Thursday, February 4, 2016

What is Logjam Attack ?


By default, internet is unsecured. Data transferred between two hosts normally are not encrypted. As a result, attackers can intercept the connection easily and listen to the conversation.

To counter the problem, we use protocols like SSH, SSL and TLS. These protocols establish a secure connection between two hosts and encrypt the data before transferring it. Email communications, bank transactions or VPN connections rely on these secure protocols.

If we look deeply, to establish a secure connection, the two hosts need to agree on a few parameters like the secret keys using which the data is encrypted and then transferred. And, that is exactly when protocols like Diffie-Hellman Key Exchange Protocol are used.

To transfer data in encrypted fashion, the two hosts communicating over the unsecured network need to agree on some secret parameters. And, these parameters need to get exchanged even before a proper secure connection is established. So, clearly at that point the communication can be intercepted by an attacker. So, the secret parameters cannot be exchanged as it is.

Diffie-Hellman Key Exchange Protocol enables the two hosts to agree on secret parameters for the secure communication, without transferring the secret parameters themselves.




Classical Diffie-Hellman Key Exchange Protocol


Let's try to understand in simple English, how Diffie-Hellman Protocol actually works.

Let's say, Alice and Bob are communicating with each other over the unsecured network and they want to agree on a secret parameter K, using which they would later encrypt all the data getting transferred between them.





To do that, Alice and Bob will first agree on a prime number p and a generator g which is a primitive root of p.

Now, Alice will take an integer a secret only to her and compute A = ga mod p Alice will then transfer A to Bob.

Now, Bob will receive A and compute B = gb mod p, where b is an integer secret only to Bob. Bob will transfer B to Alice.

Now, Alice will compute K = Ba mod p

And, Bob will compute K = Ab mod p


Because of properties of p and corresponding g, K = Ba mod p = Ab mod p

Please note that, even if an attacker eavesdrop the connection and grabs the values of g, p, A and B which are communicated between Alice and Bob, it will be computationally infeasible for the attacker to derive the value of secret parameter K. And, now Alice and Bob are free to encrypt the data using the secret key K and transfer between them.

To find out more on Diffie-Hellman Key Exchange Protocol, please see Diffie-Hellman Key Exchange Protocol




Where is Diffie-Hellman Key Exchange Protocol Used


Diffie-Hellman Key Exchange Protocol is used in protocols like SSL/TLS and IPSec. These protocols are used extensively in bank transactions, email communications, VPN Connections etc.




Implementation of Diffie-Hellman Key Exchange Protocol in Server-Client Secure Communications


There are many types of Diffie-Hellman Key Exchanges like Diffie-Hellman or DHE cipher suites, Elliptic Curve Diffie-Hellman or ECDHE cipher suites. An important property of DHE and ECDHE is they both provide Forward Secrecy, which means, even if the server key is compromised at some point, the key cannot be used to decrypt past connections. This ensures security in a better way.

Logjam Attack applies to non-EC Diffie-Hellman Key Exchange or DHE. So, we will discuss about how DHE works between a server and the client in this article.


This is how the server and the client communicate with each other in DHE.

  • The client sends a Client Hello message to the server and advertises its support for DHE cipher suites.
  • The server picks the parameters and performs half of the DH computations using those parameters.
  • The server signs those parameters using its certificate and sends them to the client.
  • The client verifies the signature, performs rest of the computation using the parameters and sends the result to the server.
  • Both the server and the client put all the computations together and derive the secret key, using which they can now encrypt the data transferred between them.



What is Logjam Attack


I think now we are quite ready to discuss about Logjam Attack. Logjam Attack is an attack which was first reported in May, 2015.

Some servers and clients support DHE_EXPORT instead of the DHE cipher suites. Because of this, the server and the client communicationg with each other select weaker parameters for Diffie-Hellman Key Exchange. Weaker parameters, especially the length of prime number p, weakens the algorithm much, especially when p is selected to be 512 bit long.

If we look deeply, if an attacker captures the value of g and ga and from there compute the value of a, he can make an attack. And, this becomes considerable easier when the selected prime number p is 512 bit long.

So, if the client asks for DHE_EXPORT, instead of DHE to the server and selects the length of p to be 512 bit long, the algorithm becomes vulnerable. And, the attackers exploit this opportunity.


In Logjam Attack, the attacker intercept the connection between the server and the client and replaces the ciphersuites with DHE_EXPORT.

The server cannot understand the trickery of the attacker. It simply goes for DHE_EXPORT and selects weaker parameter of 512 bit.

The server continues with its computation and sends the signed parameters to the client.

When the client finds DHE_EXPORT, it also cannot understand the trickery. It supposes the server does not support DHE and it continues with its computations using those parameters.

The server and the client goes ahead with deriving the secret key. But, the attacker breaks that easily and gets the secret data.



Mitigation


So, the most important question is can we mitigate this attack ?

The answer is yes.

The server and the client communicating with each other can draw a line about how weak the parameters can be. The server can opt for selecting parameters which are at least 1024 bits long. And, the client can refuse to connect to any server which select parameters weaker than 1024 bits.


Good that most of the web browsers including Chrome, Firefox, Safari, Internet Explorer are working on this.  
Posted by at No comments:

Wednesday, February 3, 2016

What is Juice Jacking ?


Smart phones and tablets are indispensable today. We can hardly think of even a single day without them. We carry them almost everywhere we go. And, that results in the most common problem we face with them. We need to charge them quite often.

Sometimes when we are travelling, we run out of charges and we end up going to public charging kiosks to charge them. But, how safe is that ?


In fact, attackers can take advantage of charging mobile devices from public charging kiosk and perpetrate attacks. Juice Jacking is one such example.






How is Juice Jacking done ?


We often charge our mobile devices with a USB charger. And, the same cable is used for data connection also. And, that results in another vulnerability which attackers can exploit to invade privacy and steal sensitive data from the device.


In 2011, Brian Krebs first reported on this attack. He suggested, it is quite possible for attackers to set up a rogue public charging kiosk and hide a small computer inside it. As a result, when a smart phone or tablet will be plugged in to it using a normal USB cable, the hidden computer will be able to inject malicious code or steal sensitive information like contact list, emails or other data stored in the device.


How to prevent Juice Jacking ?


Smart phone vendors are already taking steps to prevent this attack. For example, Apple iOS nowadays no longer allow the device to be automatically mounted. They have also released various security patches to fight with the vulnerability.

Android devices also prompt the user before mounting the device as a hard drive when plugged in over USB.

And there are always a couple of steps that we can take to safeguard us from this attack.

  • If you are using a public charging kiosk, use the power cord that directly plugs into a regular electrical outlet.
  • Power off your device before charging it into a public charging kiosk.
  • You can also use “Juice Jack Defender” to charge your mobile devices. These are small USB pass-through devices that enables the charging of mobile devices, but blocks the data transfer capability using that cord.


How to know whether my device is vulnerable to Juice Jacking ?


Plug in your device to a computer using a normal USB charger. If it mounts the device automatically and allows data transfer with the cord, your device is vulnerable to Juice Jacking.

If the device does not automatically mount as a hard drive using the USB cable and instead ask for a prompt to be allowed to be mounted, your device is not vulnerable to this attack.



Posted by at No comments:

Tuesday, February 2, 2016

What is BlueSniping ?

If not redirected, please click here https://www.thesecuritybuddy.com/bluetooth-security/what-is-bluesniping/

Attackers often find numerous ways to steal sensitive data from devices. Even Bluetooth enabled devices are not safe from attackers. And, BlueSnarfing is an example of such threat.

As discussed in BlueSnarfing, using this technique attackers connect to Bluetooth enabled devices, especially in public places and get access to all data stored in the Bluetooth enabled devices.





But, attackers found limitations of this technique. BlueSnarfing is applicable to Bluetooth enabled devices which are placed within a range of few meters. Clearly, it is much inconvenient for attackers to make this attack.

And, BlueSniping is a technique used by the attackers to counter that. It is a technique which is used by the attackers to increase the range of attacked Bluetooth devices even up to a mile (1.6 km). Attackers use BlueSniping to get information about Bluetooth enabled devices which are within a range of upto a mile and connect to them to steal sensitive information from them.


How is BlueSniping done ?


BlueSniping is done by the attackers using a specialized hardware called BluSniper Gun. It is normally made with hardware pieces like Folding Stock, Yagi Antenna and Linux powered embedded PC.

On placing the BlueSniper Gun in a suitable location, all the discoverable Bluetooth enabled devices show up in the PC. The attackers can now connect to them to steal sensitive data from them.

Attackers can even use several BlueSniper Guns to locate moving Bluetooth devices.


How to prevent BlueSniping ?


The most common way of mitigating this attack is to disable Bluetooth of devices in public places or whenever it is not needed.

One can change settings of devices to make the devices non-discoverable when not needed. This will prevent the devices from being listed to the attackers when the attackers scan for Bluetooth enabled devices in nearby places. But, this cannot prevent BlueSniping of those devices completely. Because, attackers can use a device's MAC address to pair with a Bluetooth enabled device, even when it is in non-discoverable mode. Each Bluetooth device has a unique 48 bit MAC address, which consists of first 24 bits of manufacturer specific information and remaining 24 bits of unique information specific to the device. But, this can at least safeguard us in a better way.


So, beware of all security vulnerabilities so that you can protect your devices and the data within in a better way and stay safe, stay secured.

Posted by at No comments:

What is Wardriving ?


Nowadays we use wireless networks almost everywhere starting from home, restaurants, cafeteria to various organizations. Because of convenience of using the wireless internet, we sometimes connect to the Wi-Fi networks without passwords or encryption. And, that gave rise to another threat of wireless networks – wardriving.









What is wardriving ?


Wardriving indicates scanning and connecting to a wireless network illegitimately for malicious purposes. Attackers often do it to steal sensitive information, spread malware or other nefarious activities. They normally scan a neighborhood for less secure wireless networks and connect to them with malicious purposes.


How is wardriving done ?


It is fairly simple for wardrivers to do wardriving. A moving car, a laptop or other mobile device, a GPS and an omnidirectional antenna often solve the purpose. There are a number of software available that the attackers normally use for finding out wireless access points.

Attackers normally do wardriving in the following manner :

  • They place a laptop and GPS inside their car and mount the omnidirectional antenna on top of their cars.
  • They select their target area. Normally, a densely populated area with good household income is targeted.
  • They start roaming in the locality in their car and scan for available wireless networks using some specialized software.
  • After they have collected the data, they place the location of obtained wireless networks access points in a map.
  • Now, the wardrivers are free to upload the data in their websites, which they can later use for making more attacks.


Can we detect wardrivers ?


We can detect wardrivers with a system and a software like Kismet. The following steps might be taken to detect wardrivers :

  • Setup a stationary computer a wireless LAN card.
  • Run the software.
  • Wardrivers normally emit a packet of data after detecting a wireless access point. This packet of data can be used as a signature. The software can scan for the signature and report if found any.


How to prevent wardriving ?


We can always take a couple of steps to prevent wardriving of our wireless networks.

  • Turn off your wireless network when you are not at home.
  • Make sure to change the default password of the router.
  • Keep a strong administrative password for your router.
  • Make sure your router is using an up-to-date encryption. Old routers normally use WEP or Wired Equivalent Privacy encryption. But, this encryption is known to be considerably weak. Instead you may prefer to use WPA or Wireless Protected Access with Advanced Encryption Standard or WPA2.
  • You can hide your network name or SSID or Service Set Identifiers for better protection. This will prevent the wardrivers from finding out your wireless network, unless they know the exact network name.
  • It is always a good practice to configure firewalls in your system to prevent network intrusions.



Posted by at No comments:

Monday, February 1, 2016

What is Pod Slurping ?


Nowadays we take several steps to ensure safety of our data. We configure firewalls, install Intrusion Detection and Prevention software and take help of anti-malware programs to prevent theft of sensitive data. No doubt these help us a lot. But, alas, there are still methods which can bypass all these safety measures, irrespective of however strong they are, and steal sensitive data. Pod Slurping is one such example.





What is Pod Slurping ?


Pod Slurping is a technique used by miscreants to steal sensitive data from a system using some simple devices like iPods, USB Sticks, Flash devices and PDAs. The miscreants simply plug these devices to the system containing data and transfer those within few minutes.

The vulnerability was first discovered by Security Expert Abe Usher. He created a Proof of Concept by using a small application slurp.exe and his iPod. He plugged in the device to a computer and was able to transfer considerable amount of sensitive data just in 65 seconds.

This attack is indeed a very simple, but a serious one. If any miscreant who has physical access to a computer, can use this technique. It does not require much software knowledge to steal information using Pod Slurping.

And, it is much difficult to prevent this. Almost every computer has USB ports enabled and anyone including employees of a company possess devices like iPods, MP3 Players or USB Sticks.


How to prevent Pod Slurping ?


As I discussed above, it proves much difficult to prevent Pod Slurping. In an organization, disabling USB ports or prevent users from using USB Sticks is one method of preventing this attack. But, it is no doubt inefficient. USB ports and USB Sticks are much helpful in our daily life and preventing the use of them will rather make our life difficult.

In Unix based systems Pod Slurping can easily be prevented though, by preventing users from mounting portable devices. Microsoft also has released instructions to prevent users from installing USB mass storage devices on its Operating Systems.

There are also a number of third-party security products that allow companies to set security policies related to usage of USB devices.



Posted by at No comments:

What is BlueBugging ?


BlueBugging is an attack in which the attacker exploits Bluetooth enabled in a device to get unauthorized access of the system and manipulate the target device to compromise its security. Attackers often use this technique to track a victim, access his contact list, make calls or send SMS from his device or do other nefarious illegal activities.


BlueBugging was first found by German researcher Martin Herfurt in 2004 and since then it has affected many victims. Even now also there are several software available for making this attack possible.





Purpose of BlueBugging


Attackers can use this technique for many nefarious purposes. The list below mentions a few of them.

  • Attacker can install a backdoor in the target device, especially a mobile phone, and through that get control of the phone. The attackers can initiate phone calls from the device and eavesdrop phone conversations of the victim.
  • Attackers can make phone calls or SMS to premium services phone numbers and extract money from the victim.
  • Attacker can send SMS from the victim's device to the attacker and steal sensitive information of the victim.
  • Some location based services use GSM services to track their customers. For that purpose, they need to get some permission on the mobile device. In Bluebugging, the backdoor can give that unauthorized permission to the attacker and the attacker can track the victim illegally.
  • The attacker can collect information about the victim's contact list, call list and exploit those information.
  • The attacker can forward the victim's calls to the attacker and do other nefarious activities.
  • The attacker can even change Network Provider settings of the victim's mobile device.


How is BlueBugging done ?


Attacker first makes a Bluetooth pairing with the victim's device. And the attacker uses that Bluetooth connection to install a Backdoor to the victim's device. Now, the Backdoor can exploit security vulnerabilities of the device software and give unauthorized access of the device to the attacker. There are lots of software readily available which the attackers normaly use to make this attack.


How to prevent BlueBugging ?


The users can always take a couple of steps to safeguard himself.


  • Turn off the Bluetooth when it is not used. This will prevent the attacker from getting unauthorized access of the device to make this attack.
  • If you see any suspicious activities in your mobile devices, like restarting suddenly or disconnecting and reconnecting with other devices etc, be cautious. It may indicate unauthorized access of the device to the attacker.
  • Check for data usage of your device. If it suddenly increases without convincing reasons, it may indicate a Bluebugging attack.
  • If you are suspicious of Bluebugging attack of your device, do a factory reset of your device. This will remove the backdoor and unauthorized access of the device to the attacker.


Read More

What is BlueSnarfing ?

What is BlueJacking ?

What is BlueSniping ?

What is BlueSmack Attack ?

What is BlueDump ?

What is BluePrinting ?

What is BlueBump Attack ?
Posted by at No comments:

What is BlueSnarfing ?


BlueSnarfing is the illegal theft of information from Bluetooth enabled devices. Using BlueSnarfing, attackers take advantage of security vulnerabilities of Bluetooth software and access Bluetooth enabled devices illegally, without the consent of the owners of the devices.


Purpose of BlueSnarfing


Attackers use BlueSnarfing to illegally access information of the Bluetooth enabled devices. Attackers can steal information like user's contact list, text messages, email messages etc using this method. This is a completely illegal as it invades privacy of users.




How is BlueSnarfing done ?


Bluetooth enabled devices communicate with each other using a protocol called OBEX or OBject EXchange. BlueSnarfing uses security vulnerabilities of that protocol.

In BlueSnarfing, the attacker first scans for Bluetooth enabled devices, especially in public places. Then they pair with those devices without the users' consent. The attackers normally use some software to do BlueSnarfing. These software enable them to get illegal access of those devices, using which they get control of the information stored in the devices.


Adam Laurie of A. L. Digital first discovered this vulnerability in 2003. And, since then this attack has affected many users. There are quite a number of software available which can enable attackers to make this attack.


How to prevent BlueSnarfing ?


The most common way of mitigating this attack is to disable Bluetooth of devices in public places or whenever it is not needed.

One can change settings of devices to make the devices non-discoverable when not needed. This will prevent the devices from being listed to the attackers when the attackers scan for Bluetooth enabled devices in nearby places. But, this cannot prevent BlueSnarfing of those devices conpletely. Beecause, attackers can use a device's MAC address to pair with a Bluetooth enabled device, even when it is in non-discoverable mode. Each Bluetooth device has a unique 48 bit MAC address, which consists of first 24 bits of manufacturer specific information and remaining 24 bits of unique information specific to the device.


How to know whether I am BlueSnarfed ?


One way of detecting whether a user is BlueSnarfed is to use some software. The same software which are used for BlueSnarfing can be used for protection also.

Using these software a user can find out all the devices that are paired with his device and see if there is any unauthorized pairing of devices. But, if you are using these software, please make sure to use that responsibly, because these software when are used otherwise, is a legal offence.



So, beware of security vulnerabilities of your devices so that you can protect those in a better way and stay safe, stay secured.



Read More

What is BlueJacking ?

What is BlueBugging ?

What is BlueSniping ?

What is BlueSmack Attack ?

What is BlueDump ?

What is BluePrinting ?

What is BlueBump Attack ?
Posted by at No comments:

What is BlueJacking ?


Nowadays many electronic devices are Bluetooth enabled. We often use this to transfer data from one device to another device. But, hackers at times take advantage of that also. BlueJacking is an example of one such exploit.


What is BlueJacking ?


BlueJacking is a method using which hackers can send unsolicited messages to Bluetooth enabled devices using OBEX or OBject EXchancge Protocol. Using BlueJacking hackers can send unwanted text messages, images or sounds to other Bluetooth enabled devices.


How is BlueJacking done ?


Hackers mainly select a place where there are lots of Bluetooth devices present. They mainly select public places like mall, restaurants etc for that reason. After that, they search for Bluetooth enabled devices present in nearby places. If a device is Bluetooth enabled and discoverable, it gets listed. Now, the attackers can send unwanted data to those devices.




How serious a threat is Bluejacking actually ?


Well, BlueJacking does not pose much threat to users. It sends unwanted data to devices, but hackers do not get control of the devices through Bluejacking. Hackers cannot steal sensitive data from the devices either.


How is BluJacking different from BlueSnarfing ?


In BlueSnarfing, Bluetooth enabled devices are illegally hacked via Bluetooth. In BlueSnarfing, hackers can get unauthorized access of the target devices. They can exploit Bluetooth to get control of the devices and steal sensitive data also.

But, as discussed earlier, BlueJacking involves transmitting unwanted data to Bluetooth enabled devices. It does not provide unauthorized access of the device to the hackers, using which hackers can control the device or steal sensitive information.


How to prevent BlueJacking ?


Though BlueJacking is harmless, it is not at all expected. And in some countries it is illegal also.

The best method of safeguarding our devices from BlueJacking is to disable Bluetooth or make the device non-discoverable through Bluetooth while being in public place or not in use. That would prevent the devices from listing to hackers while hackers scan for nearby Bluetooth enabled devices for Bluejacking.


This article was intended to inform you about Bluejacking and its potential threats. Hope you liked it.


Read More

What is BlueSnarfing ?

What is BlueBugging ?

What is BlueSniping ?

What is BlueSmack Attack ?

What is BlueDump ?

What is BluePrinting ?

What is BlueBump Attack ?
Posted by at No comments:
Subscribe to: Posts (Atom)