McCain Campaign BlackBerry Sold Full Of Confidential Contact Data

Washington D.C.'s Fox 5 news bought a used BlackBerry from the McCain campaign as they shut down. The contents were surprising:

"When we charged them up in the newsroom, we found one of the $20 Blackberry phones contained more than 50 phone numbers for people connected with the McCain-Palin campaign, as well as hundreds of emails from early September until a few days after election night. "

Laptops were also sold, although no word has come out about remnant data on them. This once again points to the importance of wiping devices or destroying them. While destruction results in no residual benefit to the original owner, it can prevent data loss, which may save more money than the small gains from re-sale. In this case, a $20 selling point for the BlackBerries is likely far outweighed by the negative publicity and anger of those whose contact information was exposed.

How difficult is it to wipe a BlackBerry? In many cases, it is incredibly easy. For BlackBerries that have security set up, simply typing in the wrong password enough times will wipe them. Others, such as the 8800 series, have a simple wipe process:

1. Go to Options
2. Select Security Options
3. Select General Settings
4. Click the Menu key
5. Select Wipe Handheld
6. Click Continue
7. Type in the word blackberry

Cell Phone Jammers As A Skimming Control

Lets Japan points out that a Japanese bank has begun to deploy cellphone jammers near their ATMs to prevent skimming attempts that are increasingly using SMS messages from a cellular phone equipped reader device to phone home.

According to Lets Japan, "Chiba Bank installed phone signal-jamming devices at 4 unmanned ATMs at bank branches in the Tokyo metropolitan area Dec. 10. It is the first use of the device in a financial institution in Japan."

This isn't likely to occur legitimately in the US due to the Communications Act - the FCC rule can be seen here, and notes that, "Fines for a first offense can range as high as $11,000 for each violation or imprisonment for up to one year, and the device used may also be seized and forfeited to the U.S. government."

I thawte this was interesting...

The Daily WTF has a post of failure from last Friday regarding Thawte's Personal Email Certificates website regarding the leakage of other users' personal security questions:

It didn’t take Eric too long to realize what was happening. For some bizarre reason, Thawte was completing his questions by using other user’s questions. When he typed in simply What was, it shot back What was Seti 1...

I was able to verify the behavior my self. I typed "When was" in the question box and was greeted with the response: "When was "M" born". I typed "do you" and got "do you live alone". Granted, you don't get answers to questions, nor are they tied to particular users. However, its hard to argue that it's not a leak of useful data that could be used to attack other users of the site.

From a design perspective, I can't possibly imagine why any users' questions would have any impact on other users' questions (although I could probably conjure up a couple of explanations for the behavior).

So, what happens when you can't trust the Web of Trust?

CheckFree's DNS Compromise - DNS In A Dangerous World

CheckFree, a major Internet bill payment site recently acquired by Fiserv had their customer sign in page DNS modified on Tuesday, resulting in users being redirected to a Ukranian malware site that attempted to infect users with a password theft trojan.

According to Brian Krebs' article about the incident, the root of the compromise was a DNS re-direct -

"It appears hackers were able to hijack the company's Web sites by stealing the user name and password needed to make account changes at the Web site of Network Solutions, CheckFree's domain registrar. Susan Wade, a spokeswoman for the Herndon, Va., based registrar, said that at around 12:30 a.m. Dec. 2, someone logged in using the company's credentials and changed the address of CheckFree's authoritative domain name system (DNS) servers to point CheckFree site visitors to the Internet address in the Ukraine."

This of course indicates that a trusted users's credentials were phished. Interesting, according to Krebs, as many as 71 other sites were also re-directed, making this a reasonably large attack, and likely one that foreshadows a trend that we will see this year. With site security becoming greater, and more time spent on front facing web application security, phishing and compromise of DNS and hosting platforms is becoming more attractive.

Sadly, it took until today for CheckFree to notify customers in any detail via email, and CheckFree's customer email notes that the following conditions that might mean that users of their site were infected, but does not provide detailed information or a link for detail about the malware. Customers might be affected if:

• You attempted to access online bill payment between 12:30 a.m. and 10:10 a.m. Eastern time (GMT -5) on Tuesday, December 2, 2008, and
• You were using a computer with the Windows operating system, and
• You reached a blank screen rather than the usual bill payment screen when you attempted to navigate to online bill payment, and
• After reaching the blank screen, your computer's virus protection program did not tell you via pop-up or other messaging that malicious software was detected and quarantined.

CheckFree offers further help, with a direct 1-800 number for those affected as well as the promise that "We will also offer you both advice and free services that can help you mitigate any risk you may face as a result of this incident or other everyday exposures you may encounter.".

For now, users who were affected will need to clean their systems, reset passwords, and to make sure that they are using better browser and system security to help prevent future compromises.

Spoofing Face Recognition Software

Gizmodo via CNET's Crave has an interesting overview of BKIS's face recognition software exploits. As described, they modify a relatively low resolution image of a person from Facebook or another site with pictures available. A tweaking process creates an image that is highly compatible with the face recognition software, allowing a malicious third party to log in to that user's system.

Reading RFID tags - Adam Laurie's RFIDIOt and the CardMan 5321 USB reader

As I noted in my last post, Improvised RFID Blocking Wallets: Preventing PayPass Skimming, I have recently been working with an OmniKey Cardman 5321 USB RFID reader in Windows. The reader is compatible with a broad range of RFID cards (From Omnikey's website):

• Philips/NXP: MIFARE®, DESFire®, MIFARE ProX®, and i.code
• HID: iCLASS®
• Texas Instruments: TagIT®
• ST Micro: x-ident, SR 176, SR 1X 4K
• Infineon: My-d (in secure mode UID only)
• Atmel: AT088RF020
• KSW MicroTech: KSW TempSens
• JavaCard: JCOP / SMART-MX in RSA mode with 2048 bit keys

Omnikey provides drivers, as well as a simple diagnostic tool which can read tag IDs and can provide basic information about the contents of the tag. If you want to do more with RFID, you need a more full featured software package, and Adam Laurie's RFIDIOt handily answers that call. RFIDIOt reads ICAO 9303 encoded Machine Readable Travel Documents, and both Data Group 61 (MRZ) and DataGroup 75 (Encoded Information Features - FACE), as well as many other data types.

To make RFIDIOt work, I installed Python 2.5.2, as some of the packages it relies on work with 2.5, but not with 2.6. You'll need the following software packages to make it all work:

• pySerial (2.4 Win32)
• pyscard (1.6.7 Win32-py2.5)
• pycrypto (pycrypto-2.0.1.win32-py.25)
• the Python Imaging Library (PIL-1.1.6.win32.py2.5)
• pywin32-212 (pywin32-212.win32-py2.5)

You can ignore the need for PCSCLite for the purposes of this install.

You will also need to modify RFIDIOtconfig.py to use the USB device. Simply modify the section that reads:

# serial port (can be overridden with -l for Windows)
line= "SERIAL”

With the following:

# serial port (can be overridden with -l for Windows)
line= "USB”

A simple re-compile of RFIDIOtconfig.py results in an updated RFIDIOtconfig.pyc, and you're ready to go.
Once you have done this, you should be able to test your reader by executing multiselect.pyc, which is a simple looping tag ID reader. If you see the tag IDs when the green LED on your CardMan turns red, you've succeeded.

RFIDIOt presumes that you will have a directory in your system root called /tmp - if you want to capture any data for testing, you'll need to manually create the directory on Windows systems.

Improvised RFID Blocking Wallets: Preventing PayPass Skimming

Many credit card users do not realize that they have PayPass enabled RFID credit cards in addition to the new RFID enabled US Passports. These RFID enabled devices are easily read at distances compatible with casual contact in a crowded environment such as a subway or an airport, and various data can be gathered from them (US passports require key data to decrypt the data stream). More and more people carry fob based RFID PayPass tokens, or have PayPass cards, making the wireless exposure of their card data far more likely.

How can we combat this? The good news is that commercial RFID blocking wallets are available, and various people have created their own versions such as the duct tape and tin foil wallet. The resourceful traveler can easily replicate their functionality on an ad-hoc basis too. We have tested with a number of common objects, such as the cookie bag and tinfoil above, which worked quite nicely for our 13.56 Mhz test tags.


As you would expect, common food packaging is a very easy to obtain improvised RFID blocking material. We have not tested 125 kHz tags, so your mileage may vary if you are attempting to block RFID tags using that frequency.

Our testing was conducted using a commercially available Omnikey Cardman 5321, a USB connected RFID reader, and using Adam Laurie's RFIDIOt package. Longer ranges are possible using custom antennas and readers, with some testing on these passive tags being done at up to 30 feet by NIST - a result that worries the ACLU.

Check your wallet - you may have a PayPass enabled card without realizing that you do. To check, simply check the back of your wallet for the PayPass logo. In addition, many cards have a chip logo on the front, making them easily identifiable.