Apple's iCloud cracked: Lack of two-factor authentication allows remote data download

By Violet Blue for Zero Day

Notorious Russian hacker Vladimir Katalov released findings showing Apple's iCloud vulnerable to unauthorized download access, with iCloud data stored on Microsoft and Amazon servers.

KUALA LUMPUR, MALAYSIA--Russian security researcher Vladimir Katalov analyzed Apple's secretive iCloud and Find My iPhone protocols to discover that neither are protected by two-factor authentication, and iCloud data can be downloaded remotely without a user ever knowing. 

In "Cracking and Analyzing Apple’s iCloud Protocols," presented to a crowded room at Hack In The Box security conference last Thursday in Kuala Lumpr, Malaysia, Vladimir Katalov revealed that user information and data is not as inaccessible as Apple is telling the public.

Katalov's findings appear to support his emphatic statement that Apple can access data it claims to not be able to access.

A malicious attacker only needs an Apple ID and password to perform remote iCloud backups — and do not need the user's linked devices.

He explained that there is no way for a user to encrypt their iCloud backups.

The data is encrypted, he explained, but the keys are stored with the data. Katalov added that Apple holds the encryption keys.

Katalov told ZDNet he was shocked to discover that in addition to all of these security chain issues, Apple's iCloud data is stored on Microsoft and Amazon servers.

Katalov's presentation pointed out that because Apple provides full request information to its third-party storage providers (Amazon and Microsoft), Apple could provide this data to law enforcement. 

In Apple's July public statement on the NSA PRISM surveillance program, Apple denied any backdoor server access for government agencies. Apple unequivocally stated, "Apple does not give law enforcement access to its servers."

When a user performs an iCloud backup download, they receive an email informing the user that the process is complete.

Katalov discovered that when a remote download is performed, the user receives no notification email. If a user's data is accessed and downloaded from iCloud by a remote third party, they would not know.

Katalov's work represents the first time anyone has analyzed and publicly presented findings on Apple's secretive iCloud protocol.

Vladimir Katalov analyzed Apple's iCloud and Find My Phone protocols by sniffing http traffic on jailbroken devices — though he was careful to explain that a user's devices do not need to be jailbroken for a malicious entity to exploit the remote backup protocol security omissions Katalov discovered.

Analyzing the traffic, he told the crowded room during his Thursday presentation, was not difficult.

Apple's iCloud data is comprised of what a user stores as a data backup. It contains documents, Dropbox files and sensitive user data.

In his analysis, Katalov discovered that iCloud files are stored as a container — plist and content— in a files-to-chunks mapping schema.

But he found that Apple's two-factor authentication, a layer of user security used in addition to a username and password, is not used for iCloud backups (or Find My Phone).

Apple's two-step authentication ("2FA") does not protect iCloud backups, Find My Phone data and the documents stored in the cloud. Katalov details this further in a blog post: "Apple Two-Factor Authentication and the iCloud."

Katalov showed Hack In The Box attendees that with simple queries, it's possible to get the authentication token for accessing the iCloud backup, backup IDs, and the encryption keys. Then one can download the files from where they're stored in Windows Azure or Amazon AWS.

ZDNet caught up with Katalov after his presentation to find out more.

When asked if he had presented his discoveries to Apple, he explained that his findings were the results of protocol analysis — and are not a vulnerability.

Put another way, the iCloud security hole falls into the "it's a feature, not a bug" category.

When ZDNet asked Katalov if there was a way for Apple to fix this issue — such as extending two-factor authentication to its iCloud and Find My Phone services — he shook his head and told us that Apple's implementation of two-factor auth was likely "only an afterthought."

Katalov told ZDNet the best thing a user can to do to protect their iCloud data is to simply not use iCloud.

However, Katalov told us he still uses Apple's iCloud as a backup service. "It is not exactly safe, but I am selecting between security and privacy," he said.

It's easy to argue that because a remote attacker needs an Apple user ID and password, the data is still out of reach to most malicious entities.

However, obtaining Apple user IDs and passwords isn't impossible — aside from email phishing techniques, which are more effective than most would believe. Social engineering techniques are sadly common and also very effective.

A recent example is the spate of Apple ID data thefts in Norway. This past February, a significant number of teenage girls were targeted by boys who easily surmised the girl's user ID and password recovery information to gain access to their Apple accounts, download photos and the girls' data — which, sadly, ended up pass around and also sold online.

In his Hack In The Box presentation, Katalov told the audience that he was also surprised to discover that when a user shuts off location tracking services, the user's location is still stored for around 3-6 hours.

We wondered if this is what led Katalov to mention that next he will analyze Touch ID protocol and storage — as soon as iOS 7 is jailbroken, he told ZDNet.

"Apple says it never sends the information, and it is never copied to local [storage]" he added, "but I am not so sure."

ZDNet asked why Katalov felt this way, when Apple specifically states that it does not transmit Touch ID information.

Katalov's eyes glittered, and a boyish smile crept across his face. In his thick Russian accent he replied, "Trust no one."

ZDNet has contacted Apple for comment and will update this article if Apple responds.

http://www.zdnet.com/apples-icloud-cracked-lack-of-two-factor-authentication-allows-remote-download-7000022196/?s_cid=e589&ttag=e589 

Columbia College Shred Event!

Please join Technology Services and New World Recycling for an opportunity to shred all your unwanted documents FREE OF CHARGE. Visit us Monday, October 28th from 1:00 to 4:00pm on Cougar Drive (behind the mail room) to shred your documents, get tips on identity theft prevention, and celebrate Halloween with Technology Services!

You Google Yourself, and That's Okay

By Peter Kafka

The Internet is great because it opens up new vistas, letting you learn all sorts of stuff about people and things in far-flung corners of the world.

And also, you can Google yourself.

Which lost of you do; 56 percent of Web users told Pew Researchers last spring that they "self-search."

That's down slightly from 2009, but up from 22 percent in 2001, when maybe people were preoccupied watching Jon Woo/Clive Owen BMW adds.

But if you feel at all embarrassed about your preoccupation with yourself, this may make you feel better: Self-searchers tend to be younger, better-educated and more affluent than the general population.

http://allthingsd.com/20130930/you-google-yourself-and-thats-ok/

Medical Info for Sale Online

You can find almost anything on the Internet these days. The News4 I-Team discovered with just a few clicks and a couple hundred dollars anyone can even buy private medical details online only you and your doctor should know.

"There are between one and two million Americans affected  by medical identity theft each year," Lisa Schifferle, with the Federal Trade Commission, told the News4 I-Team. "It can happen in all sorts of ways. There can be insiders that are paid to steal information from hospitals and nursing homes."

D.C. has had its share of breaches. In 2012, more than 66,000 people were put at risk after someone stole a Howard University Hospital contractor's laptop. In 2011, the company which provides healthcare for the military, Tricare, lost tapes containing private information of almost five million people.

A Howard University Hospital spokesperson said there's no evidence that any private information on that stolen laptop was misused. After the incident, the hospital toughened up security procedures with encryption and more HIPPA retraining. Tricare said it could not comment on the case involving its lost tapes due to ongoing litigation.

So, where does the compromised information end up? According to the FTC, the information often goes overseas, sold for big bucks. "Some studies have indicated that on the black market, you can get more for medical information than you can for a social security number," Schifferle said.

Terry Martinez was shocked when the News4 I-Team showed up at his door with private information we found for sale online. "That's my social, date of birth, IP address. They got everything. My driver's license number. They even got the term life insurance," said Martinez as he looked through what we found.

When the News4 I-Team asked him if he has ever checked to see if his medical records had been compromised, he told us "No. I hardly ever even go to the doctor. Very seldom do I ever check that."

Martinez knew something was up, though, since he's been fighting for the past year to get his identity back after discovering someone tried to file his taxes and emptied his bank account. But Martinez had no idea some of his medical information was floating around on the Internet, too.

He's not alone. The News4 I-Team found private information for people all over the D.C. area, including physician contacts, insurance providers, whether people smoke and even the amounts of insulin doses administered each day.

The man who was selling the information agreed to talk via Skype from Costa Rica but would not show his face.

He said he got most of the current medical records from India, where call centers gather information by phishing over the phone. In those call centers, he said, "You're going to see people buying data, selling data, like it's candy at a store."

The seller also described how the operation worked when he, himself, was a telemarketer for an overseas company. He said callers would try to get missing private details from people over the phone. "They gave me a script that I had to read," he said. Part of the script read, "'So what is your name? What is the doctor's name?' When we didn't even have the doctor's name on it," he explained. "We were just saying that."

Those private details were then often sold to medical companies that targeted people with health conditions and charged insurance companies for services and supplies.

You can protect yourself. The FTC says everyone should check their credit report for unusual medical bills or charges. Ask your health insurance provider for a list of benefits in your name. And never provide medical information to a caller over the phone.

If you do find out you have been a victim, you should file a complaint with the FTC and police. Also, contact your medical providers.

http://www.nbcwashington.com/investigations/Medical-Info-for-Sale-Online-224954762.html


                        

Amazon 'wish list' is gateway to epic social engineering hack

By Chenda Ngak/CBS News

Comedian Erik Stolhanske didn't know what he was getting himself into, when he let a cybersecurity expert at SecureState take a crack at hacking him. The "Super Trooper" actor gave the company the green light to access his Twitter account with nothing more than his name. What he found out was that his entire digital life could have been compromised using simple techniques.

SecureState profiling consultant Brandan Geise went on a mission to hack into Stolhanske's Twitter account, but instead was able to gain access to his Amazon, AOL, Apple and Dropbox accounts, as well his Web hosting account. 

A manipulation tactic called social engineering can give anyone smart enough to connect the dots a gateway into your digital domain. It doesn't require a single line of programming code.

"Pretty much anyone can do this," Geise told CBSNews.com.

Geise started by running a search of Stolhanske's name on Spokeo.com, a website that aggregates public information about people. Information found on Spokeo can include a home phone number, email addresses, all associated home addresses, family members, and occupation. It took two pieces of information from Spokeo to gain access to Stolhanske's Amazon.com account: an email and home address.

Amazon has a feature called wish lists that let members bookmark items they want to buy and save them in a list. Anyone can run a search for wish lists using either a name or an email address. That may be convenient when friends or relatives are wondering what you want for your birthday, but it can make you vulnerable. By trying all of the email addresses found on Spokeo, Geise was able to find Stolhanske's Amazon wish list, confirming that he also had a registered account.

The next step would be the key to making the rest of the dominoes drop.

Geise called Amazon customer service and asked to add a credit card using an account name, email address and billing address. When it came time to verify his identity, Geise told the Amazon representative that he forgot which home address he used for the account, and went down the list he obtained from Spokeo. A match was found, and he was able to add a credit card to the account.

After hanging up, he called back 30 minutes later saying he lost access to his account and backup email address. Geise was able to verify his identity by using the last four digits of the credit card he added in his previous call. He faced one last hurdle: Amazon required him to name an item that he recently purchased. Geise was able to bypass this requirement partially due to thorough research and a bit of luck.

During his initial research, Geise found a lot of personal information on Stolhanske just by going through his Twitter and Facebook posts.

"It definitely required a lot of recon work," Geise said. "But to find that kind of information, you don't have to dig that deep."

Geise knew from social media that Stolhanske was a fan of the HBO series "Game of Thrones." He told the Amazon customer representative that he rarely used the account, and that his wife may have purchase a "Game of Thrones" book or DVD. It was an educated guess that turned out to be correct.

He was in.

Geise was allowed to change the email address and reset the password to the account.

"Once I had access to Erik's account, there were quite a few credit cards on there. It didn't show the full credit card number, but showed the last four digits," Geise said.

He points out that most of the times when are people asked to verify an account, they are asked for the last four digits of the card and a billing address. Armed with that information, Geise went down the line and accessed the rest of Stolhanske's accounts -- starting with AOL.

Geise was able to gain access to Stolhanske's AOL account over the phone, by providing just his billing address and last four digits of his credit card number.

Many people link accounts together, so breaching the right combination of accounts could lead to a jackpot for a cyber criminal. In Stolhanske's case, accessing the Amazon and AOL accounts opened the door for taking over his digital life. As it turns out, Stolhanske's AOL account was the email address used to reset his Apple account, which was also his main email address. After taking control of the Apple account, Geise was able to search Stolhanske's emails to find other accounts associated with the email address, and send requests to reset passwords.

If this all sounds familiar, it's because a similar case was reported last year, when a hacker gained access to Wired reporter Mat Honan's email, Twitter, Amazon and Apple accounts. Wired later reported that Amazon quietly closed the loophole that allowed a hacker to add a credit card to an account, but Geise says the only additional hurdle he faced was naming a recent purchase.

Amazon declined to comment on Geise's claims.

Geise says using two-factor authentication could stop the potential hacker in their tracks because it would also require access personal devices, like a smartphone. But it would not make the social engineering hack impossible to accomplish. Apple, Twitter and Facebook have added the additional security measure in the last year.

Sometimes it could just be negligence of old accounts that could be the weak link. In Stolhanske's case, it was the combination of being on social media, having old mailing addresses listed on his account and having a public Amazon wish list that caused a chain effect.

Geise suggests deleting old email accounts, adding complex passwords, using random email accounts for password recovery and making Amazon wish lists private.

http://www.ktva.com/home/outbound-xml-feeds/Amazon-wish-list-is-gateway-to-epic-social-engineering-hack-221326651.html?strypg=2

Internet security is a growing concern

NEW YORK (NBC News)-Turns out, trying to erase all that stuff about yourself that you've put on the internet over the years, is even harder than what you were told, but at least it's taught you to be more cautious going forward.

In the early days of social media, there was no hesitation with what we shared, with who we thought were only family and friends. But now we know others are watching.

"One in five people have had either their social media account or their email hijacked by a bad guy," said Bob Sullivan, author and online privacy expert. "So that means someone was able to impersonate them on Facebook or Twitter or send an email that looked like it was from them."

Privacy experts like Sullivan call what we've left behind on the internet, "digital breadcrumbs", that a new survey from the Pew Research Center shows, we're just now trying to trace.

Sullivan said, "Eighty-six percent say that they've tried to at least do something to clean up those digital bread crumbs."

Pew's research also shows people have lowered expectations of privacy while online, and also lowered the personal info they're posting.

"People are taking steps to protect their privacy but they don't know quite what they are doing and most of them feel pretty bad about all the information that's out there and don't really believe that they can protect themselves right now," said Sullivan.

A discouraging note from the survey, for online retailers: people want to hide personal info from not only hackers, but advertisers.

http://www.wwlp.com/news/massachusetts/internet-security-a-growing-concern

Is Your Spouse your Biggest Online Security Risk?

If your partner asked for your Facebook password, would you give it to them Chances are, you probably would. Better that than risk all the "what are you trying to hide from me" drama that would ensue, right?

Actually, an innocuous sharing of passwords--even with the person closest to you--could lead to major security breaches. With recent hacks on the New York Times and Washington Post Web Sites, you don't have to be in government or financial services to be at risk.

A third of organizations say employee negligence (a.k.a. the human factor) was to blame for security breaches, according to this study.

“Breaches related to spouses are a growing risk that people don’t realize,” says Hugh Thompson, senior vice president at global security firm, Blue Coat. “The possibilities for attacks just increase with the more data you share with your partner.”

Here are some common ways your spouse could pose a security risk:

1.)  You have different paranoia levels. People who work in security or finance are trained to be paranoid about which devices (and even which networks) they type passwords on. But that level of training is not automatically passed on to spouses. It’s surprisingly common for both partners to use the same passwords for work and personal use, says Thompson. This could give hackers access to your work passwords, if they can trick your spouse into revealing their password via a phishing attempt. Also, on shared ccounts like DropBox and Google Docs, your password security is entirely dependent on your partner’s habits.

How do you counter this? “Just because you share some passwords with your spouse, you don’t have to share all passwords with them,” says Markus Jakobsson, Principal Scientist of Consumer Securityat PayPal. The onus is on you to decide which passwords to share with your spouse, and ensure you have different (and difficult to guess) passwords for sensitive information.

2.)  Password reset questions could give you away. Not only are some passwords easy to crack (“password” is still a common one), but password reset questions are increasingly easy to find out, according to Thompson. One reset question could be your spouse’s maiden name. “Someone could get a 30-day free trial on ancestry.com and find that out,” he says.

The risks posed by “meta passwords” or password resets through security questions are significant, according to PayPal’s Jakobsson. Take time to think over which security questions are easy to find out – the city you were born in, for example, vs. information most likely to be known only by you. Meta passwords are also rarely changed if a couple splits up. “People will generally change shared passwords if they break up, but they forget to change the security question,” he says. PayPal is trying to counter this by researching whether posing security questions based on preferences would be more effective. “We’re finding most spouses will know if you love or hate something, but will probably not know your subtle preferences, like if you prefer pepperoni on your pizza,” he says.

3.) The rise of BYOD – or Bring Your Own Device to work. As more people use their mobile phones and personal laptops at work, private information could easily be shared if those same devices are used at home. This is especially the case on weekends or vacation, where one device is used by the whole family. The risks are so great, yet so simple. For example, the picture you take on your iPhone of whiteboard notes from a meeting at the office could be synced to your partner’s iPad at home, in a matter of seconds. “The malware one person downloads by accident could affect their spouse’s company in a significant way,” Thompson adds.

The best way to avoid this is by not letting your spouse download Apps or programs on your work devices, says PayPal’s Jakobsson. If a download is absolutely necessary, he suggests doing it on an iPad or Android device. “It’s not foolproof, but safer than downloading it on a laptop or desktop.”

4.) Your partner may not be your partner online. It’s becoming increasingly common for hackers to imitate spouses online – especially on instant messaging platforms. If your spouse has online presence through social media, blogs etc., their impersonator could easily “sound like them” right down to phrases they frequently use. “Never type out your social security numbers, credit card details, prescription or medical details on an online chat, even if you think it’s your partner on the other side. Spend 5 minutes on the phone to relay this type of information,” Thompson says. “Also, be aware when using technology – where does it back up? How long does it store information for?” Many chat platforms back up the logs of your conversation on two devices – yours, as well as your spouse’s, for months. That’s twice the risk.

 5.) Thanks to social media, your information is out there for all to see.  Social media makes it a breeze for anyone to figure out who you’re dating or married to. “Your spouse’s security hygiene is just as important as your own,” says Thompson. Company information is becoming easier to decipher through a partner’s social media. “Say your friend updates their Facebook status that they’re in Bentonville, Arkansas and tag their husband or wife, it’s easy to figure out their partner was doing business with Walmart. Even if the company employee wouldn’t update their own status, their partner’s update could compromise confidential company developments.”

The disparity between how each person thinks about security is a growing threat. One partner could have a log in password or remote wipe on their mobile phone, while another doesn’t. Your spouse could be logging on to a shared computer – say, at a hotel –  to access your joint bank accounts, while you wouldn’t even dream of using a shared desktop. When it comes to your personal and corporate security, it’s a team effort.

“People are the weakest link in this case,” adds Thompson.

http://www.forbes.com/sites/ruchikatulshyan/2013/08/23/is-your-spouse-your-biggest-online-security-risk/

Missouri Credit Union customer information leaked on website

COLUMBIA, Mo--Missouri Credit Union is informing all of its customers about a security breach after personal information was made public on its website.

On Aug 5, MCU discovered a file containing customer information was posted on its website. That file contained a list of customer names, addresses, Social Security numbers, account numbers, and MCU teller/call-in passwords.

The credit union says there were ten visits to the file's location in the "short time" it was accessible. MCU does not know if anyone actually looked at the information.

"On behalf of myself and everyone at MCU, I apologize to all members affected by this incident," said president Hal James in a statement to ABC 17 News. "Please be assured that we are working to enhance our security measures to prevent something like this from happening in the future."

MCU began notifying all of its on Aug 16 about the security issue. The company is arranging for AllClearID to protect the identity of each of its members for one year.

Any customer can contact MCU for additional information by calling 877-437-4006.

http://www.abc17news.com/news/missouri-credit-union-customer-information-leaked-on-website/-/18421100/21546504/-/pqlh8s/-/index.html

Lost flash drive compromises data for thousands of students

More than 20,000 students across 36 schools in the Boston Public School (BPS) system had their data compromised when the district's ID card vendor Plastic Card Systems lost a flash drive containing the information.

How many victims? 21,054 students.

What type of personal information? Names, schools, ages, grades, ID numbers, library card numbers and CharlieCard numbers (used on smartcards to pay for Massachusetts Bay Transportation Authority travel). ID photos for roughly 14,000 students also were included on the flash drive.

What happened?  Plastic Card Systems picked up the flash drive from a BPS location. The vendor reported later that day that the memory stick was missing.

What was the response? Plastic Card Systems reported the drive as missing on a Friday and the drive did not turn up after being searched for throughout the weekend. BPS is changing the design of their student ID cards. In addition it is invalidating affecting CharlieCard and library card numbers. Families of affected students received phone calls and were sent letters.

Details: Plastic Card Systems picked up the drive from a BPS location on Aug. 9 and lost it later that day. BPS high schools were affected, as well as some middle schools spanning grades 6 to 12. Elementary schools, K-8 schools and standalone middle schools were not affected. Students are expected to receive new ID badges on schedule at the beginning of the school year.

Quote: “It is important to emphasize the information on the drive is limited to what appears on ID badges – and this cannot be used to access student records,” said John McDonough, BPS interim superintendent.

“Plastic Card Systems deeply regrets the unfortunate accidental loss of the Boston Public Schools student data files, and we understand how families will be upset, as we are upset, by the situation,” said Plastic Card Systems President Don Axline. “We will make all efforts to help Boston Public Schools in addressing this situation and will assist in any way possible to quickly rectify the situation.”

http://www.scmagazine.com/lost-flash-drive-compromises-data-for-thousands-of-students/article/307298/#

High-tech toilet gets hacker warning; nothing is safe

A vulnerability in a toilet-control app leads to an unusual warning about potential bathroom hacking hijinks.

By: Amanda Kooser

Privacy has been big news lately after revelations of NSA activities hit hard. But apparently it's not just your phone calls and Internet activity you need to be concerned about. There could be hackers gunning for your toilet, too.

Security company Trustwave issued a warning about potential bathroom breaches of luxury Satis smart toilets from Lixil. The toilets can be controlled using an Android app, but the Bluetooth PIN is hard-coded to "0000." Just knowing that code number means the awesome power of the Satis could fall into evil hands. All a hacker would have to do is download the My Satis app, get in range, pair it to the toilet using the code, and flush away.

The Android app lets toilet aficionados trigger activities such as flushing and playing music. If a malicious hacker got in Bluetooth range and took control of your toilet, all sorts of havoc could ensue. You might have to listen to the combined sounds of Justin Bieber and constant flushing while you're trying to do your business.

"Attackers could cause the unit to unexpectedly open/close the lid, activate bidet or air-dry functions, causing discomfort or distress to user," Trustwave cautions. Trustwave made several attempts to contact Lixil for a response, but the company has not yet commented on the issue.

The bigger mystery here may be why someone would want a remote control to flush a toilet, but it could be handy for absent-minded toilet users or germaphobes who want to minimize contact with the porcelain throne. With a starting price of around $2,400, you will pay for the privilege.

The security issue is real, though it's hard not to snicker about it. Perhaps an app update will take care of this matter of national security. If you've already been impacted by this issue, then you can finally rest easy knowing your toilet isn't haunted. It's just been hacked.

http://news.cnet.com/8301-1009_3-57596704-83/high-tech-toilet-gets-hacker-warning-nothing-is-safe/

Hackers targeting US, South Korea are after military secrets, cybersecurity experts say

The hackers who knocked out tens of thousands of South Korean computers simultaneously this year are out to do far more than erase hard drives, cybersecurity firms say: They also are trying to steal South Korean and U.S. military secrets with a malicious set of codes they've been sending through the Internet for years.

The identities of the hackers, and the value of any information they have acquired, are not known to U.S. and South Korean researchers who have studied line after line of computer code. But they do not dispute South Korean claims that North Korea is responsible, and other experts say the links to military spying add fuel to Seoul's allegations.

Researchers at Santa Clara, California-based McAfee Labs said the malware was designed to find and upload information referring to U.S. forces in South Korea, joint exercises or even the word "secret."

McAfee said versions of the malware have infected many websites in an ongoing attack that it calls Operation Troy because the code is peppered with references to the ancient city. McAfee said that in 2009, malware was implanted into a social media website used by military personnel in South Korea.

"This goes deeper than anyone had understood to date, and it's not just attacks: It's military espionage," said Ryan Sherstobitoff, a senior threat researcher at McAfee who gave The Associated Press a report that the company is releasing later this week. He analyzed code samples shared by U.S. government partners and private customers.

McAfee found versions of the keyword-searching malware dating to 2009. A South Korean cybersecurity researcher, Simon Choi, found versions of the code as early as 2007, with keyword-searching capabilities added in 2008. It was made by the same people who have also launched prior cyberattacks in South Korea over the last several years, Choi said.

Versions of the code may still be trying to glean military secrets from infected computers. Sherstobitoff said the same coded fingerprints were found in an attack on June 25 - the anniversary of the start of the 1950-53 Korean War - in which websites for South Korea's president and prime minister were attacked. A day later the Pentagon said it was investigating reports that personal information about thousands of U.S. troops in South Korea had been posted online.

Sherstobitoff began his investigation after the March 20 cyberattack, known as the Dark Seoul Incident. It wiped clean tens of thousands of hard drives, including those belonging to three television networks and three banks in South Korea, disabling ATMs and other bank services. South Korea says no military computers were affected by Dark Seoul.

The code used in the shutdown is different from that used to hunt for military secrets, but they share so many characteristics that Sherstobitoff and Choi believe they were made by the same people.

Sherstobitoff said those responsible for the spying had infected computers by "spear phishing" - targeted attacks that trick users into giving up sensitive information by posing as a trusted entity. The hackers hijacked about a dozen obscure Korean-language religious, social and shopping websites to make it easier to pull secrets from infected computers without being detected.

The McAfee expert said the hackers have targeted government networks with military information for at least four years, using code that automatically searched infected computers for dozens of military terms in Korean, including "U.S. Army," ''secret," ''Joint Chiefs of Staff" and "Operation Key Resolve," an annual military exercise held by U.S. Forces Korea and the South Korean military.

The report does not identify the government networks that were targeted, but it does mention that in 2009, the code was used to infect a social media site used by military personnel living in South Korea. McAfee did not name the military social media site, nor release what language it is in, at the request of U.S. authorities who cited security issues. South Korea has a military force of 639,000 people, and the U.S. has 28,500 military personnel based in the country.

McAfee also said it listed only some of the keywords the malware searched for in its report. It said it withheld many other keywords that indicated the targeting of classified material, at the request of U.S. officials, due to the sensitivity of releasing specific names and programs.

"These included names of individuals, base locations, weapons systems and assets," said Sherstobitoff.

Choi, who works for a South Korean cybersecurity company, has made similar discoveries through IssueMakersLab, a research group he and other "white-hat" hackers created.

Results of a report Choi produced were published in April by Boan News, a Seoul-based website focused on South Korean security issues, but they did not get broad attention. That report included many search terms not included in the McAfee report, including the English-language equivalents of Korean keywords.

Both McAfee and IssueMakersLab found that any documents, reports and even PowerPoint files with military keywords on infected computers would have been copied and sent back to the attackers.

The attackers are also able to erase hard drives en masse by uploading malware and sending remote-control commands, which is what happened March 20.

Before that attack, hackers had been sending spy malware on domestic networks for months, giving them the ability to gather information about how their internal servers work, what websites the users visit and which computers are responsible for security, the researchers found. This information would have been crucial for planning the coordinated attacks on banks and TV networks.

Anti-virus software and safe practices such as avoiding links and attachments on suspicious emails can prevent computers from getting infected, but the March attack shows how difficult this can be to accomplish on a broad scale. Ironically, some of the malicious codes used were disguised as an anti-virus product from Ahnlab Inc., South Korea's largest anti-virus maker, said McAfee.

McAfee said it shared its findings with U.S. authorities in Seoul who are in close collaboration with South Korean military authorities.

Tim Junio, who studies cyberattacks at Stanford University's Center for International Security and Cooperation, said the McAfee report provides "pretty compelling evidence that North Korea is responsible" for the attacks in the South by tying the series of hacks to a single source, and by showing that users of a military social media site were targeted.

There are clues in the code as well. For example, a password, used again and again over the years to unlock encrypted files, had the number 38 in it, a politically loaded figure for two countries divided on the 38th parallel, security experts said.

Pentagon spokesman Army Lt. Col. James Gregory said the Defense Department is aware of the study and looks forward to reviewing it.

"The Defense Department takes the threat of cyber espionage and cyber security very seriously, which is why we have taken steps to increase funding to strengthen capabilities and harden networks to mitigate against the risk of cyber espionage," he said.

South Korea's Defense Ministry says its secrets are safe. Ministry spokesman Kim Min-seok said officials were unaware of McAfee's study, but added that it's technically impossible to have lost classified reports because computers with military intelligence are not connected to the Internet. When accessing the Web, military officials use different computers disconnected from the internal military server, he said.

A hack of sensitive South Korean military computers from the Internet "cannot be done," Kim said. "It's physically separated."

Sherstobitoff, however, said it can be done, though he's not sure that it has been.

"While it is not entirely impossible to extract information from a closed network that is disconnected from the Internet, it would require some extensive planning and understanding of the internal layout to stage such an exfiltration to the external world," he said.

Kwon Seok-chul, chief executive officer of Seoul-based cyber security firm Cuvepia Inc., said recent hacking incidents suggest that hackers may have enough skills to infiltrate into the internal servers of Korean and U.S. military. Even if two networks are separated, he said, hackers will do anything to find some point where they converge.

"It takes time, but if you find the connection, you can still get into the internal server," Kwon said.

FBI Assistant Director Richard McFeely would not comment on McAfee's findings, but said in a written statement that "such reports often give the FBI a better understanding of the evolving cyber threat."

Neither the McAfee nor the IssueMakersLab reports suggest who is responsible for the cyberattacks, but many security experts believe North Korea is the likely culprit.

South Korean authorities have blamed the North for many cyberattacks on its government and military websites and have said they linked the March 20 attacks to at least six computers located in North Korea that were used to distribute malicious codes.

Several calling cards were left behind after the March attack, taunting victims. Two different and previously unknown groups separately took credit: The "Whois Hacking Team" posted pictures of skulls and a warning, while the "NewRomanic Cyber Army Team" said it had leaked private information from banks and media organizations.

"Hi, Dear Friends," began one such note. "We now have a great deal of personal information in our hands."

But McAfee says that claim, and others - including tweets and online rumors claiming credit for prior attacks - were meant to mislead the public and investigators, covering up the deeper spying program.

James Lewis, a senior fellow at the Center for Strategic and International Studies, said the attack is far more skillful and took place over a much longer period than was previously thought.

"I used to joke that it's hard for the North Koreans to have a cyber army because they don't have electricity, but it looks as if the regime has been investing heavily in this," said Lewis. "Clearly this was part of a larger effort to acquire strategic military information and to influence South Korean politics."

North Korean leader Kim Jong Un has made computer use and the importance of developing the IT sector hallmarks of his reign, devoting significant state resources toward science and technology. Though much of the country lacks steady electricity, a massive hydroelectric power station keeps the capital - and state computer centers - humming.

North Korean officials insist the emphasis on cyberwarfare is on protecting North Korea from cyberattacks, not waging them, but there is widespread suspicion that resources are also being poured into training scores of cyberwarriors as well.

Relatively few North Koreans are allowed to access the Internet - especially when compared to the South's hyper-wired society - but it too has seen its computer systems paralyzed by cyberattacks. Pyongyang blames the U.S. and South Korea and has warned of "merciless retaliation."

http://www.cbsnews.com/8301-202_162-57592604/hackers-targeting-u.s-south-korea-are-after-military-secrets-cybersecurity-experts-say/?pageNum=2