Hackers mull physical attacks on a networked world

Want to break into the computer network in an ultra-secure building? Ship a hacked iPhone there to a nonexistent employee and hope the device sits in the mailroom, scanning for nearby wireless connections.

How about stealing someone's computer passwords? Forget trying to fool the person into downloading a malicious program that logs keystrokes. A tiny microphone hidden near the keyboard could do the same thing, since each keystroke emits slightly different sounds that can be used to reconstruct the words the target is typing.

Hackers at the DefCon conference here were demonstrating these and other novel techniques for infiltrating facilities Friday.

Their talks served as a reminder of the danger of physical attacks as a way to breach hard-to-crack computer networks. It's an area once defined by Dumpster diving and crude social-engineering ruses, like phony phone calls, that are probably easier to detect or avoid.

As technology gets cheaper and more powerful, from cell phones that act as personal computers to minuscule digital bugging devices, it's enabling a new wave of clever attacks that, if pulled off properly, can be as effective and less risky for thieves than traditional computer-intrusion tactics.

Consider Apple Inc.'s iPhone, a gadget whose processing horsepower and cellular and wireless Internet connections make it an ideal double agent.

Robert Graham and David Maynor, co-founders of Atlanta-based Errata Security, showed off an experiment in which they modified an iPhone and sent it to a client company that wanted to test the security of its internal wireless network.

Graham and Maynor programmed the phone to check in with their computers over the cellular network. Once inside the target company and connected, a program they had written scanned the wireless network for security holes.

They didn't find any, but the exercise demonstrated an inexpensive way to perform penetration testing and the danger of unexpected devices being used in attacks. If they had found an unsecured router in their canvassing, they likely would have been able to waltz inside the corporate network to steal data.

To keep the phone running, the researchers latched on an extended-life battery that lasts days on end. But they only really need a few minutes inside a building to test the network's security.

"It's like saying, once you get into Willy Wonka's Chocolate Factory, and you're in the garden where everything's edible, you have it all," Graham said in an interview.

The attack won't work, of course, if a company's wireless network is properly secured. In that case, Graham and Maynor said there's likely no big loss: the package that had been sitting in the mailroom would probably be mailed back to them so they could try it again elsewhere.

Another talk focused on new twists to Cold War-era espionage tactics that could allow criminals to sidestep the locks on computer networks.

Eric Schmiedl, a lock-picking expert and undergraduate at the Massachusetts Institute of Technology, outlined several surveillance methods long used by government intelligence agents that have become more accessible to garden-variety criminals because of the falling price of the technologies.

For example, Schmiedl said even low-budget criminals now have a way to eavesdrop on conversations through a window. It involves bouncing a beam from a laser pointer off the glass and through a light sensor and audio amplifier.

If the people inside the room are close enough to the window, their conversation creates vibrations that the equipment can translate into a crude reconstruction of the conversation, Schmiedl said.

"We're burning the candle at both ends," he said. "The technology is becoming easier and cheaper and anybody can do it. And at the same time there's more incentive now to do it. These are two trains on a collision course. The question is when they're going to collide."

Afghan al-Qaeda figure warns of attacks on West

Al-Qaeda's top commander in Afghanistan warned of more attacks against the West in a video posted on the Web that paid tribute to a suicide bomber said to have carried out the June bombing of the Danish embassy in Pakistan.

The blast killed six, including one Danish citizen, and caused widespread destruction in the Islamabad neighborhood. Al-Qaeda quickly claimed responsibility soon after the attack, saying it was carrying out Osama bin Laden's promise to exact revenge over the publishing of a cartoon of Islam's Prophet Muhammad in Danish papers.

It was the deadliest strike against Denmark since the reprinting of the cartoon earlier this year.

In the new, 55-minute video posted late Thursday, al-Qaeda's commander in Afghanistan commander Mustafa Abu al-Yazeed warned "once more the Crusader states that insult, mock and defame our Prophet ... that we will exact revenge at the appropriate time and place."

Abu al-Yazeed, who is Egyptian and who is also known as Abu Saeed al-Masri, said the embassy attack in Islamabad was "but the beginning" and called on Muslim youth in the West to "retaliate" against the "enemies of Islam and Muslims in whose midst they live."

The video's authenticity could not be independently verified. It was posted on an Islamic militant Web forum commonly used by al-Qaeda to issue videos and bore the logo of the terror group's Al-Sahab media arm.

The video also showed the last testament of the Saudi bomber purportedly behind the embassy attack, known by his nomme de guerre Abu Ghareeb al-Makki. His real name was given as Kamal Saleem Atiyyah al-Fudli al-Hathli.

Al-Makki is shown wearing an explosives vest and head scarf as he recounts his plan. He then gets into a car, followed by a computer-animated segment that reconstructs the attack.

The unusually elaborate and lengthy video was made as a documentary and included segments from statements by Danish, Dutch and U.S. officials, as well as Saudi and Jordanian royals, incorporated with remarks by various al-Qaeda figures.

"As for my final message to the worshippers of the cross in Denmark, I tell them, Allah permitting, this isn't the first nor the last retaliation," al-Makki says. "We will wipe you from the face of the earth."

In August, Pakistani officials said they were trying to confirm whether a suspected militant killed in fighting in the tribal Bajur area was Abu al-Yazeed, but there has been no confirmation since. Thursday's video did not indicate when the footage of Abu al-Yazeed was filmed.

Officials in Denmark did not immediately comment the new threats.

But the Danish intelligence service PET warned last month that the country faces the worst terror threat in many years with a possible attack happening at any time. It said the 2006 publication of 12 drawings of Prophet Muhammad that sparked riots across the Muslim world, and Denmark's military involvement in Iraq and Afghanistan have helped focus extremists' attention on the small Nordic country.

The cartoons angered Muslims because they depicted Muhammad as violent and licentious. Also, Islamic law bans any depiction of the prophet, even favorable, for fear it could lead to idolatry.

Malaysia's leader vows to foil opposition takeover

Malaysia's prime minister has vowed to foil opposition leader Anwar Ibrahim's plan to seize power, but denied trying to send government lawmakers on an overseas trip to hamper them from defecting to the opposition.

Anwar has threatened to engineer a slew of defections by legislators from Prime Minister Abdullah Ahmad Badawi's ruling National Front coalition by Sept. 16, stirring deep anxiety among members of the coalition that has ruled Malaysia for 51 years.

Abdullah said at a news conference late Friday that his administration will "make sure that whatever they (the opposition) want to do on Sept. 16 will not happen."

"They're depending very much on our party people deserting us. Our party people will not desert us to give them the advantage of setting up a government on Sept. 16," Abdullah said.

The National Front retained power with only a simple parliamentary majority in March national polls, its worst electoral performance ever. Anwar's three-party opposition alliance needs at least 30 government lawmakers to defect to topple Abdullah's administration.

A National Front club announced Thursday it was organizing an "educational field trip" abroad this month for nearly 80 coalition lawmakers. The sudden announcement sparked speculation that the trip was a plot to stop lawmakers from defecting.

Local media have reported that the tour to study agricultural technology would be free for all participants. Organizers were still working out details, but the lawmakers would likely spend two weeks in several countries, possibly Australia, New Zealand, China or Taiwan.

Abdullah denied the trip was politically motivated, stressing that the lawmakers involved were "not people who want to cross over from the National Front to the opposition."

"If they want to go, let them go. Why link it to Sept. 16?" Abdullah said.

Most government leaders insist that Anwar's threat to oust the National Front is a bluff. Anwar, a former deputy prime minister, won a by-election last month that enabled him to re-enter Parliament and to become prime minister if his alliance takes power.

So far, no National Front lawmakers have declared any immediate intention to defect since March, though speculation has intensified in recent days that a first wave of crossovers could be announced as early as next week

South Sumatra outlaws Ahmadiyah

South Sumatra governor Mahyuddin N.S. on Monday issued a decree banning Islamic minority sect Ahmadiyah and any activities of the Indonesian Jamaah Ahmadiyah (JAI) organization from the region.

Mahyuddin said the decree was made in accordance with a joint- ministerial decree issued earlier this year ordering the sect to stop all religious activities or face charges for blaspheming Islam.

South Sumatra is the second region to outlaw the sect after West Sumatra.

In the decree, the governor also ordered the local Religious Affairs Agency and the High Prosecutors' Office to coordinate and take necessary measures in accordance with the ban.

The governor said the decision to ban Ahmadiyah was taken after a meeting between the regional administration, Indonesian Ulema Council (MUI), Raden Patah State Islamic Institute, Religious Affairs Agency, prosecutors' office, police and several Islamic organizations.