Hacking in Russia for Olympics - on CNBC TV

Impetus

There was an interesting item on hacking in Russia where foreigners visiting the winter Olympics are having their phones and computers etc hacked. They brought a new Apple PC, fresh out of the box, and a mobile phone and powered them up.

The phone was hacked and malware downloaded before they had a second to take their first drink from a cup of coffee. They suggested that it was Russian intelligence installing software to record phone and other conversations and send them back to the perpetrators. The security expert they brought noticed the phone download icon activated, indicating to him that the malware was installed at that point.

When they got back from the coffee, the brand new Apple Mac showed extensive signs of hacking too.

Stuxnet

Ridiculous reporting, typical US media trying to instil fear into the already gullible and blinded US population.

I watched the video.

Real explanation.

Thursday, February 06, 2014
That NBC story 100% fraudulent
By Robert Graham
Yesterday (Feb 5 2014) NBC News ran a story claiming that if you bring your mobile phone or laptop to the Sochi Olympics, it'll immediately be hacked the moment you turn it on. The story was fabricated. The technical details relate to going to the Olympics in cyberspace (visiting websites), not going to there in person and using their local WiFi.

The story shows Richard Engel "getting hacked" while in a cafe in Russia. It is wrong in every salient detail.
They aren't in Sochi, but in Moscow, 1007 miles away.
The "hack" happens because of the websites they visit (Olympic themed websites), not their physical location. The results would've been the same in America.
The phone didn't "get" hacked; Richard Engel initiated the download of a hostile Android app onto his phone.
I had expected the story to be about the situation with WiFi in Sochi, such as man-in-the-middle attacks inserting the Blackhole toolkit into web pages exploiting the latest Flash 0day. But the story was nothing of the sort.

Instead, the hacking in the story was due to the hostility of Olympic themed websites. The only increased danger from being in Russia is geolocation. Google uses your IP address to increase the of rank local sites, so you'll see more dodgy Russian sites in the results. You can disable this feature in your Google account settings.

Absolutely 0% of the story was about turning on a computer and connecting to a Sochi network. 100% of the story was about visiting websites remotely. Thus, the claim of the story that you'll get hacked immediately upon turning on your computers is fraudulent. The only thing that can be confirmed by the story is "don't let Richard Engel borrow your phone".

That leaves us with the same advice that we always give people:
don't click on stuff
patch your stuff (browser, Flash, PDF)
get rid of the really bad stuff (Oracle's Java)
don't click on stuff
oh, and if you really are in Sochi, use VPN over the public WiFi
I gleaned these details from Kyle Wilhoit, the expert quoted in the story, and his Twitter feed. He's working on a blog with the full technical details. I'm sure it'll be great, with lots of details about what hackers can find with Maltego, the dangers of hostile websites, and so on -- the sort of great information totally lost in the nonsense that is the NBC story.

http://blog.erratasec.com/2014/02/that-nbc-story-100-fraudulent.html?fb_action_ids=1462693950618252&fb_action_types=og.likes&fb_ref=.UvSS63LFOuO.like&fb_source=other_multiline&action_object_map=%7B%221462693950618252%22%3A1441984179369278%7D&action_type_map=%7B%221462693950618252%22%3A%22og.likes%22%7D&action_ref_map=%7B%221462693950618252%22%3A%22.UvSS63LFOuO.like%22%7D#.UvS2PDZ_tSL

ETA: Have a laugh

Harold Weiss

Impetus wrote: »

They suggested that it was Russian intelligence installing software to record phone and other conversations and send them back to the perpetrators.

That's where I stopped taking the story seriously.

stupid head

http://motherboard.vice.com/blog/how-nbcs-russian-hack-actually-happened-according-to-the-security-expert-who-set-it-up

Khannie

Harold Weiss wrote: »

That's where I stopped taking the story seriously.

Ah in fairness, if you were hosting the olympics and had a zero day that you could inject onto a large number of foreign phones, sure you'd be mad not to.

RustyNut

Impetus wrote: »

There was an interesting item on hacking in Russia where foreigners visiting the winter Olympics are having their phones and computers etc hacked. They brought a new Apple PC, fresh out of the box, and a mobile phone and powered them up.

The phone was hacked and malware downloaded before they had a second to take their first drink from a cup of coffee. They suggested that it was Russian intelligence installing software to record phone and other conversations and send them back to the perpetrators. The security expert they brought noticed the phone download icon activated, indicating to him that the malware was installed at that point.

When they got back from the coffee, the brand new Apple Mac showed extensive signs of hacking too.

Looks like Snowden might be nixering for the Russians.
Has to pay for the new appartement somehow I suppose.

Impetus

Stuxnet wrote: »

Ridiculous reporting, typical US media trying to instil fear into the already gullible and blinded US population.

I watched the video.

Real explanation.

ETA: Have a laugh

My thoughts when watching this were along the "suspicion haunts the guilty mind" - ie the US is NSA-ing everybody.

There is a massive anti-Russia propaganda offensive in the US media at the moment - documented by Adam Curry and John C Dvorak in this netcast produced last Thursday:

http://mp3s.nashownotes.com/NA-589-2014-02-06-Final.mp3

Impetus

Another nail in the coffin for CNBC/NBC in terms of the company's real agenda and credibility

http://www.techdirt.com/articles/20140207/13475826139/security-researcher-punches-holes-nbcs-everyone-going-to-sochi-will-be-hacked-story-nbc-doubles-down-response.shtml