From an article in IT PRO: Black Hat: It wasn’t just the iPhone that got hacked… | IT PRO – By Asavin Wattanajantra, 3 Aug 2009 at 13:16
This was courtesy of vulnerabilities in SSL, allowing somebody to intercept traffic with what Marlinspike called a null-termination certificate.
Matt Hampton, chief technological officer at Imerja, said: “It’s not just something that can happen with a web browser. Something else needs to have been done beforehand.
He added: “Either a virus or malware has been downloaded on a [targeted user’s] machine that has changed the configuration, so the named servers have been changed.”
This could mean that a targeted user is pointed to a server where the attacker has created fake web pages, which could come from a location as far away as China or Russia.
“Currently if a user clicked on that link they would get a warning, because the browser doesn’t trust the certificate,” he added.
“If [the attacker] has managed to install a null-termination certificate, they won’t get the warning. It’s going to hide the fact that things have been changed.”
This could allow attackers to steal passwords or create fake online banking sites where they could steal credit card details.
Firefox 3.5 is currently protected against the attack, but not earlier versions. Chrome and IE8 are not.
The conference also revealed a hacking attack by researcher Dino Dai Zovi that could allow criminals to take control of Apple computers and steal scrambled data.
There was also a detailed report on Russian cybercrime, with a claim that Eastern European mobsters are justifying their crimes by hiding it behind extreme nationalism and anti-western sentiment.
There was even a presentation on lockpicking forensics, as interest in physical security has become an extension of the growing number of people interested in computer security.
The hacker community is thriving, and another hacker convention in the Defcon conference is currently taking place in Las Vegas.
Reports revealed that somebody tried to hit Defcon attendees this week with a fake ATM placed in the Rivera hotel, which is playing host to the annual event.
It was apparently recording the card details and PIN on anybody trying to use it, but the criminals involved probably didn’t bank on it ending up centre stage of a hacker-focused security event.
The entire article is at: Black Hat: It wasn’t just the iPhone that got hacked… | IT PRO
