HBO hacked, attackers leak GoT script and some episodes

HBO has become hackers’ latest entertainment industry target: attackers have breached the company’s servers, and they claim to have syphoned from them 1.5 terabytes of data.

The extent of the breach

The breach has been confirmed by HBO, who said that proprietary information, including some of their programming, was compromised as a result of the “cyber incident,” but did not specify what specific data was stolen.

According to Entertainment Weekly, the attackers have already leaked online unreleased episodes of Ballers and Room 104, and a script that seems to be that for the next episode of HBO’s mega-popular Game Of Thrones series.

The hackers, who do not seem interested in money but in hurting the company, have emailed many entertainment journalists and apparently shared a link to the leaked files. “Enjoy it & spread the words. Whoever spreads well, we will have an interview with him. HBO is falling,” they added.

The hackers told Wired that they’ve penetrated HBO’s network and collected “files and films and scripts and so on.” They claim they have also exfiltrated a lot of information about HBO’s staff and other internal info. Whether this is true or not remains to be seen.

The scope of the breach is yet to be determined, but if what the attackers claim is true, this hack resembles more that of Sony (in 2014) than the more recent one resulted in the leakage of unreleased Orange Is The New Black episodes, stolen from post-production company Larson Studios.

What now?

HBO has called in outside cybersecurity firms to help with the investigation, and has notified law enforcement of the incident. HBO chairman and CEO Richard Plepler has notified HBO employees of the breach via email.

“Ever since the infamous attack on Sony Pictures, there is evidently an appreciation on the part of hackers for stealing high value content such as movies and TV shows,” noted Richard Stiennon, Chief Strategy Officer at Blancco Technology Group.

Fiinal production videos are a class of information and the theft of such information can lead to extraordinary losses, he pointed out, adding that content producers and all the parties involved in shooting, editing and post-production processing and distribution should be on high alert.

“They should immediately review their data governance policies and discover the weak links in protecting their content and shore up their defenses. An information governance policy should take into account where critical content resides at all times. That content should be protected even when it’s in the hands of third party service providers. To avoid these types of losses, this type of content and all files associated with it should be securely erased when it is no longer required,” he advised.

from Help Net Security http://ift.tt/2vdKTuA

Large corporations increasingly considering blockchain deployment

57% of large corporations are either actively considering, or are in the process of, deploying blockchain technology, according to Juniper Research.

Almost 400 company founders, executives, managers and IT responded to the Blockchain Enterprise Survey. Amongst companies who have reached the PoC (Proof of Concept) stage, two-thirds (66%) expected blockchain to be integrated into their systems by the end of 2018.

‘Best Fit’ for blockchain

Using data from the survey, the company’s attendant deep dive strategy report identified settlement, land registry and digital fiat currency as ‘best fit’ opportunities for blockchain deployment, but cautioned that for each of these opportunities the scale and variety of barriers were significant.

The research claimed that those companies which would benefit most from blockchain include those with:

• A need for transparency and clarity in (trans)actions
• A current dependence on paper-based legacy storage systems
• A high volume of transmitted information.

Internal disruption and interoperability key concerns

However, Juniper argued that while awareness of blockchain and its benefits had increased in the past 12-18 months, there was the danger that companies might seek to deploy blockchain without having first considered alternative options.

“In many cases, systemic change, rather than technological, might be a better and cheaper solution than blockchain, which could potentially cause significant internal and external disruption,” according to research author Dr Windsor Holden.

Indeed, the research found that companies may have underestimated the scale of the blockchain challenge. For issues such as interoperability, the proportion of survey respondents expressing concerns progressively increased as companies proceed towards full deployment, while concerns also rose sharply regarding client refusal to embrace blockchain.

from Help Net Security http://ift.tt/2uT0VaL

Digital transformation and IoT to drive investment in IT operations management

The growth of digital business and the Internet of Things (IoT) is expected to drive large investment in IT operations management (ITOM) through 2020, according to Gartner. A primary driver for organizations moving to ITOM open-source software (OSS) is lower cost of ownership.

While acceptance of OSS ITOM is increasing, traditional closed-source ITOM software still has the biggest budget allocation today. Moreover, complexity and governance issues that face users of OSS ITOM tools cannot be ignored. In fact, these issues open up opportunities for ITOM vendors. Even vendors that are late to market with ITOM functionality can compete in this area,” said Laurie Wurster, research director at Gartner.

Gartner believes many enterprises will turn to managed ITOM or ITOM as a service (ITOMaaS) enabled by open-source technologies and provided by a third party. With OSS, vendors can provide more cost-effective and readily available ITOM functions in a scaled manner through the cloud.

Through 2020, public cloud and managed services are expected to be leveraged more often for ITOM tools, which will drive growth of the subscription business model for both cloud and on-premises ITOM. However, on-premises deployments will still be the most common delivery method. This imposes multiple challenges to incumbent ITOM vendors. First, those vendors that do not offer a cloud delivery model will face continuous cannibalization from ITOM vendors that can deliver ITOM through both cloud and on-premises.

Second, platform vendors, such as Microsoft Azure and Amazon Web Services (AWS), are providing some native ITOM functionalities on their public clouds. Customers that are running workloads solely on these platforms may prefer these native features. There are also “hybrid” requirements for ITOM tools that can seamlessly manage both cloud and on-premises environments.

Future of cloud services and OSS for ITOM

“Customer demand has driven traditional software vendors to transform and adapt to the changing technology and competitive landscapes. Competitive pressure from cloud (SaaS offerings) and commercial OSS (offerings with a free license plus paid support) is forcing ITOM providers to move toward subscription-based business models for both cloud and on-premises deployments,” said Matthew Cheung, research director at Gartner. “This shift will eliminate revenue growth spikes as the large upfront investment seen in traditional models is spread out over time in a repeatable revenue stream.”

The influx of new, smaller ITOM vendors focused on one or two major tool categories will continue to cause disruption for large traditional suite vendors. Given this situation, traditional vendors will need to react by changing how their products fit together. More importantly, traditional vendors need to change how their solutions are sold as customers exert significant pressure to shift to offering cloud-based services.

from Help Net Security http://ift.tt/2vhF2Uu

Deadspin Why Your Team Sucks 2017: Chicago Bears | The Slot Mooch Screws Pooch [Updating] | The Grap

Deadspin Why Your Team Sucks 2017: Chicago Bears | The Slot Mooch Screws Pooch [Updating] | The Grapevine Shady Phaedra Parks Caught in Yet Another Whopper, This Time About Trying to Rent Out Her House | Splinter I Am the World’s First Abortion Refugee |

from Lifehacker http://ift.tt/2tTb8T8

This DIY Recipe for that McDonald's Szechuan Sauce from "Rick and Morty" Is Pretty Damn Good

What's Your Favorite Web Hosting Service?

What To Tell Kids Instead of "You're So Smart"

Turn on Your Phone's Kill Switch So It's Useless If Stolen

Start Pulling out Your Tablets and E-Readers When You Go Through Airport Security

What Etiquette Questions Are Burning Inside You?

Give Condolences to Grieving Kids Because They Need Them, Too

How to Send Web Pages From Your Phone to Your PC

What to Unplug and Turn Off When You Leave for Summer Vacation

How to Become a High-Profile Personal Assistant

Get Started Reading Poetry With the 25 Most Anthologized Poems

Will It Sous Vide?: Let's Pick Another Topic!

Give Your Old Hard Drive or SSD New Life With This $7 Enclosure

News in brief: Roomba data not for sale; thief-catching wallet; Windows Bounty Program

Your daily round-up of some of the other stories in the news

iRobot not selling data

Roomba – you know, the robotic vacuum that navigates itself around your floors collecting debris and data – makers iRobot were in the news last week for their plans to sell maps of users’ homes to voice assistant big wigs Google, Apple and/or Amazon.

In an interview with ZDNet, CEO Colin Angle responded to privacy concerns, clarifying that it was a “misinterpretation”.

On all WiFi-enabled Roombas, usage data (e.g. how long did it clean, how far did it go, did it encounter any error codes, is it functioning correctly) can be sent to the cloud so it can be shown on the customer’s mobile device.

Angle explained that robots collect data in order to carry out their job but customers are in control and that “iRobot will never sell your data”.

Thief-catching wallet

What do you keep in your wallet? Money, credit cards, business cards, receipts? What about GPS, a chunk of RAM, a Wi-Fi hotspot, wireless phone charging and an anti-theft camera?

That’s what you’ll get with the Volterman, a crowdfunded Tardis-lite for your money that caught the eye of The Verge’s Paul Miller.

Miller was particularly taken by the wallet’s camera:

The creepiest feature, though, is the built-in camera. When the wallet is in “lost” mode, it will take a picture of anybody who is peeking into it. Perhaps in recognition of how strange some people might feel about having a camera in their wallet, the feature is listed as optional.

If you’re keen to keep an eye on the people keeping an eye on your money you’ll have to wait though. Right now the wallet is still in its vapour state and isn’t due to ship until December, a target that Miller considers “improbable”.

Until then Volterman Inc. are going to need somewhere safe to keep their cash because their smartphone/wallet mash-up has attracted a whopping 1723% of its $45,000 funding target.

Windows Bounty Program

Microsoft has announced the arrival of the Windows Bounty Program, an expansion of the existing Windows Insider Preview. The company promises that:

Any critical or important class remote code execution, elevation of privilege, or design flaws that compromises a customer’s privacy and security will receive a bounty

Microsoft is keen that hackers concentrate on its chosen “focus areas”. Bounty hunters focussing on the Hyper-V system in Windows 10, Windows Server 2012 (and 2012 R2) and Windows Server Insider Preview can chase rewards of up to $250,000.

Catch up with all of today’s stories on Naked Security

Follow @NakedSecurity

Image of Linus and Isaac courtesy of Flickr user Eirik Newth under a Creative Commons license.

from Naked Security http://ift.tt/2weCu6K

The FDA Wants Cigarettes to Lose Most of Their Nicotine

Robot Safecracking

Robots can crack safes faster than humans -- and differently:

So Seidle started looking for shortcuts. First he found that, like many safes, his SentrySafe had some tolerance for error. If the combination includes a 12, for instance, 11 or 13 would work, too. That simple convenience measure meant his bot could try every third number instead of every single number, immediately paring down the total test time to just over four days. Seidle also realized that the bot didn't actually need to return the dial to its original position before trying every combination. By making attempts in a certain careful order, it could keep two of the three rotors in place, while trying new numbers on just the last, vastly cutting the time to try new combinations to a maximum of four seconds per try. That reduced the maximum bruteforcing time to about one day and 16 hours, or under a day on average.

But Seidle found one more clever trick, this time taking advantage of a design quirk in the safe intended to prevent traditional safecracking. Because the safe has a rod that slips into slots in the three rotors when they're aligned to the combination's numbers, a human safecracker can apply light pressure to the safe's handle, turn its dial, and listen or feel for the moment when that rod slips into those slots. To block that technique, the third rotor of Seidle's SentrySafe is indented with twelve notches that catch the rod if someone turns the dial while pulling the handle.

Seidle took apart the safe he and his wife had owned for years, and measured those twelve notches. To his surprise, he discovered the one that contained the slot for the correct combination was about a hundredth of an inch narrower than the other eleven. That's not a difference any human can feel or listen for, but his robot can easily detect it with a few automated measurements that take seconds. That discovery defeated an entire rotor's worth of combinations, dividing the possible solutions by a factor of 33, and reducing the total cracking time to the robot's current hour-and-13 minute max.

We're going to have to start thinking about robot adversaries as we design our security systems.

from Schneier on Security http://ift.tt/2vfLKuo

Should Adobe make Flash open source? [POLL]

Last week, we wrote that Adobe was “calling time” on Flash, according to a blog post from Adobe Corporate Communications with the rather unexciting title of Flash and the Future of Interactive Content.

Other reports were rather more blunt.

Techradar wrote Adobe finally kills Flash, WIRED couldn’t resist the tautological Adobe Finally Kills Flash Dead, and BGR Media went for the unequivocal Adobe Flash is finally dead.

None of those headlines was quite right – least of all BGR’s, which actually dates back to December 2015, thus making it nearly two years ahead of this year’s headlines…

…which themselves turned out to be three years too early.

In fact, Adobe has said simply that it “will stop updating and distributing the Flash Player at the end of 2020.”

In other words, even those of us who have been trying for years to wean the world off Flash still don’t have much to celebrate.

In more than three years’ time, people will still be using Flash, and Adobe will still be stuck in the ongoing process of “encourag[ing] content creators to migrate any existing Flash content to [the] new open formats [like HTML5, WebGL and WebAssembly].”

With all this in mind, why would anyone want to keep Flash going even longer?

Long live Flash!

Finnish software developer Juha Lindstedt thinks he has an answer, and a petition to go with it:

Flash along with its sister project Shockwave is an important piece of internet history and killing Flash and Shockwave means future generations can’t access the past. Games, experiments and websites would be forgotten.

So he’s asking Adobe to release Flash as open source, just in case.

Open sourcing Flash and the Shockwave spec would be a good solution to keep Flash and Shockwave projects alive safely for archive reasons. Don’t know how, but that’s the beauty of open source: you never know what will come up after you go open source!

We’ve not convinced.

After all, we already live in a world from which many other important pieces of internet history have as good as vanished, apparently without causing us to lose our grip on either the past or the future.

(OS/2, Macromedia Director, Google Gears, Netscape Navigator, Gopher, Usenet and France’s ultra-low bandwidth Minitel all spring unbidden, and unchronologically to mind.)

But it’s not up to us, it’s up to you!

Have your say

Have your say by voting in our poll:

And have more say by telling us what you think in the comments below.

(You may remain anonymous.)

Follow @NakedSecurity
Follow @duckblog

from Naked Security http://ift.tt/2uO7QTZ

The 5 Tasks You Should Automate As Soon As You Get a New Phone

Today's Best Deals: Fire HD 10, DEWALT Tools, Samsung Sound Bar, and More

Do Less Damage to the Planet When You Fly

How to Tell a Story, with Alan Alda & The Moth's Catherine Burns

Deadspin Everything After Daniel Cormier Got Knocked Out Was A Disaster | Jezebel Angelina Jolie Cal

Deadspin Everything After Daniel Cormier Got Knocked Out Was A Disaster | Jezebel Angelina Jolie Calls Reaction to Vanity Fair Story About Her Audition Process ‘False and Disturbing’ | The Grapevine Sunday’s Game Of Thrones Was A Message To Black America | Splinter Ivanka Trump ‘Desperately’ Wants You to Lower Your Expectations of Her |

from Lifehacker http://ift.tt/2uR1xNY

Amazon's Blowing Out The Last Of Their Fire HD 10s For $120, While Supplies Last

Cooking Octopus on The Grill Is Way Easier Than You Think

One lousy click: the phishing blunder that sank an entire product

Do you need to extract text from images, videos or PDFs?

Not only is there an app for that, it turns out there’s even a browser plugin called Copyfish to help you, too.

Copyfish is supposed to let you grab subtitles from films, captions from cartoons, and so on, while you’re browsing.

(We’re assuming that the name is a pun on HHGttG’s Babelfish, the eel-like creature you stick in your ear that automatically translates everything you hear into your own language.)

Unfortunately, the Copyfish software project is in all sorts of crisis right now, thanks to a phishing attack over the weekend.

In Copyfish’s case, it seems very much that an injury to one ended up being an injury to all.

According to the creators of the Copyfish tool, this is what happened:

• An email arrived, apparently from Google, telling Copyfish that its plugin wasn’t compliant with the Chrome Web Store rules and might be removed.
• The email included a handy link that supposedly went to the relevant developer dashboard so that Copyfish could look into it.
• A helpful Copyfish developer decided to investigate, and clicked on the given link to log in.
• The link was bogus, and so the developer ended up revealing the company password to a bunch of crooks.

What next?

After that, things happened quickly.

More ads and web spam than usual started appearing on the computers of Copyfish’s own computers.

After a while, Copyfish rather scarily figured out that the ads were being inserted by its own Chrome plugin.

Worse still, the infected version that was doing the adware injection was an update the company didn’t even know was out there.

The crooks who’d acquired the password had lost no time:

• Locking Copyfish out of its own Chrome Web Store account.
• “Upgrading” the plugin from version 2.8.4 to an unofficial release numbered 2.8.5 and adding in a bunch of ad-serving malware code.
• Moving the Copyfish for Chrome code to a different account.

Presumably, the Copyfish developers all had automatic plugin updates turned on, so they’d unexpectedly acquired an unauthorised version of their own software.

The only word we can think of to describe this sort of situation is, “Ouch.”|

Apparently, the rogue ad-serving component works by “calling home” to a third-party website to fetch unauthorised JavaScript code; Copyfish managed to get this rogue site blocked so that the rogue ads it delivers never appear.

But as the the company noted earlier today: “we still have no control over Copyfish, so there is a chance that the thieves [could] update the extension once more.”

Ironically, Copyfish’s breach notification page invites you to sign up to the company’s newsletter “[i]f you want to get an email once the issue is fixed”…

…so watch out for further fake emails telling you that version 2.8.6 is ready!

What to do?

You might have expected professional web developers to be a bit more circumspect in a case like this – but apart from containing a suspicious link, the the original email from the crooks was at least vaguely believable:

Your Google Chrome item, “Copyfish Free OCR Software,” with ID: [redacted] did not comply with our program policies and will be removed from the Google Chrome Web Store unless you fix the issue.

Please login to your developer account [link redacted] for more information.

To a native speaker of English, the wording here isn’t quite right (e.g. did not comply would read better if it were does not comply), and to a fluent techie, the login link – which used a non-Google link shortening service – should have been a red flag that something was wrong.

So here’s our advice to reduce the risk of account takeovers of this sort:

• Don’t click on login links in emails. If you never click on login links, even when you trust the email, but always find the login page in a trusted way of your own, the crooks will find it much harder to phish you in this way.
• Turn on two-factor authentication (2FA) whenever you can. 2FA means you need a one-time login code, as well as your username and password, every time you login. That’s one more thing the crooks need to figure out every time they try to phish you.
• Don’t feel pressurised to act when you receive what sounds like bad news via email. Ask for a second opinion from someone you actually know and trust – a nearby colleague, for instance – especially when the email apparently relates to an official company account.
• Never believe the contact details provided in an email. If the email comes from an imposter, the contact details will lead back to the crooks, who will simply “confirm” any lies they told in the original email. Get details such as websites, email addresses and phone numbers from a trusted third party source that you found for yourself.

Think before you click!

Follow @NakedSecurity
Follow @duckblog

from Naked Security http://ift.tt/2vlhQ8Z

Dark Web criminals caught after reusing passwords

We often hear stories about how criminals take advantage of people who reuse their passwords across websites and don’t enable two-factor authentication (2FA).

But, recently it appears these roles were reversed when police in the Netherlands shut down the criminal activity of a number of dark web vendors who reused their own credentials and didn’t enable 2FA on their accounts.

According to cryptomarket researcher @5auth, as of 24 July 2017, up to 16 accounts on the dark web marketplace Dream Market were under control of the Dutch Police:

Means: all of these vendors sold on Hansa without 2fa and used the same password on Dream.

— C (@5auth) July 25, 2017

The Dutch Police likely seized these credentials in their crackdown on the Hansa and AlphaBay marketplaces earlier this year.

While Hansa and AlphaBay fell, another dark market, Dream Market, seemed untouched by authorities and many of the affected vendors moved their operations there.

However, there was rampant speculation that Dream Market was either actively compromised and being monitored by authorities, or that it was only a matter of time until it too was shut down.

Earlier this week, it looked like the shoe finally dropped for at least 16 vendors on Dream Market, but it doesn’t appear that the authorities used any high-powered tricks in their takedown. Instead, it looks as though the Dutch police simply reused credentials they’d already captured.

According to at least one of the vendors themselves on the /r/DarkNetMarkets subreddit, they hadn’t changed their password after Hansa was taken down, and they also hadn’t enabled 2FA, or were unable to enable it.

“Guys, I am one of those vendors. I can clearly say that (at least) my account was seized by dutch LE. I think they came on it through my sillyness using same password on hansamarket. All my informations got changed during the night they took hansamarket offline.”

Though we have no confirmation from the Dutch police as yet, if this was a matter of credential reuse it was trivial for the police to log in to vendor accounts and completely take them over, shutting the vendors out of their own accounts and swapping the vendors’ PGP keys to ones owned by the Dutch police.

The vendors taken offline seem to be garnering little sympathy from their peers for their lax security practices. “You likely didn’t have 2FA enabled in the first place… and used the same password as on Hansa,” wrote one user in the DarkNet Market UK subreddit. “You should know better.”

If they’re read five ways to upgrade your passwords they would have.

Follow @NakedSecurity
Follow @mvarmazis

from Naked Security http://ift.tt/2hgMY3b

Nation-states are biggest cyber threat for drug and medical device makers

Government-sponsored hackers were seen as the biggest threat to cyber security among executives in charge of technology, information, and security at drug and medical device makers, according to the 2017 Cyber Healthcare & Life Sciences Survey by audit, tax and advisory firm KPMG.

Nation states topped the list of threats from 53 percent of respondents, followed by individual hackers and hacktivists. The data that hackers are seeking are mostly tied to financial information (69 percent) followed by patents and clinical research (63 percent), found the survey of 100 US tech, data, security executives from medical device and pharmaceutical/biotech companies.

“Some nations desperately want intellectual property to support local life sciences organizations without incurring R&D costs and challenges,” said David Remick, a KPMG partner who works with life sciences companies.

“Drug and medical device makers have significant volumes of valuable financial and clinical information,” said Life Sciences Advisory Leader Alison Little. “Recent cyber events targeting the life sciences industry demonstrate that market capitalization can be immediately eroded depending on the nature of the cyber-attack and extent of damage.”

“The life science industry is increasingly engaging patients directly through web portals and apps to help them better manage their conditions, but this opens the door to new risks,” said Michael Ebert, a KPMG partner who leads cyber for the Healthcare & Life Sciences Practice.

Misguided priorities

Life sciences organizations listed multiple priorities required to be more effective in cyber security. Better technology (36%) was cited as the highest priority for medical device makers, followed by an overarching strategy on data collection/protection (28%). Pharma organizations cited stronger processes (24%) as the biggest need, followed by more funding and better technology tied for second at 22 percent. Greater staffing was seen as a priority among only 9 percent of respondents.

“Many organizations prioritize technology solutions over improving processes and training staff. This is a grave mistake,” Remick said.

Despite 62 percent of executives saying they are feeling “more secure” even after the reports of high profile breaches, about 40 percent of life sciences companies said their overseas security protocols are not as strong as those in the United States, making EU data privacy rules much more significant. The survey found more than a third (34 percent) described their organizations as under-resourced internationally.

from Help Net Security http://ift.tt/2vXQSRT

The Starbucks Frappajappajooza Is Real If You Want It to Be

A New Game Helps You Navigate Difficult End-of-Life Conversations

Phishers steal Chrome extension from developer

An attacker has compromised the Chrome Web Store account of German developer team a9t9 software, and has equipped their Copyfish Chrome extension with ad/spam injection capabilities.

Unfortunately, even after the developers spotted the compromise, they were unable to remove the offending extension from the store, as it has been already moved to the attacker’s own developer account.

“So far, the update looks like standard adware hack, but, as we still have no control over Copyfish, the thieves might update the extension another time… until we get it back. We can not even disable it – as it is no longer in our developer account,” the duo warned.

They are currently still trying to reach Chrome Store administrators in an effort to force the removal of the extension.

Account hijacking through phishing

How did the attacker gain access to a9t9’s Chrome Web Store account? A phishing email impersonating the Chrome Web Store team was all it took:

The developer didn’t notice that the provided link was a bit.ly link because he was viewing it in HTML form, and did not find it immediately suspicious that Google apparently uses Freshdesk for its customer support system.

“The password screen itself was an exact (or at least good enough) copy of the one used by Google,” the developers noted, and so they entered the login information without thinking twice about it.

A not that rare and unusual occurrence

Spammers and data collectors sometimes buy out the owners of relatively popular add-ons and extensions, and make surreptitious changes to them, counting on users not to notice that something is amiss.

Still, there are those who prefer hijacking developer accounts and swapping legitimate offerings (standalone software or add-ons) with malicious ones. We’ve seen it many times already, and we will likely continue seeing it for the foreseeable future.

In a discussion that arose on Hacker News following this particular incident, a commenter pointed out that a similar attack, possibly by the same attacker, happened on the Social Fixer Chrome extension last month. Other commenters also pointed out many other instances of “extensions gone bad” in the last year or so.

“I guess this is as good a place as any to post that I noticed something similar had happened to [User-Agent Switcher for Google Chrome] and [Block Site],” one of them noted.

from Help Net Security http://ift.tt/2vXZDLo

Get Ready For Your Next Home Improvement Project With Amazon's One-Day DEWALT Sale

The New York gas pumps that steal your credit card

A few years back, we saw a spate of Bluetooth-enabled, banking-data-gobbling skimmers installed at gas stations in the Southern US.

Eventually, 13 alleged thieves were charged with forging bank cards using banking details chirped out via Bluetooth to nearby crooks from devices that were impossible for gasoline-buying customers to detect, given that the skimmers were installed internally.

Of course, it’s much easier to detect thieves’ attempts to get at your credit card when they’ve gone the kludgy, model airplane route. That route entails thieves 1) gluing a card catcher onto the front of an ATM (hopefully in a nice, wiggly fashion—much easier for victims to detect that way!), 2) hoping it doesn’t fall off before it catches some cards, and then 3) hanging around the machine, pretending to look innocent, as they wait to snatch the cards after victims give up on ever getting them back.

True, the Bluetooth skimmer was installed internally, making it tougher to spot than the glued-on kludge of a card catcher. It still presented a problem for the thieves, though: namely, using Bluetooth meant the skimmer still relied on the thieves hanging around nearby, given the limited range of this wireless technology. It also meant that anybody else using Bluetooth in the vicinity could get an eyeful of “Oooo, payment card details up for grabs!”

Now, as security journalist Brian Krebs reports, New York City police have started to see a new sort of skimmer on gas pumps that cuts the Bluetooth tie, instead relying on wireless GMS text messages to get card details to the crooks anywhere in the world.

No more hanging around smelly gas pumps! No more returning to the scene of the original crime – as in, the place where the skimmers were initially installed – to retrieve the booty. Now, the thieves can plug the skimmers in and make themselves scarce, taking off to wherever their counterfeit card making setup is located.

Mind you, wireless transmission of stolen card data is nothing new. There’s a US Secret Service task force in Los Angeles that’s been looking into fuel theft and fuel-pump skimming since 2009, and it’s found that there are distinct crime gangs, working in tandem, that steal the gas and that skim the card data. They use SMS/text messages to exfiltrate card data. And like the GSM skimmers, use of the SMS skimmers likewise means that thieves don’t have to return to the scene of the crime: all they need is mobile phone service to collect card data and PINs.

Krebs quoted Secret Service agent Steve Scarince in a 2015 article:

Generally the way it works is the skimmer will sell the cards to a fuel theft cell or ring. The head of the ring or the number two guy will go purchase the credit cards and bring them back to the drivers. More often than not, the drivers don’t know a whole lot about the business.

They just show up for work, the boss hands them 25 cards and says, ‘Make the most of it, and bring me back the cards that don’t work.’ And the leader of the ring will go back to the card skimmer and say, ‘Okay out of 100 of those you sold me, 50 of them didn’t work.’

But this is apparently the first time that we’ve seen GSM-based pump skimmers show up in gas pumps – at least, in New York – according to a New York police officer. The devices were pulled off of three New York filling stations this month. The officer shared some images of the devices with Krebs.

Krebs identifies that, like other pump skimmers, these GSM skimmers draw power from the pumps they’re attached to, allowing them to operate indefinitely.

Analysis on the T-Mobile SIM cards apparently hasn’t turned up any data on the thieves. All that investigators have found so far are the unique serial numbers—what’s known as the integrated circuit card identifiers, or ICCIDs—of the SIM cards.

It’s common to see skimming devices on ATMs – or gas pumps, or any card processing device – used with some type of remote sensing or telemetry, whether messages are being sent out via GSM or mobile phone. Thieves can take off-the-shelf devices, including the bits and pieces of a mobile phone used in this recently discovered GSM skimmer or, say, a video recorder, and then just jam it behind some believable-looking moldings. It can make it tough for a customer to tell there’s something fishy going on.

What to do?

Don’t use a card machine on a gas pump, an ATM or anything else if you think it may have been tampered with.

In cases like this, where the machine itself seems to have been compromised and there are no external clues to the tampering, there isn’t much you can do beyond deciding if you trust the gas station or not.

As always, it’s smart to regularly check credit card statements and keep an eye out for anything that doesn’t look right.

Keep your bank’s phone number handy on your phone too. If you see anything suspicious, whether it’s on your statement or at an ATM, a restaurant or the filling station, report it to the credit card company.

And don’t forget to call the police: if there’s fraud going on, they’ll want to know.

Follow @NakedSecurity
Follow @LisaVaas

from Naked Security http://ift.tt/2hfJk9J

Seagate to pay millions for forking over employee info to scammers

A moment of inattention by one of its employees, and Seagate stands to lose tens of millions of dollars. No, the company was not the victim of a BEC scam – instead, it has been dragged to court by its own employees.

In 2016, the company handed over current and past employees’ W-2 forms to scammers, who then used the information to file fraudulent tax returns in their names, obtain lines of credit using their Social Security numbers, and so on.

A group of affected employees decided, therefore, to file a class action suit against the company, and apparently they’ve now reached an out-of-court settlement.

The proposed Seagate employee info theft settlement

“Seagate will offer Employees and Third Parties up to two years of Experian’s ProtectMyID identity theft protection plan at no cost. In addition, Seagate will reimburse all class members for documented out-of-pocket costs as a result of the Data Incident that are not otherwise reimbursable through the ProtectMyID plan, up to $3,500 per class member,” the motion to approve the settlement says.

“Plaintiffs estimate that the Experian ProtectMyID protection is valued at approximately $5.75 million to the Settlement Class. Plaintiffs further estimate that Seagate’s ‘backstop’ protection offers potential coverage of more than $42 million to protect a class estimated at 12,000 individuals.”

The affected employees say that apart from providing two years of free identity theft protection services to them, the company has no offered any compensation to third-party victims (the scammers also filed joint tax returns for some of the affected employees’ adult dependents), has not provided them with assistance in dealing with the IRS or state tax agencies, nor offered to reimburse employees for the costs – current and future – incurred as a result of falsely filed tax returns.

Also, they complained that the offered ProtectMyID service does nothing to protect against identity theft, but just provides assistance after identity theft has been discovered.

“For the rest of their lives, Plaintiffs and the class members will bear a heightened risk of all manners of identity theft,” the employees’ lawyers noted.

“As a result of Seagate’s negligence, Plaintiffs and the class members have suffered and will continue to suffer damages and injury including, but not necessarily limited to: a) out-of-pocket costs associated with addressing false tax returns filed with the IRS and state tax agencies; b) increased future out of pocket costs in connection with preparing and filing tax returns; c) out-of-pocket costs associated with procuring identity protection and restoration services; d) in the event of future identity theft, out-of-pocket costs associated with repairing credit, reversing fraudulent charges, and other harms; and e) lost productivity and enjoyment as a result of time spent monitoring, addressing and correcting future consequences of the Data Breach.”

The settlement still has to be approved by the judge.

from Help Net Security http://ift.tt/2vkHuL3

Measuring Vulnerability Rediscovery

Measuring Vulnerability Rediscovery

New paper: "Taking Stock: Estimating Vulnerability Rediscovery," by Trey Herr, Bruce Schneier, and Christopher Morris:

Abstract: How often do multiple, independent, parties discover the same vulnerability? There are ample models of vulnerability discovery, but little academic work on this issue of rediscovery. The immature state of this research and subsequent debate is a problem for the policy community, where the government's decision to disclose a given vulnerability hinges in part on that vulnerability's likelihood of being discovered and used maliciously by another party. Research into the behavior of malicious software markets and the efficacy of bug bounty programs would similarly benefit from an accurate baseline estimate for how often vulnerabilities are discovered by multiple independent parties.

This paper presents a new dataset of more than 4,300 vulnerabilities, and estimates vulnerability rediscovery across different vendors and software types. It concludes that rediscovery happens more than twice as often as the 1-9% range previously reported. For our dataset, 15% to 20% of vulnerabilities are discovered independently at least twice within a year. For just Android, 13.9% of vulnerabilities are rediscovered within 60 days, rising to 20% within 90 days, and above 21% within 120 days. For the Chrome browser we found 12.57% rediscovery within 60 days; and the aggregate rate for our entire dataset generally rises over the eight-year span, topping out at 19.6% in 2016. We believe that the actual rate is even higher for certain types of software.

When combined with an estimate of the total count of vulnerabilities in use by the NSA, these rates suggest that rediscovery of vulnerabilities kept secret by the U.S. government may be the source of up to one-third of all zero-day vulnerabilities detected in use each year. These results indicate that the information security community needs to map the impact of rediscovery on the efficacy of bug bounty programs and policymakers should more rigorously evaluate the costs of non-disclosure of software vulnerabilities.

We wrote a blog post on the paper, and another when we issued a revised version.

Comments on the original paper by Dave Aitel. News articles.

Tags: academic papers, patching, Schneier news, vulnerabilities, zero-day

Posted on July 31, 2017 at 5:59 AM • 0 Comments

from Schneier on Security http://ift.tt/2wduGSQ

Researchers remotely hack Tesla Model X

Security researchers from Tencent’s Keen Security Lab have done it again: they’ve found vulnerabilities in one of Tesla’s cars and demonstrated that they can be exploited remotely to do things like open the car’s doors and force it to break while in motion.

What’s more, they’ve also managed to bypass the code signing/signature checking mechanism Tesla introduced last year to make sure that their cars accept only firmware updates signed by the company.

Possible attacks

The researchers discovered multiple zero-days in different car modules, ultimately affecting both the car’s CAN bus, which allows all the car’s microcontrollers to communicate with each other, and its Electronic Control Unit (ECU), which controls the car’s electrical system and subsystems.

They have demonstrated that, while the car is parked, they can make the car switch lights on an off, lower and raise windows, car seats, open and close the sunroof panel, and fiddle with the in-vehicle displays. Also, that they can make a moving car brake, open its trunk, and activate its windshield wipers – things that could lead to serious accidents and even loss of life if the travelling speed is high.

VIDEO

They have responsibly disclosed the vulnerabilities to the car maker, and Tesla has pushed out the needed security patches over the air in July.

“The reported issues affect multiple models of Tesla motors. Based on Tesla’s report, most of the active Tesla motors have been updated to new firmware with patches via FOTA [Firmware Over-The-Air],” the researchers noted.

Still, they urged Tesla car owners to check whether they have received firmware version 8.1 (17.26.0) or later, and if not, to force the update themselves.

Tesla is known for welcoming research of this kind and they’ve repeatedly proven to be quick to respond to disclosures of security issues, effectively setting an example for other automakers.

As a side note: the ICS-CERT has issued an alert last week about another vulnerability in the CAN bus protocol. That one can only be exploited by attackers who have physical access to the target car’s input port (typically ODB-II).

from Help Net Security http://ift.tt/2wdesJu

Monday review – the hot 32 stories of the week

Get yourself up to date with everything we've written in the last seven days - it's weekly roundup time.
from Naked Security http://ift.tt/2hfKP7S

Independent labs will test the security of medical devices

The Medical Device Innovation, Safety and Security Consortium (MDISS) launched the first of more than a dozen planned specialized labs for security testing medical devices.

Who

MDISS is a non-profit public/private partnership dedicated to advancing patient safety and public health, and the first to focus exclusively on medical device cybersecurity. It develops and delivers practical technology, operations and policy solutions for member organizations, including hospitals, health delivery organizations, doctors, epidemiologists, clinical engineers, medical device manufacturers, academics, regulators, embedded security experts and cybersecurity researchers.

What

The new MDISS World Health Information Security Testing Lab (WHISTL) facilities will comprise a federated network of medical device security testing labs, independently owned and operated by MDISS-member organizations including healthcare delivery organizations, medical device manufacturers, universities and technology companies.

Enabling MDISS members to test devices in both physical and virtual environments, WHISTL facilities will focus on identifying and mitigating medical device vulnerabilities, sharing solutions and best practices, and device security education and awareness. Newly uncovered vulnerabilities will be responsibly reported to medical device manufacturers and to the NHISAC-MDISS Medical Device Vulnerability Program for Evaluation and Response.

While such security “proving grounds” aren’t new to enterprise IT, WHISTL is the first network of labs specifically designed around the needs of medical device researchers, healthcare IT professionals and hospital clinical engineering leaders. By the end of 2017, MDISS WHISTL facilities will open in New York, Indiana, Tennessee, California as well as in the UK, Israel, Finland and Singapore.

How

Each WHISTL facility will launch and operate under a shared set of standard operating procedures. The goal is to help organizations work together to more effectively address the public health challenges arising from cybersecurity issues emergent in complex, multivendor networks of medical devices.

Together with the National Health Information Sharing and Analysis Center (NH-ISAC), MDISS has already built a dynamic national cyber information-sharing community to advance patient safety and privacy. MDISS, under a $1.8M contract from the DHS, built the medical device cyber risk assessment platform (MDRAP).

The platform helps health systems, device manufacturers, and technology firms collaborate to produce and share device risk assessments. The fast-growing and standards-based MDRAP platform features moderated crowdsourcing and facilitates timely, responsible sharing of risk assessments and threat indicators, while helping automate critical device inventory, audit, oversight and vulnerability tracking tasks for hospitals.

WHISTL’s device testing protocols will have their foundation in the UL Cybersecurity Assurance Program specifications (UL CAP), especially with regards to fuzz testing, static binary analysis and structured penetration testing.

from Help Net Security http://ift.tt/2vke0Nd

Container security: The seven biggest mistakes companies are making

As enterprises increase adoption of containers, they also risk increasing the number of mistakes they make with the technology. Given that many companies are still wrapping their heads around the potential of container technology and how to best leverage it, that stands to reason. With that said, however, companies must ensure that they are establishing a solid foundation for security as they continue to identify strategies and workloads that make sense on a container platform.

Here are the seven biggest container security mistakes companies are making, and how they can “adjust their sails” to ensure smooth sailing ahead.

1. Securing containers without securing the platform on which they are deployed

Any conversation around containers security must begin with a discussion around securing the operating system (OS) platform upon which they are deployed.

Without a foundational layer of platform security, an organization risks making the workloads that are deployed within it – including containers – vulnerable. Despite often being overlooked, the selection of a solid, secure foundation at the onset will define the rest of the container infrastructure.

2. Focusing on security of what’s inside of containers and not the containers themselves

Ensuring what is inside a container is of paramount importance as the contents can compromise the security of a container. However, when the focus is heavily on securing the contents of a container, sometimes that comes at the cost of securing the container itself. Since a container is essentially a running process on a Linux host that is “contained” – a container inherently shares kernel space with the host.

This means that while containers provide many advantages over traditional virtualized deployment environments, they have a different type of attack vector that organizations need to understand. Hence, it is important to ensure the container technology your organization deploys provides security coverage and protection against seen and unforeseen attacks and attack vectors.

3. Not securing APIs

Securing applications includes managing application and API authentication and authorization. When working with applications composed of microservices, APIs are key. However, when applications have multiple independent API services, the number of service endpoints increases and additional security measures are required.

An API management tool can mitigate security issues and can provide control features beyond basic security and authentication, including actions such as restricting access to specific endpoints, applying access policies for groups of users or setting per-period limits for incoming API calls to protect infrastructure and keep traffic flowing smoothly.

4. Not tracking known vulnerabilities

The list of known vulnerabilities is constantly evolving, so organizations should make sure they check the contents of container images when first downloaded and continue to track vulnerability status over time for all approved and deployed images. Container scanning tools that deploy continuously updated vulnerability databases can offer up-to-date information on known vulnerabilities when using container images from other sources.

Deploying a private container registry is also recommended. Doing so enables organizations to manage access to, and promotion of, downloaded container images and any internally built images.

5. Allowing containers to run as privileged

Deploying or creating any application or process with the least privilege possible is important and still the best practice for containers. Since – as noted before – containers share kernel space with the host OS, enabling a container to run in fully privileged mode would allow whatever is running in the container unrestricted access to the host system. As a result, this can cause a very clear security concern.

Unfortunately, while most container use cases should not need to run as root, many images still do. Hence, it is recommended that administrators leverage security context constraints (SCCs), to define – at specific levels – the capabilities of a running container within the host OS including what it can see and what it can do.

6. Failing to integrate containers into a continuous security loop, including image provenance, patching, and security scanning and policy-based monitoring

Once containers are up and running, it is important to maintain continuous security through the development and management of the containers. Doing this is a key to securing the entire software stack. By adhering to a “build once, deploy everywhere” philosophy, developers ensure that the product of the build process aligns directly with what is ultimately deployed in production. And the continuous integration process should include policies that flag security issues immediately, halting the process of deploy before vulnerabilities can be exposed.

When digging further into the security considerations while deploying containers, it is important to look at:

Software Supply Chain and Image Provenance: With a trusted source registry, organizations can ensure secured, patched, and up-to-date images. The security approach for deployed workloads should be based on where container images originated, what they are running, and how they are running.

Patching deployments: Automatic patch detection enables patching to be more efficient and less time consuming, ensuring that continuous security becomes part of the CI/CD model.

Security Scanning and Policy-based Monitoring: Real-time monitoring and security scanning of images ensures an added layer of security.

7. Neglecting to align enterprise security needs with the agility of containers

Containers are designed to come and go quickly, challenging some traditional and relatively static security practices. It is important to adopt security solutions designed to work with the speed and agility of containers. Consider network defense: organizations want a container platform that uses software defined networking (SDN). This provides a unified cluster network that enables communication between containers across the cluster and allows organizations to segment the network traffic to isolate different users, teams, applications and environments within the cluster.

Beyond security, any container platform must to provide an experience that works for any given developer and operations team. Security can work hand in hand with an enterprise-grade container-based application platform without compromising functions and while improving operational efficiency and infrastructure utilization.

from Help Net Security http://ift.tt/2uMacTn

This App Works Like Tinder, Except It's for Making Platonic Friends

Week in review: Black Hat, the future of AppSec, the value of cyber insurrance

Here’s an overview of some of last week’s most interesting news and articles:

Review: Pwnie Express Pulse
Pwnie Express Pulse is a SaaS offering that uses custom hardware sensors to provide continuous network discovery, threat detection, risk assessment, and critical information about all security issues that should be resolved.

Is cyber insurance worth the paper it’s written on?
Is there any point spending good money on cyber insurance when you could put that money into robust protection instead?

Lippizan: Sophisticated, targeted spyware on Google Play
Google has discovered targeted spyware on Google Play that is likely the work of Equus Technologies, an Israeli cyber surveillance technology dealer.

Addressing the deficit in cyber security workforce and national policy
Whether they like it or not, in this day and age nearly all organizations have to think about their cybersecurity posture and find a way to minimize cybersecurity risk. But the main problem about doing the latter is that nobody can effectively assess the cybersecurity risk of organizations.

UK govt urges teenagers to apply for cyber security training programme
Students will be selected for the programme via a pre-entry assessment, and the scheme will provide them with clear pathways into the cyber security industry via direct contact with industry experts.

Custom code accounts for 93% of application vulnerabilities
Although third-party software libraries represent a majority of an application’s code, they account for less than seven percent of application vulnerabilities.

Hackable smart car wash systems can hurt people
Two years after researchers Billi Rios and Terry McCorkle first flagged serious vulnerabilities in automatic, smart car wash systems by US manufacturer PDQ, the company is finally acknowledging the danger.

An internet-connected fish tank let hackers into a casino’s network
A high-tech, internet-connected fish tank in a North American casino has been used to exfiltrate data from the company’s network.

Google Groups misconfiguration leads to sensitive data leaks
By searching for publicly exposed Google Groups within the top 1,000 most visited websites on Alexa, researchers found hundreds of them, containing information such as PII, employee salary details, customer passwords, and so on.

22% of SMBs hit by ransomware had to cease business operations
More than one-third of small and medium-sized businesses have experienced a ransomware attack in the last year, a new Malwarebytes report claims, and 22 percent of these impacted businesses had to cease operations immediately.

Phishers’ techniques and behaviours, and what to do if you’ve been phished
Once a user has been phished, how long does it takes for the phishers to misuse the stolen credentials?

Most companies fail to measure cybersecurity effectiveness
With global companies and governments spending more than $100 billion a year on cybersecurity defenses, a substantial number of companies are making business decisions and purchasing cyber security technology blindly.

MacOS malware used to spy on home users in the US
A new variant of the macOS malware Fruitfly has been found by security researcher Patrick Wardle on some 400 machines of (mostly) home users located in the US.

The future of AppSec: Stop fighting the last war
It’s a cornerstone of military doctrine: when you focus too much on the last battle you faced, you miss signs of the new battleground taking shape. The principle holds as true for cybersecurity as it does for cavalries and tanks.

How to protect the power grid from low-budget cyberattacks
Cyberattacks against power grids and other critical infrastructure systems have long been considered a threat limited to nation-states due to the sophistication and resources necessary to mount them. At the Black Hat USA 2017 conference in Las Vegas, a team of New York University researchers challenged that notion by disclosing vulnerabilities in a component that, combined with publicly available information, provide sufficient information to model an advanced, persistent threat to the electrical grid.

Russian arrested, indicted for laundering funds from Mt. Gox hack
Alexander Vinnik, a Russian man arrested on Tuesday in Greece, is allegedly the operator of digital currency exchange BTC-e, through which funds from the Mt. Gox bitcoin exchange hack have been laundered.

Security vulnerabilities in radiation monitoring devices
If the vulnerabilities identified are exploited, an attacker could wreak havoc on critical systems used for monitoring radiation levels, such as falsifying measurement readings to simulate a radiation leak, tricking authorities to give incorrect evacuation directions, or increasing the time an attack against a nuclear facility or an attack involving a radioactive material remains undetected.

Secrets of successful threat hunters and SOCs
Successful cybersecurity teams are three times as likely to automate threat investigation.

UniCredit breach: Data of 400,000 customers exposed
Italian global banking and financial services company UniCredit has revealed that it has suffered two security breaches in less than a year.

Only 2% of “GDPR-ready” organizations are actually compliant
Organizations across the globe mistakenly believe they are in compliance with the upcoming GDPR, Veritas claims, after polling over 900 business decision makers from the US, the UK, France, Germany, Australia, Singapore, Japan and the Republic of Korea.

Expected cyber threats over the next six months
The 2017 Cyber Threatscape Report examines key trends during the first half of 2017 and explores how cyber incidents may evolve over the next six months.

6+ billion records exposed in data breaches in first half of 2017
There have been 2,227 publicly disclosed data compromise events since the beginning of the year through June 30th.

from Help Net Security http://ift.tt/2vjdvTM

These $78 Sony Bluetooth Headphones Run For Up to 30 Hours On a Charge

Sunday Showdown: Fidget Spinner Vs. Fidget Cube

For Easier Dog Baths, Just Shower With Your Pet

Sunday's Best Deals: Sony Bluetooth Headphones, Galaxy S8, Breville Smart Oven, and More

The Newest Breville Smart Oven Is Also An Air Fryer, and It's 20% Off For the First Time Ever

What Happens When Your Bank Loses a Cash Deposit

HotelTonight Now Lets You Upgrade That Cheap Room to a Suite

Jump On the Juicing Bandwagon With This Insane Breville Deal

Cycflix Forces You To Burn Calories While You Binge Watch

Saturday's Best Deals: Breville Juicer, Syphon Coffee, Space Jam, and More

Cool Down This Summer With Alcoholic Icy Pops

Here's a Great Chance to Discover the Joys of Pasta Making

Become a sysadmin – learn how to fit right in [VIDEO]

For our final article as #SysAdminDay 2017 draws to a close, we recorded a Facebook Live video to help you become a sysadmin.

Naked Security’s Paul Ducklin and Sophos Sales Engineer Matthew Boddy put their heads together to bring you the sort of advice you just won’t find anywhere else.

Of course, in just 10 minutes of video, they don’t have time to teach you about networking, programming, debugging, troubleshooting – or, for that matter, anything to help you actually do a sysadministrational job.

In short, they can’t show you how to be the part, but they can help you deal with the tricky choices you’ll need to make if you want to look the part.

For example, should you be seen to code in Perl or Python? Prefer cargo pants to jeans? Edit with Vi or Emacs? Listen to vinyl or cassette tapes? (Our two experts were unanimous on that issue, though not for the reasons you might expect.)

Don’t delay – watch right now, because this could be more important than you think, depending on how important you think it is going to be:

(Can’t see the video directly above this line? Watch on Facebook instead.)

Follow @NakedSecurity

from Naked Security http://ift.tt/2u641WC

For Beach Picnics, Bring Foods You Can Eat With Toothpicks

M.A.C. is Giving Away Free Lipstick Tomorrow

Coke Zero Was a Bullshit Drink From the Beginning

The iPod Shuffle Review (2017)

Friday Squid Blogging: Giant Squids Have Small Brains

Ben A. • July 28, 2017 4:07 PM

WikiLeaks drops another cache of ‘Vault7’ stolen tools

Emissary Panda amongst others.

http://ift.tt/2eNkYDz

Trust Issues: Exploiting TrustZone TEEs

@Thoth, @Clive Robinson

http://ift.tt/2gX7p4U

The End of Triple DES

"The US National Institute of Standards and Technology (NIST) has just announced withdrawal of approval for triple DES (also known as 3DES, TDEA and sometimes DES EDE) in common protocols such as TLS and IPSec."

http://ift.tt/2uPnZKl

http://ift.tt/2tKpPan

Cyber arm of UK spy agency left without PGP for four months

"UK spy agency GCHQ’s cyber security arm, CESG, was left without PGP encryption for more than four months, according to a government report."

http://ift.tt/2vSNWF8

http://ift.tt/2vT0qwC

On Kaspersky

The author dislikes the fact that the "U.S. government used Kaspersky Lab’s products—including on DOD systems."

http://ift.tt/2vY6kg1

KL AV for Free. Secure the Whole World Will Be.

Kaspersky Free is due to be released. Coincidence? You can't blame the company for wanting market penteration.

http://ift.tt/2tW8AD2

Exclusive: Congress asks U.S. agencies for Kaspersky Lab cyber documents

"A U.S. congressional panel this week asked 22 government agencies to share documents on Moscow-based cyber firm Kaspersky Lab, saying its products could be used to carry out "nefarious activities against the United States," according to letters seen by Reuters."

http://ift.tt/2eUof3K

Going dark: encryption and law enforcement

http://ift.tt/2uxJr3l

Reminder: Spies, cops don't need to crack WhatsApp. They'll just hack your smartphone

http://ift.tt/2uD6f1L

WhatsApp: The Bad Guys’ Secret Weapon

http://ift.tt/2uC5qs2

De-Anonymization, Smart Homes, and Erlang: Tor is Coming to SHA2017

http://ift.tt/2usmQW1

Sounds bad: Researchers demonstrate “sonic gun” threat against smart devices

"A sonic "gun" could in theory be used to knock drones out of the sky, cause robots to fail, disorient virtual or augmented reality software, and even knock people off their "hoverboard" scooters. It could also potentially be used to attack self-driving cars or confuse air bag sensors in automobiles."

http://ift.tt/2tQ1Gnn

macOS Fruitfly Backdoor Analysis Renders New Spying Capabilities

"A mysterious piece of malware that gives attackers surreptitious control over webcams, keyboards, and other sensitive resources has been infecting Macs for at least five years."

http://ift.tt/2vfc74s

Novel attack tricks servers to cache expose personal data

"The so-called web caching attack targets sites that use content delivery network (CDN) services such as Akamai and Cloudflare."

http://ift.tt/2uTO0b3

Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science
FLARE VM: The Windows Malware Analysis Distribution You’ve Always Needed!
HawkEye Credential Theft Malware Distributed in Recent Phishing Campaign

http://ift.tt/2v3jEml

http://ift.tt/2tKBHhb

http://ift.tt/2uUHP6o

EVERY app offered by alternative Android app market redirected to malware

http://ift.tt/2uXDy1X

Wallet-snatch hack: ApplePay 'vulnerable to attack', claim researchers

http://ift.tt/2w6uc0Q

Hackers can turn web-connected car washes into horrible death traps

http://ift.tt/2v2a3fI

The opsec blunders that landed a Russian politician's fraudster son in the clink for 27 years

http://ift.tt/2uGoJi0

Upcoming USB 3.2 Specification Will Double Data Rates Using Existing Cables

http://ift.tt/2vGu4WC

from Schneier on Security http://ift.tt/2v58vBu

What Could Happen to LGBTQ Rights After a Week of Political Attacks

Weekly Upgrades: How We Made Two Twitter Bots Become Friends

How To Enable Dark Mode On Your Smartphone For Late Night Browsing

See Just How Disgusting Your Carpets Are With the Bissell ReadyClean, Now Cheaper Than Ever

Score a Job at Amazon Before They Employ Us All

3-Ingredient Happy Hour: The Classic, Boozy Vesper

Day 1: A Beginner's Guide to HIIT Class

HIIT—or High Intensity Interval Training, for the uninitiated—is one of the trendiest exercise programs out there at the moment, but getting started as a first-timer can be daunting, to say the least. (“High intensity” has a way of making a workout sound effective, but not necessarily so approachable.)

As part of our ongoing “Day 1" series demystifying the process of jumpstarting a new hobby or activity, we asked trainer Holly Rilinger for tips on approaching your very first HIIT class, including what to wear (hint: not running shoes!), how to give the teacher a heads up that you’re a beginner, and most importantly, a reminder that “nobody is looking at you.”

Advertisement

Video Credits:

Senior Producer: Kiran Chitanvis

Advertisement

Creative Producer: Jorge Corona

Advertisement

Associate Producer: John Dargan

from Lifehacker http://ift.tt/2uEXQwk

Me on Restaurant Surveillance Technology

I attended the National Restaurant Association exposition in Chicago earlier this year, and looked at all the ways modern restaurant IT is spying on people.

But there's also a fundamentally creepy aspect to much of this. One of the prime ways to increase value for your brand is to use the Internet to practice surveillance of both your customers and employees. The customer side feels less invasive: Loyalty apps are pretty nice, if in fact you generally go to the same place, as is the ability to place orders electronically or make reservations with a click. The question, Schneier asks, is "who owns the data?" There's value to collecting data on spending habits, as we've seen across e-commerce. Are restaurants fully aware of what they are giving away? Schneier, a critic of data mining, points out that it becomes especially invasive through "secondary uses," when the "data is correlated with other data and sold to third parties." For example, perhaps you've entered your name, gender, and age into a taco loyalty app (12th taco free!). Later, the vendors of that app sell your data to other merchants who know where and when you eat, whether you are a vegetarian, and lots of other data that you have accidentally shed. Is that what customers really want?

from Schneier on Security http://ift.tt/2tQG4aD

There's Finally An Affordable Roomba That You Can Control With Your Phone

Ask Dr. NerdLove: I Didn’t Cheat But My Wife Thinks I Did

The Easiest Way to Learn How to Juggle

If you’ve always wanted to learn how to juggle, you’ll be happy to know it’s actually pretty easy to learn. All you need is a little patience—and a few plastic bags.

In the video above from the SlickJuggling YouTube channel, David Slick, world record holder for the longest duration juggling, shows how most jugglers get their start: with scarves. That’s right, if you want to learn how to juggle, you toss floaty scarves instead of balls, rings, batons, pins, or fire.

Advertisement

The way you practice is simple. Sit down on the ground. Start with two scarves—one on the ground to your left, and one in your left hand. Now throw the scarf in your left hand to the right, and pick up the one on the ground. Repeat on the other side, and you have the basic mechanics down. Add the third scarf now. Hold two scarves and place one on your left side. Throw the scarf in your left hand, pick up the scarf on your left, throw the scarf in your right hand, pick up the scarf on your right. Throw, pick up, throw, pick up, etc. Eventually you’ll be quick enough to throw and catch them while they hang in the air.

Best of all, you don’t need to go buy special juggling scarves. You can use plastic grocery store bags since they’re just as floaty and easy to snatch. Over time, you’ll be able to move on to balls or bean bags using the same technique. When you’re ready to stand and do it, or you’re trying the heavier stuff, try standing over a bed to make things easier. Keep at it and you’ll be a world class juggler in no time.

from Lifehacker http://ift.tt/2tK46jE

Blowing Germs All Over Someone Else’s Food is Fine When It’s Birthday Cake

The 5 Factors Behind Your Credit Score

News in brief: beware the hacked carwash; man sentenced over Mirai attack; farewell to the iPod

Your daily round-up of some of the other stories in the news

When a carwash goes rogue

We’ve written about hacking cars on Naked Security, and we’re all too well aware of the vulnerabilities of devices connected to the Internet of Things. But the news that a connected carwash could potentially be vulnerable to attacks has pretty much floored us.

First, we have to ask: why on earth does a carwash need to be connected? It turns out that some carwashes made by PDQ not only come with huge whirly brushes and water jets, but also with a web server that, according to Bleeping Computer, allows staff to manage the contraption remotely.

And, according to researchers led by Billy Rios, that web server comes with a default password that’s common to all the models identified in their alert, which means that if it’s not changed anyone could take control of the carwash.

The researchers said in their presentation at Black Hat in Las Vegas that they’d actually alerted the manufacturer to the vulnerability two years ago, but that it hadn’t yet been patched.

The research makes for scary reading: they said they could potentially lock cars with customers and operatives inside the carwash and direct water at them.

Next time you’re thinking of getting the car washed, you might want to check out what model your local garage has installed – and maybe pick somewhere else.

Man sentenced for Mirai attack on Deutsche Telekom

A British man was given a suspended sentence at a court in Germany on Friday after he admitted to having been behind the Mirai attack last year that knocked out nearly one in 20 German customers of the ISP Deutsche Telekom.

The 29-year-old man, identified as Daniel K, told the court in Cologne last week that the attack was “the worst mistake of my life”, and, according to Sky News, claimed that he’d been paid £7,700 by a Liberian company to develop a botnet.

The man, who uses the online handle “Spiderman”, is also facing charges in the UK, where authorities have asked for his extradition.

Deutsche Telekom said the attack had caused damages totalling €2m, and added that it’s considering a civil lawsuit against the man, who was arrested at Luton airport in the UK in February.

End of the line for the iPod

It’s the end of an era for those of us whose first experience of digital music on the move was Apple’s iconic iPod: the Cupertino company has said that it’s to finally retire its venerable iPod Nano and iPod Shuffle.

Those two devices are the last in the line of a product that was born back in 2001, launched by Steve Jobs with the tagline: “1,000 songs in your pocket”. The very first iteration was Mac-only and had a mechanical clickwheel and a mono screen, with a similar Windows-friendly version following soon after.

From there the iPod acquired a touchwheel and a colour screen, and then the ability to store and display photographs before shrinking down into the much smaller Shuffle and Nano devices, and also evolving into the iPod Touch, the immediate precursor to the iPhone.

While we mourn an iconic piece of hardware, let’s not forget that it wasn’t the first digital music player to sport a hard drive, and many of us would very much like to see iTunes, which was developed to manage the iPod, follow the device into oblivion.

But the writing was on the wall for the iPod as smartphones acquired not only the ability to play music, but also decent-sized hard drives. Meanwhile, I’m going to dust off my first-gen iPod Touch (running iOS 5) and see if a museum would like to give it a home.

Catch up with all of today’s stories on Naked Security

Follow @NakedSecurity
Follow @katebevan

from Naked Security http://ift.tt/2u5LSIq

PSA: The Nintendo 2DS XL Is In Stock On Amazon, At Least For Now

Obamacare Repeal Is Dead (For Now)—Here's What That Means for Your Healthcare

Podcasts for Parents and Kids

There Is No Magic Solution To Your Underwater Car Loan

iPhone: Get a One-Handed Keyboard Without Waiting for iOS 11

The Essential Tools Inside a Pro Travel Photographer's Bag

How to Survive Toddlers From The Authors of The Toddler Survival Guide

If someone comes along and shoots an arrow into your heart...

“If someone comes along and shoots an arrow into your heart, it’s fruitless to stand there and yell at the person. It would be much better to turn your attention to the fact that there’s an arrow in your heart.”—Pema Chodron

from Lifehacker http://ift.tt/2v6iwxZ

Screengrabber Bah Gawd, It’s The Rattlesnake!

Screengrabber Bah Gawd, It’s The Rattlesnake! | The Slot Anthony Scaramucci Says ‘Cock’ 3 Times in Unhinged New Yorker Interview | Splinter Fox News Hosts Can’t Contain Their Rage Over the Survival of Obamacare | The Root ‘We’re Gonna Kill All of You’: Woman Gets Fired After Threatening 3 Somali Women in ND |

from Lifehacker http://ift.tt/2uEMjNn

Today's Best Deals: Mini Kamado Grill, Graphics Tablet, Civilization VI, and More

Will It Sous Vide?: Fresh Homemade Cheese

Use a Makeup Sponge for Mess-Free Period Sex

Unleash Your Inner Artist With This Amazon One-Day Sale

What to Know About Bell's Palsy, a Condition That Paralyzes Half Your Face

Lipizzan spyware linked to cyberarms firm plunders SMS, logs and photos

Thanks to Jagadeesh Chandraiah and Ferenc László Nagy of SophosLabs for their behind-the-scenes work on this article.

Android users take note: spyware called Lipizzan has infected up to 100 devices and can monitor phone activity while extracting data from popular apps.

That doesn’t sound like a huge number of devices, but as researchers elsewhere have noted, this looks like targeted, precision malware rather than a broad data-stealing tool. Google’s Android Developers’ blog said that “Lipizzan’s code contains references to a cyberarms company, Equus Technologies”, whose LinkedIn page says it’s a company “specializing in the development of tailor made innovative solutions for law enforcement, intelligence agencies, and national security organizations”.

Lipizzan appeared on Google Play as an innocent-looking app with names like “Backup”, “Cleaner” and “Notes”.

Researchers described Lipizzan as a multi-stage spyware product capable of monitoring and exfiltrating a user’s email, SMS messages, location, voice calls, and media. Twenty Lipizzan apps were distributed in a targeted fashion to 100 or so devices. Google has blocked the developers and apps from the Android ecosystem, and Google Play Protect has removed it from the infected phones.

Though Google’s response was swift, the spyware itself exemplifies the ever-increasing zeal malware creators are showing when it comes to targeting Android.

SophosLabs researchers have analyzed the spyware and painted the following picture:

In one of the samples, the stage-1 application appears as “Notes Plus” – an innocent-looking notes-taking application:

If you look carefully under assets, you can see that Lipizzan has an AES-encrypted zip file that is decrypted and loaded at runtime.

Payload

A stage-2 apk file does all the malicious activities and includes the spyware payload. The payload examined by SophosLabs received following commands:

It has the ability to:

• record calls,
• take snapshots,
• hijack the microphone, and
• capture the location.

In addition to monitoring your phone, it also fetches data from popular apps, SMS and call logs:

It targets data from the following applications:

• Skype
• Hangouts
• LinkedIn
• Telegram
• Whatsapp
• Viber
• Call logs
• Email
• Gmail

You can see the data extraction code for Hangouts and whatsapp below:

Anti-debug and anti-VM

The stage-2 file is designed to make life difficult for security researchers by employing anti-debug and anti-emulator features to slow down analysis in test environments.

For anti-debug verification, it checks if adb is enabled. Researchers use adb to interact with Android devices from another computer.

The anti-emulator checks for the following:

• If Build_PRODUCT – sdk, google_sdk, sdk_x86 , vbox86p (AndroVM)
• If Build_MANUFACTURER – unknown, Genymotion (Popular Android Emulator)
• If Build.BRAND – generic , generic_x86
• If Build.DEVICE – generic, generic_x86, vbox86p
• If Build.MODEL- sdk, google_sdk, Android SDK built for x86
• If Build.HARDWARE – goldfish, vbox86
• If Build.FINGERPRINT – generic/sdk/generic, generic_x86/sdk_x86/generic_x86, generic/google_sdk/generic, generic/vbox86p/vbox86p

Now what?

As noted above, Google has blocked the spyware from Google Play. Sophos detects it as Andr/Lipizan-A and has blocked it from customers.

The continued onslaught of malicious Android apps demonstrates the need to use an Android antivirus such as our free Sophos Mobile Security for Android.

By blocking the install of malicious and unwanted apps, even if they come from Google Play, you can spare yourself lots of trouble.

Follow @NakedSecurity
Follow @BillBrenner70

from Naked Security http://ift.tt/2uJjtdc

Are you a Sysadmin? Find out now for free!

It’s #SysAdminDay, and although most of us think we know what sysadmins are, it’s easy to make mistakes.

Some people say that if you yourself think you are a sysadmin, then ipso facto you are not; similarly, that if you think you are not a sysadmin, then ipso facto you are not.

(This does not leave the set of all sysadmins empty: if you form no personal opinion about whether you are a sysadmin or not, then it is clearly still possible for you to be one. Or not.)

We thought we’d try to sort out the confusion using a classification technique called “feature extraction”, which is where you try to identify those parts of an object that are sufficient on their own to differentiate between, say, documents and spreadsheets, or between malware and goodware…

…or between sysadmins and, well, other people,

Take our quick quiz and find out for sure

Here goes: choose one of A, B or C for each of the five questions below. (You must choose the closest answer each time – don’t skip a question because your own perfect answer isn’t listed.)

You don’t need to keep track of which answer you gave to what question – just count the number of times you said each of A, B and C.

1. A healthy breakfast is:

A. A bowl of cereal.
B. Smashed avocado on pumpernickel.
C. C₈H₁₀N₄O₂.

---

2. A purposeful weekend that benefits those around me includes:

A. Mowing the lawn.
B. Visiting a craft brewery.
C. Call of Duty.

---

3. My favourite computer is:

A. Latest model iPhone.
B. iMac (2003 model year, purple variant).
C. No favourites. I love my whole botnet.

---

4. The coolest sort of transport is:

A. Ford Focus ST.
B. Fixed-gear bicycle.
C. SSH.

---

5. On a first date, I wear:

A. Chinos, boat shoes, 100% cotton T-shirt.
B. Skinny jeans, cashmere cape, paisley button-down.
C. Doesn’t matter, I keep the webcam on my face.

---

Find out about yourself

Here’s what your answers mean:

Follow @NakedSecurity
Follow @duckblog

from Naked Security http://ift.tt/2w6Auxo

Police crack seized phones of inauguration day protesters

We already know that police scoured the social media accounts of at least some of the 230 protesters arrested on inauguration day in January 2017 (pictured).

They also seized the phones of more than 100 people and began rooting around for data.

In March, prosecutors said in a court filing (PDF) that at that point, the government expected to be in a position “to produce all of the data from the searched Rioter Cell Phones in the next several weeks”.

It would take a while, the government said in the March filing:

All of the Rioter Cell Phones were locked, which requires more time-sensitive efforts to try to obtain the data.

Well, it turns out that most, but not all, of the phones were locked, as in, encrypted. And the police plan to have quite the field day with those few in the inauguration day court cases.

In March, federal prosecutors were stitching together a cloud-based database full of all the personal data they had managed to squeeze out of those 100 phones. Some of the phones belonged to people who had been indicted, while others belonged to un-indicted arrestees.

They sought to make the data available to the lawyers of 214 defendants accused of felony rioting.

Now, thanks to a a July 21 filing seen by The Daily Beast, we know exactly what data investigators managed to get their hands on after cracking the passwords of at least eight locked phones.

Namely, prosecutors say they want to use extracted internet histories, communications, and photos as evidence against the defendants in court.

The July 21 filing moved to enter evidence from eight seized phones, six of which were encrypted and two of which were not. A Department of Justice representative confirmed to the Daily Beast that “encrypted” meant additional privacy settings beyond a lockscreen.

According to the July 21 filing, encryption did what encryption’s supposed to do. The encrypted phones didn’t offer up much of anything: just “a short data report which identifies the phone number associated with the cell phone and limited other information about the phone itself”.

The unencrypted phones, on the other hand, offered up a jackpot. Investigators got everything: the phones’ “call detail records,” “SMS or MMS messages,” “contact logs/email logs,” “chats or other messaging applications,” “website search history and website history,” and “images or videos.” Prosecutors are seeking to use whatever of that data related to January 20 – the date of the protest – or to other people who are suspected of having been involved in the protest.

As CityLab reported in January, police may have been attempting to search arrested people’s devices for content pre-trial, within a day of seizing them. One detainee’s Gmail account sent out a Google alert about being accessed at 4:15 pm the day after its owner had been arrested, while the device was in police possession.

Prosecutors claimed in the March filing that they had accessed a “large amount” of personal information that was irrelevant to the charges the defendants are facing, including photos and videos. In fact, assistant United States attorney Jennifer Kerkhoff told the court in March that the government had collected more than 600 hours of video footage from the confiscated phones.

Mark Goldstone, a lawyer representing six of the accused, said it’s not surprising that some of the footage is irrelevant. It’s pretty mundane, and it’s hard to see how it could be used to prosecute people on charges of rioting. Esquire quoted Goldstone when he was on a late-March conference call with 15 other lawyers representing protestors, when he said that for some of the defendants, the video amounted to…

Here’s your client at the beginning of the march, wearing black clothes and goggles, your client could have left but did not, and here is your client at the end, in the police kettle.

It sure doesn’t sound like much of a smoking gun. But as Esquire puts it, it’s not hard to demonize a masked protester.

Goldstone:

The scary thing about it is that defendants who want to test that theory have to be willing to face a jury, who could uphold the government’s line.

It’s one example of how there are good reasons to keep personal data private – and your phone encrypted. If law enforcement is looking through your device after you’ve been at a protest, making it harder to access makes sense.

Follow @NakedSecurity
Follow @LisaVaas

from Naked Security http://ift.tt/2v6gwG6