Tag Archives: hack

Linux

Robie Basak: Better two factor ssh authentication on Ubuntu

Leave a comment

In the past, true two factor authentication in ssh has been something of
a hack to set up. Now that OpenSSH 6.2 has now been released with full
and proper support, the next release of Ubuntu (Saucy Salamander)
will include it.

Quick Start

All you have to do is:

  1. apt-get install libpam-google-authenticator.

  2. Users who want to continue using ssh must each run the command
    google-authenticator. This tool interatively helps you to create the
    file ~/.google_authenticator, which contains a shared secret and
    emergency passcodes. It’s a terminal application, but it does still
    display a QR code for quick loading of the shared secret into your two
    factor device (in my case, this is the Google Authenticator app on my
    Android smartphone).

  3. Edit /etc/ssh/sshd_config. Set:

    ChallengeResponseAuthentication yes
PasswordAuthentication no
AuthenticationMethods publickey,keyboard-interactive

    In case you have changed them in the past, you should also check the
    following two settings (these are both defaults on Ubuntu):

    UsePAM yes
PubkeyAuthentication yes

  4. Run sudo service ssh reload to pick up your changes to
    /etc/ssh/sshd_config.

  5. Edit /etc/pam.d/sshd and replace the line:

    @include common-auth

    with:

    auth required pam_google_authenticator.so

That’s it! Now ssh logins will require a key, and after your key is
verified will additionally require proof that you hold your second
factor device.

Your existing ssh session should not be affected by these changes. So
before you continue, make sure that you can still access the machine by
authenticating with your new two factor system in another session. If
you’re using shared connections (or aren’t sure), be sure to use the
-Snone option to ssh in order to make sure that you don’t accidentally
skip authentication by re-using an existing connection.

How It Works

Traditionally, ssh only verified one thing. That was either your
password, or verification that you held your private key, or something
else (GSSAPI/Kerberos and other things I won’t cover here). Multiple
methods were allowed, and success using any one method was considered a
successful authentication.

ssh continues to be able to defer to PAM for authentication. However,
authentication with an ssh key happens outside PAM, and ssh treats any
one of these (key or PAM) as successful. This means that it checks for
your password, or that you hold your private key, but not both. This
makes it difficult to use a key together with PAM for a second factor,
since ssh will just go ahead and never consult PAM for the second factor
if your client proves that you hold your key.

With the new feature, AuthenticationMethods can be used to specify two
methods that are both required. This means that you can require both
ssh key authentication and PAM, and adjust your PAM configuration to be
the second factor device in the case of the ssh service.

Why is this more secure?

It’s always a good idea to reduce your attack surface, and limit
authentication code only to areas designed with security in mind.
Previous methods to implement this kind of support involved hacks or
patches. With this new support, the only security sensitive code used is
PAM and ssh itself, being used as they were designed to be used, and
without any third party patches. Both were designed for security from
the …read more

Source: FULL ARTICLE at Planet Ubuntu

Science & Technology

Hacker group finds a way to gain root access to Chromecast

Leave a comment

(Phys.org) —GTVHacker has posted a blog entry describing a hack they’ve done on Google’s new streaming stick Chromecast. Because the process is so simple, it appears as if Google intentionally left the “vulnerability” open for hackers and other commercial enterprises to exploit, much as they have done with Android devices. …read more

Source: FULL ARTICLE at Phys.org

Automobiles

Video: Watch how hackers can take control of your car

Leave a comment

By Jeremy Korzeniewski

When meeting a duo of computer hackers for the very first time, we imagine hearing the words, “We want to convince you that we can hurt you, without hurting you,” is bound to raise the hounds of anxiety upon your mental makeup. At least, it would ours. And it’s those words, uttered by Charlie Miller and Chris Valasek to Forbes staff reporter Andy Greenberg, that introduce us to the reality that modern-day cars can indeed be hacked.

The next frightening step, which is outlined in the video below, involves entering into a Toyota Prius that looks like a science project gone wrong – missing dash, wires hanging down and a laptop computer hiding in the back seat. It’s kind of like being a human marionette puppet with the strings held high above by Dr. Frankenstein’s techy grandson. In other words, “Are you guys both buckled up?” is no longer a friendly safety-minded reminder, it’s a scared-for-my-life requirement.

See how these two hackers earned a bunch of money from the US government to hack into a couple of cars in the video below. And keep your tinfoil hats close by.

Continue reading Watch how hackers can take control of your car

Watch how hackers can take control of your car originally appeared on Autoblog on Wed, 24 Jul 2013 16:00:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments

…read more

Source: FULL ARTICLE at Autoblog

Computers

SIM card hack has severe implications for business

Leave a comment

It’s amazing it took so long. More than 20 years after its initial development, the SIM card has been hacked. A German cryptographer named Karsten Nohl will be presenting findings to that effect at the annual Black Hat computer security conference at the end of the month.

The impact of hacked SIM cards, one of the few stalwarts in the high-tech industry that has not seen a serious exploit, could be monumental. The exploit involves simply sending a specially configured, hidden SMS to the phone, giving the attacker an easy way around that phone’s built-in encryption. Ultimately this would then give the attacker the ability to do all manner of nasty things, from having the phone send pricy for-pay text messages to recording telephone conversations. While some seven billion SIM cards are in use today, Nohl estimated that roughly half a billion mobile devices worldwide would currently be vulnerable to this type of attack.

Fixes are already in the works, but as any IT manager who’s survived an old-fashioned Windows virus onslaught knows, a fix does not necessarily equal a solution. Even if patches are made available, that’s no guarantee they’ll be universally rolled out in a timely fashion. SIM cards can be updated invisibly over the air by network operators, but that poses a secondary problem. Because users have no visibility into whether their phones are vulnerable to the attack or not, wireless customers won’t know whether or not their devices are safe.

For individuals, the risk of someone hijacking your phone and listening in on calls or making phony purchases is bad enough.

To read this article in full or to leave a comment, please click here

…read more

Source: FULL ARTICLE at PCWorld

Articles of Interest

Chicago Politician: “Police Are Killing Some Of These Kids.”

Leave a comment

By Chris Agee

Black on Black 300x270 Chicago Politician: Police are killing some of these kids.

It is abundantly obvious Chicagoans have no qualms about electing radical leftists. A ridiculous notion advanced by one state representative from the crime-ridden city, however, illustrates the depravity of area politics.

Monique Davis, addressing the Windy City’s prevailing murder epidemic, shared a particularly deranged conspiracy theory.

“I’m going to tell you what some suspicions have been,” she told listeners of a local radio station, explaining “people have whispered” to her that “they’re not sure that black people are shooting all of these children.”

As if such willful ignorance was not discouraging enough, she suggested the brave men and women in law enforcement might actually be behind the widespread violence.

“I don’t want to spread this, but I’m just going to tell you what I’ve been hearing,” she said, in a transparent ploy to avoid responsibility for the absurd comment. “They suspect maybe the police are killing some of these kids.”

The representative demonstrated a quintessential leftist tactic by making tacit allegations without any tangible evidence. Once such misinformation reaches the public, they know at least a portion of the population will eagerly believe it to confirm their own prejudices.

The left has tried — often successfully — to foment hate toward the majority race in the aftermath of a case involving two minorities. Davis and her ideological comrades take the idiocy to another level by exonerating real murderers in favor of condemning those tasked with keeping citizens safe.

Garry McCarthy, superintendent of the Chicago police force, called Davis’ statements “absurd,” “inflammatory” and “insulting.” In response, the elected official doubled down by standing with the anonymous conspiracy theorists to whom she previously alluded.

Clearing up any confusion, Davis prefaced her statements on a local radio station with this disclaimer: “I’m not a detective; I’m not an investigator.”

She then repeated her previous contention that “many people in my community … believe it is possible that some of these murders are committed by our finest. Now, we can’t say that doesn’t happen.”

Disingenuous arguments often involve promulgating vicious rumors and calling on the accused to prove them wrong. Even in the notoriously corrupt culture of Chicago politics, such crass behavior should be considered beyond the pale.

Click here to get B. Christopher Agee’s brand new book, “Publik Skoolz Is Grate Edyukashun,” for just $3.99! Like his Facebook page for engaging, relevant conservative content daily.

Related posts:

  1. Chicago Police Chief: We’ll Shoot Licensed Gun Owners Under Chicago’s Police Chief Gary McCarthy and the hack that…
  2. Grand Jury Threatens To Expose Police/mayoral Cover-up Of Manslaughter In Chicago In March, Coach is Right published a story of official…

…read more

Source: FULL ARTICLE at Western Journalism

News, Politics, Government

More On Navalny And Putin From A Forbes Stooge

Leave a comment

By Paul Roderick Gregory, Contributor

  Yesterday’s post Putin Declares Himself Dictator With The Navalny Verdict stirred up a hornet’s nest of protest from Putin’s PR machine. According to Putin’s claquers, the Navalny verdict was just. He is a crook. He commands support from only one percent of Russians (All reasonable Russians love Putin). And what can you expect from a hack writer paid generously by Forbes do to do their bidding. Besides, this fool knows nothing about Russia, despite his pretensions. One critic took umbrage at my mention of Alexandra Dukhanina, the teenage girl held under house arrest for more than a year. After all, this vicious masked (wrong, she wore a stocking cap) girl hurled a bit of asphalt at heavily armed riot police. She deserved to be hauled off in a choke hold. (See picture)  Despite my unmasking by Putin supporters, I continue my commentary on the Putin-Navalny shootout. The news of the day: The prosecutor has freed Navalny on bail pending his appeal. The American press has interpreted this either as a concession to Navalny supporters (wrong), as a split within the Kremlin,  or as a clever maneuver to allow Navalny to campaign unsuccessfully in the September Moscow mayoral election against the Russian KGB state’s candidate, Sobyanin. Sobyanin was appointed when Putin fired his predecessor and needs the legitimacy of being elected to office. Navalny is Putin’s first victim to have charisma, an unblemished record, and a following of millions on his blog. Khodorkovsky was an evil oligarch, and the Pussy Riot girls offended traditional Russian values. Navalny represents virgin territory for Putin’s repression machine. Perhaps the Kremlin really does not know what to do. If Putin puts Navalny in jail for five years (which means he needs another sentence at the end of the term), the Navalny legend grows. But a free Navalny will be a constant thorn in Putin’s side as he exposes the theft of billions by Putin and his associates. Allowing Navalny to contest the mayoral race may be too clever by a half. Navalny will be running against a non-Muscovite (from Siberia, no less). To keep Navalny’s vote count down, there will have to be massive fraud, and it was electoral fraud that sent hundreds of thousands to the streets in December of 2011. Instead of giving Sobyanin his electoral mandate, he will go down in history as the one who stole the September 2013 election and set off the massive street demonstrations of September and October of 2013. What is a poor Putin to do? I see that Europe has responded to the Navalny sentence with harsh condemnation. President Obama is said to be concerned and following the situation. He may even cancel his visit to Moscow, but this may have more to do with fugitive Snowden than Navalny. Believe it or not, the United States has tremendous leverage over Putin at this point. Putin has staked his reputation on the success of the winter Olympics in Sochi. The treat of a U.S. boycott could …read more

Source: FULL ARTICLE at Forbes Latest

Science & Technology

Femtocell hackers from iSEC hear, see smartphone content

Leave a comment

(Phys.org) —While all thoughts are on how government agencies can abuse surveillance technologies to ruin people’s lives, an unassuming group of backyard neighbors in summer clogs and shorts can leisurely lean back in their chairs and snoop to read an SMS that a victim has just sent from her smartphone, listen in on her phone calls, and see all the pictures she is sending off by intercepting the data connection. Better still, they can plant themselves in the financial district and snoop on people talking about accounts, business mergers, or anything else ripe for exploit. Welcome to iSEC’s kind of exploit, the talk of the security crowd this week and no doubt the talk of companies that depend on red flags for potential security holes. The security consultants, iSEC Partners Tom Ritter and Doug DePerry, managed to hack a Verizon Wireless device and turn it into a mobile spy. “This is not about how the NSA would attack ordinary people. This is about how ordinary people would attack ordinary people,” said Tom Ritter, a senior consultant with the security firm iSEC Partners. …read more

Source: FULL ARTICLE at Phys.org

Do it yourself

Hack Like a Pro: How to Find Almost Every Known Vulnerability & Exploit Out There

Leave a comment

Welcome back, my nascent hackers!

Earlier, I wrote a guide on finding operating system and application vulnerabilities in Microsoft’s own security bulletins/vulnerability database. In this tutorial, I will demonstrate another invaluable resource for finding vulnerabilities and exploits by using the SecurityFocus database.

Most often, when we’re trying to hack a system, the vulnerabilities and exploits that will work on the target are not going to be simply handed to us, like I have done in these tutorials. We need to do a bit of research to find what will work on a particular target system… more

…read more

Source: Wonder How To

Video Gaming

App Store Update: July 12

Leave a comment

Every day hundreds of new apps make their debut on the App Store, and hundreds more are updated or reduced in price. We have sifted through the noise and highlighted those select few that might be worth your attention. For more mobile game trailers, reviews and news be sure to Subscribe to IGNMobileGames on YouTube.

No video today, ASU fans. But hey, scroll down a bit and you’ll forgive us – tons and tons of great freebies are compiled here in today’s Update.

Dungeon of Legends – ($2.99)

A new dungeon-crawler that brings elements of platforming and puzzle-solving into the mix alongside the usual hack-and-slash action:

Continue reading…

…read more

Source: FULL ARTICLE at IGN Video Games

Science & Technology

China steals new Australia spy agency blueprints, report says

Leave a comment

Chinese hackers have stolen top-secret blueprints to Australia’s new intelligence agency headquarters, a report said Tuesday, but Foreign Minister Bob Carr insisted ties with Beijing would not be hurt.

The Australian Broadcasting Corporation said the documents taken in the cyber hit included cabling layouts for the huge building’s security and communications systems, its floor plan, and its server locations.

Carr said the government was “very alive” to the threat of on national security, adding that “nothing that is being speculated about takes us by surprise”.

But he refused to confirm or deny China was behind the attack.

“I won’t comment on whether the Chinese have done what is being alleged or not,” he said.

“I won’t comment on matters of intelligence and security for the obvious reason: we don’t want to share with the world and potential aggressors what we know about what they might be doing, and how they might be doing it.”

While Australia has a long-standing military alliance with the United States, China is its largest trading partner and the two countries have been forging closer ties.

Carr insisted that the relationship would not be damaged by the allegations, which follow several other hacking attacks on in the past two years.

“It’s got absolutely no implications for a ,” he said. “We have enormous areas of cooperation with China.”

The revelations saw Canberra came under pressure to launch an independent inquiry into the “sorry saga” by opposition politicians, but Prime Minister Julia Gillard declined to comment on “these unsubstantiated reports”.

File photo of Australian Foreign Minister Bob Carr in Beijing in May 2012
File photo of Australian Foreign Minister Bob Carr in Beijing in May 2012. Carr Tuesday insisted ties with China would not be hurt by a report that Chinese hackers have stolen top secret blueprints to Australia’s new intelligence agency headquarters.

The state broadcaster’s investigative Four Corners programme said the attack on a contractor involved with building the new Canberra headquarters of the Australian Security Intelligence Organisation was traced to a server in China.

It cited security experts as saying the theft exposed the agency to being spied on and may be the reason for a cost blowout and delays to the opening of the building, which was supposed to be operational last month.

Des Ball, from the Australian National University’s Strategic and Defence Studies Centre, said the blueprints would show which rooms were likely to be used for sensitive conversations, and how to put devices into the walls.

“Once you get those building plans you can start constructing your own wiring diagrams, where the linkages are through telephone connections, through wi-fi connections,” he was quoted as saying.

The report, which did not say when the alleged theft took place, comes amid deepening concern about aggressive state-sponsored hacking by China.

In 2011, the computers of Australia’s prime minister, foreign minister and defence minister were all suspected of being hacked, with the attacks reportedly originating in China.

At the time, Canberra said cyber attacks had become so frequent that government and private networks were under “continuous threat”.

Beijing dismissed the allegations as “groundless and made out of ulterior purposes”.

Earlier this year, computer networks at the Reserve Bank of Australia were hacked, with some said to be infected by Chinese-developed malware searching for sensitive information.

This followed Chinese telecoms giant Huawei being barred in 2012 from bidding for contracts on Australia’s ambitious Aus$36 billion (US$35 billion) broadband rollout due to fears of cyber attacks.

Source: FULL ARTICLE at Phys.org