the no longer secret, ghostly NOLA base.

Some of the buildings on the base were the most off-limits facilities in Louisiana, besides those at Barksdale AFB. Now these strictly classified buildings are abandoned and explored by professionals (The Proper People.)
https://youtu.be/5kTdT_gUu6Y
Something queasy about the formerly busiest spaces being empty and unimportant.

RFID company sues college researchers for exposing defects

This another ugly trend in big business: www.computerworld.com/action/article.do?command=printArticleBasic&articleId= 9109139 Chip maker sues to quash research on RFID smart card security flaws Researcher says chip hack could crack open 2 billion cards, By Sharon Gaudin July 10, 2008 (Computerworld) A semiconductor company is suing a Dutch university to keep its researchers from publishing information about security flaws in the RFID chips used in up to 2 billion smart cards. The cards are used to open doors in corporate and government buildings and to board public transportation systems. NXP Semiconductors filed suit in Court Arnhem in The Netherlands against Radboud University Nijmegen. The company is pushing the courts to keep university researchers from publishing a paper about reported security flaws in the MiFare Classic, an RFID chip manufactured by NXP Semiconductors. The paper is slated to be presented at the Esorics security conference in Malaga, Spain, this October, according to Karsten Nohl, a graduate student who was part of a research group that originally broke the encryption last year. Nohl told Computerworld on Thursday that he gave his research to the Dutch university so it could build on what he had done, and he has been closely following its progress. "I think it's crucial that it's published in an academic conference where researchers can work on solutions," said Nohl. "I don't think there's any good outcome for NXP. Say they were to win. They'd be keeping information away from the academics who might come up with solutions." NXP declined to be interviewed for this story but said in an e-mailed statement, "We cannot give further comments at this time, as it is in the hands of the court and the court has given a confidentiality order." Representatives from the university did not respond before deadline. Call out the military Nohl said the problem lies in what he calls weak encryption in the MiFare Classic smart card. In March, he said that once he had broken the encryption, he would need only a laptop, a scanner and a few minutes to get the cryptographic key to an RFID door lock and create a duplicate card to open it at will. Since the MiFare Classic smart cards use a radio chip, Nohl said he easily can scan them for information. If someone came out of a building carrying a smart card door key, he could walk past them with a laptop and scanner in a backpack or bag and skim data from their card. He also could walk past the door and scan for data captured to the reader. Once he's captured information from a smart card and/or the card reader on the door, he would have enough information to find the cryptographic key and duplicate a smart card with the necessary encryption information to open the door. He said the whole process would take him less than two minutes. And that, according to Ken van Wyk, principal consultant at KRvW Associates, is a big security problem. "It turns out it's a pretty huge deal," said van Wyk in a previous interview. "There are a lot of these things floating around out there. Using it for building locks is the biggy, especially when it's used in sensitive government facilities -- and I know for a fact it's being used in sensitive government facilities." Van Wyk noted in March that one European country had deployed soldiers to guard some government facilities that used the MiFare Classic chip in their smart door key cards. "Deploying guards to facilities like that is not done lightly," he said. "They recognize that they have a huge exposure. Deploying guards is expensive. They're not doing it because it's fun. They're safeguarding their systems." Van Wyk declined to identify the European country under discussion. Vintage technology Manuel Albers, a spokesman for NXP Semiconductors, said previously that the company had confirmed some of Nohl's findings. However, he said there are no plans to take the popular chip off the market. "The MiFare chip was first introduced in 1994. At the time, the security level was very high," he said in an interview. "The 48-bit key length for encryption was state of the art." In an earlier interview Albers noted that NXP recently released MiFare Plus, which is backward-compatible with the MiFare Classic while offering better security. He said the company did not release the updated chip because of Nohl's findings, but it did use some of his information when designing it. In a statement on its Web site, the university notes that Mifare smart cards are widely used to control access to buildings and facilities. "All this means that the flaw has a broad impact," according to the release. "Because some cards can be cloned, it is in principle possible to access buildings and facilities with a stolen identity. This has been demonstrated on an actual system. In many situations where these cards are used, there will be additional security measures; it is advisable to strengthen these where possible." The university added that this past March, its researchers informed its government, the Dutch Signals Security Bureau of the General Intelligence and Security Service, and NXP Semiconductor about their findings. In an interview on Thursday, van Wyk said publishing security research is a common pursuit, but it's a bit harder to deal with for a hardware company. "You have an RFID chip deployed by the millions," said van Wyk. "Switching that around is extremely costly and won't happen very quickly. It could be it will take them months or a year to do that." Van Wyk added that it's a "scary" situation for the companies and organizations using these smart cards. "If they're using that for access control to buildings, they'd have to make major changes to their whole access system," he said.

MICROSOFT'S E-BOOK CRACKED

Way back on 25 March 2003, the issue of PC Magazine, page 25, has a brief news item as follows: An anonymous tech whiz has created a 29K command line program called Convert Lit to turn Microsoft Reader's Digital Rights Management component against itself. PC Magazine has verified that running Convert Lit on a PC with legitimate rights to read a purchased DRM5 e-book title removes all protection and even exports HTML from the LIT file. This battle will never be solved solely with technology. Something the Defense Department never understood about its software reuse efforts in the 1980s.

Phishing the phishers

A n enterprising group of fraudsters from Morocco calling themselves Mr-Brain has launched a website that offers easy-to-use phishing site code, email templates and other hacking tools. The website offers phishing kits for many of the most common targets, such as Bank of America, eBay, PayPal and HSBC. The tools and code provided by Mr-Brain are designed to make it extremely easy for other fraudsters to deploy realistic phishing sites. Only a very basic knowledge of programming is required to configure the PHP scripts to send victims' details to the fraudsters' chosen electronic mail address. Deploying one of these fully working kits can be done in as little as one minute – another factor that adds to their appeal.

Phishing the phishers

Mr-Brain's intentions are to encourage as many people as possible to use their phishing kits, for all is not what it seems at first glance. Careful inspection of the configuration script reveals deceptive code that hides the true set of electronic mail addresses that are contacted by the kit – every phisher who uses these kits will unwittingly send a copy of each victim's details back to the Mr-Brain group. The configuration script exploits the case-sensitivity in PHP variable names to disguise Mr-Brain’s electronic mail address as an unrelated but seemingly essential part of the script, encouraging fraudsters not to alter it. The injected electronic mail address is actually contained in a completely separate PHP file, where it is encrypted in a hidden input field named "niarB", or "Brain" backwards. Yet another PHP script reads the value from this input field and decrypts it before supplying it to the configuration script. Most fraudsters are unlikely to notice this level of obfuscation and will assume the script is working normally, as they will also receive a copy of any emails produced by the script. When Netcraft decrypted the contents, the hidden input field revealed one of Mr-Brain's Gmail addresses, which is used to covertly capture details from all of the phishing kits that have been deployed on their behalf by other fraudsters. A comment at the top of one of the scripts aims to deter these fraudsters from examining the script that decrypts the hidden field: Earlier this month, Netcraft also exposed a similar phishing scam targeting Bank of America. This, too, was authored by Mr-Brain and was configured to covertly send harvested credentials to a different Gmail address. Each phishing kit listed on their website is accompanied by a description, showing what kind of information it steals from victims. One page on their website lists a selection of Social Security numbers, credit card numbers and PINs under the heading "Free and Freash [sic!] Credit Card". Mr-Brain claims that all of the scam pages offered on its site are undetected by Mozilla, Opera and Internet Explorer. Netcraft blocks these sites when they are detected by the Netcraft Toolbar community, and propagates the block to all companies which licence the Netcraft Phishing Site Feed.

Clinton-Obama campaign uses XSS as a weapon

While Clinton and Obama are battling it out in the political arena, security researchers are continuing to find vulnerabilities in the candidates' and supporters' websites. Interestingly, while a typical exploit is to redirect one party's site to their opponent's, the reasons for seeking to discover such vulnerabilities are not always politically motivated.

Following the recent cross-site scripting attacks against Obama (see previous post), Finnish security researcher Harry Sintonen has published an example of a cross-site scripting vulnerability on votehillary.org.

Sintonen's example submits a POST request to the Vote Hillary website and injects an iframe, causing the site to display the contents of Barack Obama's website. Unlike the Obama incident, which redirected the user's web browser, Sintonen's method retains the votehillary.org URL in the address bar while displaying the opposing website.

Sintonen told a Netcraft reporter that he was inspired by the recent Obama attacks and first examined Hillary Clinton's official website at www.hillaryclinton.com. Sintonen did not find any cross-site scripting vulnerabilities on this site, adding that it looked quite secure, but subsequently found XSS opportunities available on the Vote Hillary website. Sintonen lives in Finland and has no strong interest in US politics.

While the example exploits have so far been relatively benign (limited to redirecting a user to the opponent's website, for example), future cross-site scripting vulnerabilities found on political candidate sites have plenty of scope to be much more serious. Obama's and Clinton's websites both accept monetary contributions towards their campaigns, so cross-site scripting vulnerabilities could be leveraged to steal money and identities from supporters.

Sintonen told Netcraft he informed the webmasters of votehillary.org about this cross-site scripting vulnerability two days ago, but has not yet received a response.

Hacker drives Obama visitors to Clinton

A security weakness in Barack Obama's website has been exploited to redirect visitors to Hillary Clinton's website. Visitors who viewed the Community Blogs section of the site were instead presented with Clinton's website as a result of a cross-site scripting vulnerability.

Barack Obama's visitors were redirected to this site.

A user named Mox, from Liverpool, IL, posted an apparent confession in the Community Blogs section on the Barack Obama website yesterday. The subject of the post was, "I am the one who "hacked" Obama's site."

Mox plays down the matter by saying that all he did was exploit some poorly written HTML code before suggesting that it was a cross-site scripting vulnerability that had been exploited. By allowing users to enter characters such as > and " into their blog URLs, JavaScript could be injected into pages in the Community Blogs section and would be executed by subsequent visitors.

A YouTube clip from zennie62 demonstrates the attack. The clip shows a user clicking on the Community Blogs section of the Barack Obama site, which subsequently causes the browser to redirect to hillaryclinton.com. The author speculates that "Senator Clinton's staffers possibly hired someone to hack into the Barack Obama website system." No evidence is offered to back up this statement.

Another vulnerability found on the Barack Obama site.

While Mox states that the original issue has now been fixed, a number of similar vulnerabilities have since been identified and remain unfixed, and are documented on xssed.com, which notes that such vulnerabilities open up opportunities to infect Obama's supporters and site visitors with malware, adware and spyware.

Just when you thought Google Docs were safe...

Just when you thought you were were safe from Google Desktop exploit, An interesting cross-site scripting (XSS) vulnerability found in the Google Spreadsheets service would have allowed attackers to gain unauthorised access to other Google services, including Gmail and Google Docs.

The vulnerability was discovered by security engineer Billy Rios , and takes advantage of nuances in the way Internet Explorer handles Content-Types for webpages.

When a spreadsheet is saved and downloaded in CSV format, the Content-Type is set to "text/plain", thereby instructing the client's browser that the document should be treated as plain text. However, if HTML tags are entered into the first cell of the spreadsheet, Internet Explorer detects these tags near the start of the CSV document and instead deduces that it should be treated as HTML. This essentially allowed arbitrary HTML webpages to be served from spreadsheets.google.com, which in turn allowed JavaScript to be executed in the context of the spreadsheets.google.com site. A remote attacker could exploit this weakness by stealing the user's session cookies and hijacking their session.

Rios points out that Google cookies are valid for all google.com sub domains. This means that when a user logs in to Gmail, the Gmail cookie is also valid for other Google services, such as Google Code, Google Docs, Google Spreadsheets, and more. Cross-site scripting vulnerabilities in any of these sub domains can allow an attacker to hijack a user's session and access other Google services as if they were that user.

Google has fixed the vulnerability discovered by Rios and there have been no reports of the vulnerability being exploited by attackers.

eBay buys Fraud Sciences

US online auctioning giant eBay and its subsidiary PayPal will soon be better protected from online fraud. This comes after news that PayPal has purchased Israeli online risk tools startup Fraud Sciences for $169 million. The small privately owned company, which only raised $7 million in investment before the buy-out, has developed verification technology for securing commercial transactions on the Internet. Fraud Sciences' technology is designed to uncover fraudulent credit card purchases by verifying that the customer making the purchase is in fact the cardholder. It uses a technique, known as 'identity proofing', which builds on the behavioral practices already used by many online retailers to detect fraud. Tel Aviv based Fraud Sciences was founded in April 2006 by Shvat Shaked, and Saar Wilf. They will be joining PayPal's technology and fraud management teams alongside Fraud Science's COO Yossi Barak. Other Israeli startups that have made the news recently are Modu and YouFig. Investors in Fraud Sciences include Redpoint Ventures, BRM Capital and entrepreneur Eli Barkat, who acquired a 40% stake in the firm for $5 million. He is set to make 12 times that amount in the exit. Fraud Sciences, which will continue to operate out of Israel, had originally intended to raise $11 million in a two-stage financing round, but in the course of due diligence, PayPal offered to buy the company out. eBay and e-commerce enabler PayPal have been facing an increasing battle against online fraud. They plan to use Fraud Science's risk tools and analytics to expose scams and deceptions targeted at their companies, and to accelerate the development of next generation fraud detection tools. Scott Thompson, president of PayPal, said the acquisition of Fraud Sciences fits into eBay's recently announced plans to significantly improve trust and safety across its sites this year. "Integrating Fraud Sciences' risk tools with PayPal's sophisticated fraud management system should allow us to be even more effective in protecting eBay and PayPal's hundreds of millions of customers around the world," he said. This is the second Israeli purchase for Californian Internet auction company eBay and its first purchase of a security technology company. In 2005, the US giant bought price comparison company Shopping.com, for $634 million.

Google Desktop Exploitability

(As I published on Shvoong): It was a matter of time before someone
realized that Google Desktop has provided an opening into a PC through
which a hacker can get an easy entry. Mattan Gillon, an Israeli hacker,
performed an act of public service by exposing the flaw on his blog.

Exploiting a bug in Microsoft Internet Explorer's processing Cascading
Style Sheets (CSS). The CSS format is commonly used to give a Web
site page a consistent look and navigation properties, and attackers can
target the process by which IE
parses CSS while running Google Desktop. Gillon explains how browsers
usually turn off domain crossing. A specific web
page can direct a browser to another domain, though it may not retrieve
the contents of the page nor run any of its objects. This restriction
feature serves to preclude a site owner using JavaScript from spying on
a user. Additionally, if a user is already logged
on to a web service such as Yahoo, Hotmail or Gmail, a malicious web
page could be used to run a malicious operation in the user account.
This operation can be an opening of an email and the subsequent sending
it to a third party. In IE, these security features are easily broken
when the browser encounters a CSS import.

Mattan Gillon called this attack CSSXSS, or Cascading Style Sheets Cross-Site
Scripting. Using the IE browser's weakness of being fooled by curly
brackets strategically placed in a decoy site's code, and getting hold
of Google Desktop's key found in the application code, a hacker can
easily gain an entry into the target PC already running the Google
Desktop service.For this IE weakness to be
exploited, web surfers must first be tricked into visiting a malicious
Web site. They can protect themselves, however, if they turn off Active
Scripting in the IE's Internet Options menu, Gillon says.