Year 2013 will be year of cyber security. CNN expects more cyber wars this year. Cybercrime is on the rise, and last year we saw more and more computer virus attacks. Security company Kaspersky Lab warns of more new cyber-threats against enterprises and mobile devices. Cyber security also relates to mobile.
Security becomes an increasingly important issue. Year 2013 is the year of cyber security. Security company Stonesoft predicts we will face a more targeted launch cyber-attacks, cyber espionage and hactivism. Cyber security is the fastest growing trend in information security and its importance will increase in the future. According to Stonesoft the current security systems are unable to provide adequate protection against targeted attacks: we require proactive cyber protection and willingness to face the unknown threats.
Hacktivism will continue. According to article Anonymous: ‘Expect us 2013′ the hacking group boasted its cyberattacks against the U.S., Syrian, and Israeli governments in 2012. They are also warning people to continue to expect this type of activity.
SCADA security was hit hard in 2012. Some of the big manufacturers hit hard have learned their lessons and test their devices more now. But how are some smaller manufacturers security testing? Metasploit has special category for SCADA
devices. Good idea to test your devices against it.
There is still work to do on Cyber security standards and SCADA standards. For example in very widely used automation security standard IEC 61508 security is addresses only in informative way (NOT MANDATORY. IEC 62443-2-4: A Baseline Security Standard for Industrial Automation Control Systems is a good starting point when thinking on SCADA systems security.
Nowadays you need to think about SCADA system security more then some years ago. Previously, it was thought that it is sufficient to isolate factory process automation system from the office networks and the Internet. This is no longer enough. Nowadays you need to think about information security of production of automation systems. You can’t keep the automation systems isolated from Internet. Accidental connections to Internet from isolated networks happen. Malware can spread through USB memory sticks (Stuxnet did that). And nowadays there are more and more business reasons to connect process automation systems to other networks. So automations system do not anymore live in complete isolation from rest of the world.
Systems with SCADA vulnerabilities have become easier to find. Hackers tap SCADA vuln search engine article tells a search engine that indexes servers and other internet devices is helping hackers to find industrial control systems that are vulnerable to tampering. Search engine Shodan easily pinpoints shoddy industrial controls. Shodan makes it easy to locate internet-facing SCADA, or supervisory control and data acquisition, systems used to control equipment at gasoline refineries, power plants and other industrial facilities. The search engine can also be used to identify systems with known vulnerabilities. Shodan makes networks more vulnerable to brute-force attacks on passwords, many of which may still use factory defaults.
Thousands of SCADA Devices Discovered On the Open Internet article tells that there are all the time news of the continuing poor state of security for industrial control systems. The pair of researchers with found found not only devices used for critical infrastructure such as energy, water and other utilities, but also SCADA devices for HVAC systems, building automation control systems, large mining trucks, traffic control systems, red-light cameras and even crematoriums. Never underestimate what you can do with a healthy list of advanced operator search terms and a beer budget.
Researchers have also found crippling flaws in GPS receivers. Global Positioning System infrastructure critical to the navigation of a host of military and civilian technologies including planes, ships and unmanned drones. GPS system is also used to generate accurate clocks in SCADA system and smart grid devices. Researchers showed that they could permanently de-synchronise the date of Phasor Measurement Units used in smart grid and cause UNIX epoch rollover in a few minutes. The overall landscape of GPS vulnerabilities is startling.
Happy now? Mobiles, cloud, big data now ‘a growing security risk’ article tells that innovations in mobile and cloud computing, social technology and the use of “big data” present an emerging risk to organisations’ IT security, experts have warned. The European Network and Information Security Agency (ENISA), which is an EU advisory body, said that those technologies would increasingly provide the platform for “most of the innovation expected in the area of IT” and warned that with their emergence would come an associated increased cyber threat. ENISA warned that the threat stemming from mobile computing comes from the fact that mobile communications take place over “poorly secured … or unsecured channels”. The most significant threat stems from hackers inserting malicious software in website browser and other software available on mobile devices. Cyber criminals could also use the capabilities of cloud computing for their own gains, such as by storing malware in those systems and using the technology as a platform to launch attacks.
Drive-by downloads attacks against web browsers have become the top web threat. More specifically, attackers are moving into targeting browser plugins such as Java (Java exploits are the major cross-platform threat), Adobe Reader and Adobe Flash. The drive-by download attacks are almost exclusively launched through compromised legitimate websites which are used by attackers to host malicious links and actual malicious code. Exploits are sold for considerable amount of money and quickly included into exploit kits.
Africa’s Coming Cyber-Crime Epidemic article tells that last decade may have just been the first step in a looming African cyber-crime wave. Africa has the world’s fastest-growing middle class, whose members are increasingly tech-savvy and Internet connected and lax law enforcement is a perfect petri dish for increased cybercrime.
European wide cyber police started. EU’s new European Cybercrime Centre (EC3) was just opened few days ago. The facility will act as the “focal point” in the EU’s fight against cybercrime, against both businesses and private citizens. EC3 will act as a hub where crime-fighters can pool expertise and information, support criminal investigations and help develop and spread best practice. It will work with industry to develop threat assessments. It will work closely with the FBI and the US Secret service, in addition to other foreign agencies.
1,930 Comments
Tomi Engdahl says:
NSA gathered thousands of Americans’ e-mails before court ordered it to revise its tactics
http://www.washingtonpost.com/world/national-security/nsa-gathered-thousands-of-americans-e-mails-before-court-struck-down-program/2013/08/21/146ba4b6-0a90-11e3-b87c-476db8ac34cd_story.html
For several years, the National Security Agency unlawfully gathered tens of thousands of e-mails and other electronic communications between Americans as part of a now-revised collection method, according to a 2011 secret court opinion.
The redacted 85-page opinion, which was declassified by U.S. intelligence officials on Wednesday, states that, based on NSA estimates, the spy agency may have been collecting as many as 56,000 “wholly domestic” communications each year.
“For the first time, the government has now advised the court that the volume and nature of the information it has been collecting is fundamentally different from what the court had been led to believe,” John D. Bates, then the surveillance court’s chief judge, wrote in his Oct. 3, 2011, opinion.
“The court is troubled that the government’s revelations regarding NSA’s acquisition of Internet transactions mark the third instance in less than three years in which the government has disclosed a substantial misrepresentation regarding the scope of a major collection program,” Bates wrote in a scathing footnote.
Tomi Engdahl says:
How NSA Bypassed the Fourth Amendment for 3 Years
On October 3, 2011, the FISA Court deemed some of the NSA’s collections to violate the Fourth Amendment. – See more at: http://www.emptywheel.net/2013/08/20/how-nsa-bypassed-the-fourth-amendment-for-3-years/#sthash.5DwQk4fW.dpuf
Tomi Engdahl says:
What You Need to Know on New Details of NSA Spying
http://online.wsj.com/article/SB10001424127887324108204579025222244858490.html
Today’s report in The Wall Street Journal reveals that the National Security Agency’s spying tools extend deep into the domestic U.S. telecommunications infrastructure, giving the agency a surveillance structure with the ability to cover the majority of Internet traffic in the country, according to current and former U.S. officials and other people familiar with the system.
The information here is based on interviews with current and former intelligence and government officials, as well as people familiar with the companies’ systems.
Although the system is focused on collecting foreign communications, it includes content of Americans’ emails and other electronic communications, as well as “metadata,” which involves information such as the “to” or “from” lines of emails, or the IP addresses people are using.
At key points along the U.S. Internet infrastructure, the NSA has worked with telecommunications providers to install equipment that copies, scans and filters large amounts of the traffic that passes through.
This system had its genesis before the attacks of Sept. 11, 2001, and has expanded since then.
Tomi Engdahl says:
Facial Scanning Is Making Gains in Surveillance
http://www.nytimes.com/2013/08/21/us/facial-scanning-is-making-gains-in-surveillance.html?pagewanted=all&_r=0
The federal government is making progress on developing a surveillance system that would pair computers with video cameras to scan crowds and automatically identify people by their faces, according to newly disclosed documents and interviews with researchers working on the project.
The Department of Homeland Security tested a crowd-scanning project called the Biometric Optical Surveillance System — or BOSS — last fall after two years of government-financed development. Although the system is not ready for use, researchers say they are making significant advances. That alarms privacy advocates, who say that now is the time for the government to establish oversight rules and limits on how it will someday be used.
There have been stabs for over a decade at building a system that would help match faces in a crowd with names on a watch list — whether in searching for terrorism suspects at high-profile events like a presidential inaugural parade, looking for criminal fugitives in places like Times Square or identifying card cheats in crowded casinos.
The automated matching of close-up photographs has improved greatly in recent years, and companies like Facebook have experimented with it using still pictures.
In interviews, Ed Tivol of Electronic Warfare Associates and Dr. Farag both suggested that as computer processing becomes ever faster the remaining obstacles will fall away.
Several independent biometric specialists, given a description of the project’s test results, agreed that the system was not yet ready. They said 30 seconds was far too long to process an image for security purposes, and that its accuracy numbers would result in the police going out to question too many innocent people.
“This technology is always billed as antiterrorism, but then it drifts into other applications,” Ms. McCall said. “We need a real conversation about whether and how we want this technology to be used, and now is the time for that debate.”
Tomi Engdahl says:
Bradley Manning sentenced to 35 years in prison for WikiLeaks disclosures
http://www.theverge.com/2013/8/21/4642816/bradley-manning-sentenced-wikileaks-case
Bradley Manning’s court-martial reached an end today, with Army Colonel Denise Lind sentencing him to 35 years in prison.
The WikiLeaks source, arrested in Iraq in 2010 for releasing nearly 700,000 government documents to WikiLeaks, was found not guilty of the most serious charge of “aiding the enemy,” which could have resulted in life imprisonment. Manning was found guilty on virtually all other charges under the Espionage Act, the Computer Fraud and Abuse Act, and the code of military justice.
In a brief statement, he apologized for his actions, saying, “At the time of my decisions, as you know, I was dealing with a lot of issues. Although they have caused me considerable difficulty in my life, these issues do not excuse my actions.”
Tomi Engdahl says:
Manning’s Sentence, Miranda’s Detention
http://www.newyorker.com/online/blogs/closeread/2013/08/mannings-sentence-mirandas-detention.html?currentPage=all
Bradley Manning has been sentenced to thirty-five years in prison. Military prosecutors had asked for sixty years, out of a possible ninety
Manning gave hundreds of thousands of classified war logs and diplomatic cables to WikiLeaks. He also gave them a video
The sentence will be appealed, and Manning will be eligible for parole in about eight years. Whether he gets it then is likely to be as politicized a matter as this court martial was from the beginning. He was also dishonorably discharged.
What is the point of this sentence? The prosecutors had a simple answer: there had to be a deterrent. (“This court must send a message to any soldier contemplating stealing classified information,” a prosecutor said in the sentencing hearing.) A frightening, crippling sentence was the only way to make sure that no one leaked again, ever. What it seems likely to do is chill necessary whistle-blowing and push leakers to extremes.
The lesson that Edward Snowden, the N.S.A. leaker, seems to have drawn from the prosecutions of Manning and others is that, if you have something you think people should know, take as many files as you can and leave the country.
What combination of over-classification and security bureaucracy requires almost five million people in this country to have security clearances—almost a million and a half with top-secret clearance, which is what Manning had, or higher? That’s also why Snowden, a private contractor, saw what he did.
There are laws against giving away classified files, including those Manning offered to plead guilty to. Why was it so important to call him a spy? An answer is that we have reached a point where our government, and allies like Britain, can’t tell the difference between leak investigations and espionage and terrorism.
It is also on that score that the detention of David Miranda, the partner of Glenn Greenwald, the Guardian journalist who received files from Snowden, is so dangerous. Miranda, a Brazilian citizen, was held for nine hours while in transit at Heathrow Airport under a section of Britain’s Terrorism Act.
How was Miranda involved in terrorism, even putatively? Saying that the public revelations about surveillance made it harder for the N.S.A. to continue on as before is not an adequate answer.
Miranda’s detention was joined with an extraordinary incident (which my colleague John Cassidy has written about) that ended with British intelligence officers standing in the Guardian offices while computer equipment holding files from Snowden were smashed into small pieces. There are other copies
Tomi Engdahl says:
NSA and Intelligence Community turn to Tumblr — weird but true
http://news.cnet.com/8301-1009_3-57599622-83/nsa-and-intelligence-community-turn-to-tumblr-weird-but-true/
In light of top-secret document leaks that show the U.S. government spied on people, the country’s Director of National Intelligence launches a Tumblr blog for greater transparency.
Tomi Engdahl says:
New Zealand Approves Domestic Spying, ‘Death Of Privacy,’ Says Kim Dotcom
http://www.ibtimes.com/new-zealand-approves-domestic-spying-death-privacy-says-kim-dotcom-1393999
New Zealand has approved a new bill that will expand the power of its spy agency and allows for domestic surveillance. The bill’s passage has been met with plenty of criticism most notably from Kim Dotcom, founder of Mega, who said “Today is the death of privacy” on Twitter.
Tomi Engdahl says:
SMS to Shell: Fuzzing USB Internet Modems : Analysis of Autoupdate features
http://www.garage4hackers.com/blogs/8/sms-shell-fuzzing-usb-internet-modems-analysis-autoupdate-features-1083/
This is a continuation from my previous(main) blog post where I explained the security issues with USB internet modems. And this is a second part where I would dissect the autoupdate feature of these devices, mainly because we noticed that the costumers were never getting security updates.
Any way Huawei was very keen in finding more bugs and fixing there products, so many thanks to them and I could not find a security response service for disgisol.
So seems like the local vendors, IDea, Reliance, Tata etc who uses Huawei has not pushed these patches to there costumers even though these bugs were fixed in 2011, weird right . So there is no point me sharing more bugs to Huewai as there seems to be no way for them to update the device users with these patches.
Tomi Engdahl says:
SMS to Shell: Fuzzing USB Internet Modems
http://www.garage4hackers.com/blogs/8/sms-shell-fuzzing-usb-internet-modems-1082/
Research focused on widely used products/services is of high importance because of the large attack and impact surface it provides to the attacker . This blog focus on an innovative new attacks surface [USB Data Modems] because of the the large impact surface .
We would not be releasing the POC exploit which we have found on various modem devices for another 3 months, mainly because there is no autoupdate mechanism available on these modems. Even though I was not able to make a highly sophisticated exploit I have come up with POC codes to demonstrate the damages. And a highly skilled exploit writer could make all the devices out there vulnerable to these attacks. So once this blog is published I will request all the device vendors to enable/add an auto update mechanism on these device and push the patches to their costumers.
Tomi Engdahl says:
Declassified Documents Prove NSA Is Tapping the Internet
http://www.wired.com/threatlevel/2013/08/nsa-tapping-internet/
U.S. intelligence officials have declassified a secret court opinion that both chastises the National Security Agency for misleading the court and highlights an eavesdropping program in which authorities have direct access to “upstream” internet communications.
The document (.pdf) released today confirms for the first time unofficial leaks and speculation that the federal intelligence community has direct access to telecom companies’ backbones and it scoops up email communications as they go past. Millions are collected each year.
WIRED first reported on such an eavesdropping installation in 2007 when a former AT&T technician provided documents outlining eavesdropping technology used by AT&T.
Today’s revelation follows disclosures by NSA leaker Edward Snowden, who highlighted other NSA-backed spy programs, including one called PRISM and another that collects metadata from every phone call made in America.
Tomi Engdahl says:
EFF Wins Release of Secret Court Opinion: NSA Surveillance Unconstitutional
http://yro.slashdot.org/story/13/08/21/2343238/eff-wins-release-of-secret-court-opinion-nsa-surveillance-unconstitutional
“For over a year, EFF has been fighting the government in federal court to force the public release of an 86-page opinion of the secret Foreign Intelligence Surveillance Court (FISC). Issued in October 2011″
Tomi Engdahl says:
Forced Exposure ~pj
http://www.groklaw.net/article.php?story=20130818120421175
The owner of Lavabit tells us that he’s stopped using email and if we knew what he knew, we’d stop too.
There is no way to do Groklaw without email. Therein lies the conundrum.
What to do?
What to do? I’ve spent the last couple of weeks trying to figure it out. And the conclusion I’ve reached is that there is no way to continue doing Groklaw, not long term, which is incredibly sad. But it’s good to be realistic. And the simple truth is, no matter how good the motives might be for collecting and screening everything we say to one another, and no matter how “clean” we all are ourselves from the standpoint of the screeners, I don’t know how to function in such an atmosphere. I don’t know how to do Groklaw like this.
Harvard’s Berkman Center had an online class on cybersecurity and internet privacy some years ago, and the resources of the class are still online. It was about how to enhance privacy in an online world, speaking of quaint, with titles of articles like, “Is Big Brother Listening?”
And how.
You’ll find all the laws in the US related to privacy and surveillance there. Not that anyone seems to follow any laws that get in their way these days. Or if they find they need a law to make conduct lawful, they just write a new law or reinterpret an old one and keep on going. That’s not the rule of law as I understood the term.
I hope that makes it clear why I can’t continue. There is now no shield from forced exposure. Nothing in that parenthetical thought list is terrorism-related, but no one can feel protected enough from forced exposure any more to say anything the least bit like that to anyone in an email, particularly from the US out or to the US in, but really anywhere.
So this is the last Groklaw article. I won’t turn on comments. Thank you for all you’ve done.
Tomi Engdahl says:
Exclusive: UK’s secret Mid-East internet surveillance base is revealed in Edward Snowden leaks
http://www.independent.co.uk/news/uk/politics/exclusive-uks-secret-mideast-internet-surveillance-base-is-revealed-in-edward-snowden-leaks-8781082.html
Data-gathering operation is part of a £1bn web project still being assembled by GCHQ
Britain runs a secret internet-monitoring station in the Middle East to intercept and process vast quantities of emails, telephone calls and web traffic on behalf of Western intelligence agencies, The Independent has learnt.
The station is able to tap into and extract data from the underwater fibre-optic cables passing through the region.
The information is then processed for intelligence and passed to GCHQ in Cheltenham and shared with the National Security Agency (NSA) in the United States.
The Middle East installation is regarded as particularly valuable by the British and Americans because it can access submarine cables passing through the region. All of the messages and data passed back and forth on the cables is copied into giant computer storage “buffers” and then sifted for data of special interest.
Information about the project was contained in 50,000 GCHQ documents that Mr Snowden downloaded during 2012. Many of them came from an internal Wikipedia-style information site called GC-Wiki. Unlike the public Wikipedia, GCHQ’s wiki was generally classified Top Secret or above.
The Independent understands that The Guardian agreed to the Government’s request not to publish any material contained in the Snowden documents that could damage national security.
The Government also demanded that the paper not publish details of how UK telecoms firms, including BT and Vodafone, were secretly collaborating with GCHQ to intercept the vast majority of all internet traffic entering the country.
But there are fears in Government that Mr Greenwald – who still has access to the files – could attempt to release damaging information.
He said after the arrest of Mr Miranda: “I will be far more aggressive in my reporting from now. I am going to publish many more documents. I have many more documents on England’s spy system. I think they will be sorry for what they did.”
One of the areas of concern in Whitehall is that details of the Middle East spying base which could identify its location could enter the public domain.
The data-gathering operation is part of a £1bn internet project still being assembled by GCHQ. It is part of the surveillance and monitoring system, code-named “Tempora”, whose wider aim is the global interception of digital communications, such as emails and text messages.
Across three sites, communications – including telephone calls – are tracked both by satellite dishes and by tapping into underwater fibre-optic cables.
Access to Middle East traffic has become critical to both US and UK intelligence agencies post-9/11.
Tomi Engdahl says:
Germany warns: You just CAN’T TRUST some Windows 8 PCs
Microsoft: You can still buy an ‘insecure’ Win 8 machine sans TPM chip
http://www.theregister.co.uk/2013/08/23/nsa_germany_windows_8/
Microsoft’s new touchy Windows 8 operating system is so vulnerable to data-sniffing that Germany’s businesses and government should not use it, German authorities have warned in a series of leaked documents.
According to leaked documents that appeared in German weekly Der Zeit, the country’s authorities fear the OS’s baked-in Trusted Computing technology – specifications and protocols including the infamous Secure Boot feature, which work together with hardware loaded with a unique encryption key inaccessible to the rest of the system – means that Germans’ data is not secure.
Authorities at Germany’s Federal Office for Information Security (BSI) later clarified that it was the Trusted Computing specs in Windows 8 in conjunction with the Trusted Platform Module (TPM) embedded in the hardware that creates the security issue. BSI released a statement which backtracked slightly and insisted that “specific user groups [using] of Windows 8 in combination with a TPM may well mean an increase in safety [concerns]“.
Trusted Computing is a controversial bunch of specifications developed by a group of companies including AMD, Cisco, Fujitsu, Hewlett-Packard, IBM, Intel, Microsoft and Wave Systems Corp.
The tech is designed to stop the use of software and files which do not contain the correct digital rights permissions (thus protecting the property of vendors behind the protocols), including “unauthorised operating systems” (a specific function of the much-maligned Secure Boot). But Secure Boot also protects the users from rootkits and other malware attacks. The set of permissions is automatically updated online, outside of the control of the user.
A machine that contains a Trusted Platform Module and runs software adhering to the Trusted Computing specifications is, arguably, under the control of the vendor – in this case Microsoft
A TPM 2.0 chip is being built into more and more computers running Windows 8.
The newspaper obtained an internal document from Germany’s Ministry of Economic Affairs written at the beginning of 2012. It warned of “the loss of full sovereignty over information technology” and that “the security objectives of confidentiality’ and integrity are no longer guaranteed”.
It continued: “The use of ‘Trusted Computing’… in this form … is unacceptable for the federal administration and the operators of critical infrastructure.”
Trusted Platform Module 2.0 is considerably more invasive than older versions.
“From the perspective of the BSI, the use of Windows 8 in combination with a TPM 2.0 is accompanied by a loss of control over the operating system and the hardware used. This results in new risks for the user, especially for the federal government and critical infrastructure.”
Tomi Engdahl says:
Nasdaq in Fresh Market Failure
Glitch That Locked Out Investors for Three Hours Is Latest Malfunction in Electronic Trading
http://online.wsj.com/article/SB10001424127887324619504579028873794227410.html
A technical glitch knocked out trading in all Nasdaq Stock Market securities for three hours Thursday afternoon, an unprecedented meltdown for a U.S. exchange that paralyzed a broad swath of markets and highlighted the fragility of the financial world’s electronic backbone.
Nasdaq officials scrambled to figure out what happened and resume trading.
Some hiccups persisted after Nasdaq reopened trading, though Nasdaq told traders that the markets closed normally Thursday.
“Our systems, and the industry’s, have to get to a higher level of robustness,” said Robert Greifeld, chief executive of Nasdaq parent Nasdaq OMX Group Inc., in an interview.
Nasdaq said it plans to work with other exchanges to investigate Thursday’s outage, which centered on a problem with the data feed supplying U.S. markets with trade information, and supports “any necessary steps to enhance the platform.”
Nasdaq officials internally pointed to a “connectivity” problem with rival NYSE Arca, according to people familiar with the matter, that led to price quotes not being reported.
SEC Chairwoman Mary Jo White said the episode “should reinforce our collective commitment to addressing technological vulnerabilities of exchanges and other market participants.”
The outage raised new questions about increasingly automated U.S. trading systems following a series of high-profile glitches, including an options-trading snafu on Tuesday that affected thousands of orders. Observers said the repeated snags could undermine confidence
The trading halt “calls into question the system in general,”
“This takes confidence from the markets,”
Several “dark pool” trading platforms, electronic venues set up to facilitate private stock transactions, shut down altogether in the wake of Nasdaq’s outage.
The reason: Nasdaq didn’t send electronic messages through the market feed telling firms trading had come to a stop. Normally, firms that run automated trading systems rely on such messages to stop and start trading in halted stocks throughout the day.
Nasdaq executives on Thursday pointed to the connectivity issues as triggering software and hardware problems on the data feed Nasdaq operates, according to people familiar with the discussions.
Thursday’s problem is the latest in a string of technology-related mishaps affecting exchanges and brokers.
Earlier this week, Goldman Sachs flooded U.S. stock-options markets with erroneous orders, most of which were later canceled.
Tomi Engdahl says:
Fuzzing usb modems rahu_sasi
by Rahul Sasi on Jul 26, 2013
http://www.slideshare.net/RahulSasi2/fuzzing-usb-modems-rahusasi?utm_source=ss&utm_medium=upload&utm_campaign=g4h#
Tomi Engdahl says:
Goldman Issues Mistaken Options Orders, Roiling Prices
Trades Traced to Software Program, Could Cost Firm Hundreds of Millions
http://online.wsj.com/article/SB10001424127887324747104579024964124614096.html
Goldman Sachs Group Inc. sent waves of erroneous orders into the stock-options market on Tuesday morning, the latest technical glitch to roil market prices and bedevil traders and regulators.
Still, Goldman’s potential losses on the mishap could run into hundreds of millions of dollars, according to people familiar with the matter.
“The exchanges are working to resolve the issue,” a Goldman spokesman said in a statement. “Neither the risk nor the potential loss is material to the financial condition of the firm.”
The trading error highlights the mounting risks of global financial markets that increasingly are being driven by computers rather than people. A series of mishaps since the “flash crash” of 2010, which sent stocks and exchange-traded funds plummeting in minutes, have undermined confidence in market systems around the world.
The episode is the latest in a series of market mishaps arising from technology designed to make markets more efficient.
Tomi Engdahl says:
Goldman trading glitch could cost more than $100 million
http://www.cnbc.com/id/100976404
The trades involved NYSE Euronext, CBOE and Nasdaq OMX, according to reports
The botched trades occurred when Goldman’s internal computer system that helps to determine where to price options mistakenly ended up sending orders at errant prices. Goldman is a market maker in the options market.
Tomi Engdahl says:
Nasdaq CEO Greifeld defends decision not to speak to press
http://www.cnbc.com/id/100983517
Nasdaq-OMX CEO Robert Greifeld defended the way his exchange handled Thursday’s three-hour outage, saying unspecified outside issues were the real problem.
Trading on the tech-heavy platform was halted for three hours as technicians identified the problem then coordinated with other market principles on resuming activity.
In a statement late Thursday, the Nasdaq said it knew 30 minutes into the outage what caused the problem, but it was another two-and-a-half hours before officials were ready to turn back on the all-electronic market.
Nasdaq identified the problem as a “connectivity issue between an exchange participant and the SIP,” or Securities Information Processor–essentially the system that receives all traffic on quotes and orders for stocks on the exchange.
“The way we handled the problem is there’s no liability,” he said. “No trading happened. It was a regulatory halt. Nobody was relatively advantaged nor disadvantaged. Everybody was on the same footing.”
Tomi says:
Online games a ‘playground’ for organized crime, according to security expert
http://www.polygon.com/2013/8/22/4646622/online-games-a-playground-for-organized-crime-according-to-security
Online games are a “playground” for organized crime and cyber criminals, JD Sherry, vice president of technology and solutions at Trend Micro said following the news that League of Legends accounts were compromised.
Earlier this week, account information – usernames, email addresses, salted password hashes, and some first and last names – for some North American League of Legends players were “compromised” by hackers.
The increase of free-to-play online gaming across all platforms over the years “have opened the doors to micro-transactions in-game.” The simple and functional systems created so players can spend money effortlessly creates “playgrounds” for cyber criminals take advantage of. Attackers can either
“Game platforms can have millions of users all storing sensitive information or code access for more features,” Sherry said. ” These are highly sought after in the cyber-crime underground for trading and selling in the black market. These platforms can fall victim to cyber-attacks just like any organization, especially if they have vulnerabilities that go unpatched.
bitgazette says:
this looks very interesting
Tomi Engdahl says:
How Not to DDoS Your Former Employer
http://krebsonsecurity.com/2013/08/how-not-to-ddos-your-former-employer/
Pro tip: If you’re planning to launch a debilitating denial-of-service attack against your former employer, try not to “like” the Facebook page of the DDoS-for-hire Web service that you intend to use in the assault.
Tell that to Kevin Courtois, a 28-year-old from Three Rivers, Quebec who was arrested earlier this year for allegedly launching a volley of cyber attacks against his former company over a nine month period beginning in May 2012.
“What’s funny is when we went to seize the hard drive, he didn’t look surprised because he hacked into the president of the company, so he knew that we were coming,” Masse said. “The funny part is that while he used data wiping software to wipe his drive, he only wiped the free space, but didn’t wipe his backups. That guy thought he was so smart, you should have seen the smirk on his face.”
Tomi Engdahl says:
Lawmakers Probe Willful Abuses of Power by NSA Analysts
http://www.bloomberg.com/news/2013-08-23/nsa-analysts-intentionally-abused-spying-powers-multiple-times.html
The leaders of U.S. congressional intelligence committees said they want to probe the intentional abuses of surveillance authority committed by some National Security Agency analysts in the past decade.
“I am reviewing each of these incidents in detail,” Dianne Feinstein, a California Democrat and chairman of the Senate intelligence panel, said in a statement, after the NSA confirmed to Bloomberg News yesterday that some analysts deliberately ignored restrictions on their authority to spy on Americans.
“Any case of noncompliance is unacceptable, but these small numbers of cases do not change my view that NSA takes significant care to prevent any abuses and that there is a substantial oversight system in place,” Feinstein said.
“Over the past decade, very rare instances of willful violations of NSA’s authorities have been found,” the agency said in a statement to Bloomberg News. “NSA takes very seriously allegations of misconduct, and cooperates fully with any investigations — responding as appropriate. NSA has zero tolerance for willful violations of the agency’s authorities.”
Tomi Engdahl says:
Youtube has a video how to copy mechanical keys:
Solar Key Making DIY keys with a Fresnel Lens
http://www.youtube.com/watch?v=iMfkgBvQ8ig
If you need to copy a key that the hardware store cannot do, this solar method works with most keys for locks.
Tomi Engdahl says:
New NSA documents: U.S. intelligence heard from the United Nations headquarters
http://www.spiegel.de/politik/ausland/nsa-hoerte-zentrale-der-vereinte-nationen-in-new-york-ab-a-918421.html
New documents prove to SPIEGEL information: Even the United Nations headquarters in New York was tapped by the U.S. NSA, although an agreement prohibiting just that. Even the U.S. Consulate in Frankfurt served as a listening post.
Hamburg – The U.S. Secret NSA has not only the European Union bugged, but also the headquarters of the United Nations. This is evident from the NSA secret documents, the DER SPIEGEL has analyzed.
Thus, it is the NSA succeeded in the summer of 2012 to penetrate the internal video conference system of the international community and to crack the encryption. This was for “a dramatic improvement of the data from video teleconferencing and the ability to decrypt this traffic” taken care of, according to a secret NSA document. “The traffic gives us the internal video teleconferencing the UN (yay!).” Within three weeks, the number of decrypted communications had risen from 12 to 458th
In one case, the NSA had also caught the Chinese intelligence in it, also a spy. Then, the NSA intercepted, which had previously listened to the Chinese. The espionage actions are illegal, in valid today agreements with the UN, the United States has pledged not to take covert action.
From the internal documents also indicate that the NSA has spied the EU even after the move to the new embassy premises in September 2012.
In three ways, the NSA attacked by its own account, the European branches: each bug as well as by copying the hard drives in New York and infiltrating the computer network in Washington. Here, the NSA took advantage that the computer of the EU embassies about a so-called Virtual Private Network (VPN) are interconnected. “If we lose access to a page where we can get him back immediately when we come through the VPN to the other side” for components in NSA technicians in an internal presentation. “We have used several times when we were at, Magothy ‘kicked out.”
Tomi Engdahl says:
NSA row: Merkel rival threatens to suspend EU-US trade talks
http://www.theguardian.com/world/2013/aug/26/germany-eu-us-trade-nsa
Peer Steinbrück says he will delay negotiations until US comes clean on bugging of German government offices
Angela Merkel’s main rival in the German general election next month has pledged to suspend EU-US trade talks over the National Security Agency spying scandal if he replaces her as chancellor.
In a further sign that the NSA row has soured relations between the US and its European allies, Peer Steinbrück, leader of the Social Democratic party, told ARD TV: “I would interrupt the negotiations until the Americans say if German government offices and European institutions are bugged or wiretapped. We don’t know if the Americans may be sitting under our desks with some technical devices.” He pledged to press Washington about the spy agency’s activities before continuing with the talks about a transatlantic free trade agreement.
His move comes after Germany’s Der Spiegel weekly reported that the NSA bugged the United Nations’ New York headquarters, with the European Union and the International Atomic Energy Agency among those targeted.
Tomi Engdahl says:
Guardian teams up with New York Times for future Snowden GCHQ coverage
But ‘I never spoke to The Independent,’ Snowden says
http://www.theregister.co.uk/2013/08/23/guardian_nyt_partnership_on_gchq_disclosures/
Faced with a mounting backlash from UK authorities, The Guardian newspaper has announced that it will collaborate with The New York Times to release further documents detailing the activities of the UK’s Government Communications Headquarters.
“In a climate of intense pressure from the UK government, the Guardian decided to bring in a US partner to work on the GCHQ documents provided by Edward Snowden,” the paper said in a statement on Friday. “We are working in partnership with the NYT and others to continue reporting these stories.”
The move comes after CCHQ agents reportedly smashed up hard drives and computers belonging to Guardian staffers when editor-in-chief Alan Rusbridger refused to turn over materials leaked by Snowden.
Government muddying the waters?
Meanwhile, a second UK paper has begun reporting on GCHQ activities, purportedly based on documents leaked by Snowden, but Snowden himself has cast doubt on the latest coverage.
On Friday, The Independent reported what it claimed were details of a top-secret British spy base in the Middle East, including information it alleged The Guardian had promised the government not to disclose.
“Speaking for myself, let me make one thing clear,” Greenwald wrote. “I’m not aware of, nor subject to, any agreement that imposes any limitations of any kind on the reporting that I am doing on these documents. I would never agree to any such limitations.”
“It is intended that the collaboration with the New York Times will allow the Guardian to continue exposing mass surveillance by putting the Snowden documents on GCHQ beyond government reach,” Guardian reporter Lisa O’Carroll wrote. “Snowden is aware of the arrangement.
Tomi Engdahl says:
NSA hacked into encrypted UN communications, leaked documents show
http://gigaom.com/2013/08/25/nsa-hacked-into-un-communications-leaked-documents-show/
According to Germany’s Der Spiegel, the Americans have tapped the United Nations’ internal videoconferencing system. Meanwhile, the NSA has admitted a few analysts used its systems to spy on their love interests.
Der Spiegel‘s report also followed on from earlier revelations about the NSA bugging EU institutions, explaining that the U.S. agency gained access to the virtual private network (VPN) used by the EU’s embassies in America.
Tomi Engdahl says:
Chinese Internet Hit by Attack Over Weekend
http://blogs.wsj.com/chinarealtime/2013/08/26/chinese-internet-hit-by-attack-over-weekend/
Part of the Chinese Internet went down early Sunday morning in what the government is calling the largest denial-of-service attack it has ever faced.
The attack, which was aimed at the registry that allows users to access sites with the extension “.cn,” likely shut down the registry for about two to four hours, according to CloudFlare, a company that provides Web performance and security services for more than a million websites. Though the registry was down, many service providers store a record of parts of the registry for a set period of time, meaning that the outage only affected a portion of websites for some users.
Denial-of-service attacks cause disruptions by overwhelming a computer or network with a high level of online activity. Usually the attacks originate from networks of computers that have been hijacked by malware or viruses.
By Monday the problem seemed to have been solved, with Chinese Internet users able to access websites such as Sina Corp.’s social networking site Weibo smoothly.
CloudFlare Chief Executive Matthew Prince said the company observed a 32% drop in traffic for the thousands of Chinese domains on the company’s network during the attack compared with the same time 24 hours earlier.
Tomi Engdahl says:
War on Leaks Is Pitting Journalist vs. Journalist
http://www.nytimes.com/2013/08/26/business/media/war-on-leaks-is-pitting-journalist-vs-journalist.html?pagewanted=all&_r=0
They knew, or should have known, the risks of revealing information entrusted to them, and decided to proceed. Like almost all whistle-blowers, they are difficult people with complicated motives.
So, too, are the journalists who aid them. It’s not surprising that Julian Assange, the founder of WikiLeaks, who brokered the publishing of Private Manning’s documents, and Glenn Greenwald, the columnist for The Guardian who has led the Snowden revelations, have also come under intense criticism.
What is odd is that many pointing the finger are journalists.
What have Mr. Assange and Mr. Greenwald done to inspire such rancor from other journalists? Because of the leaks and the stories they generated, we have learned that in the name of tracking terrorists, the N.S.A. has been logging phone calls and e-mails for years, recorded the metadata of correspondence between Americans, and in some instances, dived right into the content of e-mails. The WikiLeaks documents revealed that the United States turned a blind eye on the use of torture by our Iraqi allies, and that an airstrike was ordered to cover up the execution of civilians.
Mr. Keller said the relationship with sources and competitors on coverage was always fraught with peril, but technology has created significant disruption to both the business model and the practice of journalism.
If the revelations about the N.S.A. surveillance were broken by Time, CNN or The New York Times, executives there would already be building new shelves to hold all the Pulitzer Prizes and Peabodies they expected. Same with the 2010 WikiLeaks video of the Apache helicopter attack.
Instead, the journalists and organizations who did that work find themselves under attack, not just from a government bent on keeping its secrets, but from friendly fire by fellow journalists. What are we thinking?
Tomi Engdahl says:
ProPublica Joins NSA Chase
http://www.buzzfeed.com/bensmith/pro-publica-joins-nsa-chase
Broadening the journalistic front on the National Security Agency documents leaked by Edward Snowden.
The non-profit investigative reporting group ProPublica is among the media organizations with access to some NSA documents leaked by Edward Snowden, another suggestion that the reportorial investigation into the National Security Agency’s programs and practices is broader than previously known.
Tomi Engdahl says:
NSA leaks: David Cameron’s response is intimidation, says world press body
http://www.theguardian.com/media/2013/aug/26/nsa-leaks-david-cameron-newspapers
World Association of Newspapers and News Publishers tells the UK government its actions could threaten press freedom
David Cameron has been told that the government’s attempt to destroy sensitive leaked documents about mass surveillance was “an act of intimidation” that risks a chilling effect on press freedom.
The World Association of Newspapers and News Publishers (WAN-IFRA) has written to the prime minister over the government’s “deeply regrettable” response to files leaked by the National Security Agency whistleblower Edward Snowden.
The body, which represents 18,000 publications from 3,000 companies, condemned officials for their “symbolic” attempt to restrict reporting by destroying computer hard drives held by the Guardian.
Tomi Engdahl says:
Goldman puts four on leave after fallout from trading glitch: report
http://www.reuters.com/article/2013/08/26/us-goldman-options-leave-idUSBRE97P01620130826
Goldman Sachs Group Inc (GS.N) put four senior technology specialists on administrative leave after a trading glitch that led to a flood of erroneous options trades, the Financial Times reported
The Financial Times said about 80 percent of the mistaken contracts sent to the New York Stock Exchange were cancelled, limiting losses for Goldman. But the glitch “provoked a strong reaction” within the bank, which takes pride in a reputation for risk management, the paper said.
The system, called a “trading axis”, monitors the Wall Street bank’s inventory to determine whether it should be a more aggressive buyer or seller in the market.
Tomi Engdahl says:
N.S.A. Phone Data Collection Is Illegal, A.C.L.U. Says
http://www.nytimes.com/2013/08/27/us/nsa-phone-data-collection-is-illegal-aclu-says.html?pagewanted=all&_r=0
In a detailed legal attack on the National Security Agency’s collection of Americans’ phone call data, the American Civil Liberties Union argued in court papers filed Monday that the sweeping data gathering violates the Constitution and should be halted.
The A.C.L.U. cited the writings of George Orwell and the comprehensive East German surveillance portrayed in the film “The Lives of Others” in warning of the dangers of large-scale government intrusion into private lives. The new motion, elaborating on the A.C.L.U.’s arguments against the data collection, came in a federal lawsuit challenging the N.S.A. program that the group filed in June.
The A.C.L.U. lawsuit is one of several challenges to N.S.A. programs based on leaks by Edward J. Snowden, the former N.S.A. contractor who is now in Russia.
“Americans do not expect that their government will make a note every time they pick up the phone of whom they call, precisely when they call them and for precisely how long they speak,” the group wrote.
Tomi Engdahl says:
Phone Hack Could Block Messages, Calls on Some Mobile Networks
https://threatpost.com/phone-hack-could-block-messages-calls-on-some-mobile-networks/102090
By tweaking the firmware on certain kinds of phones, a hacker could make it so other phones in the area are unable to receive incoming calls or SMS messages, according to research presented at the USENIX Security Symposium earlier this month.
The hack involves modifying the baseband processor on some Motorola phones and tricking some older 2G GSM networks into not delivering calls and messages. By “watching” the messages sent from phone towers and not delivering them to users, the hack could effectively shut down some small localized mobile networks.
The technique was discussed in detail in a talk at USENIX by Kévin Redon, a Berlin-based telecommunications researcher.
Essentially the hacked firmware – named OsmocomBB – can block some calls and messages – also known as pages- by responding to them before the phones that were initially intended to receive them do, something Redon and company called during their research “the race for the fastest paging response time.”
The paper notes that while 4G has been rolled out en masse in most countries, most of the globe remains at the mercy of the Global System for Mobile Communications (GSM) infrastructure.
GSM had been notoriously difficult to crack in its early days but the group had help thanks to the recent proliferation of cheap tools such as the Universal Software Radio Peripheral, a glorified computer–hosted software radio. In 2004, the source code for the Vitelcom TSM30 phone was leaked as well, which allowed researchers to better manipulate and study GSM stack implementations.
Tomi Engdahl says:
To make journalism harder, slower, less secure
http://pressthink.org/2013/08/to-make-journalism-harder-slower-less-secure/
That’s what the surveillance state is trying to do. It has the means, the will and the latitude to go after journalism the way it went after terrorism. Only a more activist press, working together, stands a chance of resisting this.
Tomi Engdahl says:
Exclusive Glenn Greenwald Interview: “I Won’t Be Kept Out of My Country for Doing Journalism!”
http://www.truth-out.org/news/item/18402-i-wont-be-kept-out-of-my-country-for-doing-journalism-exclusive-glenn-greenwald-truthout-interview
Glenn Greenwald, the US lawyer-turned-blogger-turned-journalist, has been writing about state-sponsored repression, surveillance, torture and leaks for years. He has four best-selling books but nothing compared to the watershed event in June when Greenwald and documentary filmmaker Laura Poitras received a cache of top secret documents from NSA whistle-blower Edward Snowden. On August 21, from his home in Rio de Janeiro, Greenwald described the latest twists and revelations in the NSA spy scandal.
Tomi Engdahl says:
Open Secret About Google’s Surveillance Case No Longer Secret
http://blogs.wsj.com/digits/2013/08/26/open-secret-about-googles-surveillance-case-no-longer-secret/
The Justice Department recently won a court battle to keep an Internet company from talking about federal demands for user data, arguing that even disclosing the company’s name would damage national security.
But then, after months of arguments, the department appears to have been foiled by its own redaction process, which left the name “Google” on one page that was posted Friday in the U.S. District Court for the Southern District of New York.
The case and Google’s role in it underscore a tension between some Silicon Valley companies and the government over national security surveillance and the secrecy surrounding it.
Google has been pushing back against data-gathering tools called national security letters in two federal courts since this spring.
After a judge in California ruled the law was a violation of the First Amendment right to free speech in March, Google challenged several of the letters it had received and asked to be freed from the gag orders.
The decisions have consistently sided with the government and ordered Google to comply and keep quiet.
Google and other companies involved in the NSA programs have said the secrecy surrounding government data-gathering leaves them unable to tell their customers what they really do with the data and puts their business at a disadvantage.
Tomi Engdahl says:
How Snowden did it
http://investigations.nbcnews.com/_news/2013/08/26/20197183-how-snowden-did-it?lite
When Edward Snowden stole the crown jewels of the National Security Agency, he didn’t need to use any sophisticated devices or software or go around any computer firewall.
All he needed, said multiple intelligence community sources, was a few thumb drives and the willingness to exploit a gaping hole in an antiquated security system to rummage at will through the NSA’s servers and take 20,000 documents without leaving a trace.
“It’s 2013 and the NSA is stuck in 2003 technology,” said an intelligence official.
Jason Healey, a former cyber-security official in the Bush Administration, said the Defense Department and the NSA have “frittered away years” trying to catch up to the security technology and practices used in private industry. “The DoD and especially NSA are known for awesome cyber security, but this seems somewhat misplaced,” said Healey, now a cyber expert at the Atlantic Council. “They are great at some sophisticated tasks but oddly bad at many of the simplest.”
As a Honolulu-based employee of Booz Allen Hamilton doing contract work for the NSA, Snowden had access to the NSA servers via “thin client” computer. The outdated set-up meant that he had direct access to the NSA servers at headquarters in Ft. Meade, Md., 5,000 miles away.
A typical NSA worker has a “top secret” security clearance, which gives access to most, but not all, classified information. Snowden also had the enhanced privileges of a “system administrator.” The NSA, which has as many as 40,000 employees, has 1,000 system administrators, most of them contractors.
As a system administrator, Snowden was allowed to look at any file he wanted, and his actions were largely unaudited. “At certain levels, you are the audit,” said an intelligence official.
He was also able to access NSAnet, the agency’s intranet, without leaving any signature, said a person briefed on the postmortem of Snowden’s theft. He was essentially a “ghost user,” said the source, making it difficult to trace when he signed on or what files he accessed.
If he wanted, he would even have been able to pose as any other user with access to NSAnet, said the source.
The “thin client” system and system administrator job description also provided Snowden with a possible cover for using thumb drives.
The system is intentionally closed off from the outside world, and most users are not allowed to remove information from the server and copy it onto any kind of storage device. This physical isolation – which creates a so-called “air gap” between the NSA intranet and the public internet — is supposed to ensure that classified information is not taken off premises.
But a system administrator has the right to copy, to take information from one computer and move it to another. If his supervisor had caught him downloading files, Snowden could, for example, have claimed he was using a thumb drive to move information to correct a corrupted user profile.
“He was an authorized air gap,” said an intelligence official.
In a contractor’s office 5,000 miles and six time zones from headquarters, he was free from prying eyes. Much of his workday occurred after the masses at Ft. Meade had already gone home for dinner.
It’s not yet certain when Snowden began exploiting the gaps in NSA security. Snowden worked for Booz Allen Hamilton for less than three months, and says he took the job in order to have access to documents. But he may have begun taking documents many months before that, while working with the NSA via a different firm. According to Reuters, U.S. officials said he downloaded documents in April 2012, while working for Dell.
Snowden is currently living in Russia, where he’s been granted temporary asylum. The U.S. government has charged him with theft and violations of the Espionage Act.
Tomi Engdahl says:
Codename ‘Apalachee’: How America Spies on Europe and the UN
http://www.spiegel.de/international/world/secret-nsa-documents-show-how-the-us-spies-on-europe-and-the-un-a-918625.html
President Obama promised that NSA surveillance activities were aimed exclusively at preventing terrorist attacks. But secret documents from the intelligence agency show that the Americans spy on Europe, the UN and other countries.
Tomi Engdahl says:
Anonymous Document Sharing Site Pastebin Surpasses 1 Million Members, Keeps Growing
http://techcrunch.com/2013/08/26/anonymous-document-sharing-site-pastebin-surpasses-1-million-members-keeps-growing/
Pastebin officially announced that they’ve surpassed 1 million registered members since the introduction of the login service two and a half years ago. The service allowed users to log in using social media tools and control the pastes they uploaded to the site. Members can also edit and delete pieces of information they post to the site. Users can still paste items anonymously.
Like many popular “paste” sites, Pastebin started out as a repository for code, snippets of text, and chat logs. Now, however, it has become a sort of clearinghouse for Anonymous, the group, and other groups intent on maintaining anonymity.
“we are currently serving about 17 million visitors per month,”
“Every time something really controversial gets posted on Pastebin, it often results in a lot of media attention, which can result in a temporary boost in traffic. In the case of the Edward Snowden related items there were also a few days where traffic was noticeably higher than normal,”
Tomi Engdahl says:
Open Sourcers Pitch Secure Email in Dark Age of PRISM
http://www.wired.com/wiredenterprise/2013/08/mailpile/
‘Email is going to be with us for a long time. We need to do what we can to make it more secure.’
— Bjarni Rúnar Einarsso
With the specter of government surveillance hanging over this post-PRISM world, people are beginning to wonder if the idea of secure email is complete nonsense.
Ever since the former National Security Agency contractor Edward Snowden leaked documents revealing the extent of the spy agency’s monitoring activities, many are convinced that email can never be completely safe from prying eyes, and some have even given it up entirely. In recent weeks, two services that promised to offer completely secure email — Lavabit and Silent Circle — have shutdown, apparently because they couldn’t stop the government from breaking their security.
But the reality is that email is an integral part of both our personal and professional lives — something that most of us can’t give up without alienating friends and family and ditching our day jobs. We have no choice but to find new ways making it safe. “E-mail is going to be with us for a long time,” says Bjarni Rúnar Einarsson, a software developer and member of the Icelandic Pirate Party. “We need to do what we can to make it more secure.”
Einarsson is doing his part with Mailpile, an open source web-based e-mail client that you can run on your own computer or in the cloud. With this creation, he hopes to make it easier for every day users to encrypt their mail — without giving up the sort of search tools they get from a service like Google’s Gmail. The team has already raised over $100,000 dollars on the crowdfunding site Indie GoGo to fund its future development.
It’s a tough time to pitch secure email. But that’s what Einarsson is doing. And it only makes sense.
The government may have the technical means to reach public email services and, with National Security Letters, it may have other ways of getting at our messages, but we can minimize these threats — and that’s what Mailpile aims to do.
“It’s more expensive to subpoena hundreds or thousands of [e-mail providers] all over the world than it is to subpoena one big target like Gmail,” Einarsson says.
Yes, you can already sign-up for an e-mail account with an alternative hosting provider and move your email into a client like Thunderbird.
If you decide to switch from Gmail to another provider, you may find the tools sorely lacking. That’s what happened to Einarsson a few years ago.
“I’d become addicted to being able to search and process large volumes of e-mail quickly,” he says. “When I started to become uncomfortable with using a proprietary solution living in the cloud I began to look for alternatives and couldn’t find anything. I had a realization of how I could design something that would function like Gmail on my own computer at home, so I wrote the code and it worked.”
‘If you’re actually concerned that someone will know who you’re communicating with, that’s not something that PGP can help’
— Rainey Reitman
Novak points out that even if they can make PGP easy to use, they’ll still need to encourage adoption by other users
The key, Novak says, will be in getting people who already have encryption keys to get other people to sign-up as well. “My goal is to make it like sending a friend request on a social network,” he says.
Mailpile’s encryption tools could indeed make e-mail more secure, but there are still risks. Even those using PGP to encrypt messages will leave behind information such as who they exchanged messages with, even if the contents of those messages have been read. It’s like having a log of your phone conversations: Someone can tell who you talked to and when, but they don’t know what you actually said.
Tomi Engdahl says:
USA: “Beware of the three Android security threat”
U.S. authorities have released a warning to government employees for Android security concerns. There are three primary threat.
Warning have developed together with the U.S. Department of Justice and the national security agency. Published by example, Android Community.
They point out that the malware problem is now almost exclusively on Android. Another problem is the beginning of Nokia’s Symbian operating system, but it is being phased out of the market.
79 percent of Android pests
The warning, in 2012 mobile malware 79 per cent of Android. Symbian accounted for 19 per cent.
On other platforms the problem was not at all. Apple’s iOS platform accounted for 0.7 per cent. Windows Phone and BlackBerry’s share of the malware were both just 0.3 per cent.
The reason for the problems is the Android platform in addition to the popularity of its openness. The programs can be applied quite freely, allowing for the distribution of malware. For example, the Apple iOS platform, Windows Phone and applications are checked prior to arrival.
One problem is that the Android phones are used in many cases older versions of the platform. They are known to be security holes.
The three main problems
The warning are highlighted three main problems. The first is expensive to send text messages to the Trojans. They can be fought for Android security software.
Another risk is the rootkit malware that hides behind the phone’s operating system. This threat is recommended that Carrier IQ Test program.
The third threat is a criminal by the fake versions of Google Play-trade program.
Sources:
http://www.tietokone.fi/artikkeli/uutiset/usa_varokaa_androidin_kolmea_turvauhkaa
http://cdn.androidcommunity.com/wp-content/uploads/2013/08/Screen-Shot-2013-08-26-at-9.40.48-AM.png
Tomi Engdahl says:
Be careful, your information falling into the wrong hands
The network commercial services have entered your personal information is not safe. They will end up sooner or later into the wrong hands – the criminals, the authorities, or other businesses. It warns Jyrki Kasvi from Tieke.
Corporate data collected by us online will end up sooner or later into the wrong hands, criminals or authorities. This can happen even if the companies do not use the information unethically. Committee warns of Information Society Development in Tieken of Research and Development, Jyrki Kasvi.
He is concerned about the huge mass of information, which is the private collection of people online.
“We should not simply assume that the information is only in the forums to which you are assigned. Intrusion through which they may end up being criminals, acquisitions, or a secret to another company under the laws of the authorities for analysis. ”
Our knowledge, are the building blocks of Google and Facebook’s online giants such as the actual product, targeted advertising and market analysis, building.
Willingly disclose information about who we spend time with, what we are interested in, where we are moving, where to dream about what we buy, and so on.
About what companies are doing to collect knowledge, is not well understood. Even the revelations of the U.S. NSA spying by the Office of massive data collection of ordinary people in network traffic has received a majority cautious.
Google’s lawyers are even directly stated that people can not expect emails to be private.
The huge masses of information management is no longer a problem, and they can be mined out of the desired things. Servers gigantic industrial buildings keep wheels turning.
“We are living in the open windows on the world. Good times have been going on for so long that people do not know how to be concerned about data misuse. Finnish lacks a healthy paranoia to protect your identity”
Lawyer, to defend the rights of citizens’ electronic Effi Vice-President of Ville Oksanen, estimates that companies are interested in the masses, not individuals.
“I think we should not worry about too much. In normal everyday life of an individual consumer, a relatively small risk that his or her information would be used widely abused. Services using the current price is that it will have to give up some degree of privacy. ”
Facebook knows who your friends are, what you liked, what words to use with your discussions with and which pages you visited when you sign in online.
Google’s services will still have a bias towards a more complete picture. What Google does not know about us? If you make it web search, whereas YouTube videos and use your Android phone, Gmail, Google plus, as well as the Google Wallet payment service, the mysteries are few and far between. Chrome saved passwords are easy to read.
If the smartphone allows the use of location data, location may be, for example, unmask the micro-blogging service Twitter.
“The consent to use location data to provide easily without any further reflection. People often automatically click on “yes” to all questions, “Oksanen says.
Map of services to facilitate the use of spatial data using must be enabled. This increases the incentive for the location of the distribution.
The result will tell you what this can be sold to the consumer.
“To our knowledge allows advertisers to be able to provide those services that are not previously been unimaginable. It is the right advertiser’s holy grail, ” Kasvi will update.
Recruitment situations in the United States also looks at social media. Finnish Personal Data Act prohibits profiling the conclusion of a potential employee online behavior.
The collection of data is not necessarily according to Oksanen’s a bad thing. The problem consists in his opinion, if the data is not able to control.
“A system in which all the information is collected and everything is utilized to change the structures of society. The consumer does not own behavior hardly able to influence the case. Instead, people should be required to policy makers on the protection of the privacy laws. ”
The European Parliament and the European Council have started treatment with EU data protection law reform. The new Data Protection Regulation enters into force, it replaces the Finnish Personal Data Act.
Source: http://www.3t.fi/artikkeli/uutiset/teknologia/varo_tietosi_joutuvat_vaariin_kasiin
Tomi Engdahl says:
Syrian Electronic Army Apparently Hacks DNS Records Of Twitter, NYT Through Registrar Melbourne IT
http://techcrunch.com/2013/08/27/syrian-electronic-army-apparently-hacks-dns-records-of-twitter-new-york-times-through-registrar-melboune-it/
The Syrian Electronic Army has claimed responsibility for hacking the domain name servers of two of Twitter’s sites, and a third appears to have been redirected to servers hosted by the SEA. In addition, attacks have been made on The New York Times and Huffington Post UK name servers.
The New York Times says it was attacked via its registrar, Melbourne IT. Once the Syrian Electronic Army had gained access to registry records, it was able to change both contact details and domain name servers.
After the claimed responsibility for hacking the DNS records of the New York Times, additional issues began being popping up in relation to the hosting of Twitter images.
Twitter has issued the following statement on the DNS record issues with Twimg.com
Melbourne IT is now providing a statement
Tomi Engdahl says:
Details Behind Today’s Internet Hacks
http://blog.cloudflare.com/details-behind-todays-internet-hacks
Registrars and Registries
Registrar Compromise
The New York Times has confirmed publicly that their registrar was hacked, allegedly by the Syrian Electronic Army.
Cleaning Up the Mess
At the registry, Verisign rolled back changes to the name servers and added a so-called registry lock to NYTimes.com. This prevented further changes even if initiated by the registrar. While quick action by OpenDNS and Google limited the impact on their customers, web surfers using other recursive DNS providers continued to be served hacked results.
How to Protect Yourself
This was a very spooky attack. MelbourneIT is known for having higher security than most registrars. We are hopeful that they will post the details of the attack as they are discovered so organizations can understand the threat and how to better protect themselves.
Tomi Engdahl says:
Hackers had Melbourne IT reseller credentials to attack NYT, Twitter
http://www.zdnet.com/hackers-had-melbourne-it-reseller-credentials-to-attack-nyt-twitter-7000019931/
Summary: No sophisticated attack was required to attack The New York Times and Twitter, as hackers already had valid credentials to allow them to change DNS entries.
Tomi Engdahl says:
Embedded XP big risk next year
Microsoft will end next year XP operating system support. The same applies to the decision of embedded systems XP embedded version. The German company says embedded XP with operating systems are truly at high risk first of April 8 day.
nnominate Security Technologies AG wants to remind industrial companies developing systems to ensure that adequate security measures to be adopted in good time. Only in this way can, for example to ensure continued production for sure.
Innominate that XP can still be found constantly vulnerabilities. In July this year, Microsoft had already announced the 31 important security update system. Of these, 18 were classified as critical.
The most obvious solution would be to upgrade the operating system or replace the whole extract of the base, but this can be very expensive, depending on the system and. Innominate suggests it is easier to protect critical components by separate software or tools.
Source: http://www.elektroniikkalehti.fi/index.php?option=com_content&view=article&id=282:sulautettu-xp-iso-riski-ensi-vuonna&catid=13&Itemid=101
Tomi Engdahl says:
Cybercriminals target Android platform
http://www.av-comparatives.org/wp-content/uploads/2013/08/apkstores_investigation_2013.pdf