Mandiant releases quick credential cracker, to hasten the death of a bad protocol
Infosec In Brief PLUS: Google’s security outfit Mandiant last week released tools that can crack credentials in 12 hours, in the hope that doing so will accelerate the death of an ancient Microsoft security protocol.
As explained in a Mandiant post, for over 20 years researchers have known that Microsoft’s Net-NTLMv1 legacy authentication protocol exposes users to credential theft. Yet it’s still out there.
Mandiant therefore released rainbow tables it says allow security pros to easily demonstrate the weakness of Net-NTLMv1.
“The release of this dataset allows defenders and researchers to recover keys in under 12 hours using consumer hardware costing less than $600 USD,” Mandiant’s principal red team consultant Nic Losby wrote last week.
Losby’s post explains how to use the dataset, and concludes “Organizations should immediately disable the use of Net-NTLMv1.”
The Register offered similar advice – in 2010 – underlining the bizarre persistence of Net-NTLMv1
16 years jail for sailor who sold secrets to China
A US District court last week sentenced a US Navy sailor convicted of selling secrets to China to 16 years and eight months of prison time.
The court last year convicted Wei of six espionage-related charges, stemming from the sale of technical manuals and operational information to a Chinese intelligence official between 2022 and 2023. According to the Department of Justice’s note on his sentencing, he earned around $12,000 for his spying activities.
The DoJ claimed Wei knew his activities were wrong and confided with a fellow sailor that he thought he was being solicited by Chinese intelligence, but did not break off contact with his Chinese handler.
Supreme Court hacker pleads guilty
Nicholas Moore, 24, of Springfield, Tennessee, last week pleaded guilty to hacking the US Supreme Court’s electronic document filing system.
Per court documents, Nicholas Moore spent 25 days illegally accessing the SCOTUS filing system in 2023, earning him a charge of computer fraud. Additional information regarding the case, including what Moore may have done inside the system, hasn’t been made public.
US electronic court systems have been compromised on numerous occasions in recent years, most recently by supposed Russian hackers who were accused of attacking the decades-old (and boy does it show) Public Access to Court Electronic Records (PACER) system last year.
Moore, who was charged under 18 USC 1030(a)(2), could face up to a decade in prison, plus fines.
Nigerian ‘Black Axe’ gang busted again
It’s been three years since the Nigeria-based crime syndicate Black Axe was last busted by Interpol, but the cross-border police organization recently reported apprehending 34 individuals in Spain.
Black Axe is known to engage in various types of crime, both virtually and in the physical world, involving cyber-enabled fraud, drug and human trafficking, and even armed robbery.
Interpol believes Black Axe has around 30,000 members, plus ” countless affiliated individuals.” While Interpol said 10 of its recent arrests involved members of the gang’s “core group” from Nigeria, the sheer numbers of Black Axe actors mean recent arrests are a pinprick.
The group has been busted twice previously in recent years, with 75 arrests in 2022 and 14 more apprehensions in 2023.
Bill seeks to melt ICE’s apps
US lawmakers are trying to set new rules that would limit the US Immigration and Customs Enforcement’s (ICE’s) ability to use a mobile app used to identify suspects and protestors.
A bill backed by six Democratic House members, led by Committee on Homeland Security ranking member Bennie Thompson (D-MS), would restrict use of ICE’s Mobile Fortify app to ports of entry to the USA. As it stands now, ICE agents use the app during many operations, which Democrats believe enables violations of civil liberties.
“When ICE claims that an image it snaps and runs through an unproven app can be enough evidence to detain people for possible deportation, no one is safe,” said Thompson.
ICE also uses other tracking technology, including license plate reading cameras, to surveil both immigrants and US citizens alike.
The bill also prohibits the Department of Homeland Security, ICE’s parent agency, from sharing the app outside its own ranks.
The bill would also require the Department to make the app inoperable on non-DHS systems – such as personal devices owned by ICE agents – and require ICE to delete all images, photographs, and fingerprints of US citizens previously captured by the app. ®
READ MORE HERE