning, operating, maintaining and upgrading data centers yields no significant business advantage and is a waste of IT capital and effort.

More:
http://www.forbes.com/sites/kurtmarko/2014/08/03/why-youll-never-build-a-dc/