"Bitcoin Jesus"

34 Year Old Robert Ver Bergan invested in Bitcoin in 2011 when the price was right around $1 per Bitcoin. Now with prices currently hovering above $1,000 he is a virtual millionaire. Because of his wealth, he has earned the nickname "Bitcoin Jesus."


Here's the full article: http://www.cnbc.com/id/101237537


I don't understand the big fuss! IT IS VIRTUAL MONEY! It's not real money. The most you can do is sell them to receive an Amazon or iTunes gif card. Nobody accepts them as cash. I can't believe that this has caught on and people are actually buying and selling these things. To me this is like a Wall Street Banker trying to buy my Monopoly money from me. It's only real value lies in the gift cards, you can at least, in turn, use them to purchase things. How idiotic are the sites that are exchanging these gift cards for Bitcoins. They're just losing money.

Overall it's just people exchanging money for no reason. You can't just create a new currency. The only way Bitcoin could actually be effective is if the government got involved to somehow give them worth. But until then, I don't see any major business using them.

Windows XP is in the news?!

Just prior to Thanksgiving, Microsoft issued an advisory about the bug (CVE-2013-5065), which lies in the kernel component of Windows XP and Windows Server 2003. Apparently, the attacker can excute code through the kernel mode, then the attacker goes to “install programs; view, change or delete data; or create new accounts with full administrative rights.” 

"FireEye researchers Xiaobo Chen and Dan Caselden revealed in a blog post that to target users, in-the-wild attacks had been detected where the kernel vulnerability was used in conjunction with an Adobe Reader exploit."


The article goes on to say that if you have the most current version of Adobe Reader, you are not susceptible to this kernel attack. So, patch your systems, people. 

I'm really wondering, who the hell still has Windows XP?! My grandmother doesn't have Windows XP and she's 76! And if you're hacking Window's XP what are you looking for?! Photo's of somebody's childhood vacation?! 


UPDATE YOUR SYSTEMS, PEOPLE!

Anonymous is Back at it Again

On Monday, Anonymous posted on PasteBin taking credit for an attack targeting Japanese Microsoft websites. This was the post on pastebin.com

1. Greetings Citiziens of the World
2. And Greetings Microsoft
3. We are Anonymous...
4.  
5. A couple days ago a DDoS attack was launched at Japanese Microsoft(Domain) Websites and Servers.
6. We are sorry to report that the Japanese Microsoft Websites and Servers did not go down as planned.
7. Although something did go down.
8. We took the pretty much the entire Microsoft domains down.
9. That includes sites such as:
10.  
11. Hotmail.com
12. MSN.com
13. Live.com
14. outlook.com
15. Microsoft.com
16.  
17. The DDoS attack was launched in response to Taiji...Operation KillingBay OR #OpKillingBay
18. Although We are sorry for any inconvenience We caused you Microsoft...It's the thought that counts right?
19.  
20. For the record Microsoft, We love the "XBOX-One"  and the games it offers (CODGhost)
21.  
22. F**K the Japanese Language
23.  
24.  
25. We do not Forgive
26. We do not Forget
27. We are Legion
28. We are Anonymous
29. Expect some F**king DDoD attacks Taiji
30. Expect us...12:1:13
31. #OpKillingBay

Credit: http://pastebin.com/P6KcaBjM


Apparently, they are upset about the slaughter of dolphins in the village of Taiji, Japan. Operation Killing Bay or #OpKillingBay is the protest against the slaughter.


Interesting that they apologized to Microsoft and complimented them on XBOX-One. Also "F**K the Japanese Language" seems a tad out of place and unnecessary.  I also don't think a DDoS attack is going to stop what is happening to the dolphins in Taiji. All in all, I don't really understand this attack, but I guess these guys have to keep busy somehow.

People Don't Take Precautions when Accessing a Public Wi-Fi Network...Shocker

AnchorFree a software security company and PhoCusWright a travel research firm conducted a study of 2,203 American travelers that have taken at least one leisure trip of 75 miles or more in the last year. And as you could guess, the statistics were alarming to people who have a security background. I've seemed to complain a lot on this blog so let's start out with something positive:

4 out of 5 people surveyed felt their personal information was not safe when using a public Wi-Fi network. So there's that.

But according to the study 84% of of people do not take action to ensure their data is secure. I attribute this to probably not knowing how to protect your data. The most visited sites for these travelers were banking websites, or commerce websites where they have to put in account data, such as credit cards. So people do not feel safe, but they still enter personal information into these sites while using public networks.

One other positive is 54% of respondents say they stay away from using personal information when using these public networks. YAY!

I'll admit I used to try to use and open Wi-Fi network when I was in an airport. But I was also, 13. Truth be told, I stopped because the Wi-Fi in airports were so terrible, I could never connect to them. I almost blame the airport for peoples actions. If they see the airport's Wi-Fi is free and can't get on, they might just go and try to join the next network available thinking it can do no harm. Maybe the airports should offer secure Wi-Fi that is built into ticket prices. You could receive your authentication when you check in. I could be your account number or something. I know that some offer a secure network once you a re sitting down waiting for your plane, but nobody wants to go through the hassle to join it when your device picks up other free networks. It could make more money for the airport, and keep peoples information more secure.


Here's the full article:  http://www.scmagazine.com//study-majority-of-us-travelers-dont-take-precautions-when-using-public-wi-fi/article/322956/

The FBI came to Syracuse

On Wednesday, Steve Vizyary of the FBI came to our IST 323 lab to discuss cyber security and hackers. Vizyary is based out of New York and specializes in tracking Jihads and their use of the internet. Here  are some of the main points I picked up on.

1. Soon hacking will be the number 1 threat to the country, over terrorism. This idea came from a quote from Vizyary's former director. But it's finally happening. Hacking is growing and growing. Soon hacking will be the form of terrorism. Countries will be hacking each other in order to try and get the upper hand.

2. A level 2 hacker is usually somebody searching for financial information. Sure, that's not too strange. But I found it strange that the 3 leading countries for this type of hacking are Russia, China, and Iran. These are 3 of the stronger economies in the world yet they are still trying to steal financial information. I find it peculiar. It's probably more mob/Mafia type of people doing these attacks. I'm not accusing any country of financial fraud or some type of crime but it does seem fishy.

3. One in eight spam messages are clicked on. ONE IN EIGHT! I can't believe that. It was harder for Shaq to shoot a free throw then for a hacker to catch somebody with a spam attack. I wouldn't think in 2013 that the number would be so high. I could maybe understand one in twenty. But one in eight?! Come on.

4. Hacktivists are the largest group of hackers around, but they are not that much of a threat. Mainly because these hackers are not that experienced, and some like to do it just for fun (like the Joker in Batman). But I see a lot of potential in Hacktivist if they were more organized and skilled. They could really cause major problems in computer security world wide.

5. The FBI's "arch-nemisis" is Industrial Espionage. I find the idea of it really cool. It's basically like Inception only with computers. Some hackers will break in and then patch the area so nobody can get in and then they can hide in the system they hacked.

Overal the talk today was pretty interesting. We also learned that malware is still the leading type of attack.

That's all for now.

--Chris

U.S. Caught Spying...Again

The Associated Press reported a story that the United Stated monitored over 60 million calls in Spain. A Spanish newspaper ,El Mundo, published a documentary on Monday that said the United States spied on over 60 million phone calls in one month.  A graph titled "Spain-Last 30 days" which depicted the call traffic between December 10, 2012 and Jan. 8, 2013. The document says the NSA monitored the numbers and durations of the calls, but not the content. El Mundo said the Metadata System the US used could monitor e-mails and text messages, but that was not shown on the graph. The document used for the documentary was one leaked by Edward Snowden, who, if you can remember, has asylum in Russia from the United Stated for information leaking.

Last week there was a report in the French newspaper, Le Monde, reported a similar story of allegations that the US had been spying on Chancellor Angela Merkel's cell phone. The same story was reported in a German magazine, Der Spiegel. US Ambassador James Costos, was summoned to Spain last week to discuss the United States targeting with Foreign Ministry. Afterwards the Ministry called on the US to hand over all information from the "supposed eavesdropping carried out in Spain.

I understand that when you are leading a country and you are concerned for there wellbeing, sometimes you might have to do things that aren't as ethical as we'd like them to be. But my concern is why are spying on our allies? Last I knew they were there so we could trust them and depend on them. This is a bad reputation for the US to have. These countries are very angry with what the Government has been doing, and rightfully so. We would be very upset if England or somebody was spying on us. We would feel exposed and violated. I know that we aren't the only country to be doing this. It's just sad that this is what it has come to.


Here is the full story: http://m.apnews.com/ap/db_289563/contentdetail.htm?contentguid=RVibRptQ

Google Chrome Doesn't allow Google Apps

We all praise Google. They are the best tech company to date, they're so innovated, everything that they do is so amazing!!! But I have found a hole in the great Google. The older version of Google Chrome does not allow you to use any of GOOGLE'S APPS. If you do not have the newest version of Google Chrome you are not allowed to use anything that isn't just a google search or Google Images. Gmail, Blogger, or Google Maps are all unreachable because of and incorrect certificate for the host. When I try to get on Google Maps in Chrome I receive a pop up message saying "The server presented a certificate that doesn't match built-in expectations. The expectations are included for certain, high security web sited in order to protect you." And then it says the servers certificate appears to be a forgery.

I find this EXTREMELY ironic that Google itself is not allowing it's own services. So obviously the smart move would be to delete Chrome and install the new version which is a hassle. But what if you can't download the new version? My girlfriend's Mac is so old that she is not able to download the newest Chrome because she does not have a new enough Mac OS. The kicker is, her computer does not have the ability to update itself any further. Her computer is stuck at Mac OS X 10.5.8.

So what do you do if you're in this position? You go to a different browser. For the user it is frustrating and funny (the irony). But think about if you're Google. There are people who cannot use your web browser they are going to go somewhere else which is bad for business.

Mozilla mobile OS hacked by a Teenager

Hey guys welcome back to I Stayed For Wake Forest. Let's dive back into some security news. 

Mozilla's Firefox mobile OS has been hacked by a 17 year old named Shantanu Gawde. Gawde, is the first person to infect Mozilla's OS with malware. The interesting part, aside from him being 17, is he will not share his secrets until the Ground Zero Summit in India in early November. 

Adam Greenberg of SCmagazine.com said "At the four-day information security event in New Delhi, Gawde will show how his malware will allow him to give commands to remotely access the phone's SD card, remotely transfer all contacts, track users' geographic location, control radio functions, and upload and download pictures, music and videos." 

Mozilla has said that they are aware of Gawde's plans to present at the conference. Mozilla reached out to Gawde in attempt to hear his findings before the conference, but because of rules of the conference he was not able to reveal anything. Mozilla believes that they have already figured out how Gawde attacked their OS. Andreas Gal, Mozilla vice president of mobile, said that such attacks rely on developer mode functionality, which is normally disabled on smart phones. Also Gawde said they believe in order for the attack to work that the phone must be physically connected to a computer controlled by the attacker, and unlocked by the attacker.  

I find it interesting that Gawde still planned to present at the Ground Zero Summit instead of turning in his secrets to Mozilla for what I'm sure would be a nice payday and could possibly turn into a job. I guess that Gawde believes that he is going to get an even bigger payday after his presentation. Maybe working out for the long run will pay off for him. 


Here's the full story: http://www.scmagazine.com/mozilla-addresses-teenagers-purported-mobile-firefox-os-malware/article/318056/  

Spam Growing on Social Media

Continuing on my social media spam train, a study conducted by Nexgate (published today) analyzed that over 60 million pieces of social media content contained a 355% jump in social spam over the last year. 355 PERCENT! 15% of this spam contained links to pornography and malware. I wrote yesterday how astonished I was that these attacks still existed. The article did not say how many of these attacks were a success. But if the jump was 355% these attacks must have some level of success.

I just don't understand it. I guess I have more faith in human intelligence than I should. Ok, that sounded mean. What I do mean is I find it shocking how people have not been informed. The first series of this blog has been about social engineering and how users interact with these attacks. But I have to remember, I grew up with this stuff. I'm guessing some of the victims did not grow up with the internet and social media. But it's like Chris Croad said, the battle is not with the hackers, it's educating people to know what to look for.

That's all for now. I'll be back soon.

--Chris

Breaking Bad Hackers

Breaking Bad has cultivated America. The hit show ends it 6 season run this Sunday. Because of this Hackers have used this as a way to attack viewers through Twitter. Spammers have been adding users to a Breaking Bad themed list on twitter. After users were added to the list they would see tweets saying "Leaked Breaking Bad" or "New Episode" and a Pastebin.com link. Satnam Narang, a security response manager at Symantic said "In order to open the large file, users are instructed to download the latest version of 7-Zip,"."The link directs users through an affiliate program, which is how scammers make money. The affiliate program directs users to an installer that comes bundled with other applications. Users can choose not to install these applications" he said. Apparently these list gain quite a lot of traction but were easily to remove yourself from.

I'm very surprised that this actually worked on people. But that's what people do. Sometimes they just don't think and click. I'm more surprised that this worked over a social media outlet. Most hacks over Facebook or Twitter are very easy to spot out; the links are rather sketchy looking. Statistics show that 30% of twitter are 18-30 year olds, so a lot of them grew up with Twitter and Facebook and you would think they would be able to spot this obvious hack.
Just today I heard a girl talking about how her Twitter got hacked and was sending strange message to people. The messages said "Recommended: (inset strange link)." The funniest part was I received a message just like that from somebody else a few hours after that. 

I'm surprised that these attacks still exist. Because they are so obvious I figure that Hackers wouldn't move on to something less out in the open. But maybe the out in the open attack is the best kind. Kind of like hiding in plain sight. 

iPhone has already been hacked

As we all were afraid of, the new iPhone fingerprint scanner has already been hacked. Yesterday mid afternoon Buzz Feed released and article saying the Chaos Computer Club has created a fake fingerprint using a photograph on transparent paper and then "pink latex milk or white wood glue is smeared in the pattern created by the toner onto the transparent sheet." 

Here's the article: http://www.buzzfeed.com/jwherrman/the-iphones-fingerprint-sensor-has-already-been-hacked

If you wanted to go through all that trouble to steal and crack into my phone go right a head. You deserve it. 

These hackers are obviously more advanced than your average thief. But lets look at this in the business world. According to an article on venturebeat.com there is about 300 million active iPhones. So obviously there are a lot of executives who use iPhones. If a hacker were to steal a phone and could steal a fingerprint half the battle is already over to get into that phone and could possibly get into company e-mail. Who's to say there would even be a passcode on the phone. As we discussed in class Yahoo! President Marissa Mayer said she thought the fingerprint scanner was a great idea because she did not like typing in her code 15-20 times a day. Imagine the possibilities of getting into her phone. 

I have a problem with idea of the fingerprint scanner itself. Sure it's cool and we can all feel like secret FBI agents, but it is actually taking away from the authentication process. I feel like a fingerprint is something you have and something that you are. Genetically you are you fingerprint. I know that you can set it up to be your cat's paw or your nose but not too many people are going to do that. But because it is taking away from the authentication process I feel that Apple is actually making their phones security weaker not stronger.

New Blog Purpose

This is Chris Harter's new security blog for IST 323. In this blog I will be posting my opinions on different IT security news and my experiences with IT security. I am going to be posting 3 to 4 times per short assignment based on the length of my posts. For my first post I am going to talk about my own experience as a "hacker." Don't worry I didn't do anything illegal so you won't have to call the cops after  reading this.
My girlfriend is a sophomore at LeMoyne and has lived in two different dorms the last two years. To get into their dorms just like Syracuse students swipe their ID (something you have authentication). There have been times where instead of waiting for her to answer the door someone from LeMoyne have been entering their dorm and I have walked right behind them and into the dorm. I never thought anything of it until I started taking IST 323.
After reading our textbook and being in lecture, I have learned this type of hack is called tailgating. Tailgating is exactly what it sounds like, it's walking behind someone who has authentication and looking like you belong there to gain access to a place you are not authorized to be in.
Obviously I was not doing anything malicious, I was just seeing my girlfriend. It made me chuckle when I tailgated someone last week. Over the past 2 years I have tailgated at least 15 times. But then it made me think what if I was somewhere else. Or what if I was somebody dangerous? All I had to do is smile and say thank you and I was in. If we were somewhere with more security I know I would not have been let in. It all comes back to the need to train people to not be susceptible to social engineering.
But all in all, this is just a fun story of how I accidentally became a hacker even if it was the lamest hacker of all time.


Thanks for reading there will be another post tomorrow!

--Chris