Attackers Sony used password system

The attackers knew the network from Sony to break used the stolen password of an administrator, so claim US researchers on the basis of evidence found via the password the attackers had access to the entire Sony network.

The discovery is one of the reasons why the researchers think that the attack on Sony's done with the help of an employee, so let officers across CNN know. The US authorities have now declared the attack a matter of national security. According to CNN, Washington will be today North Korea blame designate behind the attack.

Security expert Jeffrey Carr argues that the US should provide evidence first before it can be assumed that North Korea is actually behind the attack. He himself has serious doubts about this. "My advice to journalists, managers, policy makers and the public to doubt everything you hear on the granting of cyber attacks. There is no concrete evidence and possible indicators that can not be verified."

Even Kim Zetter of Wired published an article why the evidence against North Korea is thin. The film would also "The Interview" have been no reason for the attack. The film was the first announcement is not mentioned by the attackers. The fact that the malware on a computer with a Korean language is compiled does not say anything. Setter outlines two scenarios then who is behind the attack. Possibly it is a group of people who, like Anonymous operate, or there were several groups with different motives that had access to the Sony network.

FBI used Metasploit to identify Tor users

The FBI has used a component of the popular Metasploit hacking tool to identify Tor users. Metasploit is a tool that penetration testers and security experts test the safety of systems and networks. It is now being developed and managed by security company Rapid7.

Wired reports that the FBI in 2012 set in part of Metasploit to successfully identify different Tor users through Adobe Flash Player. The US investigation department made ​​use of an abandoned Metasploit project called " Decloaking Engine ". It was one in 2006 developed experimental concept where multiple tricks were used to identify users of a service such as Tor anonymity via a specially crafted Web site. In case the Tor user had his installation secure he could not be identified through the website. However, if users made ​​a mistake their real IP address is visible.

Flash Player

One of the tricks was the use of a Flash application. Adobe Flash Player can set up a direct connection to the Internet and thus leak the IP address of the user. A known problem and the Tor Project advises users therefore not to install Flash Player. Finally appeared in 2011, a version of the Tor Browser, the software to access the Tor network, allowing users were better protected and the test site that was set up for the Decloacking Engine almost no users identified more.

However, the FBI used Decloaking Engine as a basis for an operation against child pornography sites on the Tor network. The investigation department had access to several of these sites and then let them run Flash programs in visitors' browsers in order to determine their true IP address. A total of 25 users in the United States were identified and an unknown number elsewhere. According to Wired is to use the first time the FBI spyware-like software to all visitors of a website started in place against certain individuals.

Identification

However, it is unknown whether the FBI standard Decloaking Engine has used or a customized version. HD Moore, the original developer of Metasploit and Decloaking Engine, argues that his release could barely identify Tor users. Only suspects with very old Tor version or who had gone to great lengths to install Flash Player would have been at risk.

In this way, the FBI would only have to suspects with the worst operational security-oriented instead of the worst offenders. A few months later, the FBI provided the weather on Tor users. Then there was an exploit for a known Firefox vulnerability used to determine the IP address and MAC address of Tor users. Again it came to users with poor operational security, as it attacked Firefox leak was already in the latest version of Tor Browser solved .