Hacking your cell phone calls, texts, browser

An increasingly popular technology for extending cell-phone coverage ranges had a major security hole that went undetected for years, through which an attacker could eavesdrop on everything a target did on their phone, according to new research released on Monday.
The research brings to light previously unknown vulnerabilities in some models of femtocells, devices that mobile network operators use to bring wireless service to low-coverage zones. The compact boxes, which are typically as small as a standard cable modem, can be deployed in hard-to-reach spots like the top of an apartment building or a home in the mountains. Femtocells are also referred to as “network extenders,” and analysts project that as many as 50 million of them will be in use by 2014.

In a demonstration for CNNMoney, researchers at iSEC Partners, who discovered the security hole, covertly recorded one of our phone conversations and played it back for us. They were also able to record our browsing history, text messages, and even view pictures we sent from one smartphone to another by hacking the network extender.

“We see everything that your phone would send to a cell phone tower: phone calls, text messages, picture messages, mobile Web surfing,” said iSEC Partners senior security consultant Tom Ritter.

ISEC discovered the security flaw a year ago and contacted the affected vendors, who quickly began working on a fix. Though iSEC focused its research on femtocells operating on Verizon’s 3G CDMA network, the company believes similar holes could exist on other network extenders.

http://money.cnn.com/2013/07/15/technology/security/femtocell-phone-hack/

 

Advertisements

Alert from Hacker News: Some Outdated WordPress Blogs Used in DDOS Attacks

In the past we have reported about many such cyber attacks, where attackers hacked into the WordPress blogs using password brute-force attack or they used the PINGBACK vulnerability in older versions of WordPress without compromising the server.

WordPress has a built in functionality called Pingback, which allows anyone to initiate a request from WordPress to an arbitrary site and it can be used for a single machine to originate millions of requests from multiple locations.

We have seen more than 100,000 IP addresses involved in the recent DDOS attack and the victim’s Forum website received more than 40,000 requests in 7 minutes from different WordPress blogs and IP addresses.

http://thehackernews.com/2013/12/ddos-attacks-originated-from-thousands.html

12-year-old admits to hacking major government websites for Anonymous

A 12-year-old Canadian boy has pleaded guilty to three charges of hacking government websites under the affiliation of ‘hacktavist’ initiative Anonymous.

A court heard on Thursday how the fifth grader – from the Montreal suburb of Notre-Dame-de-Grâce – wreaked computer havoc during the Quebec student uprising in 2012, with some sites out of service for two days.

He has pleaded guilty to three charges related to hacking websites that included those of Montreal police, the Quebec Institute of Public Health, the Chilean government and some non-public sites.

The attacks took some of the sites offline for up to two days, at what police estimated as a cost of $60,000 in damages.
Read more: http://www.dailymail.co.uk/news/article-2477746/Fifth-grader-just-12-years-old-admits-charges-major-hacking-targeting-government-websites.html#ixzz2j1rHVB00

Online Tor anonymizer network among NSA’s targets

Top-secret national security documents disclosed to the Guardian by Edward Snowden show United States and British intelligence have long attempted to crack the Tor anonymizer network used by human rights workers, journalists, cybercriminals and others.

  On Friday, the Guardian published leaked documents attributed to  the former intelligence contractor revealing how the US National  Security Agency and Britain’s Government Communications  Headquarters, or GCHQ, have worked extensively towards  compromising the computers of people who browse the Internet with  Tor, a program that routes traffic through multiple nodes in an  effort to help mask the identities of its users.

  According to the Guardian’s James Ball, Bruce Schneier and Glenn  Greenwald, the NSA’s “current successes against Tor rely on  identifying users and then attacking vulnerable software on their  computer.”

  “While it seems that the NSA has not  compromised the core security of the Tor software or network, the  documents detail proof-of-concept attacks, including several  relying on the large-scale online surveillance systems  maintained by the NSA and GCHQ through internet cable  taps,” the writers add.

 

Read the rest at http://rt.com/usa/nsa-target-tor-network-739/ 

FBI Threatened Lavabi to Turn Over SSL Keys to ALL User Email Accounts

Lavabit owner Ladar Levison told RT that he had no choice but to close his email service because the FBI, in pursuit of NSA whistleblower Edward Snowden, forced him into an ethical dilemma by demanding he hand over customers’ personal data.

RT: The FBI demanded you hand over encryption  codes to collect data from a specific account that is not named  in the documents. What was your initial response

Ladar Levison: That’s actually not correct. What they  demanded were the SSL keys that were protecting all the data  coming in and out of my network for all of my users, and that’s  what I had an issue with. I’ve said before that I took the stance  that I did not to try and protect a single person but because I  was concerned about the invasion and the sacrificing of  everyone’s privacy rights that were accessing my system. 

RT: We were led to believe that you had been  threatened to be charged with criminal content if you did not  comply. Do you feel those threats would have eventually become  reality if you didn’t follow suit? 

LL: Oh, I know they would. In fact they went on to  charge me $5,000 a day for every day that I didn’t turn over  those keys, which is why I was eventually forced to hand them  over. Given the difficult choice of remaining silent about what I  thought was a grave injustice or taking, like you said, the  lesser of two evils and shutting down the service. I just wasn’t  comfortable knowing that they were examining all the data that  was coming in and out of my network without any kind of  transparency or auditing by myself to ensure that they were only  collecting the information they were legally authorized to and  continuing to run the service with that knowledge. So I made the  only decision I felt was appropriate. In terms of being arrested,  I think the only reason they didn’t is because if they had the  system would have had nobody to maintain it. That’s one of the  advantages of being a small business owner, you wear many  hats. 

 

http://rt.com/usa/govt-implications-internet-control-lavabit-752/

Sen. Feinstein’s NSA Alleged Reform Bill To Add Surveillance Authority

A bipartisan group of US senators is trying to ban the NSA’s blanket surveillance program in a radical bill proposed to the Senate Intelligence Committee. But a milder bill from chairwoman Diane Feinstein would sanction more snooping on US citizens.

Thursday’s Committee hearing on reforming the Foreign Intelligence Surveillance Act (FISA) reviewed the two rival bills in an effort to find a balance between security and privacy. The Committee is expected to have further lively debate on the proposed legislation next week, before the bill is sent for consideration by the full Senate.

 Feinstein’s bill would also seek to expand the US government’s spying capabilities by authorizing the monitoring of terror suspects the NSA is tracking overseas when they arrive in the US. 

Currently, when a suspected terrorist arrives in America, the NSA has to halt its surveillance, creating a legal loophole.

“I call it the terrorist lottery loophole,” said Republican Senator Mike Rogers, the chairman of the House Intelligence Committee. “If you can find your way from a foreign country where we have reasonable suspicion that you are … a terrorist … and get to the United States, under a current rule, they need to turn it off and do a complicated handoff to   the FBI,” Rogers said.

The new bill would allow the NSA to legally continue eavesdropping on a person for seven days after arriving to the US without asking for authorization from a court.

Democratic Senator Wyden, who has been for years working with classified data as a member of the Senate Intelligence Committee, also derided the NSA’s complaints about the damage to US national security caused by the recent leaks.

“You talk about the damage that has been done by disclosures, but any government official who thought this would never be disclosed was ignoring history. The truth always manages to come out,” he said.

http://rt.com/usa/nsa-snooping-senators-feinstein-439/

Senate Intelligence Committee Hearing: The NSA Wants Unlimited Citizen and Business Data in National Database

[NSA Director Keith] Alexander acknowledged that the NSA is interested in compiling the largest national database possible, and that there is no limit to the number of records that can be gathered. The storehouse holds billions of records, former officials have told The Washington Post.

Is it the goal of the NSA to collect the phone records of all Americans?” Udall asked.

I believe it is in the nation’s best interests to put all the phone records into a lockbox that we could search when the nation needs to do it, yes,” Alexander said.

 

The government has claimed the authority to gather the data under Section 215 of the USA Patriot Act, also known as the “business records” provision of the Foreign Intelligence Surveillance Act. The FISA court in 2006 agreed that the government could use that statute to order phone companies to hand over “all call detail records” daily to the NSA.

 

Asked by Udall if that statute gave NSA the authority to collect other data — such as utility bills — Deputy Attorney General James M. Cole offered a qualified answer. “It’s given them the authority to collect other bulk records if they can show that it is necessary to find something relevant to a foreign intelligence investigation of particular types. . . . It’s not just all bulk records. But it’s also not no business records. It’s all dependent on the purpose.”

 

 

[Sen. Ron Wyden (D-Oregon)], Udall and other lawmakers have introduced reform legislation that would, among other things, end the phone records collection, while allowing for a more limited program.

On Thursday, Wyden accused U.S. officials of not being more forthcoming about intelligence-collection programs.

“The leadership of your agencies built an intelligence-collection system that repeatedly deceived the American people,” he said. “Time and time again, the American people were told one thing about domestic surveillance in public forums while government agencies did something else in private.”

 

http://www.washingtonpost.com/world/national-security/nsa-leaks-extremely-damaging-national-intelligence-director-tells-senate-hearing/2013/09/26/a01b4e08-26d3-11e3-b75d-5b7f66349852_story.html

 

Wyden infamously showed down with Clapper earlier this year when he asked the lawmaker if the intelligence community collects information on millions of Americans. Clapper responded “not wittingly,” then later apologized to Committe Chairwoman Dianne Feinstein (D-California) for his “clearly erroneous” remark after Snowden’s leaks suggested otherwise only weeks later.

So that he would be prepared to answer, I sent the question to Director Clapper’s office a day in advance. After the hearing was over, my staff and I gave his office a chance to amend his answer,” Wyden told the Washington Post after the March meeting. “Now public hearings are needed to address the recent disclosures, and the American people have the right to expect straight answers from the intelligence leadership to the questions asked by their representatives.”

On Thursday, Alexander phrased questioning directed at Gen. Alexander in an attempt to determine if the NSA collected information from cell phone towers that could be used to locate customers. Alexander decline to provide a straight answer during an unclassified hearing.

 

If you’re responding to my question by not answering it because you think thats a classified matter, that is certainly your right,” said Wyden. “ We will continue to explore that because I believe that is something the American people deserve to know.”

 

http://rt.com/usa/fisa-hearing-nsa-surveillance-410/