[ISN] Oliver North ridicules Spitzer, calls on IT to hire war vets

http://www.networkworld.com/news/2008/031108-infosec-oliver-north.html

By Ellen Messmer
Network World
03/11/2008

ORLANDO -- At a security conference in Orlando Tuesday, Col. Oliver
North mocked the plight of New York Gov. Eliot Spitzer, caught up in a
prostitution-ring scandal that may end his political career.

North, who first gained the national spotlight because of his
involvement in the Reagan Administration-era Iran-Contra affair and who
is now a news commentator for Fox News, told security managers attending
the Infosec World Conference that Spitzer "apparently forgot everything
he knows about information security." As has been widely reported,
Spitzer is under federal investigation linking him to a high-priced
prostitute service called Emperors Club VIP through wiretaps, text
messages, e-mail and wired money transfers.

In his keynote address, North said Spitzer -- a zealous investigator as
attorney general of New York before becoming governor -- is being
investigated by federal authorities using the same technologies he has
used to crack crime cases. North poked fun at Spitzer's alleged link to
prostitution, saying "it helps to have an electronic warning on your
belt before you take off your pants."

North also lambasted newspaper and television media that he thinks
portray an inaccurate, negative picture of the War on Terrorism,
particularly in Iraq and Afghanistan.

Chiding in particular Newsweek and the Washington Post, which he called
"Washington Compost," North said, "I've made a dozen trips to the war.
The information being given to the American people is not fairly
presented." He said he knew of instances where networks in America are
buying videotape from Arab news media, such as Al-Jazeera, a practice he
condemned.

The American troops today are smart, capable and "operate and maintain
the most sophisticated weapons ever created. That information hasn't
been communicated to the American people," North told attendees at the
conference, which has attracted 1,800 people.

Although the American military today displays "competence, courage,
integrity, loyalty, tenacity and situational awareness," North said,
the "unemployment rate for veterans of this war is nearly 20%. This is
inconceivable."

He noted the national unemployment rate in general hovers around 5%.
North encouraged the information security managers attending Infosec to
hire the nation's war veterans. "This is 225,000 young Americans today
that served in the military." "They're coming out, looking for jobs," he
said. "For the good of your business and security of this nation, put
out the help-wanted signs for veterans."

When asked by an audience member whether he supported the idea voiced by
some presidential candidates about a quick withdrawal from Iraq, North
replied, "It would be an unmitigated disaster" for several reasons, one
being that it would result in the "collapse of what has become one of
our best allies in the War on Terror."

He also said the United States needs to find alternatives to petroleum
to meet its energy needs because oil money is a big factor in funding
"the jihad against America."

All contents copyright 1995-2008 Network World, Inc.


___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn

[ISN] U.Va. student claims to have cracked smartcard encryption

http://www.inrich.com/cva/ric/news.apx.-content-articles-RTD-2008-03-09-0127.html

By Brian McNeill
MEDIA GENERAL NEWS SERVICE
March 09, 2008

A University of Virginia graduate student and two fellow hackers say
they have cracked the encryption code used to protect millions of
wireless "smartcards" in use across the globe.

With readily available equipment that cost under $1,000, Karsten Nohl,
26, and his two Germany-based partners say they dismantled a tiny chip
found inside many smartcards and mapped out its secret security
algorithm.

With the cryptographic formula in hand, the hackers were then able to
run it through a computer program that tried out every possible key. It
broke the encryption after a few hours. If they were to try again, Nohl
said, it would take a matter of minutes.

"I don't want to help attackers, but I want to inform people about the
vulnerabilities of these cards," said Nohl, a doctoral candidate in
computer engineering at U.Va. who is originally from Germany.

Wireless chips, which employ technology known as radio-frequency
identification, or RFID, are found inside most modern credit cards, car
keys, security keycards and subway passes. The chips send an encoded
numeric signal to the reading device, which allows the user to wave
their card to gain access to secure buildings, remotely unlock a car,
pay for public transportation and much more.

The popular chip that the trio "dissected" is called the MiFare Classic
RFID chip and is manufactured by NXP Semiconductors, a Netherlands-based
company.

Nohl and his colleagues found that it was fairly easy to crack the RFID
chip's code.

The three computer whizzes announced their findings at the Chaos
Communications Congress in Berlin, an annual worldwide convention of
hackers. They are not releasing the details of how they beat the chip's
security code. But, Nohl added, it is possible that criminals might also
have done so.

Manuel Albers, director of regional marketing for North and South
America for NXP, disputed that Nohl and his compatriots breached the
chip's security, as they obtained only a portion of the cryptographic
algorithm. In fact, he said, the company's chips have multiple layers of
security and are not in danger of being totally compromised.

The company has been in contact with Nohl and his team and is reviewing
their findings, he said.

"We constantly improve and review our products to make sure it's up to
snuff with the latest security threats," he said.

Moreover, Albers said, NXP manufactures chips with a range of security
levels from zero to substantial protection. The chip examined by Nohl
was a relatively simple version with little security, he said.

In a statement, NXP added that the MiFare Classic "is not used in
banking, payment, nor automotive security applications anywhere in the
world. The MiFare Classic is predominately used in automatic fare
collection applications and access control applications."

Projects such as hacking the security code of an RFID chip are the "evil
twin" of Nohl's regular research, he said, which focuses on the
development of cryptographic algorithms for computer security. Nohl's
faculty advisor, David Evans, an associate professor in U.Va.'s School
of Engineering and Applied Science, said in a statement that exposing
security flaws through hacking helps ensure that future products are
more secure.

Hacking, Nohl said, refers to the practice of investigating the internal
processes of computing technology. It is often mistaken for "cracking,"
he said, which means to break into computer processes for fun, vandalism
or profit.

Nohl said that a more secure option for RFID security codes would be to
rely on publicly known and time-tested security algorithms. NXP's secret
code, he said, is an example of "security by obscurity," or the practice
of keeping the code private and hoping hackers do not figure it out.
Private algorithms, Nohl said, are more likely to have flaws and
vulnerabilities.

"We found significant vulnerabilities in their algorithm," he said. "By
keeping it secret, they hurt themselves in the end." Brian McNeill
writes for The Daily Progress in Charlottesville.


___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn

[ISN] US, UK and friends have cyber-war party

http://www.theregister.co.uk/2008/03/10/cyber_storm_ii_exercises/

By Dan Goodin in San Francisco
The Register
10th March 2008

Business and government leaders from the US, UK and three other
countries will spend much of this week simulating and defending against
a large-scale cyber attack in an exercise designed to strengthen
coordinated responses to what many perceive as a growing threat.

Participants of Cyber Storm II, which also include about 40
private-sector companies, will enact a scenario in which "persistent,
fictitious adversaries" launch an extended attack using websites, email,
phones, faxes and other communications systems. Other countries involved
are Australia, New Zealand and Canada.

Cyber Storm II comes two weeks after the Pentagon released an assessment
of China's military might, warning the People's Liberation Army was
intent on expanding its capabilities for cyber warfare. It also comes
amid intelligence reports that utilities in several countries have
sustained cyber attacks that caused power outages.

This week's exercises are a follow up to Cyber Storm I, which was
completed two years ago. They are mandated by an act of Congress that
requires the public and private sectors to strengthen cyber
preparedness.

Companies including Cisco, Juniper Networks, Dow Chemical, Air Products
& Chemical and Wachovia are participating. Nine US states and at least
18 federal agencies are also involved. They represent the chemical,
information technology, communications and transportation industries,
which are considered ctritical parts of the infrastructure. The US
Department of Homeland Security is hosting the event - no doubt with
danishes and plenty of Starbucks coffee.

The exercises are designed to sharpen and assess participants' ability
to respond to a multi-day, coordinated attack and better understand the
"cascading effects" such attacks can have.

Results of Cyber Storm I pointed the the need for better coordination
between various agencies and for a common framework for communicating
among different parties.

While it's not necessarily a bad idea to simulate imagined threats,
there's no indication that participants will delve into actual practices
that are known to put national security at risk. For example, last week
came word that a private website operator regularly received official
Air Force communications containing sensitive information because his
email address was similar to those of military leaders. Additionally, a
Pentagon official has now confirmed that an attack last year on a
network belonging to the Department of Defense involved a Windows
vulnerability and allowed the intruders to steal "an amazing amount" of
data.

As these episodes make clear, sometimes we can be our own worst enemy,
no simulation necessary. ®



___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn

[ISN] Chinese 'hacker' denies CNN report

http://www.china.org.cn/china/national/2008-03/11/content_12264393.htm

Shanghai Daily
March 11, 2008

The founder of a domestic hacker website has criticized a CNN report
that claimed he was employed by the Chinese government to attack a
United States government website, a Beijing newspaper reported today.

CNN claimed the central government has employed and paid several young
operators of a website to "attack the world's most sensitive sites,
including the Pentagon" in a report named "Chinese hackers: No site is
safe" on March 7, Global Times said.

The CNN report said the interviewees, identified as Xiao Chen, admitted
"they have hacked into the Pentagon and downloaded information," and was
"paid secretly by the Chinese government" after doing so.

Xiao, the co-founder of Zhejiang-based website Hacker4.com for computer
fans to exchange information, said he never said this to the journalist,
said the Global Times, which is affiliated to People's Daily.

Shanghai Daily checked Hacker4.com and found most of its information
concentrates on providing tips on how to prevent hacker attacks. It
publicizes the loopholes of operating systems and teaches users how to
recover from cyber viruses.

"The whole CNN report was groundless," Xiao Chen told the Global Times.
They apparently wrote that for certain purposes, Xiao added. He spoke to
Global Times to "clarify the case" after seeing the CNN report.

A journalsit from CNN sent more than 20 e-mails to set up an interview
with Xiao, saying he just wanted to introduce his website, said Xiao in
the report.

But the journalist kept asking whether he had accessed the Pentagon's
website and if the Chinese government paid them.

He denied answering any questions like that, the Global Times report
said.

"I have never had access to any overseas website, let alone attacked
one," Xiao told the newspaper.

The US Department of Defense claimed Chinese hackers always attacked its
government website in the Chinese Military Report on March 4. However,
US-based information security system company Symantec reported that most
hackers were in the United States and China is one of the victim
countries, the Global Times report said.


___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn