Security vendor FireEye has uncovered a series of attacks against targets in Europe and the US that occurred between 29 April and 27 May. FireEye says a group of Middle East-based hackers called the Molerats are responsible for the attacks, launched via remote-access tool exploits known as Poison Ivy. The group, which also engages in phishing attacks, is become more active, according to researchers, who traced Molerats attacks to campaigns launched against the BBC, an unnamed US financial institution, and government organizations in Israel, Latvia, Macedonia, New Zealand, Slovenia, Turkey, the UK, and the US. Although the attackers typically use free, commonly available malware, FireEye says the group appears to be adapting its attacks to be increasingly difficult to detect. (SlashDot)(eWeek)(FireEye)
Saturday, June 28, 2014
Saturday, March 15, 2014
Gaming Site Offers Reward for Conviction in DDos Attack
An online gaming site operator is offering a reward of €10,000 (roughly US$13,000) for information leading to the conviction of the people responsible for the site being taken down by a distributed denial-of-service attack. The massively multiplayer online role-playing game provider Wurm had its servers taken offline earlier this week as a result of the attack and was forced to move to a new Web hosting provider. Company officials said “We can offer 10,000 Euro for any tips or evidence leading to a conviction of the person responsible for this attack.” The attack is the latest in a series of large DDoS attacks, many of which are using the Network Time Protocol, used properly to sync a computer’s clock, to magnify the attack. Barry Shteiman, with the data security company Imperva, told the BBC attacks on online gaming have changed significantly in the past year. “If we take a look at last year's gaming attacks, we can definitely see that there was a focus on account hijacking rather than service disruption. This is therefore a new trend that should be watched out for.” Meanwhile, Wurm says it plans to compensate its players for any lost time. Its servers are being reconfigured, but, as of 20 February 2014, does not have a specific time that the site can be returned to full operations. (Ars Technica)(BBC)(Wurm Online -- 1)(Wurm Online -- 2)
Sunday, March 2, 2014
Massive Denial-of-Service Attack Hits CloudFlare
CloudFlare, a US-based provider of distributed denial-of-service attack-protection services, itself became the target of the world’s largest DoS attack. Hackers struck the company following an attack on one of its customers. CloudFlare CEO Matthew Prince said the traffic generated by the attack on CloudFlare was 400 Gbits per second, the largest ever recorded. It also affected other European and US websites and users. The Network Time Protocol reflection attack took advantage of a technology designed to synchronize time settings on computers communicating over the Internet. It used fraudulent synchronization requests that ultimately flooded CloudFlare’s site. (SlashDot)(Ars Technica)(IT News)(Matthew Prince @ Twitter)(CloudFlare)
Please sign in to flag this as inappropriate.
Friday, July 26, 2013
Opera Says Network Attack Lets Hackers Certify Malware
Browser maker Opera Software says an attack on its internal network took advantage of its update service and led to the theft of at least one old and expired code-signing certificate that hackers used to sign malware, making it look legitimate to victims and thus safe to use. This has allowed them to distribute malicious software that incorrectly appears to have been published by Opera Software or appears to be the Opera browser, Opera stated. The company released no other details. Because of the scheme, any Windows user who downloaded the malware thinking it was the Opera browser and tried to install the browser on 19 June 2013 may have installed the malicious software instead. This is an example of how hackers are increasingly focusing attacks on software firms’ internal networks -- which allows them to have the ability sign files and to escalate their own privileges in order to move more freely within the network -- rather than individual users, according to security experts. (SlashDot)(Security Week)(The Opera Security Group)
Friday, September 21, 2012
Thwarting the cleverest attackers: Even most secure-seeming computer is shockingly vulnerable to attack
In the last 10 years, cryptography researchers have demonstrated that even the most secure-seeming computer is shockingly vulnerable to attack. The time it takes a computer to store data in memory, fluctuations in its power consumption and even the noises it emits can betray information to a savvy assailant.
Attacks that use such indirect sources of information are called side-channel attacks, and the increasing popularity of cloud computing makes them an even greater threat. An attacker would have to be pretty motivated to install a device in your wall to measure your computer's power consumption. But it's comparatively easy to load a bit of code on a server in the cloud and eavesdrop on other applications it's running.
Fortunately, even as they've been researching side-channel attacks, cryptographers have also been investigating ways of stopping them. Shafi Goldwasser, the RSA Professor of Electrical Engineering and Computer Science at MIT, and her former student Guy Rothblum, who's now a researcher at Microsoft Research, recently posted a long report
on the website of the Electronic Colloquium on Computational Complexity, describing a general approach to mitigating side-channel attacks. At the Association for Computing Machinery's Symposium on Theory of Computing (STOC) in May, Goldwasser and colleagues will present a paper demonstrating how the technique she developed with Rothblum can be adapted to protect information processed on web servers.
In addition to preventing attacks on private information, Goldwasser says, the technique could also protect devices that use proprietary algorithms so that they can't be reverse-engineered by pirates or market competitors -- an application that she, Rothblum and others described at last year's AsiaCrypt conference.
Today, when a personal computer is in use, it's usually running multiple programs -- say, a word processor, a browser, a PDF viewer, maybe an email program or a spreadsheet program. All the programs are storing data in memory, but the laptop's operating system won't let any program look at the data stored by any other. The operating systems running on servers in the cloud are no different, but a malicious program could launch a side-channel attack simply by sending its own data to memory over and over again. From the time the data storage and retrieval takes, it can infer what the other programs are doing with remarkable accuracy.
Goldwasser and Rothblum's technique obscures the computational details of a program, whether it's running on a laptop or a server. Their system converts a given computation into a sequence of smaller computational modules. Data fed into the first module is encrypted, and at no point during the module's execution is it decrypted. The still-encrypted output of the first module is fed into the second module, which encrypts it in yet a different way, and so on.
The encryption schemes and the modules are devised so that the output of the final module is exactly the output of the original computation. But the operations performed by the individual modules are entirely different. A side-channel attacker could extract information about how the data in any given module is encrypted, but that won't let him deduce what the sequence of modules do as a whole. "The adversary can take measurements of each module," Goldwasser says, "but they can't learn anything more than they could from a black box."
The report by Goldwasser and Rothblum describes a type of compiler, a program that takes code written in a form intelligible to humans and converts it into the low-level instruction intelligible to a computer. There, the computational modules are an abstraction: The instruction that inaugurates a new module looks no different from the instruction that concluded the last one. But in the STOC paper, the modules are executed on different servers on a network.
According to Nigel Smart, a professor of cryptology in the computer science department at the University of Bristol in England, the danger of side-channel attacks "has been known since the late '90s."
"There's a lot of engineering that was done to try to prevent this from being a problem," Smart says, "a huge amount of engineering work. This is a megabucks industry." Much of that work, however, has relied on trial and error, Smart says. Goldwasser and Rothblum's study, on the other hand, "is a much more foundational study, looking at really foundational, deep questions about what is possible."
Moreover, Smart says, previous work on side-channel attacks tended to focus on the threat posed to handheld devices, such as cellphones and smart cards. "It would seem to me that the stuff that is more likely to take off in the long run is the stuff that's talking about servers," Smart says. "I don't know anyone else outside MIT who's looking at that."
Smart cautions, however, that the work of Goldwasser and her colleagues is unlikely to yield practical applications in the near future. "In security, and especially cryptography, it takes a long time to go from an academic idea to something that's actually used in the real world," Smart says. "They're looking at what could be possible in 10, 20 years' time."
Share this story on Facebook, Twitter, and Google:Other social bookmarking and sharing tools:
Story Source:
The above story is reprinted from materials provided by Massachusetts Institute of Technology.
Note: Materials may be edited for content and length. For further information, please contact the source cited above.
Note: If no author is given, the source is cited instead.
Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.
Monday, May 28, 2012
Thwarting the cleverest attackers: Even most secure-seeming computer is shockingly vulnerable to attack
In the last 10 years, cryptography researchers have demonstrated that even the most secure-seeming computer is shockingly vulnerable to attack. The time it takes a computer to store data in memory, fluctuations in its power consumption and even the noises it emits can betray information to a savvy assailant.
Attacks that use such indirect sources of information are called side-channel attacks, and the increasing popularity of cloud computing makes them an even greater threat. An attacker would have to be pretty motivated to install a device in your wall to measure your computer's power consumption. But it's comparatively easy to load a bit of code on a server in the cloud and eavesdrop on other applications it's running.
Fortunately, even as they've been researching side-channel attacks, cryptographers have also been investigating ways of stopping them. Shafi Goldwasser, the RSA Professor of Electrical Engineering and Computer Science at MIT, and her former student Guy Rothblum, who's now a researcher at Microsoft Research, recently posted a long report
on the website of the Electronic Colloquium on Computational Complexity, describing a general approach to mitigating side-channel attacks. At the Association for Computing Machinery's Symposium on Theory of Computing (STOC) in May, Goldwasser and colleagues will present a paper demonstrating how the technique she developed with Rothblum can be adapted to protect information processed on web servers.
In addition to preventing attacks on private information, Goldwasser says, the technique could also protect devices that use proprietary algorithms so that they can't be reverse-engineered by pirates or market competitors -- an application that she, Rothblum and others described at last year's AsiaCrypt conference.
Today, when a personal computer is in use, it's usually running multiple programs -- say, a word processor, a browser, a PDF viewer, maybe an email program or a spreadsheet program. All the programs are storing data in memory, but the laptop's operating system won't let any program look at the data stored by any other. The operating systems running on servers in the cloud are no different, but a malicious program could launch a side-channel attack simply by sending its own data to memory over and over again. From the time the data storage and retrieval takes, it can infer what the other programs are doing with remarkable accuracy.
Goldwasser and Rothblum's technique obscures the computational details of a program, whether it's running on a laptop or a server. Their system converts a given computation into a sequence of smaller computational modules. Data fed into the first module is encrypted, and at no point during the module's execution is it decrypted. The still-encrypted output of the first module is fed into the second module, which encrypts it in yet a different way, and so on.
The encryption schemes and the modules are devised so that the output of the final module is exactly the output of the original computation. But the operations performed by the individual modules are entirely different. A side-channel attacker could extract information about how the data in any given module is encrypted, but that won't let him deduce what the sequence of modules do as a whole. "The adversary can take measurements of each module," Goldwasser says, "but they can't learn anything more than they could from a black box."
The report by Goldwasser and Rothblum describes a type of compiler, a program that takes code written in a form intelligible to humans and converts it into the low-level instruction intelligible to a computer. There, the computational modules are an abstraction: The instruction that inaugurates a new module looks no different from the instruction that concluded the last one. But in the STOC paper, the modules are executed on different servers on a network.
According to Nigel Smart, a professor of cryptology in the computer science department at the University of Bristol in England, the danger of side-channel attacks "has been known since the late '90s."
"There's a lot of engineering that was done to try to prevent this from being a problem," Smart says, "a huge amount of engineering work. This is a megabucks industry." Much of that work, however, has relied on trial and error, Smart says. Goldwasser and Rothblum's study, on the other hand, "is a much more foundational study, looking at really foundational, deep questions about what is possible."
Moreover, Smart says, previous work on side-channel attacks tended to focus on the threat posed to handheld devices, such as cellphones and smart cards. "It would seem to me that the stuff that is more likely to take off in the long run is the stuff that's talking about servers," Smart says. "I don't know anyone else outside MIT who's looking at that."
Smart cautions, however, that the work of Goldwasser and her colleagues is unlikely to yield practical applications in the near future. "In security, and especially cryptography, it takes a long time to go from an academic idea to something that's actually used in the real world," Smart says. "They're looking at what could be possible in 10, 20 years' time."
Share this story on Facebook, Twitter, and Google:Other social bookmarking and sharing tools:
Story Source:
The above story is reprinted from materials provided by Massachusetts Institute of Technology.
Note: Materials may be edited for content and length. For further information, please contact the source cited above.
Note: If no author is given, the source is cited instead.
Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.