A deep look into US Military and CyberWar

Arstechnica has a (long) story up about HBGary and how they wrote backdoors for the US government.
This is very interesting look into the Black Ops of computer security. We all need to be aware of what is out there and what is going on.

If you have time give this article a read. If you don't know Ars articles are always well researched and written. Warning: It is a 5+ page article.

http://arstechnica.com/tech-policy/news/2011/02/black-ops-how-hbgary-wrote-backdoors-and-rootkits-for-the-government.ars

Back with more when I get time to research what they discuss here.

7 Types of Hackers

Roger Grimes, Security Advisor at Infoworld.com, has an article about the 7 types of hackers.

• Cyber Criminals
• Spammers / Adware Spreaders
• Advanced Persistent Threat Agents
• Corporate spies
• Hactivists
• Cyber warriors
• Rogue hackers

This is an interesting and quick read. I hope this helps explain to people there is more than one type of hacker, not always criminals with evil intent.

Potential PSN Hacks

Since the PS3 encryption key has been cracked hackers have been studying the firmware and have found some interesting things out about the way your PS3 interacts with the PlayStation Network. One hacker reports that he has found evidence that your credit card information is sent to the PSN in an unencrypted text file, granted over a SSL connection. This would be secure as long as you aren't running a custom firmware.

Hackers have reported that custom firmware running on a PS3 could be compromised with a set of fact SSL certificates and DNS information. Using this the hackers could route PSN traffic to a proxy server over SSL and decrypt the data, save it, re-encrypt it and forward it on to the PSN servers. This could be done transparently to the user, except for maybe a small slowdown from proxying.

My advice, stay away from custom PS3 firmwares for now. Especially while Sony is cracking down so hard on modders, with permanent bans from the PSN.

Quick Tip - Passwords

In light of all the password leaks recently ( Gawker and HBGary ), I thought maybe I should give some quick tips of good password etiquette:

1. Pick a strong password

• That means not a dictionary word
• Contains more than just letters, like a number AND a special character
• Make it longer than 8 characters

2. Don't reuse the same password on multiple accounts.

• This is bad because if your password is stolen then they can gain access to all your other accounts

3. Don't share your password, save it in a text file, write it down, or email it to yourself.

• These just make it easier for someone to steal it.

HBGary vs Anonymous

HBGary is a computer security company that does penetration testing, intrusion detection and worm detection, quarantine, and analysis. They present themselves as experts in the computer security field, but recently they were successfully compromised by basic well known techniques.

Aaron Barr was conducting what he called "just research" on information gathering through social media. He would use Facebook, Twitter, Lindedin, and other social networks to gather data about his target and their family and friends. He claims he could find his target's real name as well as where they were from just from publicly available information on social media sites.

He decided that he wanted to go after what he saw as "the leaders" of Anonymous. This did not turn out well for Mr. Barr. He claimed to have found the real names of these so called leaders of Anonymous and was in talks with the FBI to gain a contract between them and HBGary Federal, that's right Aaron Barr was the CEO of HBGary Federal. HBGary Federal is a branch of HBGary that was to handle all federal contracts, but was falling short of it's goal and running out of money. This made Barr anxious to close a deal by any means neccessary.

Anonymous Releases Stuxnet Source Code

Fox News reports that an unencrypted version of the Stuxnet worm source code has been released online by the group known as Anonymous. This version was being studied by HBGary Federal and was discovered when Anonymous hacked into their network earlier this month.

For those who don't know the Stuxnet worm was the first computer worm to specifically target SCADA (Supervisory Control and Data Acquisition) systems and also the first known worm to install a rootkit on a PLC (Programmable Logic Controller). It is largely regarded as the most sophisticated piece of computer malware to date. Experts worry that this source code could be studied by attackers to create similar sophisticated attacks.




For a more in-depth look at what Stuxnet is I suggest reading over the Wikipedia entry or watch this youtube video by Semantec demonstrating what Stuxnet does to a PLC.

The decompiled source code can be found here, and for more news and updates on the source code follow @stuxnetsource.

I link to the source because I believe knowledge is for everyone and the more people that can study these types of malware the better off we all are because the more wide spread the knowledge the less powerful it becomes.