Signal, No Noise

January 21, 2010

Protecting against Wi-Fi, Bluetooth, RFID data attacks

Filed under: Cyberspace — mungurk @ 16:23

source
July 19, 2008 9:25 AM PDT by Elinor Mills

NEW YORK–Using a laptop, cell phone headset, building access badge, credit cards, or even a passport can make you a walking target for data thieves and other criminals, a security expert warned at the Last HOPE hacker conference here late Friday.

Security expert RenderMan discusses the insecurity of RFID chips, Bluetooth headsets and laptops using Wi-Fi at the Last HOPE hacker conference.

(Credit: Elinor Mills/CNET News)

In a frightening but entertaining session entitled “How do I Pwn Thee? Let me Count the Ways” (pwn is hacker speak for “own” or control), a hacker who goes by the alias “RenderMan” explained how most people are at risk and don’t even know it.

By now most people probably know they should be careful using Wi-Fi networks, especially public hotspots that don’t encrypt data transmissions and where network access points can be spoofed. These issues leave Web surfers at risk of having their data stolen, receiving fake Web pages and other information, and having their computers completely taken over, he said.

Even airplane passengers who either ignore stewardess requests to disable Wi-Fi or don’t know how to turn it off are not immune to attacks from others in the airplane, he added.

RenderMan suggests that people disable Wi-Fi when it is not in use and use VPNs and firewall software.

Bluetooth headset users are at risk because of a security hole in the technology and default PINs that don’t get changed, he said. Exploiting vulnerabilities someone can break in and steal data from the phones, make calls without the cell phone owner knowing, listen in on and break into conversations, and even spy on people by turning the device into a bug.

He advises that people change the default password, disable the Bluetooth on the phones, turn off the headsets when not in use, and limit access to the data and features when communicating with other Bluetooth devices.

Many people don’t realize that new U.S. passports have RFID technology with weak encryption that makes the data on the chip easy to read with the proper reader device. (See related video below).

The U.S. government attempted to mitigate the privacy threat by putting a metal foil layer on the front and back cover of the passports, but the stiffness of the foil pops the passport open as much as an inch, wide enough for RFID readers to snatch the data, RenderMan said, showing a video to demonstrate this.

“There is no rule that says that if the chip doesn’t work, they will refuse you access to the border. You will get increased scrutiny, but it’s still a valid document,” he said. “So, liberal application of a hammer can negate a lot of the possible” problems.

But doing willful damage to the passport is a crime, one attendee pointed out. “I fell, really hard,” RenderMan deadpanned.

RFID used in transit and building access badges has also been proven to be insecure, allowing someone to use an RFID reader to copy data off the card and make a clone of it, he said.

A security flaw in the Mifare Classic Chip used in transit systems is the subject of a court case in The Netherlands. The maker of the chip, NXP Semiconductors, sued to block a university from publishing details of the problems, but a court ruled on Friday that the research can be made public.

Even traditional keys are vulnerable, RenderMan said. For instance, photographs of spare keys for electronic-voting machines displayed on a Web page were used to make replicas with similar-looking keys, he said. A video demo showed how someone filed down a key from a hotel mini-bar and was able to open up the memory card slot of a Diebold voting system.

CSI Stick grabs data from cell phones

Filed under: Cyberspace — mungurk @ 16:20

source

August 29, 2008 1:54 PM PDT

This guest post is from Marc Weber Tobias, an attorney and physical security specialist.

If someone asks to borrow your cell phone, or you leave it unattended, beware!

Unless you actually watch them use it, they may be secretly grabbing every piece of your information on the device, even deleted messages. If you leave your phone sitting on your desk, or in the center console of your car while the valet parks it, then you and everyone in your contacts list may be at risk, to say nothing of confidential e-mails, spread sheets, or other information. And of course, if you do not want your spouse to see who you are chatting with on your phone, you might want to use extra caution.

Paraben’s CSI Stick can be used to make a copy of all data on a cell phone.

(Credit: Marc Weber Tobias)

There is a new electronic capture device that has been developed primarily for law enforcement, surveillance, and intelligence operations that is also available to the public. It is called the Cellular Seizure Investigation Stick, or CSI Stick as a clever acronym. It is manufactured by a company called Paraben, and is a self-contained module about the size of a BIC lighter. It plugs directly into most Motorola and Samsung cell phones to capture all data that they contain. More phones will be added to the list, including many from Nokia, RIM, LG and others, in the next generation, to be released shortly.

I recently attended and lectured at the Techno-Security conference in Myrtle Beach, Fla. About 1,500 law enforcement and security professionals participated and were briefed on the latest in cybersecurity vulnerabilities from participating federal agents, manufacturers, and cyber-consultants. The CSI Stick caught my attention because of the potential to rapidly and covertly download all of the information contained in many cell phones.

This device connects to the data/charging port and will seamlessly grab e-mails, instant messages, dialed numbers, phone books and anything else that is stored in memory. It will even retrieve deleted files that have not been overwritten. And there is no trace whatsoever that the information has been compromised, nor any risk of corruption. This may be especially troublesome for corporate employees and those that work for government agencies.

The good news: the device should find wide acceptance by parents who want to monitor what their kids are doing with their phones, who they are talking to and text messaging, and where they are surfing. It could also be valuable in secure areas where employees need to be randomly monitored to insure that sensitive information is not compromised through the use of a cell phone as a memory device.

The CSI Stick sells for $200 and requires an added piece of software to mine the data and do sophisticated processing on your computer. So now, in addition to worrying about your conversations or data being intercepted through your Bluetooth headset, there is a new threat, and it is very real.

The rule: if your phone contains sensitive data, do not leave it unattended. If you loan it to someone to use because they tell you theirs is not working, make sure you actually see them using the phone and there is nothing connected to it.

(Credit: Marc Weber Tobias)

January 19, 2010

Jeff Rubin: The Business of Climate Change

Filed under: Americas, Canada, Economy, North America, Physical — mungurk @ 00:03

January 18, 2010

Airport body scanners ‘unlikely’ to foil al-Qaeda

Filed under: Britain, Counterterrorism, Europe, Northern Europe, Terrorism — mungurk @ 22:12

source
Page last updated at 16:00 GMT, Monday, 4 January 2010

Airport body scanners would be “unlikely” to detect many of the explosive devices used by terrorist groups, a Tory MP has warned.

Ben Wallace, who used to work at defence firm QinetiQ, one of the companies making the technology, warned it was not a “big silver bullet”.

A computer screen showing the results of a full body scan

Electromagnetic waves are beamed onto passengers to create a 3-D image

Gordon Brown has said the scanners are to be introduced at UK airports.

A woman standing in a body scanner

People stand fully clothed in a scanner while their image is examined

A spokeswoman for QinetiQ said the technology “should be part of a layered approach to security”.

Mr Wallace said the scanners would probably not have detected the failed Detroit plane plot of Christmas Day.

He said the same of the 2006 airliner liquid bomb plot and of explosives used in the 2005 bombings of three Tube trains and a bus in London.

BAA, which runs six UK airports, said it is to install the machines “as soon as is practical” at Heathrow.

Mr Wallace – an ex Army officer – was employed by QinetiQ as their overseas director in the security and intelligence division before being elected to the Lancaster and Wyre seat in 2005.

He said the “passive millimetre wave scanners” – which QinetiQ helped develop – probably would not have detected key plots affecting passengers in the UK in recent years.

QinetiQ is one of a number of companies that manufacture this kind of security scanning equipment.

‘Layered’ approach

Mr Wallace told BBC Radio 4’s Today programme: “The advantage of the millimetre waves are that they can be used at longer range, they can be quicker and they are harmless to travellers.

“But there is a big but, and the but was in all the testing that we undertook, it was unlikely that it would have picked up the current explosive devices being used by al-Qaeda.”

He added: “It probably wouldn’t have picked up the very large plot with the liquids in 2006 at Heathrow or indeed the… bombs that were used on the Tube because it wasn’t very good and it wasn’t that easy to detect liquids and plastics unless they were very solid plastics.

“This is not necessarily the big silver bullet that is somehow being portrayed by Downing Street.”

A spokeswoman for QinetiQ said “no single technology can address every eventuality or security risk”.

“QinetiQ’s passive millimetre wave system, SPO, is a… people-screening system which can identify potential security threats concealed on the human body. It is not a checkpoint security system.

“SPO can effectively shortlist people who may need further investigation, either via other technology such as x-rays, or human intervention such as a pat-down search.”

Staff screening

Simon Davies, director of the human rights watchdog Privacy International, also expressed doubts that the scanners would make air travel more secure.

“These machines can’t tell you what the object is underneath or within the clothing,” he said.

“They can only detect the irregularity. The problem is the way modern clothing is designed, the fact that people take many objects of a non-metallic nature through airports means that the machines are of extremely limited value.”

He said emphasis was needed to continue with “ordinary and quite boring measures that actually do work” such as screening airport staff and conducting vehicle checks.

Aviation security analyst Chris Yates said better training of staff was needed alongside the introduction of new technology.

“I’ve seen some very awful examples of the pat down,” he said.

“If it’s done effectively, yes, you can do a proper examination of somebody and pretty much determine whether they are hiding something.

“But at the end of the shift, on a bad day at work, the security guards just wanting to get home, is he going to want to do that? That’s the big issue and I would prefer to see technology doing the electronic pat down, than a person doing it.”

Norman Shanks, former head of security for BAA, said body scanners can only be part of the solution and that passenger profiles are also vital.

“Profiling takes into account their behaviour patterns, their tickets, how they purchase them, how they’re acting and interacting with people and many times it’s believed this is a security person’s function.”

‘Pat down’

The US is also introducing tougher checks for air passengers from nations deemed to have links with terrorism.

BBC transport correspondent Tom Symonds said that, according to the Department for Transport, the new security measures introduced at UK airports on Monday were not causing serious disruption.

British Airways said it had no delays and the checks were largely being carried out at departure airports around the world in countries on a list published by the US Transportation Security Administration, our correspondent added.

These include Nigeria, Pakistan, Syria, Iran, Sudan and Yemen.

Mr Brown had said travellers to and from British airports would see the “gradual” introduction of the use of full body scanners and hand luggage checks for traces of explosives.

They will initially operate alongside metal detectors, and be used for all flights in and out of the country.

Scanner technology

On Sunday, Mr Brown accepted there was no way to be certain that the devices would be 100% effective, and “we have got to go further”.

The £80,000 full body scanners produce “naked” images of passengers.

They work by beaming electromagnetic waves on to passengers while they stand in a booth. A virtual three-dimensional image is then created from the reflected energy.

The machines are currently being trialled at Manchester airport following tests at Heathrow airport from 2004 to 2008.

They are also being rolled out across the US, with 40 machines used at 19 airports.

The latest decisions came after Nigerian Umar Farouk Abdulmutallab, now in custody, was accused of trying to detonate a bomb on a plane bound for the US on 25 December.

Kenya police shoot hate cleric al-Faisal supporters

Filed under: Africa, Counterterrorism, Eastern Africa, Kenya, Nigeria, Terrorism, West Africa — mungurk @ 11:07

source

Page last updated at 17:32 GMT, Friday, 15 January 2010

FAISAL’S STORY SO FAR…
Protester with portrait of Abdullah al-Faisal

At least five people have died after Kenyan police opened fire at supporters of a Jamaican-born Muslim cleric notorious for preaching racial hatred.

Police also fired tear gas at hundreds of stone-throwing protesters calling for Abdullah al-Faisal to be freed.

Faisal is in detention in Nairobi after Kenya failed to deport him.

Kenya wants to expel him citing his “terrorist history”. He was jailed for four years in the UK for soliciting the murder of Jews and Hindus.

An unnamed senior police officer told the AFP news agency that five people had died, while one of the protest organisers told AP that seven people had lost their lives.

Sources at the Kenyatta Hospital have confirmed that one person has died, while seven others sustained bullet wounds. Doctors say their lives are not in danger.

At least four police officers have been hospitalised, AFP reports.

Banner

Muslim youths began the protest match after Friday prayers at the Jamia Mosque in the centre of Kenya’s capital, Nairobi.

They wanted to present a petition to Immigration Minister Otieno Kajwang and Prime Minister Raila Odinga’s office.

But police had banned the march and intervened.

One banner read: “Release al-Faisal, he is innocent”, reports the AFP news agency.

Reuters news agency reports that some people joined the security forces in attacking the protesters.

Faisal was arrested on 31 December 2009, a week after he is believed to have arrived from Tanzania.

Mr Kajwang says The Gambia has agreed to take him in but Kenya was unable to send him there because airlines in Nigeria refused to carry him.

Tanzania has also refused to let him re-enter its territory.

Faisal was born Trevor William Forrest in St James, Jamaica – though he left the island 26 years ago, initially living in the UK.

His parents were Salvation Army officers and he was raised as a Christian.

But at the age of 16 he went to Saudi Arabia – where he is believed to have spent eight years – and became a Muslim.

He took a degree in Islamic Studies in the Saudi capital of Riyadh, before coming back to the UK.

Faisal spent years travelling the UK preaching racial hatred urging his audience to kill Jews, Hindus and Westerners.

A year after being deported from the UK in 2007, he was preaching in South Africa.

The Kenyan authorities said Faisal had arrived in Kenya on 24 December 2009 after travelling through Nigeria, Angola, Mozambique, Swaziland and Malawi and Tanzania.

Duck hunters spark nuclear weapons plant lockdown

Filed under: Americas, Military, North America, USA, WMD — mungurk @ 11:04

source
Page last updated at 18:52 GMT, Friday, 15 January 2010

A pair of duck hunters triggered a security alert at a nuclear weapons assembly plant in Amarillo, Texas.

Officials put the plant into lockdown after getting reports of individuals in camouflage gear stalking across the road from the factory.

They turned out to be two plant employees who had decided to spend their day off hunting fowl.

The plant was briefly shut as a “precautionary measure”, a plant official said.

“They were just doing what people do around here,” said Carson County Sheriff Tam Terry.

“They just had a lot more company than they were planning on.”

The pair, who sparked the alert when spotted early in the morning carrying arms and dressed in camouflage gear, were later found in a nearby field setting up goose decoys.

No charges will be filed against the men who both had permission to hunt from the local landowner.

US images show how Osama Bin Laden may look

Filed under: Counterterrorism, Terrorism — mungurk @ 11:02

source

Osama Bin Laden in a 1998 file photo (l) and an digitally-altered aged photo (r)

The digitally-altered photo (r) has been aged from the 1998 file image (l)

The US State Department has issued digitally-altered photos showing how Osama Bin Laden may look now, aged 52.

Its 1998 file image of the al-Qaeda leader has been adapted to take account of a decade’s worth of ageing, and possible changes to facial hair.

The digitally-altered photos on the State Department’s website show two options for how he may look now – one with a full beard, and one without.

Osama Bin Laden founded al-Qaeda and is top of the US most-wanted list.

He is accused of being behind a number of atrocities, including the 1998 bombing of two US embassies in East Africa and the attacks on New York and Washington on 11 September 2001.

Since then, his al-Qaeda network has been linked indirectly to bombings on the island of Bali in Indonesia and its capital Jakarta, as well as with suicide attacks in Casablanca, Riyadh and Istanbul.

After 9/11, al-Qaeda leaders are believed to have regrouped in Pakistan’s tribal areas.

Bin Laden is still thought to be hiding in the mountainous region near the border between Pakistan and Afghanistan.

Agencies ill-equipped for US-based terrorists

Filed under: Americas, Counterterrorism, North America, Terrorism, USA — mungurk @ 11:01

source

By Daniel Dombey in Washington

Published: January 15 2010 21:42 | Last updated: January 15 2010 21:42

US military and counter-intelligence establishments are ill-equipped to deal with domestic extremist threats, Robert Gates, US defence secretary, said on Friday in comments that highlighted American fears about home-grown terrorism.

He was speaking after the conclusion of an internal defence department review into the November shootings at the Fort Hood army base in Texas. Major Nidal Malik Hasan, an army psychiatrist, has been accused of killing 13 people.

“It is clear that as a department we have not done enough to adapt to the evolving domestic internal security threat to American troops and military facilities that has emerged over the past decade,” Mr Gates said at the Pentagon.

“In this area, as in so many others, this department is burdened by 20th-century processes and attitudes, mostly rooted in the cold war. Our counter­intelligence procedures are mostly designed to combat an external threat such as a foreign intelligence service.”

Concerns about US intelligence gathering have intensified since the Fort Hood killings, chiefly because of the failed Christmas day aircraft attack in Detroit and the murder of seven CIA operatives in Afghanistan by a Jordanian triple agent.

The Obama administration has declined to characterise the Fort Hood deaths as terrorism – in contrast with its description of the Detroit and Afghan episodes – in spite of criticism from US conservatives.

But concerns about extremism in the US have also been fanned by several other cases, including the detention of five Virginia-based students in Pakistan and the indictment of David Headley, a Chicago native, on charges of carrying out surveillance work for the 2008 Mumbai attacks.

“We are fortunate that we faced only one incident at one location,” said the report. “We cannot assume that this will remain the case in the future.” It added thatThe report said policies did not give commanders authority to intervene when personnel “make contact or establish relationships with persons or entities that promote self-radicalisation”.

Mr Gates said he was acting on the report’s call for Major Hasan’s supervisors to be held accountable for their failings.

In the aftermath of the shootings it has emerged that Major Hasan’s colleagues had been alarmed by his previous behaviour and that the authorities had intercepted e-mails in which he discussed killing US soldiers with Anwar al-Alaki, a radical cleric in Yemen. But no action was taken.

Canadian alleged to have role in Mumbai terror attacks

Filed under: Americas, Canada, North America, Terrorism — mungurk @ 10:49

source

Stewart Bell, National Post Published: Thursday, January 14, 2010

TORONTO — A Pakistani-Canadian businessman was indicted by a U.S. grand jury on Thursday for his alleged role in the 2008 terrorist attacks in Mumbai, India that killed more than 160 people.

Tahawwur Hussain Rana was charged with providing material support to both the Mumbai attacks and Lashkar-e-Tayyiba, the Pakistani terrorist group that was responsible.

Mr. Rana, 49, was already facing charges alleging he had participated in a plot to attack a Danish newspaper that published a cartoon of the Muslim prophet Muhammad with a bomb in his turban.

But on Thursday a grand jury returned a new indictment that, for the first time, also implicated him in the Mumbai massacre, a three-day terror rampage in India’s largest city. Two Canadians were among the dead.

The owner of First World Immigration, which has offices in Toronto, Chicago and New York, Mr. Rana was arrested last October in Illinois, where he had been working, although he owns a home in Ottawa.

The grand jury also indicted Ilyas Kashmiri, a Pakistani terrorist who was allegedly in regular contact with al-Qaeda, and Abdur Rehman Hashim Syed, a retired major in the Pakistani military.

A fourth defendant, David Coleman Headley, a Pakistani-born American who had trained at Lashkar camps in Pakistan, was indicted last month for his alleged roles in the Danish and Indian plots.

The indictment alleges that in 2006, after changing his name from Daood Gilani so he would appear more American, Mr. Headley began studying targets in Mumbai. Mr. Rana allegedly helped by giving him a cover story.

“In approximately June 2006, Headley allegedly traveled to Chicago, advised Rana of his assignment to scout potential targets in India, and obtained approval from Rana, who owned First World Immigration Services in Chicago and elsewhere, to open a First World office in Mumbai as cover for his activities,” the U.S. Department of Justice said in a statement.

“Rana allegedly directed an individual associated with First World to prepare documents supporting Headley’s cover story of opening a First World office in Mumbai, and advised Headley how to obtain a visa for travel to India.”

During the planning stages of the Mumbai attacks, Mr. Headley made five trips to the Indian city to take photographs and record videotapes of potential targets.

“Before each trip, Lashkar members and associates allegedly instructed Headley regarding specific locations where he was to conduct surveillance, and Headley traveled to Pakistan after each trip to meet with Lashkar members and associates, report on the results of his surveillance, and provide the surveillance photos and videos,” the statement says.

The indictment suggests that Lashkar conducted careful planning which included constructing a Styrofoam model of the Taj Mahal hotel. Lashkar also gave Mr. Headley a GPS device so he could record the locations of targets and sites where the terrorists could land the boat in which they were to travel from Pakistan.

During Headley’s July 2008 surveillance mission to Mumbai, one of the Pakistani terrorist planners allegedly communicated with him “by passing messages to him through Rana,” the indictment alleges.

The Mumbai attacks began on Nov. 26, 2008 and continuing until Nov. 28. Ten gunmen trained by Lashkar used rifles, grenades and explosives to attack the Taj Mahal and Oberoi hotels, the Leopold Café, Chabad House and the Chhatrapati Shivaji Terminus train station – all of which Headley allegedly had scouted in advance.

The indictment similarly accuses Mr. Rana of helping Mr. Headley scout targets in Denmark, where Pakistani terrorists were planning a second attack, this time against the Jyllands-Posten newspaper, its cartoonist and his editor.

“In late December 2008 and early January 2009, after reviewing with Rana how he had performed surveillance of the targets attacked in Mumbai, Headley advised Rana of the planned attack on the Danish newspaper and his intended travel to Denmark to conduct surveillance of its facilities,” the statement says.

It says Mr. Rana again helped Mr. Headley travel as a representative of First World, so he could gain access to the newspaper office by claiming he wanted to buy advertising.

Mr. Rana has pleaded not guilty to the charges related to the Danish plot. No date has been set for his arraignment on the new charges related to the Mumbai attacks.

National Post
sbell@nationalpost.com

Caribbean at risk of more large quakes like Haiti mega tremblor

Filed under: Americas, Caribbean America — mungurk @ 10:03

source

Monday 18th January, 2010

ANI     Monday 18th January, 2010

London, January 18 : Earthquake experts have warned that the devastating quake that struck Haiti on January 12 could be the first of several in the region, which means the region is at risk of more large tremblors.

According to a report in New Scientist, historical records suggest that not all the energy that has built up in the faults running through the Caribbean region was released in the Haiti quake.

Their fear is that enough energy remains in the fault system to trigger another earthquake of the same scale as the one on January 12.

The last time Haiti was struck by earthquakes of this scale was in 1751 and 1770, when three large earthquakes hit within the space of 20 years.

They ruptured the same fault segment as the one that slipped on Jan. 12, as well as segments lying further to the east, in Haiti and the neighbouring Dominican Republic.

“Last time round there was a sequence of earthquakes,” said Uri ten Brink, an expert on earthquakes in the region from the US Geological Survey in Woods Hole, Massachusetts.

“I’m worried, as we might expect the eastern side of the fault to rupture next,” according to other geologists.

“Stress transfer along the fault is likely to trigger a chain of quakes,” said Bill McGuire from University College London.

Another, larger earthquake could affect surrounding nations as well.

The fault that was responsible for the Haiti quake extends west through Jamaica. Another runs parallel to it in the north, along the southern edge of Cuba and the northern side of Haiti and the Dominican Republic.

Historical records suggest that both these faults produce large and destructive earthquakes every few centuries.

“They are dangerous especially when large population centres like Port-au-Prince, Kingston in Jamaica or Santiago in the Dominican Republic are so close to them,” said Paul Mann from the University of Texas at Austin.

The region harbours a third fault to the east, which is a further cause for concern.

Measurements over several decades show that the sum of all earthquakes that strike on “splinter faults” on the Caribbean plate have accounted for around half of the energy associated with this movement, leaving the other half stored up in the system.

McGuire and his colleagues are concerned that much of the stress may be accumulating on the undersea thrust fault to the east.

If that stress were to be released on the submarine fault, it could trigger a catastrophic tsunami of the scale of the 26 December 2004 Indian Ocean disaster.

Older Posts »

Powered by WordPress