Web Security

By B.K. DeLongWith alleged Anonymous leadership such as Sabu and opponents such as th3j35t3r tweeting about their supposed shenanigans in Las Vegas, the question on everyone’s mind this week is whether Anonymous is truly walking the halls of this week’s Black Hat and DEFCON hacker conferences.  Some believe the answer to that question is almost certainly ‘yes’ but not for the reasons you might think – here’s my opinion based on several discussions I’ve had throughout the week.

HED: Three Ways that Google’s Chrome OS Could Enable Really Nasty Web Based AttacksDEK: Researchers at the Black Hat Briefings conference in Las Vegas warn that Google’s new Chrome Operating System could enable certain kinds of Web based attacksGoogle’s new Chrome Operating System was designed to fix the nagging security problems that have plagued platforms like Microsoft Windows. But new research unveiled at the Black Hat Briefings in Las Vegas suggests that the new cloud-centric OS, while far more secure, may also introduce some troubling security issues, too. In their talk, Web security researchers Matt Johansen and Kyle Osborn, both of Whitehat Security, said that a thorough audit of Google’s Chrome OS turned up numerous security issues, most of which are not specific to Chrome, but which could still be used to push malicious programs to devices running Chrome, hijack Google- or other online accounts of Chrome users and steal sensitive information. The researchers spoke Wednesday in a BlackHat session dubbed “Hacking Google Chrome OS,” which presented the results of a WhiteHat audit that was authorized by Google, itself. The two gave the Web based OS high marks on many traditional measures of security, noting that Chrome OS eliminates many traditional targets of malware and attacks: Chrome OS devices don’t use internal hard drives, eliminating the possibility of persistent malware infections and data theft. “We’re not looking for the ‘usual suspects’ like buffer overflows or vulnerabilities in (Adobe) Flash or (Microsoft) Office,” Johansen told the audience. Instead, the researchers said they focused their attention on some of the core APIs (application program interfaces) that undergird Chrome, and on extensions to Chrome that might allow attackers to push malicious content before a user, capture information from them or access sensitive databases and other data stores. Among other things, the two researchers found that a notepad application, Scratchpad, that comes bundled with the ChromeOS on Chromebooks contained a cross site scripting vulnerability that could have allowed one Chrome user to hijack another user’s Google account, make off with their Google contacts and other data by way of a shared Scratchpad and some simple Javascript. Google has since closed that security hole, the researchers said. In analyzing key Chrome APIs, the two found that those interfaces permitted behavior that, while not unique to Chrome, could make stealthy attacks against Chrome OS environements child’s play. APIs like chrome.windows and chrome.tabs allow new browser windows to be opened and scripts run automatically upon accessing a specific Web site – a feature that could be used, for example, to craft attacks against banking or e-commerce Web sites.Chrome extensions, if not properly written, could contain cross site scripting holes that could then be leveraged by an attacker against any Web site. Google’s policy of abstaining from reviews of extensions that are uploaded to the company’s Web store also pose a problem by allowing clearly malicious extensions to be posted without any review or sanity checking. During the demonstration, the two showed off a custom extension they developed that collected a number of malicious features, including one that could allow an attacker to launch an internal port scan from Web browser with some simple HTML and Java coding. Osborn said he was able to upload the malicious extension to Google’s Web store, from which other users could download it. Google hasn’t contested the researchers’ findings, but says the attacks they demonstrated aren’t unique to its operating system, but are typical of Web based attacks that affect all operating systems. “We think that the characterization that this is a new attack surface created with Chrome OS seems inconsistent,” a company spokesman told Threatpost. According to the Whitehat researchers, Google is weighing responses to the security issues they raised, including the introduction of application specific APIs that would allow the company to more tightly control access permissions extensions and limit access to other data stored on Google. A Google spokesman declined to comment on that. For now, the company said it wants to work with developers to avoid cross site scripting. “Extensions are powerful software, and there are a number of things that come into play with that, but this isn’t about the Chrome OS, its about the Web and those extensions,” the spokesman said. Researchers at the Black Hat Briefings conference in Las Vegas warn that Google’s new Chrome Operating System could enable certain kinds of Web based attacksGoogle’s new Chrome Operating System was designed to fix the nagging security problems that have plagued platforms like Microsoft Windows. But new research unveiled at the Black Hat Briefings in Las Vegas suggests that the new cloud-centric OS, while far more secure, may also introduce some troubling security issues, too.

Hackers are actively exploiting a zero-day vulnerability that may be affecting millions of WordPress users. The bug was found in an image re-sizing utility that comes built-in to a number of commercial and free themes on the popular blogging platform.

The UK’s Metropolitan Police swooped down on the remote, weather beaten Shetland Islands last week to arrrest what the authorities claim is a top ranking member of the international hacker collective Anonymous, which has been terrorizing governments and high profile corporations for most of the last six months. The arrest of Jake Davis, aka “Topiary” capped a busy month for law enforcement in the U.S. and U.K., with raids on dozens of homes and the arrest of reputed leaders of both Anonymous and the affiliated Lulz Security, including Marshall Webb, the Ohio man known online online as “m_nerva,” Ryan Cleary, the alleged botnet operator known as “Ryan,” and a fellow Brit known online as “Tflow.”

Social networking giant Facebook has finally boarded the bug bounty bandwagon. The company announced late last week they’ll award $500 for each bug to those who share information about flaws that could compromise the site’s privacy. The news confirms rumors that began to bubble at a Hack in the Box security conference back in May.

ED: Alleged Anonymous Leader Topiary Arraigned in LondonDEK: The authorities have charged Jake Davis, a UK resident from the remote Sheltand islands with five criminal counts. The 18 year old is alleged to be “Topiary,” a prominent member of the inner circle of the hacking groups Anonymous and Lulz Security. The authorities have charged Jake Davis, a UK resident from the remote Sheltand islands with five criminal counts. The 18 year old is alleged to be “Topiary,” a prominent member of the inner circle of the hacking groups Anonymous and Lulz Security.  Davis, whose arrest was announced on July 27, (http://threatpost.com/en_us/blogs/uk-police-arrest-man-they-say-anonymous-member-topiary-072711) is charged with violations of the UK’s Computer Misuse Act, Serious Crime Act and Criminal Law Act, including “Unauthorised access to a computer system,” “Conspiracy with others to carry out a Distributed Denial of Service Attack on the website of the Serious and Organised Crime Agency,” and other conspiracy charges. He appeared in City of Westminster Magistrates’ Court on Monday 1 August, according to the Metropolitan Police (http://content.met.police.uk/News/Man-charged-with-ecrime-offences/1260269346230/1257246745756)The teenager, who appeared in court wearing dark sunglasses and a blue, denim shirt, was released on bail until August 30, but is required to wear a monitoring bracelet and abstain from using the Internet, according to a report in the UK’s Daily Telegraph. (http://www.telegraph.co.uk/technology/news/8674987/LulzSec-hacking-Jake-Davis-had-cache-of-750000-passwords.html). Controversy has swirled around the arrest, with astonishment that a teenager in such a remote corner of the British Isles would be at the center of an international hacking collective, and members of Anonymous claiming that authorities arrested the wrong man. However, the Metropolitan Police have issued numerous statements that suggesting that they have strong evidence linking Davis to the hacker known as Topiary. If that is true, it would be a major score in the international law enforcement effort to bring down the group, which has carried out a string of high profile hacks in the last year, including attacks on HBGary, Sony, the CIA, the UK’s Serious and Organized Crime Agency and others. Leaked IRC chat logs purporting to be from a restricted channel used by the group’s leadership suggest that Topiary was a central player in the attacks on HBGary Federal and its then-CEO Aaron Barr. A user with the IRC handle Topiary is quoted in those logs directing elements of that attack, including the publication of stolen e-mails from the firm. He also served as a spokesman for the group, granting interviews to the press, though leaked chat logs suggest that he was interested in  passing himself off as an “observer” of the group rather than a leading member. The arrest is the second of a top ranked Anonymous member in recent weeks. In June, authorities arrested 19 year-old Ryan Cleary of Essex England. Cleary is alleged to have operated a botnet used t attack on tho carry out denial of service attacks, including the website of the Serious and Organised Crime Agency. The authorities have charged Jake Davis, a UK resident from the remote Sheltand islands with five criminal counts. The 18 year old is alleged to be “Topiary,” a prominent member of the inner circle of the hacking groups Anonymous and Lulz Security. 

The U.S. Securities and Exchange Commission voted on Tuesday to impose new rules to help oversee what experts warn is a burgeoning and little understood shadow market of ultra high-speed, computer based trading. But one security expert warns that new reporting rules are only part of the problem. High frequency trading systems are also dangerously insecure, with few protections against manipulation by outside actors or rogue insiders.