Gizmodo's Twitter account hacked

Hackers gain access through a former employee's Twitter account, which they breached first.

Gizmodo's Twitter account was hacked Friday by a group called Clan VV3. The breach didn't last long, but it was enough to send racist and offensive messages to the account's 415,000 followers.
The attackers apparently gained access to the Gizmodo account after compromising former employee Mat Honan's e-mail and Twitter account.
Read more of "Gizmodo's Twitter account hacked" at ZDNet.

Hackers reveal critical vulnerabilities in Huawei routers

Security researchers disclosed critical vulnerabilities in routers from Chinese networking and telecommunications equipment manufacturer Huawei at the Defcon hackers conference on Sunday.
The vulnerabilities -- a session hijack, a heap overflow and a stack overflow -- were found in the firmware of Huawei AR18 and AR29 series routers and could be exploited to take control of the devices over the Internet, said Felix Lindner, the head of security firm Recurity Labs and one of the two researchers who found the flaws.
Huawei is one of the fastest growing providers of networking and telecommunication equipment in the world. Huawei equipment powers half of the world's Internet infrastructure, Lindner said.
The researcher, who also analyzed the security of Cisco networking equipment in the past, described the security of the Huawei devices he analyzed as "the worst ever" and said that they're bound to contain more vulnerabilities.
During the Defcon talk, which Lindner gave together with Recurity Labs security consultant Gregor Kopf, the researchers pointed out that there are over 10,000 calls in the firmware's code to sprintf, a function that's known to be insecure.
"This stuff is distrusting," said security researcher Dan Kaminsky, who is best known for discovering a major vulnerability in the world's DNS (Domain Name System) infrastructure in 2008 and who worked for Cisco in the past. "If I were to teach someone from scratch how to write binary exploits, these routers would be what I'd demonstrate on."
"What FX [Lindner's moniker in security circles] has shown is that the 15 years of secure coding practices that we've learned about -- the things to do or not do -- have not been absorbed by the engineers at Huawei," Kaminsky said.
According to the Huawei website, the AR series routers are used by enterprises and AR18 in particular is marketed as product intended for small and home offices.
The Recurity Labs researchers specified during the talk that they didn't test any "big boxes" like the Huawei NE series routers -- which are intended for telecom data communication networks -- because they couldn't obtain them.
Lindner and Kopf also criticized Huawei for its lack of transparency when it comes to security issues. The company doesn't have a security contact for reporting vulnerabilities, doesn't put out security advisories and doesn't say what bugs have been fixed in its firmware updates, the researchers said.
"If I don't know who to contact, I can't tell you about your bugs and this happens," Lindner said, referring to the public disclosure of vulnerabilities.
The researcher hopes that this will be a wake-up call for Huawei customers. The only way to force a company to build more secure products is to make the customers ask for it, like it happened in the past with Microsoft, Cisco or Apple, he said.

Cybersecurity: Bit9 Raises $34.5M From Sequoia, Others For Its Whitelist Approach To Fighting Attacks

Hacking, viruses, megabreaches and other cybercriminal activity are on the increase, and cybersecurity specialists Bit9, which works with 30 of the Fortune 100 companies, has today announced a significant round of funding, $34.5 million, to help fight it. The Series D investment, the biggest yet for Bit9, was led by new investor Sequoia Capital, with participation from existing investors Atlas Venture, Highland Capital Partners, Kleiner Perkins Caufield & Byers, and .406 Ventures.
The growth of cybercrime has massively increased the need for companies to protect their data, and that is giving rise to a number of new approaches for how to do that most effectively. Bit9′s approach plays on a new trend among cybersecurity companies: traditional protection is based around the concept of a blacklist of forbidden sites, but Patrick Morley, the CEO of Bit9, notes that his company turns this on its head to focus not on what shouldn’t be allowed in, but only on what should — the so-called “whitelist” approach to the problem.
The idea, he says, is to trust only sites that are known, rather than trying to account for the ones that are not. The reason for this, he says, is because viruses, worms and the people who create them are regularly changing what they are doing, so to try to account for all that is bad and new is virtually impossible. “The challenge with security is that it is hard because to create new threats is so easy that they pass right through” an existing blacklist security wall, he tells me. 
Think of the old approach as a flu shot: these tend to only account for the most common strains, and so that means you can still catch a flu if its a new one that hasn’t been included in the seasonal shot.
Up to now, this approach has given Bit9 some significant accolades. Morley notes that Bit9, which says it works with some 700 organizations in total (although it doesn’t name any of them) and says it’s growing at 100 percent annually in terms of business, was the only company in the world to date that has been able to stop the Flame virus (or at least publicly state that it has…), and it was the only one that stopped the RSA breach. On Flame, he notes that the block was almost inadvertent. It simply was not on its whitelist for a particular customer: “We stopped it not because it was Flame, but because it was not trustworthy,” he says.
Morley says that the changes in cybersecurity have really started to take place in the last 24 months — not just in terms of attacks being ramped up, but also because enterprises have become much more aware of the issue of breaches. He says that these days the conversation is happening at board level, with companies increasingly away of “how risky things are.”
As we heard earlier this year in Verizon’s big cyber security report, the biggest threats today, he says, come from organized crime, nation states looking for IP from other countries and hacktivists like Anonymous.
Going forward, Morley says that Bit9 plans to extend its whitelist approach to cover more platforms than it does today, with some of those developments to come in the next two quarters. He says the company already sees success covering security on laptops and desktops, as well as data centers and infrstructure, “but if you think about it the move to mobile, bring your own device and cloud” are also becoming increasingly significant areas, he says. These are also areas that Bit9 will seek to further incorporate into its support.
The cost for cybercrime attacks — according to the Ponemon Institute, which interviewed 50 companies — is now at $5.9 million, with the highest now $36.4 million.

US National Security Agency boss asks hackers to make internet more secure

The head of the American government's secretive National Security Agency has taken the unprecedented step of asking a convention of computer hackers to join him in an effort to make the internet more secure.
In a speech to the 20th annual Def Con gathering in Las Vegas, the four-star general Keith Alexander stressed common ground between US officials and hackers, telling them privacy must be preserved and that they could help by developing new tools.
"You're going to have to come in and help us," Alexander told thousands of attendees.
The conference founder, Jeff Moss, known in hacking circles as the Dark Tangent, told the conference he had invited Alexander, who rarely gives speeches, because he wanted them to learn about one of the world's "spookiest, least known" organisations.
Attendees were respectful and gave modest applause, though several said they were concerned about secret government snooping and the failure of authorities thus far to stop foreign-backed attacks.
"Americans pay taxes so that federal agencies can defend them," said a researcher who asked not to be named. "I see it as a hard sell asking a business entity to spend money for the common good."
Alexander won points by wearing the hacker "uniform" of jeans and a tee shirt, wandering the halls and praising specific hacking efforts, including intrusion detection tools and advances in cryptology.
He also confronted civil liberties concerns that are a major issue for many researchers devoted to the internet.
Taking questions screened by Moss, Alexander denied that the NSA had dossiers on millions of Americans, as some former employees have suggested.
"The people who would say we are doing that should know better," he said. "That is absolute nonsense."
Alexander used the speech to lobby for a cyber security bill moving through the Senate that would make it easier for companies under attack to share information with the government and each other as well as give critical infrastructure owners some reward for adhering to future security standards.
"Both parties see this as a significant problem," he said, adding that the experts like those at Def Con should help in the process. "What are the standards that we should jointly set that critical networks should have?"
In addition to conducting electronic intelligence gathering, primarily overseas, the defence-department-controlled NSA is charged with protecting the American army from cyber-attacks.
Increasingly, it has been sharing its findings with the FBI to aid in criminal cases and with the department of homeland security, which warns specific industries of new threats.
Displaying a slide with the logos of several dozen of companies breached by criminals or spies in the past two years, Alexander said only the most competent even knew they had been hacked.
"There are 10 times, almost 100 times more companies that don't know they have been hacked," he said.

Hackers build private 'Ninja Tel' phone network

Hackers built their own GSM network at Defcon, Ninja Tel, and distributed customized Android phones with fun apps.

Hackers who spent their teen years phone-phreaking -- breaking into telephone networks and making free calls -- have created their own GSM network at Defcon and are using creative and silly apps on highly customized Android phones.
The Ninja hacker group is giving the phones away to people who have contributed to the community, and to their lucky friends. The phones and accompanying lanyards serve as "badges" that provide entrance to the annual Ninja party tonight. (Defcon attendees can also get in by donating blood or signing up to donate bone marrow, or donating money to the Electronic Frontier Foundation.)
The phones are HTC One V phones running Android 4.0.3. Calls can be routed over the private GSM network or over Defcon's Wi-Fi network. The network is not encrypted and there is no emergency call phone number.
The "Ninja Tel" network is "the biggest open BTS (base transceiver station) network ever," said Ninja Michael J.J. Tiffany. BTS networks are designed to allow for software-based switching technology that can be housed in small spaces, such as a van.
The Ninja Tel van, complete with official looking logo and hard-hat wearing workers, has a GSM base station; a 12-foot antenna; networking and Web app servers; and other equipment and is parked in a large room at Defcon. The project took about 10 months to complete, Tiffany said.
There are 650 phones on the private network, with people making phone calls, texting, chatting, holding conference calls, and playing a sword-fighting game. There are additional apps being created by people who are using the phone through Android's IDE (Integrated Development Environment).
People choose their own phone number and username and can have their photos taken so that their face shows up in everyone's contact list. Once the customized Ninja SIM card is inserted, a special terms of service written by a Ninja who is a lawyer is displayed and the phone receives a call with a fun welcome message recorded by Pat Fleet, who is the voice of AT&T.
The interface has a retro look and feel with screens reminiscent of the yellow pages and other classic elements, created by Pinguina, a designer at Universal. Ninja attention to detail is seen in every interaction, such as the sword sound that's made by the phone when the screen is unlocked.
A popular app is BoozeFone, a play on MovieFone, which gives options such as press 1 for Vodka, 2 for Jack Daniels, and 3 for PBR and has a humorous recorded audio message for each. People can notify the system that they have booze and what type, and when someone calls in and requests that item the two will be connected.
There is a vending machine app that interacts with customized Coke machines to dispense swag, but Tiffany declined to say exactly what, not wanting to spoil the surprise for people using the machines at the party.
Ninjas declined to say how much the operation cost for the phones and all the equipment, paid for and otherwise supported by Facebook, Zynga, AllJoyn, and Lookout, whose workers worked on the Android development.
"The goal was to create a network that could be explored to give people an experience they haven't had since we were kids," Tiffany said. "It's not just a phone network. It's a phone network that has a lot of goodies.... We laid down the infrastructure and people are bringing the party to this network. It's an interactive experience."
Given that it is a hacker conference it's no surprise that people are trying to hack the network and take it down, but so far there has been only one known attempt to jam the network, and it failed, Tiffany said.
Creating a phone network purely for play is classic hacker MO and, in particular, typical of this group.
"We are a constructive group," Tiffany said. "We have a name and we did it not by being bad. Not breaking anything or taking anything down. We're creating our own network. That's Ninja style."