Blog

Posts Tagged smart home hacking

‘Operation Hangover’ hackers exploit latest Windows zero-day – Computerworld

‘Operation Hangover’ hackers exploit latest Windows zero-day

Indian gang ups its game with targeted attacks that rely on malicious Word docs

By Gregg Keizer

November 7, 2013 10:47 AM ET

1 CommentinShare4

Computerworld – The unpatched vulnerability in Windows that Microsoft acknowledged on Tuesday has been used by a known Indian hacker group responsible for earlier "Operation Hangover" attacks, security company Symantec said yesterday.

The gang behind Operation Hangover is believed to be based in India, and the bulk of the first round of cyber-espionage attacks, which were discovered in May, were aimed at its neighbor and long-time adversary Pakistan.

"After analyzing the payloads being used in this attack, we have identified that the targeted emails are part of an attack campaign known as Operation Hangover," Symantec said in a blog, referring to the newest campaign that relies on the Microsoft zero-day vulnerability to hijack and infect Windows PCs.

Microsoft issued a security alert Tuesday, saying that a vulnerability in the TIFF image-format parsing component of Windows was being exploited in attacks aimed at targets in the Middle East and South Asia, the latter region representing countries like India and Pakistan.

The attacks Symantec captured used malicious Word documents attached to emails with subject headings such as "Illegal Authorization for Funds Transfer" and "Problem with Credit September 26th 2013."

It was the first time that the Hangover group has used a zero-day vulnerability in its attacks, Symantec said.

Researcher Haifei Li of security company McAfee was the first to find and report the unpatched bug to Microsoft. The Redmond, Wash., company’s security team was alerted of the vulnerability Oct. 31.

According to Li, the exploit uses multiple XML objects to "spray the heap memory," a technique more than a decade old, to uncover sections of memory suitable for use by the actual attack code.

"It is worth [noting] that this heap-spraying in Office via ActiveX objects is a new exploitation trick which we [haven’t] seen before," Li wrote earlier this week.

Microsoft’s own researchers confirmed the ActiveX-based head-spray tactic in a detailed description published on its Security Research & Defense blog Tuesday.

This article, ‘Operation Hangover’ hackers exploit latest Windows zero-day, was originally published at Computerworld.com.

via 'Operation Hangover' hackers exploit latest Windows zero-day – Computerworld.

Posted in: Latest Computer News

Leave a Comment (0) →

Hacking Smart Homes

Hacking Smart Homes

HackSmartHome.png

Kashmir Hill, a reporter for Forbes, found out just how easy it is to hack a smart home. By “Googling a very simple phrase,” Hill was presented with a list of homes with automation systems from a well-known company. “[The] systems had been made crawl-able by search engines,” says Hill, and because the now discontinued systems didn’t require users to have a username or password the search engine results, once clicked, allowed her full control of the system. Hill contacted two of the homes she found online and, once she had asked for permission, demonstrated her ability to switch on and off lights in the homes. Hill also had the ability to control a range of other devices in the homes. This is just one example of the potential security issues surrounding home automation systems.

Home automation, the automation of things like lighting, heating, door and window locks, and security cameras  is a relatively new, but rapidly growing market currently worth US$1.5 billion in the US alone. But as with any new technology, there will inevitably be potential security risks.

Security researchers will give two separate presentations at the Black Hat 2013 security conference on security vulnerabilities in home automation systems. One of the presentations will discuss a vulnerability in a proprietary wireless protocol, Z-wave, that is used in a range of embedded devices such as home automation control panels, security sensors, and home alarm systems. The flaw allows for the encrypted communication of a Z-wave device to be intercepted and used to disable other Z-wave devices. A second talk, ‘Home Invasion 2.0,’ will present vulnerabilities discovered after several popular home automation systems were looked at. “We looked over somewhere in the range of 10 products and only found one or two that we couldn’t manage to break. Most didn’t have any security controls at all,” said Daniel Crowley of SpiderLabs. Many of the devices allow the user to download an app for their phone that allows them to control the automated system remotely. The researchers found that many systems used no authentication when communicating between the mobile device and the home system, creating opportunities for a malicious actor to take control.

Approximately three percent of homes in the US currently have home automation systems installed, but that number is set to grow, with some analysts projecting an increase that will see it reach double digits in the next few years.

In the rush to adopt new and exciting technology, keeping that technology secure may sometimes be placed low on the list of priorities. Hopefully, the vulnerabilities uncovered by this and other research will help highlight the importance of good security.

This article was found at the following link:
Hacking Smart Homes | Symantec Connect Community
.

Posted in: Latest Computer News

Leave a Comment (5) →