WikiLeaks’ Exposed Stratfor Trove Maligned with Malware

A system administrator Josh Wieder who recently visited WikiLeaks discovered malware laced into documents of the publicly exposed Stratfor, stated techworm.net dated July 19, 2015.

Austin, Texas (US) situated American think tank, Stratfor that handles security issues, during late 2011, became victim of a hack by Jeremy Hammond. Hammond the hacker forwarded the e-mail archive of the company to WikiLeaks during early the next year. WikiLeaks, as it handles any other leaked file coming into its grip, publicized the dump.

Wieder scanned all the 5m electronic mails dumped together just for discovering malicious software inside most of the files.
In a blog post, Wieder described the data as truly enormous, more than 5.5m e-mails. The dump was probably so enormous that 2-yrs weren’t enough for accurately examining as well as cleansing the documents before they were wholly published during 2014 (from the year 2012 when WL received them). Techworm.net published this, July 19, 2015.

Further as per Wieder, plentiful malware got illegally included as PE/OLE files else VBScript macros. It was probable that more contaminated documents were hanging about inside WikiLeaks’ dump of unfiltered folders. The Register reported this, July 17, 2015.

As an instance of the above, the February 2011 dated internal memo regarding Libya’s conflict-torn regions of Tripolitania and Cyrenaica had an attached Word file, which indicated presence of malware when examined with VirusTotal, as there was one code-execution attack code inside it for the CVE-2010-3333 vulnerability in Mac and Windows (Microsoft Office).

Wieder has prepared one catalog of Stratfor electronic mails that carry the malware described.

He says he discovered eighteen active malware strains inside the e-mail dump, the majority of which had Word, Excel or PDF files implanted. One malware strain had been created for plucking user registration details from applications. These were addresses and names that were then sent over the Internet onto a remote system.

The Sysadmin further states he has been asking the whistle blowing WikiLeaks site for getting the database sanitized. According to him, no reputable news website would be expected to harbor malware-laced documents, therefore WikiLeaks that claims to be accountable, should not either.

View the original content and more from this author here: http://ift.tt/1D8eGUp

from hacker samurai http://ift.tt/1KvI4Ur
via IFTTT

DefCon Hackers Tell How They Cracked Brink’s Safe in 60 Seconds

Gone in 60 seconds. Security researchers will demonstrate at an Aug. 8 DefCon presentation how they can crack a modern Brink’s safe in just a minute.

When it comes to security, a safe—the physical device in which money is deposited for safekeeping—is quite literally supposed to be safe.

Yet, according to new research set to be demonstrated at the DefCon 23 conference in Las Vegas on Aug. 8, certain models of Brink’s CompuSafe digital safes can be exploited to enable an attacker to crack a safe within 60 seconds and steal whatever cash may be stored inside. The model in question is Brink’s CompuSafe Galileo, which is intended for use in retail stores as a cash management system.

Oscar Salazar, senior security associate at security firm Bishop Fox explained that money inserted into the CompuSafe is automatically deposited to the retail store’s bank account. Salazar, along with Dan Petro, security associate at Bishop Fox, can point to many vulnerabilities in the CompuSafe Galileo.

“One of the main vulnerabilities we are focusing on comes by way of a USB port that is on the exterior of the safe,” Salazar told eWEEK. “We have created a little tool that we can just plug into the safe, wait 60 seconds for the tool to do its work, and then the safe doors will open and you can take all the cash out.”

It might raise eyebrows that the operating system that powers CompuSafe Galileo is Windows XP, which Microsoft no longer supports. Salazar emphasized, however, that it’s not Windows XP that is the root cause of the CompuSafe vulnerabilities.

“Even if the CompuSafe were running Windows 10, it wouldn’t have changed the exploit that we will be demonstrating,” Salazar said.

The USB port on the CompuSafe Galileo is not physically secured with an additional key or access restriction, Salazar said. He explained that the CompuSafe is part of a retail point-of-sale system; so it is typically deployed in well-trafficked areas and not usually in some form of hardened secure location with limited physical access, such as a vault.

In the normal operation of the safe, the majority of operations are executed by way of a touch-screen on the safe. Once the money has been inserted into the safe, it is automatically deposited to the retailer’s bank, which means that it’s the bank’s money and a store manager cannot remove cash from the safe. Typically, to remove cash, there is a requirement for both the store manager and a Brink’s employee to be present.

“Part of what’s interesting about our hack is it bypasses everything and just gives us direct access without having a store manager or Brink’s employee present,” Salazar explained.

The tool that Salazar and Petro created basically emulates mouse and keyboard presses. Petro noted that the vulnerability isn’t something that a typical security scanner would catch, but is something that a software quality assurance team should notice.

“A large portion of the attack is about escaping out of the kiosk mode that is put in place on the safe, in order to prevent someone from accessing the backend system,” Petro explained.

Petro said that he and Salazar literally “smashed” on the keyboard to see what would happen when arbitrary keys were pressed together. Using that smashing technique, the researchers were able to figure out how to escape the kiosk mode.

View the original content and more from this author here: http://ift.tt/1D49mBE

from hacker samurai http://ift.tt/1ewhDCp
via IFTTT

Planned Parenthood targeted by anti-abortion hackers

HOUSTON -For the second time this month, Planned Parenthood is becoming the target of an anti-abortion group.

On Monday, the organization confirmed that anti-abortion hackers have tried to collect staff email addresses, passwords, internal emails, and other private information.

“I am personally pro-life but I am not for hacking into any database or exposing anyone for any reason,” said Jan Kelly.

“I don’t think it’s ever OK to do it,” Brenda Swain.

The recent hacking attempt comes about two weeks after an anti-abortion group called “The California-Based Center for Medical Progress” posted a controversial video about Planned Parenthood on YouTube.

The video suggests that Planned Parenthood harvests body parts from aborted fetuses and makes money off tissue donations, which would be illegal.

“The allegation that Planned Parenthood profits in any way from tissue donation is not true,” said Cecile Richards, the President of Planned Parenthood Federation of America.

The Texas Tribune has reported that the anti-abortion group responsible for the video may have visited a Planned Parenthood facility in Houston.

Conservative lawmakers are now calling for efforts to de-fund Planned Parenthood.

“I could talk about the video but I think I’d vomit trying to talk about it. It’s disgusting,” said House Speaker John Boehner.

Meanwhile, Planned Parenthood said it has alerted the Department of Justice and the FBI about the recent hacking attempt, saying in part “We treat matters of safety and security with the utmost importance, and are taking every measure possible to mitigate these criminal efforts to undermine our mission and services.”

Texas is one of several states planning to investigate Planned Parenthood.

View the original content and more from this author here: http://ift.tt/1VKljlS

from hacker samurai http://ift.tt/1D56Fjg
via IFTTT

US Disturbed by WikiLeaks German Spy Target Disclosure

Providing German opposition with lists of US espionage targets was unreasonable, the head of American Academy in Berlin, Gerhard Casper, said in an interview with the German Bild newspaper, published Monday.
BERLIN (Sputnik)– On July 8, WikiLeaks revealed that the United States spied on three German chancellors: Helmut Kohl, Gerhard Schroeder and Angela Merkel, as well as a number of other federal government members beginning at least in the 1990s.

Casper, a former president of Stanford University, told the newspaper that revealing the espionage information was not a reasonable decision.

He added, however, that he does not believe that there will be a long-term severance in US-German relations.

According to Casper, US and Germany must now establish clear rules of cooperation between special services, and the discussion should be led in an objective manner.

Earlier in July, the head of the Bundestag committee investigating the espionage scandal, Patrick Sensburg, said the NSA had been spying on German citizens up until at least 2012, in violation of mutual cooperation pacts between the intelligence agencies.

View the original content and more from this author here: http://ift.tt/1KvI4Eb

from hacker samurai http://ift.tt/1ewhDm9
via IFTTT

Hackers Just Attacked Planned Parenthood, but the Real War Is So Much Bigger

They wear masks and bulletproof vests, and they change their driving route on their way to the office. They take back entrances, hide their identities and rarely tell people what they do for a living. Not all of them have it this hard, but for people who work for abortion providers and companies like Planned Parenthood, anonymity can be the only thing standing in the way of those who want to stop their work through any means necessary.

On Monday morning, hackers published a list of 333 names and email addresses of people who are allegedly associated with Planned Parenthood. It’s the most recent installment in a long history of anti-abortion activism, where doxxing isn’t just a tool of shaming and invading privacy but the first step on the road to ruining lives — or ending them.

On Monday afternoon, Planned Parenthood released a statement acknowledging the hack and blaming “extremists” who “have called on the world’s most sophisticated hackers to assist them in breaching our systems and threatening the privacy and safety of our staff members.”

The inside story of the Planned Parenthood attack: The information was leaked by a small hacking group called 3301, an international group of five hackers and friends with various motives and interests. They say they’re affiliated with the notorious Lizard Squad and other hacking groups, and are sympathetic to incarcerated hacker heroes like Rory Guidry, whom they’d like to see set free.

“We have a lot of future targets,” Jansson, one of the members of 3301, told Mic. “We’re going to be here for a while yet.”

 “I guess [abortion providers can] just buy a gun,” one of the hackers told Mic. “That’s what America is good for, right?”

Planned Parenthood is 3301’s first publicized target. Two members of the group have strict anti-abortion beliefs, whereas Jansson is just more interested in the challenge of finding vulnerabilities in major systems that claim to be totally secure. Not that Jansson doesn’t have his own political beef with America.

“Corruption, racism, the fact they act like [they’re] the world police,” Jansson told Mic, listing his grievances with the U.S. “Also the fact people think Donald Trump would make a good president is crazy.”

Jansson said that the group has information about women who received abortions at Planned Parenthood facilities, as well as the Social Security number of Planned Parenthood’s CEO, but they don’t plan to release that information — at least not yet. Jansson said he insisted to the team members in charge of leaking info that they only dump the information of workers, not actual abortion-seekers. He trusts that his team won’t leak that info.

This hack wasn’t a sophisticated work of evil genius. Essentially, the team found out that Planned Parenthood was using an old piece of software — an outdated version of CONCRETE5, Planned Parenthood’s content management system — and hit it where it was most dated and vulnerable. The websites of NGOs and municipalities are notoriously easy to exploit.

But even if this is a one-off attack (as opposed to a concerted and consistent effort to take down abortion clinics and family service providers), it’s part of a long history of doxxing and exposing abortion providers and their allies. It’s a gruesome war as old as the Internet itself.

View the original content and more from this author here: http://ift.tt/1h0YdHP

from hacker samurai http://ift.tt/1D56Hrr
via IFTTT

HP Fortify finds 100% of tested smartwatches contain significant security vulns | hacker samurai

from Hacker Samurai http://ift.tt/1D5nw5r
via IFTTT

HP Fortify finds 100% of tested smartwatches contain significant security vulns

By StephanieWisdom (HP)

Smartwatches—they’re growing in popularity for both their convenience and capabilities (plus, they look pretty cool). But, as they become more mainstream, they’ll continue to store more sensitive information, and through connectivity with mobile applications, they may soon enable physical access functions—unlocking cars and homes. It truly is the era of Internet of Things (IoT).

As part of an ongoing series looking at IoT security, HP has unveiled results of a recent study which confirms that smartwatches with network and communication functionality represent a new and open frontier for cyberattack. The study conducted by HP Fortify found that 100 percent of the tested smartwatches contained significant vulnerabilities, including insufficient authentication, lack of encryption and privacy concerns.

The study questions whether smartwatches are designed to store and protect the sensitive data and tasks for which they are built. HP Fortify on Demand assessed 10 smartwatches, along with their Android and iOS cloud and mobile application components, uncovering numerous security concerns.

You can read the report here, as well as see actionable recommendations for secure smartwatch development and use—both at home and in the office!

View the original content and more from this author here: http://ift.tt/1et5i1T

from hacker samurai http://ift.tt/1D5nw5r
via IFTTT