Malicious user hides trojan links in cloned Steam Greenlight pages

Malware links briefly appear in fan-voting section despite $100 submission fee.

By Kyle Orland

Steam

A malicious user exploited the somewhat open submission structure of Steam's Greenlight section over the weekend to briefly hide malware links in cloned versions of legitimate game pages.

Polygon reports that a Steam user going by the handle bluebunny14 posted copies of pages for five games to the Steam's Greenlight section over the weekend. The cloned pages copied the text, screenshots, and videos of existing Greenlight games, including Melancholy Republic and The Maze, to look exactly like legitimate titles seeking attention in Steam's fan-voting area. But the cloned versions of the pages also included links to purported "beta version" links for the games that instead linked users to what Polygon calls "a known Trojan."

After being posted Sunday, the malicious links were reportedly removed by early Monday, and the cloned game pages themselves reportedly removed by Monday afternoon. "Community members alerted us of the situation over the weekend by flagging the content," said Valve's Doug Lombardi in a statement. "Our Community Moderators responded quickly by removing all malicious links from the fake Greenlight material and then we banned the submissions. We are taking further steps to deal with anyone involved in posting the links. We'd like to thank those who reported the issue in addition to our Community Moderators, and we encourage everyone to report any suspicious activity in the future by using the flag icon located throughout the Steam Community."

Steam Greenlight launched in the summer of 2012 as a clearinghouse allowing the community to vote on game concepts and in-progress projects it would like to see offered for sale on Steam. But the section was quickly flooded with spam submissions for fake and offensive listings, and misleadingly sourced clones of copyrighted and trademarked games.

Is Valve locking out poorer developers or just imposing order?

 

To "cut down on the noise" of these fraudulent submissions, Valve instituted a one-time, $100 fee for Greenlight developers in September of 2012. "It was obvious after the first weekend that we needed to make some changes to eliminate pranksters while giving folks in the community the ability to focus on 'their kind' of games," Valve UI designer Alden Kroll told Ars at the time. While that fee apparently didn't stop bluebunny14's malicious submissions over the weekend, it will likely slow down the same user from continuing to post more malicious links under different accounts.
Open app marketplaces, like those on many smartphone platforms, are often plagued with fake listings purporting to be popular games and software, sometimes hiding malware behind the legitimate-seeming facade. Since its launch in 2003, though, Steam has cultivated a reputation as a more carefully curated marketplace of the best of the PC gaming marketplace, without risk of viruses or other malware.

Steam's curated image has been diluted somewhat in recent years, though, as the number of games available on the service has skyrocketed, doubling in the last 18 months to encompass over 4,000 distinct titles. Over 3,200 submissions have garnered enough user votes to be officially "greenlit" by Valve in the last two years, and over 570 of those games have been officially released on Steam.

NSA hiding Equation spy program on hard drives

By JOSEPH MENN

Equation infection: Kaspersky Labs says the highest number of machines infected with Equation programs were in Iran, Russia and Pakistan.

The US National Security Agency has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba and other top manufacturers, giving the agency the means to eavesdrop on the majority of the world's computers, according to cyber researchers and former operatives.

That long-sought and closely guarded ability was part of a cluster of spying programs discovered by Kaspersky Lab, the Moscow-based security software maker that has exposed a series of Western cyber-espionage operations.

Kaspersky said it found personal computers in 30 countries infected with one or more of the spying programs, with the most infections seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria. The targets included government and military institutions, telecommunication companies, banks, energy companies, nuclear researchers, media, and Islamic activists, Kaspersky said.

Kaspersky Labs - The areas of government Equation has been able to infect by nation.

The firm declined to publicly name the country behind the spying campaign, but said it was closely linked to Stuxnet, the NSA-led cyberweapon that was used to attack Iran's uranium enrichment facility. The NSA is the agency responsible for gathering electronic intelligence on behalf of the United States.

A former NSA employee told Reuters that Kaspersky's analysis was correct, and that people still in the intelligence agency valued these spying programs as highly as Stuxnet. Another former intelligence operative confirmed that the NSA had developed the prized technique of concealing spyware in hard drives, but said he did not know which spy efforts relied on it.

NSA spokeswoman Vanee Vines declined to comment.

Kaspersky published the technical details of its research on Monday, which should help infected institutions detect the spying programs, some of which trace back as far as 2001.

The disclosure could further hurt the NSA's surveillance abilities, already damaged by massive leaks by former contractor Edward Snowden. Snowden's revelations have hurt the United States' relations with some allies and slowed the sales of US technology products abroad.

The exposure of these new spying tools could lead to greater backlash against Western technology, particularly in countries such as China, which is already drafting regulations that would require most bank technology suppliers to proffer copies of their software code for inspection.

TECHNOLOGICAL BREAKTHROUGH

According to Kaspersky, the spies made a technological breakthrough by figuring out how to lodge malicious software in the obscure code called firmware that launches every time a computer is turned on.

Disk drive firmware is viewed by spies and cybersecurity experts as the second-most valuable real estate on a PC for a hacker, second only to the BIOS code invoked automatically as a computer boots up.

"The hardware will be able to infect the computer over and over," lead Kaspersky researcher Costin Raiu said in an interview.

Though the leaders of the still-active espionage campaign could have taken control of thousands of PC's, giving them the ability to steal files or eavesdrop on anything they wanted, the spies were selective and only established full remote control over machines belonging to the most desirable foreign targets, according to Raiu. He said Kaspersky found only a few especially high-value computers with the hard-drive infections.

Kaspersky's reconstructions of the spying programs show that they could work in disk drives sold by more than a dozen companies, comprising essentially the entire market. They include Western Digital, Seagate, Toshiba, IBM, Micron Technology and Samsung.

Western Digital, Seagate and Micron said they had no knowledge of these spying programs. Toshiba and Samsung declined to comment. IBM did not respond to requests for comment.

GETTING THE SOURCE CODE

Raiu said the authors of the spying programs must have had access to the proprietary source code that directs the actions of the hard drives. That code can serve as a road map to vulnerabilities, allowing those who study it to launch attacks much more easily.

"There is zero chance that someone could rewrite the [hard drive] operating system using public information," Raiu said.

Concerns about access to source code flared after a series of high-profile cyber attacks on Google Inc and other US companies in 2009 that were blamed on China. Investigators have said they found evidence that the hackers gained access to source code from several big US tech and defense companies.

It is not clear how the NSA may have obtained the hard drives' source code. Western Digital spokesman Steve Shattuck said the company "has not provided its source code to government agencies." The other hard drive makers would not say if they had shared their source code with the NSA.

Seagate spokesman Clive Over said it has "secure measures to prevent tampering or reverse engineering of its firmware and other technologies." Micron spokesman Daniel Francisco said the company took the security of its products seriously and "we are not aware of any instances of foreign code."

According to former intelligence operatives, the NSA has multiple ways of obtaining source code from tech companies, including asking directly and posing as a software developer. If a company wants to sell products to the Pentagon or another sensitive US agency, the government can request a security audit to make sure the source code is safe.

"They don't admit it, but they do say, 'We're going to do an evaluation, we need the source code,'" said Vincent Liu, a partner at security consulting firm Bishop Fox and former NSA analyst. "It's usually the NSA doing the evaluation, and it's a pretty small leap to say they're going to keep that source code."

Kaspersky called the authors of the spying program "the Equation group," named after their embrace of complex encryption formulas.

The group used a variety of means to spread other spying programs, such as by compromising jihadist websites, infecting USB sticks and CDs, and developing a self-spreading computer worm called Fanny, Kasperky said.

Fanny was like Stuxnet in that it exploited two of the same undisclosed software flaws, known as "zero days," which strongly suggested collaboration by the authors, Raiu said. He added that it was "quite possible" that the Equation group used Fanny to scout out targets for Stuxnet in Iran and spread the virus.

 - Reuters

Analyst: We underestimated North Korea

By Dana Ford, CNN



(CNN) - As the United States gets ready to blame the Sony hack on North Korea, a troublesome question is emerging: Just what is North Korea capable of?

Experts say the nation has spent scarce resources on building up a unit called "Bureau 121" to carry out cyber-attacks.

North Korea has been blamed in the past for attacks in South Korea, but the Sony hack - if indeed North Korea is behind it - would seem to represent an escalation of tactics.

"I think we underestimated North Korea's cyber capabilities," said Victor Cha, director of Asian Studies at Georgetown University. "They certainly didn't evidence this sort of capability in the previous attacks."

Cha was referring to attacks on South Korean broadcasters and banks last year.

In March 2013, South Korean police said they were investigating a widespread computer outage that struck systems at leading television broadcasters and banks, prompting the military to step up its cyber-alert level.

The South Korean communications regulator reportedly linked the computer failures to hacking that used malicious code, or malware.

An investigation found that many of the malignant codes employed in the attacks were similar to ones used by the North previously, said Lee Seung-won, an official at the South Korean Ministry of Science.

North Korea denied responsibility.

A spokesman for the General Staff of the Korean People's Army labeled the allegations "groundless" and "a deliberate provocation to push the situation on the Korean Peninsula to an extreme phase," according to KCNA, the North Korean state news agency.

North Korea has similarly denied the massive hack of Sony Pictures, which has been forced to cancel next week's planned release of "The Interview," a comedy about an assassination attempt on North Korean leader Kim Jong Un.

But KCNA applauded the attack.

"The hacking into the SONY Pictures might be a righteous deed of the supporters and sympathizers with the DPRK," it said, using the acronym of its official name, the Democratic People's Republic of Korea. "The hacking is so fatal that all the systems of the company have been paralyzed, causing the overall suspension of the work and supposedly a huge ensuing loss."

Experts point to several signs of North Korean involvement. They say there are similarities between the malware used in the Sony hack and previous attacks against South Korea. Both were written in Korean, an unusual language in the world of cyber crime.

"Unfortunately, it's a big win for North Korea. They were able to get Sony to shut down the picture. They got the U.S. government to admit that North Korea was the source of this and there's no action plan really, at least publicly no action plan, in response to it," said Cha. "I think from their perspective, in Pyongyang, they're probably popping the champagne corks."

CNN's Gregory Wallace, Brian Stelter, Evan Perez, K.J. Kwon and Jethro Mullen contributed to this report.

Sony hacks continue: PlayStation hit by Lizard Squad attack

By Alice MacGregor, CloserStill Media

Hacker group, Lizard Squad, has claimed responsibility for shutting down the PlayStation Network over Sunday night, the second large scale cyber-attack on the Sony system in recent weeks.

Users had been experiencing issues with log in overnight and into this morning, greeted by an error message reading “Page Not Found! It’s not you. It’s the Internet’s fault.”

PSN support acknowledged the downtime and confirmed that it had been investigating the issue. However, no details were shared as to the nature or cause of the issue.

“Thanks for your patience as we investigate,” the Japanese firm shared at midnight last night.
The company has now tweeted that the issue has been fixed: "If you had difficulties signing into PlayStation Network, give it a try now."

Although apparently unrelated, the outage comes just weeks after the much larger cyber-attack to the tech giant’s film studios Sony Pictures, which leaked confidential corporate information and unreleased movies.

An outfit calling themselves Guardians of Peace released the private data, including details on employees’ and actors’ salaries and addresses. Princess Beatrice was one of its victims, whose pay details and home address was forwarded to media firms across the U.S.

Speculations suggested that the Sony Pictures hack was linked to North Korea over its reported filmatic mocking of the national leader Kim Kong-Un. The country has denied engineering the attack, however the North Korean National Defence Commission released an official statement saying that the cyber-theft had been a “righteous deed.”

The group claiming to have taken down PSN today, Lizard Squad, first appeared earlier this year with another high-profile DDOS, or distributed denial of service attack, on Xbox Live and World of Warcraft in August.

Lizard Squad shared a link to a White Hose petition calling for the Obama Administration to “Stop the infamous DDOS hackers, and fake bomb threat callers, called Lizard Squad” – which currently counts 7,598 signatures.

The hacker collective claimed that this attack was just a taste and a ‘small dose’ of what was to come over the Christmas period.

Scam of the Day: PS4Jailbreaker dot com. More surveys for you, more money for them

By wololo · December 3, 2014

PS4Jailbreaker .com is a scam, they won’t “jailbreak” your PS4, they will just ask you to fill a survey for which they will get paid, and you won’t get anything in exchange. If you want the latest and greatest news about the possibility to hack your PS4, bookmark our “PS4 CFW for Dummies” page, which will have all the information needed, the day a hack is actually made public. Please share this information with your more gullible friends, who don’t know the difference between reputable scene websites, and stupid cash grab schemes.


It’s been a while since I last debunked one of those fake “Vita iso” or “PS4 iso” websites.
Yesterday one of these sites had the audacity of posting a link to their *** directly in the comments of my blog. So I decided I’d thank them, by calling them out publicly for their scammy website.

The website involved here is fake website ps4jailbreaker .com. PS4Jailbreaker .com is a scam website, put in place to make a quick buck on some fake download.



The site is an unoriginal and typical scam (I guess people still fall for these, so next time someone asks you if this is real, kindly point them to this article). PS4Jailbreaker .com pretend to offer a free jailbreak of your PS4, all you have to do is complete a survey to get your download. The surveys will take some of your precious time, and the owners of the site will get paid for each complete survey.

The chances of you actually getting your download at the end of the survey are slim at best. The possibility of you actually being able to “jailbreak” (hack) your PS4 with whatever you end up downloading, is 0.

It is not possible at the time of this writing to fully hack a PS4. When something looks too good to be true, it’s because it’s too good to be true. You can avoid scams such as PS4Jailbreaker .com by simply using this thing that us human beings call a brain: If there existed a method to hack the PS4 like these guys pretend to offer, all major scene websites would be talking about it, *before* you even realize the method exists. We have a community of thousands of people here, looking daily for all possible news related to hacking the PS4. It is statistically impossible that you could find out a “revolutionary” technique that we haven’t heard of.

The day a hack of the PS4 will exist, it will be on the front page of this website and other major scene websites. Heck, it will probably also be in the news of mainstream technology sites. So, don’t feel clever because you only just found out about the fake claims of PS4Jailbreaker .com, you’re actually on the verge of netting these guys $5 of your time, for nothing in return.

When a hack for the PS4 is truly available, it will be explained in details on our “PS4 CFW for dummies” page. That’s the page you need to bookmark for news on that.

Besides this very easy way to detect scam websites such as PS4Jailbreaker .com, you can also see that the techniques used on their website are fairly obvious: newly created website for the purpose of the product (the only people doing this are people selling a new hardware mod such as Sky3DS or trueblue.

When it comes to software hacks, you will usually hear about those on a hacker’s blog, twitter account, and here, before anyone thinks of even creating a dedicated websites. Hackers are too busy actually hacking, they usually won’t create a brand new website for one of their releases!)

Very typical of these websites too is the suspicious “did this hack work for you” vote system. Again, real hackers wouldn’t care about putting such a dumb thing in place.

Again, whenever a hack comes for the PS4, you’ll hear about it almost instantly on this site and other reputable sources. Don’t try and think you’re more clever than everybody else because you found an unvisited dark corner of the intertubes: most likely you’ll get mugged. This is the case with the scam on PS4Jailbreaker .com, a site that will basically steal your time to fulfill a survey, make money out of it, and leave you with nothing. Not dangerous per se, but definitely not worth your time.


(For the conspiracy theorists out there, feel free to actually try. You’ll give these guys the money from your survey, and will end up with nothing in exchange. That will be a great life lesson for you)

FBI secretly seeking legal power to hack any computer, anywhere

By Cory Doctorow

The Bureau is seeking a rule-change from the Administrative Office of the US Courts that would give it the power to distribute malware, hack, and trick any computer, anywhere in the world, in the course of investigations; it's the biggest expansion of FBI spying power in its history and they're hoping to grab it without an act of Congress or any public scrutiny or debate.

But under the proposed amendment, a judge can issue a warrant that would allow the FBI to hack into any computer, no matter where it is located. The change is designed specifically to help federal investigators carry out surveillance on computers that have been “anonymized” – that is, their location has been hidden using tools such as Tor.

The amendment inserts a clause that would allow a judge to issue warrants to gain “remote access” to computers “located within or outside that district” (emphasis added) in cases in which the “district where the media or information is located has been concealed through technological means”. The expanded powers to stray across district boundaries would apply to any criminal investigation, not just to terrorist cases as at present.

Were the amendment to be granted by the regulatory committee, the FBI would have the green light to unleash its capabilities – known as “network investigative techniques” – on computers across America and beyond. The techniques involve clandestinely installing malicious software, or malware, onto a computer that in turn allows federal agents effectively to control the machine, downloading all its digital contents, switching its camera or microphone on or off, and even taking over other computers in its network

FBI demands new powers to hack into computers and carry out surveillance [Ed Pilkington/The Guardian]

(Thanks, Melted_Crayons!)

Vita hack: the webkit exploit fully explained (+ more code for you to look at!)

By wololo · November 2, 2014

This was kind of out of the blue: Developer acez  just posted an article on his blog explaining all the details of the Webkit exploit that was recently revealed for the Vita, including how he and a group of friends leveraged it.

The read is extremely interesting, and I won’t pretend I’m able to summarize it in a way that would do it any justice, so I suggest you just read it.

A cynical summary for people like me who have been in the PSP hacking scene previously would be: “ha, the security on the PSP was a joke, now we’re talking”. The article truly shows that the exploit was not only about digging for CVE's and quickly and dirtily implement them on the Vita.

Between the absence of a debugger, ASLR, sandboxing, no JIT, and other bumps in the road, acez’s post clearly explains this was not easy. At all.

From the scene’s perspective, it’s interesting to see that the main people behind this work (freebot, acez, and John The Ropper) are – as far as I know – not people from the PSP or PS3 scene. They seem to be, however, very, very well seasoned hackers (at least acez seems to be a regular CTF – The hacking ones, not the Quake ones – contestant). The things they pulled off, which I understand where very helpful, behind the scene, to some of the releases we’ve seen over the past few days, were not an easy thing.

Credits

Johntheropper and freebot worked with acez directly on the exploit. In addition, he credits Yifanlu and Josh_Axey for their help on the Vita, as well as Acid_Snake and Codelion, and everyone else who “made this possible”.

Downloads

The exploit and all related work can be found on acez’s github. At this point I assume this is more or less the same work that has been released in CodeLion’s recent memtools_vita, but it is worth checking it.

What’s next?

Let’s hope that the interest of acez, JhonTheRopper, and freebot for the Vita will stay for a while. As mentioned in the blog article, there’s still a lot to do: Webkit is sandboxed, and without additional exploits, the scene will not be able to gain “full” native access to the Vita. From a personal point of view though, I would surely be happy to start seeing a simple SDK, and some simple homebrew, in the sandboxed Webkit exploit. Just for the sake of it.

Source: acez.re

Anonymous’ Twitter account suspended in conjunction with Ferguson protests

Anonymous had threatened to reveal private information about a man they claimed to be Michael Brown's shooter  

By Joanna Rothkopf
 

(Credit: Reuters/Nacho Doce)

Hacking group Anonymous’ Twitter account (@TheAnonMessage) was suspended on Thursday. The group claimed to reveal the name of Michael Brown’s shooter via the social media website and threatened to publish his home address and photo if the Ferguson Police Department did not confirm the allegation.

According to NBC News, Chief Angel Jimenez of the St. Ann Police Department in Missouri said that the person accused by Anonymous is actually a dispatcher, not a police officer. “At no time has he ever been involved in a shooting in Ferguson or elsewhere,” said Jimenez.

While Twitter does not comment on individual accounts, when asked for comment, a representative pointed to the social media website’s rules, which states that Twitter does not permit users to  ”publish or post other people’s private and confidential information” or “publish or post direct, specific threats of violence against others.” Anonymous had done both.

Anonymous has since switched to a backup account.

Twitter has suspended my main account. The powers that be will stop at nothing to silence us. #Anonymous #Ferguson
— TheAnonMessage2 (@TheAnonMessage2) August 14, 2014

Censoring us is an act of war. #Ferguson #TheAnonMessage
— TheAnonMessage2 (@TheAnonMessage2) August 14, 2014

---

---

HANDS UP, DON'T SHOOT. #Ferguson #TwitterSuspension #Anonymous pic.twitter.com/tX93g6lWM1
— TheAnonMessage2 (@TheAnonMessage2) August 14, 2014

ANNOUNCEMENT: We are ceasing any future dox releases until further notice. #Anonymous #Ferguson
— TheAnonMessage2 (@TheAnonMessage2) August 14, 2014

Joanna Rothkopf is an assistant editor at Salon, focusing on sustainability. Follow @JoannaRothkopf or email jrothkopf@salon.com.

Anonymous To Ferguson Police: Expect Us

By karoli

Anonymous published a list of demands in response to the police shooting of Michael Brown in Ferguson, Missouri.



Anonymous has stepped into the Ferguson, Missouri police shooting of a young unarmed black man and they have done so with firm resolve.

In their video above, they demand that elected representatives for that area introduce legislation defining clear standards of conduct for police in situations like the one that resulted in the shooting of Mike Brown Saturday.

They further state that if this demand isn't met, they will hack into police department databases and publish confidential data they obtain.

Whether one agrees or disagrees with Anonymous' operating tactics, what they're asking for is not outrageous. There is a point where a line in the sand is needed, and where everyone should stop pretending the police are always right and the people are always wrong. That right/wrong view seems to be the one that prevails when black or brown people are the ones protesting in the street.

That kid lay in the street for hours while they beefed up their militarized presence in Ferguson, as if to invite violence. I'm not sure I'm buying the "official account" of how Brown came to be shot eight times, either. If he allegedly attacked the cop sitting in the car, how did he come to fall 35 feet away while the cop never got out of the car?

As a writer, it's difficult to balance a desire not to slam police, who have a difficult and demanding job against sympathy for an unarmed kid dead in the street. In some cases, criticism just lives in the situation. This is one of those times.

Ferguson's elected officials should take Anonymous' demands seriously.

(As a side note, Twitter killed the #OpFerguson hashtag and suspended the @OpFerguson account. I'm sure glad they believe in free speech. I guess for them that's only for conservatives.)