Google offers $1 million reward to hackers who exploit Chrome

There's security and then there's security.

Google has pledged cash prizes totaling $1 million to people who successfully hack its Chrome browser at next week's CanSecWest security conference.

Google will reward winning contestants with prizes of $60,000, $40,000, and $20,000 depending on the severity of the exploits they demonstrate on Windows 7 machines running the browser. Members of the company's security team announced the Pwnium contest on their blog on Monday. There is no splitting of winnings, and prizes will be awarded on a first-come-first-served basis until the $1 million threshold is reached.

...At last year's competition, Internet Explorer and Safari were both toppled but no one even attempted an exploit against Chrome (despite Google offering an additional $20,000 beyond the $15,000 provided by contest organizer Tipping Point).

Chrome is currently the only browser eligible for Pwn2Own never to be brought down. One reason repeatedly cited by contestants for its lack of attention is the difficulty of bypassing Google's security sandbox.

If you're still surfing with Internet Explorer, I would recommend giving Chrome a try. It's fast, secure and free. You can download it here.


Hat tip: @KimZetter.

Harbinger of Future Events: New York Times Emails Millions of Subscribers to Tell Them Their Subscriptions Are Cancelled

Paul Krugman hardest hit:

The New York Times mistakenly sent an e-mail on Wednesday to more than eight million people who had shared their information with the company, erroneously informing them that they had canceled home delivery of the newspaper.

The Times Company, which initially mischaracterized the mishap as spam, apologized for sending the e-mail. The people who received the message represented a cross section of readers who had given their e-mail addresses to the newspaper, said Eileen Murphy, a spokeswoman for the Times Company.

...The e-mail urged recipients to consider continuing their subscriptions to The Times at 50 percent off for 16 weeks. The message sent off a flood of Twitter reactions and calls to The Times...

...She said the e-mail had been sent by a Times employee and not Epsilon Interactive, a third-party service the company uses to communicate with subscribers.

I'm thinking this is just the first step in a self-fulfilling prophecy.

The 10 Funniest Passwords Exposed by the Stratfor Breach

10 ABC News: jonathan.d.greenberger@abc.com:stephanopoulos
 9 Goldman Sachs: joseph.aiken@gs.com:derivative
 8 MSNBC: gary.nease@msnbc.com:Seaweed1
 7 Goldman Sachs: amy.lee@gs.com:password
 6 New York Times: kewald@nytimes.com:9295
 5 Soros? david.steinberg@soros.com:secret
 4 Fred Burton, VP of Stratfor: burton@stratfor.com:stratfor
 3 Standard Bank: ravi.bhatia@standardbank.com:ravi
 2 Control Risks: jennifer.harbison@control-risks.com:research
 1 Goldman Sachs: muneer.satter@gs.com:bulls***

Bonus Banking Password UBS: paul.brewer@ubs.com:1234

Breaking: Statement on the 2.7 million emails obtained from Stratfor

More than 48 hours after it was rooted, the website of intelligence firm Stratfor Research remains down. In fact, as of this moment, even its temporary server (showing an "Under Maintenance" page) is inaccessible, perhaps due to an ongoing denial-of-service attack.

Via Wikileaks, the following statement describes some of the motives for the compromise.

In the wake of the recent operation by which Stratfor's servers were compromised, much of the media has focused on the fact that some participants in the attack chose to use obtained customer credit card numbers to make donations to charitable causes. Although this aspect of the operation is indeed newsworthy, and, like all things, should be scrutinized and criticized as necessary, the original purpose and ultimate consequence of the operation has been largely ignored.

Stratfor was not breached in order to obtain customer credit card numbers, which the hackers in question could not have expected to be as easily obtainable as they were. Rather, the operation was pursued in order to obtain the 2.7 million e-mails that exist on the firm's servers. This wealth of data includes correspondence with untold thousands of contacts who have spoken to Stratfor's employees off the record over more than a decade. Many of those contacts work for major corporations within the intelligence and military contracting sectors, government agencies, and other institutions for which Anonymous and associated parties have developed an interest since February of 2011, when another hack against the intelligence contractor/security firm HBGary revealed, among many other things, a widespread conspiracy by the Justice Department, Bank of America, and other parties to attack and discredit Wikileaks and other activist groups. Since that time, many of us in the movement have dedicated our lives to investigating this state-corporate alliance against the free information movement. For this and other reasons, operations have been conducted against Booz Allen Hamilton, Unveillance, NATO, and other relevant institutions. The bulk of what we've uncovered thus far may be reviewed at a wiki maintained by my group Project PM, echelon2.org.

Although Stratfor is not necessarily among the parties at fault in the larger movement against transparency and individual liberty, it has long been a "subject of interest" in our necessary investigation. The e-mails obtained before Christmas Day will vastly improve our ability to continue that investigation and thereby bring to light other instances of corruption, crime, and deception on the part of certain powerful actors based in the U.S. and elsewhere. Unlike the various agents of the U.S. Government, the hacking team that obtained this information did not break down the doors of the target, point guns at children, and shoot down any dogs that might have been present; Anonymous does not resort to SWAT tactics, and this is simply one of many attributes that separate the movement from the governments that have sought to end our campaign and imprison our participants. Of course, such points as these will not prevent our movement from being subjected to harsher scrutiny than is given to those governments which are largely forgiven their more intrusive tactics by virtue of their status as de facto holders of power in a world that has long been governed in accordance with the dictate that might makes right.

Incidentally, many of us are more than happy to proceed according to that amoral dictate if we find it to be necessary. And, increasingly, we have found it to be so.

Barrett Brown
Project PM
irc.project-pm.org

Post-attack: Stratfor Research website still down after 24 hours

The website of intelligence firm Stratfor Research remains down more than 24 hours after it was rooted and defaced.

A comment on ZeroHedge by "Osgo" seems to summarize some of the key issues.

I find it astounding how people who just have no f'ing idea about INFOSEC, Anonymous, 4Chan, or Lulzsec... who still think AOL is the Internetz... are suddenly Armchair Warrior Commando Supremo, ready to wreak havoc upon enemies of capitalism... actually thinking that WikiLeaks, etc..is some sort of black-ops, Soros-scheming, FEMA camp-making endeavor ready to enslave their family, firmly ensconced in their gated community where most of the cars are shiny and their kids a little too clean... get some f'ing perspective, people, this is the Internetz equivalent of you driving around in your old '73 Camaro with a few too many Oly's in you as you took out your neighbors mailboxes, laughing with glee, later discovering your erstwhile girlfriend's angora sweater along with the twin treasures within.

Stratfor's site wasn't updated, patched well or maintained in a way commensurate with their public image. Indeed, it was a public secret that anyone could read ALL the articles in Google's cache... what they just went through is typical... Podunk site from a few years ago grows exponentially without proportionate security measures that EXCEEDED growth. While they hired and promulgated new authors, contributors and analysts with a pantload of letters after their names, they 'prolly didn't hire enough IT/web developers/security folks 'cause let's face it...they're usually considered a cost center, not a name that would bring in new subscribers/biz/accolades. I seem to remember they had open positions for interns... not pro's... go figure....

Every org. has growing pains... but the pain point here? The manageable risk that was unfortunately overlooked by "America's Private CIA" endeavor? By promoting and evangelizing themselves as an alternate intelligence organization, they failed to take into account good OPSEC. Here we have hundreds of records soon to be available, dead-drop names, sovereign ID's, aliases and a Who's-Who of people and corps. who just don't wanna be found....easily cross-referenced with other public disclosures... that any counter-intel org. could use to their great advantage. At this point it may even be an issue of maskirovka, but certainly the intrusion in no way approaches a sovereign level of expertise, IMHO...

This has got to be a flat-out awful Christmas for everyone involved with Stratfor. The company's website is a crucial element of its marketing and service delivery arms; yet, as Osgo implies, the organization's I.T. function may have received short shrift.

Screenshots: Stratfor Research Website Pwnt by Attackers

The website of intelligence firm Stratfor Research appears to have been defaced and then DOSed (suffered a denial-of-service attack) by attackers.

The message traffic (below) -- if accurate -- portrays a defiant IT manager offering a, eh, perhaps unwise challenge.

The Google cache recorded some of the content including shadow files and other sensitive info apparently rooted from Stratfor's servers. I've tactfully redacted some of the more sensitive info.

// OH STRATFOR. IF YOU ONLY KNEW WHAT ALL IS ABOUT TO GO DOWN.
// 'BUT WAIT', YOU ASK. 'IS THIS IT?' 0H N0, WE GOT MORE IN STORE...
// BUT FOR NOW, SOME INSPIRING WORDS OF WISDOM FROM IT MANAGER FRANK GINAC:

"You do realize how preposterous it is to suggest that stratfor simply
shutdown completely for 2 days, right? The plan that you've attached paints a
gloom and doom picture claiming no chance that such a move will succeed. Does
that really seem a rationale conclusion?"

// YOU DONT EVEN KNOW THE EXTENT OF THE GLOOM AND DOOM WE HAVE PLANNED, FRANK


"Attended the TakeDownCon security conference. Focus of the conference was on
wireless and mobile security. No vendors pushing product or service at this
conference. Instead, great presentations by renowned white hat hackers (good
hackers) and security experts. Bottom line is that no mobile platform is
secure, including the Blackberry, but there are best practices that minimize
the risk of their use within the enterprise. We will be incorporating these
best practices in our operation over the coming months."

// INCORPORATING PRACTICES FROM "GOOD WHITE HAT HACKERS"? HOW'D THAT WORK OUT?

"It blew my mind to discover that our email server backups are being stored on
the same physical server. I'm affectionately referring to these little
discoveries as 'Mooney turds'."

// SO SAD WE RM'D YOUR MAIL SERVER AND ALL BACKUPS, FRANK

"Most if not all of us use professional and social networking sites like
LinkedIn and Facebook. All offer levels of privacy ranging from wide open
where everyone can see your profile, activities, and posts to closed allowing
only your immediate connections (or friends) access. As a private intelligence
company we must all take extra care to protect our personal information from
those who would use that information to exploit us personally or
professionally. Although we don't have hard and fast rules on how to set your
privacy settings nor do we restrict use of such sites, I suggest that you
temper your need to share with prudence and consider the business that we are
in. It's also important to check your privacy settings regularly to ensure
that the sites you use haven't changed the meaning or scope of privacy
settings -- we've all heard or read the news regarding this practice at
Facebook. I suggest that you never include any information in your profile --
regardless of privacy setting -- that could be used to compromise your
identity. Specifically, never include: your birth date, your exact street
address (although this information can usually be found on the web quite
easily), your cell phone number, SSN or other government issued ID number
(that should be obvious), or any other information that someone could use to
compromise your identity if your account were compromised."

// EVEN WITH ALL THE BEST SECURITY PRACTICES LEARNED FROM THE "RENOWNED WHITE
// HAT HACKERS" WE STILL MANAGED TO STEAL ALL YOUR PERSONAL INFORMATION. UMAD?

Interesting, to say the least.

Update: Cryptome:

Subject: Important Announcement from STRATFOR
Date: Sat, 24 Dec 2011 19:49:58 -0500
From: STRATFOR

Dear Stratfor Member,

We have learned that Stratfor's web site was hacked by an unauthorized party. As a result of this incident the operation of Stratfor's servers and email have been suspended.

We have reason to believe that the names of our corporate subscribers have been posed on other web sites. We are diligently investigating the extent to which subscriber information may have been obtained.

Stratfor and I take this incident very seriously. Stratfor's relationship with its members and, in particular, the confidentiality of their subscriber information, are very important to Stratfor and me. We are working closely with law enforcement in their investigation and will assist them with the identification of the individual(s) who are responsible.

Although we are still learning more and the law enforcement investigation is active and ongoing, we wanted to provide you with notice of this incident as quickly as possible. We will keep you updated regarding these matters.

Sincerely,

George Friedman

STRATFOR
221 W. 6th Street, Suite 400
Austin, TX 78701 US

Update II: Police-Led Intelligence:

PLI is far more concerned about the state of the classified information provided by STRATFOR to the US Government... STRATFOR maintains separate classified and unclassified networks and information, and PLI understands that none of the STRATFOR data has been spared the attention of the hacking group. Of course, had STRATFOR placed any classified data on the server which we know has been hacked, they’d be in blatant violation of the laws of the US and of common sense, but it’s against the law why? Because it’s happened before.

If classified data has been compromised in the hack, it will create a larger impact – and response – than if it is unclassified commercial intel. In addition, Sabu, a leading member of the group, boasted on Twitter that... "Over 90,000 Credit cards from LEA, journalists, intelligence community and whitehats leaked and used for over a million dollars in donations..."

The AntiSec/LulzSec crowd, on the AnonymousIRC Twitter channel, has promised that this is the first of many attacks.