Hacking Attacks Exposed

A summary of an article, “Black Hat to expose attacks,” by Tim Greene
August 5, 2009
This summary was forwarded by Judge Herbert B. Dixon,Jr of the Superior Court of the District of Columbia with the permission of the Center for Legal and Court Technology, formerly the Courtroom 21 project, http://www.courtroom21.net/ . Upon receiving a copy, I contacted Judge Dixon and we agreed that it was appropriate to post it here in recognition of the important work the Center for Legal and Court Technology is continuing.

With all the new techniques that computer hackers are developing these days, these seemingly undetectable attacks are insidiously maneuvering their way into our computers and databases. What can we possibly do to combat a silent stalker that leaves no trace on our hard drives of ever having been there? Luckily, a collaboration called Black Hat, formed in 1997, offers us a family of information security events designed to promote digital self defense.

The Black Hat USA 2009 conference convened last week in Las Vegas, NV. It brought together speakers and presentations from widely diverse backgrounds, including academia and information technology. Many of the presenters discussed ways in which hackers steal information secretly without leaving behind much evidence. One such tactic is to utilize computers that are plugged into a nearby electrical outlet. The attackers know, for instance, that the keyboard cable isn’t protected and the signals that are made by hitting of the keys feed into the ground wire of the computer’s electrical system. Hackers attach the ground of a power socket, located nearby, and connect it to two probes separated by a resistor. They then decode the letters by comparing the fluctuations in the voltage difference. Once the letters have been revealed, the attackers can figure out your passwords and determine what you were typing.

Have you ever checked on your bank balance or made a payment on a credit card while at an internet café or while using any type of public wireless? Doing this puts you at a high risk of being attacked and your passwords and account information stolen. Even when you think you are working within a secure SSL session, hackers are watching and waiting. An effort has been made to ensure more stringent website SSL certification qualifications, but lurking behind that green EV (extended validation) bar might be a browser still utilizing the older, more traditional DV (domain validation) issue SSL certificate. Websites looking to ensure their users that their whole website is EV SSL certified and safe to use would be well advised to make sure that all of their pages (even those they don’t necessarily control) are up to date on all the newest certifications.

Along with software modules, such as Meterpreter, that can invade authorized software someone is running on their computer, many by savvy computer hackers are leaving no visible trace on our hard drives. Mandiant, a company that deals in intelligent information security, is hard at work developing different tools to help us track the damage that attackers are inflicting upon our computer systems. The best advice for now is, be careful where and how you access important information, try to only use websites that are fully EV SSL certified, and keep an eye out for any evidence that you’ve been hacked.

To learn more, go to www.networkworld.com