Anonymous leaks sensitive data from Israeli defense firm Decell

BadBlue Tech, the automated tech news portal, points us to a file of sensitive data leaked a few hours ago by Anonymous (PDF):

1. #Anonymous #OpIsrael
2.
3. Greetings Citizens of the world,
4.
5. This is Anonymous.
6.
7. Decell Inc. is (apparently) a privately held company founded in
2000, fully owned by Israel ministry of defense.
8. Decell Technologies Ltd.,” Decell “ leverages its unique
technology to provide accurate, real-time traffic information to
public services, private traffic management companies and not
surprisingly Israeli intelligence services (MOSSAD & Shin Bet).
9. Using sophisticated analysis of different raw data sources such as
CFCD (Celluar Floating Car Data) and GPS (Global Positioning
System) Decell provides GIS (Geographic Information System)
services to both MOSSAD and Shin Bet.
10. Colonel Abraham (Avi) Peri acts as current CEO of Decell, He
served as CEO for number of high-tech companies, and earlier, as a
Colonel in the IDF (Israeli Defense Forces). He was in charge of
all computer centers and software development activities in the
IDF! (He is just too sexy!)
11.
12. Source:
(http://www.decell.com/About_Us/Board_of_Directors/board.html)
13.
14. Now after all of this impressive introduction it is our
pleasure to announce that we have managed to hack Decell servers,
acquiring some highly sensitive information, including exact GPS
coordinates of every City, Highway, Streets and of course every
sensitive buildings located within Israel boarders!
15.
16. We are asking every Zionist around the world to pay careful
attention to the following statement:
17.
18. You have a CHOICE to make, either
19.
20. STOP MURDERING CIVILIANS, WOMEN AND CHILDREN,
21. STOP MASS-KILLING PALESTINIANS,
22. STOP STEALING PALESTINIANS LAND,
23.
24. Or ELSE
25.
26. WE WILL PUBLISH MORE OF WHAT WE HAVE GOT, INCLUDING
COORDINATES OF SPECIAL BUILDINGS!
27. THEN HAMAS MISSILES WOULDN'T LAND IN DESERT OR OCEAN THIS
TIME..........
28.
29. Here are some sample of what we have access to:
30.
31. Decell customers usernames and passwords...

Of course, a quick review of the full, illustrated history of Israel would clear up any misconceptions about the Middle East. Namely, which side advances civilization and which promotes barbarism.

Ironically Juxtaposed Headlines o' the Day

Hat tip: me.

ING Fights Euro-Zone Woes With Data

April 3, 2013, 7:44 AM ET
Dutch banking giant ING hopes to right its own ship in the middle of this storm by using data to improve not only its understanding of who its customers are, but how they want to be treated. It is using traditional and next-generation data analytics to improve its execution of even the simplest transactions, such as sending out new bank cards, or contacting customers who have forgotten to take their cash out of the ATM using their preferred mode of communication.

“If we need to work on consumer trust, then we need to know what influences trust,” ING’s CIO, Ron van Kemenade, tells CIO Journal...

###

Dutch bank ING's online customers find wrong balance in accounts

April 03, 2013 / Reuters
Dutch bank ING was inundated with complaints from retail and business customers in the Netherlands on Wednesday because their online accounts showed incorrect balances.

ING said that it had a problem with processing payments on Tuesday night and that balances online appeared incorrect even though the actual balances in the accounts were not affected. It said the problem was not caused by computer hacking.

Angry customers complained by phone, on social media and in person at bank branches. ING said that it did not know how many customers had been affected.

Reports: ING Bank Accounts Suffering From Catastrophic Errors

Twitter was ablaze earlier today with reports that global super-bank ING was suffering from catastrophic accounting errors, with some Dutch accounts incorrectly showing negative balances and others registering millions of Euros.


Several of the comments (translated by Google):

• "Problem solved. Before you look through - €1.3M"

• "Say # ING, where the f * ck is my money now gone?"

• "Balance for the third time changed today # ING"

• "Thanks ING from € 500, - to € 2,317,650 in the bank. - on the couch! Hope it also remains after jam! # ing # error "


Unconfirmed reports claim that the errors -- along with banking problems at the Netherlands' Rabobank -- are the result of a cyber-attack:

From top level sources I can confirm to you what you are seeing is an emerging pattern of various beta-tests using Stuxnet like algorithms to affect the banking networks the world over.

Although unsubstantiated, the reports have some level of credibility as the global banking system has been under a concerted series of attacks for the last several weeks.

Ridding your Chrome browser of Flash

I've been running Chrome for a couple of weeks without Flash and the differences are exhilarating.

• Fewer "disappearing pages"

• Fewer "sick" pages

• Zero "Flash not responding" pages

• Fewer reboots due to memory leaks

Best of all, most video sites no longer require Flash to deliver video streams (using HTML 5, I suppose).

Ready to take the plunge? It's simple. In your Chrome address bar, type about:plugins. You'll see something like this:


Find the Adobe Flash Player section and click any of the Disable links you see. If you have a master Disable link (see arrow), just click that one. Now close your browser and restart it.

My guess is you'll soon be enjoying your surfing experience a great deal more. And, as an added bonus, your security posture will be vastly improved.

How Search Works: Fighting Spam

Google has introduced a new portal that attempts to clarify how their monumentally successful search engine actually works under the covers. One of the more interesting aspects of their presentation relates to the search engine's "War on Spam" -- bogus content of little or no value that is intended to deceive the search engine to generate traffic (and ad revenue).


It would appear that one of the more recent "innovations" in spam is hacking reputable sites for the purpose of influencing search-engine optimization (SEO) scores. Along with "Watering Hole Attacks," the trend of exploiting legitimate sites to effect malicious ends is certainly an ominous development.

Crunchy on the Outside, Tender on the Insider

Palo Alto Networks, the very successful "next-generation firewall" vendor, just published its 10th edition of "The Application Usage and Threat Report". Its findings point to a threat landscape moving from outside the firewall to inside.

[Our findings imply] that perimeter security efforts are “crunchy on the outside” effectively stopping some of the threats. Shifting the focus to internal applications, the findings show that security is “tender on the inside”, with 97% of the vulnerability exploit logs found in only 10 applications (out of 1,395 found). Nine of these applications are considered high-value assets; they are internal or infrastructure related applications that are integral to many business functions. This data indicates that the strategy of attacking critical resources from inside the network continues to become the rule and not the exception, and will force enterprises to monitor their internal traffic for threats in addition to the perimeter.


...attackers will ... heavily modify and customize their communications not only to confuse traditional security, but also for more functional purposes. Malware will regularly modify peer-to-peer protocols in order to create their own resilient commandand-control communications. For example, the Zero Access botnet (and its rootkit) is one of the most popular pieces of malware in the wild, and likewise was the leading malware observed in our data. This particular malware uses customized peer-to-peer traffic as well as other customized UDP and TCP traffic for communicating with its command and control infrastructure. This traffic is critically important to the reliability and survivability of the botnet in the wild. The malware, having delivered its payload, is sacrificed and the botnet survives to execute the next phase of the attack.

...However while this traffic works perfectly well from the attacker’s point of view, it does not match any known applications, and was thus classified as being custom or unknown traffic ... The analysis clearly shows that customized or modified traffic is highly correlated with threats. This indicates that proactively controlling or blocking “unknown” traffic could easily provide a powerful and untapped strategy for controlling modern threats.

For large organizations concerned with Advanced Persistent Threats (APTs), especially those launched by malevolent nation-states, internal network monitoring appears to be a must-do.

Security Researcher: NBC Serving Up Malware

Help Net Security reports that NBC's website has been hijacked and is serving visitors a heaping helping of malware. And, no, I don't mean the Obama talking points they repeat on a daily basis. I mean real malware.

NBC's website has been compromised, and is redirecting users to malicious sites, reports Dancho Danchev.

According to HitmanPro, the website has been injected with malicious iFrames that lead to one of several compromised sites equipped with Java and PDF exploits.

It seems that upon successful exploitation of one of the vulnerabilities, the users are saddled with variants of the Citadel info-stealing Trojan that currently aren't detected by many AV solutions.

The server with which the malware communicates has already been sinkholed. Nevertheless, if you have visited the news outlet's website today, and your AV hasn't picked up on anything, use a new one to double check - preferably one of these that at the moment do.

Visiting the NBC's website is, for the time being, still dangerous, and even Facebook has moved to protect its users by not allowing the posting of the site's URL.

If it turns out the Red Chinese hacked NBC's computers, one obvious question comes to mind: How would we know?


Hat tip: BadBlue Tech News.

MANDIANT REPORT: How Red China Engages in Open Warfare Against America's Critical Industries

Mandiant has published a lengthy, must-read report (PDF) on a Red Chinese cyber-war unit [APT1] that is openly attacking American firms.

One of the primary methods the PLA gains a beachhead inside the target firm is through spear-phishing, which uses a personalized email that entices the victim into clicking on a malicious link.

The Initial Compromise represents the methods intruders use to first penetrate a target organization’s network. As with most other APT groups, spear phishing is APT1’s most commonly used technique. The spear phishing emails contain either a malicious attachment or a hyperlink to a malicious file. The subject line and the text in the email body are usually relevant to the recipient. APT1 also creates webmail accounts using real peoples’ names — names that are familiar to the recipient, such as a colleague, a company executive, an IT department employee, or company counsel — and uses these accounts to send the emails. As a real-world example, this is an email that APT1 sent to Mandiant employees:


At first glance, the email appeared to be from Mandiant’s CEO, Kevin Mandia. However, further scrutiny shows that the email was not sent from a Mandiant email account, but from “kevin.mandia@rocketmail.com”. Rocketmail is a free webmail service. The account “kevin.mandia@rocketmail.com” does not belong to Mr. Mandia. Rather, an APT1 actor likely signed up for the account specifically for this spear phishing event. If anyone had clicked on the link that day (which no one did, thankfully), their computer would have downloaded a malicious ZIP file named “Internal_Discussion_Press_Release_In_Next_Week8.zip”. This file contained a malicious executable that installs a custom APT1 backdoor that we call WEBC2-TABLE.

Although the files that APT1 actors attach or link to spear phishing emails are not always in ZIP format, this is the predominant trend we have observed in the last several years. Below is a sampling of file names that APT1 has used with their malicious ZIP files:

2012ChinaUSAviationSymposium.zip
Employee-Benefit-and-Overhead-Adjustment-Keys.zip
MARKET-COMMENT-Europe-Ends-Sharply-Lower-On-Data-Yields-Jump.zip
Negative_Reports_Of_Turkey.zip
New_Technology_For_FPGA_And_Its_Developing_Trend.zip
North_Korean_launch.zip
Oil-Field-Services-Analysis-And-Outlook.zip
POWER_GEN_2012.zip
Proactive_Investors_One2One_Energy_Investor_Forum.zip
Social-Security-Reform.zip
South_China_Sea_Security_Assessment_Report.zip
Telephonics_Supplier_Manual_v3.zip
The_Latest_Syria_Security_Assessment_Report.zip
Updated_Office_Contact_v1.zip
Updated_Office_Contact_v2.zip
Welfare_Reform_and_Benefits_Development_Plan.zip

The example file names include military, economic, and diplomatic themes, suggesting the wide range of industries that APT1 targets. Some names are also generic (e.g., “updated_office_contact_v1.zip”) and could be used for targets in any industry.


On some occasions, unsuspecting email recipients have replied to the spear phishing messages, believing they were communicating with their acquaintances. In one case a person replied, “I’m not sure if this is legit, so I didn’t open it.” Within 20 minutes, someone in APT1 responded with a terse email back: “It’s legit.”

Bottom line: trust no one.

Yet another superb reason NOT to visit antique media websites

I mean, besides the censorship and naked malice for the Constitution.

LA Times website redirected users to exploit kit for over six weeks

A sub-domain of Los Angeles Times' website has been redirecting visitors to compromised websites hosting the latest version of the Blackhole exploit kit for over six weeks (since Dec. 23, 2012), says Brian Krebs, and estimates that some 325,000 visitors were exposed to the attack.

Alerted to the fact that something was wrong with OffersandDeals.latimes.com by some of its readers, he investigated the matter with the help of Avast's director of threat intelligence Jindrich Kubec, who checked it and confirmed that the tips were, indeed, true and correct.



When first contacted, LA Times spokeswoman Hillary Manning stated that the problem was tied to the recent hack of the NetSeer advertising network site, which resulted in Google blocking popular third-party sites - among them the New York Times, the Washington Post, ZDNet and the LA Times - that were serving ads provided by the ad network. She claimed that the problem had been solved and that there were no additional ones.

Unfortunately for the publication, that was not true, as Avast and other security companies continued to detect exploits coming from the sub-domain. In a statement released a few hours later, the LA Times conceded that the security companies' readings were accurate, and that they resolved the situation.

This type of attack is sometimes called a "Watering Hole", where a site known to be popular with the target(s) is exploited so that it can launch attacks when the target visits.

Consider this Reason #7,308 to avoid all legacy media distribution channels.


Related: For all mockery LAT-related, check out Patterico's Pontifications. Hat tip: BadBlue Tech News.

IRONIC PRIVACY FAIL: Facebook Founder's Sister Suffers Photo Leak

Well, if the sister of Facebook founder Jerry Zuckerberg screwed up her own privacy settings, what chance do the rest of us have?

...Mark Zuckerberg's sister Randi has complained about a Facebook privacy breach.

Randi, the former head of marketing for Facebook and the executive producer of Bravo's reality series Silicon Valley, complained when Callie Schweitzer, director of marketing and projects at VoxMedia, posted a photo of Randi and her family (including Mark) reacting to the new Poke app. Randi originally circulated the photo on Facebook to her friends, but Schweitzer posted it publicly on Twitter:

...Zuckerberg and Schweitzer have since deleted the conversation, but according to BuzzFeed, Schweitzer originally wrote "@randizuckerberg demonstrates her family's response to Poke" with a link to the pic. Randi then replied "@cschweitz: Not sure where you got this photo. I posted it only to friends on FB. You reposting it on Twitter is way uncool."

The article implies that Schweizer was not actually connected directly to Randi, but had simply subscribed to her updates.

So the failure was presumably either user error by Randi or facilitated by the vagaries of Facebook's notoriously nebulous privacy settings.

It doesn't help that this particular incident follows hot on the heels of Instagram's (a Facebook acquisition) public relations disaster.

It remains to be seen whether Facebook will get this privacy thing right, balancing the need to generate top-line growth with the privacy requirements of a fickle user community.


Hat tip: BadBlue Tech News.

CLICK: Hotel Keycard Attack Just Got Real in Texas

Ruh roh:

You may remember a vulnerability in four million keycard locks presented at the Black Hat conference in July. Hacker Cody Brocious showed he could insert a device he built for less than $50 into the port at the bottom of the common hotel lock, read a key out of its memory, and open it in seconds...

...Two months later, it turns out at least one burglar was already making use of that technique to rob a series of hotel rooms in Texas. The Hyatt House Galleria in Houston has revealed that in at least three September cases of theft from its rooms, the thief used that Onity vulnerability to effortlessly open rooms and steal valuables like laptops...

...at least two other hotels in Texas were hit with the attack. Onity has been criticized for its less-than-stellar response to a glaring vulnerability in its devices. The Hyatt says Onity didn't provide a fix until after its break-ins, forcing the hotel to plug its locks' ports with epoxy. And even now, Onity is asking its hotel customers to pay for the full fix, which involves replacing the locks' circuit boards.

Sebastian Anthony has a suitable and pithy response to Onity's, eh, carelessness:

The hack in its entirety is detailed on Brocious’s website, but in short: At the base of every Onity lock is a small barrel-type DC power socket (just like on your old-school Nokia phone). This socket is used to charge up the lock’s battery, and to program the lock with a the hotel’s “sitecode” — a 32-bit key that identifies the hotel. By plugging an Arduino microcontroller into the DC socket, Brocious found that he could simply read this 32-bit key out of the lock’s memory. No authentication is required — and the key is stored in the same memory location on every Onity lock... The best bit: By playing this 32-bit code back to the lock… it opens. According to Brocious, it takes just 200 milliseconds to read the sitecode and open the lock.

As for how Onity justifies such a stupendously disgusting lack of security, who knows. Generally, as far as managerial types go, securing a system seems like a frivolous expense — until someone hacks you. In non-high-tech circles, hacks like this are par for the course — usually, a company doesn’t hire a security specialist until after its first high-profile hack. For a company that is tasked with securing millions of humans every night, though, it would’ve been nice if Onity had shown slightly more foresight.

My advice: bar the hotel room door and secure it with a chair against the door jamb. Oh, and don't leave valuables in the room safe either. That's easily hacked too.

(Just wondering: isn't it about time security hardware companies started taking security more seriously?)

ANOTHER REASON TO USE THE CHROME BROWSER: The 100,000 Star Experiment

Seriously, this is way cool.

Ready for a mind-blowing trip? Google‘s got you covered with its “100,000 Stars” Chrome experiment, visualizing our stellar neighborhood in a way you’ve never seen.

Using either your mouse or a trackpad, “100,000 Stars” lets you fly around in a sophisticated 3D graphic of our galaxy, taking a close look at the stars that are relatively close to Earth. Try zooming way out, where you can peer at the edge of the Milky Way, and see if it makes you feel like we did, finding ourselves wishing we could zoom out even farther.

Or you can click the “take a tour” button on the upper left to be swept away to the most interesting stars in our galaxy, or click on a star to get more info. And don’t miss the variety of views you can get, showing you the actual density of the stars in our galaxy. It’s spectacular.

Beyond its value as a fascinating toy, “100,000 Stars” is a demo of current web technology. It shows you 3D graphics and plays music by Mass Effect composer Sam Hulick. It accomplishes this magic using an alphabet soup of cool browser tech, including WebGL, CSS3D and Web Audio. And, you don’t need to be using the Chrome browser either. We noticed it works just as well in Firefox...

As Adam Koblim reminds us on the Google Chrome blog, the "mist of 100,000 measurable stars is a tiny fraction of the sextillions of stars in the broader universe."

Dude. Just check it out.


P.S.: If you don't use the Chrome browser, I'd highly recommend it. It's Google's free, high performance browser that can be downloaded in a jiffy.