I just noticed that Littleton Coins' website has a security vulnerability that improperly handles/transmits passwords.
While recently visiting the Littleton Coin website, www.littletoncoin.com, I noticed that the logon Id and surprisingly enough the logon Password are sent in plain text via the URL when you visit your "My Account" page right after logging in. This means that anyone who can access the server log files (not the encrypted database entries), folks at your ISP, or ANYONE who can see what pages you visit can now obtain your user name and password to this site. When you combine this with the fact that many users store their credit card details on these eCommerce sites, it is not hard to imagine that given enough time, this could become quite a serious matter.
In the screenshots below, the example logonId is 'coin-user' and the example logonPassword is 'coin-pass.'
Now, the site does use HTTPS which is good as it encrypts the communication between server and client. However, the technique of sending plain-text passwords via URLs should never be used in the real world, much less by a site that is classified as a substantial eCommerce site.
Bottom line, I like Littleton Coin...I am sure their web/IT guys make way more than I do...Never send plain-text passwords via URL
Observations: I can only seem to recreate this when I open a fresh browser connection to www.littletoncoin.com, then go to "Log In", then go straight to "My Account". At this point you should see both the logon Id and password within the URL. However, If I log in, then look at something before going to the "My Account" page, then I do not see the password being sent via the URL.
Update: As of today, Mar 12, 2013, I have spoken with an individual at Littleton Coin who has stated that this issue is being addressed and should be fixed by tomorrow.
The best way to protect yourself from an online financial scam is to diligently check your bank accounts. At least, until now. Security firm Trusteer has found an elaborate new computer virus that not only helps fraudsters steal money from bank accounts, it also covers its tracks.
Think of a crime plot involving a spy who plans to break into a high-security building and begins by swapping out security camera video so guards don't notice anything is amiss. Known as a surveillance camera hack, the technique has been used in dozens of movies.
A new version of the widely prevalent SpyEye Trojan horse works much the same way, only it swaps out banking Web pages rather than video, preventing account holders from noticing that their money is gone. advertisement
The Trojan horse employs a powerful two-step process to commit the electronic crime. First, the virus lies in wait until a customer with an infected computer visits an online banking site, steals their login credentials and tricks the victim into divulging additional personal information such as debit card information. Then, after the stolen card number is used for a fraudulent purchase, the virus intercepts any further visits to the victim's banking site and scrubs transaction records clean of any fraud. That prevents -- or at least delays -- consumers from discovering fraud and reporting it to the bank, buying the fraudster critical extra time to complete the crime.
Trusteer calls it a "post transaction" attack, because much of the virus' effectiveness is attributable to its ability to control what victims see after fraudulent transactions occur. Amit Klein, chief technology officer for Trusteer, said he believes criminals have used the technique for a few months, and it has infected real consumers.
"I predict that the use of post transaction attack technology will significantly increase as it enables criminals to maximize the amount of fraud they can commit using their initial investment in malware toolkits and infection mechanisms," Klein said.
The new SpyEye came to Trusteer's attention when a large retail bank in the United States spotted it and shared with the firm, he said.
Read the entire article: http://redtape.msnbc.msn.com/_news/2012/01/06/9986119-new-virus-raids-your-bank-account-but-you-wont-notice [Read more ...]
Bookmark / Share:
Do you have a thought about this article? Post a comment and tell us about it!
An unpatched security flaw in Apple’s iTunes software allowed intelligence agencies and police to hack into users’ computers for more than three years, it’s claimed.
A British company called Gamma International marketed hacking software to governments that exploited the vulnerability via a bogus update to iTunes, Apple's media player, which is installed on more than 250 million machines worldwide.
The hacking software, FinFisher, is used to spy on intelligence targets’ computers. It is known to be used by British agencies and earlier this year records were discovered in abandoned offices of that showed it had been offered to Egypt’s feared secret police.
Apple was informed about the relevant flaw in iTunes in 2008, according to Brian Krebs, a security writer, but did not patch the software until earlier this month, a delay of more than three years.
Read the entire story here: http://www.telegraph.co.uk/technology/apple/8912714/Apple-iTunes-flaw-allowed-government-spying-for-3-years.html [Read more ...]
Bookmark / Share:
Do you have a thought about this article? Post a comment and tell us about it!
'Many types of electronic devices or information storage medium can be hacked to either give up information or perform actions it wasn't initially designed to do. The vulnerability of some of your everyday devices might surprise you.'
1. Medical implants
"Insulin pumps are apparently even more susceptible to outside interference, and at the recent Black Hat hacker conference in Las Vegas, the life-saving pumps were shown to be vulnerable from distances of up to a half mile. Using power radio antennas, hackers can hijack a pump's wireless signal and cause it to give a blast of insulin to a wearer, with potentially deadly results."
2. Baby monitors
"What most users probably don't realize, is that the dozen or so wireless channels that these helpful devices use can often be picked up outside the home — giving anyone with a similar device or wireless receiver an undetectable window into your home."
3. Automobiles
"These days, security experts are worried about much more tech-savvy car thieves who can unlock your car, or even start it, simply by shooting it a text message or two. Many automotive systems — such as OnStar — utilize the same type of cellular technology as a common cell phone"
4. Garage door openers
"Hackers can easily modify a standard door opener to accept a USB port, and software is readily available on the web to modify how it operates. A number of tutorials can be found online to walk an amateur hacker through the process of hacking your garage door in just minutes."
5. The human brain
"In fact, the Defense Advanced Research Projects Agency (DARPA) is funding a $4.9 million program to reverse-engineer the human brain in an effort to mine its computational abilities."
IDG News Service - A former government contractor says that the FBI installed a number of back doors into the encryption software used by the OpenBSD operating system.
The allegations were made public Tuesday by Theo de Raadt, the lead developer in the OpenBSD project. DeRaadt posted an e-mail sent by the former contractor, Gregory Perry, so that the matter could be publicly scrutinized.
"The mail came in privately from a person I have not talked to for nearly 10 years," he wrote in his a posting to an OpenBSD discussion list. "I refuse to become part of such a conspiracy, and will not be talking to Gregory Perry about this. Therefore I am making it public."
No one has come forward to corroborate Perry's story, but the allegations are remarkable. If they're true -- and at present they're being greeted with skepticism by the security community -- they mean that the FBI may have developed secret ways to snoop on encrypted traffic and then hidden them in source code submissions accepted by OpenBSD.
Perry is now CEO with a VMware services company called GoVirtual, but 10 years ago -- when the backdoor code was allegedly added to OpenBSD's IPsec stack -- he was a government contractor working for the FBI, he said.
Read the entire article: http://www.computerworld.com/s/article/9201220/Former_contractor_says_FBI_put_back_door_in_OpenBSD
Related: http://www.itworld.com/open-source/130820/openbsdfbi-allegations-denied-named-participant [Read more ...]
Bookmark / Share:
Do you have a thought about this article? Post a comment and tell us about it!
A series of computer errors at an Air Force base in Wyoming Saturday took 50 nuclear intercontinental ballistic missiles -- one-ninth of the U.S. missile stockpile -- offline for about an hour, CBS News chief political consultant Marc Ambinder reports.
Engineers believe that the outage at F.E. Warren Air Force Base was caused by a hardware failure in a launch control computer rather than a power failure as had been previously reported, according to a defense official with knowledge of the situation.
Adm. Mike Mullen, the chairman of the Joint Chiefs of Staff, was immediately briefed about the incident Saturday. He in turn told Defense Secretary Robert Gates. President Obama was briefed Tuesday morning.
According to an administration official, at no time did the president's ability to launch missiles decrease should that have been necessary.
A military official said that the failure triggered an emergency protocol and sentries were dispatched to verify in person that all of the missiles were safe and properly protected.
The military does not believe the incident was sabotage.
Read the entire article: http://www.cbsnews.com/8301-503544_162-20020817-503544.html
Microsoft Corp (MSFT.O) issued its biggest-ever security fix on Tuesday, including repairs to its ubiquitous Windows operating system and Internet browser for flaws that could let hackers take control of a PC.
The new patches aim to fix a number of vulnerabilities including the notorious Stuxnet virus that attacked an Iranian nuclear power plant and other industrial control systems around the world.
Microsoft said four of the new patches -- software updates that write over glitches -- were of the highest priority and should be deployed immediately to protect users from potential criminal attacks on the Windows operating systems.
Microsoft said it also repaired other less serious security weaknesses in Windows, along with security problems in its widely used Office software for PCs and Microsoft Server software for business computers.
http://www.reuters.com/article/idUSN1220677620101012 [Read more ...]
Bookmark / Share:
Do you have a thought about this article? Post a comment and tell us about it!
A computer security researcher has built a device for just $1,500 that can intercept some kinds of cell phone calls and record everything that's said.
The attack Chris Paget showed Saturday illustrates weaknesses in GSM, one of the world's most widely used cellular communications technologies.
His attack was benign; he showed how he could intercept a few dozen calls made by fellow hackers in the audience for his talk at the DefCon conference here. But it illustrates that criminals could do the same thing for malicious purposes, and that consumers have few options for protecting themselves.
Cyber criminals have raided the accounts of thousands of British internet bank customers in one of the most sophisticated attacks of its kind.
The fraudsters used a malicious computer programme that hides on home computers to steal confidential passwords and account details from at least 3,000 people.
The internet security experts M86, who uncovered the scam, estimate that at least £675,000 has been illegally transferred from the UK in the last month - and that the attacks are still continuing.
Conficker is building and maintaining a powerful network of enslaved computers, and machines infected with the worm can be made obey the whims of Conficker's unknown commanders. Why?
Conficker's obfuscated code, stealthy peer-to-peer mechanisms, evasion of network filtering, and sophisticated updates are exemplary in the world of worms. If Conficker has any equal in its combination of technical inscrutability, pervasiveness, bulletproof networking, and steady innovation, it's another application called Skype. Like Conficker, Skype obscures its operation from debuggers and disassemblers, can't be effectively blocked on the network layer, stumps experts with its formidable peer-to-peer system, and is backed by a team dedicated to preserving these advantages. Skype works this way to gain specific commercial advantages. Conficker works similarly. But why does Conficker even exist?
The public doesn't yet know why such cutting-edge work has been poured into developing and spreading the Conficker worm. But one worrisome possibility is that Conficker's army of zombie PC's could present the "Internet emergency" that authorities (the U.S. government in particular) have long warned about — a sustained attack of such scale and resilience that the network is brought to its knees. The sleeping giant Conficker may be designed specifically to launch just that conflict.
Computer maker Dell is warning, according to The Register, that some of its server motherboards have been delivered to customers carrying an unwanted extra: computer malware. It could be confirmation that the "hardware trojans" long posited by some security experts are indeed a real threat.
Unlike hard-drive-based computer viruses which can be disabled by antivirus software, a hardware trojan lives out of reach of such defences. It comprises some kind of alteration - by sabotage or accident - to the very heart of a computer: its microprocessors, memory chips or circuit boards.
News that Dell may have a hardware trojan problem emerged on a support forum after a user was warned by a Dell call centre that the firm's PowerEdge R410 server motherboard contains spyware of unspecified function that a Dell engineer needed to come and remove.
Dell confirms on the same forum: "The potential issue involves a small number of PowerEdge server motherboards sent out through service dispatches that may contain malware. This malware code has been detected on the embedded server management firmware."
Internet ads are unavoidable for the most part. They clog up the screen space and slow down the overall experience. Now you can block internet ads altogether easily with Ghostery.
The idea of blocking internet ads needs to be approached from different angles, one being the end user who wants a safer and faster web experience and the web publisher who builds and maintains the content.
From the end-users perspective...
Blocking the ads is an overall A+ thing to do. With a simple browser plug-in you can easily block most ads and other internet oddities like spy/tracking cookies et cetera. If you want to allow some things such as 'Google gadgets' then you simply click on the option to allow gadgets to be displayed. The plug-in will notify you (on your browser) how many objects it has detected:
From the publishers perspective...
This is not really a desired action you want from your guests as this will limit the amount of income you can generate. One way to avoid forcing a user to block your ads is to make sure the ads dont overpower your visitors. If someone comes to your site and sees a page full of ads with no content they will most likely leave. If they are a regular visitor and just cant deal with "all those crappy ads" then they will most likely opt to block the ads via a plug-in like Ghostery. Please note that this is *not* a paid endorsement...I actually use and like this product.
Now, lets assume that your visitors *always* have their ad blocker on (like me)...you want to make sure your content still looks like content! Many publishers don't bother to view their content with an ad blocker installed so they have no idea how their content falls apart when viewed as such.
Below is a screenshot of our widgets domain with the ads blocked (notice that I did allow the display of Google gadgets for this screenshot):
"Windows-7x-large Microsoft has toned down the intentionally annoying User Account Control security feature introduced in Windows Vista. UAC is the feature that frequently prompts Vista users for permission to do something, sometimes more than once."
"But security experts say the streamlined UAC in Windows 7, launched Thursday, is being shipped in a configuration that may do more harm than good, in terms of leaving your Windows 7 PC vulnerable to cyber criminals looking to take control."
Recently Microsoft included a plug-in (bundled within their security updates) that caused complete system compromise to Firefox users.
That's right, true to their prior merits, Microsoft seems to have found a way to take a jab at their toughest competition. They have included a Firefox plug-in that has since been found to lead to complete system compromise simply by visiting a malicious website.
Firefox responded by blocking the plug-in and notifying Microsoft. Microsoft has since corrected the issue. Read more:
Google has long been one of the top contenders when looking for web based advertising. One of the reason for Google's overwhelming success is their targeted ads. Google has recently taken their targeted ad network to an entire new level. This, as all too often is the case, is a two edged sword.
In itself this is a good idea for both the publisher and advertiser alike. The problem enters the equation when you add the 'Joe visitor' variable. You see, in order for Google to display ads to Joe that he will like, Google has to know what Joe likes. How do they gather this information. Simple - They have recently teamed up with many 3rd party advertising networks and created quite an infrastructure. Now, they place tracking cookies to track where you go, and all the data from these various companies are compiled together for a pretty complete profile of you.
How do we stop this?
Fortunately you can disable these cookies from the source. Google has even provided a Firefox add-on that will make sure your browser always remembers to block this cookie.
To opt-out of the Google/Doubleclick tracking cookies click here.
To opt-out of many 3rd party ad networks via the NAI (Network Advertising Initiative) click here.See below screenshot
Too many times we get a call from someone asking about a virus problem! Most of the time these problems can be avoided pretty easily.
One of the first steps I would recommend is to NOT run your computer as Administrator! I can't tell you how many times I have removed viruses from computers in which the owner was running the machine as admin (the Windows default set up). When you run your computer as administrator ANY code you run will run with administrative privileges i.e. It can do anything it wants!
Now, If you are running your computer as a limited user, the bad code can only infect/damage your files...not the system files. So, not running your computer as admin is step one!
Step two is to have AV (AntiVirus) software running locally on your machine. Many times people will rely on the email servers AV to protect them. For instance, they use a Yahoo email account and Yahoo scans email attachments. So if the Yahoo scan says its no threat, they will open it anyway.
We will attempt to show you some basic virus writing tactics in order to help you better protect yourself. We will be using some older viruses we wrote ourselves using VBS. These are 5 years old now and should be of no harm to any modern patched computer.
If you run a website and run PHP, CGI or other server side scripts you should seriously look into the security of said script.
Poorly written scripts can allow attackers remote access to your server!
Today we published a short article explaining how attackers use poorly written code to gain access to web servers and other machines running in the vicinity of the exploited server.
How to hide a virus within a normal media file. In this example we will be hiding a virus inside what appears to be a normal media file. When the file itself is ran, the media file will open as usual but the virus file will be launched secretly in the background.
Today Tropical PC Solutions has published an article on how to hide a virus file within a normal media file.
Today Viruses are everywhere! Malicious code is a huge problem and it isn't going to go away. People must learn how to secure their machines from such code.
