Facebook hackers pwn baseball team pages, claim NY Yankees captain is having sex change

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A host of Facebook accounts belonging to US baseball teams were hacked yesterday, and defaced with messages in dubious taste, including one which claimed that New York Yankees captain Derek Jeter was undergoing a sex change.

"We regret to inform our fans that Derek Jeter will miss the rest of the season with sexual reassignment surgery. He promises to come back stronger than ever in 2013 as Minnie Mantlez"

Other clubs affected included the Miami Marlins, San Diego Padres, Chicago White Sox, Washington Nationals, Chicago Cubs and San Francisco Giants.

Here is a selection of the messages that were posted:

Clearly an unauthorised party had managed to gain admin access to the Facebook pages in order to post the messages - and the first thought is that it would be a very strange coincidence to have the Facebook pages of so many clubs compromised at the same time.

However, it turns out that the clubs run the Facebook pages in conjunction with MLB Advanced Media.

One possible scenario is that an MLB Advanced Media employee was sloppy with their password (maybe they weren't using a hard-to-guess password, or maybe they were using a password that they had also been using elsewhere on the net), allowing a hacker to gain access and post the inappropriate content.

A spokesperson for the baseball league told the Wall Street Journal that they were working with Facebook and law enforcement to see if they could identify what had happened, and who might have been responsible:

"For a brief moment today, a few MLB Club Facebook accounts were hacked and inappropriate material was briefly on display from those Clubs' pages on Facebook. MLB Advanced Media oversees these Facebook pages on behalf of the Clubs and regrets this occurrence. We are working with Facebook, Major League Baseball Security and, where appropriate, legal authorities to determine the circumstances surrounding this situation."

I guess everyone should be grateful that the hacker didn't exploit their access to the baseball clubs' Facebook pages by posting something more malicious - such as links to malware-infected pages - that could have impacted thousands of sports fans.

This isn't, of course, the first time that Facebook fan pages have been hacked and unauthorised posts made. There have been a wide variety of victims in the past, ranging from Viagra manufacturer Pfizer, Nicolas Sarkozy, and last year the rapper Soulja Boy who blamed a hacker for a series of racist and homophobic rants.

Perhaps the most embarrassing incident of this nature was when Facebook's own CEO, Mark Zuckerberg, had his official fan page hacked via an API bug.

Make sure that you keep informed about the latest security and privacy issues on Facebook. Join the Sophos page on Facebook, where over 190,000 people regularly share information on threats and discuss the latest security news.

Follow @gcluley

Baseball player image from Shutterstock.

Tags: baseball, Chicago Cubs, Chicago White Sox, Derek Jeter, Facebook, hacking, Miami Marlins, MLB, New York Yankees, San Diego Padres, San Francisco Giants, Washington Nationals

View the original article here

Anatomy of a bug: latest Firefox 'new tab' feature thumbnails HTTPS pages

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

About a week ago, popular IT news site The Register announced a security hole in Firefox.

Under the headline Firefox 'new tab' feature exposes users' secured info: Fix promised, El Reg decried the most recent Firefox release as "unlucky version 13".

The story ended up pretty widely reported, and Mozilla has publicly promised a fix.

But is this really a bug? If so, is it serious?

Even more importantly, do any of the workarounds popping up online actually do what they claim?

We decided to investigate - which took a lot more fiddling, digging and experimentation than you might think. (Unless you're a software tester. If so, you already know how explosively configuration options combine.)

Example of a New Tab page with images thumbnailed during earlier browsing

The controversial feature is Firefox 13's updated 'new tab' system. This takes thumbnail snapshots of sites you visit, and replays them later when you use the New Tab window.

The thing which outraged Register reader Chris, and led to all the news coverage, is that the thumbnails include images of content accessed over HTTPS, such as banking transactions and webmail sessions.

That much is true.

I opened a series of HTTPS pages looking like this:

Then I exited Firefox and reloaded it.

At this point, the New Tab page did indeed clearly reveal the content of my earlier secure browsing:

In hindsight, this is a bad idea, given Firefox's default privacy settings. I'm glad Mozilla has committed to change it.

If you permit Firefox to retain cached information from day to day in this form, anyone with even momentary access to your browser in the future can hit Ctrl-T or Command-T, and may immediately get a look at personal information you wouldn't expect to have been be preserved.

Nevertheless, HTTPS doesn't promise encryption at all times. The S-for-secure component applies only during the HTTP part of the transaction - the data transfer. It's worth keeping that in mind.

Whatever is inside an HTTPS request, and inside its corresponding reply, must exist in unencrypted form at each end of the conversation in order to be of any use.

That means both your browser and the server you're talking to may - indeed, probably will - end up with a permanent record of the transaction's content, even though it was encrypted during transmission.

In fact, that's exactly what happens in Firefox, version 13's New Tab thumbnails notwithstanding.

Even if you turn off the thumbnail display (clicking the matrix icon on the New Tab screen will do that for you), the contents of your HTTPS pages may very well end up in the Firefox cache anyway.

(When a web page is sent to your browser, whether securely transmitted or not, the server gets to say if and how it should be cached. The server does this by setting an Expires: or a Cache-Control: header in the HTTP reply.)

In my HTTPS experiments, turning off the thumbnails didn't do anything about Firefox's cache.

Here's what I saw after clearing all history and repeating my tests with thumbnail display turned off. I examined the cache with the special about:cache URL:

Zooming in to the seven files listed as cached shows three of the URLs duplicated - the HTTPS pages I visited in the test.

The objects denoted No expiration time are the thumbnail images; their partners are the original, decrypted, HTTP replies:

Zooming in to any of the files in the list brings up the complete HTTP header and body data in the reply:

So the new-found data leakage due to the thumbnails is a bit of a red herring.

The information from which Firefox 13 builds its thumbnails has been there all along in previous Firefox versions.

The cache isn't quite as easy to get to as the New Tab window, but it can still be accessed directly from your browser. Also, of course, it contains not just highly-compressed snapshots of your web pages at specific instants, but an exact history of all their components.

Your best bet for getting rid of cached content - which, as we have seen, includes the very thumbnails that got Register reader Chris worried in the first place - is to use Firefox's existing privacy features to purge old browsing data promptly.

Keeping a detailed record of your browsing history and maintaining it between sessions is convenient, but insecure.

A little inconvenience goes a long way towards improving security, which is why I recommend a Firefox privacy configuration similar to this:

I also recommend that you use the Clear Recent History... command as a matter of routine whenever you finish an online transaction involving personally identifiable imformation.

You'll find the history-clearing dialog in the Tools menu.

Finally, as I promised earlier, what about the "thumbnail bug" workarounds you'll find online?

You may be tempted to use a workaround until Mozilla adapts the behaviour of its 'new tab' system to exclude HTTPS pages.

For example, you may have read about the browser.newtabpage.enabled option you can change in about:config.

I've also read that you ought to change the other two newtab-related settings you can see here, too:

Bad news. This isn't actually a workaround at all. It feels like one, because the thumbnails no longer appear if you tweak the settings above.

But the thumbnails are still collected, are still held in the cache, and are still accessible by visiting about:newtab and clicking the matrix icon.

In conclusion, if this whole issue really is a bug, it's more of bug in our attitude to retaining browser data between sessions than a bug in the Firefox code.

Even when Mozilla "fixes" any thumbnail concerns you might have, I'll still be advising you to get much more aggressive about how often and how thoroughly you clear out your browser history...

Follow @duckblog
-

View the original article here

Authenticity of Web pages under attack by hackers - USA Today

The keepers of the Internet have become acutely concerned about their ability to protect the most sensitive personal information such as account logons and credit card numbers.

USA TODAY

Hackers cracked three companies that work with the most popular Web browsers to ensure the authenticity of Web pages where consumers type in sensitive information.

The hacked firms are among more than 650 digital certificate authorities (CAs) worldwide that ensure that Web pages are the real deal when displayed by Microsoft's Internet Explorer, Firefox, Opera, Apple's Safari and Google's Chrome.

A hacker gained access to digital certificate supplier DigiNotar this summer and began issuing forged certificates for dozens of marquee companies.

Unable to cope with the fallout, the Dutch company filed for bankruptcy last week. Two other digital certificate companies, New Jersey-based Comodo and Japanese-owned GlobalSign, were similarly hacked this summer, exposing a glaring weakness in the Internet's underpinnings.

"The infrastructure baked into the Internet, which is based on trust, is starting to fall apart," says Michael Sutton, research vice president at security company Zscaler.

CAs digitally certify account sign-ins, shopping and other pages where consumers type sensitive data. This sets up an encrypted connection to the Web browser, which displays the form for the consumer to fill out. The browser trusts only digitally signed pages.

A counterfeiter issued valid DigiNotar certificates for 531 faked pages. Some of the pages were crafted to expertly impersonate online properties of Google, Microsoft, Skype, Equifax, Twitter, Facebook and the CIA, among others, according to consulting firm Fox-IT.

This touched off a scramble to cut off the faked pages, which were difficult for consumers to spot as faked.

The successful hacks demonstrated that it is possible to "impersonate any site on the Internet," says Josh Shaul, chief technical officer at security company AppSec.

No banks or payment-service websites were targeted, says Mikko Hypponen, chief researcher at anti-virus company F-Secure. The hackers seem much more interested in harvesting personal data from e-mail services, social networks, credit bureaus, blogging sites and anonymity services.

The pressure is on CAs and browser makers to do more to identify and quickly eradicate counterfeit certificates and faked Web pages, security experts say. "No one knows where the next breach will occur," says Jeff Hudson, CEO of digital certificate management company Venafi.

Microsoft, maker of Internet Explorer, declined to comment, as did Apple, maker of the Safari browser. "The security of the Web is our collective responsibility," says Johnathan Nightingale, Mozilla's director of Firefox engineering.

For more information about reprints & permissions, visit our FAQ's. To report corrections and clarifications, contact Standards Editor Brent Jones. For publication consideration in the newspaper, send comments to letters@usatoday.com. Include name, phone number, city and state for verification. To view our corrections, go to corrections.usatoday.com.

View the original article here