Tag: hackers

Farmers turn to hackers to save them from tractor makers

US farmers are paying Eastern European hackers to crack their tractors so that they can actually repair them.

Tractor maker John Deere puts locks on its tractors because it does not want farmers to  perform “unauthorised” repairs on farm equipment. It wants the farmers to wait for one of its dealers to show up and repair it. They are also worried that the tractor maker could remotely shut down a tractor and there wouldn’t be anything a farmer could do about it.

A licence agreement John Deere required farmers to sign in October forbids nearly all repair and modification to farming equipment, and prevents farmers from suing for “crop loss, lost profits, loss of goodwill, loss of use of equipment … arising from the performance or non-performance of any aspect of the software”.

The agreement applies to anyone who turns the key or otherwise uses a John Deere tractor with embedded software. It means that only John Deere dealerships and “authorised” repair shops can work on newer tractors.

However this does not sit well with farmers who feel that if they have bought a tractor they should be allowed to do with it what they like. So they go to some dodgy part of the internet and pay for a crack from the nice man in the Ukraine.

This saves a fortune in time and money. If you want to replace a transmission and you take it to an independent mechanic—he can put in the new transmission but the tractor can’t drive out of the shop. Deere charges $230, plus $130 an hour for a technician to drive out and plug a connector into their USB port to authorise the part.


Dark web shrinking

The number of dark web services has gone down significantly following the Freedom Hosting II hack that took place at the start of February.

According to a new OnionScan report, only 4,400 services exist on the dark web. This is significantly down on last year when the number of dark web services was pitched at 30,000.

According to Sarah Jamie Lewis, the main researcher behind the OnionScan report, at the heart of this dramatic drop in numbers is the downfall of Freedom Hosting II, a dark web hosting service.

A previous report from October 2016, also by Lewis, estimated that Freedom Hosting II hosted around a fifth of the entire dark web.

“We believe that the Freedom Hosting II takedown not only removed many thousands of active sites but also may have affected other hosting providers who were hosting some infrastructure on top of Freedom Hosting II,” Lewis explained.

Anonymous hacked Freedom Hosting II at the start of February this year after they discovered the provider was knowingly providing service to many websites hosting images of sexually abused children.

The dark web is now down to 4,000 HTTP websites, 250 TLS (HTTPS) endpoints, 100 SMTP services, and only 10 FTP nodes.

Lewis also notes that despite previous reports of improperly configured of dark web servers, the number of installations leaking details about the underlying server has remained at the same levels.

Russian hackers make a killing showing real ads to non-humans

humans-channel4-amc-sci-fi-tv-seriesRussian cybercriminals have built a new high-tech fraud business based on showing real ads to fake people.

So far the fraud has siphoned more than $180 million from the online ad industry.

Security outfit White Ops have named the technique “Methbot,” and said that it is a very advanced cyber operation on a scale no one’s seen before.

Eddie Schwartz, White Ops chief operating officer said that Methbot, so nicknamed because the fake browser refers to itself as the “methbrowser,” operates as a sham intermediary advertising ring.

Companies would pay millions to run expensive video ads. Then they would deliver those ads to what appeared to be major websites. What they didn’t know was that the criminals had created more than 250,000 counterfeit web pages no real person was visiting.

White Ops first spotted the criminal operation in October, and it is making up to $5 million per day — by generating up to 300 million fake “video impressions” daily.

According to White Ops, criminals acquired massive blocks of IP addresses — 500,000 of them — from two of the world’s five major internet registries. Then they configured them so that they appeared to be located all over the United States.

They built custom software so that computers (at those legitimate data centres) acted like real people viewing those ads. These “people” even appeared to have Facebook accounts (they didn’t), so that premium ads were served.

Hackers avoided ad-fraud blockers because the software mimics a real person who only surfed during the daytime — using the Google Chrome web browser on a Macbook laptop.

However, media experts noted that the additional fake 300 million “views” now existing in the advertising marketplace does put significant pressure on media companies who are competing over an audience that doesn’t really exist.

White Ops said its researchers traced back Methbot’s creators to individual hackers in Russia, but the firm would not release additional details on the record.

Lots of Americans would give up sex to avoid being hacked

8d64f8b6-7567-4d48-b0ac-b6438cdef185More than 40 percent of Americans would give up sex for a year to never have to worry about being hacked, according to one new study.

Emmanuel Schalit, CEO of online password management firm Dashlane, which commissioned the survey of 2,000 U.S adults, said that the company used the “quirky angles” of food and sex to show just how much in mind cybersecurity is for Americans today.

Apparently, 41 percent of Americans would rather give up their favourite food for a month than go through the password reset process for all their online accounts — a process that is recommended as routine for all online account holders to help prevent hacks.

Schalit said that cybersecurity was a very real concern for a large portion of the population.

“A vast proportion of people understand the threat of hacking in daily life, and would sacrifice something fundamental to avoid it.”

The study found that 43 percent of millennials would trade in sex for online safety; while 64 percent of those aged 18-34 showed themselves to be “more trusting,” said Schalit, saying they’ve shared or received passwords to other people’s accounts; 37 percent of those 35 and older said they’d shared passwords.

“The youngest people in our sample tend to be more trusting than older people for all sorts of reasons. This is in part that has to do with having a different attitude toward life, as a result, of being  being younger and having been born in an age when the internet already existed,” said Schalit.

While the study shows that millennials are more inclined to share passwords, Schalit asserts that this doesn’t necessarily mean they’re doing so blindly or irresponsibly.

“It’s not a bad thing to share a password within a family or a company that has a [shared] Facebook account. The real problem is how you share it. If you share it over email that’s a bad idea because email is always the first thing to get hacked.”

Dashlane’s survey found that in their passwords, 31 percent of Americans have used a pet’s name, 23 percent have used number sequences, 22 percent have used a family member’s name, and 21 percent have used a birthday.

Democrats expect executives and laywers to defend them against hackers

face palmThe Democratic National Committee has not really learnt its lessons about hackers.  It has formed a new committee to defend itself against future hackers and has not included a single computer technical expert – in other words all chiefs and no indians.

According to a memo obtained by POLITICO, the committee will be made up of  Rand Beers, former Department of Homeland Security acting secretary; Nicole Wong, former deputy chief technology officer of the U.S. and a former technology lawyer for Google and Twitter; Aneesh Copra, co-founder of Hunch Analytics and former chief technology officer of the U.S and Michael Sussmann, a partner in privacy and data security at the law firm Perkins Coie and a former Justice Department cybercrime prosecutor.  After all laywers and executives always know what to do when your server is hacked and how to protect it.

interim DNC Chairwoman Donna Brazile wrote in a memo that the board would prevent future attacks and “ensure that the DNC’s cybersecurity capabilities are best-in-class, I am creating a Cybersecurity Advisory Board composed of distinguished experts in the field,” .

“The Advisory Board will work closely with me and the entire DNC to ensure that the party is prepared for the grave threats it faces—today and in the future.”

Hard to see how that works. Hacking attacks are usually stopped by a security expert who knows what they are doing wiring up a system which prevents hacking. A lawyer is not particularly useful and while NSA looks good on a CV the phrase “acting secretary” does not mean that they dealt with much hacking.


Hackers could hijack homes

Internet of thingsA security expert said that setting up your house based on the  ‘Internet of Things’ devices could lead to your house being hijacked by hackers.

Allen Scott, the head of strategic partnerships, for F Secure warned that the new wave of ‘internet of things’ devices could leave people ‘under siege’ from criminals that “want to find an easy way to make cash.”

He said that the current trend from hackers involves people are taking data, encrypting it and then holding it to ransom. There is no reason to think it is impossible with smarthouses.

The ‘Internet of Things’ essentially describes a new type of home product that now has internet connectivity, allowing it to update itself, be controlled remotely via smartphone or tap into millions of other devices to make itself more intelligent.

Currently these devices range from smart thermostats which let you remotely control your home’s heating to remotely controlled lighting to ovens which can be pre-set to turn on using a smartphone.

But they also include things like ‘smart locks’ use a fingerprint sensor on your phone to allow access to your house.

Scott warns that these new gadgets present hackers with a lucrative new source of income.

“They’re no longer kids in bedrooms hacking into the NATO website because they can do it, or challenging each other at school, you can make more money from hacking with ransomware. Every technology device that’ll be shipped in four of five years’ time will have an IOT connector in it, it still astonishes me that you can go to eBay and buy pretty sophisticated technology for under a £10. Without knowing it you’ve just bought yourself an IoT,” he said.

Hackers steal your voice


2672889152_0fa1bf6ebc_bSecurity experts are looking into ways attackers can fool voice-based security systems by impersonating a person’s voice.

A team at the University of Alabama, Birmingham (UAB), has found that using readily available voice morphing software, hackers are able to administer voice imitation attacks to breach automated and human authentication systems.

The research was presented last week at the European Symposium on Research in Computer Security (ESORICS) in Vienna, Austria.

Nitesh Saxena said that people rely on the use of their voices all the time, it becomes a comfortable practice to base security systems around them.

“What they may not realize is that level of comfort lends itself to making the voice a vulnerable commodity. People often leave traces of their voices in many different scenarios. They may talk out loud while socializing in restaurants, giving public presentations or making phone calls, or leave voice samples online,” he added.

“Voice is a characteristic unique to each person, it forms the basis of the authentication of the person, giving the attacker the keys to that person’s privacy.”

Hackers can easily record a voice clip if they are within close proximity of their target, over the phone via a spam call by using audio snippets found online.

Advanced voice morphing software can also create an extremely close imitation of a person’s voice from a limited number of audio samples, allowing an attacker to speak any message in the victim’s voice.

With a few minutes’ worth of audio in a victim’s voice would lead to the cloning of the victim’s voice.

The researchers tested voice-biometrics, or speaker-verification used to secure systems, such as online banking, smartphone PIN locks and government access control. They also looked at the impact of stealing voices to imitate humans in conversation, such as morphing celebrity voices and posting snippets online, leaving fake voice messages, and creating false audio evidence in court.

The majority of advanced voice-verification algorithms were trumped by the researchers’ attacks, with only a 10-20 per cent rate of rejection. Humans told to verify voice samples only rejected about half of the morphed clips.

Convicted hacker saved corporations

A computer hacker who infiltrated the servers of major corporations defected to the men in suits to avoid a large jail sentence.

Hector Xavier Monsegur was arrested by the cops and it was likely he would get more than 20 years porridge under the US government’s “lock em up for years for no real purpose” justice system.

However Monsegur switched sides and helped the government disrupt hundreds of cyberattacks on Congress, NASA and other sensitive targets.

New York prosecutors detailed the cooperation of Monsegur for the first time in court papers while asking a judge to reward him with leniency at his sentencing Tuesday.

Monsegur helped them cripple Anonymous and worked around the clock with FBI agents at his side.

He provided, in real time, information about then-ongoing computer hacks and vulnerabilities in significant computer systems, prosecutors wrote.

The FBI estimates he helped detect at least 300 separate hacks, preventing millions of dollars in losses, they added.

It is believed that despite saving the Land of the Fee more than 300 times, he will still face jail. But because of his cooperation, the sentence could be two years or less.

However in a 2011 interview with an online magazine, Monsegur said he decided to join forces with Anonymous because he was upset over the arrest of WikiLeaks founder Julian Assange.

Using the alias Sabu, Monsegur led Lulz Security, or LulzSec, which hacked computer systems of Fox television, Nintendo, PayPal and other businesses, stole private information and then bragged about it online.

When arrested Monsegur immediately agreed to cooperate, giving the FBI a tutorial on the inner-workings and participants of LulzSec and Anonymous, prosecutors said. Under their direction, he “convinced LulzSec members to provide him digital evidence of the hacking activities” and “asked seemingly innocuous questions that … could be used to pinpoint their exact locations and identities,” court papers said.

Reports that Monsegur was cooperating made him a pariah in the Anonymous movement, prosecutors said. Hackers began posting personal information about him, and he was even approached on the street and threatened, they said. He, and his family were later placed in a witness protection programme 

Hackers hit a US utility

In what the Department of Homeland Security calls a “sophisticated hack” someone hit a public utility and compromised its control system network.

The DHS said that there was no evidence that the utility’s operations were affected but it must put the fear of Jehovah into many utilities who operate ancient computers.

The DHS did not identify the utility in a report that was issued this week by the agency’s Industrial Control Systems Cyber Emergency Response Team, or ICS-CERT.

ICS-CERT was able to work with the affected entity to put in place mitigation strategies and ensure the security of their control systems before there was any impact to operations, a DHS official said in a statement.

Normally such attacks are not disclosed by ICS-CERT, partly because companies are reluctant to go public about attacks to avoid potentially negative publicity. In fact in this case ICS-CERT said that investigators had determined the utility had likely been the victim of previous intrusions. It did not go into more details.

The hackers appear to have launched the latest attack through an Internet portal that enabled workers to access the utility’s control systems. The passwords were attacked with a “brute force” method.

Systems in the US utilities are often so old that they are susceptible to such brute forcing technologies would not have the detailed logging required to aid in an investigation.

Last year ICS-CERT responded to 256 cyber incident reports, more than half of them in the energy sector. While that is nearly double the agency’s 2012 caseload, there was not a single incident that caused a major disruption. 

Iranian hackers damaged the US navy

Iranian hackers managed to score a more serious hit on the US Navy than has been previously admitted.

In September, the US Navy’s largest unclassified computer network was hacked by a group either “working directly for Iran’s government or acting with the approval of Iranian leaders”.

Not much was said at the time, but it looked like a simple hack in revenge for all that Stuxnet stuff that the US and Israel did to the Iranian nuclear plant.

Now US officials say that the network infiltration was far more extensive than previously thought, and lasted much longer.

According to The Wall Street Journal, it took the Navy four months after initial news of the hack was published in late September to purge the hackers from the network.

The hackers hit the Navy Marine Corps intranet through “a security gap” in one of the Navy’s public-facing websites. Officials say that the hackers made no headway into classified networks but seemed to be everywhere in the network.

It took a coordinated plan to push them out and cyberwarriors and contractors had to be bought in to do the job. The cost to repair the network, a senior defence official said, was $10 million and will probably rise when a few invoices are paid.

The US Navy was surprised at the skills of the Iranian hackers. They had previously relied on DDoS attacks to attack US government networks which are not that difficult to stop.

What is worrying is that while the hackers reportedly were not able to extract any truly valuable information from their infiltration, they could still do a lot of damage. Moreover, the Iranians could train many people in their techniques.