China Hacks At Rates

Beijing sharply cuts interest rates to aid the country's faltering economy.

• World Bank: China Needs Balanced Development
• Beijing's Confidence Game
• China Cooling Too Quickly

China Hacks At Rates

Parmy Olson, 11.26.08, 11:50 AM EST

Beijing sharply cut interest rates to aid the country's faltering economy.

WASHINGTON (CNN) -- Computers at the headquarters of the Barack Obama and John McCain campaigns were hacked during the campaign by a foreign entity looking for future policy information, a source with knowledge of the incidents confirms to CNN.

Workers at Barack Obama's headquarters first thought there was a computer virus.

1 of 2

The source said the computers were hacked mid-summer by either a foreign government or organization.

Another source, a law enforcement official familiar with the investigation, says federal investigators approached both campaigns with information the U.S. government had about the hacking, and the campaigns then hired private companies to mitigate the problem.

U.S. authorities, according to one of the sources, believe they know who the foreign entity responsible for the hacking is, but refused to identify it in any way, including what country.

The source, confirming the attacks that were first reported by Newsweek, said the sophisticated intrusions appeared aimed at gaining information about the evolution of policy positions in order to gain leverage in future dealings with whomever was elected.

The FBI is investigating, one of the sources confirmed to CNN. The FBI and Secret Service refused comment on the incidents. Watch Brian Todd's report on the investigation. »

The sources refused to speak on the record due to the ongoing investigation and also because it is a sensitive matter involving presidential politics.

As described by a Newsweek reporter with special access while working on a post-campaign special, workers in Obama's headquarters first detected what they thought was a computer virus that was trying to obtain users' personal information.

The next day, agents from the FBI and Secret Service came to the office and said, "You have a problem way bigger than what you understand ... you have been compromised, and a serious amount of files have been loaded off your system."

One of the sources told CNN the hacking into the McCain campaign computers occurred around the same time as the breach into those of Obama's campaign.

Representatives of the campaigns could not be reached for comment on the matter.

Testing for Injection Exposures

Now that you understand the basics of SQL injection, LDAP injection, XPATH injection, and OS command injection, it is important that you test you web applications to verify their security. Many methods can be used in testing for injection flaws in web applications. The following section describes an automated method to test for injection flaws, including SQL, LDAP, XPath, XQUERY, and OS commands, using iSEC’s SecurityQA Toolbar. The SecurityQA Toolbar is a security testing tool for web application security. It is often used by developers and QA testers to determine an application’s security both for specific section of an application as well as the entire application itself. For more information on the product, visit www.isecpartners.com.

Buffer overflows are one of the more complex injection attacks, as they take advantage of developers misusing memory. Like command injection, a successful buffer overflow attack gives the attacker complete control of the remote machine.

Some programming languages, such as C and C++, place memory management responsibilities on the developer. If the developer is not careful, user input could write to memory that was not intended to be written to. One such memory location is called the return address of a stack. The return address holds the memory address of the next machine instruction block to execute. If an application is vulnerable to buffer overflows, an attacker could send a very long string to the web application—longer than the developer expected. The string could potentially overwrite the return address, telling the web application what machine instructions it should execute next. The injection aspect of buffer overflows is that the attacker injects machine instructions (called shell code) into some user input. The attacker somewhat needs to know where the shell code will end up in the memory of the computer running the web application. Then the attacker overwrites the return address to point to the memory location of the shell code.

Exploiting buffer overflows are nontrivial, but finding them is not as difficult, and finding buffer overflows on a local machine is easy. You need only send very long strings in all user inputs. We suggest inputting predictable strings, such as 10,000 capital As, into each input. If the program crashes, it is most likely due to a buffer overflow. Repeat the crash while running the application in a debugger. When the program crashes, investigate the program registers. If you see 41414141 (41 is the ASCII representation of a capital A) in the SP register, you have found a buffer overflow.

Finding buffer overflows on remote machines, such as a web application, is a lot more difficult, because attackers cannot view the contents of the web application’s registers, and it may even be difficult to recognize that the web application has even crashed. The trick to finding buffer overflows on web applications is to do the following:

1. Identify what publicly available libraries or code the web application is running.

2. Download that code.

3. Test that code on your local machine to find a buffer overflow.

4. Develop exploit code that works on your local machine.

5. Attempt to execute the exploit code on the web application.

Guz Online

Every speciality has his/her own definition for following terminology.

I will try to do my best how I got those.
Maybe I can give you some examples to understand more.
Especially in computer security field, a lot of confusing stuffs are going on.
Make it sure to keep thinking more and more.

Endurance
Passion
Efforts
lead you close to your goal.

I am still pursuing my dream/my final destination.

Let me show you more......


Terminology:

1. Confidentiality - Ensures secrecy or privacy of information
2. Integrity - Gurantees unauthorized modifcation of data
3. Availability - Keep availability of data when a legitimate user want to access