SSCC 97 - Black Hat and DEF CON review, broken crypto, Frak, smart meters and hacking transit

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

This Chet Chat is the last one from our summer hiatus and features Peter Szabo and I discussing a few more of our favorite talks from Black Hat and DEF CON 2012.

I started our discussion with Moxie Marlinspike and David Hulton's talk "Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2". They explained some of the mistakes Microsoft engineers made in their implementation of MS-CHAPv2 a common authentication protocol used for VPNs and WiFi access points.

Because of these flaws, the cryptographic strength is somewhere in the neighborhood of 56 bits. This allowed Marlinspike and Hulton to launch a service using general purpose FPGAs that can crack any key in 24 hours or less for approximately $200.

Peter went to a talk on reverse engineering firmware titled "Embedded Device Firmware Vulnerability Hunting Using FRAK, the Firmware Reverse Analysis Konsole". The tool is not yet available, but will be released allowing anyone to peer inside of firmware blobs for printers, routers, phones or any other flashable device.

I attended a very sensible talk about smart meter security called "Looking Into The Eye Of The Meter" in reference to the infrared "eye" that can be used to talk to this latest generation of meters.

SecureState have released a toolkit to assist others in performing vulnerability assessments of meter infrastructure.

Pete wrapped up by sharing the entertaining talk he attended on hacking public transit systems called "How to Hack All the Transport Networks of a Country". The presenter explored all the different ways that technical skills and social engineering can be combined to manipulate any large, complicated system.

(10 August 2012, duration 14:34 minutes, size 8.4 MBytes)

You can also download this podcast directly in MP3 format: Sophos Security Chet Chat 97, subscribe on iTunes or our RSS feed. You can see all of the Sophos Podcasts by visiting our archive.

http://twitter.com/chetwisniewski

View the original article here

Bay Area transit system sets meeting about cutting off cell service - CNN

BART suspended cell service in spots July 11 to thwart demonstratorsThe move elicited harsh criticism from civil liberty advocates and othersThe transit system calls the move necessary to ensure public safetyBART's board plans to meet on Wednesday to discuss the matter

(CNN) -- Board members of San Francisco's rapid transit system will convene a special meeting next week to discuss the controversial decision this month to cut off cell service in selected stations.

The August 11 move by the Bay Area Rapid Transit System (BART), in an apparent attempt to head off protests against its police officers, drew sharp condemnation from free speech advocates and spurred hackers to launch attacks on the system's website and internal network.

In a letter to passengers sent Saturday and signed by the board's president, Bob Franklin, and interim general manager Sherwood Wakeman, BART defended the decision in claiming it was done "out of an overriding concern for our passengers' safety."

The letter referenced a July 11 protest, in which people railed against the system after several shootings involving its police officers -- the latest coming last month and resulting in the death of 45-year-old Charles Hill.

That spirited and largely peaceful rally at the city's Civic Center stop was organized by a group called "No Justice, No BART," which formed after the 2009 shooting of an unarmed passenger by a BART police officer.

But at the demonstration, video shows one person climbing atop a subway train, before being pulled down. BART also noted in its letter that the protesters blocked doors and generally delayed roughly two-thirds of trains running during the rush-hour commute.

"These actions violated the law by creating a serious threat to the safe operation of the BART system," wrote the agency.

BART police department members learned of another planned protest about a month later, deciding to suspend cell phone service for three hours at select locations in hopes of preventing demonstrators from organizing.

That decision elicited criticism from civil liberty organizations, the San Francisco Chronicle's editorial page and others.

"All over the world people are using mobile devices to organize protests against repressive regimes, and we rightly criticize governments that respond by shutting down cell service, calling their actions anti-democratic and a violation of the rights to free expression and assembly," Rebecca Farmer from the ACLU's northern California office wrote on the advocacy group's website. "Are we really willing to tolerate the same silencing of protest here in the United States?"

Online messages attributed to Anonymous took credit for the apparent hacking last Sunday of myBART.org, a link off BART's website that showed a page featuring, among other items, the hacking group's logo -- a smirking mask above two crossed swords, all on a black background.

In addition, Twitter traffic related to Anonymous boasted that hackers had been able to get into BART's internal network.

"By (cutting cell service), you have not only threatened your citizens' safety, you have also performed an act of censorship," a seemingly computer-generated voice -- speaking over dramatic music and images -- said in a video posted online Sunday afternoon. "By doing this, you have angered Anonymous."

The Federal Communications Commission is collecting information on the matter, with agency spokesman Neil Grace saying Monday by e-mail that "any time communications services are interrupted, we seek to assess the situation."

"We ... will be taking steps to hear from stakeholders about the important issues those actions raised, including protecting public safety and ensuring the availability of communications networks," Grace said.

BART closed, then reopened stations to thwart demonstrators when they gathered again Monday but -- while its officials did not rule out the possibility before -- there was no indication that the suspended cell service again.

In its letter Saturday, BART spoke to First Amendment concerns, stating it recognized people's right to protest "where it can be done safely and without interference with BART's primary mission of providing safe, efficient and reliable public transportation service."

But the letter insisted that suspending cell phone service "did not affect any First Amendment rights of any person to protest in a lawful manner in areas at BART stations that are open for expressive activity. The interruption did prevent the planned coordination of illegal activity on the BART platforms, and the resulting threat to public safety."

The special board meeting to discuss the matter will occur Wednesday, the letter stated.

View the original article here

Hackers gain access to transit police union site

Paul Elias, Associated Press, On Wednesday August 17, 2011, 8:56 pm EDT

SAN FRANCISCO (AP) -- Hackers launched another online attack Wednesday against a California transit agency that found itself in the middle of a debate about free speech after it turned off cell phone service in its stations to thwart a potential protest.

This time, hackers gained access to the website of the union that represents Bay Area Rapid Transit police and posted personal information on more than 100 officers.

The officers' home and email addresses were leaked along with passwords.

BART Police Deputy Chief Daniel Hartwig said his office was aware of the breach and referred inquiries to the BART Police Officers Association. Union president Jesse Sekhon didn't immediately return a phone call seeking comment.

The union's website was disabled later in the day.

The hackers group Anonymous announced the most recent breach on Twitter and published the address of the website where the information could be found.

However, Anonymous didn't immediately claim responsibility for the hack, as it did when it broke into BART's marketing website last week and released the personal information of more than 2,000 customers.

"No one claimed responsibility for the hack," Anonymous said in a Twitter post. "Some random joe joined a channel and released the data to the press."

BART interim General Manager Sherwood Wakeman condemned the latest "attack on the working men and women of BART."

"We are deeply concerned about the safety and security of our employees and their families," he said in a prepared statement.

The two hacks came in apparent retaliation for BART cutting wireless communication in its San Francisco stations Thursday night to quell a brewing protest over a police shooting.

The agency took that action after demonstration organizers said they would issue last-minute instructions in text messages and on social networks about where to gather and disrupt the evening commute. The demonstration was planned over the July 3 BART police shooting and killing of Charles Blair Hill, 45. The police allege the transient lunged at them with a knife.

A demonstration on July 11 over the shooting disrupted the evening commute, as one protester scrambled on top of a train, halting all BART transit in San Francisco for 30 minutes.

The decision to cut wireless communication to head off another protest Thursday put the transit agency in the middle of a worldwide debate over free speech, social networks and public safety.

The action was compared unfavorably to Hosni Mubarak's attempt to shut Internet access in Egypt before he was forced from office by mass demonstrations.

BART's action is widely believed to be the first time a U.S. governmental agency cut wireless communication to quell a protest.

BART chief spokesman Linton Johnson said Tuesday it was his idea to cut the power, and the tactic was vetted by police and approved by the agency's general manager, who previously served as BART's top attorney.

Johnson defended the tactic as legal and appropriate to ensure a safe commute.

The planned protest never materialized Thursday and all trains were on time that night.

The Federal Communications Commission is looking into BART's action while the FBI is investigating the hack of mybart.org last week.

View the original article here

Hackers protest transit blocking of cellphones

SAN FRANCISCO (AP) — San Francisco's mass transit system prepared for renewed protests Monday, a day after hackers angry over blocked cell phone service at some transit stations broke into a website and posted company contact information for more than 2,000 customers.

The action by a hacker group known as Anonymous was the latest showdown between anarchists angry at perceived attempts to limit free speech and officials trying to control protests that grow out of social networking and have the potential to become violent.

Anonymous posted people's names, phone numbers, and street and email addresses on its own website, while also calling for a disruption of the Bay Area Rapid Transit's evening commute Monday.

BART officials said Sunday that they were working a strategy to try to block any efforts by protesters to try to disrupt the service.

"We have been planning for the protests that are said to be shaping up for tomorrow," BART spokesman Jim Allison said. He did not provide specifics, but said BART police will be staffing stations and trains and that the agency had already contacted San Francisco police.

The transit agency disabled the effected website, myBART.org, Sunday night after it also had been altered by apparent hackers who posted images of the so-called Guy Fawkes masks that anarchists have previously worn when showing up to physical protests.

The cyber attack came in response to the BART's decision to block wireless service in several of its San Francisco stations Thursday night as the agency aimed to thwart a planned protest over a transit police shooting. Officials said the protest had been designed to disrupt the evening commute.

"We are Anonymous, we are your citizens, we are the people, we do not tolerate oppression from any government agency," the hackers wrote on their own website. "BART has proved multiple times that they have no problem exploiting and abusing the people."

Allison described myBART.org as a "satellite site" used for marketing purposes. It's operated by an outside company and sends BART alerts and other information to customers, Allison said.

The names and contact info published by Sunday came from a database of 55,000 subscribers, he said. He did not know if the group had obtained information from all the subscribers, he said, adding that no bank account or credit card information was listed.

The BART computer problem was the latest hack the loosely organized group claimed credit for this year. Last month, the FBI and British and Dutch officials made 21 arrests, many of them related to the group's attacks on Internet payment provider PayPal Inc., which has been targeted over its refusal to process donations to WikiLeaks. The group also claims credit for disrupting the websites of Visa and MasterCard in December when the credit card companies stopped processing donations to WikiLeaks and its founder, Julian Assange.

BART's decision to shut down wireless access was criticized by many as heavy handed, and some raised questions about whether the move violated free speech.

The problems began Thursday night when BART officials blocked wireless access to disrupt organization of a demonstration protesting the July 3 shooting death by BART police who said the 45-year-old victim was wielding a knife.

Activists also remain upset by the 2009 death of Oscar Grant, an unarmed black passenger who was shot by a white officer on an Oakland train platform. The officer quit the force and was convicted of involuntary manslaughter after the shooting.

Facing backlash from civil rights advocates and one of its own board members, BART has defended the decision to block cell phone use, with Allison saying the cell phone disruptions were legal because the agency owns the property and infrastructure.

"I'm just shocked that they didn't think about the implications of this. We really don't have the right to be this type of censor," Lynette Sweet, who serves on BART's board of directors, said previously. "In my opinion, we've let the actions of a few people affect everybody. And that's not fair."

Laura Eichman was among those whose email and home phone number were published by the hackers Sunday.

"I think what they (the hackers) did was illegal and wrong. I work in IT myself, and I think that this was not ethical hacking. I think this was completely unjustified," Eichman said.

She said she doesn't blame BART and feels its action earlier in the week of blocking cell phone service was reasonable.

"It doesn't necessarily keep me from taking BART in the future but I will certainly have to review where I set up accounts and what kind of data I'm going to keep online," Eichman said.

Michael Beekman of San Francisco told the AP that he didn't approve of BART's move to cut cell phone service or the Anonymous posting.

"I'm not paranoid but i feel like it was an invasion of privacy," he said. "I thought I would never personally be involved in any of their (Anonymous') shenanigans."

The group Anonymous, according to its website, does "not tolerate oppression from any government agency," and it said it was releasing the User Info Database of MyBart.gov as one of many actions to come.

"We apologize to any citizen that has his information published, but you should go to BART and ask them why your information wasn't secure with them," the statement said.

___

Associated Press writers Terry Tang and Bob Seavey in Phoenix also contributed to this report.

View the original article here