Local Classified Penny Auction Scam

While there are a lot of new posts regarding the new ways to exploit people using novel techniques and 0day exploits, there continues to be a rash of tried and true methods of coercion.  I want to just walk through a simple example and reflect on how effective these methods continue to be.

Many people turn toward online classified sites to buy and sell items online.  This example starts with kijiji.ca which even I've used on occasion to find used electronics and other items.  Doing a search on the site for a "Samsung Galaxy Note 2" returns a posting from today with someone selling one for an unreasonably priced unit.

$125 for a $500 phone?, but what if it's for real?  No harm in just asking some simple questions.  Email sent with some obvious questions regarding the condition and location.

About an hour passes before I get a response from what appears to be a legit seller.

Notice no answer to the questions I asked, but a friendly pointer at where the unit came from and how I could get one for the same price.  What is biddycacts.com though?  Well this online penny auction site claims to allow for purchases way below the value of the items being sold.

Including a not-so-obvious but intentionally generic newsreel video.

https://www.youtube.com/watch?feature=player_embedded&v=OK9mUVAPTMY

That's when I get the second email from another email account with the exact same content and a link to a different URL but same exact site.  bidcactus.com.

Ok so even now I'm suspicious and I do a little digging into the DNS registration information, YouTube account posting the videos and the posts on Kijiji related to the items.  All appear to be somewhat anonymous and scammy.

Switching mindsets to that of the people behind this scheme.  What might be going on here?  Here is one likely scenario:

1. The scammers setup the fake bidding site and youtube accounts and probably twitter and email accounts too.  Including fake items and auctions.
2. They post a few ads on local advertising sites for desirable items for too-good-to-be-true prices.
3. Setup a script to auto-reply to inquiries about the items from legitimate buyers with links to the scam site.
4. Ask for registration from the user which includes an email address and password.
5. Use this email address and password to attempt to access the email provided.  Any that work add them to the list of people that scam messages are sent from.
6. If the user is gullible enough to bid and pay for items using a credit card or paypal, this is free cash.
7. Wait a week or two then switch to another email address, URL, payment gateway etc
8. If the scammers were really nefarious they could also extract all of the email from the user and likely use it to conduct additional fraud or ID theft.

Simple scams like these are obvious to critically minded people, but with so many people online exposed to this how do we find out about them?  Plus what's to stop more from springing up all the time.

Three lessons for people:
1.  If something looks to good to be true, it almost always is.
2.  Follow safe browsing practices.  Be patient and don't rush into giving anyone your information or registering with unknown sites.
3.  If you fall for a scam, tell people about it and register it with local law enforcement (http://www.rcmp-grc.gc.ca/scams-fraudes/index-eng.htm), Internet Crime Compliant Center (http://www.ic3.gov/default.aspx), and google's phishing report (http://www.google.com/safebrowsing/report_phish/).

Creating an Encrypted Bootable OSX Lion USB Recovery Disk

With Apple's latest operating system release 10.7 - Lion they have included a number of new features which make it a bit more convenient to both backup and secure your data in case of a failure.  In this short post I'll explain how to use a generic external drive to make a secure bootable disk for your mac.

First a disclaimer and some assumptions regarding your setup.  I have used these instructions to get a working disk on my setup - but this does not mean that the same steps will work for you, so use caution - and if anything goes wrong please feel free to add to these steps.

I am also assuming that you are using the latest operating system patches for OSX and I'm at version 10.7.2.

Step 1 - Connect and prepare your external USB drive.

Connect your USB disk and open disk utility.

Change the formatting scheme of the disk to include two partitions, a 1GB partition, and a partition using the remaining disk space.  I named one as RECOVERY and one as TIMEMACHINE.  Ensure that under "Options" the format is GUID Partition

Select the format for both of the partitions as Mac OS Extended (HFS) and click apply. Note - this will erase all of the data from the selected drive so make sure you have the right drive selected.

Step 2 - Download and Install the OSX recovery disk assistant from Apple - http://support.apple.com/kb/dl1433

The wizard will ask you which disk you'd like to use to install onto.  Select the RECOVERY Volume.  Be aware that this will erase all data on the selected disk (well except for the TIMEMACHINE partition that we created earlier :)).

There is now a hidden recovery partition with a type of "Apple_Boot" on the USB drive that you used.  To see it, in a terminal window type:

diskutil list

Step 3 - Open Time Machine preferences and click select disk.  Select the TIMEMACHINE volume.  Also check off the encryption checkbox to ensure that your files are protected.  You will be prompted for a passphrase to use for this.  Note - this is a different passphrase than is used for the user on the computer and for the wholedisk encryption you have on the hard drive.

Step 4 - Wait until the first backup is complete.  Once the files are transfered for the first time the backups will be encrypted as well.  This also will take some time.  During these operations you can eject the disk and have it resume once the disk is reconnected.  When you reconnect the encrypted disk, you will be prompted for you password.

Step 5 - Once the backup and encryption operations are complete, you should test your backup solution by rebooting the computer and holding down the Option key, then select the USB disk.  The recovery wizard will walk you through the processes of restoring your computer from the recovery Volume on the USB drive.

I will update this post, when I get a chance to test out the recovery process.

Step 6 - Always remember the rule of 3 when making copies of your important data.  1 live copy, 1 backup copy, and 1 copy stored somewhere other than your other two.  In this case you could get by with just periodically (weekly / monthly) backing up to the USB drive and then storing this drive in a different location.

Announcing new team member - Benoit Desforges

I'm very pleased to announce that we've added another significant resource to our team.  Our new advisor Benoît Desforges brings international experience and a fresh perspective on information risk management.

Prior to joining, Benoît worked for KPMG's advisory group, he holds several professional designations including CISSP, CISA, GCIH, and GAWN.  When he's not teaching advanced networking courses for a local university, Benoît enjoys travel and time with his family.

Benoît will be providing our clients with security advice and building out a number of new and improved professional service offerings.  He'll also be regular contributor to our blog.  Congratulations Benoît!

New Trust Solutions

With the all of the activity circling around SSL certs and CA trust, there is an inherent trust problem.  Internet users have been taught to trust the PKI scheme that we use for all secure browsing activity.  There are two very valid cases for the destruction of this trust:

1.  Law-enforcement / Government interception.  There are product vendors whose business model is to supply equipment to law enforcement and government clients which can "law-fully" intercept communications without the knowledge of the end-user.  Example is www.packetforensics.com.  Although I do not have a link (can anyone supply a corroborating link?), there are several product pages that are not publicly accessible which would likely confirm this fact.  In order for these products to work, the SSL certs that are used would have to be trusted by the browser software to avoid being detected as un-trusted.  I am theorizing that these certs would be generated by one of the trusted roots within the existing trust-model.

2.  Compromised CAs.  Both Comodo and Diginotar both purport to have been compromised resulting in the generation of certificates that can be used to emulate the trust with popular web properties.  To the end user there is no easy way to differentiate between valid and invalid certs.

The impact here is that a user may think that all information is secured between them and the server, but in reality this traffic may be routed through a very-untrusted 3rd party and intercepted.  We currently have no effective tool to provide information to users that any activity like this has occurred.  So for the mean time we should be very vigilant about who we are communicating with, and the certificates that are used to trust their identities.

I also encourage and hope that we see some innovative solutions created that will allow users to be aware of changes to traffic patterns - indicating potential MITM, and new methods of generating trust in web-services like convergence http://convergence.io/.

Blindly Trusted Roots

With both Comodo and Diginotar both having their security breached, it highlights some of the important trust issues we have on the Internet.  The process of trusting these root CA's is extremely important as they serve as the foundation of protecting our information as it is transmitted across public and untrusted networks.

Both of the breaches resulted in fraudulent certifications being issued and used to impersonate high-traffic sites such as google, yahoo, skype and live dot com properties.  These certificates were used to trick browsers (and users) into thinking that they were connected to a valid site, when they were not.

More importantly though is the realization that the trust in the root CA system on the Internet has been eroded.  With two publicly disclosed breaches, how many undisclosed breaches have their been, and how many breaches of these CA's have not even been discovered?

While the use of fraudulent certificates on high-volume consumer sites is a big issue, the bigger issue here is the use of low-volume high-value certs to intercept financial transactions, email message systems, and other highly critical services.

My position is that we need to come up with a new paradigm for establishing trust in public/private services, and eliminate the use of old broken systems like the root CA pki's.  The only issue I see is the speed with which this can happen.

Application Security - Don't Wait for the Breach

The ongoing Sony saga, the Conservative Party, and now CodeMasters.  High-profile breaches of data are becoming everyday occurrences.   Reports like Verizon's DBIR indicate that more than 90% of these incidents would have been avoidable using basic security controls.  TripleCheck offers straight-forward assessment services to ensure that you're organization is prepared to meet these challenges.  Call or email us today to gain assurance over the security of your environment.

May Security Catch-up

Its been much too long since my last post - Sony's PSN network has been breached a few times, a record number of vulnerabilities have been published, and the US government has released a new set of cyber space strategies.

On the cool tools and technologies there have been lots of notable releases:

• Some research from Albert Cotesi New Zealand on the traffic flowing from IOS to 3rd parties, now sniffable thanks to MITMProxy, and instructions on getting it working with IOS
• As always SQLmap is making life easier for the vulnerability assessor and pen-tester.
• Microsoft has released an updated to the Enhanced Mitigation Experience Toolkit - I'll be looking into this over the next few weeks, and how it can be applied practically.
• New major version of Backtrack also released, for those of you that are still relying upon live-cd's as a source for tools.