Author Archives: user469294

The hacker who attacked the website of “Meie Maa” newspaper fined EUR 455

meiemaa.ee_DoS

A 22-year-old hacker has been fined 455 euros for breaching the Meie Maa media website and disabling the comments section, which then diverted readers to a rival site. The attack took place in May, forcing Meie Maa, a media outlet in Saare County, to temporarily shut down its comments section, Meie Maa reported. Readers entering the section were told the site is unsafe and were directed to Saarte Hääl, a rival news site.

The Western District Prosecutor’s Office fined the man 455 euros, of which 100 euros, which has already been paid, will go to Meie Maa as compensation for damages and 355 euros will go to state coffers. Head of Meie Maa, Priit Rauniste, said they are yet to decide whether they will pursue civil action against the man.

Escaped criminal punishment – Western District Prosecutor’s Office closed the criminal proceedings in this case.

Apparently, meimemaa.ee had a XSS vulnerability in the comments section, which was exploited by adding a HTML code which displayed the message and redirected visitor’s browser to other news site.

Not clear how the fine was calculated and what section under Estonian Penal Code was originally imposed against the attacker.

Links:
http://news.err.ee/v/society/e0f267a5-b8f5-45e0-baac-584a1fd61360
http://uudised.err.ee/v/eesti/cbe747dc-22e2-4b9b-ab05-a8d90a1a50b0

31C3 talk: Security Analysis of Estonia’s Internet Voting System

Halderman_Tarvi

Estonia is the only country in the world that relies on Internet voting in a significant way for legally-binding national elections — up to 30% of all voters cast their ballots online. This makes the security of Estonia’s Internet voting system of interest to technologists and citizens the world over. Over the past year, I helped lead the first rigorous, independent security evaluation of the system, based on election observation, code review, and laboratory testing. The findings are alarming: there are staggering gaps in Estonia’s procedural and operational security, and the architecture of the system leaves it open to cyberattacks from foreign powers. Our investigation confirmed the viability of these attacks in the lab, but the Estonian government has chosen to downplay them. We urgently recommend that Estonia discontinue use of the system before the country suffers a major attack.

The presentation contains good technical overview of Estonian i-voting. The presenter argues that Estonian i-voting has weak operational security. Some of the arguments used by the presenter are quite questionable:

Harri Hursti, one member of our team who is a very large Finnish man and known as a prodigious drinker, went out for serious drinking with this very nice Russian fellow, who is the head of security for the election operations team. During this dinner, I am told, each man consumed two bottles of Vodka, after witch nothing can be hidden from the truth. So, Hursti reports that by the end of this evening he had dranked that root password out of the head of security.

Links:
https://events.ccc.de/congress/2014/Fahrplan/events/6344.html
https://www.youtube.com/watch?v=JY_pHvhE4os

Sniffing real world EMV payment card protocol transaction

emv_sniffing_simtrace

Abstract
The objective of this report is to observe and describe a real world online transaction made between a debit card issued by an Estonian bank and a payment terminal issued by a Estonian bank. In this process we can learn how the EMV protocol works and which protocol features are used in a Chip-and-PIN card issued by an Estonian bank.

The transaction analyzed in this report was captured using a terminal from a friendly merchant in Tartu and using a Visa Electron debit card issued by SEB Estonia. The amount of transaction was 0.99 EUR. The transaction was performed in September, 2014. The full output (all requests and responses) with annotation can be found from the appendix.

The report has been published for UT course “Research Seminar in Cryptography (MTAT.07.022)”.

Links:
https://courses.cs.ut.ee/2014/cryptoseminar/fall/uploads/Main/mart-report-f14.pdf

Summary of master’s theses: Attack-tree based risk analysis of Estonian i-voting

attack_tree_vote_publishing_attack

This report analyzes two independent works published in 2014 that model security threats of Estonian i-voting scheme using attack trees. The first one, the master’s thesis of Tanel Torn [11] constructs several realistic attack trees for various types of attacks on Estonian i-voting system and evaluates them using three different state-of-the-art methodologies proposed in attack-tree literature. The second work, the master’s thesis of Ruud Verbij [13], proposes a general framework to allow comparison of different internet voting schemes. Verbij evaluates the proposed framework by applying it on Estonian i-voting protocol.

Despite using different approaches, both Torn and Verbij agree on some of the results. First, they both consider attacks on the Central System to be much more expensive, involving more risk and thus less probable. Second, results of both authors’ analyzes show that revocation attacks are more profitable than vote modification attacks. This in mainly due to the fact that in the former case the attack does not have to go through undetected.

The report has been published for UT course “Research Seminar in Cryptography (MTAT.07.022)”.

Links
https://courses.cs.ut.ee/2014/cryptoseminar/fall/uploads/Main/riivo-report-f14.pdf

Two criminal investigations are underway related to Bitcoin

bitcoin_logo

They warned the mediator that in case anyone operates in said area without licence, this could spell violation as treated by Penal Code come under activity without licence. Following the correspondence, Fiscal Intelligence Unit issued a precept in which they demanded data to determine if the person came under Money Laundering and Terrorist Financing Prevention Act.

«He contested the precept and meanwhile our goal was to get him to give the data and say whether he had deals exceeding €1,000. With this we are now in court and we won at first instance,» explained Mr Paul.

Representative of mediator Priit Lätt said Fiscal Intelligence Unit had no right to require the data.

Links:
http://news.postimees.ee/3028413/bitcoin-offers-options-to-launder-money

PhD thesis: “Deriving Security Requirements from Business Process Models”

ahmed_naved_PhD_thesis

Naved Ahmed PhD thesis: “Deriving Security Requirements from Business Process Models”
Defense date: 16.12.2014 – 16:15 to 17:45 (J. Liivi 2-404, Tartu, Estonia)

Thesis supervisors:
Assoc. Prof. PhD. Raimundas Matulevicius, University of Tartu
Prof. PhD. Marlon Dumas, University of Tartu

Opponents:
Prof. PhD. Andreas L. Opdahl, University of Bergen, Norway
Assoc. Prof. PhD. Rafael Accorsi, University of Freiburg, Germany

Summary:
To consider this need, the approach taken in this thesis is to analyse the business process models from a security perspective to derive security objectives and requirements. The thesis has proposed three complementary contributions: Firstly, security risk-oriented patterns that integrate the security risk analysis into business process models. These patterns supports security risk concepts in business process models that business analyst can understand easily. Secondly, the taxonomy for assessing security in business processes. This taxonomy is used to classify the security risk-oriented patterns and helps analysts to apply these patterns in business process models. Finally, these contributions form a foundation for a method, security requirements elicitation from business processes (SREBP) that performs a systematic elicitation of security requirements for their business processes.

Links:
http://www.ut.ee/en/events/naved-ahmed-deriving-security-requirements-business-process-models
http://dspace.utlib.ee/dspace/bitstream/handle/10062/44267/ahmed_naved.pdf

Estonian journalists discover global leak of mobile telelephone numbers

The site www.whocall.info enables to search for unlisted mobile numbers from all over the world. One can search by phone numbers: entering a number with the international dialing code (such as 372 in Estonia) will prompt the programme to produce the name of the owner of the number. The article’s author Piret Reiljan said that she found many numbers of high-ranking politicians, including Estonian prime minister Mr Taavi Rõivas.

The site does not perform the opposite search: it does not provide numbers of persons if one searches by name, so one has to previously know the number to get the owner’s name. Even so, it is scary to imagine that the search could also be made to work the other way around. It is not known how all these personal number and names might be used. All we know is that it provides numbers, which have been unlisted by their owners and which are not published anywhere.
The owner of the website is not known. The site itself does not provide any contact information besides the name Whocall Ltd.

“This domain name was registered on October 30 of this year, and its owners are not identifiable from public sources,” said RIA expert Veldre.

According to Veldre it is really possible that someone in various ways collected telephone numbers published on Internet and put them in super database. “The situation is complicated by the fact that under the law of another country may be the case that such information gathering and serving is legal activity. I believe that the Data Protection Inspectorate have their say on this issue,” said the expert.

Veldre added, however, that if it is confirmed that the database contains numbers that should not be publicly available and their owners confirm that they did not made their numbers public, them it maybe be possible to find out how these numbers were leaked.

Links:
http://www.balticbusinessnews.com/?PublicationId=ac63e73d-4922-4f28-9675-a2629bb087c7
http://www.aripaev.ee/uudised/2014/11/26/ekspert-ehk-isegionnestub-lekkimise-koht-tuvastada-
http://www.aripaev.ee/uudised/2014/11/26/uks-lekkekoht-facebook

Estonians arrested in cybercrime-related raids across Europe

cybercrime

Europol reports that at least one arrest has been made in Estonia as part of an international operation against computer highjacking by Remote Access Trojans (RATs), led by the French police and coordinated through Europol.

Apart from Estonia, people suspected of misusing remote access Trojans were also detained in the UK, France, Romania, Latvia, Italy and Norway.

The UK’s National Crime Agency (NCA) said that criminals who successfully deploy RATs, can gain complete control over target computers. RATs are often deployed to spy on people via webcams, access banking or other personal information, download new and potentially illegal content, and use the victim’s computer to launch criminal Distributed Denial of Service (DDOS) attacks.

Links:
http://news.err.ee/v/scitech/992e2269-0d18-4742-9b2b-cc96b39cd90f

Interview with TUT Center of Digital Forensics and Cyber Security co-leader Olaf Maennel

Olaf_Maennel

Tallinn University of Technology (TUT) opened a new Center of Digital Forensics and Cyber Security on November 12. The Center will offer technical advice, academic education and training programs, conduct cutting-edge research projects, and raise public awareness of cyber security risks. ERR news interviewed the center’s co-leader, Olaf Maennel, to learn more about the newly opened center and the cyber security issues, as well as about his personal connection to Estonia.

Links:
http://news.err.ee/v/scitech/f503fe99-28fa-4e1c-9738-c4af41b69c42

Tallinn International CyberCrime Conference 2014

logo_tut

Location: Tallinn, Estonia – Radisson Blu Hotel Olympia
On 12 and 13 november 2014 the Tallinn University of Technology organizes the International Cybercrime Conference of 2014. The main agenda of the conference is to announce the official opening of TUT Centre of Digital Forensics and Cyber Security and to discuss current cyber security research.

Conference CyberCrime 2014, day 1, 12.11.2014 (most of the day in estonia – english simultaneous translation, with the exception of 2 presentations in english)

Moderator Aare Tammemäe, FinanceEstonia, Chairman of the Board
09.00 – 10.00 Registration and welcome coffee
10.00 – 10.15 Conference Opening Address: Prof Erkki Truve, Vice rector of Tallinn University of Technology
10.15 – 10.25 Mr Hanno Pevkur, Minister of the Interior, Republic of Estonia
10.25 – 11.10 Plenary Session 1
Key note speaker: Mrs Heli Tiirmaa-Klaar, Cyber Security Policy Advisor, European External Action Service.
EU Cyber Security Strategy and Capacity Building to Fight Cybercrime.
11.10 – 11.20 Mr Üllar Lanno, Estonian Forensics Science Institute.
The beginning of IT forensics in Estonia or how the 2CENTRE Estonia started
11.20 – 11.50 Coffe-break
11.50 – 12.20 Plenary Session 2
Mr Gert Jervan, Dean of Faculty of Information Technology, Tallinn University of Technology; Mrs Anu Baum, 2CENTRE Estonia; Rain Ottis, TUT Centre of Digital Forensics and Cyber Security. TUT Cyber centre – past, present and future
12.20 – 12.25 The importance of the establishment of 2CENTRE Estonia. Welcoming word by Minister of the Justice of the Republic of Estonia, Andres Anvelt
12.25 – 12.50 Signing the memorandum of association of TUT Centre of Digital Forensics and Cyber Security
12.50 – 13.30 Panel Discussion – Erkki Truve, Heli Tiirmaa-Klaar, Andres Anvelt, Priit Pärkna, moderated by Gert Jervan, Dean of IT faculty of TUT
13.30 – 14.30 Lunch
14.30 – 14.50 Ms Ann Mennens – B-CCentre (Belgium). The B-CCENTRE, establishing exchange and cooperation between academia, public and private sector in Belgium: a major challenge
14.50 – 15.10 Ms Cheryl Baker – University College Dublin (Ireland)
Success story of the university (UCD), IT-forensics in Ireland, Irish experience and challenges in the global forensics market
15.10 – 15.40 Coffe-break
15.40 – 16.00 Mr Tanel Tammet, Mr Rain Ottis, Mr Jüri Vain. Introduction of the Four Projects (e-Crime, ECESM, SEREIN, IT-Akadeemia)
16.00 – 16.30 Mr Andres Kütt – Advisor at Estonian Information System’s Authority. E-state, e-governance & e-citizen or why we need experts in digital forensics.
16.30 – 17.00 Conclusions of the Day 1
19.00 – 22.00 Reception hosted by prof Erkki Truve, Vice rector of Tallinn. University of Technology (admittance based on earlier registration). House of Brotherhood of the Blackheads
Pikk str 26, 10133 Tallinn
Phone: +372 631 3199

Conference CyberCrime 2014, day 2 (all day in English), 13.11.2014

Moderator Olaf Maennel
08.45 – 09.15 Registration
09.15 – 10.00 Gorazd Božič, Slovenia
Incident Response and CERT Cooperation in the Modern Age
10.00 – 10.15 Coffee break
10.15 – 11.00 Varis Teivāns, Deputy Manager of CERT.LV
“Role of Digital Forensics in Fight Against Cybercrime in Baltic States”
11.00 – 11.15 Coffee break
11.15 – 12.00 Matthew Sorell, Australia
Beyond metadata: non-cooperative provenance tracing of digital photography
12.15 – 13.15 Lunch
13.30 – 14.15 Nickolas Falkner, University of Adelaide, Australia.
Security and Automated Configuration: Where Standards and Policy Fail, Complexity Will Not be Enough to Save Us.
14.15 – 15.00 Pavel Laptev, Estonia
Cyber Forensics view from the Estonian Forensic Science Institute
15.00 – 15.15 Coffee break
15.15 – 16.00 Gergely Toth, Deloitte Cyber Security Team
An Industry perspective on cyber security challenges
16.00 – 16.40 Olaf Maennel, Professor, Tallinn University of Technology.
Summarizing the 2’nd day of the conference

Links:
http://www.conference-expert.eu/en/cybercrime-conference-2014/162-event-programme
https://www.b-ccentre.be/12-13-november-tallinn-international-cybercrime-conference-2014/