SIM cards vulnerable to hacking

Hundreds of thousands of mobile phones may be vulnerable to spying because of the utilization of outdated, 1970s-era cryptography, in accordance to new exploration because of be presented on the Black Hat security conference.

Karsten Nohl, an professional cryptographer with Protection Research Labs, has discovered a method to trick mobile phones into granting accessibility to the device’s spot, SMS functions and allow modifications to a person’s voicemail amount.

Nohl’s analysis looked at a mobile phones’ SIM (Subscriber Identification Module), the little card inserted into a device that ties it to a telephone amount and authenticates computer software updates and commands sent over-the-air from an operator.

A lot more than 7 billion SIM cards are in use globally. To make certain privacy and safety, SIM cards use encryption when communicating with an operator, however the encryption standards use fluctuate extensively.

Nohl’s analysis found that a lot of SIMs use a weak encryption conventional dating in the 1970s known as DES (Data Encryption Typical), according to a preview posted on his company’s blog.

DES has long been considered a weak type of encryption, and many mobile operators have upgraded now to far more safe types. It truly is reasonably easy to find the private essential employed to signal articles encrypted with DES.

In its experiment, Safety Investigation Labs sent a binary code in excess of SMS to a device utilizing a SIM with DES. Because the binary code wasn’t properly cryptographically signed, it would not run to the gadget.

But although rejecting the code, the phone’s SIM tends to make a essential mistake: it sends back more than SMS an error code that carries its personal encrypted 56-bit private important, according towards the company. Due to the fact DES is thought of an extremely weak form of encryption, it’s achievable to decrypt the personal crucial utilizing identified cracking methods.

Safety Exploration Labs did it in about two minutes on the typical laptop or computer together with the assistance of the rainbow table, a mathematical chart that helps convert an encrypted private critical or password hash into its authentic type a lot quicker.

Using the private DES key in hand, it really is then probable to “sign” malicious software program updates together with the key, and send individuals updates to your gadget. The device believes the software originates from a legit supply after which grants accessibility to sensitive data.

The enterprise outlined an assault situation towards SIM cards that run some type of Java virtual machine, a computer software framework for Java applications.

Making use of the SIM’s personal important, an attacker could force the SIM to download Java applets, that are fundamentally extremely small applications that complete some function. These applets would be “allowed to send SMS, alter voicemail numbers, and query the telephone place, amongst numerous other predefined functions.”

“These abilities alone present lots of likely for abuse,” the enterprise wrote.

Possible treatments for the problem such as ensuring SIM cards use state-of-the-art cryptography and also working with Java virtual machines that restrict applets’ entry to particular information and facts.

Nohl’s presentation, ”Rooting SIM cards,” will consider area in the Black Hat protection conference in Las Vegas on July 31.

source: http://www.pcworld.com/article/2044880/sim-cards-vulnerable-to-hacking-says-researcher.html

relate article: Google Earnings: Profit Up but Search-Ad Prices Drop 6%
                Intel announced second quarter earnings: net profit fell 29%
    Hackers ask the federal government not to participate in its annual meetings

NSA hacks China, leaker Snowden claims

Hong Kong (CNN) -- U.S. intelligence agents have been hacking computer networks around the world for years, apparently targeting fat data pipes that push immense amounts of data around the Internet, NSA leaker Edward Snowden told the South China Morning Post on Wednesday.

Among some 61,000 reported targets of the National Security Agency, Snowden said, are thousands of computers in China -- which U.S. officials have increasingly criticized as the source of thousands of attacks on U.S. military and commercial networks. China has denied such attacks.

The Morning Post said it had seen documents provided by Snowden but was unable to verify their authenticity. The English-language news agency, which operates in Hong Kong, also said it was unable to independently verify allegations of U.S. hacking of networks in Hong Kong and mainland China since 2009.

Snowden told the paper that some of the targets included the Chinese University of Hong Kong, public officials and students. The documents also "point to hacking activity by the NSA against mainland targets," the newspaper reported.

The claims came just days after U.S. President Barack Obama pressed Chinese President Xi Jinping to address cyberattacks emanating from China that Obama described as "direct theft of United States property."

Snowden's allegations appear to give weight to claims by some Chinese government officials that the country has been a victim of similar hacking efforts coming from the United States.

His claims came as Gen. Keith Alexander, the National Security Agency chief, testified at a U.S. Senate hearing that the country's cyberinfrastructure, including telephones and computer networks, is somewhat vulnerable to attack.

On a scale of one to 10, "our critical infrastructure's preparedness to withstand a destructive cyberattack is about a three, based on my experience," he said.

In the Morning Post interview -- published one week after the British newspaper The Guardian revealed the first leaks attributed to Snowden -- he claimed the agency he once worked for as a contractor typically targets high-bandwidth data lines that connect Internet nodes located around the world.

"We hack network backbones -- like huge Internet routers, basically -- that give us access to the communications of hundreds of thousands of computers without having to hack every single one," the newspaper quoted him as saying.

A "backbone" is part of the inner workings of a computer network that links different parts of that network. It is used to deliver data from one part of the network to another and, as such, could expose data from multiple computers if hacked.

'Trying to bully'

Snowden, 29, worked for the Booz Allen Hamilton computer consulting firm until Monday, when he was fired after documents he provided to journalists revealed the existence of secret programs to collect records of domestic telephone calls in the United States and the Internet activity of overseas residents.

While he has not been charged, the FBI is conducting an investigation into the leaks, and he has told The Guardian that he expects the United States will try to prosecute him.

Snowden told the Morning Post that he felt U.S. officials were pressuring his family and also accused them of "trying to bully" Hong Kong into extraditing him to prevent the release of more damaging information.

He vowed to resist extradition efforts if it comes to that, saying he "would rather stay and fight the United States government in the courts, because I have faith in Hong Kong's rule of law."

"My intention is to ask the courts and people of Hong Kong to decide my fate," the South China Morning Post quoted Snowden as saying. "I have been given no reason to doubt your system.''

But Hong Kong lawmaker Regina Ip, a former secretary of security for the territory, said Tuesday that while any extradition process could take months, Snowden isn't necessarily beyond the reach of the United States.

"If he thought there was a legal vacuum in Hong Kong which renders him safe from U.S. jurisdiction, that is unlikely to be the case," she said.

The newspaper said Snowden has been hiding in undisclosed locations inside the semi-autonomous Chinese territory since checking out of his hotel room Monday -- a day after he revealed his identity in an interview with The Guardian.

Snowden told the Morning Post he is not trying to evade U.S. authorities.

"People who think I made a mistake in picking Hong Kong as a location misunderstand my intentions," the newspaper quoted him as saying. "I am not here to hide from justice; I am here to reveal criminality."

The NSA and the National Intelligence director did not immediately respond to a CNN request for comment.

Asked during a media briefing on Wednesday for comment on Snowden's latest claims, U.S. State Department spokeswoman Jennifer Psaki declined. She said she had not seen the latest Morning Post report.

On the defensive

The revelations have renewed debate over surveillance in the United States and overseas in the name of fighting terrorism, with supporters saying the programs revealed by Snowden are legal and have helped stop terror plots. Civil liberties advocates, however, call the measures dangerous and unacceptable intrusions.

Such criticisms have put Obama and his allies on the issue -- both Democrats and Republicans -- on the defensive against mounting criticisms from a similarly bipartisan group of critics demanding changes to rein in the programs.

There also is a sharp division among Americans over the issue.

A Gallup poll released Wednesday found that 44% of Americans believe Snowden did the right thing by releasing details about the classified surveillance programs, while 42% said it was wrong and 14% said they were unsure.

The poll for that question had a 6% margin of error.

It also found that more Americans disapprove than approve of the government's surveillance programs, 53% to 37%. Ten percent had no opinion.

The poll for that question had a 4% margin of error.

Those differences were on display Wednesday when Alexander, the director of the National Security Agency, testified at a hearing into cybersecurity technology and civil liberties.

Officials have been unable to explain controversial data mining programs because they have been classified, Alexander testified.

But Alexander rejected the Snowden's claim that the NSA could tap into any American's phone or computer.

"I know of no way to do that," Alexander said.

But he testified that phone records obtained by the government helped prevent "dozens" of terrorist events.

He would not discuss disrupted plots broadly, saying they were classified. But he did say federal data mining appeared to play a role in helping to disrupt a plot in recent years to attack the New York subway system.

Alexander said information developed overseas was passed along to the FBI, which he said was able to identify eventual suspect Najibullah Zazi in Colorado and ultimately uncover a plot. Zazi pleaded guilty to terror-related charges in 2010.

While not on the roster for Wednesday's hearing, another administration official in the spotlight is Director of National Intelligence James Clapper, whom Democratic Sen. Ron Wyden has singled out for how he answered questions about the telephone surveillance program in March.

In March, Wyden asked Clapper whether the NSA collects "any type of data at all on millions or hundreds of millions of Americans?"

"No sir," Clapper said.

On Saturday, Clapper told NBC News that he answered in the "most truthful or least most untruthful manner" possible.

Clapper told NBC that he had interpreted "collection" to mean actually examining the materials gathered by the NSA.

He previously told the National Journal he had meant that "the NSA does not voyeuristically pore through U.S. citizens' e-mails," but he did not mention e-mails at the hearing.

EU questions

Fallout over revelations about the NSA's intelligence-gathering has reached the European Union's governing body, where Vice President Viviane Reding raised concerns that the United States may have targeted some of its citizens.

Reding said she plans to raise the issue during a meeting Friday with U.S. Attorney General Eric Holder.

"The respect for fundamental rights and the rule of law are the foundations of the EU-U.S. relationship. This common understanding has been, and must remain, the basis of cooperation between us in the area of Justice," Reding, the EU commissioner for justice, said Wednesday.

"Trust that the rule of law will be respected is also essential to the stability and growth of the digital economy, including transatlantic business. This is of paramount importance for individuals and companies alike."

source:http://edition.cnn.com/2013/06/12/politics/nsa-leak/index.html?hpt=hp_t2
my web:dbuying.com