Researcher Refutes Google's, Microsoft's Accounts of Hijacked Passwords

Could botnets that infected PCs with keylogging or data stealing Trojan horses really be to blame for the leak of Gmail and Hotmail passwords?

One researcher isn't buying Microsoft's and Google's explanation that Hijacked Hotmail and Gmail Passwords were obtained in a massive phishing attack.

Mary Landesman, a senior security researcher at San Francisco-based ScanSafe, said it's more likely that the massive lists -- which include approximately 30,000 credentials from Hotmail, Gmail, Yahoo Mail, and other sources -- were harvested by botnets that infected PCs with keylogging or data stealing Trojan horses.

Landesman based her speculation on an accidental find in August of a cache of usernames and passwords, including those from Windows Live ID, the umbrella log-on service that Microsoft offers users to access Hotmail, Messenger and a slew of other online services.

That cache contained about 5,000 Windows Live ID username/password combinations, said Landesman, who found the trove while researching a new piece of malware. "From the organization [of that cache] and what the data looked like in raw form, I think it's more likely that this latest was the result of keylogging or data theft, not phishing," Landesman said.

She dismissed the idea that the passwords had been collected in a large-scale, industrywide phishing attack , as Microsoft and Google both maintained.

"Another indicator is the sheer number of compromised accounts," Landesman said, referring to the two lists that have gone public. "Phishing is not generally a wildly successful scam, it doesn't have a big return. People are more savvy about phishing than we give them credit for."

Instead, it's more logical to assume that the passwords were acquired by botnet operators, who hijack PCs using security exploits, then later plant data-stealing malware on those machines. "That s a much more realistic source," said Landesman. "Regardless [of] what the final intent is of a botnet, one of the core capabilities of every botnet is the harvesting of e-mail credentials. If it looks like a horse, it's a horse, it's not a zebra."

Landesman's theory contradicts not only Microsoft and Google, but also the Anti-Phishing Working Group (APWG), an industry association dedicated to fighting online identity theft. On Monday, the APWG's chairman, Dave Jevans said a phishing attack that garnered thousands of passwords was do-able. "It's not outside the realm of possibility," he said then.

Also against the phishing explanation, argued Landesman, is the fact that the second list -- approximately 20,000 passwords -- contained usernames from not just Hotmail, but also Gmail, Yahoo Mail, Comcast, EarthLink and others. "That makes [the purported phishing campaign] a much broader attack across multiple services."

Her first thought when she read about the compromised Hotmail accounts was of the cache of credentials she'd found two months before. "Those public lists reminded me of the lists I found," she said. "It was definitely not a complete list, but seemed to be an advertisement for what this [hacker] had to offer."

The hacker was either inexperienced, or none too bright: The data was not password-protected, which is the norm for credential caches.

Landesman's theory is not just an academic exercise, she maintained.

"Everyone who suspects that their account has been compromised should change their password," she said, repeating advice by Microsoft, Google and other security experts. "But if, after changing their password, they have another reoccurrence where they see their account being used to e-mail spam, or they again can't access their account, then they need to suspect that there's a local infection on their PC."


Source:

http://www.infoworld.com/d/security-central/researcher-refutes-googles-microsofts-accounts-hijacked-passwords-036?page=0,0

Professional Website Design Services

Microsoft Internet Explorer SSL Security Hole Lingers

Microsoft still does not acknowledge a weakness in its Internet Explorer browser that was pointed out seven weeks ago and enables attackers to hijack what are supposed to be Secure Web Sessions.

The company says it is still evaluating whether the weakness exists, but Apple, which bases its Safari for Windows browser on Microsoft code, says Safari for Windows has the weakness and the Microsoft code is the reason. If Microsoft doesn't fix the problem, Apple can't fix it on its own, Apple says. Apple has fixed the problem for Safari for Macs.

"Microsoft is currently investigating a possible vulnerability in Microsoft Windows. Once our investigation is complete, we will take appropriate action to help protect customers," a Microsoft spokesperson said via e-mail. "We will not have any more to share at this time."

The weakness can be exploited by man-in-the-middle attackers who trick the browser into making SSL sessions with malicious servers rather than the legitimate servers users intend to connect to.

Current versions of Safari for Mac, Firefox, and Opera address the problem, which is linked to how browsers read the x.509 certificates that are used to authenticate machines involved in setting up SSL/TLS sessions.

In July two separate talks presented by researchers Dan Kaminski and Moxie Marlinspike at the Black Hat Conference warned about how the vulnerability could be exploited by using what they call null-prefix attacks. The attacks involve getting certificate authorities to sign certificates for domain names assigned to legitimate domain-name holders and making vulnerable browsers interpret the certificates as being authorized for different domain-name holders.

For instance, someone might register www.hacker.com. In many x.509 implementations the certificate authority will sign certificates for any request from the hacker.com root domain, regardless of any sub-domain prefixes that might be appended. In that case, the authority would sign a certificate for bestbank.hacker.com, ignoring the sub-domain bestbank and signing based on the root domain hacker.com, Marlinspike says.

At the same time, browsers with the flaw he describes read x.509 certificates until they reach a null character, such as 0. If such a browser reads bestbank.com\0hacker.com, it would stop reading at the 0 and interpret the certificate as authenticating the root domain bestbank.com, the researcher says. Browsers without the flaw correctly identify the root domain and sign or don't sign based on it.

Source:

http://www.infoworld.com/d/security-central/microsoft-internet-explorer-ssl-security-hole-lingers-243

Chicago Web Site Design Company