Romanian Police Arrest Alleged Hacker in Pentagon, NASA Breaches
by Taylor Armerding via lynx 2012-02-16 09:01:02

A 20-year-old hacker who goes by the Internet name TinKode was arrested recently by Romanian police after he bragged about hacking into Pentagon and NASA computer systems.

Razvan Manole Cernaianu is accused of revealing security holes and publishing information about SQL injection vulnerabilities in those agencies.

The Romanian Directorate for Investigating Organized Crime and Terrorism said Cernaianu also offered a computer program on his blog that could be used to hack into websites and published a video showing Internet attacks he had made against the U.S. government.

The FBI and NASA assisted in the investigation. The U.S. Embassy in Bucharest said Cernaianu used, "advanced hacking tools to gain unauthorized access to government and commercial systems."

Cernaianu allegedly hacked into a computer server at NASA's Goddard Space Flight Center last April, and posted a screen grab that showed files connected to confidential satellite data.

Anthony M. Freed, managing editor of Infosec Island, says that TinKode is known to have taken advantage of several well-known vulnerabilities that many of his targets should have resolved before he exploited them through SQL injections -- a technique many security experts now derisively call "Hacking 101."

"His targets tend to be large entities that undoubtedly have complex network deployments and multiple interfaces for third parties like contractors or client bases," says Freed, "which provide a higher product probability of his finding unprotected points of entry."

Freed says penetration by a determined hacker is almost guaranteed in networks of this size.

"They should focus on detection and data protection within the networks," he says, "while working under the assumption that they will not be able to prevent all breach attempts.

"Advanced monitoring systems, appropriate data classification, and secondary authentication protocols for access to the most sensitive information is critical both for detecting an intrusion and slowing hackers progress. This can buy the needed time to lock down the compromised system and prevent data theft."

Gary McGraw, CTO of Cigital, says if TinKode didn't want to get caught, he should not have been bragging so publicly. "If you go looking for attention, you're probably going to get it," he says.

McGraw says the damage caused was probably minor. "But, to get past all of these silly problems, agencies like these should build systems with security in mind in the first place. Right now they are trying to fix broken systems."

© 2012 CXO Media Inc.

http://tinyurl.com/6wbpb34

Two can play the tracking game -- smartphones, a security nightmare
by Eric W. Dolan via lynx 2012-02-17 10:27:33

Take note CIA, NSA and USAF lamers, the digital sword cuts both ways -- SKILL, not money, corruption, intimidation, violence or anything else rulz cyberspace -- that is why time is on OUR side!

The ability to track the location of a cell phone user without the user’s knowledge is far too easy, computer scientists at the University of Minnesota’s College of Science and Engineering have discovered.

University of Minnesota computer science Ph.D. student Denis Foo Kune, working with associate professors Nick Hopper and Yongdae Kim, and undergraduate student John Koelndorfer, described their findings in a recently released paper, “Location Leaks on the GSM Air Interface” (PDF).

“Cell phone towers have to track cell phone subscribers to provide service efficiently,” Foo Kune explained. “For example, an incoming voice call requires the network to locate that device so it can allocate the appropriate resources to handle the call. Your cell phone network has to at least loosely track your phone within large regions in order to make it easy to find it.”

But that information is easily accessible to anyone with a cheap computer, an inexpensive phone and free open source software. Using this simple setup, the researchers where able to track the location of a test subject within a 10-block area as the subject walked through Minneapolis.

The researchers tracked the subject by tapping into the Global System for Mobile Communications (GSM) network, the predominant worldwide mobile network.

Concern has previously been raised about the ability of third parties to access the locational data kept by cell phone service providers. But unlike those cases, the researchers were able to track the cell phone without any collaboration with the service provider whatsoever.

The finding raises numerous privacy and security concerns.

“For example, agents from an oppressive regime may no longer require cooperation from reluctant service providers to determine if dissidents are at a protest location,” the researchers wrote in their study.

“A second example could be the location test of a prominent figure by a group of insurgents with the intent to cause physical harm for political gain. Yet another example could be thieves testing if a user’s cell phone is absent from a specific area and therefore deduce the risk level associated with a physical break-in of the victim’s residence.”

Copyright applies.

http://tinyurl.com/89nbulm