More Dangerous Certificates On Dell Computers Discovered

On Dell computers appear to present certificates are more dangerous than just eDellRoot root certificate which since yesterday is to warn and allowing users to be attacked. Reported that the security firm Duo Security on the basis of its own research.

Dell turns since August computers to install the same root certificate called eDellRoot, including associated private key.Something that, according to researchers at Duo Security is a pretty big mistake. " Using the certificate can be man-in-the-middle attacks against users are executed and it is for example possible to install malware or encrypted connections to eavesdrop. In addition, there appears to be a second eDellRoot certificate. The second license was found on 24 IP addresses. Which models are exactly is unknown.

"It suggests that Dell is deliberately identical keys in other models. This is a blatant disregard for basic cryptographic security," said the researchers. One of the systems used was accessible via the internet and certificate to offer Web services over HTTPS was a SCADA system. Such systems are used, among other vital infrastructure.

Finally an Atheros Authenticode certificate was also detected for the signing software. The password of the certificate was cracked within six hours. However, the certificate was found to have expired already, which restricts the possibility for abuse. However, it seems that the certificate was in use at the time that it was still valid.

Manufacturers Do Not Learn

According to the researchers, the discovery reveals a disturbing trend among manufacturers. Adding Trusted Certificates to a system, and especially root certificates can expose users to unnecessary risks. "Unfortunately it appears that manufacturers do not learn from past mistakes and keep them to keep repeating," the conclusion of the research (pdf). Dell has now indicated that it eDellRoot certificate via an update will be removed.

Expert: Adjusting Default Port VNC Or SSH Bad Idea

System administrators or users to change the default port of VNC, SSH or other protocols or services are not sensible and engaged only create a false sense of security. That allows John Matherly, founder of the search engine Shodan. This search engine is designed to find all kinds of systems on the Internet, such as routers, modems, webcams, SCADA systems and other equipment.

Also all kinds of services can be found via Shodan. Matherly decided to investigate how many Virtual Network Computing (VNC) without authentication. Via VNC, it is possible to operate a system remotely. In case there is no authentication is set to have an attacker only the IP address of the system to know to connect to it and access. Matherly discovered 8,000 VNC installations without a password could be used to log on. What struck me was that in about half of these installations, the default port was changed.

Standard VNC running on port 5900, but nearly 4000 system was the port number changed to 5901. "I think a lot of people to change the default port with the idea that if their service is hidden," notes Matherly on. However, this behavior not only plays with VNC installations. Also with SSH, a protocol to remotely control computers, this happens often. Please choose people often slightly different numbers, but according Matherly people are not really good at coming up with random numbers.

In the industrial sector customizing port numbers also occurs. Use as many factories and production Modbus industrial control system. Standard Modbus runs on port 502, but there are also hundreds of installations on the Internet listening on port 503. There are, however, to find all kinds of tools and scanners that these custom port numbers can still be found.According to Matherly is therefore to change the port number, nothing more than a palliative and it only gives a false sense of security.

NATO Organizes Major Cyber Exercise In Estonia

400 computer experts will this week in Estonia to participate in a major NATO cyber exercise, where an attack is simulated on a fictional country. A total of sixteen teams from countries for Locked Shields 2015 registered as the exercise is called.

Locked Shields is an annual simulation held since 2010 in the cyber defense center of NATO in Tallinn. The organizers announced that this year, in addition to SCADA systems including Windows 8, a test version of Windows 10, Android devices and IP cameras are part of the exercise, as well as an "element of active defense".

"Locked Shields prepares computer emergency response specialists for continuously evolving cyber security landscape. Unique about this is that we are realistic technologies, use networks and methods of attack," said Colonel Artur Suzik, director of the NATO Cooperative Cyber ​​Defense Center of Excellence. "In order to ensure that the exercise is flush with real developments will be there every year new technologies and added attack vectors."