Tag Archives: spoofing

Fooling Samsung Galaxy S8 Iris Recognition

Posted on by

We have a love-hate relationship with biometric ID. After all, it looks so cool when the hero in a sci-fi movie enters the restricted-access area after having his hand and iris scanned. But that’s about the best you can say about biometric security. It’s conceptually flawed in a bunch of ways, and nearly every implementation we’ve seen gets broken sooner or later.

Case in point: prolific anti-biometry hacker [starbug] and a group of friends at the Berlin CCC are able to authenticate to the “Samsung Pay” payment system through the iris scanner. The video, embedded below, shows you how: take …read more

Continue reading Fooling Samsung Galaxy S8 Iris Recognition→

I just received a phishing text message, how could this have worked?

Posted on by

I received a phishing text message that pretended to be my bank. It had a link that went to a site that redirect to the following script:

<html><script language="javascript">var page = "Login.php?sslchannel=true&sessionid=XXX”; top.location = page; </script></html>

When I did a wget on that page with the rest of the full url it ran the following script:

<script>
    window.googleJavaScriptRedirect = 1
</script>
<script>
    var n = {
        navigateTo: function(b, a, d) {
            if (b != a && b.google) {
                if (b.google.r) {
                    b.google.r = 0;
                    b.location.href = d;
                    a.location.replace("about:blank");
                }
            } else {
                a.location.replace(d);
            }
        }
    };
    n.navigateTo(window.parent, window, "https://www.banksite.com/");
</script><noscript><META http-equiv="refresh" content="0;URL='https://www.banksite.com/'"></noscript>

From a technical perspective, I’m trying to figure out what this phishing text could have done in the worst case scenario.

Continue reading I just received a phishing text message, how could this have worked?→

Which attributes of a WPA AP certificate are used by a client device in deciding if the certificate has been trusted before?

Posted on by

When connecting to a new AP, the client device will pop a warning to ask if the certificate of the new AP should be trusted. If trusted, the warning doesn’t show anymore if the certificate is known to have been trusted before… Continue reading Which attributes of a WPA AP certificate are used by a client device in deciding if the certificate has been trusted before?→

Russia-linked hackers impersonate NATO in attempt to hack Romanian government

Posted on by

An elite hacking group linked to the Russian government masqueraded as a NATO representative to send a barrage of phishing emails to diplomatic organizations in Europe, including Romania’s Foreign Ministry of Affairs, documents show. CyberScoop obtained a copy of one such phishing email that researchers have attributed to the hacking group, which is known as APT28 or Fancy Bear. The email, which carries a booby-trapped attachment that leverages two recently disclosed Microsoft Word vulnerabilities, shows that the government-backed hacking group effectively spoofed a NATO email address to make the message appear authentic. The hq.nato.intl domain is currently used by NATO employees. The file has already been submitted to Virus Total, a publicly maintained library of computer viruses. Typically files don’t appear on the site unless they have been found in the wild. An analyst from cybersecurity firm FireEye confirmed the phishing email pictured above is in fact authentic and related to APT28 activity. […]

The post Russia-linked hackers impersonate NATO in attempt to hack Romanian government appeared first on Cyberscoop.

Continue reading Russia-linked hackers impersonate NATO in attempt to hack Romanian government→

DHS watchdog’s fraud hotline spoofed in ID theft scam

Posted on by

The inspector general’s office in the Department of Homeland Security is warning that identity thieves and fraudsters are spoofing caller ID systems to make it look as if victims are being called from the IG’s anonymous tipline. “The perpetrators of the scam represent themselves as employees with ‘U.S. Immigration,’” the office states in a press release circulated Wednesday, and “demand to obtain or verify personally identifiable information from their victims through various tactics, including by telling individuals that they are the victims of identity theft.” “Many of the scammers reportedly have pronounced accents,” states the press release. The office said it wanted to remind the public that it “never uses its hotline number to make outgoing calls — the phone line is only used to receive information from the public.” The hotline remains “perfectly safe” for reporting “fraud, waste, abuse, or mismanagement within DHS components or programs,” the statement concludes. The office […]

The post DHS watchdog’s fraud hotline spoofed in ID theft scam appeared first on Cyberscoop.

Continue reading DHS watchdog’s fraud hotline spoofed in ID theft scam→

DHS watchdog’s fraud hotline spoofed in ID theft scam

Posted on by

The inspector general’s office in the Department of Homeland Security is warning that identity thieves and fraudsters are spoofing caller ID systems to make it look as if victims are being called from the IG’s anonymous tipline. “The perpetrators of the scam represent themselves as employees with ‘U.S. Immigration,’” the office states in a press release circulated Wednesday, and “demand to obtain or verify personally identifiable information from their victims through various tactics, including by telling individuals that they are the victims of identity theft.” “Many of the scammers reportedly have pronounced accents,” states the press release. The office said it wanted to remind the public that it “never uses its hotline number to make outgoing calls — the phone line is only used to receive information from the public.” The hotline remains “perfectly safe” for reporting “fraud, waste, abuse, or mismanagement within DHS components or programs,” the statement concludes. The office […]

The post DHS watchdog’s fraud hotline spoofed in ID theft scam appeared first on Cyberscoop.

Continue reading DHS watchdog’s fraud hotline spoofed in ID theft scam→