Hacker who Snowdenized ethical hacking site also grabbed email control

The hacker who slipped Edward Snowden's passport photo and a dash of sneering onto a ethical-hacking certificate issuer's site in February accomplished quite a bit more, it turns out.
As the company EC-Council (ECC) said in a notice to customers on Wednesday, beyond DNS poisoning, the hacker also managed to issue a password-reset to the council's email service provider while the domain was still in his grasp and to maybe even poke his nose into some customers' email accounts.
The EC-Council's ongoing investigation has found that while the hacker had administrative access to its enterprise email - which it stores with a cloud service provider that it didn't name - he was able to compromise about 2% of the council's customer email accounts before its security team managed to wrest back control.
From the notice:

EC-Council uses a cloud service provider for enterprise email. Once the domain privilege was attained, the hacker then issued a password reset request to the email service provider. This circumvented EC-Council's best practices of using complex passwords and 2-factor authentication.
We have informed the service provider of this password reset policy vulnerability and are hopeful that they have already rectified it for the benefit of the IT community in general.
With administrative access to the email service provider, the hacker was able to compromise a small number of email accounts before the EC-Council security team was able to respond to the breach. This resulted in unauthorized access to messages in those specific email boxes for a short duration of time.

So much for the EC-Council's best-practices of using complex passwords and two-factor authentication (2FA).
Of course, Naked Security gives a hearty 'yes indeedy' to the concept of complex passwords -strong and unique for each service and website you use - and we consider it so important that it rates at No. 3 on our list of  3 essential security tasks.
At any rate, EC-Council says it's transferred its domain to another registrar, changed policies on management of personal information, improved existing data retention policies, introduced 2FA for member portals, improved security procedures and systems, and plans to keep doing so in the weeks and months to come.
The hacker signed his taunting message as "Eugene Belford", a name cribbed from the evil computing genius character in the movie "Hackers", also known as "The Plague".
In the defacement, he poked fun of the EC-Council for reusing passwords.
He also left a link to an attrition.org page that lists a number of prior vulnerabilities, a previous hack, and criticism of the organisation from the education and information security professions, including "taking shortcuts usually reserved for students, by plagiarizing content from other sources and including it in their commercial offerings."
The council, which issues a slew of certifications, including Certified Ethical Hacker (CEH), Computer Hacking Forensics Investigator (CHFI), and License Penetration Tester (LPT), hasn't figured out if data was compromised in the exposed accounts.
If data was compromised, it would have been from those email accounts whose users sent personally identifiable information to EC-Council via email.
No credit card data was exposed, the council said.
It's warning customers to stay alert for unauthorized use of anything they've shared with the council and to let the EC-Council know if they do find suspicious activity.

All hacking eyes on the prize money at CanSecWest

The Keen Team from China unfurls a victory banner as they knock over Apple Safari in the Pwn2Own contest at CanSecWest in Vancouver, Canada, on Feb. 13, 2014.

(Credit: Seth Rosenblatt/CNET)

VANCOUVER, Canada -- When it comes to hacking, it turns out that greed really is good.
All four of the major desktop browsers, plus two Adobe browser plug-in programs, succumbed to the predations of the hacker community in two different contests.
Pwn2Own, sponsored by Hewlett-Packard and organized by the HP-owned Zero-Day Initiative, featured up to $1.085 million in prizes, and security researchers going after Adobe Flash and Reader, Apple Safari, Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox.
Eight research teams earned $850,000, with another $82,500 going to charity for Pwn4Fun over the two-day competition, which concluded on Thursday at the CanSecWest conference at the Sheraton Wall Hotel here. HP has summarized results for Day One and Day Two
The new Pwn4Fun charity contest saw Pwn2Own co-sponsor Google nailing Apple Safari for $32,500, while Pwn2Own organizer Zero-Day Initiative hit Internet Explorer for $50,000. Both teams donated their prizes to the Canadian Red Cross.
Why security hacking is becoming more lucrative
Team Vupen of Vupen Security scored the most cash with $400,000, the most that any single Pwn2Own team has ever won. Vupen Chief Executive and Chief Researcher Chaouki Bekrar said to not let the high value of the prizes fool you: browser security, he said, is improving.
"The major value of Pwn2Own is to show that even the most secure software can be compromised by a team of researchers with enough resources," he said just after knocking off Google Chrome, the first of two contestants this year to do so.

Vupen Security's Chaouki Bekrar hides a text editor window he says shows his winning exploit for Google Chrome in the Pwn2Own contest at CanSecWest in Vancouver, Canada, on Feb. 13, 2014.

(Credit: Seth Rosenblatt/CNET)

But, he said, there's more value to the competition than just the lucrative prizes.
"Since we report the vulnerabilities to the vendors, they fix the flaws and [then] they harden the browser to prevent future attacks." Browsing in general becomes safer for everybody, Bekrar said, as browser vendors learn from each other's mistakes.
Brian Gorenc, the manager of the Zero-Day Initiative, agreed that the larger prizes are having a two-fold impact on the day-to-day security of what's likely to be your favorite browser.
"Microsoft, [Adobe] Flash, and Google were all patched before the contest. The vendors are definitely trying to put their best product forward," Gorenc said.

"The major value of Pwn2Own is to show that even the most secure software can be compromised by a team of researchers with enough resources."
--Chaouki Bekrar, Vupen Security CEO

He said that reflects the growing trend where companies respond somewhat faster to reported bugs. The average two years ago was 180 days, but that's down to 120 days now.
Meanwhile, Gorenc said, the growing prize pot is attracting researchers like nerds to an arcade game. This year saw the highest number of entries in the decade-long history of the contest, at 16. It's getting to the point where security researchers can make in one contest enough to live on for a year, but it's not easy. There are strict requirements for proving your newfound vulnerability and exploit.
Where Vupen spent around four to six weeks to earn its prize money, Keen Team, from China, scored $65,000 for hacking Apple Safari and co-hacking Adobe Flash. They will donate some of their winnings to a Chinese charity for the people missing on Malaysian Airlines flight MH370.

Brian Gorenc, of HP's Zero-Day Initiative, which organizes the Pwn2Own contest at CanSecWest in Vancouver, Canada, on Feb. 13, 2014.

(Credit: Seth Rosenblatt/CNET)

Keen Team senior researcher Liang Chen said it took three months to develop those exploits, but he clarified that factors such as operating system and browser version can affect how successful an exploit is.
"Desktop Safari is harder to hack than on iOS 7 because [Apple] will implement the latest security enhancements more often," he said.
Not all the software up on the Pwn2Own chopping block lost its head. Bekrar's Vupen withdrew from scheduled attempts at Oracle's Java and Apple Safari, although he might've passed on Safari because the Keen Team successfully exploited it an hour earlier -- possibly with the exploit he had discovered.
One researcher failed at an Internet Explorer hack, although the browser succumbed to other attempts.
Left unscathed was the highest single prize of the contest, $150,000 for the "Exploit Unicorn." This rare beast demanded a specific hack: system-level code execution on a Windows 8.1 x64, in IE 11 x64, with an Enhanced Mitigation Experience Toolkit (EMET) bypass.
Pwnium for hacking Chrome OS
Google held its own concurrent one-day hacking contest on Wednesday this week, giving security researchers a crack at Chrome OS and a grand total of $2.7 million in cash rewards.

Google security engineer Chris Evans and a Chromebook -- but not the one that was exploited in Pwnium 4, at CanSecWest in Vancouver, Canada, on Feb. 13, 2014.

(Credit: Seth Rosenblatt/CNET)

Google would not reveal the number of participants, but George Hotz, a well-known researcher known on the console hacking scene as "Geohot" won $150,000 for an exploit chain six deep on the HP Chromebook 11. A second participant is up for a partial reward on the same device. Hotz also claimed one of the four $50,000 Firefox exploits at Pwn2Own.
Chris Evans, a Google security engineer who has been on the Chrome security team since Google began building the browser, echoed a similar note to Gorenc, Bekrar, and others in Vancouver this week: If you want high-quality security, you have to pay for it.
"The prize is high," Evans said, "because the amount we can learn from it is high. We can close whole classes of bugs, while devising new hardening measures."
Evans said that across all Google security rewards programs, which includes its regular Chrome bug bounty, the Google Search bug bounty, and the Pwnium event, the company has paid more than $3 million for bugs. That includes this week's Pwnium awards, and is accelerating: Google crossed the $2 million mark only seven months ago.

"We've gone from 2 to 3 really fast," he said. "The more money we can put into the "white hat" community, the better off we all are."
--Chris Evans, Google security engineer

"We've gone from 2 to 3 really fast," he said. "The more money we can put into the "white hat" community, the better off we all are."
Evans said that the impetus at Google to improve security is driven by a desire simply to be better than the bad guys, and part of that is acknowledging and fixing previously-unknown vulnerabilities and exploits. He made it clear that Google feels it wins when it can point to lessons learned, such as the three losses by Chrome and Chromium this year.
"Bad guys are fundamentally lazy," Evans said, then added, "like the rest of us."
They're looking for the highest return with the least amount of effort, he said, put Google's goals in game-show terms.
"They want the weakest link," he said, "and we will never have Chrome be the weakest link."