TAG | hack
When you think your phone is connected to your wireless provider, you might actually be connected to a rogue tower set up to capture your data.
Such devices have been demonstrated at the Black Hat security conference and a law enforcement fake tower called “Stingray” has been known for some time. Recently sophisticated secure phones have been able to detect these fake towers and people are starting to map them. Popular Science covered it here, and here.
There is very little transparency around law enforcement or US Intelligence use of such devices, so the could just as easily be operated by foreign intelligence services, criminals, or hackers. If we had strong end to end encryption there would be little to worry about, but many Internet connections and all phone calls are vulnerable to this attack.
This and many other articles are relaying the information that governments are encouraging users to move to Chrome, Firefox, or Safari until this Microsoft Internet explorer bug is fixed. The vulnerability seems to have been in every version of IE since 6 through the current version 11. It is a remote exploitation vulnerability, so attackers can use it to run arbitrary code on your computer, effectively “owning” it. There are some work arounds within IE that may prevent the attack, but for now it is much safer and easier to simply move to a different browser.
It is important to remember that using a VPN like Anonymizer Universal does NOT provide any protection against this kind of attack. This is an attack directly against the browser using the content you have “requested”. The attack is launched from the site you are visiting, so the hostile content would flow through the VPN unhindered.
Anonymizer strongly encourages its users to move to Firefox, Safari, or Chrome, at least until this problem is resolved.
Infosec Institute published an article showing in detail how application signing on Android devices can be defeated.
This trick allows the attacker to modify a signed application without causing the application to fail its signature check.
The attack works by exploiting a flaw in the way signed files in the .apk zip file are installed and verified. Most zip tools don’t allow duplicate file names, but the zip standard does support it. The problem is that, when confronted by such a situation the signature verification system and the installer do different things.
The signature verifier checks the first copy of a duplicated file, but the installer actually installs the last one.
So, if the first version of a file in the archive is the real one, then the package will check as valid, but then your evil second version actually gets installed and run.
This is another example of vulnerabilities hiding in places you least expect.
In this post from early 2008 I talked about a technique for detecting what sites you had visited. Almost 3 years later about 66% of users are still vulnerable to this attack according to a study (paper here) from the University of California, San Diego published in October 2010.
This study further showed that this vulnerability is being widely and actively exploited. Of the top 50,000 sites (based on Alexa ranking) 485 access information that could be used to discover browser history and 46 were confirmed to be actually performing this attack. One of those 46 was in the top 100 websites on the Internet (youporn.com).
On December 2, 2010 two Californians filed suit against youporn.com alleging that they are using this technology to exploit a browser vulnerability to gather private data without disclosing that they were doing so. They are seeking class action status for this suit.
If this succeeds it would set an interesting precedent and open a new path to enforcing privacy rights in the absence of specific legislation.
This is really just an automation of something we demonstrated in the Anonymizer Labs section of our website a while back.