Heartbleed hackers hit Mumsnet

14 April 2014 Last updated at 19:12 By Leo Kelion Technology desk editor The BBC's Rory Cellan-Jones explains what users should do next

A leading UK site for parents and the Canadian tax authority have both announced they have had data stolen by hackers exploiting the Heartbleed bug.

Mumsnet - which says it has 1.5 million registered members - said that it believed that the cyber thieves may have obtained passwords and personal messages before it patched its site.

The Canada Revenue Agency said that 900 people's social insurance numbers had been stolen.

These are the first confirmed losses.

The Mumsnet site's founder Justine Roberts told the BBC that it became apparent that user data was at risk when her own username and password were used to post a message online.

She said the hackers then informed Mumsnet's administrators that the attack was linked to the Heartbleed flaw and told them the company's data was not safe.

"On Friday 11 April, it became apparent that what is widely known as the Heartbleed bug had been used to access data from Mumsnet users' accounts," the London-based website added in an email to its members.

"We have no way of knowing which Mumsnetters were affected by this.

"The worst case scenario is that the data of every Mumsnet user account was accessed.

"It is possible that this information could then have been used to log in as you and give access to your posting history, your personal messages and your personal profile, although we should say that we have seen no evidence of anyone's account being used for anything other than to flag up the security breach, thus far."

Mumsnet is making all of its members reset its passwords

The site added that it was forcing its members to reset any password created on or before Saturday.

Canada's tax agency was one of the first major organisations to cut services as a result of the flaw in OpenSSL - a cryptographic software library used by services to keep data transmissions private.

However, its action last Tuesday appears to have come too late.

"Regrettably, the CRA has been notified by the Government of Canada's lead security agencies of a malicious breach of taxpayer data that occurred over a six-hour period," the agency said on a message posted to its homepage.

"Based on our analysis to date, social insurance numbers (Sin) of approximately 900 taxpayers were removed from CRA systems by someone exploiting the Heartbleed vulnerability."

"We are currently going through the painstaking process of analysing other fragments of data, some that may relate to businesses, that were also removed."

The Canadian tax agency published a statement about the attack on its website Heartbleed flaw

The Heartbleed bug was made public a week ago by Google and Codenomicon, a small Finnish security firm, which independently identified the problem.

OpenSSL is used to digitally scramble data as it passes between a user's device and an online service in order to prevent others eavesdropping on the information.

It is used by many, but not all, sites that show a little padlock and use a web address beginning "https".

The researchers discovered that because of a coding mishap hackers could theoretically access 64 kilobytes of unencrypted data from the working memory of systems using vulnerable versions of OpenSSL.

Although that is a relatively small amount, the attackers can repeat the process to increase their haul.

'Dangerous' advice

Mumsnet has been criticised for one aspect of its handling of the breach - its email to members contains an inline link that it suggests they click to reset their passwords.

The Heartbleed bug allows hackers to steal small chunks of data from a vulnerable system's memory

However, UK police had previously warned members of the public to beware of unsolicited email asking them to click links "even if they are from companies you are familiar with".

This is because fraudsters are taking advantage of Heartbleed to mount phishing attacks in which users are directed to spoof sites designed to steal their credentials.

"It is dangerous," Dr Steven Murdoch, a computer security researcher at the University of Cambridge told the BBC.

"Probably what [Mumsnet] should have done is sent out an email saying 'go to our website using the normal address [to reset the password]'.

"If people receive an email they have not asked for they should be suspicious."

By contrast Canada's tax agency said it would not call or email the individuals it believed to be affected by its breach in order to avoid giving criminals a chance to exploit the situation.

Instead it said it would send out registered letters.

"I believe we'll see many more of these announcements over the coming days," Keith Bird, UK managing director of internet security firm Check Point said.

"However, people should double-check that the website or service they use is actually advising them to choose a new password before making any changes to their settings.

"This way, they can be sure the website has updated its security, and that they're not running the risk of exposing a new password. And if a service does recommend changing passwords, don't choose one that you already use for other websites."

View the original article here

VIDEO: Heartbleed hackers hit Mumsnet

A leading UK site for parents and the Canadian tax authority have both announced they have had data stolen by hackers exploiting the Heartbleed bug.

Mumsnet, which says it has 1.5 million registered members, said that it believed that the cyber thieves may have obtained passwords and personal messages before it patched its site.

The Canada Revenue Agency said that 900 people's social insurance numbers had been stolen.

Rory Cellan-Jones reports.

View the original article here

Hackers crack open mobile network

31 December 2010 Last updated at 10:49 Security researchers have shown how to eavesdrop on any GSM call Mobile calls and texts made on any GSM network can be eavesdropped upon using four cheap phones and open source software, say security researchers.

Karsten Nohl and Sylvain Munaut demonstrated their eavesdropping toolkit at the Chaos Computer Club Congress (CCC) in Berlin.

The work builds on earlier research that has found holes in many parts of the most widely used mobile technology.

The pair spent a year putting together the parts of the eavesdropping toolkit.

"Now there's a path from your telephone number to me finding you and listening to your calls," Mr Nohl told BBC News. "The whole way."

He said many of the pieces in the eavesdropping toolkit already existed thanks to work by other security researchers but there was one part the pair had to create themselves.

"The one piece that completed the chain was the ability to record data off the air," he said.

In a demonstration at the CCC, the pair took attendees through all the steps that led from locating a particular phone to seizing its unique ID, then leap-frogging from that to getting hold of data swapped between a handset and a base station as calls are made and texts sent.

Key to grabbing the data from the air were cheap Motorola phones which can have their onboard software swapped for an open source alternative.

"We used the cheap Motorola telephones because a description of their firmware leaked to the internet," he said.

This led to the creation of open source alternative firmware that, he said, has its "filters" removed so it could see all the data being broadcast by a base station.

The eavesdropping work builds on earlier work to list GSM encryption keys

This allows attackers to home in on the data they need to eavesdrop, said Mr Nohl. The encryption system that scrambles this data can be defeated using a huge list of encryption keys, called a rainbow table, that Mr Nohl generated in a separate research project.

"Any GSM call is fair game," he said.

GSM is the name of the technology used on the vast majority of mobile phone networks around the world. The GSMA, which represents operators and phone makers, estimates that there are more than five billion GSM mobiles in use around the world.

The GSMA has not responded to requests for comment about the research.

Playing around

Simeon Coney, a spokesman for mobile security firm Adaptive Mobile, said the work looked fairly thorough.

"Especially interesting is how the attack is aimed at a specific target phone, which could lead to malicious interest of high value targets," he added.

"This isn't an attack that is today readily repeatable yet by the anyone unfamiliar with the underlying technology," he said. "However, it does illustrate the manners in which the mobile phone system could be compromised in a focussed attack in less protected markets."

Mr Nohl said that before now commercial equipment that could spy on calls cost upwards of £35,000. The kit demonstrated at the Berlin event cost far less than that, he said. For instance, the Motorola phones used to grab data cost only 10 euros (£9) each.

Despite showing off the entire eavesdropping kit, there were no plans to release all of it for others to use, said Mr Nohl.

However, recreating the missing parts would not be difficult for a tech savvy amateur, he added.

"I expect people to do it for the fun of doing it."

Mr Nohl said the motivation for carrying out the research was to create awareness around the problem and perhaps prompt operators to improve security.

A few simple steps could make it much harder for eavesdroppers, he said.

"Raising their awareness is the most likely outcome, but the technical changes would be better."

View the original article here