Interior IG Team Used Evil Twins and $200 Tech to Hack Department Wi-Fi Networks

Hackers gained unauthorized access to the Interior Department’s internal systems by breaching agency Wi-Fi networks using $200 homemade hacking kits. Luckily, the attackers were white hat hackers from the Interior Office of the Inspector General.

Earlier this year, the Interior IG’s IT audit team conducted several penetration tests at bureau offices, using easily accessible hacking tools to demonstrate the fragility of the agency’s wireless networks.

“We found that the department did not deploy and operate a secure wireless network infrastructure,” the team wrote in an audit report released Wednesday. “Specifically, the department’s wireless network policy did not ensure bureaus kept inventories of their wireless networks, enforce strong user authentication measures, require periodic tests of network security, or require network monitoring to detect and repel well-known attacks.”

To expose just how vulnerable the agency’s networks are, the pentesting work was done entirely by the IG’s in-house IT audit team, which constructed portable test units that fit inside backpacks and purses and could be operated using a smartphone. Auditors then set up in public areas near Interior offices—such as park benches—or got limited access to buildings and set to work infiltrating the agency’s networks.

Each kit cost less than $200 and used widely available open source software.

“These attacks—which went undetected by security guards and IT security staff as we explored department facilities—were highly successful,” the team wrote, noting they were able to intercept and decrypt network traffic at multiple offices.

The intrusion tests showed Interior’s poor Wi-Fi security, as well as other deeper problems with resilience.

At two locations, the team was able to go “far beyond the wireless network at issue” and again access to the department’s internal networks. The IG hackers were even able to steal the login credentials of an IT employee, gaining access to the internal help desk system and visibility into all of that employee’s open tickets.

“We also found that several bureaus and offices did not implement measures to limit the potential adverse effect of breaching a wireless network,” the report reads. “Because the bureaus did not have such protective measures in place, such as network segmentation, we were able to identify assets containing sensitive data or supporting mission-critical operations.”

The report outlines two types of attacks testers used to gain access to Interior networks: one in which the attackers deciphered the pre-shared key—like the single ID and password used to log on to a home network—and another in which they stole unique credentials using “evil twins” to access a more secure network.

In the former scenario, the team used the homemade hacking kits to eavesdrop on wireless network traffic, waiting for someone to log on or otherwise transmit encoded credentials. Depending on the quality of the password, the attacker might be able to break the encryption there on the spot. If it’s too complex, the “credentials can be transmitted to higher performance remote systems where additional efforts could be dedicated to breaking the encoding,” the report states.

“There is no control that can prevent

Read more

Twins abduct, beat man for ransom while on house arrest for murder, authorities say

Twin brothers under house arrest on murder charges duct-taped a man and cut his face and toes demanding a ransom payment, authorities said.

On Friday, the U.S. Attorney’s Office for the Southern District of Florida announced 23-year-old twin brothers Devon Cooke and Donavan Cooke, of Miami Gardens, were charged with carjacking and kidnapping after they allegedly abducted and assaulted a man in an attempt to collect ransom money.

The brothers were under house house arrest on murder and attempted murder charges when the incident happened.

Authorities say on Tuesday the victim, who was not identified, drove to the twins’ home in Miami Gardens to collect money. When he arrived, the brothers assaulted him, snatched his car key and dragged him out of the car and into their house.

The brothers then bound him to a chair using duct tape and began beating him, authorities said. They used a knife to cut his face and toes and wrapped a dog leash around his neck, chocking him unconscious.

A witness told authorities they heard the man pleading for his life. The brothers threatened to kill him if he didn’t come up with the ransom money, the press release read.

With a gun to the man’s head, he was forced to make a call to an unknown person and told them to put cash, a Rolex and other jewelry into a bag and drive to a spot the twins designated.

An accomplice to the brothers then arrived at the home and stuffed the man into a car and took him to the exchange spot. Once there, the man ran away and the accomplice drove off with the ransom.

Authorities say investigation led by police officers led to the Cooke twins. FBI agents found some of the items used in the abduction and beating.

The twins are in federal custody and made their first appearance in Miami federal court Friday. Each brother faces up to 15 years in federal prison on the carjacking charge and life in prison on the kidnapping charge.

———

©2020 Miami Herald

Visit Miami Herald at www.miamiherald.com

Distributed by Tribune Content Agency, LLC.

Continue Reading

Source Article

Read more