Hackers claim Apple online data was compromised

A list of 27 user names and encrypted passwords apparently for an Apple website was posted to the Internet over the weekend along with a warning from hacker group Anonymous that the Cupertino-based computer maker could be a target of its attacks.
The list was posted to the Pastebin website, a hosting site for text files, by an unidentified user under the title "Not Yet Serious." It wasn't immediately clear if the user was allied with the Anonymous hacking group, but the existence of the file became widely known after Anonymous linked to it in a Twitter message.
"Not being so serious, but well," the message read before linking to the PasteBin page. "Apple could be target, too. But don't worry, we are busy elsewhere," the message said.
The data appears to be a set of user names and encrypted passwords from an SQL database for an online survey at the Apple Business Intelligence website. The site is currently offline.
Apple did not immediately respond to a request for comment.
In an apparently unrelated posting, a Lebanese grey-hat hacker called idahc_hacker said he had found vulnerabilities on another Apple website. The SQL injection and iFrame code attacks can be used by hackers to gain unauthorized access to data.
Grey hat hackers do not typically hack for malicious purposes and the Lebanese hacker did not post and data obtained from the site.
In pointing out the hacks, he said he was not part of Anonymous or LulzSec, an allied group that disbanded recently.
The Anonymous hacking group has been running an operation "Antisec" against government, law enforcement and corporations for some weeks now. A supporter of the group recently encouraged workers in "corrupt" companies and governments to also leak data. A website called HackerLeaks has been set for the purpose by Peoples Liberation Front, an ally of Anonymous. It is styled on the lines of whistle-blowing site WikiLeaks.

Cloud storage providers need sharper billing metrics

Purveyors of cloud storage services may be doing their customers, or themselves, a disservice by relying on imprecise metrics for billing, argued a researcher at a Usenix conference.
"Disk time is what costs, not I/Os or bytes, and that is what should be the metric in cloud storage systems," said Matthew Wachs, a researcher at Carnegie Mellon University, in a talk at the Usenix HotCloud workshop this week in Portland, Oregon.
Wachs, along with other researchers at Carnegie Mellon and VMware, investigated the topic in their Usenix paper, "Exertion-based billing for cloud storage access."

"Cloud storage access billing should be exertion-based, charging tenants for the costs actually induced by their I/O activities rather than an inaccurate proxy (e.g., byte or I/O count) for those costs," the paper said.
Today, IaaS (Infrastructure-as-a-Service) cloud storage providers such as Amazon or Google typically bill on two factors, the amount of data being stored and the amount of data that is transferred to and from the cloud, or I/O.
While charging based on the amount of data stored is a reasonable metric, Wachs contended, the amount charged for I/O is flawed, given the work expended to read that data from disk or write that data to disk. The cost of handling those bits on disk may vary widely from one instance to another, Wachs pointed out.
"As a result, tenant bills for storage access may bear little to no relationship to the actual costs," the paper said.
Wachs mentioned a number of factors that can lead to this variance, the most prominent being the difference between random and sequential access on the disk.
In sequential access, data is written to or read from one portion of the disk in a continual stream of bits. In random access, the disk head must jump around to different parts of the disk to read or write data.
The difference between these two types of workloads can be immense, Wachs said.
For instance, sequential access can achieve a throughput on an average disk of up to 63.5MB/s (megabits per second), whereas random access can only be executed at 1.5MB/s.
In practical terms, this disparity means that one customer executing lots of random reads and writes is using a lot more of the system's resources than another customer who may be accessing the same amount of data through sequential accesses, even though both customers are charged the same amount.
In the long run, this practice would provide no incentive for customers to establish more efficient data transfer practices, and fiscally penalize those customers who do have such practices in place. It could also erode the profit margins of storage providers, who may not have accounted for these inefficiencies in their original plans.
Other factors may heighten this disparity between workloads even further, Wachs said. For instance, disk caching may eliminate the need to access the disk at all. In cases where caching is used, the customer may actually be severely overcharged. Also, excessive metadata lookups to find the appropriate data location may consume an inordinate amount of resources.
"This is an unsustainable approach because either the client or the provider will be unhappy," Wachs said. "The clients with the easy requests will pay too much and the clients with the difficult requests will pay too little."
Wachs suggested an alternative billing mechanism, one based on disk time, or the amount of time it actually takes the disk to read or write the material.
"When we charge for disk time, and chose a rate for disk time that matches the cost for the provider, the costs are being recovered fairly," Wachs said.
Attendees brought up various issues with this approach. One noted that clients may be willing to pay a bit more overall to get a more predictable and easily understandable bill, mentioning as an example how the cellular phone industry charges on a simple flat rate and per-minute basis rather than how much the actual cell phone towers are used by each customer.
Wachs countered that the disparity between the costs of running a cloud service and what is being charged can be a significant difference, and not just a subtle averaging of the costs.
Cell phone customers probably "aren't losing sleep over whether they are paying $40 a month instead of $30 a month," he said. Businesses that are paying $40 million a month rather than $30 million a month, on the other hand, may want "the accounting and pricing to be a lot closer to the actual cost," he said.
Andrew Warfield, the session chairman for the economics track that Wachs' talk was part of, noted that the presentation was one aspect of a larger challenge now being faced by cloud providers, namely the task of examining current operational practices in a deeper, more complex way in order to offer simpler, less expensive services to their customers.
Existing cloud storage metrics "are appealing from a customer-facing standpoint as the right way to market the whole system," Wachs said. "But you need to have something in the long term that will actually match the cost for the provider," he said.

Hackers move fast to exploit just-patched IE bug

Three days after Microsoft fixed flaw, Symantec spots active attacks

Just three days after Microsoft patched 11 bugs in Internet Explorer (IE), hackers are exploiting one of those vulnerabilities, a security company said Friday.
Microsoft fixed the flaw Tuesday in an 11-patch update for IE. That update was part of a larger Patch Tuesday roll-out that quashed 34 bugs in 16 separate security bulletins.
Most security experts had put the IE update at the top of their priority lists, and urged Windows users to deploy it as soon as possible.
Today, Symantec reported that CVE 2011-1255 -- its assigned ID in the Common Vulnerabilities and Exposures database -- is already being abused.
"So far, we have only seen limited attacks taking advantage of this vulnerability and believe that the exploit is only being carried out in targeted attacks at present," said Joji Hamada, a senior researcher with Symantec's security response team, in a post to a company blog.
Hamada said that Symantec had found an exploit on an apparently-compromised site that automatically downloads an encrypted malicious file to the PC of any user browsing with an unpatched copy of IE8.
The malware shows some bot traits, Hamada added. Once planted on a machine, it contacts a remote server and listens for commands from its hacker overlords.
Although the CVE 2011-1255 vulnerability affects IE6 and IE7 as well as IE8, Symantec has only seen working exploits that target the latter.
IE9, the browser that Microsoft launched in mid-March, is not affected by the vulnerability, although it was also patched Tuesday to address four different bugs.
In the accompanying advisory, Microsoft pegged the flaw as "critical," its most-serious threat level, for IE7 and IE8 on all Windows machines, and for IE6 running on Windows XP. For IE6 on Windows Server 2003 Microsoft rated the bug as "moderate."
Microsoft also assigned a "1" to the vulnerability in its exploitability index, meaning the company expected a reliable exploit to appear within 30 days. The attackers beat that by a significant margin, putting their exploit into play within three days.
Microsoft was made aware of the flaw in late January by VeriSign's iDefense Labs, which had bought the bug from an anonymous researcher through its bounty program.
iDefense's own advisory categorized the vulnerability as a "use-after-free" bug, a type of memory management flaw that can be exploited to inject attack code.
Users unable to apply Tuesday's IE update can stymie the attacks Symantec has spotted by disabling JavaScript.
To turn off JavaScript, users should select the "Tools" menu in IE, then click "Internet Options," the "Security" tab and the "Internet" content zone. Next, click "Custom Level" and in the "Settings" box, click "Disable" under "Active scripting." Click "OK" in the current dialog box.