Many attempts are made to secure a system from external attacks, but insider attacks are more harmful. Edward Snowden is the best example of that. ‘According to recent Verizon report, insider threat accounts for around 14% of data breaches in 2013’

To avoid this insider attack by rouge employees, CloudFlare has released an open source encryption software with “two-man-rule-style” encryption and decryption method called “Red October”.

As name suggests, it will need authorization from 2 persons simultaneously to get access to sensitive data. The basic idea is explained in this diagram.

To download the project visit: https://github.com/cloudflare/redoctober

To read more visit: http://thehackernews.com/2013/12/red-october-crypto-app-encryption-decryption.html

According to a number of news reports, NSA has been collecting 125 billion calls in just one month.

As you can see from the heat map, most of the calls originated from the middle east. So the number of calls that the NSA collected are

Pakistan: 12.76 Billion
Afghanistan: 21.98 Billion
India: 6.28 billion
Iraq: 7.8 billion
Saudi Arabia: 7.8 billion
United States: 3 Billion
Egypt: 1.9 Billion
Iran: 1.73 Billion
Jordan: 1.6 Billion
Germany: 361 Million
France: 70.2 Million
Spain: 61 Million
Italy: 46 Million
Netherlands: 1.8 Million
The rest of the world: Lots and Lots

Total: 124.8 billion.

They were able to capture so much data because phone call, email or chat will take the cheapest path, not the physically most direct path. Much of the world’s communication flow through US.

One intriguing thing I noticed is that how they were able to have enough computing power to process those immense data considering that the budget is only $20M per year. (Were they using EC2 for free?)

Reference

[1] http://cryptome.org/2013/10/nsa-125b-calls.htm

[2] http://cryptome.org/2013/10/nsa-prism-13-1021.pdf

Most popular web services that you visit today require you to login using a username and password. If authenticated, the server saves a cookie on the user’s computer which will be sent along with every subsequent request. This cookie acts as an authentication token that tells the server that the request maker has full access to the current account.

HTTP hijacking, or otherwise known as sidejacking, occurs when an attacker captures a user’s cookies and is able to login as said user with all privileges and accesses intact.

When using an open wireless network, your network traffic is available for everyone to see. This includes cookies. Thus, it’s almost trivially easy for an attacker to steal your cookie on an open wireless network and perform a sidejacking attack.

The only real defense from sidejacking is to force ssl end to end encryption from the moment the user connects to the server. The downside is that this makes each and every network request more expensive and was enforced by very few of the major service providers.

While sidejacking vulnerabilities have always been a major security flaw in open wireles
networks, it didn’t receive much public attention until in 2010 when developer Eric Butler published an infamous firefox app known as firesheep.

Firesheep automated sidejacking attacks. If connected to an open wireless network, it would automatically capture any cookies sent through the air. It also contained a list of configurations for popular web services like facebook and google. When a cookie of a corresponding service was detected, the users name and picture would be displayed on the sidebar. Clicking on the name would take you to the users account.

After the release of firesheep, major websites like google and facebook enforced SSL only connections and enabled the secure attribute on their authentication cookies that mandated these cookies could only be sent over https.

I was curious to see that now, over two years after firesheep, exactly was the state of sidejacking protection is in major web services. Many of my friends use Rice Visitors as their default form of wireless without batting an eye. Even among my more tech inclined friends who knew the dangers of using open wireless, they wasn’t much alarm at using
open wireless. Were they safe?

I examine the top 10 sites on the web as according to their ranking on Alexa.

1. Google:
Https only. In addition, copying cookies verbatim didn’t lend to successful sidejacking attack.

I logged in to the same gmail account on a different browser and found that there were two cookies with different values in my two gmail sessions.

GX
GMAIL_AT

These cookies both had a random seeming alphanumeric value. Deleting GMAIL_AT didn’t seem to affect anything but deleting GX logged me out of my account. My guess is that GX is some sort of distinct session based value that google uses to thwart sidejacking attempts.

2. Facebook:
Https only. Authentication cookies (c_user) are https only.

Visiting the website using http reveals the locale of the user via non secure cookies. The attacker, if accessing the same wireless network as the victim, should already have access to this information so it doesn’t seem to be much of a vulnerability.

3. Youtube:
Http access only. Confirmed sidejacking. I suppose that adding the extra latency of SSL on top of the world’s largest online streaming video site is not something google decides is feasible at the moment.

4. Yahoo:
Http access only. Confirmed sidejacking.

5. Baidu:
Http access only. Confirmed sidejacking.

6. Wikipedia:
Http access. Optional https available. Confirmed sidejacking.

7. Windows Live:
Https only. Got this warning when logging in via Http.

“””
As long as you’re just reading and writing email, signing in with “https” gives you extra security. But this extra security disappears if you check your calendar, edit a contact, or go to another site.For the most secure connection, we strongly recommend that you change your settings to always use HTTPS.
“””

In addition, it doesn’t seem that the cookies in live have the “secure” setting set to true. That means if a user is logged in and visits live.com over HTTP, their cookies will still be sent over the clear before being redirected to HTTPS.

8. Amazon
Http access only . Confirmed sidejacking.

At first this seems like a glaring security hole. Amazon is the world’s largest online retailer and as of 2011, was processing $17.43 billion worth of items annually (source: http://phx.corporate-ir.net/phoe…).

Amazon asks for user password when

asks you for confirmation before making a purchase. Confirmation is also
necessary to do anything privacy related, whether it’ll be changing
account information or looking at past orders. j

9. QQ
Http access only. Confirmed sidejacking.

10. Twitter
Https only. Authentication cookies (auth_token) are https only.

Article

This article talks about research from Columbia University that reveals security hole presented by network printers.

While before these were rare machines used solely in enterprise, they are more and more becoming a common installation in every home, office and public institution.

Through the use of firmware updates, attackers can install and do arbitrary code execution via security holes in network printers.

While most people regard printers as dumb devices, an more accurate description would be a server on the local network.

This article goes to show that anything that is connected to the internet and has access to some sort of privileged information or permission can and should be considered a security thread.

https://www.privateinternetaccess.com/blog/2012/11/even-a-vpn-service-cant-protect-your-privacy-if-youre-using-bank-of-america/

This is an article describing a flaw in Bank of America’s privacy system.
Bank of America lets customers have full access to their account and account details with a phone and social security number.
Phone numbers are easy to get nowadays and don’t warrant a discussion; social security numbers are also increasingly common (any business that pays an individual more than $600 a year needs the individual to sign an IRS W-9 form which includes a social security number).

While the digital age has enabled an unprecedented way of storing and retrieving large amounts of data, it has also led to some unfortunate consequences like the death of privacy.
I don’t believe that the lack of privacy is an inherent problem with the present technologies but rather the attitude and policies that vendors and consumers continue to hold about personal data.
It’ll be interesting to see in the next 10 years where the trend in individual privacy and the security around that will go.