Tag: computer security

Categories
Computing

A new way to think about data encryption

Ars Technica: A new way to think about data encryption: two-level keys

Current encryption methods are far from perfect—a fact highlighted by the numerous data security breaches that have occurred over the past few years. Technological limitations in the “trusted server” model for encryption and psychological barriers hinder the robust protection of data. A trio of computer science researchers has set out to simplify encryption systems. Their research, which began in 2005, has led to a novel encryption system that they term “functional encryption” greatly simplifies the problem of key complexity.

In a functional encryption system, keys are personalized and only one is needed for a person to gain access to all the data that should be available to them. In addition to simplifying the key process, this idea allows users—with proper access rights—to search encrypted volumes for specific information.

For the mathematically inclined the published research paper.

Categories
Computing

New payment systems claim to make it safer to buy online, but do they?

The Guardian: Experts cast a wary eye over new online payment systems

Two new systems claim to make it easier and safer to shop online, by letting you pay for goods directly from your bank account without having to hand over card details. But experts are warning consumers not to be “lulled into a false sense of security”.

By acting as middlemen in the transaction these systems provide security by ensuring that credit card details are not passed to the retailer however if the banks don’t allow access to their back office systems (and why would they) then these two new systems rely upon users installing software on their computers to handle the transaction details.

But by making it necessary to install software the systems will introduce a vector of attack by criminals who will use phishing techniques and introduce trojans to steal users financial details.

Categories
Computing

Identity theft: Six clicks from a cyber crook

The Telegraph: Posting innocuous personal details on social websites could expose millions to fraud, says Heather McLean

Organised crime is no longer carried out by hackers and script kiddies; it’s gangs of criminals who are well funded and well organised,” warns William Beer, a security expert with Symantec.

The traditional view of computer hackers has been out of step with reality for quite a few years now. As more and more people come online and online services become integrated parts of their lives then the more lucrative it is for criminal gangs to become “cyber criminals”.

Categories
Computing

Confidential Home Office CD found hidden in laptop sold on eBay

BBC News: Home Office CD in auction laptop

A highly confidential Home Office disk was found hidden in a laptop computer sold on eBay.

The CD was found between the keyboard and circuit board of the laptop by computer repair technicians in Westhoughton, near Bolton.

This is an odd story because it is a mystery how it would end up being hidden inside the laptop. However it’s not all bad news because unlike other recent security lapses in this case the repair technicians discovered that the data on the CD had been encrypted.

Categories
Computing

Chip ‘n Pin security compromised

Research carried out by Saar Drimer, Steven J. Murdoch and Ross Anderson of the Computer Laboratory Security Group at the University of Cambridge, has shown how to compromise supposedly tamper-proof Chip and PIN terminals.

Without specialist equipment and with little technical knowledge fraudsters would be able to acquire all the necessary information to clone a user’s credit or debit card.

The full results of the team are published their academic paper. [via]

In Chip & PIN card transactions, customers insert their card and enter their PIN into a PIN Entry Device (PED). We have demonstrated that two popular PEDs, the Ingenico i3300 and Dione Xtreme, fail to adequately protect card details and PINs. Fraudsters, with basic technical skills, can record this information and create fake cards which may be used to withdraw cash from ATMs abroad, and even some in the UK. These failures are despite the terminals being certified secure under the Visa approval scheme, and in the case of the Ingenico, the Common Criteria system. Our results expose significant failings in the entire evaluation and certification process.

Newsnight coverage of the research.

Categories
Computing

Exploit of DRAM vulnerability leads to attack vector on disk encryption

Ed Felten and his colleagues have released an amazing research result which leads to an attack on hard disk encryption systems such as TrueCrypt, BitLocker and FileVault. Through the process of rapidly reducing the temperature of the memory chips in a computer they can extract the data contained within which would include the encryption key neccessary to decrypt the computer’s hard drive. [via]

Contrary to popular assumption, DRAMs used in most modern computers retain their contents for seconds to minutes after power is lost, even at operating temperatures and even if removed from a motherboard. Although DRAMs become less reliable when they are not refreshed, they are not immediately erased, and their contents persist sufficiently for malicious (or forensic) acquisition of usable full-system memory images. We show that this phenomenon limits the ability of an operating system to protect cryptographic key material from an attacker with physical access. We use cold reboots to mount attacks on popular disk encryption systems — BitLocker, FileVault, dm-crypt, and TrueCrypt — using no special devices or materials.

This is a very interesting piece of research but I don’t believe that it actually yields a practicable attack on hard disk encryption as long as the user maintains control of their computer in the thirty seconds or less following shutdown.

Just make sure that you don’t leave your laptop laying around whilst in sleep mode or locked by a screensaver password, but a user with enough security sense to have hard disk encryption on there computer is unlikely to do that anyway.

Declan McCullagh gives his analysis of the research in this article Disk encryption may not be secure enough, new research finds.

Categories
Computing

Vulnerability in Google’s handling of SSL and session IDs

Wired’s Threat Level blog covers the vulnerability in Google’s handling of SSL and session IDs.

One of the big stories at DefCon last year was a security researcher’s demonstration of wirelessly sniffing users’ session cookies while they accessed their e-mail accounts or conducted e-commerce transactions via wireless networks. The attack allowed a hacker access to the victim’s Gmail or Hotmail account without needing to decipher the user’s password.

Now the security researcher who presented that info has found that even using SSL HTTPS to access your Gmail account — which was touted at the time as a surefire way to protect Gmail users against such an attack — is vulnerable to this hack.

Additional coverage at The Register.

Categories
Computing

Pension details of M&S staff left on stolen laptop

BBC News: M&S staff details left on laptop

Marks and Spencer has been found in breach of data protection rules after the theft of a laptop containing the personal details of 26,000 employees.

The Information Commissioner’s Office (ICO) said the data on the laptop, which was stolen from the home of an M&S contractor, was unencrypted.

The ICO has ordered M&S to make sure all laptop hard drives are fully encrypted by April 2008.

Categories
Computing

Skype and the Bavarian trojan in the middle

Wikileaks has published a couple of leaked documents that detail how the Bavarian police, Ministry of Justice and the Prosecution office tried to arrange the purchase of malware to aid in the interception of encrypted data submitted via SSL or Skype via the internet.

If the intention was to intercept all Skype traffic in Bavaria or perhaps further afield then this could be a serious breach of civil liberties but I suspect it is merely the Bavarian authorities looking for an equivalent to a court-approved phone tap now that criminals have presumably adopted Skype or other voice over IP type technologies.

I don’t think the trojan horse approach is very practicable though as it either requires the targets to unwittingly install it or for the police to secretly gain physical access to their target’s computers in order to install the software themselves.

Categories
Computing

Power grids hacked over the internet by extortionists says CIA

Robert McMillan writes that CIA Says Hackers Have Cut Power Grid

Criminals have been able to hack into computer systems via the Internet and cut power to several cities, a U.S. Central Intelligence Agency analyst said this week.

Speaking at a conference of security professionals on Wednesday, CIA analyst Tom Donahue disclosed the recently declassified attacks while offering few specifics on what actually went wrong.

Criminals have launched online attacks that disrupted power equipment in several regions outside of the U.S., he said, without identifying the countries affected. The goal of the attacks was extortion, he said.

This doesn’t surprise me but it does perplex me that companies create systems whereby major power grid equipment can be accessed via the internet.

By making anything accessible over the internet you have created a vulnerability because no matter the security systems put in place there is now a chance that criminals will be able to gain access. Even if the technology securing access is perfect (and it is almost impossible to verify whether it is totally secure as new bugs come to light all the time) then there is the avenue of social engineering where a person with access privileges is compromised by the criminals and gives out the required information to access the system.