Video: Ars talks to the experts on Atari’s dump at yesterday’s big dig

4/27/14 Ars Technica by Megan Geuss

Microsoft

ALAMOGORDO, NM—When a film crew, a dig crew, and dozens of fans and journalists showed up at a decades-old desert landfill in New Mexico on Saturday, no one was certain what to expect. The crowd was hoping to confirm a story that made its way into gaming legend: that Atari dumped thousands, perhaps millions, of E.T. (and perhaps other) cartridges in this particular landfill back in 1983 at the height of the Video Game Crash.
While the excavation crew was digging down into the 1983 layer of the landfill, Ars got a chance to talk to E.T. programmer Howard Scott Warshaw, who was milling about, talking to fans and press. Warshaw famously claimed that the legend of E.T. cartridge burials was fake. Today, he's a licensed psychotherapist in California and says he aims to help people in high-tech circles work through their problems.
Perhaps that big-picture view of the industry is what helps him put the legends of E.T. into perspective. "It would be pretty to think that E.T. really was the downfall of the industry and that I, as a programmer, over the course of five weeks, was able to topple a billion-dollar industry. But I also have a degree in economics," Warshaw told Ars yesterday.

Read 9 remaining paragraphs | Comments

Microsoft Warns of Attacks on IE Zero-Day

4/27/14 Krebs on Security by BrianKrebs

Microsoft is warning Internet Explorer users about active attacks that attempt to exploit a previously unknown security flaw in every supported version of IE. The vulnerability could be used to silently install malicious software without any help from users, save for perhaps merely browsing to a hacked or malicious site.
In an alert posted on Saturday, Microsoft said it is aware of  “limited, targeted attacks” against the vulnerability (CVE-2014-1776) so far.
Microsoft’s security advisory credits security firm FireEye with discovering the attack. Inits own advisory, FireEye says the exploit currently is targeting IE9 through IE11 (although the weakness also is present in all earlier versions of IE going back to IE6), and that it leverages a well-known Flash exploitation technique to bypass security protections on Windows.
Microsoft has not yet issued a stopgap “Fix-It” solution for this vulnerability. For now, it is urging IE users to download and install itsEnhanced Mitigation Experience Toolkit(EMET), a free tool that can help beef up security on Windows. Microsoft notes that EMET 3.0 doesn’t mitigate this attack, and that affected users should instead rely on EMET 4.1. I’ve reviewed the basics of EMEThere. The latest versions of EMET are available here.
According to information shared by FireEye, the exploit also can be blocked by running Internet Explorer in “Enhanced Protected Mode” configuration and 64-bit process mode, which is available for IE10 and IE11 in the Internet Options settings as shown in the graphic above.
This is the first of many zero-day attacks and vulnerabilities that will never be fixed for Windows XP users. Microsoft last month shipped its final set of updates for XP. Unfortunately, many of the exploit mitigation techniques that EMET brings do not work in XP.

Atari landfill in New Mexico to be dug up on Saturday; Ars will be on scene

One reporter stares into the hellmouth of the 1983 video game crash.

by Megan Geuss - Apr 22 2014, 4:20pm EDT

Xbox Entertainment Studios

The site in Alamogordo, New Mexico, where Atari is rumored to have buried some 3.5 million copies of the video game cartridge E.T. the Extra-Terrestrial is set to be dug up this Saturday.

Never wanting to miss an excavation, we've packed our bags, cashed in our frequent flyer miles, and booked our budget motel room to be on the scene when whatever is down there is dredged up—be it hunks of plastic housing and cartridge chips or distilled evil sent to us by a superior alien race and hidden by the ghost warriors employed by Atari, which was really a front for a supernatural crime-fighting ring all along.

Fuel Entertainment Studios secured the rights to dig up the landfill with the help of local garbage contractor Joe Lewandowski, who told a TV news station that he witnessed the Atari dump in question back in 1983. Fuel then asked Microsoft's Xbox Entertainment Studios to help it make a documentary on Atari, which will be directed by Simon Chinn and produced by Jonathan Chinn.

The city of Alamogordo just recently gave the OK for the dig to proceed.

So what's the likelihood that we'll find something down there once the cement poured over the landfill has been removed and the pit is dug up? Several prominent Atari employees have denied that millions of E.T. games were buried at Alamogordo, but it seems certain that anywhere from nine to 20 trucks dumped parts from an Atari factory in nearby El Paso, Texas, into the New Mexico landfill in 1983. Still, whether those parts are intact cartridges or just cruft from a factory in transition is a mystery until we see them.

This weekend, former Atari employee and E.T. programmer Howard Scott Warshaw will be on the scene, along with a number of Hollywood-types who will be filming the dig and a team of archaeologists who will sift through whatever the dig contractors find down there. Fans are invited to come down as well, so if you live in the area, drop by and say hi!

In any case, we'll be there to bring you pictures and stories of the unfolding mystery.

3 Million Customer Credit, Debit Cards Stolen in Michaels, Aaron Brothers Breaches

Krebs on Security by BrianKrebs

Nationwide arts and crafts chain Michaels Stores Inc. said today that two separate eight-month-long security breaches at its stores last year may have exposed as many as 3 million customer credit and debit cards.
The disclosure, made jointly in a press releaseposted online and in a statement on the company’s Web site, offers the first real details about the breach since the incident was first disclosed by KrebsOnSecurity on January 25, 2014.
The statements by Irving, Texas-based Michaels suggest that the two independent security firms it hired to investigate the break-ins initially found nothing.
“After weeks of analysis, the Company discovered evidence confirming that systems of Michaels stores in the United States and its subsidiary, Aaron Brothers, were attacked by criminals using highly sophisticated malware that had not been encountered previously by either of the security firms,” the statement reads.
The Michaels breach first came to light just weeks after retail giant Target Corp. said thatcyber thieves planted malware on cash registers at its stores across the nation, stealing more than 40 million credit and debit card numbers between Nov. 27 and Dec. 15, 2013. That malware was designed to siphon card data when customers swiped their cards at the cash register.
According to Michaels, the affected systems contained certain payment card information, such as payment card number and expiration date, about both Michaels and Aaron Brothers customers. The company says there is no evidence that other customer personal information, such as name, address or debit card PIN, was at risk in connection with this issue.
The company’s statement says the attack on Michaels’ targeted “a limited portion of the point-of-sale systems at a varying number of stores between May 8, 2013 and January 27, 2014.”
“Only a small percentage of payment cards used in the affected stores during the times of exposure were impacted by this issue,” the statement continues. “The analysis conducted by the security firms and the Company shows that approximately 2.6 million cards may have been impacted, which represents about 7% of payment cards used at Michaels stores in the U.S. during the relevant time period. The locations and potential dates of exposure for each affected Michaels store are listed on www.michaels.com.”
Regarding Aaron Brothers, Michaels Stores said it has confirmed that between June 26, 2013 and February 27, 2014, 54 Aaron Brothers stores were affected by this malware, noting that the locations for each affected Aaron Brothers store are listed on www.aaronbrothers.com.
“The Company estimates that approximately 400,000 cards were potentially impacted during this period. The Company has received a limited number of reports from the payment card brands and banks of fraudulent use of payment cards potentially connected to Michaels or Aaron Brothers.”
This incident marks the second time in three years that Michaels Stores has wrestled with a widespread compromise of its payment card systems. In May 2011, Michaels disclosed that crooks had physically tampered with some point-of-sale devices at store registers in some Chicago locations, although further investigation revealed compromised POS devices in stores across the country, from Washington, D.C. to the West Coast.
Michaels says that while the Company has received limited reports of fraud, it is offering identity protection, credit monitoring and fraud assistance services through AllClear ID to affected Michaels and Aaron Brothers customers in the U.S. for 12 months at no cost to them. Details of the services and additional information related to the ongoing investigation are available on the Michaels and Aaron Brothers websites at www.michaels.com and www.aaronbrothers.com.
Incidentally, credit monitoring services will do nothing to protect consumers from fraud on existing financial accounts — such as credit and debit cards — and they’re not great at stopping new account fraud committed in your name. The most you can hope for with these services is that they alert you as quickly as possible after identity thieves have opened or attempted to open new accounts in your name.
As I noted in a recent story about the credit monitoring industry, the offering of these services has become the de facto public response for companies that experience a data breach, whether or not that breach resulted in the loss of personal information that could lead to actual identity theft (as opposed to mere credit card fraud). For more information about the limitations of credit monitoring services and more proactive steps that you can take to better protect your identity and credit file, check out this story.

How Heartbleed transformed HTTPS security into the stuff of absurdist theater

Certificate revocation checking in browsers is "useless," crypto guru warns.

by Dan Goodin - Apr 21 2014, 6:44pm EDT

• HACKING

42

Aurich Lawson / Thinkstock

If you want to protect yourself against the 500,000 or so HTTPS certificates that may have been compromised by the catastrophic Heartbleed bug, don't count on the revocation mechanism built-in to your browser. It doesn't do what its creators designed it to do, and switching it on makes you no more secure than leaving it off, one of the Internet's most respected cryptography engineers said over the weekend.

FURTHER READING

PRIVATE CRYPTO KEYS AREACCESSIBLE TO HEARTBLEED HACKERS, NEW DATA SHOWS

Four people have been able to see server keys and certificates in a test.

For years, people have characterized the ineffectiveness of the online certificate status protocol (OCSP) as Exhibit A in the case that the Internet's secure sockets layer and transport layer security (TLS) protocols are hopelessly broken. Until now, no one paid much attention. Thedisclosure two weeks ago of the so-called Heartbleed bug in the widely-used OpenSSL cryptography library has since transformed the critical shortcoming into a major problem, the stuff of absurdist theater. Security experts admonish administrators of all previously vulnerable websites torevoke and reissue TLS certificates, even as they warn that revocation checks in browsers do little to make end users safer and could indeed weaken the security and reliability of the Internet if they were made more effective.

Certificate revocation is the process of a browser or other application performing an online lookup to confirm that a TLS certificate hasn't been revoked. The futility of certificate revocation was most recently discussed in a blog post published Saturday by Adam Langley, an engineer who was writing on his own behalf but who also handles important cryptography and security issues at Google. In the post, Langley recites a litany of technical considerations that have long prevented real-time online certificate revocations from thwarting attackers armed with compromised certificates, even when the digital credentials have been recalled. Some of the considerations include:

• Attacks that use compromised or fraudulently issued TLS certificates more often than not are premised on the hacker's ability to intercept traffic passing between the target and the open Internet. This capability means attackers can simply spoof the OCSP response to show it is valid, even though the real OCSP server, if the victim could reach it, would report it as revoked.
• Even in cases of domain name system hijacking and other hacks that allow attackers to intercept only traffic from a specific site, attackers can often cache thwart OCSP by saving a valid response issued earlier for the targeted website and presenting it along with a compromised certificate. What's more, if attackers have hijacked a website, there's a good chance they can use that control to trick a recognized certificate authority into issuing a TLS certificate for it.
• Most crucially, virtually all websites and browser makers prefer certificate revocations to work with what security engineers call a soft error, or "soft fail", rather than a "hard fail." A soft fail permits an HTTPS connection to be established even if the OCSP server isn't currently available to confirm a certificate's validity, whereas a hard fail would reject the connection. The reason for the soft fail default is that the Internet isn't reliable enough to guarantee OCSP servers are always available. If end users visiting PayPal, Amazon, or countless other websites get hung up waiting for OCSP checks, frustration on an unprecedented scale would almost certainly ensue. What's more, switching to a hard fail mechanism would give miscreants waging denial of service attacks a potent new weapon for taking down huge swaths of the Internet. Rather than overwhelm the sites themselves, the attackers would only need to target the much smaller pool of OCSP servers that validate the sites' certificates.

"That's why I claim that revocation checking is useless—because it doesn't stop attacks," Langley wrote. "Turning it on does nothing but slow things down. You can tell when something is security theater because you need some absurdly specific situation in order for it to be useful."

Langley's blog post helps explain why Google Chrome by default doesn't have online revocation enabled. In the aftermath of Heartbleed, many people have counseled turning it on. That's because the OpenSSL bug allows attackers to pluck passwords, authentication cookies, and even private encryption keys out of the computer memory of vulnerable servers. In many cases, there is no way to know if the two-year-old flaw has been exploited. As a result, security experts have counseled people administering vulnerable websites to assume the key bound to their old TLS certificate is compromised. That has meant getting a new certificate and revoking the old one.

Online certificate checking is the mechanism many have assumed would prevent end users from trusting revoked credentials. Certificate revocation by sites remains a good idea, but in light of this weekend's post, end users shouldn't assume OCSP will do much to flag old compromised keys that may be presented by attackers.

FURTHER READING

SSL FIX FLAGS FORGED CERTIFICATES BEFORE THEY’RE ACCEPTED BY BROWSERS

An IETF proposal hopes to mend cracks in the Internet's foundation of trust.

Langley said as an alternative to online revocation checking, Chrome developers instead compile daily lists of revocation for high-value sites and deliver the certificate revocation list to end users as a normal browser update. This CRLSet, as it's called at Google, is useful for containing damage resulting from hacks such as the 2011 compromise of Dutch certificate authority Diginotar, which allowed attackers to mint fraudulent TLS credentials for Google and a relatively small number of other high-value sites. Alas, CRLSet will do little or nothing to protect users against the huge number of certificates potentially compromised by Heartbleed. Web services firm Netcraft estimates the figure could affect as many as 500,000 certificates.

The Heartbleed debacle is by no means the first event to underscore the inadequacy of current TLS revocation. A variety of researchers have proposed alternatives. One such fix, devised by cryptography experts Moxie Marlinspike and Trevor Perrin, is known as TACK. Another one was created by a developer from Red Hat and is dubbed Mutually Endorsing CA Infrastructure. Langley, meanwhile, held out something called OCSP Must Staple.

Those proposals and several others like them have largely languished in inertia. If there's a silver lining to Heartbleed, it may be that it provides the catalyst that the huge number of the world's engineers will need to finally fix one of the Internet's biggest security holes.

PROMOTED COMMENTS

• MrMalthusArs Scholae Palatinae

  jump to post
  dstarfire wrote:

  Umm, hate to break it to the supposed security experts, but "(such-and-such) does nothing against man-in-the-middle attacks" is like saying ski-masks are useless against an avalanche: you're pretty much screwed no matter what you do. If you can't get a trusted communication (at some point) to establish a protected tunnel, you're never going to have a secure connection.

  
  
  I think you missed a key component of this: to attack you with these stolen certificates they'd have to be man in the middling you, so yes, a defense that is trivially vulnerable to man-in-the-middle attacks isn't a whole lot of help.
  726 posts | registered Apr 8, 2006

Active malware campaign steals Apple passwords from jailbroken iPhones

200+ Ars Technica by Dan Goodin 

Sophos

Security researchers have uncovered an active malware campaign in the wild that steals the Apple ID credentials from jailbroken iPhones and iPads.
News of the malware, dubbed "unflod" based on the name of a library that's installed on infected devices, first surfaced late last week on a pair of reddit threads here and here. In the posts, readers reported their jailbroken iOS devices recently started experiencing repeated crashes, often after installing jailbroken-specific customizations known as tweaks that were not a part of the official Cydia market, which acts as an alternative to Apple's App Store.
Since then, security researcher Stefan Esser has performed what's called a static analysis on the binary code that the reddit users isolated on compromised devices. In a blog post reporting the results, he said unflod hooks into the SSLWrite function of an infected device's security framework. It then scans it for strings accompanying the Apple ID and password that's transmitted to Apple servers. When the credentials are found, they're transmitted to attacker-controlled servers.

Read 6 remaining paragraphs | Comments

Fingerprint lock in Samsung Galaxy 5 easily defeated by whitehat hackers

4/15/14 Ars Technica by Dan Goodin 

SRLabs

The heavily marketed fingerprint sensor in Samsung's new Galaxy 5 smartphone has been defeated by whitehat hackers who were able to gain unfettered access to a PayPal account linked to the handset.
The hack, by researchers at Germany's Security Research Labs, is the latest to show the drawbacks of using fingerprints, iris scans, and other physical characteristics to authenticate an owner's identity to a computing device. While advocates promote biometrics as a safer and easier alternative to passwords, that information is leaked every time a person shops, rides a bus, or eats at a restaurant, giving attackers plenty of opportunity to steal and reuse it. This new exploit comes seven months after a separate team of whitehat hackers bypassed Apple's Touch ID fingerprint scanner less than 48 hours after it first became available.
"We expected we'd be able to spoof the S5's Finger Scanner, but I hoped it would at least be a challenge," Ben Schlabs, a researcher at SRLabs, wrote in an e-mail to Ars. "The S5 Finger Scanner feature offers nothing new except — because of the way it is implemented in this Android device — slightly higher risk than that already posed by previous devices."

Read 7 remaining paragraphs | Comments