Hacking your cell phone calls, texts, browser

An increasingly popular technology for extending cell-phone coverage ranges had a major security hole that went undetected for years, through which an attacker could eavesdrop on everything a target did on their phone, according to new research released on Monday.
The research brings to light previously unknown vulnerabilities in some models of femtocells, devices that mobile network operators use to bring wireless service to low-coverage zones. The compact boxes, which are typically as small as a standard cable modem, can be deployed in hard-to-reach spots like the top of an apartment building or a home in the mountains. Femtocells are also referred to as “network extenders,” and analysts project that as many as 50 million of them will be in use by 2014.

In a demonstration for CNNMoney, researchers at iSEC Partners, who discovered the security hole, covertly recorded one of our phone conversations and played it back for us. They were also able to record our browsing history, text messages, and even view pictures we sent from one smartphone to another by hacking the network extender.

“We see everything that your phone would send to a cell phone tower: phone calls, text messages, picture messages, mobile Web surfing,” said iSEC Partners senior security consultant Tom Ritter.

ISEC discovered the security flaw a year ago and contacted the affected vendors, who quickly began working on a fix. Though iSEC focused its research on femtocells operating on Verizon’s 3G CDMA network, the company believes similar holes could exist on other network extenders.

http://money.cnn.com/2013/07/15/technology/security/femtocell-phone-hack/

 

Alert from Hacker News: Some Outdated WordPress Blogs Used in DDOS Attacks

In the past we have reported about many such cyber attacks, where attackers hacked into the WordPress blogs using password brute-force attack or they used the PINGBACK vulnerability in older versions of WordPress without compromising the server.

WordPress has a built in functionality called Pingback, which allows anyone to initiate a request from WordPress to an arbitrary site and it can be used for a single machine to originate millions of requests from multiple locations.

We have seen more than 100,000 IP addresses involved in the recent DDOS attack and the victim’s Forum website received more than 40,000 requests in 7 minutes from different WordPress blogs and IP addresses.

http://thehackernews.com/2013/12/ddos-attacks-originated-from-thousands.html

Christmas Came Early For Hackers: 2 Million Social Media Accounts Hacked, Big U.S. Bank Data Stolen

Hackers Stole 2M Facebook, Google Passwords: How to Protect Your Accounts

Dec. 5, 2013

Any time you logged into Facebook, Google, Twitter, or a host of other popular web services the past month, there may have been a hacker peering over your digital shoulder, sneaking a peek at your password.

The information security company Trustwave has revealed that the passwords to 2 million different accounts have been compromised. The malware program Pony forwarded the vast majority of the passwords to a central server in the Netherlands.

John Miller, security research manager at Trustwave, said that the hack wasn’t due to a flaw in any of those company’s servers. “It was the individual users’ computers that had the malware installed on their machine,” he told ABC News. He adds that the unnamed hackers were most likely motivated by profit. “These passwords were never publicly posted. We can’t say for sure, but [the hackers] were probably going to sell them.”

http://abcnews.go.com/Technology/hacker-group-stole-million-stolen-facebook-google-passwords/story?id=21109910

 

JP Morgan Chase Hacked: 465,000 Card  Users’ Data Gone

JPMorgan Chase, one of the world’s biggest Banks has recently announced that it was the victim of a cyber attack and warned round 465,000 of its holders of prepaid cash cards on the possible exposure of their personal information.

In the Security Breach that took place on the bank’s website www.ucard.chase.com in July, around 465,000 accounts are compromised i.e. 2% of the overall 25 million UCard users. JPMorgan confirmed that there is no risk for holders of debit cards, credit cards or prepaid Liquid cards.
 
They informed the law enforcement in September, and till now no information on how attackers have conducted the attack has been disclosed.

http://thehackernews.com/2013/12/JPMorgan-Chase-bank-card-hacked_5.html 

12-year-old admits to hacking major government websites for Anonymous

A 12-year-old Canadian boy has pleaded guilty to three charges of hacking government websites under the affiliation of ‘hacktavist’ initiative Anonymous.

A court heard on Thursday how the fifth grader – from the Montreal suburb of Notre-Dame-de-Grâce – wreaked computer havoc during the Quebec student uprising in 2012, with some sites out of service for two days.

He has pleaded guilty to three charges related to hacking websites that included those of Montreal police, the Quebec Institute of Public Health, the Chilean government and some non-public sites.

The attacks took some of the sites offline for up to two days, at what police estimated as a cost of $60,000 in damages.
Read more: http://www.dailymail.co.uk/news/article-2477746/Fifth-grader-just-12-years-old-admits-charges-major-hacking-targeting-government-websites.html#ixzz2j1rHVB00

Sen. Feinstein’s NSA Alleged Reform Bill To Add Surveillance Authority

A bipartisan group of US senators is trying to ban the NSA’s blanket surveillance program in a radical bill proposed to the Senate Intelligence Committee. But a milder bill from chairwoman Diane Feinstein would sanction more snooping on US citizens.

Thursday’s Committee hearing on reforming the Foreign Intelligence Surveillance Act (FISA) reviewed the two rival bills in an effort to find a balance between security and privacy. The Committee is expected to have further lively debate on the proposed legislation next week, before the bill is sent for consideration by the full Senate.

 Feinstein’s bill would also seek to expand the US government’s spying capabilities by authorizing the monitoring of terror suspects the NSA is tracking overseas when they arrive in the US. 

Currently, when a suspected terrorist arrives in America, the NSA has to halt its surveillance, creating a legal loophole.

“I call it the terrorist lottery loophole,” said Republican Senator Mike Rogers, the chairman of the House Intelligence Committee. “If you can find your way from a foreign country where we have reasonable suspicion that you are … a terrorist … and get to the United States, under a current rule, they need to turn it off and do a complicated handoff to   the FBI,” Rogers said.

The new bill would allow the NSA to legally continue eavesdropping on a person for seven days after arriving to the US without asking for authorization from a court.

Democratic Senator Wyden, who has been for years working with classified data as a member of the Senate Intelligence Committee, also derided the NSA’s complaints about the damage to US national security caused by the recent leaks.

“You talk about the damage that has been done by disclosures, but any government official who thought this would never be disclosed was ignoring history. The truth always manages to come out,” he said.

http://rt.com/usa/nsa-snooping-senators-feinstein-439/

Senate Intelligence Committee Hearing: The NSA Wants Unlimited Citizen and Business Data in National Database

[NSA Director Keith] Alexander acknowledged that the NSA is interested in compiling the largest national database possible, and that there is no limit to the number of records that can be gathered. The storehouse holds billions of records, former officials have told The Washington Post.

Is it the goal of the NSA to collect the phone records of all Americans?” Udall asked.

I believe it is in the nation’s best interests to put all the phone records into a lockbox that we could search when the nation needs to do it, yes,” Alexander said.

 

The government has claimed the authority to gather the data under Section 215 of the USA Patriot Act, also known as the “business records” provision of the Foreign Intelligence Surveillance Act. The FISA court in 2006 agreed that the government could use that statute to order phone companies to hand over “all call detail records” daily to the NSA.

 

Asked by Udall if that statute gave NSA the authority to collect other data — such as utility bills — Deputy Attorney General James M. Cole offered a qualified answer. “It’s given them the authority to collect other bulk records if they can show that it is necessary to find something relevant to a foreign intelligence investigation of particular types. . . . It’s not just all bulk records. But it’s also not no business records. It’s all dependent on the purpose.”

 

 

[Sen. Ron Wyden (D-Oregon)], Udall and other lawmakers have introduced reform legislation that would, among other things, end the phone records collection, while allowing for a more limited program.

On Thursday, Wyden accused U.S. officials of not being more forthcoming about intelligence-collection programs.

“The leadership of your agencies built an intelligence-collection system that repeatedly deceived the American people,” he said. “Time and time again, the American people were told one thing about domestic surveillance in public forums while government agencies did something else in private.”

 

http://www.washingtonpost.com/world/national-security/nsa-leaks-extremely-damaging-national-intelligence-director-tells-senate-hearing/2013/09/26/a01b4e08-26d3-11e3-b75d-5b7f66349852_story.html

 

Wyden infamously showed down with Clapper earlier this year when he asked the lawmaker if the intelligence community collects information on millions of Americans. Clapper responded “not wittingly,” then later apologized to Committe Chairwoman Dianne Feinstein (D-California) for his “clearly erroneous” remark after Snowden’s leaks suggested otherwise only weeks later.

So that he would be prepared to answer, I sent the question to Director Clapper’s office a day in advance. After the hearing was over, my staff and I gave his office a chance to amend his answer,” Wyden told the Washington Post after the March meeting. “Now public hearings are needed to address the recent disclosures, and the American people have the right to expect straight answers from the intelligence leadership to the questions asked by their representatives.”

On Thursday, Alexander phrased questioning directed at Gen. Alexander in an attempt to determine if the NSA collected information from cell phone towers that could be used to locate customers. Alexander decline to provide a straight answer during an unclassified hearing.

 

If you’re responding to my question by not answering it because you think thats a classified matter, that is certainly your right,” said Wyden. “ We will continue to explore that because I believe that is something the American people deserve to know.”

 

http://rt.com/usa/fisa-hearing-nsa-surveillance-410/

How Safe is Your Web Use? What You Need to Know About Email and IP Headers

After a few decades of being in existence among average, everyday human beings, the internet has become quite ubiquitous and pervasive in our lives. Most of us take it for granted like we do electricity and water. But when we send emails, do we really understand how it is delivered to the final destination, and what computers are involved in taking our emails and routing it to our friends and families? And when we visit a website, do we really understand how those clicks and personal data we entered is packaged and delivered to the ultimate website?

With what we now know about the major weaknesses the National Security Agency (NSA) and other intelligence agencies have injected into our common communication paths (telephone (traditional, mobile and Voice over IP, or VOIP), television, desktop and mobile internet), it’s probably time we at least have a basic idea of how the internet works. I will avoid getting too bogged down in technical detail and keep the conversation as short and simple as possible (though at times I may have to touch on some fairly technical terms if it can’t be avoided).

Let’s go over some common ways you communicate with friends and family first, and then go into details about how the communication happens. We’ll cover text messaging, email, and voice calls.

Text Messaging Basics

When you send a text, you probably think only you and your friend’s mobile devices are involved. Yeah, you probably know that AT&T, Verizon, Sprint, T Mobile, or other provider has a network that sends your message to your friend, but there’s a bit more to it. When you turn on your phone, it automatically connects to your provider’s network. This means that every so often, your phone says “Hi, I’m still here” to make sure your texts and voice calls are able to either be sent by you to a friend, or from a friend to you.  So let’s say you decide to say “hello” as a text to a friend. When you click Send, your mobile phone packages your message in a way very similar to what the postman or Fedex shipper does with a regular mailing. A physical mail needs a From address and a To address in order to get it to its destination.  Similarly, your phone puts the From and To info into the text message. In order to keep your provider’s network from confusing the From and To info with the actual body of your text message, the From and To info, along with date and time, is put into a “Header.” A header is like your envelope that you put your letter in. The letter and envelope are two separate things, and the letter is inserted into the envelope. Similarly, your text message is put into an electronic envelope that contains the header info (the From and To info – your phone number plus the number of your friend). Once the electronic envelope is ready, your phone sends it to your provider’s network.

The first point your electronic envelope goes to is your provider’s closest tower. This is similar to your mail going to the nearest post office to get entered into the system. From there, your regular mail goes to a major area postal hub, where it is then routed to the next logical postal hub closest to your final destination: the intended mail recipient. Similarly, the local phone tower sends your text to the nearest satellite, which then sends your text message to the next logical satellite en route to your friend. The process is reversed once your friend’s nearest phone tower is found: the final satellite in the route sends the text to your friend’s nearest phone tower, which then sends it to your friend’s mobile phone. The phone then unpacks the text and displays it on your friend’s phone.

Keep in mind that though this is a simplified example, notice that there are multiple devices involved: towers, satellites, and your provider’s computer servers for coordinating the sending of messages from one satellite to another and for archiving. I will explain why this is important to remember shortly.

Email

Email works pretty much the same way that text messaging does. Assuming you’re at your laptop typing an email up while logged in to your internet provider’s system, you will ultimately include the email address of a friend or team member from work. You click Send or Submit, and off your email goes. But it’s not quite that simple. Your email software (presumably Outlook or some free online email provider like Yahoo or Gmail) has to package your email just like with text messaging. But there’s far more info that gets added to the electronic envelope (aka “email header”) than just email addresses; Wikipedia has a good listing that I’ll provide a snippet of here (please forgive the technical jargon):

Common header items for email include:

  • To: The email address(es), and optionally name(s) of the message’s recipient(s). Indicates primary recipients (multiple allowed), for secondary recipients see Cc: and Bcc: below.
  • Subject: A brief summary of the topic of the message. Certain abbreviations are commonly used in the subject, including “RE:” and “FW:”.
  • Bcc: Blind Carbon Copy; addresses added to the SMTP delivery list but not (usually) listed in the message data, remaining invisible to other recipients.
  • Cc: Carbon Copy; Many email clients will mark email in your inbox differently depending on whether you are in the To: or Cc: list.
  • Content-Type: Information about how the message is to be displayed, usually a MIME type.
  • Precedence: commonly with values “bulk”, “junk”, or “list”; used to indicate that automated “vacation” or “out of office” responses should not be returned for this mail, e.g. to prevent vacation notices from being sent to all other subscribers of a mailinglist. Sendmail uses this header to affect prioritization of queued email, with “Precedence: special-delivery” messages delivered sooner. With modern high-bandwidth networks delivery priority is less of an issue than it once was. Microsoft Exchange respects a fine-grained automatic response suppression mechanism, the X-Auto-Response-Suppress header.[57]
  • References: Message-ID of the message that this is a reply to, and the message-id of the message the previous reply was a reply to, etc.
  • Reply-To: Address that should be used to reply to the message.
  • Sender: Address of the actual sender acting on behalf of the author listed in the From: field (secretary, list manager, etc.).
  • Archived-At: A direct link to the archived form of an individual email message.[58]

Note that the To: field is not necessarily related to the addresses to which the message is delivered. The actual delivery list is supplied separately to the transport protocol, SMTP, which may or may not originally have been extracted from the header content. The “To:” field is similar to the addressing at the top of a conventional letter which is delivered according to the address on the outer envelope. In the same way, the “From:” field does not have to be the real sender of the email message. Some mail servers apply email authentication systems to messages being relayed. Data pertaining to server’s activity is also part of the header, as defined below.

SMTP defines the trace information of a message, which is also saved in the header using the following two fields:[59]

  • Received: when an SMTP server accepts a message it inserts this trace record at the top of the header (last to first).
  • Return-Path: when the delivery SMTP server makes the final delivery of a message, it inserts this field at the top of the header.

Other header fields that are added on top of the header by the receiving server may be called trace fields, in a broader sense.[60]

  • Authentication-Results: when a server carries out authentication checks, it can save the results in this field for consumption by downstream agents.[61]
  • Received-SPF: stores the results of SPF checks.[62]
  • Auto-Submitted: is used to mark automatically generated messages.[63]
  • VBR-Info: claims VBR whitelisting[64]

Source: http://en.wikipedia.org/wiki/Email#Message_header

 

I know that was a lot of information. All you need to really understand is that email messaging has more header info than text messaging, but is quite similar in concept. An email can have messages that contain more than just text. It can contain pictures, songs, video, voice recordings and other data as determined by what’s called a MIME type. I won’t go into details about MIME types, but just know that in order for the email server to know how to handle your email, it must know what kind of content it has inside your electronic envelope. Just like when you send a DVD or CD along with a letter, it is good to let the post office know if your envelope contains fragile content for special handling.

Voice Calls

By now, you probably get the pattern. Voice calls are very similar to text messages and emails. You dial a friend’s number and click Send or Talk. A connection is established from your phone to the nearest phone tower (wireless calls) or landline home office for landline phone calls. The call is routed to the next satellite or server along a path that is the shortest distance to your friend. Once your friend clicks Send or Talk (or whatever graphical icon on your smart phone represents picking up the call), your provider establishes and monitors the quality of the call until one of you hangs up – or the network drops your call for whatever reason. Voice over IP (VOIP) uses your internet connection instead of the plain old telephone network and is very similar to text messaging, except the message content is your voice being sent in a continuous stream of electronic envelopes (called packets. Refer to http://en.wikipedia.org/wiki/VoIP for more info). Digital television transmission works very similarly, but is broadcast by TV stations and content providers in a way that is closer to what Twitter does with each tweet.

Websites

You have a few common ways we discover websites to visit. You do a search through Google, Bing or other service. You need to pay a bill or buy stuff online. A TV program we’re watching mentions a website. You get the idea. So what do You do to display that site on your computer or mobile phone/device? You either click on it or type it in to the part of your internet web browser called the Address box near the top. It starts off with http:// or similar.  But what is happening to make that web page display on your browser? It’s not magic, but several hardware and software components at work:

1)      Your web browser, which has to package your request for a web page into an electronic envelope similar to text messaging described earlier

2)      Your internet provider’s set of big computer servers (called the Provider Network)

3)      The website owner’s website, which is software that is inside a computer that either the website owner directly owns, or rents from its internet hosting provider if it is too expensive to own a dedicated computer server

When you click on a link (or enter it in manually in the Address bar at the top of the browser and click a button to send it), your web browser puts your request for the page in an electronic envelope and places a header on it that, among other things, has your computer or mobile device’s IP address (mobile phones have IP address, too, for internet purposes). Your browser sends the request to your internet provider’s computer server, which in turn passes it on to the nearest computer server that can forward it on to another one until it gets to the website computer server you asked for. The website server has the equivalent of a “bodyguard” who’s job is to make sure the request won’t cause trouble in paradise. This bodyguard snoops through your electronic envelope, makes sure there’s nothing bad in it, and passes it along to the web application of the website you requested. Every website has some kind of application software that offers the features that you come to expect in a modern website. So when you go to pay a bill online and click “Checkout” or “Pay Now,” the logic for making that happen is within the website application software that is housed on the website. A website can have one or more web applications, which is why it is important to keep the two separate in your mind. When the web application needs to send a confirmation back to you, it also puts that confirmation inside an electronic envelope and sends it back to you as a response to your request.

 

What Can Go Wrong?

Now that we’ve gotten that out of the way, have you noticed any potential problem areas with the various ways you communicate? Earlier I asked you to keep some things in mind regarding the multiple devices involved in establishing and maintaining your communications. It’s the fact that it takes several devices (called routing points) between you and your friends, family members and co-workers that is something to consider. Similar to wire-tapping of traditional phones, tapping of text messages, emails, digital voice calls and website visits can occur on any device. Each computer server and each satellite between you and your friend or the website you request has a unique address assigned to it that can be tapped into and compromised without your even knowing it. A server administrator working on any of the computer servers your communications rely on can compromise the system and secretly allow access to it at a price to the highest bidder. There are technology companies that specialize in IP tracing and recording that are already gathering tons of information on your communications and have been for many years. The Eric Snowden NSA leak scandal has become a wakeup call for the entire world, not for just governments, but businesses and individuals as well. The NSA has intentionally created weaknesses (called back doors) in every online security encryption method you use every day. So when you buy stuff online at a site that has an HTTPS in the beginning, that “s” (which stands for “secure”) should now become “I” for “insecure” because it has been very compromised. IP tracing is one of the key areas of compromise that you have to deal with.

What is IP tracing?

Ip-address.org has this to say:

Tracking down an IP address will give you a general idea of what city, state and other geographical information pertains to the original sender. You can also determine what ISP a computer user is networked with through an IP address lookup tool…Tracing an email gives other information, such as how many times an email was sent to various servers and is an important method used for determining the original source of an email. By tracing an email you can determine the original sender’s IP address, therefore giving you a geographical location of the email sender…Email tracer tools take out the confusion of searching and tracing headers and are an easy and convenient way to track down an email. By copying and pasting the header information into the form the tool will return results showing you the IP address of the original email sender…You can determine the sender’s IP address manually but it takes more time. Though you won’t be able to determine an exact name of the original sender, the received information is valuable and will offer you many clues as to the original sender.

In and of itself, IP tracing is not bad. But in the wrong hands, it can be damaging. There are already technology companies that are proudly selling advanced tracking and recording technology to intelligence and military organizations around the world, chiefly the NSA, FBI, CIA, and others. There’s a company in France that sells web browser vulnerability information to the highest bidder, thus it has no incentive to privately inform the browser maker (Internet Explorer, Chrome, Safari, etc) of weaknesses it is exploiting. So not only can you communications be tapped into, your keystrokes at your computer can be recorded to go along with the IP tracing profile that snoopers can summarize about you.

The game of internet and telecommunications security is a cat and mouse game that both the honest and dishonest are working at every day. And we have seen that sometimes, our government can fail us (they’re human) and so we need to ask our representatives to strengthen laws regarding surveillance and recording as the risk of a major terrorist attack do not rise to the level of damaging digital security and privacy rights violations. As we see with the Navy Shooter massacre in September 2013, acts of terror are not always preventable even with all of the NSA/CIA/FBI surveillance going on now. So why compromise our security online and push us several steps closer to widespread paranoia?