Administration Wiretaps Israeli Embassy

foxnews.com

Leak Offers Look at Efforts by U.S. to Spy on Israel
By SCOTT SHANE, New York Times

WASHINGTON — When Shamai K. Leibowitz, an F.B.I. translator, was sentenced to 20 months in prison last year for leaking classified information to a blogger, prosecutors revealed little about the case. They identified the blogger in court papers only as “Recipient A.” After Mr. Leibowitz pleaded guilty, even the judge said he did not know exactly what Mr. Leibowitz had disclosed.

“All I know is that it’s a serious case,” Judge Alexander Williams Jr., of United States District Court in Maryland, said at the sentencing in May 2010. “I don’t know what was divulged other than some documents, and how it compromised things, I have no idea.”

More...

Flying Drone Can Crack Wi-Fi Networks, Snoop On Cell Phones

forbes.com

How do one ex-Air Force official and one former airplane hobby shop owner, both of whom happen to have decades of experience as network security contractors for the military, spend their weekends? Building a flying, unmanned, automated password-cracking, Wi-Fi-sniffing, cell-phone eavesdropping spy drone, of course.

At the Black Hat and Defcon security conferences in Las Vegas next week, Mike Tassey and Richard Perkins plan to show the crowd of hackers a year’s worth of progress on their Wireless Aerial Surveillace Platform, or WASP, the second year Tassey and Perkins have displayed the 14-pound, six-foot long, six-foot wingspan unmanned aerial vehicle. The WASP, built from a retired Army target drone converted from a gasoline engine to electric batteries, is equipped with an HD camera, a cigarette-pack sized on-board Linux computer packed with network-hacking tools including the BackTrack testing toolset and a custom-built 340 million word dictionary for brute-force guessing of passwords, and eleven antennae.

More...

Cyber-Hackers: Faster, Better Equipped Than You...

registeredrep.com

Mark Clancy is intimately familiar with the in’s and out’s of cyber hacking attacks. As managing director and Corporate Information Security Officer at the Depository Trust and Clearing Corporation (DTCC), Clancy’s job is to pay attention to how crooks use virtual highways to steal data and assets — and stay a step ahead. Today that means much more than loading up some anti-virus software and patching an operating system.

“Mass attacks still continue, but the more sophisticated ones are targeted attacks,” says Clancy. “This style uses social engineering where they collect information they can find on the Internet about a broker or a client, and then send an email so the conversation seems more plausible. And in the broker/dealer world, bad guys are going after more high-net-worth clients. You go where the money is.”

Cyber attacks are not just the territory of large Wall Street firms—independents too have chinks in their armor. And while an 8-man advisory may not have seemed like the prime target for a hack a few years ago, that’s no longer true as criminals have gotten more specific about who they target, in an effort to maximize their return on investment.

More...

Cyberespionage At A Crossroads

darkreading.com
Aurora and Stuxnet-type attacks are here to stay, so organizations need a new defense strategy

It has been a milestone week in cyberespionage developments that smacked of a spy movie, with a confession, a killing, and a leaked intelligence cable: Iranian President Mahmoud Ahmadinejad issued a statement that "enemies" of Iran had successfully used software to disrupt centrifuges in Iran's nuclear facility, Iran's top nuclear scientist was assassinated, and a U.S. State Department cable obtained by WikiLeaks suggested the Chinese government had ordered the Aurora attack against Google.

While these events and disclosures fell short of providing actual proof about the success or even who was really behind these high-profile breaches, they punctuated what has been a game-changer of a year for cyberattacks.

More...

Hacker Spoofs Cell Phone Tower to Intercept Calls

wired.com

LAS VEGAS — A security researcher created a cell phone base station that tricks cell phones into routing their outbound calls through his device, allowing someone to intercept even encrypted calls in the clear.

The device tricks the phones into disabling encryption and records call details and content before they’re routed on their proper way through voice-over-IP.

The low-cost, home-brewed device, developed by researcher Chris Paget, mimics more expensive devices already used by intelligence and law enforcement agencies – called IMSI catchers – that can capture phone ID data and content. The devices essentially spoof a legitimate GSM tower and entice cell phones to send them data by emitting a signal that’s stronger than legitimate towers in the area.

“If you have the ability to deliver a reasonably strong signal, then those around are owned,” Paget said.

Paget’s system costs only about $1,500, as opposed to several hundreds of thousands for professional products. Most of the price is for the laptop he used to operate the system.

More...

Cybercriminals having easy time cracking corporate networks

usatoday.com
Verizon today issued its annual Data Breach Investigation Report, timed for the opening day of the giant Black Hat cybersecurity convention in Las Vegas.

It's not widely known that the telecom giant is home to a crack cybersecurity forensics team. Over the past half dozen or so years, Verizon's cybersleuths have been retained by large organizations to probe more than 900 separate cases of data theft in which some 900 million records were compromised. Based on direct evidence from those hands-on probes of real hacks, Verizon's annual breach report stands apart from other cybersecurity studies, many of which are based on subjective, anecdotal opinions of survey respondents.

More...

Thieves Flood Victim’s Phone With Calls to Loot Bank Accounts

wired.com

Bank thieves have rolled out a new weapon in their arsenal of tactics — telephony denial-of-service attacks that flood a victim’s phone with diversionary calls while the thieves drain the victim’s account of money.

A Florida dentist lost $400,000 from his retirement account last year in this manner, and the FBI said the attacks are growing.

A spokeswoman for the Communication Fraud Control Association — a telecom industry organization — told Threat Level that although fraudulent transfers have been halted in a number of cases, the losses are increasing.

“I know it’s in the millions,” said Roberta Aranoff, executive director of the CFCA. “It has exceeded a million dollars easily.”

Last November, Robert Thousand Jr., a semi-retired dentist in Florida, received a flood of calls to several phones. When he answered them, he heard a 30-second recording for a sex hotline, according to the St. Augustine Record.

More...

Security chip that does encryption in PCs hacked

usatoday.com

SAN FRANCISCO — Deep inside millions of computers is a digital Fort Knox, a special chip with the locks to highly guarded secrets, including classified government reports and confidential business plans. Now a former U.S. Army computer-security specialist has devised a way to break those locks.

The attack can force heavily secured computers to spill documents that likely were presumed to be safe. This discovery shows one way that spies and other richly financed attackers can acquire military and trade secrets, and comes as worries about state-sponsored computer espionage intensify, underscored by recent hacking attacks on Google.

The new attack discovered by Christopher Tarnovsky is difficult to pull off, partly because it requires physical access to a computer. But laptops and smart phones get lost and stolen all the time. And the data that the most dangerous computer criminals would seek likely would be worth the expense of an elaborate espionage operation.

More...

Cisco's Backdoor For Hackers

forbes.com

ARLINGTON, Va. -- Activists have long grumbled about the privacy implications of the legal "backdoors" that networking companies like Cisco build into their equipment--functions that let law enforcement quietly track the Internet activities of criminal suspects. Now an IBM researcher has revealed a more serious problem with those backdoors: They don't have particularly strong locks, and consumers are at risk.

In a presentation at the Black Hat security conference Wednesday, IBM ( IBM - news - people ) Internet Security Systems researcher Tom Cross unveiled research on how easily the "lawful intercept" function in Cisco's ( CSCO - news - people ) IOS operating system can be exploited by cybercriminals or cyberspies to pull data out of the routers belonging to an Internet service provider (ISP) and watch innocent victims' online behavior.

More...

Climate emails hacked by spies

independent.co.uk

A highly sophisticated hacking operation that led to the leaking of hundreds of emails from the Climatic Research Unit in East Anglia was probably carried out by a foreign intelligence agency, according to the Government's former chief scientist. Sir David King, who was Tony Blair's chief scientific adviser for seven years until 2007, said that the hacking and selective leaking of the unit's emails, going back 13 years, bore all the hallmarks of a co-ordinated intelligence operation – especially given their release just before the Copenhagen climate conference in December.

The emails were stolen from a backup computer server used by the University of East Anglia. They contained private discussions between climate scientists that have embarrassed those involved, particularly Professor Phil Jones, who has stepped down from his post as head of the unit pending an independent inquiry into whether there is any evidence of scientific misconduct. He is not implicated in the hacking.

More...