loose wire blog

Podcast: The Usual Suspects

Here I discuss on my regular slot with Adelaine Ng of Radio Australia patent wars, Amazon's pricing policy and anything else we can think of. (This is from last Wednesday, so probably of historical interest only, unless you like hearing me say 'er' a lot.) 

Loose Wireless 111101

Thanks to the ABC for allowing me to reproduce it as a podcast.

Phishy Facebook Emails

Facebook phishes are getting better. Compare this one:

and this:

Notice how the key bit, supposedly defining that it's a legit email, is successfully and convincingly faked:

The only difference that stands out is the domain: facebookembody.com. Although Google classified it as spam they didn't warn that it would go to a website that contains malware. So be warned. Notification emails aren't such a good idea anymore, if they ever were.

The Siri Thing

I was asked to pen a few lines for a Guardian journalist on why I thought Siri was male  in the U.S. and female in the UK. My quote was taken a tad out of context and so offended some folk who either didn't know I was a technology columnist who makes a living out of irony and flip, or that I'm the most egregious, line-forming mumbler  in British history. So here's my contribution in its entirety. Make of it what you will.

I don't know the reason why they chose male and female voices that way: it's probably something prosaic about licensing or they didn't have a Female British voice handy, or someone thought it would be good to try it that way first to see what happened.

But there's plenty of literature to suggest that the gender of a voice is important to the listener. Men, according to researchers from Kansas State University,  tend to take more financial risk if they are given a video briefing voiced over by a woman; the opposite is also true. (Conclusions from this are undermined when it's added that men are willing to take even more risks if there's no voice-over at all, which possibly means the less information they're given, the more comfortable they feel about charging off into the unknown. This might sound familiar.)

Indeed, the problem with most research on the subject is that it tends to be as confusing as that. A paper from academics at the University of Plymouth found that "the sex of a speaker has no effect on judgements of perceived urgency" but did say that "female voices do however appear to have an advantage in taht they can portray a greater range of urgencies beacuse of their usually higher pitch and pitch range."

We do know this: male German drivers don't like getting navigational instructions delivered in a female voices. There's also something called presbycusis—basically hearing loss, where older people find it easier to hear men's voices than women's, and can't tell the difference between high pitched sounds like s or th.

But the bottom line is that Apple may have erred. Brits are notoriously picky about accents: class and regional, and, according to a study by the University of Edinburgh, can't stand being told what to do by an American female voice. So far so good. But they also found that people don't like what the researchers called a Male Southern British English voice either. Conclusion: until Siri can do regional female voices, it's probably not going to be a huge success in the UK.

My tuppennies' worth: Americans speak loudly and clearly and are usually in a hurry, so it makes sense for them to have a female voice. British people mumble and obey authority, so they need someone authoritative and, well, not American female.

ASEAN Phishing Expeditions

Mila Parkour, the indefatigable phish researcher from DC, points to some recent spear-phishing attacks which to me help confirm that Southeast Asia, and ASEAN in particular, has become something of a focus for the chaps in China.

They also highlight just how vulnerable diplomats in the region are because of poor security.

One is a phish apparently coming from the Indonesian foreign ministry, in particular one Ardian Budhi Nugroho, whom the email correctly describes as from the Directorate of ASEAN Political Security Cooperation. The subject matter is topical and credible:

Dear Sirs/Mesdames,
Enclosed herewith letter from Director for ASEAN Political-Security Cooperation, informing the date of the next Direct Consultations between ASEAN and P5 Nuclear Weapon States, which will be held on 4 - 6 October 2011 in New York. A Tentative Programme of the Direct Consultations is also attached for your kind reference. Thank you for your attention and continued cooperation.

The only good thing about these phishes is that they reveal something of the attacker's interests. These attacks are timed carefully a week or so ahead of key meetings--in this case a Oct 4-6 meeting in New York of ASEAN and P5 Nuclear Weapon states (one of those states, of course, is China). The email was sent on Sept 20.

The email address given, aseanindonesia@yahoo.com, doesn't appear to be genuine, but it could easily be. Look, for example, at the email addresses listed here. More than half are either ISP or webmail addresses.

Diplomats need to get wise to these kinds of attacks by using their domain's email addresses and being more sophisticated about their communications (not sending attachments, for one thing, and telling me they don't.)

How does all this work? We don't know who received this but it'll probably be a list of diplomats attending the talks--not hard to find, as we can see from the above list. It only needs one member of each delegation to open the infected attachment for their whole delegation to be in danger of China--or whoever is behind this attack--to be able to monitor everything they do.

 

Social Media Phishing Hazards

As usual, I feel we're not being smart enough about the way that scammers improve their skills. We demand everything to be easier, and they just reap the winnings.

What they're exploiting is the fact that we use a lot of different services (twitter, email, Facebook), and services within services (those which use those primary services as authorisation—in other words, borrowing the login name and password) to make things easier for us or to offer ancillary services (backing twitter, measuring the number of Facebook friends you have in Angola, etc etc).

All of this leaves us vulnerable, because we tend to get overwhelmed by the number and complexity of the services we subscribe to. Scammers exploit this.

I found this message in my inbox the other day:

The text reads:

Hello,

You have 2 unread message(s)
For more details, please follow the link below:
http://twitter.com/account/message/20111007/?userid=789837192

The Twitter Team

Needless to say, the link itself goes elsewhere: http://lewit.fr/primitives.html which is, as far as I know, a phishing website (so don't click on it.)

This scam isn't new; this website talks about it last year—though they seem to have improved the spelling (it used to be 'unreaded').

This is clever, because while Twitter says we won't send you messages like that, of course they do, all the time:

So it's understandable why people might fall for this trick. (I don't actually know what the trick is, but I assume that if you visit an infected website they'll try to get as much malware on your computer as you can, so this is not (just) about grabbing your Twitter details.

What worries me is this: The usual defence against this, if Google or whoever is hosting your email hasn't caught it, is to inspect the link under the link. In other words, to look at the actual link that the proffered link conceals. In the above case, the twitter.com/account etc link is really going to the lewit.fr page. But you'll only know that if you mouse over the link and look at the status bar in the bottom of your browser, or paste the link somewhere else. If the link looks dodgy you know not to go there.

Or do you?

Take this email I received at more or less the same time:

It's a request from backupify (an excellent backup service) for my twitter account.

The problem I have with it is this: The Backupify link in Step1 is actually this link:

http://mkto-l0091.com/track?type=click&enid=[etc] (I've removed the rest.)

How can I tell this is a legit email? Well it's addressed to me, but spearphishing is pretty good these days. And chances are I've succumbed to backupify's prodding to tweet to the world that I'm using their service, so an accomplished phisher need only harvest those twitter accounts which have mentioned backupify. Child's play, in other words, to get into my account.

But the domain looks extremely dodgy. In fact a who is search reveals it belongs to a company called Marketo Inc which is basically an email marketing firm. So that suggests it is legi—or that their site has been infected. I have no way of knowing.

Now everyone uses these third party companies to handle bulk emails; that's understood. But when you're asking to 'reauthorize' an account this effectively means you're handing over details of your account to a third party—a step that should be treated in the same way as reentering passwords or other sensitve account details. You shouldn't be using a third party emailer for that.

I'm going to reach out to backupify and see what they say about this. It's not the first time I've seen this, and I suspect it's more widespread than one would like to think. For users, I think the lesson is clear: Don't click on a link if you're not sure. Go to the actual page of the service in question and check it out that way.

Former Soviet Bloc, Allies, Under Lurid Attack

Trend Micro researchers David Sancho and Nart Villeneuve have written up an interesting attack they've dubbed LURID on diplomatic missions, government ministries, space-related government agencies and other companies and research institutions in the former Soviet bloc and its allies. (Only China was not a Soviet bloc member or ally in the list, and it was the least affected by the attack.)

Although they don't say, or speculate, about the attacker, it's not hard to conclude who might be particularly interested in what the attacks are able to dig up:

Although our research didn’t reveal precisely which data was being targeted, we were able to determine that, in some cases, the attackers attempted to steal specific documents and spreadsheets.

Russia had 1,063 IP addresses hit in the attacks; Kazakhstan, 325; Ukraine, 102; Vietnam, 93; Uzbekistan; 88; Belarus, 67; India, 66; Kyrgyzstan, 49; Mongolia, 42; and China, 39.

The campaign has been going for at least a year, and has infected some 1,465 computers in 61 countries with more than 300 targeted attacks.

Dark Reading quotes Jamz Yaneza, a research director at Trend Micro, as saying it's probably a case of industrial espionage. But who by? "This seems to be a notable attack in that respect: It doesn't target Western countries or states. It seems to be the reverse this time," Yaneza says.

Other tidbits from the Dark Reading report: Definitely not out of Russia, according to Yaneza. David Perry, global director of education at Trend Micro, says could be out of China or U.S., but no evidence of either. So it could be either hacktivists or industrial espionage. Yaneza says attackers stole Word files and spreadsheets, not financial information. "A lot of the targets seemed to be government-based," he says.

My tuppennies' worth? Seems unlikely to be hactivists, at least the type we think of. This was a concerted campaign, specifically aimed to get certain documents. Much more likely to be either industrial espionage or pure espionage. Which means we might have reached the stage where groups of hackers are conducting these attacks because a market exists for the product retrieved. Or had we already gotten there, and just not known it?

Either way, Russia and its former allies are now in the crosshairs.

More reading:

Massive malware attacks uncovered in former USSR | thinq_

Cyberspy attacks targeting Russians traced back to UK and US • The Register

Astroturfers Revisited

Good piece (video) by Jon Ronson about astroturfing:

Esc and Ctrl: Jon Ronson investigates astroturfing - video

In the second part of Jon Ronson's series about the struggle for control of the internet, he looks at online astroturfing – when unpopular institutions post fake blogs to seem more favourable. He meets the former vice president of corporate communications for US healthcare company Cigna, who confirms his involvement in this kind of activity

He talks about the "death panels": the Cigna whistleblower, Wendell Potter [Wikipedia] tells him that the company created lots of fake blogs and groups, all of which have since disappeared, including from archive.org, to get the issue going. Looking at a google search trend of the term "death panels", you can see how it appears from nowhere so suddenly:

I've not seen an issue spring from nothing to the max quite like that for a while.

No question that we don't really know just how widespread this is. It's good that Ronson, whom I greatly admire, is on the case. Should be entertaining and revealing too.

--

Here's some stuff I've written about this in the past:

The Real Conversation I've grown increasingly skeptical of the genuineness of this conversation: as PR gets wise, as (some) bloggers get greedy and (other) bloggers lose sight of, or fail to understand the need to maintain some ethicaleboundaries, the conversation has gotten skewed. I'm not alone in this, although cutting through to the chase remains hard. The current case of the Wal-Mart/Edelman thang, where the chain's PR firm reportedly sponsored a blog about driving across America and turned it into a vehicle (sorry) to promote Wal-Mart, helps bring clarity to some issues, or at least to highlight the questions.

Social Media and Politics- Truthiness and Astroturfing Just how social is social media? By which I mean: Can we trust it as a measure of what people think, what they may buy, how they may vote? Or is it as easy a place to manipulate as the real world.

Podcast: The Tablet is the Future

The BBC World Service Business Daily version of my piece on the future of tablets.  (The Business Daily podcast is here.)   I'll post the text itself at some point. 

Loose Wireless 110914

 

To listen to Business Daily on the radio, tune into BBC World Service at the following times, or click here.

Australasia: Mon-Fri 0141*, 0741 

East Asia: Mon-Fri 0041, 1441 
South Asia: Tue-Fri 0141*, Mon-Fri 0741 
East Africa: Mon-Fri 1941 
West Africa: Mon-Fri 1541* 
Middle East: Mon-Fri 0141*, 1141* 
Europe: Mon-Fri 0741, 2132 
Americas: Tue-Fri 0141*, Mon-Fri 0741, 1041, 2132

Thanks to the BBC for allowing me to reproduce it as a podcast.

DigiNotar Breach Notes

Some folk have asked me for more details about the DigiNotar breach after my brief appearance on Al Jazeera this morning. So here are the notes I prepared for the segment. Links at the bottom.

Background

web security certificates are digital IDs issued by companies entrusted with making sure they are given to the right company or organisation. It allows a user to set up a secure connection between their computer and the organisation's website. Browsers will show a little lock or some other icon to signify the certificate has been found and is trusted.

Hackers broke into a Dutch company called DigiNotar, itself owned by US firm Vasco Data Security, in mid June. DigiNotar is one of hundreds of companies around the globe called certificate authorities that issue these authentication certificates. Browsers contain a list of which CAs they can trust.

These hackers would have been able to steal existing certificates or generate their own, meaning they could now, with the help of an Internet Service Provider, launch what are called Man in the Middle Attacks--meaning they could intercept traffic, a bit like tapping a telephone.

DigiNotar noticed that something was amiss in July, but didn't realise the extent of the breach until late August, by which time more than 500 (531) fake certificates were issued. While some cover domains like the CIA and MI6, these are probably just distractions. The key ones are a dozen issued for domains like Google, Facebook and Skype.

Why do we think this was about Iran?

Studies of the validation requests--browsers pinging DigiNotar to confirm the certificate's authenticity--showed that during August the bulk--maybe 99%--of the traffic was coming from Iran. When the certificates were eventually revoked, Iranian activity dropped.

Moreover the attackers left some quite obvious clues. They left calling cards: transcribed Farsi which translates into slogans such as  "I will sacrifice my life for my leader." "unknown soldier"

Why might Iran be interested?

Well, we now know that a lot of countries like Syria intercept ordinary Internet traffic through something called Deep Packet Inspection. This means that the government is basically snooping on web traffic. But when that traffic passes through these secure connections, it's much harder. So the holy grail of any internet surveillance is to get a hold  of those certificates, or work around them. This is a brazen attempt to do this.

All Internet traffic in Iran has to go through a government proxy, making this kind of attack much simpler. The government ISP just uses the certificate to pretend to be Google, or whatever, and then passes the traffic on.

Is it the government?

This is harder to confirm. The Dutch government is investigating this. A similar attack took place against an Italian CA in March, and it shows similar fingerprints.

But the fact that the certificates were stolen and then used seems to suggest some official connection.

What could they have discovered?

Quite a lot. All the traffic that was intercepted could be deciphered.. meaning all browsing and emails. But it also may have captured cookies, meaning passwords, which would have made it easy to hack into target accounts and sniff around old emails, dig out other passwords, or hack into associated accounts, such as Google Docs.

Moreover, some of the certificates compromise something called The Onion Router, a service which anonymizes web traffic. Though TOR itself wasn't compromised the certificates could convince your browser you were talking to TOR, whereas in fact you'd be talking to the attacker.

Should other people be worried?

Yes, Some browser developers have been more forthcoming than others; Google Chrome and Firefox have been quick to respond. Others less so. If you're in Iran or think you may be targetted, it's a good idea to change your password, and to check that no one has altered your forwarding details in your email account. You should also upgrade your browser to the latest version, whatever browser you use.

DigiNotar made some horrible mistakes: one Windows domain for all certificate servers, no antivirus, a simple administrator password. There were defaced pages on the website dating back to 2009. One has to wonder what other certificate authorities are similarly compromised. We rely on these companies to know what they're doing. They're the top of the food chain, in the words of one analyst.

We should now be looking closely at the previous breaches and looking for others. This is a ratcheting up of the stakes in a cyberwar; this kind of thing has real world impact on those people who thought they were communicating safely and will now fear the knock on their door.

In the future this is likely to lead to a change in the way certificates are issued and checked. I don't think DigiNotar is going to survive this, but I think a bigger issue is bound to be how this security issue is handled. I think governments which look to the Internet as a tool for democratic change need also to be aware of just how dangerous it is to encourage dissidents to communicate online, whether or not they're being careful.

News:

BBC News - Fake DigiNotar web certificate risk to Iranians

DigiNotar - Wikipedia, the free encyclopedia

Fake DigiNotar certificates targeting Iranians?

Expert reports/analysis:

DigiNotar Hacked by Black.Spook and Iranian Hackers - F-Secure Weblog : News from the Lab

Operation Black Tulip: Fox-IT’s report on the DigiNotar breach | Naked Security (Sophos)

Fox-IT report, operation Black Tulip (PDF)

VASCO:

Acquisition DigiNotar

VASCO DigiNotar Statement

Comodogate:

Comodo Group - Wikipedia, the free encyclopediaackground

web security certificates are digital IDs issued by companies entrusted with making sure they are given to the right company or organisation. It allows a user to set up a secure connection between their computer and the organisation's website. Browsers will show a little lock or some other icon to signify the certificate has been found and is trusted.

 

Hackers broke into a Dutch company called DigiNotar, itself owned by US firm Vasco Data Security, in mid June. DigiNotar is one of hundreds of companies around the globe called certificate authorities that issue these authentication certificates. Browsers contain a list of which CAs they can trust.

 

These hackers would have been able to steal existing certificates or generate their own, meaning they could now, with the help of an Internet Service Provider, launch what are called Man in the Middle Attacks--meaning they could intercept traffic, a bit like tapping a telephone.

 

DigiNotar noticed that something was amiss in July, but didn't realise the extent of the breach until late August, by which time more than 500 (531) fake certificates were issued. While some cover domains like the CIA and MI6, these are probably just distractions. The key ones are a dozen issued for domains like Google, Facebook and Skype.

 

Why do we think this was about Iran?

 

Studies of the validation requests--browsers pinging DigiNotar to confirm the certificate's authenticity--showed that during August the bulk--maybe 99%--of the traffic was coming from Iran. When the certificates were eventually revoked, Iranian activity dropped.

 

Moreover the attackers left some quite obvious clues. They left calling cards: transcribed Farsi which translates into slogans such as  "I will sacrifice my life for my leader." "unknown soldier"

 

Why might Iran be interested?

Well, we now know that a lot of countries like Syria intercept ordinary Internet traffic through something called Deep Packet Inspection. This means that the government is basically snooping on web traffic. But when that traffic passes through these secure connections, it's much harder. So the holy grail of any internet surveillance is to get a hold  of those certificates, or work around them. This is a brazen attempt to do this.

 

All Internet traffic in Iran has to go through a government proxy, making this kind of attack much simpler. The government ISP just uses the certificate to pretend to be Google, or whatever, and then passes the traffic on.

 

Is it the government?

This is harder to confirm. The Dutch government is investigating this. A similar attack took place against an Italian CA in March, and it shows similar fingerprints.

 

What could they have discovered?

Quite a lot. All the traffic that was intercepted could be deciphered.. meaning all browsing and emails. But it also may have captured cookies, meaning passwords, which would have made it easy to hack into target accounts and sniff around old emails, dig out other passwords, or hack into associated accounts, such as Google Docs.

 

Moreover, some of the certificates compromise something called The Onion Router, a service which anonymizes web traffic. Though TOR itself wasn't compromised the certificates could convince your browser you were talking to TOR, whereas in fact you'd be talking to the attacker.

 

Should other people be worried?

Yes, Some browser developers have been more forthcoming than others; Google Chrome and Firefox have been quick to respond. Others less so. If you're in Iran or think you may be targetted, it's a good idea to change your password, and to check that no one has altered your forwarding details in your email account. You should also upgrade your browser to the latest version, whatever browser you use.

 

DigiNotar made some horrible mistakes: one Windows domain for all certificate servers, no antivirus, a simple administrator password. There were defaced pages on the website dating back to 2009. One has to wonder what other certificate authorities are similarly compromised. We rely on these companies to know what they're doing. They're the top of the food chain, in the words of one analyst.

 

We should now be looking closely at the previous breaches and looking for others. This is a ratcheting up of the stakes in a cyberwar; this kind of thing has real world impact on those people who thought they were communicating safely and will now fear the knock on their door.

 

In the future this is likely to lead to a change in the way certificates are issued and checked. I don't think DigiNotar is going to survive this, but I think a bigger issue is bound to be how this security issue is handled. I think governments which look to the Internet as a tool for democratic change need also to be aware of just how dangerous it is to encourage dissidents to communicate online, whether or not they're being careful.

Are Google Users More Vulnerable Than Others?

The DigiNotar breach ("Operation Black Tulip") is certainly likely to be a watershed in Internet security, and possibly in how we perceive cyberwar. But one lesser point may get lost: how vulnerable we are with a single username password to access all Google accounts.

Not only does that single account gain potential access to email and access to other accounts if that email address is used as the default account in the case of a lost password (or if it's used as the sign-in for other services, a la Chrome web apps), but it also gains access to documents, photos, location information, contact lists and chat records within the Google domain.

This from the Fox-IT preliminary report on the breach:

The list of IP-addresses will be handed over to Google. Google can inform their users that during this period their e-mail might have been intercepted. Not only the e-mail itself but also a login cookie could have been intercepted. Using this cookie the hacker is able to log in directly to the Gmail mailbox of the victim and also read the stored e-mails. Besides that, he is able to log in all other services Google offers to users like stored location information from Latitude or documents in GoogleDocs. Once the hacker is able to receive his targets‟ e-mail he is also able to reset passwords of others services like Facebook and Twitter using the lost password button. The login cookie stays valid for a longer period. It would be wise for all users in Iran to at least logout and login but even better change passwords.

Worth thinking about spreading one's accounts across several accounts and resisting the urge to use Google as one's sign-in account for third party services.