Hackers Crack UK's National ID Card in 12 Minutes

The following article is from Eastman's Online Genealogy Newsletter and is copyright by Richard W. Eastman. It is re-published here with the permission of the author. Information about the newsletter is available at http://www.eogn.com.

The U.K.'s new National ID cards are supposed to be "unforgeable." Embedded inside the card is a microchip with the details of its bearer held in electronic form: name, date of birth, physical characteristics, fingerprints and so on, together with other information such as immigration status and whether the holder is entitled to State benefits. Unforgeable or not, Adam Laurie successfully forged one in twelve minutes.

I wrote recently (at http://blog.eogn.com/eastmans_online_genealogy/2009/07/an-rfid-chip-in-your-pocket-is-broadcasting-your-personal-identity-information.html) about some of the security concerns with the new U.S. passports and PASS (People Access Security Service) cards. A security expert was able to drive around a city and read some information from those documents in the pockets and purses of people nearby, even though that security expert never left his automobile. While the information he was able to obtain was limited, he did obtain the unique serial numbers of the RFID chips embedded in those documents.

Now computer expert Adam Laurie, technical director of the London security and networking firm The Bunker, was able to clone RFID chips embedded in the prospective national ID card being issued to foreign nationals in the United Kingdom.

This time the security expert did not obtain "limited information." Information included on the chip includes physical details of the recipient, name, fingerprints, among other personal details. The information was easily changed and copied to new, forged documents. After rewriting the data on the card, Laurie reversed the bearer's status from 'not entitled to benefits' to 'entitled to benefits.' Adam Laurie then created a new, forged document that would have passed all the electronic verification tests. He performed all this in front of reporters from the Daily Mail newspaper.

The time required? 12 minutes from beginning to end. The equipment? A Nokia mobile phone and a laptop computer. Both were unmodified units that you can buy in most any electronics store.

The RFID chip has room for text notes that will be visible to any security official who scans the card. Adam Laurie added the following text to the newly-created card's RFID chip: "I am a terrorist - shoot on sight."

You can read more at http://www.dailymail.co.uk/news/article-1204641/New-ID-cards-supposed-unforgeable--took-expert-12-minutes-clone-programme-false-data.html#

What's in YOUR wallet?

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page
www.artsacrossgeorgia.com
Arts Across Georgia

Compromised US and Chinese Computers Launch Greatest Number of Cyber Attacks, According to SecureWorks' Data

PRNewswire/ -- SecureWorks(R), one of the market's leading Security-as-a-Service (SaaS) providers, has published the locations of the computers, from which the greatest number of cyber attacks were attempted against its clients in 2008. The United States topped the list with 20.6 million attempted attacks originating from computers within the country and China ran second with 7.7 million attempted attacks emanating from computers within its borders.

This was followed by Brazil with over 166,987 attempted attacks, South Korea with 162,289, Poland with 153,205, Japan with 142,346, Russia with 130,572, Taiwan with 124,997, Germany with 110,493, and Canada with 107,483.

"We believe these statistics are significant because it clearly shows that the United States and China have a lot of vulnerable computers that have been compromised and are being used as bots to launch cyber attacks," said Hunter King, security researcher for SecureWorks. "This should be a warning to organizations and personal computer users that, not only are they putting their computers and networks at risk by not securing them, but they are actually providing these cyber criminals with a platform from which to compromise other computers."

Computer security can be greatly improved by keeping your web browser and operating system up to date, using the latest versions of antivirus and antispyware software, following safe computer practices such as being wary of the websites you visit, and not clicking on attachments and links within emails until verifying that the sender intentionally sent the enclosed link or attachment."

"These findings illustrate the ineffectiveness of simply blocking incoming communications from foreign IP addresses as a way to defend your organization from cyber attacks, as many hackers hijack computers outside their borders to attack their victims," said Don Jackson, Director of Threat Intelligence for SecureWorks. "The Georgia/Russia cyber conflict was a perfect example of this. Many of the Georgian IT staff members thought that by blocking Russian IP addresses they would be able to protect their networks, however, many of the Russian attacks were actually launched from IP addresses in Turkey and the United States so consequently they were hit hard. This was a perfect example where we saw Russian cyber criminals using compromised computers outside their borders."

"On the other hand, we have found that many of the Chinese hackers will compromise large networks within their own country and use them as bots to attack other organizations," continued Jackson. "For example, entire university networks in China will belong to local hacker groups."

"China's hackers do create botnets from spamming through email and blogs, but a relatively larger percentage of the compromised hosts under Chinese control are simply machines in schools, data centers, companies -- in other words, on large networks -- that are mostly unguarded and consequently are entirely controlled by hacker groups, as opposed to distributed bots harvested from widely distributed international spam runs, said Jackson. "And often the groups have an insider in the networks they own. We also see many local hacker groups in Japan and Poland compromise hosts within their own country to use in cyber attacks, so the Chinese hackers are not alone in using resources within their own borders."

With hackers utilizing computer resources inside and outside of their borders, SecureWorks suggests that in addition to securing computers with ongoing system and security updates and patches, organizations should utilize a black list to block inbound communications from known malicious IP addresses. Organizations should also block outbound communications to foreign countries known to harbor hackers and block outbound communications to hostile networks known to host criminal activity. This way if your organization does have an infected host within its network, then the host will be blocked from sending personal or company data to the cyber criminals. Of course, some of these hostile networks do support a handful of legitimate sites. In addition to a blacklist, your organization can use a separate whitelist to allow outbound communication only to trustworthy sites on those otherwise hostile networks.

"SecureWorks blocks attacks no matter what machines or countries they are coming from. When a machine represents a clear and present danger our Security Operations Center and technology might decide to block all traffic from that machine forcing the criminals to be constantly finding new machines to attack from," said Jon Ramsey, SecureWorks' CTO.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page