Oil, gas field sensors vulnerable to attack via radio waves

Sensors widely used in the energy industry to monitor industrial processes are vulnerable to attack from 40 miles away using radio transmitters, according to alarming new research.

Researchers Lucas Apa and Carlos Mario Penagos of IOActive, a computer security firm, say they've found a host of software vulnerabilities in the sensors, which are used to monitor metrics such as temperature and pipeline pressure, that could be fatal if abused by an attacker.

Apa and Penagos are scheduled to give a presentation next Thursday at the Black Hat security conference in Las Vegas but gave IDG News Service a preview of their research. They can't reveal many details due to the severity of the problems.

"If you compromise a company on the Internet, you can cause a monetary loss," Penagos said. "But in this case, [the impact] is immeasurable because you can cause loss of life."

The U.S. and other nations have put increased focus in recent years on the safety of industrial control systems used in critical infrastructure such as nuclear power plants, energy and water utilities. The systems, often now connected to the Internet, may have not had thorough security audits, posing a risk of life-threatening attacks from afar.

Apa and Penagos studied sensors manufactured by three major wireless automation system manufacturers. The sensors typically communicate with a company's home infrastructure using radio transmitters on the 900MHz or 2.4GHz bands, reporting critical details on operations from remote locations.

Apa and Penagos found that many of the sensors contained a host of weaknesses, ranging from weak cryptographic keys used to authenticate communication, software vulnerabilities and configuration errors.

For example, they found some families of sensors shipped with identical cryptographic keys. It means that several companies may be using devices that all share the same keys, putting them at a greater risk of attack if a key is compromised.

They tested various attacks against the sensors using a specific kind of radio antennae the sensors use to communicate with their home networks. They found it was possible to modify readings and disable sensors from up to 40 miles (64 kilometers) away. Since the attack isn't conducted over the Internet, there's no way to trace it, Penagos said.

In one scenario, the researchers concluded that by exploiting a memory corruption bug, all sensors could be disabled and a facility could be shut down.

Fixing the sensors, which will require firmware updates and configuration changes, won't be easy or quick. "You need to be physically connected to the device to update them," Penagos said.

Apa and Penagos won't identify the vendors of the sensors since the problems are so serious. They've handed their findings to the U.S. Computer Emergency Readiness Team, which is notifying the affected companies.

"We care about the people working in the oil fields," Penagos said.

SIM cards vulnerable to hacking, says researcher

Millions of mobile phones may be vulnerable to spying due to the use of outdated, 1970s-era cryptography, according to new research due to be presented at the Black Hat security conference.

Karsten Nohl, an expert cryptographer with Security Research Labs, has found a way to trick mobile phones into granting access to the device's location, SMS functions and allow changes to a person's voicemail number.

Nohl's research looked at a mobile phones' SIM (Subscriber Identification Module), the small card inserted into a device that ties it to a phone number and authenticates software updates and commands sent over-the-air from an operator.

More than 7 billion SIM cards are in use worldwide. To ensure privacy and security, SIM cards use encryption when communicating with an operator, but the encryption standards use vary widely.

Nohl's research found that many SIMs use a weak encryption standard dating from the 1970s called DES (Data Encryption Standard), according to a preview posted on his company's blog.

DES has long been considered a weak form of encryption, and many mobile operators have upgraded now to more secure forms. It is relatively easy to discover the private key used to sign content encrypted with DES.

In its experiment, Security Research Labs sent a binary code over SMS to a device using a SIM with DES. Since the binary code wasn't properly cryptographically signed, it would not run on the device.

But while rejecting the code, the phone's SIM makes a crucial mistake: it sends back over SMS an error code that carries its own encrypted 56-bit private key, according to the company. Because DES is considered a very weak form of encryption, it's possible to decrypt the private key using known cracking techniques.

Security Research Labs did it in about two minutes on a regular computer with the help of a rainbow table, a mathematical chart that helps convert an encrypted private key or password hash into its original form faster.

With the private DES key in hand, it is then possible to "sign" malicious software updates with the key, and send those updates to the device. The device believes the software comes from a legitimate source and then grants access to sensitive data.

The company outlined an attack scenario against SIM cards that run some form of Java virtual machine, a software framework for Java applications.

Using the SIM's private key, an attacker could force the SIM to download Java applets, which are essentially very small programs that perform some function. Those applets would be "allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions."

"These capabilities alone provide plenty of potential for abuse," the company wrote.

Possible remedies to the problem including ensuring SIM cards use state-of-the-art cryptography and also using Java virtual machines that restrict applets' access to certain information.

Nohl's presentation, "Rooting SIM cards," will take place at the Black Hat security conference in Las Vegas on July 31.

Symantec: Google Glass still vulnerable to Wi-Fi attack

Google fixed one Wi-Fi security problem with its wearable computer Glass, but Symantec says there's another problem, which has been a long-known weakness in wireless networking.

The security vendor has been analyzing Google Glass in its labs and found a second issue that is just as harmful as the now-patched QR-code vulnerability found by Lookout Mobile Security, which was made public earlier this week.

Many Wi-Fi devices regularly look for networks that they have been connected to before, wroteCandid Wueest, a threat researcher for Symantec. The behavior is convenient for users, since they don't have to manually connect to a known network, he wrote.

But for as little as US$100, a hacker can buy a device that impersonates the known Wi-Fi network by borrowing the network's name, known as its SSID (Service Set Identifier).

If a mobile device such as Google Glass looks for a known network with the SSID of "myPrivateWiFi," a device called the Wi-Fi Pineapple can respond, pretending it is the network.

Wi-Fi Pineapple is intended as a tool for security researchers. It sits between a targeted device and the Internet. Once it has tricked a Wi-Fi device into thinking it is the legitimate network, it can then spy on the data traffic.

If the traffic between a pair of Google Glasses and a remote server is unencrypted, an attacker using Wi-Fi Pineapple can view it, a major privacy and security problem known as a man-in-the-middle attack (MITM).
The issue isn't exclusive to Google Glass and could affect any device used, for example, by someone in a coffee shop. Savvy laptop and mobile phone users may be able to take steps to prevent data from leaking by using a VPN (Virtual Private Network). But the keyboard-less interface of Google Glass could make thwarting this style of attack more complicated.

In early June, Google fixed the vulnerability found by Lookout, which found that Glass would scan a QR Code instructing it to connect to a malicious Wi-Fi access point. Lookout, which told Google of the problem in May, then directed Glass to a malicious website that ran a known Android 4.04 vulnerability, which gave the security vendor complete control over the glasses.

Google issued several fixes, including one that required users to approve instructions contained in QR codes.
The fundamental problem of Wi-Fi devices looking for known networks isn't an easy one to solve, Wueest wrote. Devices could check a hardware identifier, called the MAC (Media Access Control) address, of a Wi-Fi router and match it with the SSID. But MAC addresses are easily faked, he wrote.

"The more practicable solution is to treat every network as hostile and ensure that all the applications use encrypted communications like SSL [Secure Sockets Layers] or tunnel through a VPN," Wueest wrote.
Google couldn't immediately be reached for comment.

UK datacentres vulnerable to BYOD risks, shows Ponemon study

A Ponemon Institute research into the bring your own device (BYOD) trend has found that about 60% of UK businesses have no personal device policy in place and are putting critical data at risk once it leaves a company, whether through BYOD or public cloud-based file-sharing.
By ignoring simple security steps and employee BYOD education, companies are jeopardising their confidential data, exposing it to theft, corruption, hackers, malware and more, the research report has warned.

The study, 2013 Data Protection Trends Research, found that 58% of the 570 UK IT chiefs surveyed admitted to not having a BYOD policy in place to manage employee-owned mobile devices, such as tablets and smartphones.

A wide majority (80%) of organisations have not educated employees on BYOD privacy risks, while 31% of IT teams said employee-owned devices were not allowed, illustrating that organisations are still in denial when it comes to consumer IT trends.

Another 23% have opened up the company network to make exceptions for executives, who may be handling sensitive data. This puts businesses at an increasing risk of data loss and serious compliance issues, according to the research firm.

The report, commissioned by backup provider Acronis, revealed that currently, only 21% of the respondents mandated a device password or key lock on personal devices, and only 18% performed remote device wipes when employees leave the company.

The study stated that employees commonly share corporate files through third-party cloud storage solutions such as DropBox, but as many as 69% of organisations do not have a policy in place around public cloud use and 80% have not trained their employees in the proper use of these platforms.

Experts have previously warned that BYOD and IT consumerisation are not just passing fads and that they are here to stay.

While 59% of UK organisations said they will support Apple’s Mac machines in the next year, more than half (61%) said compatibility and interoperability are still big obstacles to making Macs compliant with enterprise IT, which puts data stored and shared across the corporate network and on Apple devices at risk.
The study’s findings are in line with a previous YouGov report which revealed that many UK employers are failing to provide guidance on the usage of personal devices at work – potentially putting personal information at risk.

“Personal devices have permanently and positively changed the workplace, particularly in the way employees collaborate, work remotely and interact with company data,” said Rick Powles, managing director UK and Ireland at Acronis.

“BYOD is a huge opportunity for companies, but our research shows troubling signs of negligence in the face of these dangers. However, with policies and solutions that manage the flow of data between multiple devices and environments, companies can practice safe BYOD with confidence.”

To optimise BYOD and to avoid data loss and compliance issues, organisations should take immediate steps to ensure employees are trained in safe BYOD practices, that personal device and public cloud use are monitored and managed, and that effective data protection strategies are in place to prevent data loss, Powles advised. These are the critical steps to achieving safe BYOD.

The study was part of Ponemon Institute’s global survey of 4,374 IT practitioners which included more than 570 respondents from the UK, spanning from mid-sized to large enterprises.

It also showed that, despite many UK companies lacking in devising a BYOD strategy, the UK was ahead of the US in embracing BYOD and planning policies around employee device management. This finding echoed Citrix’s European chief’s remark that BYOD strategies are being adopted much faster in Europe than the US.

Symantec: Google Glass still vulnerable to Wi-Fi attack

Google fixed one Wi-Fi security problem with its wearable computer Glass, but Symantec says there’s another problem, which has been a long-known weakness in wireless networking.

The security vendor has been analyzing Google Glass in its labs and found a second issue that is just as harmful as the now-patched QR-code vulnerability found by Lookout Mobile Security, which was made public earlier this week.

Many Wi-Fi devices regularly look for networks that they have been connected to before, wrote Candid Wueest, a threat researcher for Symantec. The behavior is convenient for users, since they don’t have to manually connect to a known network, he wrote.

But for as little as $100, a hacker can buy a device that impersonates the known Wi-Fi network by borrowing the network’s name, known as its SSID (Service Set Identifier).

If a mobile device such as Google Glass looks for a known network with the SSID of “myPrivateWiFi,” a device called the Wi-Fi Pineapple can respond, pretending it is the network.

Wi-Fi Pineapple is intended as a tool for security researchers. It sits between a targeted device and the Internet. Once it has tricked a Wi-Fi device into thinking it is the legitimate network, it can then spy on the data traffic.

If the traffic between a pair of Google Glasses and a remote server is unencrypted, an attacker using Wi-Fi Pineapple can view it, a major privacy and security problem known as a man-in-the-middle attack (MITM).
The issue isn’t exclusive to Google Glass and could affect any device used, for example, by someone in a coffee shop. Savvy laptop and mobile phone users may be able to take steps to prevent data from leaking by using a VPN (Virtual Private Network). But the keyboard-less interface of Google Glass could make thwarting this style of attack more complicated.

In early June, Google fixed the vulnerability found by Lookout, which found that Glass would scan a QR Code instructing it to connect to a malicious Wi-Fi access point. Lookout, which told Google of the problem in May, then directed Glass to a malicious website that ran a known Android 4.04 vulnerability, which gave the security vendor complete control over the glasses.

Google issued several fixes, including one that required users to approve instructions contained in QR codes.
The fundamental problem of Wi-Fi devices looking for known networks isn’t an easy one to solve, Wueest wrote. Devices could check a hardware identifier, called the MAC (Media Access Control) address, of a Wi-Fi router and match it with the SSID. But MAC addresses are easily faked, he wrote.

“The more practicable solution is to treat every network as hostile and ensure that all the applications use encrypted communications like SSL [Secure Sockets Layers] or tunnel through a VPN,” Wueest wrote. 

Most enterprise networks riddled with vulnerable Java installations, report says

Despite the significant Java security improvements made by Oracle during the past six months, Java vulnerabilities continue to represent a major security risk for organizations because most of them have outdated versions of the software installed on their systems, according to a report by security firm Bit9.
Bit9's report was released Thursday and is based on data about Java usage collected from approximately 1 million enterprise endpoint systems owned by almost 400 organizations that use the company's software reputation service.

The data shows that Java 6 is the most prevalent major version of Java in enterprise environments, present on more than 80 percent of enterprise computers that have Java installed.

Java 6 reached the end of public support in April, and only Oracle customers with a long-term support contract will continue to receive security updates for it. Java 7, the version that is the focus of Oracle's recent security strengthening efforts, was only found on around 15 percent of endpoint systems sampled by Bit9.
Furthermore, most companies that run Java 6 on their systems don't have the latest security updates for it, the security firm found.

The most widely deployed Java version, according to Bit9's data, was Java 6 Update 20, which was installed on a little over 9 percent of endpoints. This version of Java is vulnerable to a total of 215 security issues, 96 of which have the maximum impact score on the Common Vulnerability Scoring System (CVSS) scale, Bit9 said.

The last publicly available security update for Java 6 is Java 6 Update 45, which was released in April at the same time as Java 7 Update 21, the latest version of Java available when Bit9 collected data for its report.
Only 3 percent of enterprise endpoint systems were running Java 7 Update 21, the company said. However, those endpoints belonged to only 0.25 percent of the sampled organizations, which seems to indicate that organizations with a larger number of endpoints are more likely to have the latest version of Java installed on their systems.

Another issue is that many enterprise systems have multiple versions of Java running on them. Around 65 percent of systems had more than two versions of Java installed at the same time, and approximately 20 percent had more than three versions.

According to Bit9's report, on average, organizations have more than 50 distinct versions of Java installed in their environments. About 5 percent of organizations have more than 100 versions.

This problem mainly stems from how the Java installation and updating process deals with older versions.
The Java 7 updater will attempt to remove existing installations of Java 6, but a clean installation of Java 7 won't remove older versions, said Harry Sverdlove, Bit9's chief technology officer. Java 5 versions are not removed during Java 7's installation or update processes, he said.

The Bit9 data showed that 93 percent of organizations have a version of Java on some of their systems that's at least five years old. Fifty-one percent have a version that's between five and 10 years old.

The problem with having multiple versions of Java installed at the same time on a system is that attackers can target the older and vulnerable versions to hack into that computer. Once that happens, the security of the newer Java versions doesn't help.

Code that enumerates all Java versions installed on a system for reconnaissance purposes has already been seen in real attacks, Bit9 said in the report.

Having different Java versions on a system increases usability because customers can run legacy applications, but from a security perspective it's a nightmare, Sverdlove said. Every version that is installed introduces yet another set of known vulnerabilities that attackers can target, he said.

Sverdlove compared the situation of companies running five-to-10-year-old versions of Java to running Windows 95. This practice might be convenient for compatibility reasons, but it's a horrible security risk, he said.
In most cases, this kind of Java version fragmentation inside enterprise environments is probably not even intentional, as many companies don't understand or keep track of how many versions they have installed, Sverdlove said.

First and foremost, organizations should get an assessment of what Java versions they have in their environments and where, Sverdlove said. The next step should be for them, as a matter of security policy, to stop and seriously consider whether they need Java, and if they do, for what purposes, he said.

The results of this assessment will vary among organizations, Sverdlove said. Some companies might find that a particular version of Java is needed to run legacy applications, but only on certain computers. Others might discover that certain websites that require Java work with the latest version of the software, and some might find that Java is only needed on their servers and not on desktops, he said.

Regardless of their individual Java needs, organizations should create a Java deployment policy and enforce it, Sverdlove said. If their policy is to not have Java, then they should use tools to block it from running; if they determine that they only need Java on certain machines, then they should remove it from all other machines, he said.

The most common way for hackers to attack Java installations is through the software's Web browser plug-ins by using exploits hosted on websites.

The Bit9 report did not contain specific information about how many of the Java installations identified on enterprise endpoints were accessible through the Web browsers on those computers. However, the majority of the sampled endpoint systems were desktops and laptops, so the likelihood of those Java installations being exposed to Web attacks is high, Sverdlove said.