Australian who boasted of hacking to plead not guilty to charges stemming from raid

A 17-year-old Australian who in February claimed to have breached networks at Microsoft and Sony will plead not guilty to charges stemming from a police raid on his home.

Interestingly, none of the charges lodged against Dylan Wheeler relate to his claims to have breached the networks and extracted software tools used to develop games for the XBox One and PlayStation systems.

According to documents shared by Wheeler, he is charged with possession of child exploitation material, dishonestly obtaining credit card information, possession of identification information with the intent of committing an offense, and disobeying a data access order to reveal his passwords.

Wheeler said Friday he also faces a weapons charge related to a stun gun that police seized from his family's home, and possession of drug paraphernalia.

He told Perth Children's Court on Friday how he intends to plead, and said he will formally plead not guilty in a hearing scheduled for Nov. 11.

Wheeler maintains he is innocent, and believes the charges are in part retribution.

The police "were pissed off at the fact that I went to the media," Wheeler said.

Western Australian Police in Perth declined to comment on the case.

Eventually, Wheeler said, he expects hacking charges to be filed against him. He has been open about his probes into Microsoft's and Sony's networks, and said he told Microsoft about weaknesses in its network.

"To my knowledge they [Microsoft] fixed up a lot of the problems they had," he said, while Sony "did try and fix the issues."

But Wheeler did provoke Microsoft. In August 2012, he posted an eBay listing for a "Microsoft Xbox Durango Development Kit." That same month he was visited by an investigator with Microsoft's IP Crimes Team.

In February, he placed another eBay auction listing for a "Durango" PC. The listing expired on Feb. 19, the same day police raided his family's home, seizing three Apple computers, a 1TB hard drive, credit cards, his mobile phone and a stun gun, among other items.

Wheeler's lawyer, Marc Saupin, said Friday that Australian legal rules prevent counsel from commenting about an ongoing case.

Five indicted in massive hacking scheme

Five men from Russia and Ukraine have been indicted in New Jersey for charges they conspired with each other in a worldwide hacking scheme targeting major corporate networks that compromised more than 160 credit card numbers, the U.S. Department of Justice announced.

The men allegedly attacked the networks of several companies, including Nasdaq, 7-Eleven, JCP, Dow Jones and Hannaford, the DOJ said. Companies reported US$300 in losses from the attacks, the DOJ said in a press release.

Charged in an indictment unsealed Thursday in U.S. District Court for the District of New Jersey were Vladimir Drinkman, 32, of Syktyykar and Moscow, Russia; Alexandr Kalinin, 26, of St. Petersburg, Russia; Roman Kotov, 32, of Moscow; Mikhail Rytikov, 26, of Odessa, Ukraine; and Dmitriy Smilianets, 29, of Moscow.

Drinkman and Kalinin allegedly specialized in penetrating network security and gaining access to the corporate victims' systems, while Kotov allegedly specialized in mining the compromised networks to steal data, the DOJ said. The defendants hid their activities using anonymous Web-hosting services provided by Rytikov, while Smilianets allegedly sold the information stolen by the other conspirators and distributed the proceeds of the scheme to the participants.

The five compromised networks for nearly five years, between mid-2005 and mid-2012, according to court documents.

""This type of crime is the cutting edge," Paul Fishman, U.S. attorney for the District of New Jersey, said in a statement.  "Those who have the expertise and the inclination to break into our computer networks threaten our economic well-being, our privacy, and our national security.  And this case shows, there is a real practical cost because these types of frauds increase the costs of doing business for every American consumer, every day."

Kalinin and Drinkman were previously charged in New Jersey as "Hacker 1" and "Hacker 2" in a 2009 indictment charging Albert Gonzalez, 32, of Miami, in connection with five corporate data breaches, including the breach of Heartland Payment Systems, which at the time was the largest breach ever reported.  Gonzalez is currently serving 20 years in federal prison for those offenses.

The U.S. Attorney's Office for the Southern District of New York on Thursday announced two additional indictments against Kalinin. One charges him in connection with hacking certain computer servers used by Nasdaq and a second indictment charged Kalinin and another alleged Russian hacker, Nikolay Nasenkov, with an international scheme to steal bank account information by hacking U.S.-based financial institutions.

Rytikov was previously charged in the Eastern District of Virginia with an unrelated scheme. Kotov and Smilianets have not previously been charged publicly in the U.S.

Drinkman and Smilianets were arrested at the request of the DOJ while traveling in the Netherlands on June 28, 2012.  Smilianets was extradited on Sept. 7, 2012, and remains in federal custody. Kalinin, Kotov and Rytikov remain at large.

The five defendants allegedly conspired with others to penetrate the computer networks of several of the largest payment processing companies, retailers and financial institutions, stealing the personal identifying information of individuals. They allegedly took user names and passwords, other means of identification and credit and debit card numbers, the DOJ said.

The attackers often gained initial entry into a corporate network through an SQL injection attack, the DOJ alleged. The hackers identified vulnerabilities in SQL databases and used those vulnerabilities to infiltrate a computer network. Once the network was infiltrated, the defendants allegedly placed malware on a network, creating a back door that allowed further access. In some cases, the defendants lost access to the system due to companies' security efforts, but they were able to regain access through persistent attacks.

The defendants often targeted victim companies for many months, with the DOJ saying they waited "patiently" as their efforts to bypass security were underway.

After acquiring the card numbers and related data, the conspirators allegedly sold it to resellers around the world, the DOJ alleged. The buyers then allegedly sold the so-called dumps through online forums or directly to individuals and organizations. Smilianets was allegedly in charge of sales charging approximately $10 for each stolen U.S. credit card number and associated data and approximately $50 for each European credit card number and approximately $15 for each Canadian credit card number.

If convicted, the maximum penalties for each of the counts are: five years in prison for conspiracy to gain unauthorized access to computers; 30 years in prison for

SIM cards vulnerable to hacking, says researcher

Millions of mobile phones may be vulnerable to spying due to the use of outdated, 1970s-era cryptography, according to new research due to be presented at the Black Hat security conference.

Karsten Nohl, an expert cryptographer with Security Research Labs, has found a way to trick mobile phones into granting access to the device's location, SMS functions and allow changes to a person's voicemail number.

Nohl's research looked at a mobile phones' SIM (Subscriber Identification Module), the small card inserted into a device that ties it to a phone number and authenticates software updates and commands sent over-the-air from an operator.

More than 7 billion SIM cards are in use worldwide. To ensure privacy and security, SIM cards use encryption when communicating with an operator, but the encryption standards use vary widely.

Nohl's research found that many SIMs use a weak encryption standard dating from the 1970s called DES (Data Encryption Standard), according to a preview posted on his company's blog.

DES has long been considered a weak form of encryption, and many mobile operators have upgraded now to more secure forms. It is relatively easy to discover the private key used to sign content encrypted with DES.

In its experiment, Security Research Labs sent a binary code over SMS to a device using a SIM with DES. Since the binary code wasn't properly cryptographically signed, it would not run on the device.

But while rejecting the code, the phone's SIM makes a crucial mistake: it sends back over SMS an error code that carries its own encrypted 56-bit private key, according to the company. Because DES is considered a very weak form of encryption, it's possible to decrypt the private key using known cracking techniques.

Security Research Labs did it in about two minutes on a regular computer with the help of a rainbow table, a mathematical chart that helps convert an encrypted private key or password hash into its original form faster.

With the private DES key in hand, it is then possible to "sign" malicious software updates with the key, and send those updates to the device. The device believes the software comes from a legitimate source and then grants access to sensitive data.

The company outlined an attack scenario against SIM cards that run some form of Java virtual machine, a software framework for Java applications.

Using the SIM's private key, an attacker could force the SIM to download Java applets, which are essentially very small programs that perform some function. Those applets would be "allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions."

"These capabilities alone provide plenty of potential for abuse," the company wrote.

Possible remedies to the problem including ensuring SIM cards use state-of-the-art cryptography and also using Java virtual machines that restrict applets' access to certain information.

Nohl's presentation, "Rooting SIM cards," will take place at the Black Hat security conference in Las Vegas on July 31.

Ex-Murdoch editors lose bid to have UK hacking charges dropped

LONDON - Two former editors of a British tabloid newspaper shut down by owner Rupert Murdoch over a phone-hacking scandal lost a legal battle on Friday to have criminal charges against them dropped.

Rebekah Brooks and Andy Coulson, both former News of the World editors and close associates of Prime Minister David Cameron, have pleaded not guilty to charges that they conspired to intercept people's voicemail messages in pursuit of stories.

Their lawyers had argued that once a message had been heard by its intended recipient it was no longer "in the course of transmission" as defined by the Regulation of Investigatory Powers Act under which the charges were brought.

The hacking scandal prompted Murdoch to shut down the mass-selling Sunday tabloid in July 2011 and led to a huge police investigation and to a public inquiry that revealed embarrassingly cozy ties between the media and politicians.

The judge in charge of the hacking case had rejected the defense arguments advanced by lawyers for Brooks, Coulson and three other former News of the World staff in May, but this could not be reported at the time for legal reasons.

The defendants appealed, but the Court of Appeal upheld the earlier judgment on Friday and allowed it to be reported.

"There is no good reason why the first receipt of the communication should be considered as bringing the transmission to an end," the Court of Appeal judges wrote.

The ruling means that Brooks, Coulson and others will stand trial as planned in September on hacking and other charges.

Brooks and Coulson both deny charges of involvement in the bribery of public officials for stories, and Brooks also denies perverting the course of justice.

Brooks, who after leaving the News of the World went on to edit its sister paper the Sun, Britain's highest-selling newspaper, later became the boss of Murdoch's entire British newspaper arm until the hacking scandal forced her out.

In her heyday, she enjoyed close friendships with senior politicians including Cameron.

After leaving the News of the World, Coulson went on to work as Cameron's chief of communications. He was forced out of that job in January 2011 as the hacking scandal gathered pace.