Blog Archives

Study on pacemakers found more than 8,000 known vulnerabilities in code inside the cardiac devices

5/25/2017

I knew there are problems in medical devices security, but I did not know it's so bad.

Researcher Billy Rios and Dr Jonathan Butts from security company Whitescope said their study showed the "serious challenges" pacemaker manufacturers faced in trying to keep devices patched and free from bugs that attackers could exploit.
They found that few of the manufacturers encrypted or otherwise protected data on a device or when it was being transferred to monitoring systems.
Also, none was protected with the most basic login name and password systems or checked that devices they were connecting to were authentic.

0 Comments

Dallas Tops Forbes' List Of The Best Cities For Jobs 2017

5/16/2017

0 Comments

Dallas-Plano-Irving metropolitan area ranks first this year on Forbes' list of the Best Cities For Jobs.

It’s a region that in many ways is the polar opposite of the San Francisco and San Jose metropolitan areas, which have dominated our ranking for the last few years. (They still place second and eighth this year, respectively, among the largest 70 metropolitan areas, though San Jose is down sharply from second place last year.)

Unlike the tech-driven Bay Area, Dallas’ economy has multiple points of strength, including aerospace and defense, insurance, financial services, life sciences, data processing and transportation. Employment in the metro area has expanded 20.3% over the past five years and 4.2% last year, with robust job creation in professional and business services, as well as in a host of lower-paid sectors like retail, wholesale trade and hospitality.

0 Comments

How the massive attack of WannaCry ransomware was stopped

5/16/2017

1 Comment

Here is the detailed description of how the WannaCry attack was "accidentally" stopped.

All this code is doing is attempting to connect to the domain we registered: if the connection is not successful it ransoms the system; if it is successful the malware exits.

The reason that was suggested is that the domain is a “kill switch” in case something goes wrong, but I now believe it to be a badly thought out anti-analysis.

In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to. A side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen).

I believe the malware creators were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox and the malware exits to prevent further analysis. This technique isn’t unprecedented: the Necurs trojan queries five totally random domains, and if they all return the same IP it exits.

However, because WannaCrypt used a single hardcoded domain, my registration of it caused all infections globally to believe they were inside a sandbox and exit... thus we unintentionally prevented the spread and further ransoming of computers infected with this malware. Of course now that we are aware of this, we will continue to host the domain to prevent any further infections from this sample.

One thing that is very important to note is our sinkholing only stops this version of the ransomware, and there is nothing stopping them removing the domain check and trying again, so it’s incredibly important that any unpatched systems are patched as quickly as possible.

1 Comment

Monitoring Ransomware WannaCry's Bitcoin Profits

5/15/2017

0 Comments

The beauty of Bitcoin is not just its ability to anonymously and safely handle darknet market payments like ones demanded by now popular ransomware WannaCry. Another interesting feature of Bitcoin is its ability to provide everyone else with detailed information about the number and amount of those payments as Bitcoin Blockchain is available publicly. WannaCry's Bitcoin addresses are hardcoded, which is kind of stupid but entertaining.

Bitcoin anonymity ends when you need to convert this virtual currency to old good bucks. However, there are still some options available to resolve this issue. First, you can keep the virtual currency and use it on darknet markets. Second, there are special tools called anonimizers which can mix multiple addresses and transactions in order to launder Bitcoins.

Currently, there are about 32 bitcoints on those accounts which equals to ~ $55,000.
Here are the WannaCry Bitcoin accounts:

https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

0 Comments

Vulnerability in Frisco, Texas-based True Health Diagnostics software exposed at least two million personal health records

5/10/2017

0 Comments

This design flaw is very primitive but dangerous.

The medical reports that True Health produces contain vast amounts of extremely personal information on patients, including indicators of genetic abnormalities as well as markers of potentially current and future diseases.To demonstrate the flaw, Mursch logged into his account at True Health and right clicked on the PDF file for his latest health report. He showed how the site would readily cough up someone else’s detailed health records and blood tests if he modified a single digit in the link attached to that PDF record and then refreshed the page.

0 Comments

Sabre Corp discloses breach of payment systems

5/4/2017

0 Comments

Just another card data breach.

Today, travel industry giant Sabre Corp. disclosed what could be a significant breach of payment and customer data tied to bookings processed through a reservations system that serves more than 32,000 hotels and other lodging establishments.

0 Comments

Author of books Crypto Basics, Bitcoin for Nonmathematicians, Hacking Point of Sale

Study on pacemakers found more than 8,000 known vulnerabilities in code inside the cardiac devices

Dallas Tops Forbes' List Of The Best Cities For Jobs 2017

How the massive attack of WannaCry ransomware was stopped

Monitoring Ransomware WannaCry's Bitcoin Profits

Vulnerability in Frisco, Texas-based True Health Diagnostics software exposed at least two million personal health records

Sabre Corp discloses breach of payment systems

Categories

Archives