Security researcher claims good intentions in hacking Apple Dev Center

Apple has finally explained why its Dev Center has been mysteriously shut down since last Thursday: An intruder broke in to the company's developer site in an attempt to steal registered developers' personal information. While Apple says it's in the process of "completely overhauling" its developer systems, updating its server software, and rebuilding its entire database, a Turkish security researcher named Ibrahim Balic has emerged claiming credit for the successful hack -- and claiming he had only the best white-hat intentions.

Balic's tale is reminiscent of other security researchers who claim to have breached a third party's systems or software for the greater good. Whether Apple or affected developers will share his view that he was acting in their best interests (as well as Apple's) remains to be seen; for the time being, it's not crystal clear what went down.

Apple's take on the breach goes like this:

Last Thursday, an intruder attempted to secure personal information of our registered developers from our developer website. Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers' names, mailing addresses, and/or email addresses may have been accessed.... In order to prevent a security threat like this from happening again, we're completely overhauling our developer systems, updating our server software, and rebuilding our entire database.

Apple has since told TechCrunch that only developer accounts and not iTunes accounts were compromised and no credit card data was stolen. Developers, however, have reported receiving unsolicited password reset requests.

Since Apple revealed the breach, Balic has come forward to claim credit for discovering the vulnerability in the Dev Center site as well as 12 other bugs. He has also posted a video on YouTube (which at time of writing has been set to private), showing he had in his possession developer credentials extracted from Apple's developer database. However, he claims that his intention all along has been to light a fire under Apple's bottom to fix the bugs before a malicious hacker exploited them.

Balic posted his confession to the Comments section of TechCrunch. Following are some excerpts (with spelling and grammar corrected for clarity):

My name is Ibrahim Balic, I am a security researcher. You can also search my name [on] Facebook's Whitehat List. I do private consulting for particular firms. Recently I have started doing research on Apple....

In total I have found 13 bugs and have reported through http://bugreport.apple.com. I gave details to Apple as much as I [could], and I've also added screenshots. One of those bugs has provided me access to users details. I immediately reported this to Apple. I have taken 73 users details (all Apple workers only) and [provided] them as an example. Four hours [after] my final report, [the] Apple developer portal [was] closed down.

Balic claimed that Apple never responded to his reports but has since learned that the company has contacted law enforcement to investigate: "I'm not feeling very happy with what I read and [I am] a bit irritated, as I did not [do] this research to harm or damage," he said. "I didn't attempt to publish or have not shared this situation with anybody else. My aim was to report bugs and collect the data for the [purpose] of seeing how deep I can go within this scope.

"I do not want my name to be in blacklist," he concluded. I'm keeping all the evidences, emails, and images; also I have the records of bugs that I made through Apple bug report."

Balic appears to have lost sympathy from some observers for two reasons: First, he posted the aforementioned video to the public -- and neglected to redact the names and email addresses he'd collected. (I had a chance to view the video before Balic changed the privacy setting on YouTube.)

Second, Balic claimed in the same admission that he took only 73 users' details and has "100,000-plus user details." That's an obvious contradiction, though whether Balic took 73 users' details or 100,000, Apple developers should be rightly concerned. The Dev Center clearly has been breached by at least one third party, and Apple is worried enough to have shut down the Dev Center for days to pour time and resources into rebuilding the database and overhauling the site.

Developers also may not find much comfort in Apple's assurances that "sensitive personal information was encrypted and cannot be accessed." If cyber criminals have gotten their hands on developers' contact info, they're a step away from getting their hands on associated password information, either via cracking or spear-phishing. The last thing a developer wants is to have a bad guy take control of his or her developer account and attempt to propagate malware in his or her name.

For the time being, we don't know Balic's true intentions. We don't know someone other than Balic knew about the vulnerability that enabled him to make off with either 73 or 100,000-plus developers' data. What's clear, though, is that if you're an Apple Developer, you need to be mindful that your account may have been breached and to take necessary precautions to change your password as soon as possible.

This story, "Security researcher claims good intentions in hacking Apple Dev Center," was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

View the original article here

SIM cards vulnerable to hacking, says researcher

Millions of mobile phones may be vulnerable to spying due to the use of outdated, 1970s-era cryptography, according to new research due to be presented at the Black Hat security conference.

Karsten Nohl, an expert cryptographer with Security Research Labs, has found a way to trick mobile phones into granting access to the device's location and SMS functions and allow changes to a person's voicemail number.

[ Security expert Roger A. Grimes offers a guided tour of the latest threats and explains what you can do to stop them in "Fight Today's Malware," InfoWorld's Shop Talk video. | Keep up with key security issues with InfoWorld's Security Adviser blog and Security Central newsletter. ]

Nohl's research looked at a mobile phones' SIM (Subscriber Identification Module), the small card inserted into a device that ties it to a phone number and authenticates software updates and commands sent over the air from an operator.

More than 7 billion SIM cards are in use worldwide. To ensure privacy and security, SIM cards use encryption when communicating with an operator, but the encryption standards use vary widely.

A mobile communication trade group, the GSM Association, said in a statement that only a "minority" of SIM cards that use older encryption standards would appear to be vulnerable.

"There is no evidence to suggest that today's more secure SIMs, which are used to support a range of advanced services, will be affected," GSMA said.

Nohl's research found that many SIMs use a weak encryption standard dating from the 1970s called DES (Data Encryption Standard), according to a preview posted on his company's blog.

DES has long been considered a weak form of encryption, and many mobile operators have upgraded now to more secure forms. It is relatively easy to discover the private key used to sign content encrypted with DES.

In its experiment, Security Research Labs sent a binary code over SMS to a device using a SIM with DES. Since the binary code wasn't properly cryptographically signed, it would not run on the device.

But while rejecting the code, the phone's SIM makes a crucial mistake: it sends back over SMS an error code that carries its own encrypted 56-bit private key, according to the company. Because DES is considered a very weak form of encryption, it's possible to decrypt the private key using known cracking techniques.

Security Research Labs did it in about two minutes on a regular computer with the help of a rainbow table, a mathematical chart that helps convert an encrypted private key or password hash into its original form faster.

With the private DES key in hand, it is then possible to "sign" malicious software updates with the key, and send those updates to the device. The device believes the software comes from a legitimate source and then grants access to sensitive data.

GSMA said that it has not seen the full details of Nohl's research, but that use of the DES algorithm has been "discontinued in over the air (OTA) standards for several years."

Security Research Labs outlined an attack scenario against SIM cards that run some form of Java virtual machine, a software framework for Java applications.

Using the SIM's private key, an attacker could force the SIM to download Java applets, which are essentially very small programs that perform some function. Those applets would be "allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions."

"These capabilities alone provide plenty of potential for abuse," the company wrote.

Possible remedies to the problem including ensuring SIM cards use state-of-the-art cryptography and also using Java virtual machines that restrict applets' access to certain information.

GSMA said it has already provided guidance to network operators and SIM vendors that might be affected by Nohl's findings.

Nohl's presentation, "Rooting SIM cards," will take place at the Black Hat security conference in Las Vegas on July 31.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

View the original article here