If you haven’t heard of the service you can find out more here – Google Wallet (Wikipedia).

The main concern here (security wise) is that this relies on a secure storage on the phone of your cryptographic keys that allow you to carry out transactions.

Sprint’s two newly announced 4G handsets both support Google Wallet, bringing an important boost to Google’s aspirations, but they also hammer the death nail into WiMAX in the USA.

Sprint’s last 4G handset, the “Sprint Nexus S 4G”, was a WiMAX device, but Sprint has admitted backing the wrong 4G horse and is now transitioning to LTE across its network. So the operator will now be selling Google’s Galaxy Nexus and LG’s Viper handsets, both with support for Google Wallet for those wanting pay-by-bonk functionality.

Supporting the ability to make payments by tapping the phone against a reader isn’t just a matter of supporting Near Field Communications (NFC), you also need a secure element in which to store the cryptographic keys, which will be under the control of a mutually-trusted party, and then an application with which to make the payments.

Both the Galaxy Nexus and the Viper have a module built into the phone, under the control of Google – which is trusted by Mastercard and Visa. So far only Google itself and Citibank have created applications with which a user can make payments, and despite offering to pay for users’ groceries, Google Wallet is proving something of a slow burner at best.

I’d imagine the wallet system will have functionality to auto-reload from your credit card too, so if someone can manage to grab those cryptographic keys from the ‘secure’ area on your phone – you might be in for a surprise when you get your next credit card statement.

The plus side is, the adoption rate so far seems to be super low – so it’s not much of a risk right now.

It has not been helped by Verizon asking to have the functionality disabled in its spin of the Galaxy Nexus. The operator claims the decision was down to integration issues, but it is widely believed to have made the call in order to hold back a competitor until the US-operator-consortium wallet, ISIS, comes online.

ISIS uses a secure element held in the SIM – and thus under the operators’ control – and should work with any handset supporting the SWP (Single Wire Protocol) standard for NFC/SIM communications.

So once ISIS is available then the operators will start pushing it out to everyone with an SWP-supporting handset, including the Google Galaxy Nexus and LG Viper. Google needs to move fast and grab some market share before the operators shut it out, which is why these new handsets are so important to the Chocolate Factory as well as to Sprint.

There’s a whole lot of politics going on too with a new mobile payment system set to come online soon – ISIS – founded by…wait for it…AT&T, T-Mobile and Verizon. Yah, screw whoever tries to mess with ISIS – because they are gonna be in big trouble – the only major US operator missing is Sprint.

I’m guessing that’s why they are going with Google Wallet, there’s a very short article on Wikipedia about ISIS here.

Source: The Register

You may remember back in November 2010 – European Banks Seeing New Wave Of ATM Skimming or way back in 2008 when Pro ATM Hacker ‘Chao’ Gives Out ATM Hacking Tips.

The latest is this neat hack that came out of a method outlined by Michal Zalewski back in 2005:

Cracking safes with thermal imaging

Security researchers have found that thermal cameras can be combined with computer algorithms to automate the process of stealing payment card data processed by automatic teller machines.

At the Usenix Security Symposium in San Francisco last week, the researchers said the technique has advantages over more common ATM skimming methods that use traditional cameras to capture the PINs people enter during transactions. That’s because customers often obscure a camera’s view with their bodies, either inadvertently or on purpose. What’s more, it can take a considerable amount of time for crooks to view the captured footage and log the code entered during each session.

Thermal imaging can vastly improve the process by recovering the code for some time after each PIN is entered. Their output can also be processed by an algorithm that automates the process of translating it into the secret code.

The hack works extremely efficiently on ATMs using plastic keypads, it will not work on metal keypads and this method works up to 60 seconds after you’ve used the ATM.

I’m not sure about you guys but all the ATMs I’ve seen here are using metal keypads, so it wouldn’t work too well over here.

Either way it’s a fairly cool hack and I’m glad to see, so far there’s no proof of thieves using it in the wild.

The findings expand on 2005 research from Michal Zalewski, who is now a member of Google’s security team. The Usenix presenters tested the technique laid out by Zalewski on 21 subjects who used 27 randomly selected PINs and found the rate of success varied depending on variables including the types of keypads and the subjects’ body temperature.

“In summary, while we document that post-hoc thermal imaging attacks are feasible and automatable, we also find that the window of vulnerability is far more modest than some feared and that there are simple counter-measures (i.e., deploying keypads with high thermal conductivity) that can shrink this vulnerability further still,” the researchers wrote.

I wonder if we’ll see a spate of real life attacks based around this technique now the paper has been published publicly.

You can grab the paper discussing the technique here: Heat of the Moment: Characterizing the Efficacy of Thermal Camera-Based Attacks [PDF].

Source: The Register

Plus the whole Stuxnet thing which was able to attack nuclear plants. In a way I find it ironic because so much more emphasis these days is put on the security of things like Twitter and Facebook, but the industrial control systems in factories and nuclear refining facilities are left unsecured.

It just goes to show how devastating a focused attack against these kind of large scale control systems could be.

The security of software used to control hardware at nuclear plants, gas refineries and other industrial settings is coming under renewed scrutiny as researchers released attack code exploiting dozens of serious vulnerabilities in widely used programs.

The flaws, which reside in programs sold by Siemens, Iconics, 7-Technologies, Datac, and Control Microsystems, in many cases make it possible for attackers to remotely execute code when the so-called supervisory control and data acquisition software is installed on machines connected to the internet. Attack code was released by researchers from two separate security camps over the past week.

“SCADA is a critical field but nobody really cares about it,” Luigi Auriemma, one of the researchers, wrote in an email sent to The Register. “That’s also the reason why I have preferred to release these vulnerabilities under the full-disclosure philosophy.”

The vulnerability dump includes proof-of-concept code for at least 34 vulnerabilities in widely used SCADA programs sold by four different vendors. Auriemma said the majority of the bugs allow code execution, while others allow attackers to access sensitive data stored in configuration files and one makes it possible to disrupt equipment that uses the software. He included a complete rundown of the vulnerabilities and their corresponding PoC code in a post published on Monday to the Bugtraq mail list.

There are a whole long list of vulnerabilities including PoC code posted publicly on Bugtraq this past Monday:

Vulnerabilities in some SCADA server softwares

The vulnerabilities include software by popular vendors such as Siemens. If you don’t know what SCADA is it stands for supervisory control and data acquisition.

The e-mail explains it well:

In case someone doesn’t know SCADA (like me before the tests): it’s just one or more softwares (usually a core, a graphical part and a database) that allow people to monitor and control the various hardware sensors and mechanisms located in industrial environments like nuclear plants, refineries, gas pipelines, airports and other less and more critical fields that go from the energy to the public infrastructures and obviously also the small “normal” industries.

Pretty heavy stuff, more on Wiki here – SCADA.

It came six days after a Moscow-based security firm called Gleg announced the availability of Agora SCADA+, which attempts to collect virtually all known SCADA vulnerabilities into a single exploit pack. The 22 modules include exploits for 11 zero-day vulnerabilities, said the company’s Yuriy Gurkin in an email. It’s not clear how much the package costs.

Gurkin said Gleg’s website has come under sustained web attacks shortly after releasing the SCADA exploit pack.

“We have tried to switch to ddoshostingsolutions.com provider but in just 3 days were out of 500 GB traffic limit,” he said. “Currently trying to solve this.”

The vulnerability of SCADA systems had long been theorized, but it wasn’t until last year that the world got an object lesson on just how susceptible they could be to attack. In July, researchers reported the discovery of a computer worm that attacked SCADA software sold by Siemens. Research later showed that the underlying Stuxnet exploit amounted to a “search-and-destroy weapon” built to take out Iran’s Bushehr nuclear reactor.

SCADA software often runs on extremely old systems that are difficult to replace without causing disruptions to critical equipment. As a result, installing patches and upgrades is frequently avoided despite the obvious security benefits.

Most of the bugs are quite serious too, not just DoS attacks or simple information disclosure. The majority actually lead to code execution and are able to be exploited remotely to any of these SCADA systems that are connection to an Internet enabled LAN.

What’s worse is SCADA systems rate way lower than IT systems in terms of budget for audits and security, there are very few people with in-depth knowledge in SCADA security and in general people don’t really seem interested in it.

With the scary flip side being, the SCADA systems control MUCH more important equipment than any of the IT systems do. It’ll be interesting to see if any of these companies issue statement and fixes for the software and perhaps carry out some proper audits.

Of course issuing guidelines on setting up SCADA systems in a secure manner would be useful too.

Source: The Register

McAfee is actually the world’s second-largest security software company after Symantec, so this acquisition makes them a serious player in the security industry.

Intel has completed its $7.68 billion acquisition of security vendor McAfee, the chip maker announced on Monday.

The all-cash deal makes Intel a security industry powerhouse, giving it a broad range of consumer and enterprise security products. Though the acquisition has left some observers scratching their heads, Intel says it needs the McAfee technology to help it bake security into its microprocessors and chipsets — especially as Intel looks to become more competitive in smartphones and other portable devices.

“Intel and McAfee believe today’s approach to security does not adequately address the billions of new Internet-ready devices, including PCs, mobile and wireless devices, TVs, cars, medical devices and ATM machines,” Intel said Monday in a statement announcing the acquisition’s close. “With the surge in cyber threats, providing protection to a diverse online world requires a fundamentally new approach involving software, hardware and services.”

They will be running McAfee as a fully owned subsidiary and they also be leveraging other companies they have acquired to work together with the McAfee arm (companies such as Wind River).

As they said, the current approach to computer security (especially in the consumer sector) is stuck at least 10 years behind what is actually happening. I’m not sure if this merger can improve anything, but more security in the hardware/CPU/chipset can’t hurt really can it?

Yah of course some clever chap is going to find a way to disable it/block it or simply circumnavigate the protection – but it’ll still be better than nothing.

Intel had been working to get the deal approved by U.S. and European Union regulators since it was announced last August. The European Commission, in particular, had expressed concerns that Intel would give McAfee special treatment when it came to its processors and chipsets, locking other security vendors out of the technology. Those concerns had reportedly been threatening to hold up the deal, but late last month the European Commission announced that Intel had assuaged its concerns.

Although McAfee’s technology can now be integrated into a wide range of Intel products, McAfee itself will be run as a subsidiary, operated out of Intel’s Software and Services Group. That group is run by Renée James, who will now be the boss of McAfee chief Dave DeWalt.

Anyway at least the acquisition is wrapped up now so we can keep an eye on any plans they have been brewing since last year. It’ll be interesting to see if there are any major changes in the direction of McAfee or to be really optimistic – will we see McAfee anti-virus software improve?

I don’t believe Intel will try and play the anti-trust game and lock AMD out of the McAfee party..but honestly – who knows what will happen?

Source: Network World

He became notorious way back in 2007 by fulling unlocking the iPhone and then again in 2008 by jailbreaking the iPhone running 1.12 and 1.13 firmware.

At some point he also turned his attention to rooting the Playstation 3 and broke through the OtherOS leading Sony to disable it. The latest news is Sony is going all out against him for breaking the DMCA, for copyright infringement and a string of other accusations.

A federal judge ordered prolific hacker Geohot to turn over his computers and hard drives and to stop publishing the tools used to root Sony’s PlayStation 3 after finding his hack was likely a violation of US copyright law.

The temporary restraining order was issued on Thursday by US District Judge Susan Illston of San Francisco. It’s a major victory for Sony and a setback for hacker hobbyists who believe they should be permitted to modify hardware they legally own. It comes in a lawsuit Sony filed two weeks ago against New Jersey-based Geohot shortly after he deduced the security key Sony used to lock down the PS3.
Click here to find out more!

The ruling also comes as a defeat to 21-year-old Hotz, who two weeks ago, argued he wasn’t subject to the suit because he doesn’t have sufficient ties to Northern California, where the action was brought. Shortly after release of the order, his attorney vowed to fight on.

“Needless to say, we’re disappointed about the issuance of the TRO, but this doesn’t end the question of personal personal jurisdiction of Mr. Hotz, and we still intend to go forward with that motion,” San Francisco-based lawyer Stewart Kellar told The Register. “Suffice it to say it is burdensome to my client for him to give up his computers and hard drives for the order.”

It’s a tricky area as people assume once they’ve bought the hardware (the PS3 in this case) they own it and it’s their to do as they please with. Whilst that stands correct for the hardware, it does not for the software or bootloader on the machine – that is merely licensed to the user and still belongs to Sony.

So what Sony are claiming is George does not have the authority to reverse engineer the software or release the cryptographic key used to sign games to the public and by doing this he has damaged their business and therefore revenue.

They are also bringing the the DMCA into the the mix (Digital Millennium Copyright Act), which never ends well.

Sony’s complaint claimed that by publishing the means to bypass the protection measures built into the console, Hotz violated provisions of the Digital Millennium Copyright Act. Illston said Sony had “submitted substantial evidence” showing the hack constituted a DMCA violation and that Sony was likely to “suffer irreparable harm” if it wasn’t curtailed.

Sony’s suit names some 100 other people from a hacking collective known as fail0verflow, who in late December revealed the key used to sign PS3 games and demonstrated how to use it to run homebrew apps on the console. A few weeks later, Hotz independently deduced the “metldr” key, which allowed him to root the PS3. Sony’s complaint also alleges the hackers violated the Computer Fraud and Abuse Act.

The PS3′s use of IBM’s Cell processor makes the console ideal for tackling brute-force cryptography attacks and other parallel computing operations. Once upon a time, Sony included a modified version of Linux with the PS3. Sony eventually disabled the so-called OtherOS after Hotz devised a way to use it to gain full memory access to the console.

Hotz was among the first to jailbreak Apple’s iPhone so it would work on carrier networks other than AT&T’s. Last year, the US Copyright Office exempted iPhone jailbreaking from the DMCA so that they can run apps not officially sanctioned by Apple.

The PS3 is a very powerful piece of hardware locked down by a proprietary OS so that it can’t be ‘misused’ according to the definitions enforced on the users by Sony. As is normal with consoles, the console itself is actually sold at a loss (especially in the early days) and the companies make money from selling games. Now if somehow comes along and cracks the copy protection on the games and the console and allows everyone to play pirated games – their business model is screwed isn’t it?

And the US courts have already ruled that jailbreaking your iPhone is legal, so why not the PS3 as well?

I hope Geohot gets his computers and hard-drives back soon as having your stuff hauled away is one of the worst things that can happen.

Source: The Register

This kind of GSM snooping has been possible for a long time, but it’s always been prohibitively expensive. Now researchers using simple techniques and inexpensive equipment have managed to find a way to do it by running custom firmware on cheap Motorola handsets.

Researchers have demonstrated an alarmingly simple technique for eavesdropping on individual GSM mobile calls without the need to use expensive, specialised equipment.

During a session at the Chaos Computer Club Congress (CCC) in Berlin, Karsten Nohl and Sylvain Munaut used cheap Motorola handsets running a replacement firmware based on open source code to intercept data coming from a network base station.

Armed with this, they were able to locate the unique ID for any phone using this base, breaking the encryption keys with a rainbow table lookup.

Although far from trivial as hacks go, the new break does lower the bar considerably compared to previous hacks shown by the same reasearchers. In 2009, Nohl published a method for cracking open GSM’s A5/1 encryption design using a lookup table in near real time.

What was missing, however, was a way of identifying the call stream for an individual phone in order to apply the lookup to a real call within the clutter of data moving back and forth between a particular base station and the many phones using it. That is what Nohl appears to have worked out in his latest demo.

It’s by no means a simple or straight forwards attack but it just shows with the knowledge of the crypto algorithms used by GSM base-stations it’s possible to intercept conversations from specific handsets.

There hasn’t been a whole lot of stories about GSM hacking so it’s good to see something in this area as most of the World owns at least 1 GSM device and not a whole of people are looking at the security the networks are relying on.

Another important detail is that Nohl was able to replace the firmware of the handsets with custom software. According to the BBC report on which most stories are being based, this was only possible because the Motorola handsets in question had been reverse engineered after an unspecified leak.

How easy would it be to exploit the new hack? In short, not particularly easy. Creating a custom lookup table similar to Nohl’s would take months of work and any eavesdropper would still need to break into the handset in question.

The crack does lower the bar from being a hardware problem to one of software expertise, which will cause some alarm in the GSM engineering community.

Governments and the military won’t worry unduly as they will be using encrypted satellite phone systems and GSM phones equipped with extra layers of call encryption to make sensitive calls. Large companies might want to take note, however.

As far as I know most military and government phones even when relying on GSM have another layer of encryption on top as stated in the article, so they should be pretty safe. But what about the rest of the World? Some big companies and important people are relying on standard GSM handsets without any extra protection.

I hope to see more news in this area as it has pretty big implications for everyone.

Source: Network World

The latest discovery of such implementations was in the immobiliser technology used by car companies to secure their expensive vehicles. A researcher Karsten Nohl has exposed these weaknesses at the recent Embedded Security in Cars conference in Germany.

Weak cryptography means that car engine immobiliser technology has become easy for crooks to circumvent.

Nothing weaker than 128-bit AES is considered sufficient protection for e-commerce transactions, but car manufacturers are still using proprietary 40-bit and 48-bit encryptions protocols that are vulnerable to brute force attacks. Worse still, one unnamed manufacturer used the Vehicle Identification Number (VIN) as the “secret” key for the immobiliser.

The weakness of the technology was exposed in security research by ethical hacker Karsten Nohl of Security Research Labs, who links the weakness of the technology with a growth in car thefts in Germany last year, following years in decline.

Nohl outlined preliminary findings from his research at the recent Embedded Security in Cars conference, in Bremen, Germany. His research covers the communications between card immobilisers and engine electronic systems in dozens of cars. For example, Nohl was able to crack the Hitag 2 car immobiliser algorithm used by Dutch firm NXP Semiconductors in around six hours.

And using the VIN number as the secret key? Well, that’s not very secret is it? It’s akin to using the MAC address of a computer as the SSH secret key, no one in their right mind would do that. I guess that’s what happens when you leave the engineers to implement cryptography schemes without having anyone around handy with the cluestick.

I’d imagine some of these systems are protecting extremely expensive cars, so some basic equipment, some strong crypto knowledge and 6 hours and you can land yourself a $100,000 car. Not bad for a days work.

The research builds on work by other computer scientists and encryption experts dating back at least five years. In 2005 Ari Juels of RSA Labs and researchers at Johns Hopkins University in Baltimore, Maryland, circumvented the encryption system used by Texas Instruments.

Manufacturers of car immobiliser technology have defended the robustness of their technologies.

“To our knowledge the direct causal link between the failure to adopt AES systems and the rise in car theft cannot be drawn,” Thomas Rudolph of NXP told New Scientist.

Texas Instruments claimed its proprietary cryptographic systems might be stronger than AES. Nonetheless both firms are in the process of phasing out their home-cooked crypto tech in favour of industry standard encryption systems based on 128-bit AES.

And what it is with TI claiming their system MIGHT be stronger than AES? When did ‘might‘ ever give anyone confidence? In all honesty, there is no reason at all for using proprietary algorithms or implementations. Those out in public like AES have been tried, tested and approved by the greatest crypto minds in the World, I don’t care how smart you think your employees are – but trust me they aren’t as smart as the people scrutinising AES.

I hope to see all companies using weak proprietary protocols in any industry phase them out and switch to tried and tested industry algorithms.

Source: The Register

It’s a problem that is plaguing Android right now with different phones running different core OS versions (from 1.5 to 2.2) – on top of that 3rd party skins for the OS from Samsung, Motorola and more. This makes updating the OS slow and many users are stuck with old versions and no news regarding updates.

A security researcher has released proof-of-concept code that exploits a vulnerability in most versions of Google’s Android operating system for smartphones.

M.J. Keith of Alert Logic said he released the attack code to expose what he characterized as inadequate patching practices for the open-source mobile platform. Rather than find the underlying bug himself, he searched through a list of documented security flaws for Apple’s Safari, which relies on the same Webkit browser engine used in Android. In short order, he had an attack that exploits about two-thirds of the handsets that rely on the OS.

“They need a better patching system,” Keith told The Register. “They do a good job of repairing future releases, but I think a better patching system needs to be set up for Android.”

The bug Keith’s code exploits was fixed in Android 2.2, but according to figures supplied by Google, only 36 percent of users have the most recent version. That means the remainder are susceptible to the attack.

Google has claimed that they are changing the architecture with the upcoming release of Gingerbread, many of the system apps will be pushed to the Marketplace – meaning they can push out updates much faster and easier than if everything is integrated in the OS image.

Of course core problems with the kernel or underlying OS will still have to be addressed via firmware updates, but still like this – which effects the browser – could be negated if a new browser version could be pushed out from the Android Marketplace.

The same goes for the recent Critical Zero Day Abobe Flash Flaw Which Put Android Phones At Risk.

What’s more, Keith said he had no trouble finding other documented Webkit vulnerabilities that have yet to be fixed in version 2.2.

“I found about four or five and I wasn’t trying to [do] an exhaustive search,” he said.

A Google spokesman declined to comment for this post. To be fair, Android’s design does a good job of segregating the functions of one application from those of another. That would make it hard for someone exploiting the bug Keith demonstrated to gain root privileges or access to many of the targeted handset’s resources. But it still would allow an attacker to access anything the browser can read, including a phone’s Secure Digital memory card.

The bigger point, Keith said, is that most users have no idea their devices are vulnerable to bugs that were patched long ago on other platforms.

“I wanted to demonstrate that nobody’s being notified that their Android phone is vulnerable to this stuff,” he explained. Google “wants to pretend it’s not there.”

It is a serious problem that Android is facing right now and I hope Google do more to address this and work alongside with the handset vendors so OS updates can be pushed out in a more efficient and timely manner.

The exploit code can be found here:

Android 2.0-2.1 Reverse Shell Exploit

Source: The Register

To allow complete simulations, GNS3 is strongly linked with:

• Dynamips, the core program that allows Cisco IOS emulation.
• Dynagen, a text-based front-end for Dynamips.
• Qemu, a generic and open source machine emulator and virtualizer.

Features Overview

• Design of high quality and complex network topologies.
• Emulation of many Cisco IOS router platforms, IPS, PIX and ASA firewalls, JunOS.
• Simulation of simple Ethernet, ATM and Frame Relay switches.
• Connection of the simulated network to the real world!
• Packet capture using Wireshark.

This project is an open source, free program that may be used on multiple operating systems, including Windows, Linux, and MacOS X.

You can download GNS3 v0.7.2 here:

Windows All-in-one – GNS3-0.7.2-win32-all-in-one.exe
Windows Binary – GNS3-0.7.2-bin-win32.zip
Mac DMG Package – GNS3-0.7.2-intel-x86_64.dmg
Linux/Source – GNS3-0.7.2-src.tar.gz

Or read more here.

You can download USBsploit here:

usbsploit-0.3-BETA-linux-i686.tar.gz

Or read more here.