How hackers snoop on private web browsing

Experts have identified how their web browser's 'private mode' setting is also vulnerable to hackers.

Most web browsers offer a private mode, intended to leave no trace of surfing history on the computer.

But Collin Jackson at Carnegie Mellon University in Pittsburgh, Pennsylvania, and colleagues, have found ways to detect which sites were visited with the mode enabled.

Even if private browsing is enabled, details relating to the key remain stored on the computer's hard drive, allowing a hacker to establish that a particular site had been visited.

A hacker could "guess what sites you've been to based on traces left behind," New Scientist quoted Jackson as saying.

These attacks on privacy "do not require a great deal of technical sophistication and could easily be built into forensics tools," he added.

However, Rik Ferguson -- a UK-based security researcher at Trend Micro of Tokyo, Japan -- says that any attacker with the knowledge to exploit the weaknesses would probably look to other attacks first, which may yield more detailed information.

"If someone is capable of tracking your browsing habits in this way, then they are probably also tech-savvy enough to know about commercial spyware which could much more effectively track your computer use," says Ferguson.

Blogged with the Flock Browser

Google’s China hack, an insider’s job?

Google is investigating whether one or more employees may have helped facilitate a cyber-attack from China that the US search giant said it was a victim of in mid-December, two sources told Reuters.

Google, the world's most popular search engine, said last week it may pull out of the world's biggest Internet market by users after reporting it had been hit by a "sophisticated" cyber-attack on its network that resulted in theft of its intellectual property.

The sources, who are familiar with the situation, told Reuters that the attack, which targeted people who have access to specific parts of Google networks, may have been facilitated by people working in Google China's office.

"We're not commenting on rumour and speculation. This is an ongoing investigation, and we simply cannot comment on the details," a Google spokeswoman said.

Security analysts told Reuters the malicious software (malware) used in the Google attack was a modification of a trojan called Hydraq. A trojan is malware that, once inside a computer, allows someone unauthorised access. The sophistication in the attack was in knowing whom to attack, not the malware itself, the analysts said.

Local media, citing unnamed sources, reported that some Google China employees were denied access to internal networks after January 13, while some staff were put on leave and others transferred to different offices in Google's Asia Pacific operations. Google said it would not comment on its business operations.

Google, which has denied rumours that it has already decided to shut down its China offices, said on Monday it contacted the Chinese government last week after the announcement.

"We are going to have talks with them in the coming few days," Google said. Google is also still in the process of scanning its internal networks since the cyber-attack in mid-December.

China has tried to play down Google's threat to leave, saying there are many ways to resolve the issue, but insisting all foreign companies, Google included, must abide by Chinese laws.

Washington said it was issuing a diplomatic note to China formally requesting an explanation for the attacks.

The Google issue risks becoming another irritant in China's relationship with the United States. Ties are already strained by arguments over the yuan currency's exchange rate, which US critics say is unfairly low, trade protectionism and US arms sales to Taiwan.

Washington has long been worried about Beijing's cyber-spying programme. A congressional advisory panel said in November the Chinese government appeared increasingly to be penetrating US computers to gather useful data for its military.

'China tried to hack India's computers'

Chinese hackers have tried to penetrate computers in the offices of National Security Adviser MK Narayanan, a British paper quoted him as saying.

Narayanan said his office and other government departments were targeted on December 15, the same date that US defence, finance and technology companies, including Google, reported cyber attacks from China.

"This was not the first instance of an attempt to hack into our computers," Narayanan told The Times in an interview, adding the would-be hackers sent an e-mail with a PDF attachment containing a Trojan virus.

The virus, which allows hackers to download or delete files, was detected and officials were told not to log on until it was eliminated, Narayanan said.

"People seem to be fairly sure it was the Chinese. It is difficult to find the exact source but this is the main suspicion. It seems well founded," he told The Times, adding that India was cooperating with the US and Britain to bolster its cyber defences.

The Chinese government has denied any role in the attacks, with a foreign ministry spokeswoman saying: "Hacking in whatever form is prohibited by law in China."

Narayanan said that while he expected China to be an increasingly high security priority for India, the main threat still came from militants based in Pakistan.

He said Islamabad had done nothing to dismantle militant groups since the 26/11 Mumbai attacks, and criticised Britain for accepting its excuse that such groups were beyond its control.

"The British are still blinkered on this. We believe Pakistan's policy of using terror as a policy weapon remains," Narayanan said, adding India is anxious to prevent an attack from Pakistan during the Commonwealth Games in October.

"From Pakistan's point of view, it's important to disrupt the Games so you can claim that India is not a safe place," Narayanan said.

IE flaws led to Google hack

The Chinese managed to hack Google accounts of human activists and many businesses as they took advantage of vulnerabilities in Microsoft's Internet Explorer (IE) browser which were previously unknown, according to reports.

Google has threatened to close its operations and offices in China after hacking and "phishing" attempts to break into gmail accounts of US, China and Europe based Chinese human rights activists.

The company, which agreed to censor of Google.cn at its launch in 2006, has also said it is "no longer willing to continue censoring our results on Google.cn."

Reports quoted security researcher McAfee Inc. as saying that IE is vulnerable on all of Microsoft's operating systems, including Windows 7.

What is now termed as 'operation Aurora', is being perceived as a quite sophisticated attack. the report added that 'phishers' fooled users into clicking on a link to a website. This website then secretly downloaded malicious software onto their computers. The spyware allowed the hackers to take remote control of the computers.

Microsoft has already admitted in its blog that IE browser might be used by hackers to remotely spy on infected computers. It is likely to unveil a software update for the browser. "We need to take all cyber attacks, not just this one, seriously," Microsoft Chief Executive Steve Ballmer told CNBC. "We have a whole team of people that responds in very real time to any report that it may have something to do with our software, which we don't know yet," he said.

Google has said that "these accounts have not been accessed through any security breach at Google, but most likely via phishing scams or malware placed on the users' computers."

We will stay in China: Microsoft

Microsoft Corp has no plans to pull out of China, its chief executive has said, playing down concerns about recent cyber-attacks and censorship raised by rival Google Inc.

The company's stance indicates the world's largest software maker is not likely to support its fierce rival in its battle with China and rebuffs broad US political backing for Google.

"There are attacks every day. I don't think there was anything unusual, so I don't understand," Microsoft CEO Steve Ballmer told Reuters after a meeting on modernizing government services at the White House.

"We're attacked every day from all parts of the world and I think everybody else is too. We didn't see anything out of the ordinary."

Recently, Google threatened to pull out of China - the world's biggest Internet market by users - citing censorship and cyber attacks on rights activists' email accounts there.

Google claimed more than 20 other large companies had been the target of cyber-attacks originating in China, but Microsoft has said it has no evidence any of its e-mail services or corporate networks being specifically attacked.

When asked if Microsoft had any plan to pull its business out of China, Ballmer answered "No."

"I don't understand how that helps anything. I don't understand how that helps us and I don't understand how that helps China," Ballmer said.

Microsoft has high hopes for its Bing Internet search engine in China, which has only a small share of the market, but could benefit if Google, the No. 2 player behind dominating local rival Baidu Inc, pulls out.

Ballmer's comments run counter to broad political support for Google. The White House said on Thursday it is backing Google's decision to no longer support China's censoring of searches.

A group of Republican lawmakers on Thursday called for tech heavyweights Cisco Systems Inc, Yahoo Inc and Microsoft to speak out against censorship, while House Speaker Nancy Pelosi urged tech companies not to assist China's attempts to prohibit free exchange of ideas.

Google may pull out of China

Google Inc said it may pull out of China because it is no longer willing to accept censorship of search results and after hackers coordinated a sophisticated attack on email accounts of human rights activists using its Gmail service.

Google's surprise announcement on Tuesday came shortly after an adviser to US Secretary of State Hillary Clinton said she will announce a technology policy next week to help citizens in other countries to gain access to an uncensored Internet.

More than 20 other companies were also attacked by the China-based hackers, Google said. Google said the hackers had tried to access the Gmail email accounts of Chinese human rights activists but only managed to access two unidentified accounts, and then only headlines and other data such as when the account was created.

It did not say what information the hackers tried to access from the other corporations, nor which they were. Google said it was now notifying the other affected corporations, adding that it was working with the US authorities.

"These attacks and the surveillance they have uncovered -- combined with attempts over the past year to limit free speech on the Web -- have led us to conclude that we should review the feasibility of our business operations in China," Google said in a statement.

iPhone vulnerable to hacking

Security experts have uncovered flaws in Apple Inc's iPhone that they said hackers can exploit to take control of the popular device, using the tactic for identity theft and other crimes.

Users need to be warned that their iPhones are not entirely secure and Apple should try to repair the vulnerability as soon as possible, they said at the Black Hat conference in Las Vegas, one of the world's top forums for exchanging information on computer security threats.

"It's scary. I don't want people taking over my iPhone," Charlie Miller, a security analyst with consulting firm Independent Security Evaluators, said in an interview.

Miller and Collin Mulliner, a Ph D student at the Technical University of Berlin, also discovered a method that allows hackers to easily knock a victim's iPhone off a carrier's network.

It prevents users from making calls, accessing the Internet and exchanging text messages, they added. They said the information they presented at Black Hat will give criminals enough information to develop software to break into iPhones within about two weeks.

They said they warned Apple of the flaw in the middle of July, but that the company has yet to fix it. "Apple's credibility and reputation could get hurt if they don't respond. Positive buzz is good; negative buzz is much more harmful," said Trip Chowdhry, an analyst with Global Equities Research.

About 4,000 security professionals were in attendance, including some who are really hackers. While experts ferret out software flaws to fix them and protect users, hackers use the same information to devise pranks or commit crimes.

The researchers showed the audience how to break into iPhones by sending computer code via the phone's SMS system. Mobile phones use SMS to send and receive text messages along with software upgrades. They said that the phone's users cannot detect that it is receiving the malicious code.

It is not illegal to disclose ways to hack into computer systems, though it is against the law to use it to break into them. When asked why they would hand over such information to criminals, security experts said they felt it was necessary to alert the public that iPhones were just as vulnerable to attack as personal computers.

"If we don't talk about it, somebody is going to do it silently. The bad guys are going to do it no matter what," Mulliner said.

They have successfully tested the hacks on iPhones running on networks of four carriers in Germany along with AT&T Inc in the United States. They said they believed the methods will work with iPhone carriers around the world.

The two said they used a similar method to break into phones running on Google Inc's Android operating system. Google patched the flaw after they notified the company of the vulnerability.

What makes your email hackable

What's the name of the school you attended? What is the first name of your favourite cousin? Well, email services often protect accounts with these kind of security questions in case holders forget their password. Now, a new study in the US has revealed just how easy the answers of such security questions are for other people to guess - in fact these facts make life simple for hackers, the 'New Scientist' reported.

Researchers at Microsoft have based their findings on an analysis of an experiment, involving 32 email users. Acquaintances of the email users - people with whom they wouldn't normally share their login details - were asked to try and guess the answers users assigned to protect their accounts. The volunteers managed to guess correctly a fifth of the time, raising questions over how secure the commonly used system is, the study found. However, a second study by software giant Microsoft has suggested a more secure alternative -- relying on trusted friends to vouch for you if an account becomes locked.

"Securing webmail is important because email accounts typically allow an attacker access to other accounts, for example, eBay and Amazon. If I can recover these passwords via your email account then I can spend the balance of your credit card on flat-screen TVs," Ross Anderson of Cambridge University was quoted as saying. Under the new system proposed by Stuart Schechter and Rob Reeder at Microsoft, users select several "trustees". If a user becomes locked out of their account their trustees receive a message asking them to download a "recovery code". The user must collect codes from multiple trustees to unlock their account.

A group of 19 Hotmail users trialed the system and 17 successfully regained access to their Hotmail account. That 90-per-cent success rate compares favourably to 80-per-cent success rate of the secret question system, say Reeder. In the trial, most users recovered their accounts within two days. However, when the researchers got users' acquaintances to ask the trustees to give up the codes, many of them did so. Reeder said this attack could be avoided by getting account holders to advise trustees of their role in advance. In the trial, trustees simply received an email containing the code out of the blue.

Rather than replacing the standard secret questions approach, the new method should be an optional choice for users, according to Anderson, who agrees that it is important to train trustees to be appropriately security conscious. But the idea has promise, said Reeder, pointing out that it is not a new idea to have people use third parties to back up their identity.