mitm attack - Online Cyber Security News

Wikileaks Unveils CIA's Man-in-the-Middle Attack Tool

Friday, May 05, 2017 Mohit Kumar

Wikileaks has published a new batch of the Vault 7 leak, detailing a man-in-the-middle (MitM) attack tool allegedly created by the United States Central Intelligence Agency (CIA) to target local networks.

Since March, WikiLeaks has published thousands of documents and other secret tools that the whistleblower group claims came from the CIA.

This latest batch is the 7th release in the whistleblowing organization's 'Vault 7' series.

Dubbed Archimedes, the newly released CIA tool, dumped on Friday, purportedly used to attack computers inside a Local Area Network (LAN).

According to the leaked documents, this MitM tool was previously named 'Fulcrum' but later was renamed to 'Archimedes' with several improvements on the previous version, like providing a way to "gracefully shutting down the tool on demand," and adding "support for a new HTTP injection method based on using a hidden iFrame."

The leaked documents describe Archimedes as a tool that lets users redirect LAN traffic from a targeted computer through a malware-infected computer controlled by the CIA before the traffic is passed on to the gateway, which is known as man-in-the-middle (MitM) attack.

The tool in itself is very simple without any extraordinary capabilities, as there are many MitM tools available on the Internet that anyone can be download and use it to target users on the local network.

Rendition Infosec founder Jake Williams also pointed out that the tool is not even originally developed by the CIA, rather appears to be a repackaged version of Ettercap – an open source toolkit for MitM attacks.

Williams also noted that the potential CIA targets could even use the leaked information to see whether their computers had been targeted by the agency.

Last week, WikiLeaks dumped source code for a more interesting CIA tool known as "Scribbles," a piece of software allegedly designed to embed 'web beacons' into confidential documents, allowing the spying agency to track insiders and whistleblowers.

Since March the Whistleblowing website has published 7 batches of "Vault 7" series, which includes the latest and last week leaks, along with the following batches:

"Year Zero" – dumped CIA hacking exploits for popular hardware and software.
"Weeping Angel" – spying tool used by the agency to infiltrate smart TV's, transforming them into covert microphones.
"Dark Matter" – focused on hacking exploits the agency designed to target iPhones and Macs.
"Marble" – revealed the source code of a secret anti-forensic framework, basically an obfuscator or a packer used by the CIA to hide the actual source of its malware.
"Grasshopper" – reveal a framework which allowed the agency to easily create custom malware for breaking into Microsoft's Windows and bypassing antivirus protection.

Dangerous Rootkit found Pre-Installed on nearly 3 Million Android Phones

Saturday, November 19, 2016 Swati Khandelwal

Here's some bad news for Android users again.

Nearly 3 Million Android devices worldwide are vulnerable to man-in-the-middle (MITM) attacks that could allow attackers to remotely execute arbitrary code with root privileges, turning over full control of the devices to hackers.

According to a new report from security rating firm BitSight, the issue is due to a vulnerability in the insecure implementation of the OTA (Over-the-Air) update mechanism used by certain low-cost Android devices, including BLU Studio G from US-based Best Buy.

Backdoor/Rootkit Comes Pre-installed

The vulnerable OTA mechanism, which is associated with Chinese mobile firm Ragentek Group, contains a hidden binary — resides as /system/bin/debugs — that runs with root privileges and communicates over unencrypted channels with three hosts.

According to the researchers, this privileged binary not only exposes user-specific information to MITM attackers but also acts as a rootkit, potentially allowing attackers to remotely execute arbitrary commands on affected devices as a privileged user.

"Additionally, there are multiple techniques used to hide the execution of this binary. This behavior could be described as a rootkit," the CERT advisory associated with this vulnerability warned on Thursday.

Similar to the flaw discovered in Android devices running firmware from Shanghai ADUPS Technology, the newly discovered flaw (designated CVE-2016-6564) also resides in the firmware developed by a Chinese company.

While the AdUps firmware was caught stealing user and device information, the Ragentek firmware neither encrypt the communications sent and received to smartphones nor rely on code-signing to validate legitimate apps.

This blunder could allow a remote attacker to extract personal information from an affected device, remotely wiping the whole device, and even make it possible to gain access to other systems on a corporate network and steal sensitive data.

Affected Android Devices

The vulnerability has been found in multiple smartphone handsets from BLU Products, along with over a dozen devices from other vendors. The list of affected Android handsets includes:

BLU Studio G
BLU Studio G Plus
BLU Studio 6.0 HD
BLU Studio X
BLU Studio X Plus
BLU Studio C HD
Infinix Hot X507
Infinix Hot 2 X510
Infinix Zero X506
Infinix Zero 2 X509
DOOGEE Voyager 2 DG310
LEAGOO Lead 5
LEAGOO Lead 6
LEAGOO Lead 3i
LEAGOO Lead 2S
LEAGOO Alfa 6
IKU Colorful K45i
Beeline Pro 2
XOLO Cube 5.0

While analyzing the flaw, AnubisNetworks found that the device, a BLU Studio G, attempted to contact three pre-configured Internet domains, two of which remained unregistered despite being hardwired into the Ragentek firmware that introduced the bug.

"This OTA binary was distributed with a set of domains preconfigured in the software. Only one of these domains was registered at the time of the discovery of this issue," BitSight's subsidiary company Anubis Networks says in its report published Thursday.

"If an adversary had noticed this, and registered these two domains, they would’ve instantly had access to perform arbitrary attacks on almost 3,000,000 devices without the need to perform a man-in-the-middle attack."

After the discovery, AnubisNetworks researchers registered the addresses and now controls those two extraneous domains to this day in an attempt to prevent such attacks from occurring in the future.

Around 3 Million Devices contain Dangerous Rootkit

Still, the impact was significant. The researchers were able to exploit the backdoor in the BLU Studio G phone, which allowed them to install a file in the location that's reserved for apps with all-powerful system privileges.

However, by observing the data smartphones sent when connecting to the two domains registered by BitSight, the researchers have cataloged 55 known device models that are affected.

"We have observed over 2.8 Million distinct devices, across roughly 55 reported device models, which have checked into our sinkholes since we registered the extraneous domains," the report reads.

"In some cases, we have not been [able] to translate the provided device model into a reference to the real-world device."

So far, only BLU Products has issued a software update to address the vulnerability, though BitSight researchers haven't yet tested the patch to analyze its effectiveness. However, the remaining Android devices might still be affected.

For more technical details about the vulnerability, you can head on to full report published by BitSight's AnubisNetworks.

This is the second case in a single week when researchers have warned you of Android smartphones coming pre-installed with backdoors that not only send massive amounts of your personal data to Chinese servers, but also allow hackers to take control of your device.

Chinese Government Executes MITM Attack against iCloud

Monday, October 20, 2014 Mohit Kumar

Apple iCloud users in China are not safe from the hackers — believed to be working for Chinese government — who are trying to wiretap Apple customers in the country.

Great Fire, a reputed non-profit organization that monitors Internet censorship in China, claimed that the Chinese authorities have launched a nationwide Man in the Middle (MITM) campaign against users of Apple’s iCloud service, designed to steal users' login credentials and access private data.

MAN-IN-THE-MIDDLE ATTACK

The attacks on the iCloud service was first reported on Saturday and come as Apple begins the official rollout of its latest launched iPhone 6 and 6 Plus on the Chinese mainland.

If we talk about less publicized but more danger, Man-in-the-Middle (MitM) attack is the most common one. By attempting MitM attack, a potential attacker could intercept users’ internet communication, steal sensitive information and even hijack sessions.

ACCESS TO CREDENTIALS AND ALL PERSONAL DATA

Using MITM attack, unknown hackers insinuated their own website, with fake certificate and Domain Name Service address for the iCloud service, between users and Apple's iCloud server, which allowed them to intercept data and potentially gain access to passwords, iMessages, photos and contacts.

However, Apple’s iCloud uses SSL security standard to encrypt the connections between its users and Apple's iCloud server, but the company’s SSL certificate is replaced by the intruders for a self-signed one that deceived Web browsers with false information, allowing the cyber criminals to decrypt the connections.

The attack on iCloud users in China is an effort to help the government bypass the enhanced security features of the latest iPhone devices by compromising their iCloud usernames and passwords and allowing the authorities to gain access to cloud-stored content such as phone backups, according to the Chinese Internet freedom advocacy group GreatFire.org.

GreatFire.org is the same group who previously reported a similar attack when Beijing apparently launched MITM attacks against Github, Google and more recently, Yahoo, in what was seen as an attempt to censor information on the Hong Kong protests.

HOW YOU CAN PROTECT YOURSELF

In order to protect yourself from personal data breach, Apple users in China are advised to visit iCloud.com only via browsers like Chrome and Firefox, as these competent browsers will detect the inappropriate certificate and flag any MITM attempts.

Using a VPN would get around the problem too, but only if you can use one safely behind the Great Firewall. Other softwares — including the popular Qihoo 360 ‘secure’ browser by Chinese biz Qihoo — will gobble up the dodgy certificate without warning.

“If users ignored the security warning and clicked through to the Apple site and entered their username and password, this information has now been compromised by the Chinese authorities. Many Apple customers use iCloud to store their personal information, including iMessages, photos, and contacts,” GreatFire said in a blog post. “This may also somehow be related again to images and videos of the Hong Kong protests being shared on the mainland.”

To aware users of the fake certs, Greatfire.og has also published the connection log, traceroutes, wirecapture data, and a copy of the dodgy certificate. Apple users are also advised to turn on the Two-step authentication on their iDevices, because using two-step verification would prevent the hijacking of the already compromised accounts.

It isn't clear that the Chinese government is behind the attacks, but it may be connected to the ongoing political protests taking place in Hong Kong.

“This may also somehow be related again to images and videos of the Hong Kong protests being shared on the mainland,” Greatfire.org wrote in its blog post.

When it comes to security, Apple takes their security seriously. Apple faced series of embarrassing privacy breaches in past few months in which icloud accounts of high-profile celebrities were accessed by the intruders and some of the celebrities’ nude photos were leaked online by hackers, who posted them on different websites.

Apple has not commented on the report at time of publication, but as soon as any response from the company will be received, we’ll update the story.

Millions of LinkedIn Users at Risk of Man-in-the-Middle Attack

Wednesday, June 18, 2014 Swati Khandelwal

Two year back in 2012, one of the most popular online social networking sites Linkedin spent between $500,000 and $1 million on forensic work after millions of its users’ account passwords were compromised in a major security data breach. But, it seems that the company hasn't learned any lesson from it.

WHAT IS MAN-IN-THE-MIDDLE (MitM) ATTACK

Before moving on to the story, let us discuss some emerging and common threats against the social networking sites nowadays. If we talk about less publicized but more danger, then Man-in-the-Middle (MitM) attack is the most common one. By attempting MitM attack, a potential attacker could intercept users’ internet communication, steal sensitive information and even hijack sessions.

Though MitM attacks are popular and have existed for years, a major categories of today’s largest websites and social networking sites still haven’t taken the necessary steps to safeguard their users’ personal and sensitive data from the vulnerabilities that raise the danger of this type of attacks.

LINKEDIN SSL STRIP ATTACK

The popular professional network, LinkedIn has left hundreds of millions of its users exposed to Man-in-the-Middle (MitM) attack due to the way the site uses Secure Sockets Layer (SSL) encryption in its network.

No doubt, LinkedIn is using HTTPS connection for user login pages, but they are not using HTTP Strict Transport Security (HSTS) technology that prevents any communications from being sent over HTTP, instead send all communications over HTTPS.

LinkedIn Users' Vulnerable to Man-in-the-Middle Attack

According to researchers at Israel-based Zimperium Mobile Threat Defence, the poor implementation of HTTPS/SSL allows a hacker to intercept a user’s communication by replacing all “HTTPS” requests with its non-encrypted form, “HTTP”, known as “SSL stripping” attack.

“Once the attacker has extracted a user’s credentials, they can reuse the user’s credentials or session cookies to authenticate and forge the exact session,” reads the blog post.

VIDEO DEMONSTRATION

In a video demonstration, researchers have practically used this tool against LinkedIn website and as a result of SSL stripping, they intercepted one of its users’ account by a MITM attack and successfully grabbed users’ account information and every single user they tested was vulnerable to this attack.

VULNERABLE COMPONENTS

By attempting MitM attack against the website, an attacker can grab a LinkedIn user’s credentials, hijack their session to gain access to all other LinkedIn information and impersonate the user. Attackers could do multiple things including:

Email address
Password
Read and Sent Messages
Connections
“Who viewed my profile”

Attackers can impersonate the user to use any account feature, including:

Send invitations to connect
Edit the user’s profile
Edit job postings
Manage company pages

“So not only is your personal LinkedIn information at risk, but also if you are an administrator for your corporate LinkedIn presence, your company’s brand reputation could also be damaged if a malicious actor were to gain control over posts and email communication on LinkedIn,” reads the blog post.

REMOTE ATTACKS

Moreover, this vulnerability in the LinkedIn doesn't just exist when a potential attacker is on the same network as the targeted victim.

To perform MITM attack remotely, an attacker can compromise a device and once that device enters a different network, the same attacker can use the victim’s device remotely to perform man-in-the-middle attack on other users on the victim’s network.

LINKEDIN IMPLEMENTING HTTPS BY DEFAULT, BUT VERY SLOWLY

Researchers from Zimperium first responsibly reported this critical ‘session hijacking’ vulnerability to the LinkedIn security team in May 2013. Despite, reaching out to LinkedIn six times over the last year, the team have not responded seriously.

Later from December 2013, LinkedIn started transition of the website to default HTTPS and just last week they have successfully upgraded US and European users to Default HTTPS Network. Because of slow implementation of default SSL, Zimperium finally rolled out the disclosure of the vulnerability publically.

LinkedIn spokeswoman Nicole Leverich said the issue described by Zimperium “does not impact the vast majority of LinkedIn members given our ongoing global release of https by default.”

HOW TO ENABLE FULL HTTPS MANUALLY

However, In 2012, LinkedIn offers its users an option to change their security settings to full HTTPS manually, but many might not have known about it. You can enable it by going into your LinkedIn settings, Open “account” tab and Click “manage security settings” to select Full HTTPS.