Sunday, November 30, 2008

FEDs can lojack mobiles without telco help

| w0lf |
An article states that government can determine location of mobile phones without the help of Telco. They can do this by cell-site simulators or digital analyzers called Trigger-Fish. Well nothing new about this technology. It had been well known from Mitnick's time when Tsutomu Shimomura used to track him.

But recently there had been many issues as
ACLU and Electronic Frontier Foundation have received several batches of Justice Department documents in response to the Freedom of Information Act (FOIA) request (and subsequent lawsuit) for records relating to the government’s use of cell phones as tracking devices. This has raised an alert lately as they will do this without court permissions.

Triggerfish is supposedly to be sold only to law enforcements and was agreed to be used only with proper court permission. But recent buzz seems that the later is not required. So the American Civil Liberties Union and the Electronic Frontier Foundation (EFF) filed a lawsuit in July 2008 urging a federal court to order the Department of Justice (DOJ) to turn over records related to the government's use of people's cell phones as tracking devices.

As one of the documents intended to provide guidance for DOJ employees explains, triggerfish can be deployed "without the user knowing about it, and without involving the cell phone provider." That may be significant because the legal rulings requiring law enforcement to meet a high "probable cause" standard before acquiring cell location records have, thus far, pertained to requests for information from providers, pursuant to statutes such as the Communications Assistance for Law Enforcement Act (CALEA) and the Stored Communications Act.

Tuesday, November 25, 2008

Gmail flaw can make you lose your domain or more

| Armando Romeo |
Yesterday a new POC appeared online. A new Gmail flaw, a mixture of CSRF and XSS, targeting gmail filters is capable of taking out accounts by redirecting your emails to attacker owned email addresses.

The Gmail filter is capable of setting up rules based on the sender email address. These rules include redirecting to another email account and deleting the message. This is just what Brandon needed to setup his Godaddy's account hijacking POC.

The attack goes as follows:
  • The victim's Gmail cookie is stolen to unveil the GMAIL_AT value. This is a session-bound authorization key needed later in the attack (XSS)
  • The victim is induced into visiting Gmail triggering a new filter that redirects all the emails coming from an online service, for the POC Godaddy. The victim must have used the Gmail email to register on the online service. This is where the GMAIL_AT values turns useful as the CSRF request to add a new filter needs this value to be successfully triggered (CSRF)
To take over the Godaddy account, Brandon used the Reset Password form. Godaddy's authorization code to reset the password would then be redirected to the hacker's email.

This can be adjusted to a number of other services online.
The attack is not as easy as it seems. The most difficult part is to retrieve the GMAIL_AT value through a xss. Using NoScript would help while waiting for Google to patch the flaw.

Monday, November 17, 2008

Web 2.0? Brothel of Social media whores

| Armando Romeo |
Web 2.0 is not just a bunch of new technologies melt together to build a new concept of the web.
It's turning upside down the way the web was conceived at first.
In the old web, websites fed visitors through contents. With web 2.0 visitors feed websites
with their own content. What is bad in my opinion is taht, in the last 2 years of web 2.0 this content has been our own lives, photos, postal addresses, habits, likes and dislikes. (Well actually not mine).

People has been feeding these websites with almost everything they can say about themselves. (With a bunch of made up lies to appear smarter).
If there was so many smart people as Facebook profiles show, there would be no Facebook at all probably.

Although you will never see my name on Facebook or similar amenities, I wouldn't blame Facebook and the other social networks.

They are just giving people what they have been waiting for years. Their 15 minutes of fame camouflaged under the "connect with your friends". And they made some good cash too.

Have you ever seen people fighting in real life and then be "friends" on Facebook. Well I have.
I'm amazed at how good such websites are to have people make up with each others.

Facebook is the most successful peacekeeper after 2nd world war.

I can't help the rapid growth of social media whores, (smores as Kawasaki uses to call them) but I sure can be concerned at how these social networks have distorted the use of the web 2.0 in terms of privacy. People is still too freaked out to listen to these rants. The hype will go on for a while. Privacy is a void word. Has it any meaning nowadays anymore?

...when your President silently grants legal immunity to telco companies systematically abusing of your privacy ?Retroactively.

With Social networking explosion, someone has ranted about privacy and the social impact this may have.
Someone smarter has seen a business through it. New start ups have been raised up from these concerns.
Not helping it. But worsening it.
Or just proving that the rants of the old school people had some truth.
At least they say it clear:

Pay to know people's life before you hire them. Cause they're on Facebook. How to blame them.
You see the forest. If you pay you see the tree and all his leaves.

Spokeo is amazing. Take some minutes to try it. Cause it gives amazing results. It's a good termometer of yourself positioning in the smores chart.

But it's not the only. Wink is another. YoName another.

Coca-Cola, Blockbuster, Verizon, Sony Pictures and Condé Nast have come on board. On Facebook board. Guess what? How do you think they will use your habits?

Why spending millions on ads on TV shows. TV is in broadcast. Facebook is targeted.
Social Networks is a breakthrough for Marketing. Same as Switches versus Hubs.

I'm waiting for new technologies of photo-recognition through.
Recognizing acne from your picture can be so compelling to cosmetic companies marketing dept.
Don't you think?

Ah btw, if you want to increase your Facebook friend list, here is a smore telling us how
So I'll start.

Free Security Magazines