Category: Stories/News

Dec 05 2014

UK Spy Agency Hacked Reliance Cables

Snowden Documents Reliance HackBritish intelligence hacked into two major undersea cables owned by Reliance Communications compromising millions of users, including those from the Indian government, reveal the latest scan of documents leaked by Edward Snowden, the US National Security Agency (NSA) contractor-turned-whistleblower. This security breach took place sometime between 2009 and 2011.

A private company, bought by telecom major Vodafone in 2012, helped the British intelligence agency General Communications Headquarters (GCHQ) in hacking the Reliance cables and 27 others that converged in the UK, reveal the documents.

These revelations were made in the last week of November by UK’s Channel 4 and German newspaper Süddeutsche Zeitung that jointly investigated the Snowden cache.

The Reliance cables carry internet and data traffic between Asia and Europe, and Europe to the American continent. Indian users compromised by this breach include those who don’t necessarily use a Reliance connection as the cables carry data from a multitude of internet service providers in multiple countries.

The website of Reliance Globacom, part of Anil Ambani’s Reliance Telecom group, describes itself as being one of the world’s “largest private undersea cable system spanning 67,000 km route.”

Renamed Global Cloud Xchange (GCX) in March, it owns two key undersea cables — FLAG, which connects Europe to Asia, and FLAG Atlantic 1 (FA1), which connects the American continent with Europe. Both cables meet at a junction in southwest UK and are connected by the local area network operated by Vodafone subsidiary Cable & Wireless.

The FLAG Europe-Asia undersea cable has landing stations in Egypt, the Arabian peninsula, India, Malaysia, Thailand, Hong Kong, mainland China, Taiwan and Japan. It was a key target, the documents show, since it carries data from countries that the US and UK are most interested in, like Middle East countries, India and also China.

The documents showed that the GCHQ had a secret financial arrangement with Cable & Wireless to use its facility in Skewjack Farm in southwest England to hack into the 29 undersea cables. This was part of a major operation codenamed “PFENNING ALPHA”, a computer exploitation network run jointly by the US’s NSA, and GCHQ. In separate documents, this operation has also been identified as the NSA’s “fourth-largest” information collection exercise from the global Internet.

In August 2013, Süddeutsche Zeitung accessed the Snowden papers to reveal the code names given by British intelligence to private telecom companies that cooperated with GCHQ for tapping internet communications. Cable & Wireless was identified by the codename ‘GERONTIC’ while British Telecom (BT) is referred to as ‘REMEDY’. Both companies were part of an elaborate spying programme code-named ‘TEMPORA’.

The documents also reveal how GCHQ used a secret software known as ‘XKeyscore’ to pull out data to analyse the data it was intercepting. The filtering of the Internet was carried out using technology developed by a Boeing subsidiary company, Narus. It would pull out packets of information that included phone numbers, emails, and IP addresses in real time.

Reliance Communications declined to reply to HT’s queries.

Ben Padovan, the official spokesperson of Vodafone in the UK, said in a statement: “Cable & Wireless was not owned, operated or controlled by Vodafone until 2012. We examined the past history of Cable & Wireless compliance prior to its acquisition by Vodafone and found no evidence that would substantiate these allegations…

The statement ends saying that Vodafone is legally bound not to disclose “any information regarding warrants received and the processes and systems in place to respond to such warrants” and the penalty for doing so is five years in prison.

Dec 04 2014

Hacking PayPal Accounts With One Click

PayPal CSRF HackYasser H. Ali, an Egyptian security researcher, has discovered three critical vulnerabilities in PayPal website which could be used to take control of customer accounts.

Yasser explained in his post the three vulnerabilities used to breach into accounts:

1] Reusable CSRF Token :
The CSRF token “that authenticate every single request made by the user” which can be also found in the request body of every request with the parameter name “Auth” get changed with every request made by user for security measures, but after a deep investigation I found out that the CSRF Auth is Reusable for that specific user email address or username, this means If an attacker found any of these CSRF Tokens, He can then make actions in the behave of any logged in user.

2] Bypassing the CSRF Auth System :
an Attacker can obtain the CSRF Auth which can be valid for ALL users, by intercepting the POST request from a page that provide an Auth Token before the Logging-in process, check this page for the magical CSRF Auth “https://www.paypal.com/eg/cgi-bin/webscr?cmd=_send-money”. At this point the attacker Can CSRF “almost” any request on behave of this user.

3] ByPassing the Security Questions Change :
the request of setting up the security questions “which is initiated by the user while signing up” is not password-protected, and it can be reused to reset the security questions up without providing the password, hence, Armed with the CSRF Auth, an attacker can CSRF this process too and change the victim’s Security questions.

At this point, An attacker can conduct a targeted CSRF attack against a PayPal users and take a full control over his account Hence, An attacker can CSRF all the requests including but not limited to:

― Add/Remove/Confirm Email address
― Add fully privileged users to business account
― Change Security questions
― Change Billing/Shipping Address
― Change Payment methods
― Change user settings (Notifications/Mobile settings)…. and more.

Here is the Proof Of Concept Video:

The vulnerability is patched very fast and PayPal paid me the maximum bounty they give ($ 10,000 USD) ;) ” – Yasser Ali

Original Story: Yasser Ali’s Blog >> Hacking PayPal Accounts with one click

Dec 01 2014

WhatsApp – Message Handler Vulnerability Allows to Remotely Crash

WhatsApp Remote CrashA Vulnerability has been discovered in the wildly popular messaging app WhatsApp, which allows anyone to remotely crash WhatsApp just by sending a specially crafted message, two security researchers reported.

Two India based independent security researchers, Indrajeet Bhuyan and Saurav Kar, both 17-year old demonstrated the WhatsApp Message Handler vulnerability.

In a video demonstration, they showed that by sending a 2000 words (2kb) message in special character set can crash the receiver’s app. The worried impact of the vulnerability is that the user who received the specially crafted message will have to delete his/her whole conversation and start a fresh chat, because opening the message keeps on crashing WhatsApp unless the chat is deleted completely.

What makes it more serious is that one needs to delete entire chat with the person they are chatting to in order to get back whatsapp work in normal“, Bhuyan told.

According to the duo, the reported vulnerability has been tested and successfully works on most of the versions of Android Operating system including Jellybean, Kitkat, and all the below android versions.

Similarly, Any member of your WhatsApp group could intentionally send a specially crafted message to exit people from the group and delete the group. Also, for example, if I don’t want someone to keep records of my chat with them, then I can also send the same message exploit to the person.

The vulnerability has not been tested on iOS, but it is sure that all versions of WhatsApp including 2.11.431 and 2.11.432 are affected with this bug. Also the attack does not work on Windows 8.1.

Proof-of-Concept (PoC) Video

WhatsApp, bought by Facebook for $19 billion in February this year, has 600 Million users as of October 2014, and according to the researchers, an estimated number of users affected by the vulnerability could be 500 Million.

WhatsApp was in news recently for making end-to-end encryption on all text messages as a default feature in an effort to boost the online privacy and security of its users around the world. The app maker describe this move as the “largest deployment of end-to-end encryption ever.”

Nov 26 2014

Now E-Cigarette Can Give You Malware

E-cigarette MalwareE-cigarettes may be better for your health than normal ones, but spare a thought for your poor computer – electronic cigarettes have become the latest vector for malicious software, according to online reports.

Many e-cigarettes can be charged over USB, either with a special cable, or by plugging the cigarette itself directly into a USB port. That might be a USB port plugged into a wall socket or the port on a computer – but, if so, that means that a cheap e-cigarette from an untrustworthy supplier gains physical access to a device.

A report on social news site Reddit suggests that at least one “vaper” has suffered the downside of trusting their cigarette manufacturer. “One particular executive had a malware infection on his computer from which the source could not be determined,” the user writes. “After all traditional means of infection were covered, IT started looking into other possibilities.

“The made in China e-cigarette had malware hardcoded into the charger, and when plugged into a computer’s USB port the malware phoned home and infected the system.”

Any electrical device that uses a USB charger could be targeted in this way, and just about every one of these electrical devices will come from China.

In early November, figures obtained by the Press Association revealed that e-cigarettes and related equipment, such as chargers, were involved in more than 100 fires in less than two years.

Original Story: The boss has malware, again…

Nov 25 2014

CryptoPHP – Backdoor in Thousands of CMS Plugins and Themes Used to Hijack Web Servers

CryptoPHP BackdoorSecurity researchers have discovered thousands of backdoored plugins and themes for the popular content management systems (CMS) that could be used by attackers to compromise web servers on a large scale.

The Netherlands based security firm Fox IT has published a whitepaper revealing a new Backdoor named “CryptoPHP”. Security researchers have uncovered malicious plugins and themes for WordPress, Joomla and Drupal. However, there is a slight relief for Drupal users, as only themes are found to be infected from CryptoPHP backdoor.

In order to victimize site administrators, miscreants makes use of a simple social engineering trick. They often lured site admins to download pirated versions of commercial CMS plugins and themes for free. Once downloaded, the malicious theme or plugin included backdoor installed on the admins’ server.

By publishing pirated themes and plug-ins free for anyone to use instead of having to pay for them, the CryptoPHP actor is social-engineering site administrators into installing the included backdoor on their server“, Fox IT said in its analysis on the attack.

Once installed on a web server, the backdoor can be controlled by cyber criminals using various options such as command and control server (C&C) communication, email communication and manual control as well.

Other capabilities of the CryptoPHP backdoor include:

  • Integration into popular content management systems like WordPress, Drupal and Joomla
  • Public key encryption for communication between the compromised server and the command and control (C2) server
  • An extensive infrastructure in terms of C2 domains and IP’s
  • Backup mechanisms in place against C2 domain takedowns in the form of email communication
  • Manual control of the backdoor besides the C2 communication
  • Remote updating of the list of C2 servers
  • Ability to update itself

Miscreants are using CryptoPHP backdoor on compromised Web sites and Web servers for illegal Search Engine Optimization (SEO), which is also known as Black Hat SEO, researchers said in its report. It is because the compromised websites link to the websites of the attackers appear higher in search engine results.

Black Hat SEO is a group of techniques and tactics that focus on maximizing search engine results with non-human interaction with the pages, thus violating search engine guidelines. These include keyword stuffing, invisible text, doorway pages, adding unrelated keywords to the page content or page swapping.

The security company has discovered 16 variants of CryptoPHP Backdoor on thousands of of backdoored plugins and themes as of 12th November 2014. First version of the backdoor was appeared on the 25th of September 2013. The exact number of websites affected by the backdoor is undetermined, but the company estimates that at least a few thousand websites or possibly more are compromised.