NSA Hacked Kaspersky Labs and Other Anti-virus Software to Track Users

According to the latest documents revealed by NSA whistleblower Edward Snowden, the National Security Agency (NSA) and its British counterpart, Government Communications (GCHQ) Headquarters have reverse engineered the popular security firm Kaspersky Lab and other security solutions providing companies.

The US and British spy agencies have launched this attack on the anti-virus companies since 2008 to track users and breach the networks. According to the Snowden documents revealed by The Intercept, NSA  and GCHQ have reverse engineered popular security software products under “questionable legal authority” and kept an eye the web and email traffic of the users.

While different companies have been under attack, the company which is mentioned repeatedly in the report is the Russia-based Kaspersky Labs. The company is one of the leading security solutions providers, and has more than 270,000 corporate clients and claims to protect more than 400 million spread across the globe.

Below is the screenshot of the leaked 2010 presentation named “Project CAMBERDADA.”

The technique software reverse engineering, or SRE, was used to thwart Kaspersky anti-virus software. The NSA has also shown a keen interest in the past to study the weaknesses and monitored the communications between users and the Kaspersky servers.

The attack on the antivirus companies like Kaspersky makes perfect sense as they are responsible for defending the users from inbound threats. The Intercept says that spy agencies and anti-virus companies share a cat and mouse relationship. If a spy agency is able to find weaknesses in the anti-virus software and hack it, it gives it them the obvious advantage.

The Project CAMBERDADA presentation lists 23 additional AV companies from all over the world under “More Targets!” Take a look below.

A top secret warrant issued by GCGQ tells the same motives behind these attacks: “Personal security products such as the Russian anti-virus software Kaspersky continue to pose a challenge to GCHQ’s CNE [Computer Network Exploitation] capability,” the warrant stated, “and SRE is essential in order to be able to exploit such software and to prevent detection of our activities.”

In an email, Kaspersky Lab told The Intercept, “It is extremely worrying that government organizations would be targeting us instead of focusing resources against legitimate adversaries, and working to subvert security software that is designed to keep us all safe. However, this doesn’t come as a surprise. We have worked hard to protect our end users from all types of adversaries. This includes both common cyber-criminals or nation state-sponsored cyber-espionage operations.”

The Intercept asked for comments from the NSA and GCHQ- which was obviously declined.

How to Hack a Computer Using Just An Image

Next time when someone sends you a photo of a cute cat or a hot chick than be careful before you click on the image to view — it might hack your machine.

Yes, the normal looking images could hack your computers — thanks to a technique discovered by security researcher Saumil Shah from India.

Dubbed "Stegosploit," the technique lets hackers hide malicious code inside the pixels of an image, hiding a malware exploit in plain sight to infect target victims.

Just look at the image and you are HACKED!

Shah demonstrated the technique during a talk titled, "Stegosploit: Hacking With Pictures," he gave on Thursday at the Amsterdam hacking conference Hack In The Box.

According to Shah, "a good exploit is one that is delivered in style."

Keeping this in mind, Shah discovered a way to hide malicious code directly into an image, rather than hiding it in email attachments, PDFs or other types of files that are typically used to deliver and spread malicious exploits.

To do so, Shah used Steganography — a technique of hiding messages and contents within a digital graphic image, making the messages impossible to spot with the naked eye.

Here's How to Hack digital pictures to send malicious exploits:

Until now Steganography is used to communicate secretly with each other by disguising a message in a way that anyone intercepting the communication will not realise it's true purpose.

Steganography is also being used by terrorist organisations to communicate securely with each other by sending messages to image and video files, due to which NSA officials are forced to watch Porn and much porn.

However in this case, instead of secret messages, the malicious code or exploit is encoded inside the image’s pixels, which is then decoded using an HTML 5 Canvas element that allows for dynamic, scriptable rendering of images.

The "Secret Sauce" behind Stegosploit — this is what Shah calls it.

"I don’t need to host a blog," Shah told Motherboard, "I don’t need to host a website at all. I don’t even need to register a domain. I can [just] take an image, upload it somewhere and if I just point you toward that image, and you load this image in a browser, it will detonate."

The malicious code, dubbed IMAJS, is a combination of both image code as well as JavaScript hidden into a JPG or PNG image file. Shah hides the malicious code within the image’s pixels, and unless somebody zoom a lot into it, the image looks just fine from the outside.

Video Demonstration:

Shah demonstrated to Lorenzo Franceschi of Motherboard exactly how his hack works. He used Franceschi’s profile picture and then prepared a demonstration video using his picture as the scapegoat.

In the first video presentation, Shah shows a step by step process on how it is possible to hide malicious code inside an image file using steganography technique. You can watch the video given below:

In the second video, Shah shows how his Stegosploit actually works. His exploit works only when the target opens the image file on his or her web browser and clicks on the picture.

You are HACKED!

Once the image is clicked, the system’s CPU shoots up to 100 percent usage, which indicates the exploit successfully worked. The malicious code IMAJS then sends the target machine’s data back to the attacker, thereby creating a text file on the target computer that says — "You are hacked!"

Shah also has programmed his malicious image to do more stealthy tasks, like downloading and installing spyware on victim’s machine, as well as stealing sensitive data out of the victim’s computer.

The bottom line here is:

You should not presume the image files as "innocent" anymore, as they can hide malicious code deep inside its pixels that could infect your computers.

Therefore, always make sure before you click on one.

Shah has been working on the research [PDF] during his spare time for almost five years, but he has not tested his technique on popular image sharing websites like Dropbox or Imgur. He also admitted that his method might not work everywhere.

Source www.TheHackerNews.com

NSA Wants To Track Smartphone Users Based on How They Type and Swipe

Just the way you swipe your smartphone screen is enough for your smartphone to identify you.

Yes, it’s a Fact, not Fiction!

The United States National Security Agency (NSA) has a new technology that can identify you from the way your finger swipe strokes and text on a smartphone screen, according to officials with Lockheed Martin who helped design the technology.

John Mears, a senior fellow for Lockheed IT and Security Solutions, told NextGov that Lockheed Martin has been working with the agency to create a "secure gesture authentication as a technique for using smartphones," and "they are actually able to use it."

Mandrake – New Smartphone-Swipe Recognition Technology

This new smartphone-swipe recognition technology, dubbed "Mandrake," remotely analyses the curve, unique speed and acceleration of a person's finger strokes across their device's touchscreen.

"Nobody else has the same strokes," Mears explains. "People can forge your handwriting in two dimensions, but they couldn’t forge it in three or four dimensions."

"Three is the pressure you put in, also to the two dimensions on the paper. The fourth dimension is time. The most advanced handwriting-type authentication tracks you in four dimensions."

Mandrake is similar to Dynamic Signature – a motion recognition technology originally developed by the US Air Force in 1978 for Pentagon to capture the behavioural biometrics of a handwritten signature.

NSA wants to give more accuracy to users. Oh! Really?

The NSA has tested the smartphone-swipe recognition technology in an attempt to move past the age of passwords because the technology is expected to be more accurate than the use of passwords.

The United States spy agency is keeping mum on how the NSA might use the new technology though Mears says that the organization can actively deploy the technology right now, and could already be exploiting it as part of its creepy bulk data collection program.

So, it has yet to be known how NSA make use of this new technology to add up to its Global surveillance program to spy on innocent people.

The latest revelation comes this week that the agency planned to hijack Google and Samsung app stores to infect smartphones with Spyware to secretly collect data from the devices without their users knowledge or confirmation.

Deploying Mandrake for Emergency Responders:

There aren’t many details about the technology available yet, but it is believed that the technology potentially could be used for emergency responders or mission-critical personnel, who often don't have the time or capability to get online for reporting purposes.

"If you are going 100 miles down the road, you are not going to enter a complex 12-character password to authenticate yourself," Mears says. "We have some customers who deal with radioactive material and they cannot touch things that small with gloves on – how do they authenticate?"

NSA is not Alone

However, the NSA is not the only United States agency who is looking for improvements on the password for smartphone device security.

Recently, the Federal Bureau of Investigation (FBI) has spent $1 Billion on a program – called the Next Generation Identification (NGI) system – which has the capability to recognize faces, fingerprints, palm prints, tattoo images, and retinal scans.

NGI system is also developed by Lockheed and in future may incorporate voice and "gait" recognition to identify how a person walks.

Source www.TheHackerNews.com