Massive Credit Card Breach - The Plot Thickens

Issue 1 - On Feb 10th, I blogged about a massive credit card security breach. At the time, little was known about the issue. VISA, MasterCard and several banks confirmed that a security breach at a US retailer was to blame. The name "OfficeMax" was thrown around. The FBI and the USSS were looking into the issue.

Issue 2 - In early March, people started to see issues with Citibank ATM cards in Canada, UK and Russia. At the time, they were told it was due to a possible security breach...nothing more. Citibank later issued a statement.

Two separate issues? Maybe not.

MSNBC.com - "Financial institutions around the country continue to issue warnings, the most recent this week by Citibank, which said it had spotted fraudulent withdrawals from U.S. accounts made in Canada, the United Kingdom and Russia.In each case, the banks have blamed a third-party company — in some cases, more specifically identified as a merchant or retailer. Speculation has been rampant that the source of the stolen data is office supply store OfficeMax, starting with an article last month in the San Francisco Chronicle indicating 200,000 account numbers had been stolen from the firm. OfficeMax denies it's to blame."

I guess we don't know anything for sure until the FBI and the USSS are finished with the issue.

Ohh...by the way an undisclosed number of Verizon employees at now at risk of identity theft.

As a friend once said in a very good book.

You have money in the bank if a computer says so. Your blood type is what the computer says it is. You are who the computer says you are.

Symantec Kills L0phtcrack

Securitydump.com

After merging with @ stake back in 200 and then surviving the take over by Symantec in 2004, the LC line of products has finally died. LC5 and LC4 have both been very good password crackers...and where held with high regard in the pen-testing world...but they are no more. Sad really.

Is this going "thinning of the herd" going to kill other great products? Most likely. But business is business right? Umm, I guess.

Mac OS X Hacking Contests

Last month, a blogger conducted an OS X hacking contest. Attackers were given local user access to a Mac running OS X and were asked to remove several directories or deface the running website...it was contest ended 6 hours later.

The winner stated that he used a non-public vulnerability to gain root access to the Mac. But this isn't a true hacking test, is it?

I do agree that giving attackers local access does make the process MUCH easier, but it still sends a very powerful message. OS X has local privilege escalation vulnerabilities that are not public. They are not known by the vendor and not known by the public. However, Apple isn't alone in this class. Blackhats are constantly on the lookout for unknown holes in all operating systems. At least once a year, you will hear about some new critical zero-day vulnerability that affects Windows users.


But what about hacking into OS X from the internet with no beginning access? What will happen? I don't know, but the University of Wisconsin plans to find out. They have started their own Mac OS X Security Challenge. It is slated to end on March 10th...so get to hacking. Go ahead.

Was Apple ready for this new surge of hacker attention? Only time will tell...

93,000 Students Warned After Laptop Theft

Same old story - unencrypted data on a laptop. It is likely that the person that took the laptop is just going to dump it for money, doesn't sound much like a data thief to me. However, who will get the laptop after that? A pawn shop? Who gets it after that? And for what reason?

That is the part that scares me.

Colorado college warns 93,000 after laptop theft

Laptops are seen as walking attack vectors in the internet security world....but in the real world even judges see unencrypted credit card information on a laptop as no real threat.

Interview with KF - Creator of the OS X InqTana Worm

SecurityFocus.com has a great interview with Kevin Finisterre, creator of the InqTana worm. He has been an Apple user for a while and created the OS X malware in an attempt to pull back the thin veil that seems to be keeping many OS X users blind to possible threats.

InqTana was designed to be a POC and had built-in methods to reduce its overall threat. Therefore, many AV companies saw it as a "low" threat from the very beginning.

However on Feb 21, Sophos issued a bad IDE for the InqTana.B worm. At around 8am, I found that Sophos was detecting Epson printer drivers, Adobe files and even Microsoft Office 2004 files as the InqTana.B worm. I was 97% sure it was a false positive and reported it to Sophos as quickly as possible...within 45 mines a new IDE was released. Fun Day! =)

Since Sophos isn't big on the "Quarantine" idea, it was deleting files as fast as the clients were automatically updated. While I agree with the general idea, I believe that disabling access to a possible malware file is much better than just deleting it by default. Since Sophos was deleting the files, it make it very hard to get a good sample file to send them...hello, they were deleted.
What is Sophos detects a critical non-running SAP file as malware? This has happened to me and we had to reinstall the SAP client on around 10 workstations...also not a fun day.

Will 2006 be the "Year of the OS X Exploits"??

I hope so for the sake and security of all OS X users. Real threats against Apple have been few and far between...but that trend is starting to change.

Awareness is key.

The Mac Faithful should remember this old Kenyan proverb -

Blind belief is dangerous.

Humor: Rules for Living in Austin, TX

From the Stanford Texas Club -

1. First you must understand that Austin is not Texas, but Austin is in the heart of Texas. The rest of Texas is defined by two zones-the vaguely scary, inbred country regions, and the extremely scary, urban, conservative mega-cities. In Austin, we respect both zones (they are, after all, in the great state of Texas), but we really don't have much in common with them. You may hear us speak disparagingly of other parts of Texas, but you are not allowed to do the same. The only thing we hate more than people from Houston coming to Austin and trying to turn Austin into Houston is people from outside of Texas coming to Austin and insulting our state.
   


2. You should also understand that it is hot and humid as hell for at least 3 months out of the year. People in Austin know this, and they don't understand people who complain about it. The day lasts 24 hours. There are 7 days in a week. It's hot outside. None of these things are worth mentioning or complaining about.
   


3. Austin has some peculiar conventions when it comes to traffic. First, if there is anything that could potentially distract Austin drivers, they stop dead in the middle of the road. If they see the scene of an accident on the other side of the highway, they stop. If they see rain, they stop. If there is snow, they stop and start sacrificing goats. Get used to stopping on highways. At the same time, you should get over the idea that drivers in Austin will stop at other, more appropriate times. Austin drivers will not even slow down for a pedestrian, even if that pedestrian is clinging for life to the front grill of their Suburban Land Yacht. They also will not stop to talk on their cell phones, and they damn sure will not stop for a red light that is less than 10 seconds old. And, of course in Austin, as in the entire state of Texas, it is against the law to use a turn signal. A turn signal may distract other drivers, causing them to stop in the middle of the road, so it is best to not advertise your intentions to turn or change lanes.
   


4. If you park your car in Austin, it will be towed.
   


5. Getting around Austin requires a bit of training. First of all, it is relatively easy to go north and south in Austin, but not so easy to get east or west. And if you are going north or south, the directions will surely begin with, "Go down MoPac... 'cause you sure as hell don't want to mess with I-35." Of course, this rule is changing as more and more people crowd onto MoPac, so in the future all instructions will begin with, "Actually, it's probably faster to just take Lamar." Lamar is a road with no beginning and no end, and everything is "just off" of Lamar, so it is just a matter of time before it becomes a parking lot similar to I-35 and MoPac. Eventually, a major flood of Shoal Creek will drown all the people parked on Lamar. We call this, "thinning the herd. "There is no point going anywhere during "rush hour," which runs from 6:00 to 10:00 in the morning and from 3:00 to 7:00 in the afternoon every work day except Friday (when rush hour starts on Thursday night and lasts all day). On most days, at least one driver is distracted by something during rush hour, which means that everybody has to stop. You should also make a note that Mopac IS Loop 1 -- they are one and the same. Similarly, Capital of Texas Hwy is 360, and Research is 183. 2222 is Northland or Allendale or Koenig, depending on what part of 2222 you are talking about. 290 is Ben White, but there are two 290 exits on I-35 * one of which is 2222 (which, as mentioned earlier, is Northland, Allendale and Koenig). Don't try to figure it out. Just accept it. If you question the intelligence behind this naming convention, people will simply tilt their heads to the right and stare at you.
   


6. Austin is effectively divided into two worlds. The new "tech" people who live "north" of town (north of 183), and the old "true" Austinites who live in the "middle" of town (although census data will no doubt reveal that the true "middle" of Austin is now well north of 183). South of town is hard to describe, so we'll pretend it doesn't exist, and East of town is embarrassing to describe, so we'll pretend it doesn't exist either. North Austin is a plastic, mass-produced world full of chain restaurants and movie theaters. The houses are huge, the yards are small, and the treeless streets have names like "Oak Forest View Circle." Central Austin, on the other hand,tends to attract the granola eating, deodorant-shunning, aging hippie-types. The houses are small and structurally frightening, but they are no less astonishingly expensive, and the businesses tend to be small, privately owned specialty shops that don't sell anything you'd want to buy.
   


7. There is no dress code in Austin. How you look and what you're worth typically have little do to with each other here. In central Austin, it is quite common to see some scruffy, smelly hippie with dread-locks, tattoos and piercings driving a new Lexus or Mercedes. People in Austin like to look weird. The woman you see walking down the drag with the tattoo of a dragon across her back and the purple hair may be your child's kindergarten teacher. Your congressman might be a leather-clad biker. And the girl in the coffee shop serving you a latte may have a Ph.D. in astrophysics. Don't judge a book by it's cover here. In the extreme, there is Leslie, who is technically a bearded man, but who likes to hang out downtown in a teddy and a tiara. Leslie's nuts, but he personifies Austin, and we're not going to get rid of him.
   


8. Austin has a love-hate relationship with tech companies in general and Dell in particular. We love being progressive, and the tech companies represent "the future." However, they're boring, sanitized, and they tend to treat their employees like cattle. Dell is a nasty machine that uses people like a lubricant, grinding them up and cleaning them out when they get messy or inconvenient. People in Austin are beginning to have a sneaking suspicion that George Orwell was right about everything except the date.
   


9. Austinites are largely a bunch of tree-hugging environmentalists. For example, we're strangely and frighteningly proud of our bats. In the summer, the Congress Avenue Bridge is reminiscent of a Hitchcock film, but Austinites flock down there every night to see the show up close and personal. We have a statue devoted to the bats, and we named our hockey team after them (yes, we have a hockey team). The bats rule. As does our salamander. At one time, money-grubbing developers (Freeport-MacMoRan mostly) were building irresponsibly along Barton Creek, and because the bastards (may they rot in hell) couldn't be bothered with things like proper sewage drainage, our beloved swimming hole, Barton Springs Pool, was being polluted with the sewage from Barton Creek Development residents (a.k.a., "rich scum spoor"). Most of the city council and the Texas legislature were in the pockets of the festering scumbag developers, so it was necessary to bring out the big guns-the Barton Creek Salamander, an endangered species that was being threatened by the development sludge. For some reason, in Texas it is okay to make your citizens swim in crap, but it is illegal to make salamanders do so.
   


10. And of course, there is music. Austin is supposed to be the "music capital of the world." We have a shrine for Stevie Ray Vaughn down on Town Lake (yes, it's a lake-it looks like a river to you, but it's a lake); pay your respects if you come to town. While you're at it, swing by Threadgills and pay your respects to the memory of Janis Joplin, and drop by Antone's and pay your respects to the memory of Clifford Antone. He's not dead, but he's in a Texas prison on drug trafficking charges, and that may be just as bad.

e-Passports - Are we ready?

GCN.com

The State Department started pilot production of electronic passports earlier this month and plans to roll out e-passports for the general public this summer, officials said.

The senior official in charge of the project also said that technical issues raised recently about e-passport security would not prevent the general distribution of the documents.

Visual Design of the e-Passport

RFID Security

Eariler this month a Dutch security firm broke the security of the Dutch e-Passport pilot. They intercepted the data exchange between the RFID reader and passport, stored the encrypted data, and then cracked the password in just 2 hours on a PC giving full access to the digitized fingerprint, photograph, and all other encrypted and plain text data on the RFID tag.

The United States is suppose to use password protection on the new e-passports as well. They are even suppose to include a radio shield in the front cover, therefore reducing radio leakage when the passport is closed.

What happens if the US government issuse thousands of these RFID passports and then the encryption process is broken by some group? Will they re-design and re-issue new cards to everyone?

Does anyone make RFID blocking backpacks? or computer cases? Someone should...

Man, am I glad I just got my passport...won't need a new one for quite some time.

Announcement - Botnet Reporting & Mitigating Mailing List

Gadi Evron announced the creation of a new open and public mailing list where anyone can join and report a botnet command and control (C&C) server.

The security community has lacked a centrally reporting location and this is finally changing. Read the announcment above and join in the fight if willing.

Also note the private email for reporting off-list.

Good stuff.

Interview with Solar Designer - Creator of John the Ripper

Federico Biancuzzi has a great interview with Solar Designer on SecurityFocus.com

They discuss the new features in John the Ripper 1.7 and the overall idea of password security.

Google Reader "Preview" and "Lens" Script Improper Feed Validation

My good friend, Debasis Mohanty, posted this to FD this morning.

---------------------------------

Google Reader "preview" and "lens" script improper feed validation ===================================================================
I. DESCRIPTION

Google Reader (http://www.google.com/reader/) helps organise the contents of those rss or atom feeds for which the user is interested in or subscribed to. The user instead of continuously checking his/her favorite sites or discussion groups for updates, (s)he can let Google Reader do it for them.

From news sites to your friends' blogs, Google Reader helps stay up-to-date with all the online information that matters most to the user.

II. VULNERABILITY DETAILS
Google reader is supposed to display only those contents which the user has subscribed to however two vulnerabilities has been identified which may allow an attacker to entice it's victim (using google reader service) to view unwanted web contents carrying malicious payloads.

a. Google reader "preview" script improper feed validation (without user
authentication)
----------------------------------------------------------------------------

Google feed reader "preview" script: The script
(http://www.google.com/reader/preview/*/feed/) is normally used for displaying the feed contents within the reader.

For example, the following request will display the rss content of the link
http://www.microsoft.com/athome/security/rss/rssfeed.aspx:
http://www.google.com/reader/preview/*/feed/http://www.microsoft.com/athome/
security/rss/rssfeed.aspx

Note: '*' in the above link can be replace with any word of your choice otherwise it can be left as it is.

This 'preview' script is only available to authenticated user but if a direct link is provided it doens't ask for user authentication. It can be very usefull for an attacker to mount an attack on its victim by directing them to view the content of malicious sites (carrying evil payloads).

b. Google reader "lens" script improper feed validation (with user
authentication)
----------------------------------------------------------------------------

Google feed reader "lens" script: The script
(http://www.google.com/reader/lens/feed/) is normally used for displaying contents of only those feeds to which an authenticated user has subscribed to.

However, it is possible to pass any rss / atom feed to the script as parameter to which the user has not subscribed but the un-subscribed feed contents can still be loaded within the user reader page.

For example, the following request will display the rss content of the link
http://www.securityfocus.com/rss/news.xml:
http://www.google.com/reader/lens/feed/http://www.securityfocus.com/rss/news
.xml

This 'lens' script is only available to authenticated user and can be usefull for an attacker to mount an attack on its victim by directing them to view the content of malicious sites (carrying evil payloads) even though the user is not subscribed to.

III. VENDOR
Google.com

IV. HISTORY
30th Jan, 2006 - Bug originally discovered
2nd Feb, 2006 - Vendor Notified
...
...
No vendor response
...
...
22nd Feb, 2006 - Vendor Notified again
22nd Feb, 2006 - Public Disclosre

IV. CREDITS
Debasis Mohanty
www.hackingspirits.com

---------------------------------

It isn't a killer RSS hole but just wait...this is just the beginning.

Uncomfirmed - Mozilla Thunderbird 1.0.7 : Remote Code Execution & DoS

Just posted to the FD list

--------------------------------
Mozilla Thunderbird : Remote Code Execution & Denial of Service

http://www.sysdream.com/article.php?story_id=230&section_id=78

Nmap 4.01 - Kinda old News

Just saw that Nmap was updated to 4.01 on the 10th. Just in case you didn't know...now you do. Kinda old news, but I am still catching up.

Nmap 4.01 fixed several bugs, including an important memory leak in the raw ethereat sending system. See other changes.

Possible False Positive Detection of OSX/Inqtana-B - UPDATED

Virus: 'OSX/Inqtana-B' detected in /Library/Printers/EPSON/
SP830Series.plugin/Contents/MacOS/SP830Series

Virus: 'OSX/Inqtana-B' detected in /Library/Printers/EPSON/C43Series.plugin/Contents/PDEs/
PrintSetting.plugin/Contents/MacOS/PrintSetting

Virus: 'OSX/Inqtana-B' detected
in /Library/Printers/EPSON/C44Series.plugin/Contents/PDEs/
PrintSetting.plugin/Contents/MacOS/PrintSetting

Virus: 'OSX/Inqtana-B' detected
in /Library/Printers/EPSON/PM860PT.plugin/
Contents/Utility/UTPM860PT.plugin/Contents/MacOS/UTPM860PT

Virus: 'OSX/Inqtana-B' detected
in /Applications/Microsoft Office 2004/Office/ShMem.bundle/
Contents/MacOS/ShMem

Virus: 'OSX/Inqtana-B' detected
in /System/Library/Extensions/
AppleVADriver.bundle/Contents/Resources/mp2decvbin1

Virus: 'OSX/Inqtana-B' detected
in /Applications/4D Client.app/Contents/4D Extensions/4D Carbon Support.bundle/Contents/MacOS/4D Carbon Support

-----------------------------------------

It would appear that Sophos may have a pretty big false positive issue on their hands....or at least I hope it is a false positive....more information to come.

The Sophos website seems to be running very slow (DoS'd), perhaps caused by this new detection issue.

Inqtana uses a Bluetooth vulnerability that was patched in Mid 2005, therefore most people saw the trojan as "low-risk". If my feelings are correct, the outcome of this false positive will be 100 times worse than the trojan itself.

UPDATE - 11:37AM Central

Sophos has pulled the IDE and confimed it was a false positive. Expect a new IDE within 45 mins.

Feb 2006 - Drone Armies C&C Public Report

Gadi Evron passed this nice report to the FunSec mailing list this morning.

While this information only appears to cover botnets that are reported, it does show which networks are willing to actively fight this growing problem and which aren't. Hopefully posting this information regularly will change some views and increase awareness of the issue.

Keep up the good work.

2006 - Year of the OS X Exploit?

In my personal view, Apple made the right move in using BSD code in OS X and in moving to the Intel chipset.

However, a smart man once said that every action has an equal and opposite reaction.

Why use OS X?

Apple’s use of the BSD microkernel code has turned OS X into the system of choice for both hackers and security professionals alike. As a result, many applications commonly used by on BSD/Linux have been ported to OS X. Some are even better on Apple, take KisMac for example. But all this positive attention hasn’t developed without some negative attention as well.

Opposite Reaction

Security Researchers and hackers now seem to have their sights on Apple’s OS gem.

• Just today, a serious vulnerability has been found in Apple Safari on OS X. Attackers can run shell scripts on your computer remotely just by visiting a malicious website.
• Hackers have worked to get the new x86 OS X to run on normal x86 hardware.
• Trojans and viruses designed for OS X seem to be on the rise.

Summary

Will 2006 bring an end to Apple’s current threat immunity? Perhaps - Only time will tell, but the force seems to be strong with those that want to dig in the OS X candy coating.

I have outlined several other security concerns for the Apple world with a good friend and hopefully we can put those all together in a more in-depth blog in the future.

Fun: Jamaica

Well, I spent most of the day in the rain forest of Jamaica. It was very muddy and wet...and pretty damn hot, but overall a very fun time. We are underway toward the Grand Caymans.

We will have a private tour on the next island, so driving around in a rented car/van should be pretty fun. As I have stated before, I am pretty much out of the internet security loop for the rest of the week. I hope the internet doesn't die on me....keep it going guys.

Fun: Haiti

As some of you may know, I am chilling in Haiti right now. I won't be around for around 4 or 5 days....so stay tuned. I have all types of stuff to catch up on. Not having the internet for a week is like not being alive for a full year. =)

Fun: WebShots Backgrounds

It would seem that someone from Peking decided to collect all the great backgrounds from WebShots and host them on a site in China.

www.mydeskcity.com

Not sure Webshots would like it however.

Security Breach Exposes CC Details of 200,000

Some of you may have heard about the data-security breach that resulted in numerous people having their debit cards cancelled this week. What happen? How big is the problem?

Details are still coming to light, but right now it sounds something like this -

A pretty big office-supply retailer was hacked and exposed the credit information over perhaps 200,000 people.

Bank of America, Wells Fargo and other banks were alerted by Visa and MasterCard to take security actions for those card holders.

Let’s remember, this isn't some stolen backup tape or a street thief wanting quick money on a laptop...it sounds like a real hacker that targeted the data storage of this retailer. This is my take on the issue and may not be true, but check these quotes from SFGate.com

1) Banking industry sources said they were notified last month by Visa and MasterCard that the computer system of a prominent merchant had been penetrated by a computer hacker, and that account information for thousands of customers had been endangered.

2) Rosetta Jones, a spokeswoman for Visa USA, acknowledged Thursday that the incident involved a U.S. merchant that "may have experienced a data security breach resulting in the compromise of Visa card account information."

3) Sharon Gamsin, a spokeswoman for MasterCard International, said the credit card company had been informed of "a potential security breach at a U.S.-based retailer."

Sounds pretty serious. Visa, MasterCard, BofA and Well Fargo seem to be reacting as required and expected. Issuing new cards and watching accounts is standard for security breach of this nature and is the correct step for customer protection.

So whats the big deal? The "Unknown" retailer is the deal right now.

Under California SB 1386 - requires an agency, person or business that conducts business in California and owns or licenses computerized 'personal information' to disclose any breach of security (to any resident whose unencrypted date is believe to have been disclosed).

So if the above is true, then we can assume one of the following -

1) The "Unknown" retailer has no business in California and therefore is not bound by SB 1386

2) They are bound by the law but all credit information exposed was encrypted.

3) They are bound by the law and they will disclose this breach in due time.

4) They are bound by the law and not following it as it was intended.

Someone needs to find out...and I would guess that we will all have more information very shortly. Keep your eyes out for this one.

Again, take this whole article with a gain of salt because information is will change.

The Secret 64-bit Life of the Intel Core Duo

It would appear that the new Intel Core Duo is really a 64-bit processor in hiding. So why won't Intel let your new iMac run 64-bit Linux??

More details are sure to be exposed. Is OS X 64-bit? Seriously, I am asking you....