China denies hacking high-tech weapon maker

When news of a hack against Japan's biggest weapons maker, Mitsubishi Heavy Industries, broke earlier this week an obvious question was - who might be responsible?
In all, more than 80 computers and servers at the firm - which manufactures everything from warships to space rockets - were infected by malware at a variety of sites. According to some local newspaper reports, a Chinese language script was found in one of the attacks which left computers at a submarine manufacturing plant and a missile manufacturing facility compromised.
The Guardian reports that the claims of Chinese involvement were firmly denied by a spokesman from China's foreign ministry:

"The Chinese government has consistently opposed hacking activities. The law strictly prohibits this. China is one of the main victims of hacking... criticising China as being the source of the hacking attacks is not only baseless, it is also not beneficial for promoting international co-operation for internet security."

Defence officials in Tokyo are reported to be fuming that they learnt about the attacks against Mitsubishi Heavy via local media reports more than a month after they took place, rather than directly from the firm itself.
Of course, as we all know, China is routinely blamed for cyberattacks and accused of using the internet to spy on other countries. Just as routinely, China denies its involvement.
Most famously, in January 2010 Google blamed China for an attack (dubbed "Operation Aurora") after discovering that someone in the country had tried to hack into the Gmail accounts of human rights activists.
In other incidents, accusations of China-backed hacking have come from a variety of directions including India, Belgium, the Dalai Lama, the British Secret Service, the US Defense Secretary and the Australian Prime Minister.
The truth is, however, that proving the origin of a hack attack is complicated by the fact that cybercriminals can use compromised PCs owned by innocent people to act as a go-between when trying to break into someone's computer. In other words - yes, a Chinese computer might have tried to connect to yours, but it may be under the control of someone in, say, Great Britain.
We'd be naive to think that the Chinese (and just about every other country around the world) isn't using the internet for its political, commercial and military advantage, but we should be very cautious about making assumptions without having all the proof in front of us.
So far there are no reports of classified information having been exposed by the hack attack at Mitsubishi Heavy Industries.

Hackers attack high-tech military contractor, break into submarine manufacturing plant

Mitsubishi Heavy Industries, Japan's biggest defense contractor, has revealed that it suffered a hacker attack in August that caused some of its networks to be infected by malware.
The firm - which is involved in a wide range of activities including space rockets, the production of jet fighters, shipbuilding, and running nuclear power plants - said that 45 network servers and 38 PCs became infected with malware at ten facilities across Japan.
The infected sites included its submarine manufacturing plant in Kobe and the Nagoya Guidance & Propulsion System Works, which makes engine parts for missiles.
The Japanese newspaper Yomiuri claimed that at least eight different pieces of malware, including some which stole data, were discovered at Mitsubishi sites.
A Mitsubishi spokesperson, however, was quoted as saying that "there is no possibility of any leakage of defense-related information at this point."
The company first noticed the attack on August 11th, and expects to have the results of an investigation into the security breach by the end of September.
If Mitsubishi Heavy Industries was targeted by hackers, the obvious question to ask is who was behind the attack and what was the motive?
Earlier this year we saw a series of cyber attacks against US military contractors, including Lockheed Martin, L-3 Communications and Northrop Grumman, and US Deputy Defense Secretary William Lynn publicly claimed that a foreign intelligence agency was behind a hack attack that stole classified information about a top secret weapons system.
Whoever it was who attacked Mitsubishi Heavy Industries, and whatever their motive, it's clear that all organisations need to take computer security seriously.
Cybercriminals, whether state-sponsored or not, are interested in stealing sensitive information which could have more than a financial value. You would be foolish to ignore such a threat, and must ensure that your organisation has strong defences in place to reduce the risks.

QR code security risks in the car park

QR codes are a highly convenient way to link a physical object to a URL. Point your phone's camera at the 2D barcode and you're instantly taken to a website.

That's something which can have security consequences, as mobile guru Terence Eden explains.

Recently, Islington Council in London has partnered with Verrus to bring mobile phone payments to car parking.

It's a really simple way to improve paying for parking - but it does leave open some fairly serious security risks.

Initial impressions

The QR codes being used by Islington Council are fairly clearly displayed on the side of the parking meters - but there is no printed call to action.

Which raises the question - what does scanning the code do?

From a practical point of view, would anyone scanning the code know that it allowed them to pay with their phone?

From a security point of view, does the QR code belong to the parking company? Could someone malicious have stuck this code onto the machine?

Unfortunately, there is a problem with the QR code that rang instant alarm bells in my mind.

I spotted instantly that it isn't using an HTTPS URL:

http://m.paybyphone.co.uk/?
utm_source=islington&
utm_medium=qrcode&
utm_campaign=mweb

For a site which asks for a password - and later for credit card details - that seems like a worrying oversight, and isn't going to instill confidence.

In fairness, the site does automatically redirect to the SSL version - but why leave that out of the QR code?

After scanning the code with their mobile phone, this is what the first time user sees:

One thing to note is that most mobile phones won't display the full URL, unless they are in landscape mode.

The URL on display could easily be:

https://m.paybyphone.evilsite.xxx/

Registering

If you've never used the system before, you need to register on this screen:

It is, in my opinion, a very poor idea to require someone to type their credit card number into a phone.

• What if there's a gang of vicious hoodies waiting to snatch credit cards from unsuspecting users as they get them out on the street?
• Is this really a legitimate site? There is no way of knowing, and the switch in branding between "paybyphone" or "PayByPhone" just makes things more confusing and suspicious.

Attack Vectors

The main way of attacking a QR code is to change it. In this case, all it would take would be a large sticker placed on the car parking notice to successfully redirect the user.

In the most mundane case, an attacker could ask the user to visit a malicious website which collects their login details - or worse, their credit card number.

However, a QR code can also be used to point to a premium rate phone number or premium rate SMS. Both could look "legitimate" when placed near a parking meter. A simple and effective way to deprive a victim of their money.

Solutions

QR code hijacking is very rare - but here are a few practical tips for securing a QR code payment service.

1. Include signage telling the user what the code does. Otherwise the user has no way of knowing if the code should point to a URL, phone number, or SMS.
2. Print the URL near to the code. This way if the code is hijacked and pointed to http://evilsite.xxx/ the user can see they're not visiting the correct site.
3. Include https in the URL. Get users used to checking for https before they interact with you.
4. If possible, use a short domain. Not only will it reduce the size of the QR code, it will give your users confidence if they can see the full domain in their phone's URL bar.
5. Don't ask a user to get their credit card out on a busy street. Use a mobile payment solution which charges to the user's phone bill or deducts it from their credit.

QR codes provide a brand new way for people to interact with your service. Make sure that what you offer them is simple, satisfying, and secure.

Disclaimer: The author currently works for InMobi who have a mobile payments product called SmartPay. There are several other cross-network payment solutions, including Bokuor Google Checkout.

Hackers steal credit card details at Wisconsin and Tennessee Wilderness resorts

Bad news if you have been on vacation at one of the Wilderness resorts in Tennessee and Wisconsin in the last couple of years - hackers may now have your credit card details.

VacationLand Vendors Inc, a firm which provides arcade and vending machines to businesses, has revealed that a hacker broke into its credit card processing systems and stolen up to 40,000 credit card details.

The credit cards were used in arcades at the Wilderness Hotel & Golf Resort in Wisconsin, and the Wilderness at the Smokies Waterpark Resort in Tennessee.

Precise details of how the data breach occurred have not been made public, but the company has published a warning on its website, and advised customers to keep their eyes peeled for unusual transactions on their credit cards.

Vacationland Vendors says that it "deeply regrets" the security breach and shut down its systems at the affected arcades as soon as it discovered the problem on March 25, 2011 - but that patrons may be impacted as far back as December 12, 2008.

The FTC has produced a website all about how consumers can protect themselves against identity theft.

WikiLeaks exposes thousands of sources in written-password SNAFU

The cone of silence over WikiLeaks' thousands of sources - many of whose lives are at risk if identified - has been shattered, all thanks to the most mundane, all-too-human security screwup imaginable.
To wit: WikiLeaks founder Julian Assange wrote down the password on a piece of paper, and then forgot to change it later.
The security breach has thrown open the doors to WikiLeaks' entire archive of 251,000 secret U.S. diplomatic cables.
To the horror of the media partners it has worked with in the past to carefully redact the documents - The Guardian, The New York Times, El Pais, Der Spiegel and Le Monde - WikiLeaks has published its entire archive, unredacted, putting in danger several thousands of people whom the U.S. has tagged as being at risk if exposed. The documents also cite more than 150 whistleblowers.
"We deplore the decision of WikiLeaks to publish the unredacted state department cables, which may put sources at risk," the organizations said in a joint statement.
"Our previous dealings with WikiLeaks were on the clear basis that we would only publish cables which had been subjected to a thorough joint editing and clearance process. We will continue to defend our previous collaborative publishing endeavour. We cannot defend the needless publication of the complete data – indeed, we are united in condemning it."
The media partners made it clear that this time, with this move, Assange got no help from them. "The decision to publish by Julian Assange was his, and his alone," they said in the statement.
Der Spiegel has chronicled the archive’s publishing, tracing it back to a meeting between Assange and David Leigh of The Guardian.
According to the account, as the British journalist recounts in his book "Inside Julian Assange's War on Secrecy", Leigh and Assange at one point sat down to discuss how Assange would provide Leigh with a file including all of the diplomatic dispatches received by WikiLeaks.
According to Der Spiegel, Assange placed the file on a server and wrote part of the password on a slip of paper. To make it work, one had to complete the list of characters with a certain word.
Can you remember it? Assange asked. Of course, Leigh said.
"At the time, Daniel Domscheit-Berg, who later founded the site OpenLeaks, was the German spokesman for WikiLeaks. When he and others undertook repairs on the WikiLeaks server, he took a dataset off the server which contained all manner of files and information that had been provided to WikiLeaks. What he apparently didn't know at the time, however, was that the dataset included the complete collection of diplomatic dispatches hidden in a difficult-to-find sub-folder," according to Der Spiegel.
With the dataset in the hands of Domscheit-Berg, Leigh went on to describe his meeting with Assange in his book. In the book, however, he included not only the portion of the password on the slip of paper, but also the part he had been asked to commit to memory.
What followed included feuding between Domscheit-Berg and Assange, attempts to prove that Assange wasn’t trustworthy, and the eventual disclosure that not only was the entire dataset circulating, but that the password could be found in Leigh's book.
At this point, fingerpointing is rampant. WikiLeaks' Twitter feed blames The Guardian. The Guardian is protesting its innocence, putting out a statement claiming that it had been told the password was only temporary.

@wikileaks
WikiLeaks

It is strictly false that the Guardian was told the password or file were temporary, hence the elaborate password handover method.

September 1, 2011 11:06 pm via webReplyRetweetFavorite

The U.S. Embassy in London and the U.S. State Department were notified of the possible publication on August 25 to enable officials to warn the named informants. Hopefully, this has given them enough time to remove themselves from harm.
Whether that is possible for all the sources who’ve been put in harm's way is an open question.
But one thing is certain: The platforms to which whistleblowers have hitherto brought their leaks are compromised. They are as riddled with security holes, as flailing with common human weaknesses, as the most ridiculed home user running an unsecured wireless network and the most inept office worker writing down his password on a Post-It note.
Let us hope that this carelessness, this breathtaking lapse in security hygiene, leads to no loss of life.