Tampilkan postingan dengan label SECURITY. Tampilkan semua postingan
Tampilkan postingan dengan label SECURITY. Tampilkan semua postingan

Senin, 13 Desember 2010

What exactly is hacking

The term probably originated in the 1960s when the modern computing system was evolving and people were studying computers in the labs of the Massachusetts Institute of Technology (MIT). There were a few people who could make the system work faster or differently and they were called hackers. These people were programmers who could simply break into a computer to see its code — the statements written by the original programmers to specify the actions to be performed by a computer.

Most of these early hackers were visionaries who would later shape the computer industry in the way we see it today. But in the 1970s this word started getting a bad reputation after the emergence of phone hackers. The most remarkable of them was John Draper, who devised the technique of breaking into regional and international phone networks for making free calls. He was later convicted and soon the word started getting its present day meaning — unauthorized access of computers and computer networks.

When did hackers start building communities or groups?

The early '70s witnessed hardwiring of neighbourhood computers and a community memory was created, which was nothing but an electronic bulletin board where the users can teletype their messages and retrieve the messages meant for them.

By the early '80s, the system was improved resulting in the evolution of a more efficient electronic bulletin board system (BBS). Users could now use usernames to hide their identities and the BBS became a place to boast of hacking accomplishments as well as trading stolen passwords and credit card numbers. The BBS witnessed the formation of the first hacking groups and groups like Legion of Doom and Chaos Computer Club were formed in the US and Germany respectively.

The 1983 film 'War Games' is considered the first mainstream film which introduced the general public to the world of computer hacking. In the same year, six teenagers, known as the 414s, were arrested for breaking into dozens of high profile computer systems. The event got widespread publicity and the image of hackers as being young and intelligent got established in society.

When did hacking start gaining notoriety?

Although it started in the early '70s, the first case to get international publicity was the cyber espionage of 1989 when four German hackers led by Karl Koch hacked US military computers and sold the information to the KGB. Koch, who confessed to his role in the hacking, was later found burnt to death in a forest.

By now the hacking community had got divided into two groups — black hats or crackers who worked to exploit computer systems, and white hats or hackers who were hired by companies to do ethical hacking for improving network security. The crackers included Jonathan James, who cracked into Nasa computers, stealing software worth approximately $1.7 million, or people like Adrian Lamo, who used to break into the websites of big corporations like Yahoo, Bank of America and Citigroup to find the network hole which he would later inform the company about.

Lamo was arrested after hacking the systems of the New York Times and his excuse that he was doing penetration testing did not work. Similarly, in 1993, Kevin Poulsen managed to hack into the system of a radio station in Los Angeles. Along with his friends, he rigged the station's phone system so that only their calls were received. This helped them win two Porsches, vacation trips and cash worth $20,000.

6 Jebakan yang Dipakai Hacker untuk Mencuri Password Facebook

Salah satu kemudahan yang ditawarkan Facebook adalah bisa diakses di mana pun Anda berada. Dengan semua konektivitas ini, ada tanggung jawab penting yang harus dijaga yaitu keamanan account pribadi.
Untuk mencegah terjadinya pembajakan akun Facebook, Anda baiknya Anda tahu trik-trik yang dipakai hacker dalam mencuri akun. Berikut ini adalah trik yang biasanya dipakai hacker untuk membajak akun/ mendapatkan password Facebook seseorang.

1. Aplikasi Facebook dan Iklan
Berhati-hatilah saat sudah login ke Facebook. Jangan sembarangan meng-klik iklan atau aplikasi yang Anda sendiri tidak familiar. Banyak pengguna Facebook terkena virus dari iklan di Facebook atau terjebak memberikan data pribadi mereka tanpa sengaja ketika menggunakan aplikasi tertentu.

2. Halaman Phishing Login Facebook
Hacker umumnya selalu mengeksploitasi topik-topik populer. Spammer menggunakan berbagai macam cara dan metode agar Anda terjebak dan memberikan account Anda. Facebook sendiri belakangan ini banyak dijadikan target serangan spam lewat teknik phishing. Ketika kita mengklik link yang terdapat pada Facebook, kita akan digiring ke sebuah halaman yang seolah-olah halaman login Facebook, padahal halaman tersebut adalah halaman yang dirancang spammer untuk mencuri password Facebook.
Salah satu cara untuk menghindari seperti jebakan ini adalah dengan tidak sembarangan meng-klik URL pada email. Lebih baik mengetikkan URL situs yang ingin dikunjungi langsung pada browser. Sebenarnya sangat mudah untuk mengenali URL palsu. Jika URL yang tertulis bukan Facebook.com, maka URL tersebut adalah palsu.

Encryption

 
John Edwards
For many people, the word "encryption" invokes images of spies, clandestine operations and World War II code breakers feverishly working to decipher enemy messages. Actually, encryption is a priceless security tool that any business can easily use to keep sensitive information confidential and safe from prying eyes.

Unfortunately, many businesses fail to take advantage of encryption technology, fearing that it's too complex and difficult to use on a routine basis. In reality, encrypting vital data isn't much more difficult than running a virus scanner or a data-backup program. Here's how to get started.

The Basics

There are two basic ways to encrypt data. One approach is to use asymmetric PKI (public-key infrastructure) encryption. PKI cryptography is based on a pair of cryptographic keys: One is private and known only to the user, while the other is public and known to the opposite party in any exchange.

PKI technology provides privacy and confidentiality, access control, proof of document transmission, and document archiving and retrieval support. While most security vendors currently incorporate some type of PKI technology into their software, differences in design and implementation prevent interoperability between products.

The other method of encrypting data is symmetric key protection, also known as "secret-key" encryption. Generally speedier yet less secure than PKI, symmetric encryption uses the same key to both encrypt and decrypt messages. Symmetric technology works best when key distribution is restricted to a limited number of trusted individuals. Since symmetric encryption can be fairly easy to break, it's primarily used for safeguarding relatively unimportant information or material that only has to be protected for a short period of time.

Applying Encryption

The easiest way to use encryption is to purchase a business application or a hardware product that incorporates some form of encryption technology. Microsoft's Outlook Express email client, for example, provides built-in encryption support. Meanwhile, vendors such as Seagate Technology LLC and Hitachi Ltd. have started incorporating encryption technology into their hard drives.

Since most software applications and hardware products don't include any type of internal encryption technology, business owners and managers need to look for stand-alone encryption products. This can be a confusing process, one that's best approached by first determining the business's precise security requirements, then finding an encryption product that fits each need.

Microsoft Vista Enterprise and Ultimate users can take advantage of BitLocker Drive Encryption, a full disk tool that offers powerful 1024-bit encryption. Another Windows offering is EFS (Encrypting File System), which uses symmetrical PKI technology to provide file encryption.

Beyond Microsoft, leading encryption vendors and products include PGP, open-source TrueCrypt, DESlock+, Namo FileLock and T3 Basic Security.

What to Encypt

So how do you know what to encrypt? Here are some places to start:

Minggu, 11 Juli 2010

SQL Injection

SQL Injection is a technique where an attacker creates or alters existing SQL commands (by using some special symbol) to gain access to unintended data or even the ability to execute system level commands in the server. SQL injections are the result of Poor Input Validation and can be blocked by proper input validation.

Application that do not correctly validate and/or sanitize the user input, can potentially be exploited in several ways:

· Changing SQL values.
· Concatenating SQL Values.
· Adding Function calls & stored Procedures to a statement.
· Typecast and concatenate retrieved data.
· Adding system functions & procedure to find out critical information about the server.

Peeking at a Sniffer

Let's begin by peeking into a Wireshark (Ethereal) capture file http://www.milw0rm.com


Looking at this for the first time might be overwhelming. However, let's take that deep breath, examine the packet capture line by line and implement our knowledge in TCP/IP.

Packet 1: ARP Broadcast. We've attempted to send a packet to the Internet, and before our computer can actually send it, it needs to identify the default gateway on the local network. The default gateway IP address is configured on the requesting machine, but the default gateway MAC address is unknown. My
machine sends a broadcast to the whole network, asking “Who has 192.168.0.1?,
Tell 192.168.0.186”.

Packet 2: All computers on the local subnet receive this broadcast and check whether 192.168.0.1 belongs to them. Only 192.168.0.1 responds to this ARP broadcast and sends an ARP unicast reply to 192.168.0.186, informing it of the MAC address requested.

Packet 3: Now that our computer knows where to send its packets in order for them to reach the internet, we need to resolve the IP of www.milw0rm.com. Our computer sends a DNS query to the DNS server defined in our TCP/IP settings and asks the DNS server for the IP address of www.milw0rm.com.

Packet 4: The DNS server replies and tells our computer that the FQDN www.milw0rm.com is an alias for milw0rm.com.

Packet 5: Our computer insists on an answer and asks the DNS server, once again, for the IP address of milw0rm.com (notice, no www).

Packet 6: The DNS server replies and tells our computer that the IP address for milw0rm.com is 213.150.45.196.

Packet 7: Armed with this information, our computer attempts a 3 way handshake (remember that buzzword from TCP/IP?) with 213.150.45.196 on port 80 and sends a SYN request.

Packet 8: The web server responds with an ACK and sends a SYN to our machine.

Packet 9: We send a final ACK to the web server and complete the 3 way handshake.

Packet 10: Now that the handshake is complete our computer can start talking with the service using a specific protocol. Since we are using a web browser, our computer sends an HTTP GET request which retrieves the index page, and all linked images, to our browser.

Packets 11 – end: The main page of milw0rm.com, including all linked images, are loaded in our browser.
After analyzing this dump we can see that sniffers actually make sense and can provide us with detailed information about what goes on in our network.

(Continued)

Kamis, 17 Desember 2009

Nook E-Reader Gets Hacked to Run Pandora



A few Nook device owners have hacked it to run the Pandora music application in the background.

The move opens the door to adding more apps to the e-reader — something that Barnes & Noble does not support officially.

“It wasn’t that hard,” says Robbie Trencheny, a 18-year-old student who is also the team leader at nookDevs, a wiki and an online forum for Nook enthusiasts. “Once we had rooted the Nook (on Sunday), it was only a matter of time until we could put an app on it.”

“Rooting” the Nook involves hacking its system files to get full access to the device’s Android operating system. But unlike jailbreaking the iPhone, rooting the Nook isn’t just about tinkering with the software. Instead, Nook customers have to take a screwdriver to get to the device’s innards.

Nook’s Android OS is on a microSD card that needs to be connected to a computer to change a file on it. Once that’s done, the power of Nook’s Android OS is available to its users.
To run Pandora, Trencheny first searched for the .apk file associated with the app. “It’s a file extension that Android uses and every app has it,” he says. Once that file is wirelessly downloaded onto the 3G-enabled Nook, users have to run a command in the terminal shell of the device. With a few more steps described on the nookDevs wiki, they can get Pandora installed on the Nook.

There are a few more steps to get it operational. The Nook’s touchscreen won’t cooperate with the Pandora app so users have to use a VNC remote control software to get past the app’s initial login screen. Once that’s done, Pandora works perfectly with the Nook touchscreen and can run in the background as you browse books, says Trencheny.

If all that sounds a little rough for someone who just likes to pick up an e-reader and read, then there’s a fix in the works, assures Trencheny. NookDevs is working on creating a software unlock so users won’t have to open up the Nook. They are also trying to open a marketplace just for Nook apps.

And while Pandora is the first to make it to the Nook, adding other apps should be easy, says Trencheny. “We can run multiple apps if we want to,” he says.
NookDevs members haven’t heard any complaint, so far, from Barnes & Noble. “We have looked through the end user license agreement and, as far we can tell, there is nothing in there to get us into trouble,” says Trencheny. “We are not abusing the 3G or breaking the DRM rights on the books.”Source

Adobe to patch zero-day Reader, Acrobat hole



Adobe on January 12 will patch a critical hole in Reader and Acrobat that is being exploited in attacks. That date is the company's next scheduled quarterly security update release.
The zero-day hole, which affects Reader and Acrobat versions 9.2 and earlier, could crash the system and allow an attacker to take control of the computer.

Malicious Adobe Acrobat PDF files are distributed via an e-mail attachment that, when opened, executes a Trojan that targets Windows systems, according to Symantec. The rate of infection is extremely limited and the risk assessment level is very low, the company said.

Adobe decided to issue the patch in cycle in about four weeks rather than work on an earlier patch release because that would take between two and three weeks to deliver and would put the regular quarterly update off schedule, the company said in a blog post.
"The team determined that by putting additional resources over the holidays towards the engineering and testing work required to ship a high confidence fix for this issue with low risk of introducing any new problems, they could deliver the fix as part of the quarterly update on January 12, 2010," Adobe's Brad Arkin wrote.

In the meantime, customers can use a new JavaScript Blacklist mitigation feature that allows for easy disabling of JavaScript, Arkin said.
"Additionally, an informal poll we conducted indicated that most of the organizations we talked with were in favor of [releasing the patch in cycle] to better align with their schedules," he wrote.

Meanwhile, Webroot analyzed the payload of the malware and found that it installs three files that look like Windows system files that are digitally signed with a forged Microsoft certificate. Unlike legitimate Microsoft-signed certificates, these lack an e-mail address and a time stamp, the company said in a blog post.
"Authors of Trojan horse apps rarely go to the trouble of digitally signing files in this way," writes
Webroot researcher Andrew Brandt. "It's not clear why they would be digitally signing files, but clearly the person or people behind this are up to no good." Source

Rabu, 16 Desember 2009

The iPhone Goes to War

Is the iPhone going to war?

On Wednesday at the 2009 Intelligence Warfighting Summit in Tucson, Raytheon, the military contractor, announced an iPhone application that tracks friends and foes, shows their positions on live, real time maps and provides secure communications.

Called the One Force Tracker, the Raytheon iPhone software can also be used by first responders like police, firemen, and emergency medical technicians.

The app is completely operative and works on a standard iPhone, said J Smart, chief technology officer for Raytheon’s Intelligence and Information Systems. “We are really delighted to be leveraging Apple’s innovation.”

The adaptation of the iPhone to military use is somewhat unusual, as technology more often trickles from the military to the consumer market. But this is a rare case of consumer hardware and software concepts being adapted for military use.

For instance, crowdsourcing, which has volunteers use cellphones to report real-time traffic flow, could be adapted to turn each soldier into a reporting unit, delivering real-time data about position and status.

Communications resemble social sites like Facebook, in which your friends would be represented by a military unit, and could be used to track position of, and communicate with, other units.

Maps with an overlay of points of interest are familiar to every GPS user. The Raytheon app would use the same concept, but points of interest might be known sniper sites or safe fallback positions.

Field information would be transmitted back to a central computer that would crunch the data, update it and push it back out to the soldiers. “This is hypothetical, but if there is a building with known terrorist activities, it could automatically be pushed to the phone when the soldiers get near that area,” said Mr. Smart.

Live information could also be used to reduce tactical errors and friendly fire incidents. “If there was another platoon that was supposed to arrive, and they were delayed, or ahead of schedule, you could adapt your plan,” said Mr. Smart. “If one of the units you are counting on is redirected, you know that in real time.”

Mr. Smart also said that Raytheon was developing sensors that could be attached to phones so that they would serve other purposes. He declined to give specifics, however mobile phones have been outfitted as portable ultrasound machines, which would be useful for battlefield medicine.

Although the application that Raytheon has developed will work with an off-the-shelf iPhone, the company concedes that there would have to be alterations for the battlefield.

One iPhone limitation to be addressed is that it only carries out one function at a time unlike competing systems from Palm and Google, which can run several concurrently. If a soldier is to have position automatically reported, the GPS will have to run at the same time as other applications. Mr. Smart said it would be an easy adaptation to make. “Underneath the iPhone is a Mac OS X operating system which is based on Unix, which gives us Unix multitasking,” he said.

But that raises another issue. Apple limits multitasking because it empties the batteries quickly. Because the iPhone doesn’t have a replaceable battery, a fresh one can’t be popped in when power gets low. Mr. Smart said that Raytheon may address that through a ruggedized phone case that would accommodate a larger battery.

Mobile phones are also known to be vulnerable to hacking attacks. Mr. Smart said that some safeguards were built in to the software, but especially sensitive transmissions could be passed through a more sophisticated scrambler that it would dock with.
Apple did not respond to a request for comment.

Raytheon is developing other iPhone apps as well. It has also demonstrated an application that would serve to train air traffic controllers. It would not completely replace current training, but would build skills in recalling aircraft and terrain, visual scanning, on-the-fly mathematics, and rule-based decision-making, skills that also are used frequently by gamers. Source

Sabtu, 14 November 2009

Minggu, 01 November 2009

Ubuntu bug

When we wrote yesterday about trying - and failing - to install Ubuntu 9.10, we thought we had made it clear that the installer failed to recognize two of the three installed SATA drives in our test machine. Despite this, we were exposed to a torrent of spittle-flecked invective suggesting we were variously too old, too young, too stupid, in the pay of Microsoft or simply just an asshole.

We were particularly taken with the number of Linux supporters apparently suffering from Tourette's Syndrome and especially the ones who hoped our families got cancer. It's always refreshing to receive good objective criticism.

Luckily, some readers managed to stay calm and pointed out that there is indeed a critical bug in the 64 bit RC version of Ubuntu 9.10 which fails to recognize multiple hard drives, so, sadly, the failure of the OS to install was down to coding errors rather than user incompetence.


As one reader said:

"The Ubuntu 9.10 RC installer has a rather surprising bug dealing with multiple disk drives; see #459054 at bugs.launchpad.net. It's already fixed in the daily builds, so I expect the final release will probably not have it. In the meantime, if you seriously want to try Ubuntu, either use a 9.04 CD or wait until the 9.10 actual release.

"If you are feeling conservative, wait until December and then try it, after the teething problems shake out. I like Ubuntu, but I won't pretend to anyone that it's ready for naive use until 3-5 weeks post-release. Us bleeding edge types start running new versions and/or upgrading around alpha-6, but we also file bug reports and cope with the odd spot of breakage."

Checking out bugs.launchpad.net as suggested, we found that this was indeed the case. In a post dated 26 October, Jim Leinweber wrote:

"The 9.10RC Karmic Koala ubiquity disk partitioning steps (#4, #5 in the installation screens) seem to have regressions when booting the AMD64 ubuntu live desktop CD on systems with multiple disks.

"On one system, the "side by side" radio button only showed sdc."Erase" would allow choosing sda, sdb, or sdc. The "manual" partitioning option showed all partitions on all three drives and seemed normal.

"On another system, recently loaded with windows 7 professional on a 250 GB sda, the "side by side" radio button line was missing entirely, and the manual option didn't show either the sda or the sdb SATA disk drives (intel chipset). It looked normal on a system with only 1 SATA drive."

So there we have it. Not my fault at all. Sorry about that. I will, however, be trying Karmic Koala again, but not until December, as suggested. I'll be sure to let you know how I get on.

And here's a question for you: How on earth is a potential Linux user to know they should check out launchpad.net, or similar sites to discover why things don't work? If Linux is to succeed as a mass-market OS, it must move away from the realm of the hobbyist and into the mainstream.

Security firm demoed hacking and eavesdropping on IPhone mobile VoIP calls

Over the weekend, Sipera Systems demonstrated how easy it was to eavesdrop and record VoIP calls made over an unsecured WiFi network on the iPhone. Using open source software called UCSniff, the security team hacked into the iPhone's VoIP calls proving that without security software, mobile VoIP calls might not be ready for business clients. The software has actually been around for awhile, but it just recently added the ability to listen to calls as they take place rather than after the fact.

Of course, Sipera does have a vested interest in showing us how easy it is to hack mobile VoIP calls. Today the company announced their Sipera Secure Live Communications (SLiC) mobility solution which promises to provide enterprise-class communications privacy and security for VoIP and UC on smartphones. The solution even includes a smartcard card-authentication system before users can access enterprise applications. Sipera believes the solution will allow businesses to provide smartphone-based VoIP services for their employees--saving call-minutes and high costs associated with employee cellphone use.

Read more:
- check out this article on the hacking demo ( http://www.theregister.co.uk/2009/10/23/iphone_voip_sniffing_made_easy/)
- read the press release ( http://www.fiercewireless.com/press-releases/sipera-slic-delivers-breakthrough-smartphone-security-business-ready-mobile-voip-an-0 )

source : fiercevoip.com

Google Removes Green Party Web Site From Index Due To Hac

On Sunday, if you searched in Google for [Green Party] you would not find the official Green Party of United States web site, which is at gp.com. Even if you searched for gp.org, Google would not show you the site.

One person complained about the issue at Google Web Search Help forums and a few days later, a Googler came in and told us why.

In short, the site was hacked and included harmful malware that could infect searchers computers. Google removes sites that include malware from their index, until the site is fixed. In addition, if sites are injected with links to unrelated site, with the sole intent of link spamming Google, Google will also remove the site from their index. That is what Google did in this case, and now the site is back in the index.

Googler, Jaime said:

The gp.org website was removed from Google's results because it has been hacked (if you look at the source code for http://gp.org/, about halfway down you'll see hundreds of spammy hidden links to websites selling several drugs such as Viagra and Fluoxetine).

We sent an email to the gp.org webmaster a week ago, on Monday the 19th, and they were also notified via the webmaster tools console (http://google.com/webmasters). Anyone in contact with the owners of this site, please give them this information and, as danielroofer pointed out, let them know they can visit the Webmaster Help Forum if they have additional questions.

In the meantime, we've already reinstated this site into our index, but it may take up to 24 hours for it to start showing everywhere.

Today, it seems like the spam and hack has been removed from GP.org and the site is now back in the Google index.


source : http://www.seroundtable.com/archives/021016.html

Clear card security screening is stuck on the tarmac

In the beginning, it seemed like an idea that couldn’t lose. With the advent of tortuous and often annoying post 9/11 security procedures at SFO and other U.S. airports, the notion of a way to reduce the hassle of airport screening struck most as a very attractive option.

However, the rollout of technology to make all of this possible for travelers has been anything but smooth. Verified Identity Pass, the company who promised to rollout a fingerprint and iris scan process accompanied by a smart ID card called “Clear” that would allow users (for a $199 fee) to go to the head of the security line, suddenly folded their tent last June. They left 200,000 paying customers high and dry with no refunds.

If you were a “Clear” customer, you have every right to be nervous. Those who signed up had to provide extensive confidential personal information and the fate of that data has remained very much up in the air. In addition, a laptop that contained the personal information of over 30,000 customers was “misplaced” at SFO last year. The computer was found and assurances were made that the sensitive information had not been accessed. Oops……sorry about that!

A Bay Area investment group – Henry, Inc. – has stepped in recently to buy the assets of “Clear.” Their website promises to restart the security screening process again in “Winter 2009/2010.” There are no indications that the new process will use different technology or provide stronger safeguards for the customer’s sensitive personal data.

It may well be that the federal government’s lack of confidence in “fast-pass” technology for airport travelers will hold back any successful rollout of this system. In the meantime, we all continue to line up – shoeless, beltless and liquid-free. If indeed there is a technology solution that will speed us through airport security, it can’t come soon enough.

source : http://www.examiner.com/x-27653-SF-Technology-Examiner~y2009m10d30-Clear-card-security-screening-is-stuck-on-the-tarmac

Blackberry snooping software

bugs BlackBerrys

The Department of Homeland Security's U.S. Computer Emergency Readiness Team (US-CERT) is warning BlackBerry users about a spyware program that allows attackers to turn a target's handset into a microphone that can be accessed remotely.

PhoneSnoop is a free, remote spying application designed for BlackBerry phones. The app works by intercepting phone calls from a predetermined 'trigger' number. When PhoneSnoop detects an incoming call from that number, it accepts the call and turns on the BlackBerry's speaker phone, effectively allowing the caller to listen in on the target's surroundings.




There are some very real limitations of this spying app: For starters, an attacker would need to have physical access to the victim's phone in order to install the app. PhoneSnoop also can't listen in on the victim's phone calls, and it leaves a conspicuous new program icon in the victim's app list.

Still, the alert serves as a useful reminder on the importance of maintaining proper physical security around the communications devices most of us depend upon. I am often asked about the threat to mobile phones from viruses and the sorts of spyware that typically assails PCs, and my response is always that the physical threat -- particularly the prospect of having your phone lost or stolen (however briefly) -- should be the user's primary concern.

PhoneSnoop was written and released by Sheran Gunasekera, a Sri Lankan programmer who heads the security division for Hermis Consulting, an Indonesian consulting firm that gets paid to conduct physical and network penetration tests for banks and telecommunications providers.

Gunasekera said he built PhoneSnoop as a proof-of-concept app, and as such it is not very stealthy. Still, he said, apps like PhoneSnoop could be silently bundled with other apps that the BlackBerry user wants to download, and could be set to run in the background without obvious notifications. BlackBerry apps also can be set so that they do not include program icons, or so that they simply don't show up in the list of running applications.

"BlackBerry is one of the most secure platforms out there, so what I wanted to do was highlight that even though you have a secure platform, in the end the user is probably going to be the weakest link," Gunasekera said.

PhoneSnoop isn't exactly new or feature-rich, but it is free. Applications like Flexispy and Mobile Spy can be used to intercept and relay a user's text messages, phone call logs and even GPS coordinates. Still, these other apps can cost between $250 to $300.

The BlackBerry does have some built-in defenses, if the user chooses to turn them on. As Symantec notes in its blog post about this app, you can require that a personal identification number (PIN) be provided before any apps can be installed. Also, a BlackBerry Enterprise Server can be configured to prevent applications from installing or running properly, and can remotely wipe a BlackBerry of any data should its owner lose or misplace the device.

Gunasekera added that he expects to soon release other applications to help users better secure their phones against snooping or theft. One free program he already released -- called Kisses -- can detect applications installed on a BlackBerry that have been designed to remain hidden (including programs like Flexispy).

source : http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1372852,00.html

Sabtu, 31 Oktober 2009

How hackers find your weak spots

Stealing passwords: In this common maneuver, the hacker uses information from a social networking profile to guess a victim's password reminder question. This technique was used to hack Twitter and break into Sarah Palin's e-mail.

Friending: In this scenario, a hacker gains the trust of an individual or group and then gets them to click on links or attachments that contain malware that introduces a threat, such as the ability to exploit a weakness in a corporate system. For example, says Netragard CTO Adriel Desautels, he might strike up an online conversation about fishing and then send a photo of a boat he's thinking of buying.

Impersonation/social network squatting: In this case, the hacker tweets you, friends you or otherwise contacts you online using the name of someone you know. Then he asks you to do him a favor, like sending him a spreadsheet or giving him data from "the office." "Anything you see on a computer system can be spoofed or manipulated or augmented by a hacker," says Desautels.

Posing as an insider: Imagine all the information you could extract from an unknowing employee if you posed as an IT help desk worker or contractor. "Roughly 90% of the people we've successfully exploited during [vulnerability assessments for clients] trusted us because they thought we worked for the same company as them," Desautels says.

On the Netragard blog, he describes an exploit in which a Netragard worker posed as a contractor, befriended a group of the client's workers and set up a successful phishing scheme through which he gleaned employee credentials, eventually gaining entry to the entire corporate infrastructure.

source : computerworld.com

The Passive State

The Passive State

The passive state involves operating systems with built-in security utilities. These utilities
can be quite effective when enabled, but remain worthless until the system administrator
activates them. In the passive state, these utilities are never activated, usually because the
user is unaware that they exist. Again, the source of the problem is the same: The user or
system administrator lacks adequate knowledge of the system.
To understand the passive state, consider logging utilities. Many networked operating
systems provide good logging utilities. These comprise the cornerstone of any
investigation. Often, these utilities are not set to active in a fresh installation. (Vendors
might leave this choice to the system administrator for a variety of reasons. For example,
certain logging utilities consume space on local drives by generating large text or
database files. Machines with limited storage are poor candidates for conducting heavy
logging.) Because vendors cannot guess the hardware configuration of the consumer's
machine, logging choices are almost always left to the end-user.
Other situations that result in passive-state insecurity can arise: Situations where user
knowledge (or lack thereof) is not the problem. For instance, certain security utilities are
simply impractical. Consider security programs that administer file-access privileges
(such as those that restrict user access depending on security level, time of day, and so
forth).

Vendor Response

Vendor response has traditionally been good, but this shouldn't give you a false sense of
security. Vendors are in the business of selling software. To them, there is nothing fascinating about someone discovering a hole in the system. At best, a security hole represents a loss of revenue or prestige. Accordingly, vendors quickly issue assurances to allay users' fears, but actual corrective action can sometimes be long in coming.
The reasons for this can be complex, and often the vendor is not to blame. Sometimes, immediate corrective action just isn't feasible, such as the following:
• When the affected application is comprehensively tied to the operating-system source
• When the application is very widely in use or is a standard
• When the application is third-party software and that third party has poor support, has gone out of business, or is otherwise unavailable

System Flaws or Deficiency of Vendor Response

System flaws or deficiency of vendor response are matters beyond the end-user's control.
Although vendors might argue this point furiously, here's a fact: These factors are the second most common source of security problems. Anyone who subscribes to a bug mailing list knows this. Each day, bugs or programming weaknesses are found in network software. Each day, these are posted to the Internet in advisories or warnings. Unfortunately, not all users read such advisories.
System flaws needn't be classified into many subcategories here. It's sufficient to say that a system flaw is any element of a program that causes the program to

• Work improperly (under either normal or extreme conditions)
• Allow crackers to exploit that weakness (or improper operation) to damage or gain control of a
system

In these instances, a patch (or other solution) can provide temporary relief. However, for
this system to work effectively, all users must know that the patch is available. Notifying
the public would seem to be the vendor's responsibility and, to be fair, vendors post such
patches to security groups and mailing lists. However, vendors might not always take the
extra step of informing the general public. In many cases, it just isn't cost effective.