French Security Firm Warns Of Apple IOS / PDF Vulnerability

French security firm Vupen has reported a vulnerability targeted at Apple products running IOS, namely the iPhone, iPad, and iPod touch, that could allow hackers to take control of your device. The scam is an old one, lure users to a malicious website planted with an infected PDF document. It's been done before on PCs but this is the latest in a string of attacks aimed at Apple's popular mobile devices. It would seem as though Apple is feeling the pain long suffered by Microsoft, it's tough being at the top!

Apple is looking into the claim.

Credit: The Globe and Mail

French Arrest Hacker Who Targeted Obama Twitter Account

A 25 year old Frenchman who used the online persona HackerCroll has been arrested after hijacking US President Barack Obama's twitter account.

“This individual spread information about a dozen American personalities, notably Barack Obama, on specialist blogs,” Adeline Champagnat, head of the French office against online fraud, said.

HackerCroll appeared to be driven by the challenge and apparently acted alone in his quest to gain access to the accounts. No sensitive information was allegedly targeted.

“He thinks he is good at this, and he is,” Ms. Champagnat said.

The French were tipped off by the FBI according to this Globe and Mail article.

Twitter Accounts At Risk From File-sharing Scam

Twitter users are apparently at risk of having their accounts hacked if they frequent certain torrent sites. From what I can gather, the site owners have been sitting in wait, collecting users login information and then using these same username / password / e-mail address combos to attempt access to popular third party sights, Twitter included. According to Twitter Status "This information was then used to attempt to gain access to third party sites like Twitter.  We haven’t identified all of the forums involved (nor is it likely that we’ll be able to, since we don’t have any connection with them), but as a general rule, if you’ve signed up for a torrent forum or torrent site built by a third party, you should probably change your password there."

The big message here is that you need to have unique passwords for the various sites that you frequent. I totally understand the desire to use a consistent user name, but at the very least you need to change your password! 

Use Anything But Ineternet Explorer German Government Says

From an article posted on BBC News site "The German government has warned web users to find an alternative browser to Internet Explorer to protect security.

The warning from the Federal Office for Information Security comes after Microsoft admitted IE was the weak link in recent attacks on Google's systems."

Microsoft has downplayed the risk saying that the attacks were not directed at the general public and that the holes could be filled by using the browsers' increased security setting.

Graham Cluley of anti-virus firm Sophos, told the BBC that the warning applies to IE 6, 7 and 8.

"This is a vulnerability that was announced in the last couple of days. Microsoft have no patch yet and the implication is that this is the same one that exploited on the attacks on Google earlier this week," he said.

Computer expert Alan Stevens says "It's like having a window left open in your house"

"The way to exploit this flaw has now appeared on the internet, so it is quite possible that everyone is now going to have a go."

Twitter Attacked By "Iranian cyber army"

The BBC is reporting that Twitter was attacked by a group of hackers calling themselves the "Iranian cyber army". Visitors to the site last evening were being redirected to a page showing a message declaring it had been hacked.

According to the article the "It showed an image of Arabic text overlaid on a green flag carrying the name of the third Shi'i Imam, Imam Husayn.

It also included a poem in Persian which said: "We shall strike if the leader orders, we shall lose our heads if the leader wishes."

Also included were the words: "Those that wage fight on the path of God win."

For it's part Twitter has admitted that it's Domain Name Server (DNS) records had been "temporarily compromised".

Black Hatters Reveil SMS Security Concern

Speaking to the Black Hat conference in Las Vegas, Charlie Miller and Collin Mulliner told the audience that smartphones operating Apple's, Microsoft's, or Google's operating systems were vulnerable to an SMS based attack that would be executed by code arriving in a text message. The malicious code could knock a phone off of a network, access data on the phone, or access the programs installed on the phone. The pair have published their findings to encourage the OS makers to fix the holes and have said the they contacted Apple, Microsoft, and Google directly but Google is the only one who has addressed the issue todate.

BBC story.

Twitter Execs Hacked - Secrets Leaked

In what I would call a severe blow to cloud computing, a major breach of Twitter executives e-mail, calendars, and documents was reported yesterday by company officials after the hacker sent documents about Twitters plans and finances, confidential contracts, and job applicants to two tech blogs, TechCrunch and Korben. The breach occurred about a month ago with a simple breach of a password providing access to an administrative employee’s e-mail account from where access was gained to the employee’s Google Apps account, where Twitter shares spreadsheets and documents with business ideas and financial details.

This must have a lot of IT managers saying I told you so!

Source: NYTimes

Xbox Live Gamers Targeted

Using a traditional denial of service style attack, hackers are seeking revenge on players who pown them during game play on the Xbox Live network according to Chris Boyd the director of malware research at Facetime Communications. "They get your IP address, put it in the booter tool and they attempt to flood the port that uses Xbox traffic," said Mr Boyd. "Flooding that port prevents any traffic getting out." The tool doesn't attack the Xbox live network but idividual gamer's Xbox's because many of the games played on the network are actually hosted by the players themselves. In order to carry out the attack the hacker might interconnect their PC and Xbox and then deploy packet sniffing software to sift through the traffic flowing in and out of their consoles for IP addresses. Microsoft promises to ban the offenders.

Source: BBC

Famous Twitter-ers Have Accounts Hacked

Twitter discovered yesterday that 33 prominent users of the service had their accounts compromised by an individual "who hacked into some of the tools our support team uses to help people do things like edit the email address associated with their Twitter account when they can't remember or get stuck." Those hacked included Rick Sanchez and Barack Obama. The tools were immediately taken offline to prevent further hacking and the company says they will only go live again when the security issue has been addressed. In addition, many users were also the target of a Phishing scam on the weekend. There can be no doubt now... Twitter is a hit!

Source: Twitter Blog

Student Faces Charges After Revealing Security Hole

A 20-year-old Carleton University student, Mansour Moufid, has been charged under the Criminal Code with mischief to data and unauthorized use of a computer after a letter was sent to the university with a list of the students' accounts and their passwords. The letters author claimed he easily broke into student accounts using a keystroke logging program. According to the Ottawacitizen.com "The breach allowed access to the Campus Cards that students use as debit cards for campus purchases, including photocopiers, food kiosks and the bookstore." It seems the student was trying to make a point about the IT departments security procedures, looks like they didn't take kindly to his constructive criticism!

UK Hacker Facing Extradition To The US To Face Charges

Gary McKinnon aka "Solo", a Glasgow-born systems analyst is facing extradition to the United States to face charges that he gained access to 97 US military and Nasa computers from his London home in 2001 and 2002. Lawyers working on McKinnon's behalf say that US authorities had warned McKinnon that he faced a life sentence rather than a couple of years in jail unless he agreed to plead guilty and to extradition. McKinnon has never denied accessing the networks saying he was motivated by curiosity. I guess it's not really a question of guilt but rather can he receive a fair trial in a US court? BBC story here.

Spanish Police Arrest Hackers

Five hackers being described as "being among the most active on the internet" have been arrested by Spanish police. The BBC is reporting that "Police say they co-ordinated attacks over the internet and hacked into 21,000 web pages over two years." Two of those arrested are said to be 16 years of age. The arrests took place in Barcelona, Burgos, Malaga and Valencia, the result of an inquiry that began in March after a Spanish political party's site was disabled.

Hackers Warn Big Business That Attacks Are Imminent

A "Hackers Panel" which convened in London this week at the InfoSecurity Europe conference is warning big business that denial of service attacks, the likes of which shut down the websites of banks, governments and political parties in Estonia, are imminent. Big business is seen as definite targets "If someone wants to have a pop at the UK, they are unlikely to go for the government web servers. They will go for the lower hanging fruit - companies which are seen as good representatives of the country." said panelist Steve Armstrong from the SANS Institute for information security training. Some believe that these attacks can be thwarted if ISP's take a more active roll in policing their networks and identifying machines that are compromised and participating in bot-nets, while others say it is not the place of the ISP and that more money needs to be spent by businesses to defend against such attacks. Seems rather obvious that the white hat hackers and security firms would want to support the later... The BBC has more here.

Hacker Attack On Epileptic Support Forum

Wired is reporting that a group of hackers believed to be members of "Anonymous", the group that has targeted the Church of Scientology, injected javascript code last week into a forum run by The nonprofit Epilepsy Foundation. The code caused flashing animations to display in unsuspecting forum viewers browsers, which in some cases was enough to trigger migraines and seizures. "We are seeing people affected," says Ken Lowenberg, senior director of web and print publishing at the Epilepsy Foundation. "It's fortunately only a handful. It's possible that people are just not reporting yet -- people affected by it may not be coming back to the forum so fast." The site shut the forum down approximately 12 hours after the attack. This is a juvenile prank that could have serious consequences, let's hope that the perpetrators come to their senses and find other means of drawing attention to themselves.

Military Labs fall victim to hackers

An InfoWorld news article describes a couple of "sophisticated" hacker attacks on computer networks at Oak Ridge National Laboratory (ORNL) in Tennessee and Los Alamos National Laboratory in New Mexico. The article says "it appears that intruders accessed a database of visitors to the Tennessee lab between 1990 and 2004, which included their social security numbers and dates of birth." There is further speculation that the personal data could be a bit of a smoke screen for a more serious intrusion by "a rival government". Of course we've heard a lot this fall about apparent intrusions by Chinese sponsored hackers, doesn't appear as though anyone is throwing another volley in that direction just yet but it will be interesting to see how this develops. Seems to me if the labs were compromised by "several waves of phishing e-mails with malicious attachments" then there is a serious lack of education at these sites... my kids know not to open attachments or provide sensitive info via e-mail!

Hackers go large scale to hijack search results and take over machines

An attempt by hijackers to manipulate search results and steer searchers to sites containing malicious code bent on exploiting an Internet Explorer flaw has apparently been thwarted. The BBC is reporting that the large scale attack, which involved tens of thousands of domains being set up to convince search index software they were serious sources of information, and was likely the works of Russian hackers (pure speculation). The domain names were registered in China and the sites hosted in the US, but were apparently only live for a couple of days before Google started to strip them from search results. Why can't we all just use Firefox?

Flaw found in Adobe PDF file format that could be exploited, hacker says

Security researcher, Petko Petkov, says he's discovered a flaw in the Adobe PDF file format that could allow a Windows PC to be "Completely!!! Invisibly and unwillingly!!!," compromised. Petkov, who also recently discovered a vulnerability in QuickTime that affected the Firefox browser says " All it takes is to open a PDF document or stumble across a page which embeds one." He has stated that he would not release code that shows how this attack works until Adobe addresses the problem. InfoWorld has the story here.

More government hacking but no name calling this time

New Zealand government computers have been the most recent target according the countries top intelligence officer and confirmed by the Prime Minister. Security Intelligence Service head Warren Tucker said “strong evidence” was found to link the hacking activities to foreign governments and referred to comments by Canada's security service about Chinese spying activities. Prime Minister Helen Clark said she knew which government was responsible but declined to name names. The Globe and Mail has more here.

Why you shouldn't attempt to hack your iPhone

Wired has the tale of a would be iPhone hacker who bricked his iPhone while attempting to free it from it's AT&T only service. Looking at the picture, it's a little more than "bricked" it's probably more like "burnt toast". Perhaps he should have waited for the iPod Touch and kept his old cell phone! I don't know about you but I can't really afford to throw that kind of money away with the slip of a screw driver...

Speaking of the iPod Touch, here is a little video courtesy of YouTube and slashgear, the audio is a little poor but you'll get a glimpse of the new iPod in action.

China denies accusations

In a move that should come as no shock to anyone, the Chinese government is denying accusations that it was involved in a cyber attack on the Pentagon. A Chinese Foreign Ministry official is quoted in this BBC report as saying "Some people are making wild accusations against China ... These are totally groundless and also reflect a Cold War mentality," Interestingly, President Bush and China's Hu Jintao are preparing to meet at the Apec summit in Sydney, Australia. I wonder what the agenda will be?