Security trends 2017

3,151 Comments

1. September 15, 2017 at 1:16 pm

   Tomi Engdahl says:

   Chinese vendors are already marketing face masks as iPhone X security tools
   Face ID can’t get me now!
   https://www.theverge.com/tldr/2017/9/14/16307226/iphone-x-taobao-faceid-help-me-cover-my-face-masks

   Chinese vendors on online marketplace Taobao never resist a chance to peddle their goods. Just days after Apple announced the iPhone X that replaced the home button’s Touch ID for Face ID, Chinese merchants have launched “protective masks” in response to the news.

   Reply
2. September 15, 2017 at 1:19 pm

   Tomi Engdahl says:

   Mozilla Implements Faster Diffie-Hellman Function in Firefox
   http://www.securityweek.com/mozilla-implements-faster-diffie-hellman-function-firefox

   Mozilla this week revealed plans to introduce a new key establishment algorithm in Firefox to improve both security and performance of the web browser.

   Called Curve25519, and designed by Daniel Julius Bernstein, the algorithm is a high-security elliptic-curve-Diffie-Hellman function deemed suitable for a wide variety of cryptographic applications. The public key cryptography can achieve record-setting speeds, while also offering free key compression, free key validation, and state-of-the-art timing-attack protection, Bernstein explains (PDF).

   Widely used for key-exchange in TLS, Curve25519 was recently standardized by the Internet Engineering Task Force (IETF). Mozilla has already implemented the algorithm in the latest Firefox Nightly, and expects Firefox 57, set to be released in November, to bring the feature to all users, Benjamin Beurdouche, Mozillian INRIA Paris – Prosecco team, reveals.

   Curve25519:new Diffe-Hellman speed records
   https://cr.yp.to/ecdh/curve25519-20060209.pdf

   Reply
3. September 15, 2017 at 1:19 pm

   Tomi Engdahl says:

   New Attack Abuses CDNs to Spread Malware
   http://www.securityweek.com/new-attack-abuses-cdns-spread-malware

   Content delivery networks (CDNs) are being increasingly abused to spread malware, courtesy of standards that allow the download and execution of payloads on computers, ESET warns.

   The security firm analyzed the downAndExec standard, which makes extensive use of JS scripts and enables the download and execution of malware. In one attack, miscreants were observed using the standard and abusing CDNs to deliver banking threats to users in Brazil, the researchers reveal.

   The attack chain starts with social engineering techniques being used to trick victims into executing a malicious application detected as NSIS/TrojanDropper.Agent.CL. This is a malware downloader designed to fetch a single snippet of externally-hosted JS necessary to supplement the execution process.

   The JS snippet is hosted on the infrastructure of a CDN provider, which not only provides high bandwidth for payload delivery and command and control (C&C) operations, but also ensures that takedown attempts aren’t immediately successful, as it is impracticable to block the entire CDN domain.

   Reply
4. September 15, 2017 at 1:20 pm

   Tomi Engdahl says:

   Trouble in Paradise as Cyber Attackers Circumvent 2FA
   http://www.securityweek.com/trouble-paradise-cyber-attackers-circumvent-2fa

   Two-Factor Authentication (2FA) has for years been one of the very dependable security technologies that was invoked to address high-risk scenarios — whether to safeguard enterprise resources accessed through the firewall, financial accounts, or — for high-value targets — protect each email login. Most people, to the extent that they spend time thinking about the security of 2FA, conclude — incorrectly — that 2FA offers bullet proof security for authentication.

   While 2FA is a big step above and beyond the use of traditional passwords, it is not infallible, and thinking so makes the risk of failure even greater. In a recent publication, some of my research collaborators and I demonstrated that attackers can achieve a greater than 50% success rate using a social engineering attack on Google’s SMS-based 2FA. This attack is based on an attacker coordinating a request, made to the victim, for a code with an access attempt to a resource that requires a code. Password reset is an example: the attacker would request a password reset on behalf of a victim, which results in the victim getting a security code from a service provider. Then, the attacker sends a request to the victim, appearing to come from the service provider, asking for the code. Most people responded with the code, which enables the attacker to reset their password. This is very troublesome.

   Reply
5. September 15, 2017 at 1:54 pm

   Tomi Engdahl says:

   Chrome to label FTP sites insecure
   It’s only 0.0026 per cent of traffic, but it’s all in plaintext so deserves a red flag
   https://www.theregister.co.uk/2017/09/15/chrome_to_label_ftp_sites_insecure/

   Google’s Chrome browser will soon label file transfer protocol (FTP) services insecure.

   Google employee and Chrome security team member Mike West yesterday announced the plan on the Chromium.org security-dev mailing list.

   “As part of our ongoing effort to accurately communicate the transport security status of a given page, we’re planning to label resources delivered over the FTP protocol as ‘Not secure’.”

   Adding FTP to Chrome’s naughty list was decided upon because “its security properties are actually marginally worse than HTTP (delivered in plaintext without the potential of an HSTS-like upgrade). Given that FTP’s usage is hovering around 0.0026% of top-level navigations over the last month, and the real risk to users presented by non-secure transport, labelling it as such seems appropriate.”

   Reply
6. September 15, 2017 at 2:42 pm

   Tomi Engdahl says:

   Company risks of using your own hardware for file saving/sharing
   https://vboxxcloud.com/blog/external-storage/

   Hard Drives, SSD’s, USB-Sticks, NAS, Cloud: are the options available to save data externally. The ideal media storage solution, should be large, fast and secure. Each solution presents its set of advantages and disadvantages. We offer some insights into the pros and cons of external storage to help you find the ideal storage solution for your company data.

   Reply
7. September 15, 2017 at 2:46 pm

   Tomi Engdahl says:

   Chelsea Manning: we’re spied on all the time, and the state still can’t figure out who we are
   https://boingboing.net/2017/09/14/unpersonned-by-bureaucracy.html?utm_content=buffer0116e&utm_medium=social&utm_source=facebook.com&utm_campaign=buffer

   Manning writes about this paradox in the New York Times, describing, on the one had, the enormous machineries of surveillance that we increasingly labor under; and on the other hand, the remorseless bureaucratic processes that insist that anyone whose data in anomalous can’t participate in the system (as Matt Blaze quipped about Equifax’s breach, “having an Equifax record is 100% voluntary. Only those who made the choice to have ever participated in the economy are included.”)

   Reply
8. September 15, 2017 at 5:55 pm

   Tomi Engdahl says:

   Your phone can now be turned into an ultrasound sonar tracker against you and others
   https://www.privateinternetaccess.com/blog/2017/09/your-phone-can-now-be-turned-into-an-ultrasound-sonar-against-you-and-others/

   New research shows how a mobile phone can be turned into a passive indoor ultrasound sonar, locating people with high precision indoors using multi-target echolocation, and is even able to discern a rough selection of activities. It does this by overlaying imperceptible ultrasound sonar pings into played-back music, measuring the reflections coming back to the phone’s microphone. The privacy implications are staggering.

   Reply
9. September 16, 2017 at 7:58 am

   Tomi Engdahl says:

   Understanding the prevalence of web traffic interception
   https://blog.cloudflare.com/understanding-the-prevalence-of-web-traffic-interception/

   We found that between 4% and 10% of the web’s encrypted traffic (HTTPS) is intercepted. Analyzing these intercepted connections further reveals that, while not always malicious, interception products most often weaken the encryption used to secure communication and puts users at risk.

   products intercept traffic by performing a so-called man-in-the-middle attack. In essence, the software redirects the encrypted connection to itself and pretends to be the requested website. The interceptor then opens a new encrypted connection to the destination website and proxies the data back and forth between the two connections, making the interception mostly “invisible.” Because the interceptor has access to the unencrypted data in the connection, it can read, change, and block any of the content sent or received by the client.
   There are two main ways in which connections are intercepted: locally and remotely.

   “unforgeability” of TLS certificates is the cornerstone of online security; it is the technical means that allows you to know you are talking to the right site, not an impostor.

   How prevalent is HTTPS interception?
   Measuring interception is not an easy task, as interceptors don’t advertise themselves (obviously). This is why, to detect whether a connection was intercepted, we used a refined version of the network fingerprint technique known as TLS fingerprinting, which allows us to determine which software is making the connection (interceptor or browser).

   Breaking down the Cloudflare and e-commerce site traffic by OS reveals that Windows is intercepted far more often than MacOS

   mobile OSes Android and iOS are significantly less often intercepted than desktop OSes

   Contrary to popular belief, traffic interception is not necessarily malicious. According to our study and as summarized in the chart above, web traffic is primarily intercepted for two diametrically opposed reasons:

   Improving security: Antivirus solutions and some corporate firewalls/IPS perform interception for security reasons.

   Performing malicious activities: At the other end of the spectrum, malware intercepts connections to inject ads and steal confidential data.

   most interception products use cryptography in an insecure way

   Overall, we found that 65% of the intercepted connections going to the Firefox update server have reduced security, and a staggering 37% are easily vulnerable to man-in-the-middle attacks due to blatant cryptographic mistakes (e.g., certificates are not validated).

   Overall we found out that HTTPS interceptions are more prevalent than expected (4% – 10%) and pose serious security risks as they downgrade the encryption used to secure web communications. Furthermore, the HTTPS implementations used for interception do not have the same automatic update mechanisms that browsers do, making fixes less likely to be rolled out. Intercepting middleboxes have also contributed to the delayed release of TLS 1.3 in browsers.

   Reply
10. September 16, 2017 at 8:32 am

    Tomi Engdahl says:

    The Hunt for IoT: The Rise of Thingbots
    https://www.darkreading.com/partner-perspectives/f5/the-hunt-for-iot-the-rise-of-thingbots/a/d-id/1329873

    Across all of our research, every indication is that today’s “thingbots” – botnets built exclusively from Internet of Things devices – will become the infrastructure for a future Darknet.

    The Internet of Things (IoT) and, specifically, the hunt for exploitable IoT devices by attackers, has been a primary area of research for F5 Labs for over a year now—and with good reason. IoT devices are becoming the cyber weapon delivery system of choice by today’s botnet-building attackers. And, why not? There are literally billions of them in the world, most of which are readily accessible (via Telnet) and easily hacked (due to lack of security controls). Why would attackers rent expensive resources in hosting environments to build their botnets when so many devices are free for the taking?

    Reply
11. September 16, 2017 at 9:08 am

    Tomi Engdahl says:

    ‘Ransomware of things’ spell trouble for transportation industry
    https://www.scmagazineuk.com/ransomware-of-things-spell-trouble-for-transportation-industry/article/688040/?lipi=urn%3Ali%3Apage%3Ad_flagship3_feed%3BU1pQkBveT9CG%2BmZKvx5NvQ%3D%3D

    The next step in the evolution of ransomware would be what they called “jackware” or ransomware designed to target connected devices subsequently creating a ransomware of things (RoT).

    The study found the Cyber-attacks leveraging IoT devices are also becoming commonplace particularly in the transportation where 29 percent of companies indicated they experienced an IoT attack. The energy, construction, and IT sectors aren’t far behind 22 percent of respondents from each industry reported attacks, respectively.

    Reply
12. September 17, 2017 at 6:04 am

    Tomi Engdahl says:

    Troy Hunt:
    Face ID has upsides and downsides on both security and usability and isn’t less secure than a PIN or Touch ID in practice

    Face ID, Touch ID, No ID, PINs and Pragmatic Security
    https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pragmatic-security/

    I was wondering recently after poring through yet another data breach how many people actually use multi-step verification. I mean here we have a construct where even if the attacker has the victim’s credentials, they’re rendered useless once challenged for the authenticator code or SMS which is subsequently set. I went out looking for figures and found the following on Dropbox:

    Less than 1%. That’s alarming. It’s alarming not just because the number is so low, but because Dropbox holds such valuable information for so many people. Not only that, but their multi-step implementation is very low-friction – you generally only ever see it when setting up a new machine for the first time.

    But here’s the problem with multi-step verification: it’s a perfect example of where security is friction. No matter how easy you make it, it’s something you have to do in addition to the thing you normally do, namely entering a username and password. That’s precisely the same problem with getting people to put PINs on their phone and as a result, there’s a huge number of devices out there left wide open. How many? It’s hard to tell because there’s no easy way of collecting those stats. I found one survey from 2014 which said 52% of people have absolutely nothing protecting their phone. Another in 2016 said the number is more like 34%.

    No ID

    Let’s start here because it’s the obvious one. Missing PINs on phones provides zero protection from any adversary that gets their hands on it; the kids, a pickpocket or law enforcement – it’s free rein for all. Free reign over photos and videos, free reign over messages and email and free reign to communicate with anyone else under the identity of the device owner.

    A lack of PIN has also proved very useful for remote attackers.

    The first point I’ll make here as I begin talking about the 3 main security constructs available is that they’re all differently secure. This is not a case of one is “secure” and another is “insecure” in any sort of absolute way and anyone referring to them in this fashion is missing a very important part of the narrative. With that said, let’s look at the pros and cons involved here.

    Obviously, the big pro of a PIN is familiarity
    But PINs are enormously popular and even when you do use the biometric options we’re about to get into, you’re still going to need one on your phone anyway.
    Edward Snowden typing his password in whilst under a blanket
    We’ve all been warned about the risk of shoulder surfing at one time or another
    But there’s one thing in particular PINs are resilient to which biometrics are not: the police in the US can force you to unlock your phone using your fingerprint.

    Given we’ve now had 4 years of Touch ID (and of course many more years of fingerprint auth in general), we’ve got a pretty good sense the threat landscape. Even 15 years ago, researchers were circumventing biometric logins.
    There have many other examples of auth bypass since that time
    One of the arguments I heard against Touch ID yesterday is that an “attacker” could cause a sleeping or unconscious person to unlock their device by placing the owner’s finger on the home button.
    Be that as it may, there are certainly circumstances where biometric login poses a risk that PINs don’t and the unconscious one is a perfect example.

    Face ID
    I watched the keynote today and was obviously particularly interested in how Face ID was positioned so let me share the key bits here.
    Firstly, this is not a case of “if the camera sees something that looks like the owner’s face the device unlocks”.
    Infrared camera + flood illuminator + proximity sensor + ambient light sensor + camera + dot projector = Face ID. Each of these plays a different role and you can see how, for example, something like infrared could be used to discern the difference between a human head and a photo.
    The IR image and the dot pattern then get “pushed though neural networks to create a mathematical model of your face” which is then compared to the stored one created at setup.

    Firstly, Touch ID:
    So what they’re saying here is that you’ve got a 1 in 50k chance of someone else’s print unlocking your phone.
    Here’s how Face ID compares:
    One in a million. There’s literally a saying that’s “one in a million” which symbolises the extremely remote likelihood of something happening! The 20x figure over Touch ID is significant but it doesn’t seem like the right number to be focusing on. The right number would be the one that illustrates not the likelihood of random people gaining access, but rather the likelihood of an adversary tricking
    Apple claim that Face ID is resilient to both photos and masks

    Summary

    What we have to keep in mind here is just how low the security bar is still set for so many people.

    More than anything though, we need to remember that Face ID introduces another security model with its own upsides and downsides on both security and usability. It’s not “less secure than a PIN”, it’s differently secure and the trick now is in individuals choosing the auth model that’s right for them.

    Reply
13. September 18, 2017 at 12:03 pm

    Tomi Engdahl says:

    Thomas Fox-Brewster / Forbes:
    Hackers hid backdoor in Avast-owned system cleanup tool CCleaner for Windows from August 15 to September 12; affected software was run by 2.7M users

    Hackers Hid Backdoor In CCleaner Security App With 2 Billion Downloads — 2.3 Million Infected
    https://www.forbes.com/sites/thomasbrewster/2017/09/18/ccleaner-cybersecurity-app-infected-with-backdoor/#5a8d8656316a

    Users of Avast-owned security application CCleaner for Windows have been advised to update their software immediately, after researchers discovered criminal hackers had installed a backdoor in the tool. The tainted application allows for download of further malware, be it ransomware or keyloggers, with fears millions are affected. According to Avast’s own figures, 2.27 million ran the affected software, though the company said users should not panic.

    The affected app, CCleaner, is a maintenance and file clean-up software run by a subsidiary of anti-virus giant Avast. It has 2 billion downloads and claims to be getting 5 million extra a week, making the threat particularly severe, researchers at Cisco Talos warned. Comparing it to the NotPetya ransomware outbreak, which spread after a Ukrainian accounting app was infected, the researchers discovered the threat on September 13 after CCleaner 5.33 caused Talos systems to flag malicious activity.

    Further investigation found the CCleaner download server was hosting the backdoored app as far back as September 11.

    Downplaying the threat?

    CCleaner’s owner, Avast-owned Piriform, has sought to ease concerns. Paul Yung, vice president of product at Piriform, wrote in a post Monday: “Based on further analysis, we found that the 5.33.6162 version of CCleaner and the 1.07.3191 version of CCleaner Cloud was illegally modified before it was released to the public, and we started an investigation process.

    “The threat has now been resolved in the sense that the rogue server is down, other potential servers are out of the control of the attacker.

    “Users of CCleaner Cloud version 1.07.3191 have received an automatic update. In other words, to the best of our knowledge, we were able to disarm the threat before it was able to do any harm.”

    https://www.piriform.com/news/blog/2017/9/18/security-notification-for-ccleaner-v5336162-and-ccleaner-cloud-v1073191-for-32-bit-windows-users

    Reply
14. September 18, 2017 at 1:41 pm

    Tomi Engdahl says:

    Magento Patches Critical Vulnerability in eCommerce Platforms
    http://www.securityweek.com/magento-patches-critical-vulnerability-ecommerce-platforms

    Magento this week released updates for Magento Commerce and Open Source 2.1.9 and 2.0.16 to address numerous vulnerabilities, including a remote code execution bug rated Critical severity.

    Featuring a CVSSv3 score of 8.2, the remote code execution flaw impacts content management system (CMS) and layouts. The vulnerability allows an administrator with limited privileges to introduce malicious code when creating a new CMS page, which would potentially result in arbitrary remote code execution.

    Reply
15. September 18, 2017 at 1:42 pm

    Tomi Engdahl says:

    Mocana Integrates Embedded Security Software With Industrial Cloud Platforms
    http://www.securityweek.com/mocana-integrates-embedded-security-software-industrial-cloud-platforms

    Mocana Integrates Embedded Security Software with AWS IoT, Microsoft Azure IoT, and VMware Liota to Protect Devices

    Two constants in current cybersecurity are the growing threat from insecure IoT botnets (Mirai, WireX, etcetera), and the continuing security provided by strong encryption. It is part of the mission of one venture capital funded firm to solve the former by use of the latter.

    Mocana was formed in 2002 as an embedded security software company for military applications. With the help of venture capital ($11 million in May 2017 brought the total to $93.6 million), it has expanded into ICS and both the industrial internet of things (IIoT) and consumer IoT.

    “We’re a crypto company,” Mocano’s CTO Dean Weber told SecurityWeek. “While traditional security has been to provide barriers and layers of network controls — even for IoT devices — we offer a different approach. We use cryptography to build a trust platform for IoT, mobile and industrial devices.”

    The trust platform is provided as source code to device developers, who compile it into different target devices.

    “OpenSSL provides a cryptographic library that gets calls from applications to provide services as necessary. We replace that,” explains Weber, “but we do a lot more than OSSL because we start from a root of trust on the platform, and we build an X509 trust chain. The device ends up with a trust value. That trust value represents the cryptographic trustworthiness of the platform. We’re building the foundation on a device, which could be an edge device, a sensor, an activator, a switch, a gravitometer, or a flow meter, or accelerometer or whatever.”

    In effect, a cryptographically trusted edge or IIoT device can communicate securely with its device controller. “Traditionally, that device is going to talk to a gateway service, which may be a PLC or RTU, which would then be connected to a back-end service,” says Weber, who is set to speak at SecurityWeek’s upcoming ICS Cyber Security Conference. “In the industrial space that would be the ICS SCADA; in the IoT space that might be a cloud service where you bring everything together for analytics or management, or both. At each one of those layers we can provide a trust platform that guarantees through the strength of the cryptography chosen (and we support many different types of crypto) that this communication/device is secure because the crypto is intact.”

    In the world of consumer IoT devices, any successful infection of the device with a bot will break the chain of trust and outbound traffic can be blocked. In ICS, the integrity of both the IIoT device and its communication with the SCADA device can be guaranteed. In the commercial world, Mocana this week announced that it has verified the integration of its IoT Security Platform with the IoT cloud platforms of Amazon Web Services, Microsoft Azure IoT, and VMware.

    Reply
16. September 18, 2017 at 1:44 pm

    Tomi Engdahl says:

    Millions Download “ExpensiveWall” Malware via Google Play
    http://www.securityweek.com/millions-download-expensivewall-malware-google-play

    A newly discovered Android malware that managed to infect at least 50 applications in Google Play has been downloaded between 1 million and 4.2 million times, Check Point researchers warn.

    Dubbed ExpensiveWall, the threat was designed to send fraudulent premium SMS messages and to charge users’ accounts for fake services without their knowledge.

    The total number of affected users, Check Point says, could be between 5.9 million and 21.1 million, as ExpensiveWall iw a variant of malware found in Google Play earlier this year. Unlike previous iterations, however, the new sample uses advanced obfuscation techniques to evade Google Play’s built-in anti-malware protections.

    Reply
17. September 18, 2017 at 3:24 pm

    Tomi Engdahl says:

    Artificial intelligence identifies abnormal network traffic

    Established in the Czech Republic in 2007, Flowmon now introduces its artificial intelligence network management solution to the Finnish market. It complements corporate firewalls and anti-virus protection.

    The first computer virus has been invented for 50 years. Writing malware is a growing large business that threatens businesses around the world. Preparing for tomorrow’s cyberbullying requires new kinds of solutions.

    - WannaCryn and Petya’s wormholes are becoming more and more common, and traditional protection based on firewalls and antivirus protection is no longer sufficient. Flowmon’s online behavioral analysis detects and responds to these threats and other abnormal network traffic. Artificial intelligence learns about the network and responds to network traffic abnormalities , says Tomas Sarocky, Country Manager at Flowmon Networks.

    Flowmon detects, for example, if someone is using a malicious application online if the network is part of a DDoS botnet or if a virus has come into a machine that, for example, steals information or hampers production. The technology is based on the fact that undesirable behavior is always unusual. The background is through years of research, advanced artificial intelligence algorithms and machine learning.

    the traditional solution model based on firewall and antivirus protection is not enough when companies face a modern and far more demanding threat than others, which require tools other than virus-based tools. Flowmon’s network monitoring works with artificial intelligence together with existing solutions, providing the necessary additional protection.

    - Flowmon not only detects attacks, but also makes it more effective by responding to them by providing more detailed information about the threat. This will speed up network restoration and enable better prevention.

    Source: http://www.etn.fi/index.php/13-news/6848-tekoaely-tunnistaa-poikkeavan-verkkoliikenteen

    Reply
18. September 18, 2017 at 9:59 pm

    Tomi Engdahl says:

    Andy Greenberg / Wired:
    Study: Apple may be overselling its differential privacy protections, which add noise to a user’s info before it’s sent to iCloud; Apple disputes the findings — FOR THE LAST year, Apple has touted a mathematical tool that it describes as a solution to a paradoxical problem: mining user data …

    How One of Apple’s Key Privacy Safeguards Falls Short
    https://www.wired.com/story/apple-differential-privacy-shortcomings

    For the past year, Apple has touted a mathematical tool that it describes as a solution to a paradoxical problem: mining user data while simultaneously protecting user privacy. That secret weapon is “differential privacy,”

    But differential privacy isn’t a simple toggle switch between total privacy and no-holds-barred invasiveness. And a new study, which delves deeply into how Apple actually implements the technique, suggests the company has ratcheted that dial further toward aggressive data-mining than its public promises imply.

    Reply
19. September 19, 2017 at 8:13 am

    Tomi Engdahl says:

    Someone checked and, yup, you can still hijack Gmail, Bitcoin wallets etc via dirty SS7 tricks
    Two-factor authentication by SMS? More like SOS
    https://www.theregister.co.uk/2017/09/18/ss7_vuln_bitcoin_wallet_hack_risk/

    Once again, it’s been demonstrated that vulnerabilities in cellphone networks can be exploited to intercept one-time two-factor authentication tokens in text messages.

    Specifically, the security shortcomings lie in the Signaling System 7 (SS7) protocol, which is used to by networks worldwide to talk to each other to route calls, and so on.

    There are little or no safeguards in place on SS7 once you have access to a cell network operator’s infrastructure. If you can reach the SS7 equipment – either as a corrupt insider or a hacker breaking in from the outside – you can reroute messages and calls as you please. Someone working for, or who has compromised, a telco in Morocco, for instance, can quietly hijack and receive texts destined for subscribers in America.

    Infosec outfit Positive Technologies, based in Massachusetts, USA, obtained access to a telco’s SS7 platform, with permission for research purposes, to this month demonstrate how to commandeer a victim’s Bitcoin wallet. First, they obtained their would-be mark’s Gmail address and cellphone number. They then requested a password reset for the webmail account, which involved sending a token to the cellphone number. Positive’s team abused SS7 within the telco to intercept the authentication token and gain access to the Gmail inbox. From there, they were able to reset the password to the user’s Coinbase wallet, log into that, and empty it of crypto-cash.

    Bitcoin wallet hacked via SMS interception
    https://vimeo.com/232678861/b1295b6384

    Reply
20. September 19, 2017 at 8:15 am

    Tomi Engdahl says:

    AnandTech Goes HTTPS: All Encryption, All the Time
    by John Campion & Ryan Smith on September 18, 2017 2:25 PM EST
    https://www.anandtech.com/show/11848/anandtech-goes-https-all-encryption

    If you’re reading this, then congratulations! You have successfully accessed AnandTech over HTTPS.

    I’m pleased to announce that as of this afternoon, all AnandTech pages and websites are now being served over HTTPS, allowing us to offer end-to-end transport encryption throughout the site. This is part of a larger project for us which started with moving the AnandTech Forums over to the XenForo software package and HTTPS last year; now it’s AnandTech main site to receive a security treatment of its own.

    This update is being rolled out both to improve the security of the site, and as part of a broader trend in site hosting & delivery. From a site operations point of view, we’ve needed to improve the security of the user login system for some time so that usernames and passwords are better protected, as the two of those items are obviously important. Meanwhile, although AnandTech itself is not sensitive content, the broader trends in website hosting is for all sites regardless of content to move to HTTPS, as end-to-end encryption still enhances user privacy, and that’s always a good thing.

    Reply
21. September 19, 2017 at 8:35 am

    Tomi Engdahl says:

    Sexploitation gang thrown in clink for 171 years after ‘hunting’ kids online and luring them in front of webcams
    Youngsters tricked into performing sex acts for pervs
    https://www.theregister.co.uk/2017/09/19/sexploitation_gang_sentenced_to_171yrs/

    Four men have joined their two accomplices behind bars for tricking young girls into performing sex acts online so they could film them.

    Between November 16, 2013 and March 10, 2016 the gang ran a sophisticated web ring to haunt internet forums that children use regularly. They would then lure each victim, one by one, into a private group chat session and take on various roles to achieve their ends.

    According to federal court documents filed earlier this year, each gang member took on the part of either hunters, talkers, loopers or watchers.

    Reply
22. September 19, 2017 at 8:44 am

    Tomi Engdahl says:

    Grab your popcorn: The first annual Privacy Shield review is go
    Trump administration’s views on privacy to come under scrutiny
    https://www.theregister.co.uk/2017/09/18/first_annual_privacy_shield_review/

    Transatlantic data-transfer agreement Privacy Shield is facing its first major political hurdle as the inaugural joint review kicks off this week.

    Agreed last summer, the deal between the European Union and the US aims to safeguard EU citizens’ data when it is transferred across the pond.

    For one thing, it was facing legal challenges almost immediately – one from advocacy group Digital Rights Ireland, another as follow-up to Schrems’ original case – while the change in the US administration poured more uncertainty into the mix.

    Questions were also raised over whether president Donald Trump’s executive orders on immigration, which limited citizens’ privacy rights, undermined Privacy Shield.

    Reply
23. September 19, 2017 at 11:11 am

    Tomi Engdahl says:

    Trouble in Paradise as Cyber Attackers Circumvent 2FA
    http://www.securityweek.com/trouble-paradise-cyber-attackers-circumvent-2fa

    Reply
24. September 19, 2017 at 11:11 am

    Tomi Engdahl says:

    Windows 10 Users to Get Improved Privacy Controls
    http://www.securityweek.com/windows-10-users-get-improved-privacy-controls

    The upcoming Windows 10 Fall Creators Update will bring enhanced privacy controls to both consumers and commercial customers, Microsoft says.

    After being heavily criticized for the large amount of user data collected from Windows 10 machines, Microsoft has decided to implement a series of data protections to silence concerns, and has been successful in its attempt.

    Released earlier this year, the Windows 10 Creators Update provided users with increased control over privacy settings and updates, and also allowed them to choose how much usage data they like to share with Microsoft. In July, the company announced that it would force users into reviewing their privacy settings and installing the latest feature update, namely Windows 10 Creators Update.

    Reply
25. September 19, 2017 at 11:16 am

    Tomi Engdahl says:

    Equifax Cybersecurity Failings Revealed Following Breach
    http://www.securityweek.com/equifax-cybersecurity-failings-revealed-following-breach

    Shortcomings revealed by researchers and cybersecurity firms following the massive data breach suffered by Equifax show that a successful hacker attack on the credit reporting agency’s systems was inevitable.

    Some members of the industry pointed out last week that the company’s Chief Security Officer (CSO) Susan Mauldin was a music major with no educational background in cybersecurity or technology. Mauldin and Chief Information Officer David Webb retired from the company on Friday.

    Others dug up old vulnerability reports that the firm had still not addressed and noted the lack of even basic protections on the company’s website. Even the website set up by Equifax to provide information about the breach was riddled with security holes and some services flagged it as a phishing site.

    The Apache Struts 2 vulnerability leveraged by cybercriminals to breach Equifax systems had been known and exploited for roughly two months before the attack on the company. Equifax said its security team knew about the flaw and is now trying to determine why an online dispute portal, which served as the initial point of entry, remained unpatched.

    Experts pointed out that the Apache Struts flaw is not easy to fix, especially if you have many systems that need patching. However, they believe the problem can be addressed with modern security solutions.

    Comodo discovered that more than 388 records of Equifax users and employees are up for sale on the dark web. The information, which includes usernames, passwords and login URLs, was apparently stolen using Pony malware. The security firm pointed out that some Equifax credentials were also exposed in third-party incidents, including the massive LinkedIn and Dropbox breaches.

    “From third-party (non-company system) sources, we uncovered that Equifax’s chief privacy officer, CIO, VP of PR and VP of Sales, used all lowercase letters, no special symbols, and easily guessable words like spouses’ names, city names, and even combinations of initials and birth year. This reveals that they didn’t follow basic security best practices and were lacking a complex password requirement,” Comodo said in a blog post.

    Equifax stock was worth roughly $140, but it has now dropped to $92, and financial experts believe it could plunge as low as $50. The incident has already cost the company nearly $10 billion in market value.

    Equifax Shares More Details About Breach
    http://www.securityweek.com/equifax-shares-more-details-about-breach

    Equifax has shared more details about the recent breach that affects roughly 143 million U.S. consumer

    Equifax also revealed that the breach affected less than 400,000 U.K. consumers. Their data had been stored in the United States due to a “process failure” between 2011 and 2016. It’s still unclear how many Canadians are impacted by the breach.

    That was when Equifax’s security team discovered that the attackers had exploited an Apache Struts flaw to access its systems on May 13. The vulnerability in question, CVE-2017-5638, has been exploited in the wild since the first half of March.

    Equifax said its team had known about the Struts vulnerability since it was disclosed and it took steps to patch systems. The organization is still reviewing the facts in an effort to determine why the dispute portal remained unpatched. FireEye-owned Mandiant has been called in to assist in conducting a comprehensive forensic investigation.

    “The word patch is a bit inappropriate for this problem, since what Equifax would have had to do is replace the vulnerable Struts library with the latest one,”

    Reply
26. September 19, 2017 at 11:51 am

    Tomi Engdahl says:

    A Google security chief considers the NSA a state-sponsored threat
    https://techcrunch.com/2017/09/18/a-google-security-chief-considers-the-nsa-a-state-sponsored-threat/?utm_source=tcfbpage&sr_share=facebook

    Today at TechCrunch Disrupt SF 2017 Google’s Manager of Information Security Heather Adkins sat down for a fireside chat. Among the varying topics discussed, she spoke about what’s like to have the NSA tap the company’s lines and how she views state sponsored threats.

    Reply
27. September 19, 2017 at 12:31 pm

    Tomi Engdahl says:

    Someone checked and, yup, you can still hijack Gmail, Bitcoin wallets etc via dirty SS7 tricks
    Two-factor authentication by SMS? More like SOS
    https://www.theregister.co.uk/2017/09/18/ss7_vuln_bitcoin_wallet_hack_risk/

    Reply
28. September 19, 2017 at 12:59 pm

    Tomi Engdahl says:

    AI Just Made Guessing Your Password a Whole Lot Easier
    https://yro.slashdot.org/story/17/09/18/2054205/ai-just-made-guessing-your-password-a-whole-lot-
    easier

    The Equifax breach is reason for concern, of course, but if a hacker wants to access your online data by simply guessing your password, you’re probably toast in less than an hour. Now, there’s more bad news: Scientists have harnessed the power of artificial intelligence (AI) to create a program that, combined with existing tools, figured more than a quarter of the passwords from a set of more than 43 million LinkedIn profiles.

    Artificial intelligence just made guessing your password a whole lot easier
    http://www.sciencemag.org/news/2017/09/artificial-intelligence-just-made-guessing-your-password-whole-lot-easier

    Last week, the credit reporting agency Equifax announced that malicious hackers had leaked the personal information of 143 million people in their system. That’s reason for concern, of course, but if a hacker wants to access your online data by simply guessing your password, you’re probably toast in less than an hour. Now, there’s more bad news: Scientists have harnessed the power of artificial intelligence (AI) to create a program that, combined with existing tools, figured more than a quarter of the passwords from a set of more than 43 million LinkedIn profiles. Yet the researchers say the technology may also be used to beat baddies at their own game.

    The work could help average users and companies measure the strength of passwords, says Thomas Ristenpart, a computer scientist who studies computer security at Cornell Tech in New York City but was not involved with the study. “The new technique could also potentially be used to generate decoy passwords to help detect breaches.”

    The strongest password guessing programs, John the Ripper and hashCat, use several techniques. One is simple brute force, in which they randomly try lots of combinations of characters until they get the right one. But other approaches involve extrapolating from previously leaked passwords and probability methods to guess each character in a password based on what came before. On some sites, these programs have guessed more than 90% of passwords. But they’ve required many years of manual coding to build up their plans of attack.

    Reply
29. September 19, 2017 at 1:00 pm

    Tomi Engdahl says:

    Cybersecurity and technology transfer seen as top priorities for NIST director nominee
    https://www.theregister.co.uk/2017/09/19/programming_in_the_middle_ages/

    President Donald Trump has nominated Walter Copan, an expert in technology transfer, to be the director of the National Institute of Standards and Technology (NIST), which supports physical sciences research and operates labs in Gaithersburg, Maryland, and Boulder, Colorado.

    The 63-year-old Copan is a Ph.D. chemist and president and CEO of the Colorado-based Intellectual Property Engineering Group. He says his top priority for the agency is to implement the Cybersecurity Framework, a NIST-led effort to improve network security across federal agencies as well as industry.

    “I think we all see cybersecurity as national security and economic security,” Copan says. He also wants to make sure security improvements benefit not just federal agencies and large corporations, but also smaller companies that can’t afford teams of information technology professionals. “Small- and medium-sized businesses are drivers of the economy. Statistics show that when [these businesses] are the victim of a cyberattack they go out of business in less than a year,” Copan says.

    Reply
30. September 19, 2017 at 3:11 pm

    Tomi Engdahl says:

    DigitalOcean Warns of Vulnerability Affecting Cloud Users
    http://www.securityweek.com/digitalocean-warns-vulnerability-affecting-cloud-users

    DigitalOcean is warning customers that some 1-Click applications running MySQL have an account with the same default password across all instances, and the company says the issue affects other cloud providers as well.

    DigitalOcean customers reported on social media that they received an email recommending that they run a script to determine if their Droplets – the name used by the company for its cloud servers – are affected by the vulnerability.

    The company allows its users to deploy pre-built and pre-configured applications with only one click. The list of 1-Click (One-Click) applications includes Node.js, Rails, Redis, MongoDB, Docker, GitLab, Magento and many others.

    Reply
31. September 19, 2017 at 3:13 pm

    Tomi Engdahl says:

    Google, Spotify Release Open Source Cloud Security Tools
    http://www.securityweek.com/google-spotify-release-open-source-cloud-security-tools

    Google and music service Spotify announced last week the launch of Forseti Security, a community-driven collection of open source tools designed to improve security in Google Cloud Platform (GCP) environments.

    The Forseti toolkit currently includes an inventor tool that provides visibility into GCP resources, a scanner that validates access control policies, an enforcement tool that removes unwanted access to resources, and an add-on that helps users understand, test and develop Identity and Access Management (IAM) policies.

    “Forseti gives us visibility into the GCP infrastructure that we didn’t have before, and we use it to help make sure we have the right controls in place and stay ahead of the game,” Spotify said.

    http://forsetisecurity.org/

    Reply
32. September 20, 2017 at 8:55 am

    Tomi Engdahl says:

    OptionsBleed – Apache bleeds in uncommon configuration
    https://hackaday.com/2017/09/19/optionsbleed-apache-bleeds-in-uncommon-configuration/

    [Hanno Böck] recently uncovered a vulnerability in Apache webserver, affecting Apache HTTP Server 2.2.x through 2.2.34 and 2.4.x through 2.4.27. This bug only affects Apache servers with a certain configuration in .htaccess file. Dubbed Optionsbleed, this vulnerability is a use after free error in Apache HTTP that causes a corrupted Allow header to be replied by the webserver in response to HTTP OPTIONS requests. This can leak pieces of arbitrary memory from the server process that may contain sensitive information. The memory pieces change after multiple requests, so for a vulnerable host an arbitrary number of memory chunks can be leaked.

    Unlike the famous Heartbleed bug in the past, Optionsbleed leaks only small chunks of memory and more importantly only affects a small number of hosts by default. Nevertheless, shared hosting environments that allow for .htaccess file changes can be quite sensitive to it, as a rogue .htaccess file from one user can potentially bleed info for the whole server.

    Optionsbleed – HTTP OPTIONS method can leak Apache’s server memory
    https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html

    Reply
33. September 20, 2017 at 9:47 am

    Tomi Engdahl says:

    AI slurps, learns millions of passwords to work out which ones you may use next
    Get creative – bringbackfirefly! will not longer cut it, nerds
    https://www.theregister.co.uk/2017/09/20/researchers_train_ai_bots_to_crack_passwords/

    Eggheads have produced a machine-learning system that has studied millions of passwords used by folks online to work out other passphases people are likely to use.

    These AI-guessed passwords could be used with today’s tools to crack more hashed passwords, and log into more strangers’ accounts on systems, than ever before.

    When it comes to cracking a password, you typically start with a hashed version of the passphrase, stolen from a database or similar.

    Reply
34. September 20, 2017 at 9:50 am

    Tomi Engdahl says:

    Chrome Continues To Be The Most Secure Browser, Confirms New Research
    http://www.tomshardware.com/news/chrome-most-secure-browser-research,35493.html

    Reply
35. September 20, 2017 at 1:47 pm

    Tomi Engdahl says:

    At the beginning of the year, 1.9 billion personal data was stolen

    Databases are growing at an alarming rate. Gemalto, a leader in smart card circuits, has produced a new security report that captured 1.9 billion personal data in the first half of this year.

    Compared to the last half of last year, the figure has grown by as much as 164 percent. According to Gemalto, the vast majority of personal information was abducted in 22 major cybercrime, with over one million data reaching each criminal.

    The situation may in fact be worse than reported. Of the reported 918 infiltrations in more than fifty-five, it was not possible to find out how much information eventually came to an end in the hands of criminals.

    Over 4.5 years, more than 9 billion personal data have come to the hands of criminals.

    In the beginning of this year, an average of more than 10 million data were stolen every day. The problem is likely to affect a large part of the population. The worry is that less than one percent of the stolen data is encrypted.

    Source: http://www.etn.fi/index.php/13-news/6868-alkuvuonna-varastettiin-1-9-miljardia-henkiloetietoa

    More:
    Download the Breach Level Index 2017 H1 Report Now
    http://www6.gemalto.com/breach-level-index-2017-h1-report?utm_medium=press-release&utm_campaign=bli-lp-report

    According to the latest Breach Level Index report, there were 918 reported data breaches and almost 1.9 billion compromised data records worldwide in the first half of 2017.

    Other key findings include:

    Almost 1.9 billion records compromised, lost or stolen in the first half of 2017, up by 164% from the last six months in 2016.
    Identity theft accounted for 74% of all data breaches in the first six months of 2017, up 49% from the second half of 2016
    Malicious outsiders were responsible for 74% of breaches, up by 23%
    Across industries, healthcare sector data breaches made up 25% of all breaches, with major breaches around the U.K’s National Health Service.
    Education made up 13% of all breaches, with an increase of 103%

    Reply
36. September 20, 2017 at 1:51 pm

    Tomi Engdahl says:

    WikiLeaks releases files that appear to offer details of Russian surveillance system
    https://www.washingtonpost.com/news/worldviews/wp/2017/09/19/wikileaks-releases-files-that-appear-to-offer-details-of-russian-surveillance-system/?utm_term=.0da04777bab9

    WikiLeaks, a secret-sharing organization accused of playing a key role in Russian attempts to influence the 2016 U.S. presidential election, has released documents that it claims offer details of how Moscow uses state surveillance to spy on Internet and cellphone users.

    The release, dubbed “Spy Files Russia,” appears to mark a shift for an organization that has long been accused of a reluctance to publish documents that could be embarrassing for the Russian state.

    As Edward Snowden, a former National Security Agency contractor who now lives in Russia, put it in a tweet: “Plot twist.”

    However, other experts are less impressed. “I don’t think it’s a real expose,” said Andrei Soldatov, a Russian investigative journalist and co-author of the “The Red Web: The Struggle Between Russia’s Digital Dictators and the New Online Revolutionaries.” “It actually adds a few details to the picture, [but] it’s not that much.”

    Spy Files Russia
    https://wikileaks.org/spyfiles/russia/

    Reply
37. September 20, 2017 at 3:00 pm

    Tomi Engdahl says:

    Twitter Suspends 300,000 Accounts Tied To Terrorism In 2017
    https://yro.slashdot.org/story/17/09/19/2120231/twitter-suspends-300000-accounts-tied-to-terrorism-in-2017

    According to a new transparency report, Twitter said it suspended nearly 300,000 accounts globally linked to terrorism in the first half of the year.

    Twitter Suspends 300,000 Accounts Tied to Terrorism in 2017
    https://www.bloomberg.com/news/articles/2017-09-19/twitter-suspends-300-000-accounts-in-2017-for-terrorism-content

    Twitter Inc., under pressure from governments around the world to combat online extremism, said that improving automation tools are helping block accounts that promote terrorism and violence.

    In the first half of the year, Twitter said it suspended nearly 300,000 accounts globally linked to terrorism. Of those, roughly 95 percent were identified by the company’s spam-fighting automation tools. Meanwhile, the social network said government data requests continued to increase, and that it provided authorities with data on roughly 3,900 accounts from January to June.

    Twitter currently has around 328 million users, with monthly active users in the U.S. around 68 million.

    Reply
38. September 20, 2017 at 3:04 pm

    Tomi Engdahl says:

    What Comes After User-Friendly Design?
    https://tech.slashdot.org/story/17/09/19/1946256/what-comes-after-user-friendly-design

    “User-friendly” was coined in the late 1970s, when software developers were first designing interfaces that amateurs could use. In those early days, a friendly machine might mean one you could use without having to code. Forty years later, technology is hyper-optimized to increase the amount of time you spend with it, to collect data about how you use it, and to adapt to engage you even more. [...]

    What Comes After User-Friendly Design?
    The design industry needs a new way to talk to users–one that isn’t just friendly, but respectful.
    https://www.fastcodesign.com/90139957/what-comes-after-user-friendly-design

    “User-friendly” was coined in the late 1970s, when software developers were first designing interfaces that amateurs could use. In those early days, a friendly machine might mean one you could use without having to code.

    Forty years later, technology is hyper-optimized to increase the amount of time you spend with it, to collect data about how you use it, and to adapt to engage you even more. Meanwhile, other aspects of our tech have remained difficult to use, from long, confusing privacy policies to a lack of explanation on why and when your data is being collected, much less how it’s being protected. While some aspects of apps and platforms have become almost too easy to use–consider how often Facebook invites you to check out a friend’s latest update or new comment–others remain frustratingly opaque, like, say, the way Facebook crafts advertising to your behavior.

    The discussion around privacy, security, and transparency underscores a broader transformation in the typical role of the designer

    Reply
39. September 20, 2017 at 3:13 pm

    Tomi Engdahl says:

    Seriously, Is It That Easy To Skim Cards?
    https://hackaday.com/2017/09/20/seriously-is-it-that-easy-to-skim-cards/

    The folks at Sparkfun write about an approach they received from a law enforcement agency bearing a selection of card skimmer devices that had been installed in gasoline pumps. These didn’t rely on interception of the card itself, instead they sat as a man-in-the-middle attack in the serial line between the card reader unit and the pump electronics. Let that sink in for a minute: a serial line that is readily accessible to anyone with the pump manufacturer’s standard key, carries card data in an unencrypted form. The owner of the skimming device is the criminal, but the company leaving such a wide-open vulnerability should really be joining them in having to answer to authorities.

    Gas Pump Skimmers
    https://learn.sparkfun.com/tutorials/gas-pump-skimmers

    Reply
40. September 20, 2017 at 3:33 pm

    Tomi Engdahl says:

    Amazon ‘Reviewing’ Its Website After It Suggested Bomb-Making Items
    https://slashdot.org/story/17/09/20/1424206/amazon-reviewing-its-website-after-it-suggested-bomb-making-items

    Amazon said on Wednesday that it was reviewing its website after a British television report said the online retail giant’s algorithms were automatically suggesting bomb-making ingredients that were “Frequently bought together.” The news is particularly timely in Britain, where the authorities are investigating a terrorist attack last week on London’s Underground subway system. The attack involved a crude explosive in a bucket inside a plastic bag, and detonated on a train during the morning rush.

    Amazon ‘Reviewing’ Its Website After It Suggested Bomb-Making Items
    https://www.nytimes.com/2017/09/20/technology/uk-amazon-bomb.html

    LONDON — Amazon said on Wednesday that it was reviewing its website after a British television report said the online retail giant’s algorithms were automatically suggesting bomb-making ingredients that were “Frequently bought together.”

    The news report is the latest example of a technology company drawing criticism for an apparently faulty algorithm. Google and Facebook have come under fire for allowing advertisers to direct ads to users who searched for, or expressed interest in, racist sentiments and hate speech. Growing awareness of these automated systems has been accompanied by calls for tech firms to take more responsibility for the contents on their sites.

    Amazon customers buying products that were innocent enough on their own, like cooking ingredients, received “Frequently bought together” prompts for other items that would help them produce explosives, according to the Channel 4 News.

    Although many of the ingredients mentioned by Channel 4 News are not illegal on their own, the report said there had been successful prosecutions in Britain against individuals who bought chemicals and components that can produce explosives.

    Amazon said in a statement that all the products sold on its website “must adhere to our selling guidelines and we only sell products that comply with U.K. laws.”

    Reply
41. September 20, 2017 at 3:49 pm

    Tomi Engdahl says:

    Stuxnet-Style Virus Failed to Infiltrate North Korea’s Nuclear Program
    https://spectrum.ieee.org/riskfactor/telecom/security/nsa-stuxnetstyle-virus-failed-to-infiltrate-north-koreas-nuclear-program

    The famous Stuxnet computer virus that sabotaged Iran’s nuclear program apparently had a cousin designed to do the same to North Korea. But this other U.S. cyber attack failed because agents could not physically access the isolated computers of North Korea’s nuclear program.

    Several U.S. intelligence sources told Reuters that the operation aimed at North Korea took place at the same time as the Stuxnet attack that crippled Iran’s nuclear program in 2009 and 2010.

    Both Iran and North Korea likely use similar centrifuges that can enrich uranium for either civilian purposes or to become weapons-grade nuclear material. That means North Korea probably also uses control software developed by Siemens AG running on some version of Microsoft Windows, experts told Reuters.

    Reply
42. September 21, 2017 at 9:11 am

    Tomi Engdahl says:

    Viacom left the keys of its digital kingdom on a publicly exposed AWS S3 bucket
    http://securityaffairs.co/wordpress/63201/data-breach/viacom-data-leak.html

    The security researcher Chris Vickery discovered that Media giant Viacom left sensitive data and secret access key on unsecured Amazon AWS S3 bucket.

    Media giant Viacom left sensitive data and secret access key on unsecured Amazon AWS S3 bucket, a gift for hackers. Viacom controls Paramount Pictures, MTV, Comedy Central and Nickelodeon.

    The huge trove of data store was discovered by the popular security researcher Chris Vickery, director of Cyber Risk Research at security shop UpGuard.

    The Amazon AWS S3 bucket contained 72 compressed .tgz files in a folder labeled ‘MCS’ name which appears to be Viacom’s Multiplatform Compute Services division that operates IT systems for the firm.

    The cloud storage exposed a gigabyte’s worth of credentials and configuration files for the backend of dozens of Viacom properties.

    Reply
43. September 21, 2017 at 9:23 am

    Tomi Engdahl says:

    Hacker or Hero? Why a Hacker Isn’t Always a Supervillain
    http://www.securityweek.com/hacker-or-hero-why-hacker-isnt-always-supervillain

    Summer is coming to a close, and with it the end of a steady stream of superhero movies that have been lighting up the box office over the past few months. But while on-screen heroes have been lassoing bad guys or saving the galaxy, here in the real world we’ve been witnessing a different type of anti-criminal activity: defense against cybercrime.

    While the security industry is always focused on the latest “hack of the day” or other headline-generating malware outbreak, few attacks in recent memory have generated as much interest as WannaCry, the ransomware attack that crippled organizations worldwide back in May.

    In a particularly shocking twist, researcher Marcus Hutchins, who discovered how to stop WannaCry, was recently arrested on separate hacking charges, leading to much debate within the security community. Not only was this person responsible for stopping arguably the most high-profile ransomware attack in history, but now he was accused of creating an unrelated malware strain that could land him in prison. In the wake of his arrest, many tried to figure out if he was a “black hat or a white hat” – someone who used his hacking expertise for good, or for wrongdoing?

    If the summer movie season has taught us anything, it’s that heroes and villains aren’t always so black and white.

    As people with an extraordinary ability to control the way the world works, many of today’s hackers mimic the X-Men. They toe the line between personal gain for their talent and a desire to do good for others. But if the rest of the community would give hackers more of a chance before writing them off as evildoers, not only would there potentially be more incentives for capable people to go into the white hat hacking business, but the stigma of evil hackers would slowly start to dissipate. By appreciating the unique skillset that hackers bring to the security industry, the benefits will be too large to ignore.

    Reply
44. September 21, 2017 at 9:24 am

    Tomi Engdahl says:

    iOS 11 Patches 8 Security Vulnerabilities
    http://www.securityweek.com/ios-11-patches-8-security-vulnerabilities

    Reply
45. September 21, 2017 at 9:25 am

    Tomi Engdahl says:

    AWS Bucket Leaks Viacom Critical Data
    http://www.securityweek.com/aws-bucket-leaks-viacom-critical-data

    An Amazon Web Services S3 cloud storage bucket containing a great deal of Viacom internal access credentials and other critical data was left publicly accessible, UpGuard security researchers have discovered.

    Viacom is an $18 billion multinational corporation that owns Paramount Pictures and various cable channels, including MTV, BET, Comedy Central, and Nickelodeon. According to the company, it has “the largest portfolio of ad-supported cable networks in the United States, in terms of audience share.”

    Chris Vickery, UpGuard Director of Cyber Risk Research, was the one to discover the exposed Amazon Web Services (AWS) bucket. In it, he found seventy-two .tgz files representing irregular backups of technical data, created starting with June 2017 and containing a host of sensitive data.

    After having a look at the exposed data, the security researcher determined that it included a master provisioning server running Puppet, left accessible to the public Internet, along with “the credentials needed to build and maintain Viacom servers across the media empire’s many subsidiaries and dozens of brands,” UpGuard’s Dan O’Sullivan notes in a blog post.

    Viacom’s secret cloud keys were also exposed in the leak, which could have put the media company’s cloud-based servers in the hands of hackers. Thus, attackers could have been able to launch a variety of attacks while leveraging “the IT infrastructure of one of the world’s largest broadcast and media companies.”

    Cut Cord: How Viacom’s Master Controls Were Left Exposed
    https://www.upguard.com/breaches/cloud-leak-viacom

    The UpGuard Cyber Risk Team can now disclose that Viacom Inc, the Fortune 500 corporation that owns Paramount Pictures, as well as cable channels like MTV, Comedy Central, and Nickelodeon, exposed a vast array of internal access credentials and critical data that could be used to cause immense harm to the multinational corporation’s business operations. Exposed in the leak are a master provisioning server running Puppet, left accessible to the public internet, as well as the credentials needed to build and maintain Viacom servers across the media empire’s many subsidiaries and dozens of brands.

    Reply
46. September 21, 2017 at 9:26 am

    Tomi Engdahl says:

    Twitter Suspends Nearly 1 Million Accounts Associated with Terrorism
    http://www.securityweek.com/twitter-suspends-nearly-1-million-accounts-associated-terrorism

    Twitter has suspended a total of 935,897 accounts for the promotion of terrorism between August 1, 2015, and June 30, 2017, the company says in its latest transparency report.

    A total of 299,649 accounts were suspended during the first half of 2017, marking a 20% decrease compared to the previous six-month period, the company reveals. 95% of the account suspensions were the result of internal efforts, the social platform claims.

    These are “accounts that actively incite or promote violence associated with internationally recognized terrorist organizations, promote internationally recognized terrorist organizations, and accounts attempting to evade prior enforcement,” Twitter explains.

    New Data, New Insights: Twitter’s Latest #Transparency Report
    https://blog.twitter.com/official/en_us/topics/company/2017/New-Data-Insights-Twitters-Latest-Transparency-Report.html

    Reply
47. September 21, 2017 at 9:27 am

    Tomi Engdahl says:

    ‘Optionsbleed’ Flaw Causes Apache to Leak Data
    http://www.securityweek.com/optionsbleed-flaw-causes-apache-leak-data

    A vulnerability found in Apache HTTP Server (httpd) can cause certain systems to leak potentially sensitive data in response to HTTP OPTIONS requests, a researcher warned.

    The flaw was discovered by freelance journalist and security researcher Hanno Böck, who has dubbed it “Optionsbleed.” Despite having a fancy name that is similar to the critical OpenSSL vulnerability known as Heartbleed due to them both “bleeding” memory contents, Optionsbleed is not as severe or as widespread.

    Further analysis revealed that Apache leaked server memory due to a use-after-free bug. The flaw, which could result in the exposure of sensitive data, has been assigned the CVE identifier CVE-2017-9798.

    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9798

    Reply
48. September 21, 2017 at 9:28 am

    Tomi Engdahl says:

    Android AV App Collected Data on Tens of Millions Users
    http://www.securityweek.com/android-av-app-collected-data-tens-millions-users

    Tens of millions of Android users potentially had their information collected by a security application distributed through Google Play, Check Point security researchers warn.

    Called DU Antivirus Security, the software had between 10 and 50 million downloads when the security researchers alerted Google on its data collection practices on August 21. The application was removed from the store on August 24, but was reinstated on August 28, after its developers removed the information-collecting code.

    Offered for free, the security software is developed by the DU group, and was discovered to collect a variety of user data without requesting consent from the device owner. The data collection activities, the security researchers discovered, were performed only at the application’s first run.

    According to Check Point, the information collected by the application from Android devices included unique identifiers, contact list, call logs, and potentially the location of the device. After gathering the information, the app was encrypting it and sending it to a remote serve

    Reply
49. September 21, 2017 at 9:28 am

    Tomi Engdahl says:

    Iranian Hackers Target Aerospace, Energy Companies
    http://www.securityweek.com/iranian-hackers-target-aerospace-energy-companies

    A cyber espionage group linked by security researchers to the Iranian government has been observed targeting aerospace and energy organizations in the United States, Saudi Arabia and South Korea.

    The threat actor, tracked by FireEye as APT33, is believed to have been around since at least 2013. Since mid-2016, the security firm has spotted attacks aimed by this group at the aviation sector, including military and commercial aviation, and energy companies with connections to petrochemical production.

    Specifically, the cyberspies targeted a U.S. organization in the aerospace sector, a Saudi Arabian business conglomerate with aviation holdings, and a South Korean firm involved in oil refining and petrochemicals. In recent attacks, the hackers used job vacancies at a Saudi Arabian petrochemical firm to target the employees of organizations in South Korea and Saudi Arabia.

    Reply
50. September 21, 2017 at 9:30 am

    Tomi Engdahl says:

    Infrared Cameras Allow Hackers to Jump Air Gaps
    http://www.securityweek.com/infrared-cameras-allow-hackers-jump-air-gaps

    A team of researchers from Israel has developed a piece of malware that demonstrates how hackers can abuse security cameras with infrared (IR) capabilities to send and receive data to and from an air-gapped network.

    The research was conducted by the Ben-Gurion University of Negev and the Shamoon College of Engineering in Israel. Its goal was to show that a piece of malware installed in an air-gapped network can not only exfiltrate sensitive data, such as passwords, PINs and encryption keys, but also receive commands from the outside world via infrared light, which is invisible to the human eye.

    Security cameras are typically equipped with IR LEDs that provide night vision capabilities. If an attacker can plant a piece of malware on the network connected to these cameras, the malware can take control of the IR LEDs and use them to transmit bits of data.

    The malware described by experts, dubbed “aIR-Jumper,” can encode the stolen data using various methods. For example, if on-off keying (OOK) encoding is used, the absence of an IR signal for a certain duration encodes a zero (“0”) bit, while the presence of a signal for the same duration encodes a one (“1”) bit.

    Data transmission rates depend on the security camera and the camera used to capture the data (e.g. GoPro, smartphone camera). Experiments conducted by the researchers showed that data can be exfiltrated at a rate of 20 bits/sec over a distance of tens of meters, and it can be infiltrated over a distance of hundreds of meters and even kilometers at a rate of 100 bits/sec.

    Data transmission rates can be increased significantly if more than one security camera is used by the attacker.

    https://arxiv.org/ftp/arxiv/papers/1709/1709.05742.pdf

    Reply