How many ways can hackers attack?.

[Wanker]

Here is one way.

Russian government-backed hackers who penetrated high-profile U.S. government and defense industry computers this year used a method combining Twitter with data hidden in seemingly benign photographs, according to experts studying the campaign.

In a public report Wednesday, researchers at security company FireEye Inc said the group used the unusual tandem as a means of communicating with previously infected computers. FireEye has briefed law enforcement on what it found.

The technique, uncovered during a FireEye investigation at an unnamed victim organization, shows how government-backed hackers can shift tactics on the fly after they are discovered.
“It’s striking how many layers of obfuscation that the group adopts,” said FireEye Strategic Analysis Manager Jennifer Weedon.

“These groups are innovating and becoming more creative.”
The machines were given an algorithm for checking a different Twitter account every day. If a human agent registered that account and tweeted a certain message, instructions for a series of actions by the computer would be activated.

The tweeted information included a website address, a number and a handful of letters. The computer would go to the website and look for a photo of at least the size indicated by the number, while the letters were part of a key for decoding the instructions in a message hidden within the data used to display the picture on the website.

Weedon said the communication method might have been a failsafe in case other channels were discovered and cut. Vikram Thakur, a senior manager at Symantec Corp, said his team had also found Twitter controls combined with hidden data in photos, a technique known as steganography.

FireEye identified the campaign as the work of a group it has been internally calling APT29, for advanced persistent threat. In April, it said another Russian-government supported group, APT28, had used a previously unknown flaws in Adobe Systems Inc.’s Flash software to infect high-value targets.

Other security firms use different names for the same or allied groups. Symantec recently reported another data-stealing tool used in tandem with the steganography, which it calls Seaduke. Thakur said both tools were employed by the group it knows as the Duke family.

Thakur said another tool in that kit is CozyDuke, which Russian firm Kaspersky Lab says is associated with recent breaches at the State Department and the White House.

 

[Prick]

Too many :-Cool/"

 

[Rochard]

 

[DannyDeVito]

That was 3 years ago. Anything recent?.

 

[Madman]

I've been hacked and I can't sit down.

 

[User-E]

US military’s smart sniper rifles not so smart for hackers, can be hacked to disable or change target

Software of TrackingPoint’s expensive smart sniper rifle can be hacked to disable it or misdirect its target due to flaws.

Since 2011, when TrackingPoint was launched, it has been selling over thousands of it high-end Linux powered rifles which are known for its self aiming system. TrackingPoint combines technology, sensors, cameras and Linux software into a sniper rifle to develop ‘Smart Rifles’ which enables even a beginner to accurately hit targets that have been placed far away. It’s almost foolproof shooting, albeit at a $13,000 price tag.

The scope allows its shooter to ‘digitally lock’ the target and then dial in the required variables such as wind, temperature and weight of the bullet being fired. Once the trigger is pulled, the smart rifle would activate its firing pin only when the barrel has been perfectly oriented to nail the target thus we can say the software actually chooses the exact moment to fire.

Further, the gun can also be connected to a tablet or smartphone via Wi-Fi which allows another person to view whatever the shooter is viewing in the scope. Now, the con part of this entire unit is its software which can be hacked, just like any other software!

TrackingPoint began marketing their product to hunters and it was just last year when there were rumors that even U.S. army was testing these auto-aiming rifles.

Two security researchers, Runa Sandvik and Michael Auger, who are also husband and wife, have now demonstrated that this smart rifle can be hacked and fooled into misdirecting its target or even disable it. The duo have shown, that anyone who is near enough for the Wi-Fi connection of the smart rifle can easily manipulate with the controls of this smart rifle.

The most important point to be noted here is that hacker cannot make the rifle to move in any direction or shoot on its own; however hacker can make changes to the bullet.

For instance, in a scenario of hostage taken by criminal, hacker can misdirect the police sniper to miss their target while shooting that can result in killing the hostage instead of criminal. Worst could be that the hacker completely locks the control of the smart rifle rendering it useless.

While speaking to CNNMoney, Michael Auger recalled that it all began last year summer when they happened to stop by the TrackingPoint’s booth at the Nation’s Gun Show located at west of Washington, D.C.

Auger said: “We were reading their marketing material that said you could connect it to your phone.”

The advertisement read out that “gun enabled with Wi-Fi connection” actually made her purchase it and check out the security of its software, which is natural for a security researcher! Thus she says: “That’s when I suggested we buy one and hack it.”

Soon, a lower-end Precision-Guided .308 model was purchased by the duo at a price of $12,995.

Next, Auger began her work by opening the computerized scope and started studying the hardware of this smart rifle and was able to discover the flaws which was quite conspicuous.

Sandvik and Auger have found of some chain of vulnerabilities in the Linux software of the rifle through which they can take control of the self aiming functions boasted by TrackingPoint.

The very first vulnerabilities is its inbuilt Wi-Fi which has a default password, which when ON allows anyone within the range of the Wi-Fi to get connected to it. Thus once hacker gets connected to the Wi-Fi, the gun serves as a server and gives access to the APIs which enables alteration of key variables in its targeting applications.

The duo also found that an attacker could also add themselves as ‘root’ user on the device which would enable them to take a complete control of the software and make permanent changes to its targeting variables including deleting essential files which could completely disable the scope from operating. It was also discovered that suppose user has set some PIN to limit access of outsiders to the gun, the root attack can still gain complete access and in fact allow hacker to lock out the gun’s owner by setting a new PIN. Thus attacker can completely stop the gun from firing the ammunition. This proves that the gun listens to remote instructions and allows administrative access to hackers which could be dangerous.

Auger and Sandvik carried out their experiments with the smart rifle at a gun range in West Virginia.

During the test shot, Auger fired just once and was able to hit the target placed at 50 yards.

Then, Sandvik tapped into the rifle from a computer placed near shooter and tricked the software into thinking that the 175 grain bullet is actually 2,857 times heavier. Auger now fired in the same manner as in the test shot, however this time the bullet landed 30 inches to the left of the target.

CNNMoney quotes: “They didn’t just trick the rifle to miss. They tricked it to miss — just right.” It seems the same thing can be done even by adjusting the wind and temperature readings of the rifle.

Sandvik added: “Unless you’re really familiar with the rifle and know what you’re doing, you probably won’t notice those variables are changing. You’ll be too focused lining up your shot.”

The duo say that the most surprising part of this hack is that it is quite easy to exploit the flaws.

Sandvik claims that the hacker would just have to download the widely available TrackingPoint Smartphone app, know their default password and just be in their vicinity so as to get access to the device, one is sure to sabotage the smart rifle’s shot by readjusting the temperature and wind settings. The worst thing here is that the default password has been published online!

If a hacker wants to create more damage then they will have to re-engineer the hardware and lock the trigger, also make changes to the bullet weight and worst is just turn off the software and render the device useless. Sandvik fears that someone would definitely publish all this online to help other hardware hackers.

Auger and Sandvik are planning to reveal more about their research at the Black Hat cyber-security convention which would be held next week in Las Vegas.

Then, it would be easier for any hacker to discover the weaknesses of the rifle and exploit it individually; unless ofcourse TrackingPoint takes this issue seriously and takes firm steps to fix the flaw.

It seems Sandvik has already spoken to TrackingPoint on Sunday and she adds “they seemed… interested in fixing the issues we identified.”

When CNNMoney inquired, TrackingPoint did not comment about the flaws or any possible steps being taken towards fixing the issue.

https://www.techworm.net/2015/07/us-military-smart-rifle-hacker-hack.html

 

[User-E]

Hackers can remotely take over Nuclear Power Plants by exploiting vulnerability in IES

Hackers can exploit the vulnerabilities of Industrial Ethernet Switches and take control over Nuclear Power Plants or the Hydroelectric Dams.

Are you among those who believe that hackers can only take down a website with the DDOS attack? If Yes, then its time you started thinking otherwise, because a new research has revealed some shocking vulnerabilities in the Industrial Ethernet Switches (IES) which could be exploited by the hackers to gain an easy access to enormous Nuclear Power Plants or the Hydroelectric Dams

As per the The Daily Dot, the security researchers would be uncovering the entire details of the vulnerabilities present in the IES at the BlackHat cyber security conference which will be held next week in Las Vegas.

What is an Industrial Ethernet Switch and why is it so very important?

IES are basically used to connect the various devices in huge power plants, hydroelectric dams, refineries, ports, factories and other industrial organizations and they are responsible for the prompt maintenance of the internal network. However, security researchers have discovered certain security flaws which can help cyber attackers to “not only gain access to the network but also take full control and cause potential damage.”

Read more here: https://www.techworm.net/2015/08/security-flaws-in-industrial-ethernet-switches.html

 

[User-E]

Cyber Warfare : United States decides hack back against China

United States announces open cyber war with China as a revenge for OPM and other hack attacks

According to a New York Times report published this Friday, the US administration of President Barack Obama has made a decision to retaliate against China for the alleged theft from the databases of the Office of Personnel Management (OPM) and the disclosure of personal information of over 20 million Americans from government databases.

The NYT report suggests that President Barack Obama has decided to retaliate against China, specifically due to the extent and nature of the OPM robbery. That said, the White House is still trying to find a way to retaliate against China without sparking the rapidly increasing cyber conflict.

The decision was made after the Obama administration deduced that the hacking attack on the OPM was so immense that the customary practices for dealing with traditional spying cases did not apply.

According to The Verge, the White House is torn between two options: a symbolic response like a diplomatic protest or the dismissal of known Chinese agents in the United States, to more significant actions like hacking back.

More important steps include retaliatory operations planned to steal or disclose information from Chinese entities which may be valuable to Beijing, to the public, in pretty much same way as the secret OPM files on government employees were to Washington, were leaked by OPM hackers.

The responses to the cyber attack from both the countries have made some officials involved in the internal debates fear an escalation of the hacking conflict between these countries.

For instance, legislators are urging for immediate action, according to The Hill. “The way you deal with a bully on the playground is to punch them in the face and put them on the ground because the only thing they respect is power,” former Arkansas Gov. Mike Huckabee said.

This does not imply that a response is expected in the near future or by when would it be done. The White House would have to ascertain the negative aspect of any important, yet proportionate, retaliation is greater than the benefits, or would it lead to retaliation on individuals or American firms working in China. President Obama, clearly seeking maximum advantage, has asked his employees to come up with a more creative set of responses.

A senior administration official involved in the debate, who spoke on the condition of anonymity to discuss internal White House plans said “One of the conclusions we’ve reached is that we need to be a bit more public about our responses, and one reason is deterrence.”

“We need to disrupt and deter what our adversaries are doing in cyberspace, and that means you need a full range of tools to tailor a response,” the official added.

Legal action may be taken against Chinese individuals and organizations by the US Justice Department who are believed to be responsible for the data theft. For example, last year, five Chinese military officers were formally accused of stealing the intellectual property from American companies. However, many officials describe such punishment as symbolic only because none of them will be prosecuted and sentenced in the US.

Even though no official charges has been made by Washington against Beijing for carrying out the recent hacks including the OPM one, many of the private cyber security researchers and US officials have blamed the Chinese government for being behind the intrusions.

For years, the US has been charging the Chinese government and military of conducting computer-based attacks, including theft of information from federal agencies.

The hacking claims have been dispersed by China as “irresponsible and unscientific.”

Dismissing the cyber attack charges by Washington as deceitful, Beijing says the leaks from intelligence agencies have disclosed that the US itself is the most active executioner of cyber spying against foreign countries, especially against China.

https://www.techworm.net/2015/08/united-states-vs-china-cyber-war.html

 

[Pullmyfinger]

Wow thanks.

 

[User-E]

The Canadian Military Will Pay You $635,000 to Successfully Hack Its Vehicles

Canada’s military department want to pay hackers $635,000 to hack its vehicles. The Department of National Defence has floated tenders to hire a hacker to hack into its vehicles.

In the tender floated here, the department says interested parties can quote to find weaknesses in its vehicles and trucks. After the recent concerns over car hacking after a reporter was able to hack the Jeep, car hacking seems to have become the latest buzz word.

The Canadian military contract will have a hacker analyze the systems of a 2015 light-duty pick-up truck — they’re not releasing specifics on the truck to be hacked. They then must figure out where the vulnerabilities are, and demonstrate how they can be hacked.

A 2014 vehicle can have up to 100 computers on on board, running 60 million lines of code and exchanging 25 gigabytes of data every hour, according to the tender.

Payment for the main work tasks is about $158,000 ($205,000 Canadian), with another $477,000 ($820,000 Canadian) possibly available for additional work as required and requested. Those extra tasks might include developing software to mitigate the potential for hacking.

The work will be completed Defence Research and Development Canada Valcartier Research Centre in Quebec City, with the vehicle and software supplied by the Department of National Defence.

“Cyber-attacks on information technologies like personal computers and servers usually result mostly in immaterial damages like the loss, the alteration or the theft of information or money, and the disruption of operation,” according to the [. “In the case of vehicular systems, cyber-attacks are a more important concern since the safety of their users or the other users on the road might be at stake.”

The tenders are to be opened on 27th October, so if you are interested you can visit here.

https://www.techworm.net/2015/10/canadian-military-hiring-hackers-to-hack-its-vehicles.html

 

[User-E]

Hacking fears make US Navy teach new recruits celestial navigation techniques

It has been reported this week that the United States Naval Academy situated in Annapolis, Maryland, has returned to using celestial navigation for all new recruits, teaching the use of sextants – instruments made of mirrors used to calculate angles and plot directions over computer hacking concerns.

Lt. Cmdr. Ryan Rogers, the deputy chairman of the naval academy’s Department of Seamanship and Navigation said “We went away from celestial navigation because computers are great. The problem is, there’s no backup.”

Celestial navigation was the technique used to guide ancient Polynesians in the Pacific and took Ernest Shackleton to remote parts of Antarctica. It was also used by astronauts on Apollo 12 when the craft was disabled by lightning.

However, once the United States Air Force launched the Global Positioning System (GPS) satellites, the Naval Academy stopped using celestial navigation in 1998. While celestial navigation can calculate your position within 1.5 miles, by 1995 GPS could pinpoint your location within feet, and the system has never been shut down.

Rogers told: ‘If you can use GPS, it’s just so much more accurate. We know there are cyber vulnerabilities.’

Today, the system relies on 31 satellites, which circles the Earth twice a day and costs American taxpayers about $1 billion (£650 million) a year.

“The perceived need for sextants was taken away,” said Peter Trogdon, president of nautical instrument company Weems & Plath in Annapolis, Maryland.

The sales of sextants declined after the arrival of GPS, Mr Trogdon, said “There’s only a few thousand sold a year. Most of those are sold to yachtsmen who want to have a backup.

“If you can use GPS, it’s just so much more accurate,” said Lt. Cmdr. Ryan Rogers. But, he added, “we know there are cyber vulnerabilities.”

Celestial navigation training for the fleet stopped in 2006. However, in 2011, ship navigators’ celestial navigation training was reinstated, with training only for enlisted ranks planned. Pilot programmes are also beginning for army reservists in Philadelphia, Auburn, and Rochester.

“Knowledge of celestial navigation in the GPS era provides a solid backup form of navigation in the event GPS becomes unreliable for whatever reason,” said Captain Timothy Tisch, of the US Merchant Marine Academy – which has never abandoned celestial navigation. “It is also good professional practice to use one navigational system to verify the accuracy of another.”

The juniors were the first midshipmen to receive training this summer. Further, during an advanced navigation course, all newly enlisted sailors will have to study the stars and learn theories of celestial navigation from autumn next year. The first to graduate with the reinstated instruction would be the class of 2017.

“This is the first semester we added it in, so we’re just baby-stepping it,” said Lt. Christine Hirsch, who teaches navigation at the academy. Only three hours will be taught. “We just added the theory, but we really do have the capabilities to expand.”

Mr Trogdon said the decision was “fantastic”. “How cool is it to go back to the ancestral technique?”

https://www.techworm.net/2015/10/us...r-navigation-because-of-fears-of-hacking.html

 

[George Costanza]

:don'twantto-see:/

 

[Boing]

An autistic man suspected of hacking into US government computer systems is to be extradited from Britain to face trial, a court has ruled.

Lauri Love, 31, who has Asperger's syndrome, is accused of hacking into the FBI, the US central bank and the country's missile defence agency.
Mr Love, from Stradishall, Suffolk, has previously said he feared he would die in a US prison if he was extradited.

A judge at Westminster Magistrates' Court made the extradition ruling.

Earlier, his lawyer said his alleged hacking had "embarrassed" US authorities.
Tor Ekeland said the US government "had very, very bad security and these hacks utilised exploits that were publicly-known for months".

Mr Love's lawyers said he could face up to 99 years in prison if convicted of the hacking offences.

Earlier he stood in the dock as district judge Nina Tempia ruled he could be extradited to the US, where he could face trials in three different states.
He was first arrested at home in Suffolk in 2013 and had computer equipment seized by British police, who then released him on bail.

He was not charged in the UK, where the investigation into him was dropped.

Mr Love's defence team argues his depression and Asperger's syndrome mean he should not be sent abroad, but US prosecutors say he is using his mental health issues as an excuse to escape justice.
In England and Wales, the maximum sentence for crimes such as those of which Mr Love is accused is two years and eight months.

 

[Anonymous69]