The Latest


Microsoft announced a number of fun new features for its Edge Chromium browser today, and they’re mostly rolling out over the next few months. I’m impatient, so I took a look at what’s coming—vertical tabbed browsing, smart copying-and-pasting, password-checking, and organized “Collections”—and found all the extensions and workarounds you need to try these features out right now.

Vertical Tabs

The problem with the current implementation of tabs in nearly every major browser is that the more tabs you open, the worst your experience gets. I don’t mean to blame you for the unpleasant number of websites you have sitting in the background of your browser. It’s an ugly situation, but sometimes unavoidable. However, the more tabs you jam into your screen, the harder it is to see what each tab actually is—meaning that the very act of navigating to a tab to process its contents, and ideally close it, becomes a trial-and-error process that’s almost guaranteed to encourage you to do anything else.

Enter vertical tabs. Because who needs tiny horizontal tabs when you can instead view a lovely (albeit long) list of vertical tabs—each with the name of the website proudly displayed in the side of your browser, for easier finding. Vertical tabs will soon hit Microsoft’s Edge Chromium browser, but there’s no reason you can’t get started trying them out right now.

Since Edge Chromium supports Chrome extensions (no matter how much your browser might yell at you), I recommend checking out two. First, try vTabs, which is a quick and verbose way to unlock a vertical sidebar for your tabs. There are way too many options for you to fiddle with when installing it, so I recommend unchecking everything but the basic thing you want—vertical tabs—and sticking with that. And when you do, your browser will look something like this:

Yes, I know. The top tabs still exist. Just ignore them or hit F11 to drop your browser into full-screen mode to make them temporarily disappear. And, yes, the extension works on some websites and not on others. Still, it’s a quick little way to see if you like the implementation before it becomes a better, cleaner option in Edge Chromium itself.

I’m also a fan of the Tree Style Tab extension. It’s not a sidebar—sorry—but it has a nifty little trick to help you stay organized with vertical tabs. All the tabs currently open in your browser appear as their own entities. When you open a new tab from any of them, that tab appears nested under the site that created it, like so:

Close that primary tab that started everything, and the new tabs you opened from them will become their own separate entities—ruining your organization. But if you’d like to see a breadcrumb-like trail of how you got to wherever you are among all the open tabs you have, it doesn’t get much more useful than this extension.

Smart Copy

Microsoft’s new “Smart Copy” feature, arriving in Edge Chromium at some future point, is designed to allow you to preserve the formatting of that which you copy from a website to another application. In other words, when you go to copy a table from a website to an app like Excel, it won’t look like ass:

You can replicate this functionality—for tables, at least—using an extension like Table Capture. Install it, then go ahead and copy and paste something from the web into your favorite spreadsheet application.

This extension isn’t quite as “paint what you want to select” as Microsoft’s Smart Copy feature—and I couldn’t find a data table complex enough that warranted the extension, but that doesn’t mean they don’t exist. A number of the extension’s users note how this helped them copy into Excel that which they couldn’t simply highlight, copy, and paste. And if nothing else, it’s a much faster way to copy a full table to your clipboard than that method.

Also, Table Capture’s author, George Mike, is awesome. When you go to uninstall the extension, you see this:

Now that’s customer service, especially since he lets people use most of the extension’s primary functionality for free.

Password Monitor

This one’s easy. Following just about everyone else, Microsoft is unveiling an Edge Chromium feature that will alert you if, or when, your passwords have been compromised in some kind of data breach. Better yet, Microsoft will even make it easy for you to change them by giving you a quick and easy link to your various services’ password-reset pages.

Zero for zero: Nailed it.
Screenshot: David Murphy

There are plenty of extensions that can mimic this functionality—or, at least, give you enough of a warning that you can then go change your passwords as needed. Google’s own Password Checkup extension comes to mind. The free password manager LastPass has a “security challenge” feature that lets you scan for compromised passwords among your database; the ever-popular 1Password has a similar “Watchtower” feature.

Collections

No need to find a third-party extension to get a taste of Microsoft’s “Collections” feature for Edge Chromium, an easy way to organize and export saved information from a number of different websites. You can enable that in the stable version of Edge Chromium right now, thanks to a little hack.

To get started, find the shortcut you use to launch Edge. Right-click on it, select “Properties,” and look for the “Target” line. It should end with something like msedge.exe”, but it might also have some extra data appended after, like--profile-directory=Default

After whatever comes last, you’ll want to add the following code (with a space between it and whatever came last):

--enable-features=msEdgeCollections

That should look something like this:

Once you’ve done that, launch Edge Chromium as normal, and you’ll see your new Collections option in the upper-right corner. Click it to get started building your first collection of content—websites you’ve visited and notes you want to take.


from Lifehacker https://lifehacker.com/how-to-try-out-edge-chromiums-latest-features-months-be-1842562597

A federal court has ruled that violating a website's tems of service is not "hacking" under the Computer Fraud and Abuse Act.

The plaintiffs wanted to investigate possible racial discrimination in online job markets by creating accounts for fake employers and job seekers. Leading job sites have terms of service prohibiting users from supplying fake information, and the researchers worried that their research could expose them to criminal liability under the CFAA, which makes it a crime to "access a computer without authorization or exceed authorized access."

So in 2016 they sued the federal government, seeking a declaration that this part of the CFAA violated the First Amendment.

But rather than addressing that constitutional issue, Judge John Bates ruled on Friday that the plaintiffs' proposed research wouldn't violate the CFAA's criminal provisions at all. Someone violates the CFAA when they bypass an access restriction like a password. But someone who logs into a website with a valid password doesn't become a hacker simply by doing something prohibited by a website's terms of service, the judge concluded.

"Criminalizing terms-of-service violations risks turning each website into its own criminal jurisdiction and each webmaster into his own legislature," Bates wrote.

Bates noted that website terms of service are often long, complex, and change frequently. While some websites require a user to read through the terms and explicitly agree to them, others merely include a link to the terms somewhere on the page. As a result, most users aren't even aware of the contractual terms that supposedly govern the site. Under those circumstances, it's not reasonable to make violation of such terms a criminal offense, Bates concluded.

This is not the first time a court has issued a ruling in this direction. It's also not the only way the courts have interpreted the frustratingly vague Computer Fraud and Abuse Act.


from Schneier on Security https://ift.tt/2JslwdZ

Personally identifiable information (PII) belonging to more than 4.9 million people from the country of Georgia – including full names, home addresses, dates of birth, ID numbers, and mobile phone numbers, including that of dead people – was published on a hacking forum on Saturday.

That’s more than the current total estimated population: according to the National Statistics Office of Georgia, as of 2019, the country had about 3.7 million people.

The data set was first spotted by Under the Breach, a data breach monitoring and prevention service. ZDNet reports that it’s been shared online in a 1.04 GB MDB (Microsoft Access database) file.

One respondent to the Twitter post from Under the Breach said that this is “very old data” that’s been “shared several times on many open/closed forums” and that whoever shared it “is probably a leecher” (link added).

In fact, it appears that all the records date back to 2011.

Under the Breach initially thought that the entire country’s voter database had been ripped off from Georgia’s Central Election Commission (CEC). But the CEC denied it yesterday, saying that it doesn’t capture some of the data included in the dump – including that of dead people.

From a Google translation of its statement:

The CEC portal provides information on about 3.5 million voters, which does not include information about the dead; However, the CEC does not transmit voter lists for the purpose of forming a voter list and therefore does not have information on the voter’s father’s name, telephone number or ID number in the voter database.

The CEC said that it didn’t process the data published on the non-named hacker forum and that the database differs from what the election administration has access to, including in terms of data, format and database structure.

Nor has any cyber incident been reported to the CEC, its statement said. Finally, data verification has shown that the personal numbers and addresses of the data published on the forum don’t match those in the CEC voter database, the commission said.

Under the Breach shared the data with ZDNet, which communicated with one of the people who shared the data on the forums. They declined to say where they got the data from, but later, after ZDNet waved the CEC’s statement in their face, clarified that it wasn’t the CEC. Sorry, they said, we misunderstood: our English isn’t great.

The data-dump sharer said that the data can be verified on the CEC’s website, not that it had been leaked from the commission in the first place.

ZDNet has provided links to the leaked data to Georgian authorities who it says are now investigating the breach.

Latest Naked Security podcast


from Naked Security https://ift.tt/340izLi

The Kwampirs (aka Orangeworm) attack group continues to target global healthcare entities in this time of crisis, the FBI has warned.

Kwampirs

“Targeted entities range from major transnational healthcare companies to local hospital organizations,” the Bureau noted.

“The FBI assesses Kwampirs actors gained access to a large number of global hospitals through vendor software supply chain and hardware products. Infected software supply chain vendors included products used to manage industrial control system (ICS) assets in hospitals.”

Kwampirs

This is the third FBI private industry notification since the beginning of the year about the group’s activities and the modular Kwampirs RAT it uses.

According to the alert:

  • The attack group first establishes a broad and persistent presence on the targeted network and then delivers and executes the Kwampir RAT and other malicious payloads
  • Kwampirs actors have successfully gained and sustained persistent presence on victim networks for a time period ranging from three to 36 months
  • The Kwampir RAT is modular and, depending on the target, different modules are dropped. But it seems that the threat actors main goal is cyber espionage
  • Significant intrusion vectors include: lateral movement between company networks during mergers and acquisitions; malware being passed between entities through shared resources and internet facing resources during the software co-development process; and software supply chain vendors installing infected devices on the customer/corporate LAN or customer/corporate cloud infrastructure.

“Kwampirs campaign actors have targeted companies in the imaging industry, to include networked scanner and copier-type devices, with domain access to customer networks. The FBI assesses these imaging vendors are targeted to gain access to customer networks, including remote or cloud management access, which could permit lateral CNE movement within victim networks,” the FBI added.

While the Kwampirs/Orangeworm threat actors is considered to be an APT (Advanced Persistent Threat), it is currently unknown whether they are state-backed.

What is known is that they don’t go after PII, payment card data, and are not interested in destroying or encrypting data for ransom – though, according to the FBI, several code-based similarities exist between the Kwampirs RAT and the Shamoon/Disstrack wiper malware.

The group also doesn’t limit their targeting to healthcare and software supply chain organizations. To a lesser extent, they go after companies in the energy and engineering industry as well as financial institutions and prominent law firms, across the United States, Europe, Asia, and the Middle East.

Defense and post-infection remediation

The notice delivers best practices for network security and defense to be incorporated before infection, recommended post-infection actions and identifies residual Kwampirs RAT host artifacts that can help companies to determine if they were a victim.

Indicators of compromise and YARA rules to identify Kwampirs malware have been provided in separate documents.

SANS ISC handler (and Dean of Research at the SANS Technology Institute Twitter) Johannes Ullrich notes that Kwampirs will likely enter an organization’s network undetected as part of a software update from a trusted vendor.

“Anti-malware solutions will detect past versions. But do not put too much trust in anti-malware to detect the next version that is likely tailored to your organization,” he added, and offered helpful advice for writing abstracted detection signatures that might come in handy.

While not recently updated, the MITRE ATT&CK entry for the Kwampirs malware may also be helpful. For more technical details about the malware, you might want to check out ReversingLabs’s recent analysis.


from Help Net Security https://ift.tt/2R0IzAJ

How fast does malware spread? Does it spread faster than security patches for zero days?

And what about fake news? Could the World Health Organization (WHO) ever manage to spread reliable information about COVID-19 protection strategies faster than misinformation? Such as, for example, the incorrect claim that gargling with salt water prevents the virus from penetrating cells in the throat?

Researchers say yes: Good data can beat bad data in the race to spread. In a paper published on Friday, researchers from North Carolina State University (NC State) and the Army Research Office have demonstrated a new model of how competing pieces of information spread in online social networks and the Internet of Things (IoT).

The model uses network topology that includes factors such as network size, how interconnected it is, and which networks slow down data with bottlenecks caused by a limited number of nodes. The researchers suggest that their findings could be used to quickly disseminate accurate information so as to displace false information about anything – from computer security to public health.

It would be like figuring out exactly where to make an injection so that a vaccine goes to work faster than the illness it’s battling, according to Jie Wang, a postdoctoral researcher at NC State and first author of the paper.

Ultimately, our work can be used to determine the best places to inject new data into a network so that the old data can be eliminated faster.

According to the findings, a network’s size matters when it comes to the speed of good data displacing bad data. Bigger isn’t always better, though: rather, the speed at which good data travels is primarily affected by network structure.

A highly interconnected network can disseminate new data very quickly. And the larger the network, the faster the new data will travel.

However, in networks that are connected primarily by a limited number of key nodes, those nodes serve as bottlenecks. As a result, the larger this type of network is, the slower the new data will travel.

The researchers created an algorithm that they used to assess where, exactly, to inject new data so that it can spread as fast as possible.

Wenye Wang, co-author of a paper on the work and a professor of electrical and computer engineering at NC State:

Practically speaking, this could be used to ensure that an IoT network purges old data as quickly as possible and is operating with new, accurate data.

Jie Wang, a postdoctoral researcher at NC State and first author of the paper, says that the findings are applicable to social networks in that they could be used to optimize the speed at which accurate information spreads when it comes to subjects that affect the public: for example, it could be used to battle the spread of misinformation.

That’s an important fight, given what can be the life-threatening consequences of misinformation’s fast spread.

For example, in 2018, Facebook banned the mass-forwarding of messages in its WhatsApp chat app, following people getting lynched in a fake-news crisis that seized India, Myanmar and Sri Lanka. Last week, Facebook confirmed that it may do the same with Facebook Messenger, in an effort to lasso the runaway forwarding of COVID-19 fake news and rumors.

The paper, “Modeling and Analysis of Conflicting Information Propagation in a Finite Time Horizon,” was published in the journal IEEE/ACM Transactions on Networking.

Latest Naked Security podcast


from Naked Security https://ift.tt/2QVNGC3

Last week we wrote about a WhatsApp hoax that was spreading widely, warning people to look out for a cybersecurity catastrophe that simply wasn’t going to happen.

That was known as the Martinelli/Dance of the Pope hoax, and it claimed that two dangerous videos are about to come out that will hack or wipe out your phone so it can’t be fixed.

This week, there’s another WhatsApp hoax that suddenly started spreading, apparently forwarded in good faith by lots of worried users:

Straight from the City of London Police fraud team – Extremely sophisticated scam going about this morning. Definitely Danske bank customers but possibly all banks. You get a message saying a payment hasn’t been taken eg O2,Vodafone or EE [UK mobile providers] and to click here. As soon as you touch it the money is gone. They already have all your details and it’s the most advance scam the bank has ever seen. Pass this on to everyone. Please. This is from work this morning – they are being inundated with calls – thousands flying out of peoples accounts! Spread the word!

Before we look at the plausibility of this – spoiler alert: it’s somewhere between implausible and impossible, and it didn’t happen – let’s check the very first claim in the message.

Hoaxes of this sort often include what we call “claims to authority” – Martinelli/Dance of the Pope claimed that its story had been announced on BBC Radio, for example – that are there to add a veneer of credibility.

But here’s what the City of London Police tweeted a few hours ago:

Please be aware of false message currently being circulated

The City of London Police in turn link you to UK National Fraud and Cyber Crime Reporting Centre’s ActionFraud website, where you will see that the “City of London Police hasn’t issued any alerts about fake messages from Danske Bank.”

So, please don’t spread this hoax – you’re just creating fear and uncertainty among any of your friends and family who might have received a text message recently.

Could it happen?

The brazenly bogus start to the text in this hoax – an outright lie about a law enforcement team – suggests that it didn’t evolve from scraps of fact but was put together deliberately, though it’s anyone’s guess why.

As for the rest of the message, there’s a tiny ring of truth throughout, but so-called “unpaid mobile bill” text message scams don’t work quite as directly as the hoax claims.

Typically, the link in the SMS takes you to a website where a fake login page appears and that’s where the password stealing happens.

Indeed, we wrote about a very similar scam, albeit in a slightly different guise, late last week, where crooks texted you a “failed home delivery” message where you allegedly needed to pay in a $3 shortfall before the delivery could be completed.

Mobile phone billing scams use a different pretext but typically follow a similar sequence.

A URL (web link) in the SMS takes you to your broswer; your browser expands on the details of the scam and gives you a “payment” link; and that link in turn takes you to a page that is designed to resemble a typical credit card payment portal.

All the data you put into the bogus payment form goes not to your bank but directly to the crooks, and that’s how they attack your credit card later on – or sell the data on so someone else can do so.

Browser exploits

In theory, a booby-trapped web page that was rigged up to crash your browser might be able to launch malware on your phone without warning and without asking for permission, even if all you did was tap on the link in the SMS to take you there.

But that sort of attack is very rare these days, and almost certainly wouldn’t lead to the crooks getting hold of your banking password immediately and instantly withdrawing money.

If nothing else, the crooks would still have to persuade you to type in your banking password or card number while their malware was running, just as they would do via a fake website, so the attack wouldn’t happen “as soon as you touch[ed]” the link in the text message.

The big giveaway, however, is the part about how “this is from work this morning”.

How likely is that, in the middle of coronavirus lockdown?

What to do?

  • Don’t spread discredited stories online via any messaging app or social network. Do your homework. There’s enough fake news at the moment without adding to it.
  • Don’t be tricked by claims to authority. Anyone can write “the police announced this”, but that doesn’t tell you anything. In this case, what came from the police was an annoucement that it was false.
  • Don’t use the “better safe than sorry” excuse. Lots of people forward hoaxes with the best intentions, but you can’t make someone safer by “protecting” them from something that doesn’t exist. All you are doing is wasting everyone’s time.

Latest Naked Security podcast


from Naked Security https://ift.tt/3bCNekb

Transport Layer Security (TLS) is a common cybersecurity protocol that is frequently seen in email, web browsers, messaging, and other communication methods that take place over networks. TLS is relied upon to ensure secrecy using different techniques like encryption, hash functions, and digital signatures.

webinar TLS attacks

These days, however, nothing is immune to attack, so despite being designed to improve security, threat actors have still managed to find ways to exploit TLS.

In this webinar, you’ll learn about and get recommendations on how to defend against common weaknesses vulnerability scanners uncover and attacks targeting TLS, including:

  • Weak security certificate signatures
  • Unworthy certification authorities
  • Key exchange misconfiguration
  • Manipulation attacks like BEAST, CRIME, and POODLE

Join expert ethical hacker Ernesto Alvarez on April 9 as he reviews the different pieces of this complex protocol, discusses how to prioritize these risks, and provides actionable advice on potential remediation measures.


from Help Net Security https://ift.tt/2ygLfDK