ProSecurityNews » Hacks

PSN011 – Hacks, Threats, Dumpster Diving and a new schedule

admin — Mon, 23 Feb 2009 11:11:50 +0000

In this episode we discuss more smart phone threats, defeating facial recognition biometric login on laptops, how your Word documents can reveal your secrets, dumpster diving, and a change to our show schedule.

Show Links

Smartphone Threats Intensify – DarkReading
Security researchers crack laptop facial biometrics
Black Hat ® DC 2009 Briefings Archives
How Attackers Use Your Metadata Against You
ShmooCon 2009: Chris Paget’s RFID cloning talk – Hack a Day
SecurityDreamer Dumpster Diving

Your Face is NOT Your Password - how they did it (PDF File)

//Jon

Click the link to read the entire show transcript.

Smartphone Threats Increase

We have commented several times about the security threats posed by smartphones, and a study was just released that adds more fuel to the fire.

In previous articles we have mentioned the hazards of cell phones in the workplace. Besides hindering productivity, they may be equipped with data gathering technologies that early James Bonds would have only dreamed of. They can record conversations both on and off the phone. They can take both still and motion pictures of your company secrets. They have access to your corporate VPN. And many can act as portable storage devices connected like a thumb drive to a USB port on a network computer. Armed with email and web access, your stolen data can be sent out of the building in record time.

According to a new report released by McAffee, the famous anti virus company, more than half of mobile device-makers said their products experienced malware, voice-, or text spam attacks last year. McAfee’s report, which is based on a survey of 30-plus mobile device manufacturers from around the world, found these vendors are getting hit with more malware attacks than ever before.

Experts have long warned that smartphones, such as Windows Mobile and iPhone handsets, could become the new weakest link in the enterprise, with more users relying on them for accessing corporate email, surfing the Web, and other applications.

Enterprise smartphones are starting to get hit with the types of security problems wireless LANs have been facing, industry experts say. Viruses — especially via Windows — can be carried from smartphones to the network, he says, which puts the entire infrastructure at risk.

So now we not only have to worry about what a smart phone can remove from your business, but also what it might inject in the form of malware or a virus.

Laptop Facial Recognition Cracked

You may be aware that many laptop computers have a small built in web cam just above the screen. They have been put to several interesting uses. One such use is sending you an email photograph of the guy who just stole your computer. Another recent use available on a few laptops is facial recognition. The first time I saw someone use this I thought it was kind of bizarre. I observed Lloyd pick up his laptop and bring it near his face to log in instead of using a password.

Anyway, researchers in Vietnam have cracked the facial recognition on many of these laptops and they demonstrated the technique a the Black Hat security convention in Washington DC this week. They cracked the systems built into Lenovo, Toshiba and Asus laptops.

Essentially the researchers were able to bypass the security systems by showing the camera a picture of the registered user, they were also able to gain entry by showing the camera pictures of other people’s faces, after manipulating light and shade settings.

The Link to the technical paper explaining the technique is on our website in the show notes.

So what can we learn from this? Probably that it is best to let new technology be tested by others before you adopt it.

META Data Used Against You

While we are talking about computer related threats, did you know that the mere act of attaching a Word Document or PowerPoint presentation to an email could reveal confidential data to the recipient?

The Dark Reading Blog explains how. Metadata is a powerful feature of many document and file types, including Microsoft Office documents, PDFs, JPGs, ZIP files, and multimedia formats. Depending on the application and the file, metadata might contain information such as author names, user names, version of the software used to create the file, the user’s operating system, and sometimes even the computer’s MAC address. Armed with this data, an attacker can develop exploits that might work not only on a specific file, but on all similar file types in an enterprise.

The report goes on to explain that metadata is also helpful in social engineering attacks. Knowing the five different authors of a document, an attacker can “drop names” via the phone to make his scheme seem more credible. Similarly, location information contained in photos could be mentioned, making the calls seem more legit.

Metadata can also help with physical theft. For example, users may post images to Flickr or Twitter from a phone that enables geo-tagging. This information can give attackers the location about a target’s home or business, and where he might be on a daily basis. Similarly, the MAC address of the system can indicate the type of hardware used, making it easier to identify mobile workers who are likely to have laptops that are kept in places where they might be easy to steal.

If you want to know more, see the link to this article in the show notes. The original article has a link to a white paper titled Document MetaData, The silent killer. The article also has a few real life examples of how meta data tripped up a pharmaceutical company who deleted damaging data from a research report, how former president Bush was taken to task about the original author of a speech about Iraq, and about how redacted information in released Pentagon document was easily revealed.

Electronic Combination Locks

Listener Dave in Virginia wrote in recently to remind us about the many benefits of electronic safe locks. Obvious benefits, but benefits that we need to remind ourselves of from time to time. Dave was primarily concerned that todays economic climate was causing businesses to be a little foolish with cost cutting.

For example, if a managers salary is tied to profitability of his organization, they it is only natural to cut cost wherever possible to increase profit and increase his bonus. The problem comes in when this cost cutting involves security procedures.

By way of example lets consider the case of a fast-food chain who found that managers were reluctant to change safe combinations. Despite a specific security policy about safe combination changes when user turnover occurred, some managers ignored the policy and did not make timely combination changes to save money and increase their bonus.

The solution to this problem was electronic safe combination locks that the manager could change. So instead of calling a locksmith and paying for a service call, the manager could, and would, change the combination upon employee turnover thus maintaining security.

The electronic locks also have other benefits over mechanical combination locks, which are roughly Civil War era technology. Mechanical combination locks must be dialed in a precise sequence and dialed accurately to open them. This can be time consuming and frustrating for the user. So much so that it is common that the safe will not be locked properly during the day. The dial might be turned just enough to lock the safe boltworks, but requiring only a quarter turn to open it again, without dialing the combination.

Electronic locks can help because a pin number is much easier and faster to enter to unlock the safe, and policies require that in a manager has to be in and out of a cash management safe many times per day. Combine the rapid ease of use with the ease of setting a new combination and you have a winner for the security department.

Electronic safe locks have 3 basic categories and price points.

At the low end, electronic safe locks provide basic PIN access and user-changeable PINs
The middle range locks offer multiple-user capabilities, programmable time delays and an electronic token combined with a pin for extra security
At the high end, the locks include time windows to restrict lock opening to business hours, audit trail capabilities and even dual custody. Some even have a ‘door left open’ alarm.

So what can we learn from this? The most significant reason electronic safe locks have become so popular is the user-changeable access code feature. By allowing users to quickly and easily change individual access codes, store personnel can maintain security policies while not impacting store profitability. Often, the cost savings associated with user-changeable access codes can justify the capital investment of an electronic safe lock within the first year of operation. If you want to know more about electronic safe locks, consider signing up for the Safe Lock Servicing class at Lockmasters Security Institute. Visit the website at lsieducation.com to learn more.

RFID Passport Cloning

In the last episode we spoke about Researcher Chris Paget who planned to release the details of his ‘drive by passport cloning system’ during the Shmoocon hacker convention held in Washington DC. You may recall he used components purchased on eBay for less than $250 to do some drive by discovery of RFID enabled devices. In a manner similar to Wardriving where a mobile laptop discovers insecure wifi network resources, the researcher equipped his vehicle to discover nearby RFID devices and capture the unique identifier code. During a 20 minute drive in downtown San Francisco he was able to copy the RFID tags of two passports without the knowledge of the passport holder.

Anyway, his talk is available as a video on the hackaday.com website of you are interested. There is a link in the show notes.

Dumpster Diving

Steve Hunt of the Security Dreamer blog has an interesting video blog post of the results of his recent dumpster diving score. He wanted to prove the point that the IT guys in a facility don’t have exclusive domain over “data protection”. It is not only an IT issue, the data sits on hardware, or in the trash next to the copier, or in the recycling bins, or in this case, outside in the dumpster. In only 3 minutes he found wire transfer information, copies of checks complete with social security numbers, and even a discarded laptop from the Chicago Board of Trade with the hard drive still inside! The video is well worth watching.

What can we learn from this. Once again, valuable data can leak out of a facility in all sorts of ways, and sometimes it is even thrown away in the trash. How does your facility handle potentially sensitive information? Do you have a document destruction service to deal with all the paper that gets thrown away? How about old computers? What is your security policy regarding the data on the hard drives?

Closing

In closing, I want to take this opportunity to announce a format change. We have decided to move to a biweekly podcast format so beginning in March we will produce Pro Security News every other week. Also, I will be away from the office for a while, so look for our next show on Monday, March 16. In the meantime, I will post interesting news items to the website at www.ProSecurityNews.com. You will get the same weekly automatic notification in your email letting you know about items I have posted.

If you have any questions about any of the topics discussed today, or if you have a technical question you need an answer for, send me an email at info at prosecurity news dot com. I will answer both via email, and on the show so others can learn.

This podcast has been brought to you by the Lockmasters Security Institute in Nicholasville Kentucky. For more than 50 years LSI has been the nation’s leading educational organization for technical and security education. Our students come from the federal government, US military, Fortune 500 companies, private industry and law enforcement. LSI offers 27 different classes covering security management practices, lock & safe technical skills, and law enforcement covert technical operations skills. Check the website at lsieducation.com for the 2009 schedule of classes.

PSN011E – Hacks, Threats, Dumpster Diving, New Schedule (enhanced)

admin — Mon, 23 Feb 2009 11:07:15 +0000

(enhanced podcast) In this episode we discuss more smart phone threats, defeating facial recognition biometric login on laptops, how your Word documents can reveal your secrets, dumpster diving, and a change to our show schedule.

This is the enhanced version of the podcast with embedded images and chapter markers much like a DVD. See PSN011 for the show links and the full text of the podcast.

PSN010 – Protec Attacks

admin — Mon, 16 Feb 2009 01:30:48 +0000

We cover more cell phone blunders, Top Secret Twittering, revised BHMA standards, attacks on ABLOY Protec, and “ the unmask”. Also, LSI is looking for highly qualified security professionals to add to their staff of instructors.

Lockmasters Security Institute Approved by GSA

LSI has been certified by the General Services Administration (GSA) to train safe and vault technicians who service GSA approved security equipment. With an estimated 400,000 GSA containers in use today, this is an ideal course for any U.S. military, government & commercial locksmith.

In this intense 10 day course, students learn by opening locked containers using the approved methods of forced entry. They also learn about servicing, installing, diagnosing, troubleshooting, repairing and certifying GSA Locks, and GSA approved security containers.

Students leave the class with a specially created safe lock servicing tool kit and an extensive 700+ page reference manual that includes the latest specifications, regulations, neutralization techniques, security container identification, troubleshooting and much more. The reference manual itself weighs over ten pounds! Students who successfully complete the course also receive factory certifications and diplomas from LSI, Hamilton Products Group, & KABA Mas X09. All the GSA regulations and government forms required as part of servicing and inspection are available for download on the LSI website. See the show notes for the link.

Lockmasters Security Institute offers Methods of Entry for Law Enforcement

LSI, has partnered with the FBI-LEEDA organization, and created a class specifically for the Law Enforcement community. Methods of Entry is designed to familiarize officers with the tools and techniques used by today’s criminals to gain entry through locked doors. Offensive entry techniques for police are also addressed for lawful / court ordered entry.

This class has dual strategies. The offensive strategy is designed to familiarize law enforcement personnel with methods that can be used to carry out lawful or court ordered bypass techniques to open doors, bypass locks or bypass security systems. The class is designed to provide familiarity with tools common to the locksmithing and intelligence communities, but not generally known to the public.

The defensive strategy is designed to expose law enforcement personnel to tools and techniques used by criminals, and to aid in the identification of burglary tools.

This class is available to any sworn law enforcement officer and requires the agency to certify the need for this training.

In addition to the training, LSI offers a catalog of specialized entry support tools to aid Law Enforcement officers in gaining lawful/court ordered entry through locked doors. See the show notes for a link to the website.

Securitas USA Announces Asset Acquisition in Hawaii

Securitas Security Services USA, Inc. recently announced the acquisition of the Hawaiian commercial assets of Akal Security Inc. in a transaction scheduled to close on February 20, 2009. This transaction will include over 30 locations and over 300 security officers. The Akal press release notes that the sale does not include any of Akal’s Federal Government contracts, nor any of Akal’s business outside the state of Hawaii.

Akal is the largest provider of contract Judicial Security services, providing protection for federal courthouses in 40 states. Akal specializes in providing security for critical federal government facilities, state and local government agencies and military installations.

Securitas USA has an existing presence in Hawaii with 2,400 employees managed out of 6 branch offices. Headquartered in NJ, Securitas employs over 100,000 people. Services include uniformed security officers, mobile patrols, security consulting & investigations.

http://www.akalsecurity.com/

Digital SLR Camera Fits Into Nikon’s Microscope

On February 20, Nikon Vision Co Ltd will release the “Fabre Photo EX,” a portable stereoscopic microscope that can be fitted to a Nikon’s digital single-lens reflex camera. The announced price is about 1,200 US. A special bracket will allow event the modestly price series of Nikon Coolpix cameras to be attached. The product is rugged and intended for field observation, and industrial uses such as parts inspections. However it is clear that such a device has obvious uses to law enforcement for forensic investigations. Further, the price is low enough that it wont break even the most modest budget.

With one AA alkaline battery, the Fabre Photo EX can be operated for about ten hours. It is equipped with a white LED light for observation and photo shoot in a dim environment. The light can be switched between “OFF,” “One Light” and “Two Lights,” making it possible to adjust shading and brightness.

http://techon.nikkeibp.co.jp/english/NEWS_EN/20090204/165115/

Courts split over police searches of handhelds

This next story is outside our area of expertise, but it will be of interest to our friends in law enforcement & security management. The courts are split over police searches of handheld phones during traffic stops and subsequent arrests.

Anyone who owns a smart phone that can text, email & web browse knows all to well that the phone can contain a lot of personal and potentially damaging data. Apparently a warrant is needed to search a smartphone in

your home, but recent court decisions have not done much to clear up how such searches should be conducted in the field.

The Cnet News Politics & Law blog has details on the story and excerpts from some of the court decisions that might help in setting a policy to be used by your agency while this all shakes out. Given some of our recent stories about cell phones being the possible ’smoking gun’ in a crime, it would at least be prudent to sequester the phone in a shielded container to prevent the data from being destroyed remotely as we mentioned in show number 4 and show number 8.

Congressman twitters secret trip to Iraq

This story was all over the news recently, but we will cite the Cnet article written by Rafe Needleman as our source.

For security reasons, a recent congressional delegation Iraq was supposed to be secret. Even media outlets that knew of the trip kept a lid on the news.

According to the Twitter feed, Rep. Peter Hoekstra announced both his planned departure and his arrival into Baghdad.

It is unknown if Rep. Hoekstra broke any laws by revealing the trip, but the political blogs are fond of pointing out that such a security lapse is surprising for the Ranking Member of the House Intelligence Committee.

The representative counter strikes on his website by pointing out that there is no such rule or policy regarding disclosure of the movements of a high profile delegation, and cites some examples of where some Democrats have not followed their own advice.

Of course the real news in all of this is that evidently you can now get BlackBerry data service in Baghdad. Who knew?

Seriously though, what can we learn form this? This kind of slip up could have been disastrous for both the delegation and their military escorts. It is just common sense to keep details of travel into danger zones off the internet.

We have spoken before about the hazards of cell phones in the workplace. Besides hindering productivity, they may be equipped with data gathering technologies that early James Bonds would have only dreamed of. They can record conversations both on and off the phone. They can take both still and motion pictures of your company secrets. They have access to your corporate VPN. And many can act as portable storage devices connected like a thumb drive to a USB port on a network computer. Armed with email and web access, your stolen data can be sent out of the building in record time. Now we add the public disclosure of company information, or in this case, the location of high profile targets, on a global social network, that by its very nature is designed to appeal to the masses, and you have a situation that essentially creates jobs security for those of us in the security industry. Hmmm, maybe its not so bad after all.

One final note, if you use a Blackberry, I suggest you stay in touch with their support website. Because of the popularity of this device it has become a target for hackers who are bored with attacking Windows Computers, there are now several exploits against the Blackberry that could result in your having a very bad day.

In door hardware news. . .

BHMA Issues Revised Standards.

The Builders Hardware Manufacturers Association recently published revised standards for Exit Devices, Door control Closers, and Auxiliary Hardware. BHMA is the only organization accredited by the American National Standards Institute (ANSI) to develop and maintain performance standards for locks, closers, exit devices and other builders hardware.

The revised standards can be purchased online from buildershardware.com in either printed or electronic format. I highly recommend the complete set to anyone that specifies, sells or installs builders hardware.

Unlocking the ABLOY Protec

The Abloy Protec key cylinder has been under attack recently, mostly on YouTube. Last December a video was posted demonstrating a new tool and how it is used to mill off the face of the cylinder so the disks can be extracted and decoded to make a key. It is a destructive entry technique however the repair to the customer would be to replace the drilled cylinder with a new one.

A second video was posted a few days ago titled Abloy Protec Decode. It shows a demonstration of a decoding method however the video is lacking audio and a clear explanation of what is being done. Further, much of the manipulation is done just outside the camera filed of view. None the less, the author of the video has vigorously defended his claim on the popular locksport blog Blackbag hosted by Barry Wels.

Time will tell if this technique proves successful. See the show notes for the links to the videos.

http://blackbag.nl/?p=319

http://www.youtube.com/watch?v=YiZOURhFnUI

http://www.youtube.com/watch?v=uj4myR2XlWc

Unmasking your face

I just couldn’t help but laugh when I discovered this next story. An artist by the name of Andrew Salomone has solved the problem that snow skiers have of looking like a hold up guy because they are wearing a full face balaclava when skiing in cold weather. Using his technique you can wear your warm balaclava, but without masking your true identity. The steps to making his Identity Preserving Balaclava are detailed on the website “ instructables”.

Simply stated, he starts with 6 pictures of a persons head. He takes a picture of the front, back, left, right, top, and shoulder to neck. Using imaging editing software he scales the pictures to full size and prints them onto iron on t shirt transfer material. Now you can probably see where this is going. The next step is to iron the transfer onto some cloth and then trim, arrange, and sew the pieces of cloth into a full face mask.

I wonder how long it will take the bad guys to adopt this full face mask technique to impersonate someone else while committing a crime..

http://www.instructables.com/id/Identity_Preserving_Balaclava_all_the_warmth_with/

LSI is hiring

Our final story for the day is good news, Lockmasters Security Institute is looking for instructors. Thats right, if you are looking for a new position, and have extensive experience in the locksmith and physical security, and you enjoy sharing your knowledge with others, then we want to talk to you today. Please call our toll free number, (866) 574-8724, and ask for Deanna Deborde on extension 213.

And so ends this 10th episode of Pro Security News. We covered a lot of topics in this show. The links to all the original stories and research articles are included in the show notes.

If you wish to praise or condemn the show, please drop us a note at info at pro security news dot com. We can’t improve if we don’t know what’s bugging you. If you enjoy the show please consider giving us a rating on iTunes and Zune.

PSN010E – Protec Attacks

admin — Sun, 15 Feb 2009 23:13:17 +0000

(Enhanced Podcast) We cover more cell phone blunders, Top Secret Twittering, revised BHMA standards, attacks on ABLOY Protec, and “the unmask”. Also, LSI is looking for highly qualified security professionals to add to their staff of instructors.

This is the enhanced version of the podcast with embedded images and chapter markers much like a DVD. See PSN010 for the show links and the full text of the podcast.