Security market grows

Security is always in the news so it hardly comes as a surprise that the market for security products is growing. According to research specialist Gartner the worldwide security software market was up 5.3 percent in 2014.

In terms of value the market is worth $21.4 billion, however, the make up of that market is shifting. Low growth in endpoint protection platforms and a decline in consumer security software -- possibly because of improved built-in security in the latest versions of Windows -- are balanced by high-growth areas, such as security information and event management (SIEM), secure Web gateway (SWG), identity governance and administration (IGA) and enterprise content-aware data loss prevention (DLP).

`Overall market growth was up slightly in 2014 to 5.3 percent from 4.9 percent in 2013,` says Sid Deshpande, principal research analyst at Gartner. `Even though the SWG segment experienced single-digit growth in 2014, cloud-based and hybrid SWG deployments are becoming increasingly popular. As organizations` corporate data traffic becomes more exposed to the Internet and moves out of the control of traditional network security boundaries, SWG technologies continue to be an important piece of the overall security technology strategy of most enterprises`.

Symantec remains the biggest player in the security market with $3.69 billion of revenue, but it suffered its second consecutive year of revenue decline in 2014. This is in part due to its heavy reliance on consumer security software which accounts for 53 percent of its business.

Intel -- which owns McAfee -- is in second place with $1.8 billion, up 4.6 percent, followed by IBM which saw its security software revenue up 17 percent in 2014 to reach $1.48 billion.

The DLP market grew 15.8 percent year on year to reach $643 million in revenue in 2014. This was mainly due to a strong showing from Symantec in this sector, accounting for nearly half of the total market. SIEM was up 11 percent to $1.6 billion thanks to a strong focus on threat detection and response from security buyers.

Read original article

Facebook Security Checkup

Security and Facebook are not words that generally sit well together. This is something that the social network is only too aware of, and in recent years has taken various steps to try to improve the security and privacy of individuals` accounts. The latest tool in its arsenal is the new Security Checkup.

At the moment the tool is not being made available to everyone, but those who have been chosen to test drive it will be able to use simple on-screen prompts to change their password, turn on login alerts, and clean up login sessions, all from one handy location.

One of the problems with security on Facebook is that users often do not take the time to look through the settings that are available that could help to keep them protected. By pulling everything together into a single guided process, it is hoped that more people will be encouraged into managing their accounts more carefully.

Introducing the tool test in a Facebook post, Site Integrity Product Manager, Melissa Luu-Van said:

We invest considerable resources to create a safe and secure experience for everyone on Facebook. That means building security technologies directly into our platform that are always working to protect your information, as well as offering tools you can use to increase your account security. Today, we are starting to test a new tool that quickly guides you through a few of the options that anyone can access on their security settings page.

You don't need to do anything to access the new tool -- if you have been chosen to take part in the test, the Security Checkup will automatically pop up on your screen.

Read original article

Jacobi Medical Center Breach

During the same assessment that revealed a recent Bellevue Hospital Center breach, New York City Health and Hospitals Corporation (HHC) identified a separate incident involving a former Jacobi Medical Center employee improperly emailing personal information on roughly 90,000 patients.

How many victims? About 90,000.

What type of personal information? Names, addresses, dates of birth, telephone numbers, medical record numbers, treatment dates and types of services, limited sensitive health information, and health insurance identification numbers, which may include Social Security numbers.

What happened? A former Jacobi employee improperly accessed and transmitted files containing the personal information to a personal email account and the email account at her new employer, which is a New York City agency.

What was the response? HHC interviewed the former employee, and confirmed that the email and information was deleted from her personal computer and personal email account, as well as the computer and email account used at her new employer. Steps have been taken to prevent former employees from gaining access to personal information once their employment has ceased. An automatic blocking system is being implemented to prevent email communications containing personal and other confidential information from being sent from HHC`s systems to outside systems, unless for legitimate purposes. All potentially impacted individuals are being notified, and offered a free year of credit monitoring services.

Details: The incident occurred on Feb. 19 and was discovered on Feb. 27. The employee indicated that she sent the information in the event that in the future she had to respond to questions about her past work.

Quote: `There is no evidence to suggest that the subject files were received or viewed by anyone other than the former employee, and there is no evidence to suggest that the PHI contained in these files was misused or further disclosed in any manner,` according to a notification posted to the website.

Read original article

Grabit Nabs 10k SMB Files

A fresh cyber-spying campaign has been able to steal about 10,000 files from small-to-medium sized businesses—so far.

The threat, appropriately dubbed `Grabit` by Kaspersky Lab, has targeted SMBs based mostly in Thailand, India and the US. Targeted sectors include chemicals, nanotechnology, education, agriculture, media, construction and more.

To illustrate the scale of operation, take, for instance, a simple Grabit keylogger, which was found to be maintaining thousands of victim account credentials from hundreds of infected systems. It has so far stolen 2,887 passwords, 1,053 emails and 3,023 usernames from 4,928 different hosts, internally and externally, including Outlook, Facebook, Skype, Gmail, Pinterest, Yahoo, LinkedIn and Twitter, as well as bank accounts and more.

`Grabit shows that it's not just a 'big fish' game—in the cyber-world, every single organization, whether it possesses money, information or political influence, could be of potential interest to one or other malicious actor,` said Ido Noar, senior security researcher for the Global Research & Analysis Team at Kaspersky. `Grabit is still active, and it's critically important to check your network to ensure you're protected.`

The infection starts with an employee in a business organization receiving an email with an attachment that appears to be a Microsoft Office Word file. The user clicks to download it, and the spying program is delivered to the machine from a remote server that has been hacked by the actors to serve as a malware hub. The attackers control their victims using HawkEye keylogger, a commercial spying tool from HawkEyeProducts, and a configuration module containing a number of Remote Administration Tools (RATs).

`On the one hand, the Grabit threat actor does not go the extra mile to hide its activity: some malicious samples used the same hosting server, and even the same credentials, undermining its own security,` Kaspersky noted. `On the other hand, the attackers use strong mitigation techniques to keep their code hidden from analysts' eyes. As a result, Kaspersky Lab believes that behind the operation is an erratic group, with some more technical members that are focused on being untraceable more so than others.`

Expert analysis also suggested that whoever programmed the malware did not write all the code from scratch.

Read original article

Cell Provider Ditches Passwords

Japan`s largest mobile service provider, NTT DoCoMo, said it would replace passwords with biometric credentials on a number of its online services, in a step to move users closer to a password-free world.

Starting Wednesday, NTT DoCoMo customers with smartphones capable of handling biometric authentication will be able to access several online services using iris recognition or fingerprint authentication, the company said. The company offers four smartphones with biometric authentication, including the Galaxy S6 Edge SC-04G, Galaxy S6 SC-05G, Arrows NX F-04G and Aquos Zeta SH-03G. The Arrows NX F-04G has an iris scanner which can authenticate the user.

NTT DoCoMo will support biometric authentication based on protocols developed by the FIDO Alliance, a consortium of technology companies and financial services firms trying to strengthen authentication by creating protocols and standards which don`t rely on passwords. The protocols rely on the combination of hardware, software, and services, and are designed to be interoperable across different networks and devices.

`DoCoMo expects to become the world's first mobile operator to integrate online services with smartphones capable of FIDO-enabled multiple biometric authentication,` DoCoMo said in a statement.

NTT DoCoMo also joined the board of directors for the FIDO Alliance, which was formed July 2012 and publicly launched in February of 2013.

The mobile carrier has been working to integrate FIDO-compatible biometric authentication technologies in its smartphones since last year, Seiji Maruyama, managing director of products at NTT DoCoMo, said in a statement.

Services such as d book, d game, d music, d delivery, and Pet Insurance will use iris recognition or fingerprint authentication to give users access and to process payments. DoCoMo will enable its carrier billing system enabled by FIDO authentication. This is particularly significant because DoCoMo, as Japan`s largest mobile carrier, has 65 million subscribers.

The announcement benefits both users and app developers, Rajiv Dholakia, vice-president of products at Nok Nok Labs, told SecurityWeek. Users get simpler authentication, such as fingerprint and iris scanning, instead of having to remember secure passphrases or deal with the inconvenience of having to enter complex passwords on a mobile keyboard. Developers benefit because they just have to focus on a single interface when writing code to support different devices.

`Touch ID has shown that once consumers get comfortable with these modalities, then they expect to be able to use them across their different mobile applications,` Dholakia said.

Along with rolling out first federated identity system to integrate FIDO authentication and mobile services ecoysystem, DoCoMo plans to work with outside partners and third-party service providers to integrate FIDO-enabled technologies. For this initial announcement, the mobile carrier worked with Nok Nok Labs, Qualcomm, Samsung, Sharp, and Fujitsu.

`In this context you can think of NTT DOCOMO as a developer, just one with 65 million subscribers offering a broad range of services,` Dholakia said, noting, `The same benefits still apply.`

Dholakia called the announcement a `win for the whole ecosystem,` as DoCoMo`s adoption of the FIDO standard will encourage manufacturers who offer devices for the mobile carrier to support the integrate more FIDO-compatible authentication technologies on their hardware.

With more devices supporting the protocols, developers and online services will be more likely to write applications actually taking advantage of the technologies. The sheer size of DoCoMo`s user base will help with the momentum because there is a FIDO-enabled ecosystem already in place. There will be `a virtuous cycle,` Dholakia said.

Read original article

Rockwell Patches HMI Flaw

Rockwell Automation has released a patch to address a vulnerability in one of the company's human-machine interface (HMI) products that can be exploited by malicious actors to obtain user-defined passwords.

According to an advisory published by ICS-CERT on Wednesday, the security flaw affects RSView32, an integrated, component-based HMI solution designed for monitoring and controlling automation machines and processes. Researchers of the Russia-based security firm Ural Security System Center (USSC) have been credited for finding and reporting the vulnerability to Rockwell.

The usernames and passwords set by users for RSView32 are stored in a file. The problem is that the encryption algorithms used to protect these credentials are outdated, allowing attackers to gain access to the information by decrypting the file.

ICS-CERT has pointed out that the vulnerability cannot be exploited remotely and without user interaction.

`This exploit requires an attacker gaining local access to the specific file storing passwords local to the RSView32 product. This involves local or remote access, reverse-engineering, and some form of successful social-engineering,` ICS-CERT noted in its advisory.

The vulnerability, for which the CVE-2015-1010 identifier has been assigned, affects RSView32 version 7.60.00 (CPR9 SR4) and prior. Rockwell has released a patch to mitigate the risk associated with the flaw.

In addition to applying the patch, Rockwell advises customers to limit access to the product to authorized personnel, use Microsoft AppLocker or other whitelisting application to mitigate risks, and maintain layered physical and logical security. Security training for employees, downloading patches only from trusted sources, and establishing a staged patch management and product upgrade strategy are also recommended.

Rockwell advises customers to migrate from RSView32 to FactoryTalk View Site Edition (SE), an HMI product which, according to the company, provides unprecedented levels of control and information access.

Users who want to continue to use RSView32 should upgrade the operating system on which the product runs to a compatible version that is as current as possible and still supported by the developer. Since RSView32 is designed for Microsoft Windows environments, this piece of advice likely refers to upgrading from Windows XP, which is no longer supported by Microsoft.

Read original article

Beacon Health breach

Yet another large hacker attack has been revealed in the healthcare sector. But unlike three recent cyber-attacks, which targeted health insurers, this latest breach, which affected nearly a quarter-million individuals, involved a healthcare provider organization.

South Bend, Ind.-based Beacon Health System recently began notifying 220,000 patients that their protected health information was exposed as a result of phishing attacks on some employees that started in November 2013, leading to hackers accessing `email boxes` that contained patient data.

The Beacon Health incident is a reminder that healthcare organizations should step up staff training about phishing threats as well as consider adopting multi-factor authentication, shifting to encrypted email and avoiding the use of email to share PHI.

`Email - or at least any confidential email - going outside the organization`s local network should be encrypted. And increasingly, healthcare organizations are doing just that,` says security and privacy expert Kate Borten.

Unfortunately, in cases where phishing attacks fool employees into giving up their email logon credentials, encryption is moot, she says. `Although encryption is an essential protection when PHI is sent over public networks, and stored somewhere other than within IT control, it is only one of many, many security controls. There`s no silver bullet.`

At the University of Vermont Medical Center, which has seen an uptick in phishing scams in recent months, the organization has taken a number of steps to bolster security, including implementing two-factor authentication `for anything facing the Web, because that can pretty much render phishing attacks that are designed to steal credentials useless,` says CISO Heather Roszkowski.

The Latest Hacker Attack

On March 26, Beacon Health`s forensic team discovered the unauthorized access to the employees` email accounts while investigating a cyber-attack. On May 1, the team determined that the affected email accounts contained PHI. The last unauthorized access to any employee email account was on Jan. 26, the health system says.

`While there is no evidence that any sensitive information was actually viewed or removed from the email boxes, Beacon confirmed that patient information was located within certain email boxes,` Beacon Health says in a statement posted on its website. `The majority of accessible information related only to patient name, doctor`s name, internal patient ID number, and patient status (either active or inactive). The accessible information, which was different for different individuals, included: Social Security number, date of birth, driver`s license number, diagnosis, date of service, and treatment and other medical record information.`

The provider organization says it has reported the incident to the U.S. Department of Health and Human Services, various state regulators, and the FBI.

Hospital Patients Affected

A Beacon Health spokeswoman tells Information Security Media Group that the majority of those affected by the breach were patients of Memorial Hospital of South Bend or Elkhart General Hospital, which combined have more than 1,000 beds. The two facilities merged in 2012 to form the health system. Individuals who became patients of Beacon Health after Jan. 26 were not affected by the breach, she says.

The breach investigation is being conducted by the organization`s own forensics team, the spokeswoman says.

Affected individuals are being offered one year of identity and credit monitoring.

The news about similar hacker attacks earlier this year that targeted health insurers Anthem Inc. and Premera Blue Cross prompted Beacon`s forensics investigation team to `closely review` the organization`s systems after discovering it was the target of a cyber-attack, the Beacon spokeswoman says.

In the wake of the incident, the organization has been bolstering its security, including making employees better aware of `the sophisticated tactics that are used by attackers,` she says. That includes instructing employees to change passwords and warning staff to be careful about the websites and email attachments they click on.

Read original article

IRS Authentication Method

The method the Internal Revenue Service used to authenticate users, which failed to keep sophisticated hackers from breaching a taxpayer-facing system, has been widely criticized by cybersecurity experts.

The IRS used knowledge-based authentication, or KBA, to authenticate the identity of users who accessed its `Get Transcript` application, which the agency earlier this week revealed was breached, exposing the records of more than 100,000 taxpayers

Although the IRS has not identified who breached the system, several media outlets, citing anonymous sources, have reported that the hackers were likely part of a Russian criminal gang. The FBI is joining the IRS`s criminal division and the Treasury Department`s inspector general for tax administration in investigating the breach, according to news reports.

The IRS says it employed a dynamic version of KBA, which poses personal knowledge questions for users to answer in order to verify their identity. The answers to the questions are based on public and private information the IRS gathers, such as marketing data, credit reports and transaction history.

Circumventing Authentication

The IRS said the hackers obtained personally identifiable information about taxpayers from non-IRS sources that allowed them to accurately answer KBA questions, which gave them access to taxpayer accounts. The IRS did not identify which third-party sources the hackers used, although some cybersecurity experts surmise the PII might have come from information pilfered from other breaches.

`Knowledge-based authentication is a tired technology that has been compromised with the ubiquity of personal information available in social media,` Robert Siciliano, online safety expert with Intel Security, says in an interview with Information Security Media Group. `Any entity that`s solely relying on knowledge-based authentication is in the dark ages.`

In an audio report, Siciliano and Zebryx Consulting`s Scott Dueweke, formerly with Booz Allen Hamilton, discuss:

• How knowledge-based authentication, or KBA, works; and
• The security technologies the IRS could have employed to supplement KBA;

The report also describes the warnings the IRS had received from the American Institute of CPAs and National Institute of Standards and Technology regarding the weaknesses of KBA.

The IRS, in a statement, said it noticed last week unusual activity occurring on the Get Transcript application, suggesting that unauthorized individuals had access to some accounts on the transcript application. The tax agency said the breach started in February and continued until mid-May.

Read original article

Flame worm complex

The jury is out on whether `Flame` (also known as `Flamer` or `Skywiper`) is `the most lethal cyberweapon to date` as some have claimed, or just a highly complex and sophisticated piece of malware. But simply from looking at the volume of security vendors` blog posts dedicated to the malware since its discovery this week, it is clear that Flame is far from ordinary.

One thing we do know is that there is a lot that isn`t known yet. Because of both its size - when fully deployed, it is almost 20MB - and its complexity, researchers expect the full analysis to take several months at least.

What is known is that Flame is a modular piece of malware that has worm-like features, which allows it to spread on a local network. The use of modules is not unique to Flame: prevalent trojans such as ZeuS and SpyEye allow for the use of modules or plug-ins. However, whereas the latter kinds of malware are used to target the masses (stealing online banking details, sending spam), Flame`s capabilities, which include network-sniffing, taking screenshots and recording audio conversations, suggest it is being used for cyber-espionage purposes.

So far, a few hundred infections are known, with victims varying from individuals to state-related organisations. Most of the victims are located in the Middle East: of the few hundred known infections, Iran features most prominently as a location, followed by Israel and Sudan.

The complexity of the malware, the prevalence of infections in Iran, as well as a number of technical features (such as the use of the Lua scripting language), suggest similarities with Stuxnet and Duqu. However, there are many differences too: unlike Stuxnet it does not appear to target SCADAs and the number of infections is probably significantly larger than that of Duqu. It is currently unclear whether the malware uses any zero-day exploits.

It is possible that Flame was developed by the same group that developed Stuxnet and Duqu, though likely as a parallel project. Given the location of the infections and the fact that developing something like Flame would require huge resources, many believe the governments of one or more rich Western nations are behind the malware. However, as with Duqu and Stuxnet, noone has been able to prove such claims.

While it has been discovered only recently, it is believed that Flame has been around for some time, possibly going back as far as March 2010. Writing about the malware, F-Secure`s Mikko Hyppönen said that this is a case where the anti-virus industry has failed.

Virus Bulletin will continue to follow the developments around Flame and report about it on www.virusbtn.com and on our Twitter feed. While complacency is rarely a good idea when it comes to cybercrime, it is worth pointing out that the vast majority of users and organisations are unlikely to be affected by the malware.

Read original article

Escalating Cyberattacks

Electronic health records are prime targets because healthcare organizations lack the resources, processes, and technologies to protect them. And it`s only going to get worse.

Imagine a hostile nation-state with your psychiatric records. Or an organized crime ring with your child's medical file. Or a disgruntled employee with your medical insurance information.

It's scary but true. Cyber criminals—from unhappy employees to the most sophisticated hackers—are targeting healthcare data, findings from the Fifth Annual Benchmark Study on Privacy & Security of Healthcare Data indicate. And no healthcare organization, from an 18-bed county hospital in Illinois to healthcare insurer CareFirst to insurance giant Anthem, is immune to these attacks. Without fear or favor, these criminals want to hack into healthcare systems to seize your medical data either to make a profit or to expose the security vulnerabilities of the U.S. healthcare system.

For money-hungry criminals, healthcare records are a treasure trove of easily accessible information. According to the FBI, criminals are targeting the healthcare sector because individuals' personal information, credit information, and protected health information (PHI) are accessible in one place, which translates into a high return when monetized and sold.

`Credit cards can be say five dollars or more where PHI records can go from 20 say up to—we`ve even seen $60 or $70,` says Jim Trainor, second in command at the FBI's cyber security division.

The motivations are more complex for politically-minded criminals. The most recent Sony breach became a model of many of the new risks surrounding cyberattacks and the resulting data breaches: disruption of business operations; intellectual property theft; public embarrassment; damaged relationships with business partners, clients, and employees.

The recent Anthem breach reveals an additional threat. There was speculation that organized cybercriminals may hold healthcare records for ransom, demanding payment for not releasing the information online or to other criminal groups. And in healthcare breaches, where lives can literally be at stake, no provider can afford to ignore a threat of compromise to patient healthcare records.

The many faces of criminal attacks

Healthcare records are prime targets for criminals because they recognize that healthcare organizations lack the resources, processes, and technologies to prevent and detect attacks, and thus protect patient data. It's no surprise, then, that criminal attacks are up 125 percent since 2010, according to benchmark study data. For the first time, in fact, criminal attacks are now the number one root cause of data breaches, rather than user negligence/carelessness or system glitches.

The Ponemon study found that criminals are using a variety of methods to access healthcare records, from spear phishing to web-borne malware attacks to exploiting an existing software vulnerability. According to John Riggi, the FBI's Cyber Division Section Chief, criminals often use personal social media profiles to craft highly effective spear phishing attacks, a tactic that occurred in 88 percent of healthcare organizations in the Ponemon study as a means for gaining access. They then simply `phone home` while escalating privileges and building a network map. Once data is exfiltrated, they use the Dark Web to monetize the stolen information.

Riggi also said that cyber threats by both nation states and organized crime are growing, most typically from Eastern Europe, Russia, China, and Iran. As James Comey, director of the FBI, has said, `There are two kinds of big companies in the United States. There are those who`ve been hacked by the Chinese and those who don`t know they`ve been hacked by the Chinese.`

Despite these growing threats, half of all organizations have little or no confidence in their ability to detect all patient data loss or theft. In addition, only 40 percent of covered entities and 35 percent of business associates are concerned about cyber attackers.

This lack of concern is reflected in a lack of appropriate budget. CBS News referenced a 2014 survey of healthcare technology professionals, in which half of respondents spent three percent or less of their technology budgets on cybersecurity. The standard investment is 10 percent, experts say.

Tom Turner, executive vice president of sales and marketing at Bitsight Technologies, an organization that rates companies on cyber security, said he is `absolutely` worried about the security of his own health care records.

`Healthcare is absolutely performing at the bottom of the other industries,` Turner told CBS News. `If you`d like a letter grade for that, maybe a C or D.`

Highly motivated criminals are realizing and exploiting the political and financial value of healthcare data, putting patients' medical and financial health in jeopardy. Unless healthcare organizations become as adept at protecting patient data as criminals are at attacking it, we could experience a tsunami of healthcare data breaches and medical identity theft the likes of which we've never seen. This is just the tip of the iceberg.


Read original article

Linux based worm

A worm that targets cable and DSL modems, home routers, and other embedded computers is turning those devices into a proxy network for launching armies of fraudulent Instagram, Twitter, and Vine accounts as well as fake accounts on other social networks. The new worm can also hijack routers` DNS service to route requests to a malicious server, steal unencrypted social media cookies such as those used by Instagram, and then use those cookies to add `follows` to fraudulent accounts. This allows the worm to spread itself to embedded systems on the local network that use Linux-based operating systems.

The malware, dubbed `Linux/Moose` by Olivier Bilodeau and Thomas Dupuy of the security firm ESET Canada Research, exploits routers open to connections from the Internet via Telnet by performing brute-force login attempts using default or common administrative credentials. Once connected, the worm installs itself on the targeted device.

Moose spreads itself using a file named elan2—`élan` is the French word for moose, Bilodeau and Dupuy explained in their report. Once installed, the malware begins to watch traffic passing through the router for unencrypted cookies from Web browsers and mobile applications, which may be passed to unencrypted sites that leverage social network features:

The worm begins to scan both other Internet addresses within the same ISP network, other random IP addresses, and local network addresses for other vulnerable devices. Infected devices advertise themselves on port 10073; the worm attempts to connect to this port first before launching Telnet attacks, and it moves on if it gets a successful connection. The malware also attempts to use shell commands on the infected router to change DNS settings, replacing existing domain name servers with malicious ones that could route Web requests by the router`s users to lookalike sites—or sites laden with exploit malware.

The main purpose of Moose, however, appears to be to create a network of covert HTTP proxies that can be used by the worm`s command and control (C&C) servers to communicate with social networks. While this traffic is encrypted using HTTPS, the researchers were able to trace which sites the traffic was going to and establish a link between the traffic and fraudulent social media accounts. The proxy service is created on TCP port 2318 on the router`s Internet network interface, taking incoming Web requests from a whitelisted set of IP addresses and redirecting them as HTTPS requests to social media sites. The most heavily targeted social networks were Instagram (accounting for 47 percent of the traffic analyzed by ESET), then Twitter and Vine (49 percent).

Bilodeau and Dupuy were able to monitor the accounts accessed by an infected router through the proxy service, and they saw `more than 700 Instagram accounts accessed... over about a month.` They watched accounts get created through the tunnels and found that they were followed by about 40 accounts within a few hours. The accounts, in turn, were apparently used as paid `follows` for commercial accounts, including a wedding planner in Riyadh and a Brazilian site advertising paid Facebook followers.

While not intended to target Internet of Things devices specifically, Bilodeau and Dupuy found that Moose could infect a number of such devices, including medical ones. `Based on recent security research, we have evidence to state that even medical devices like the Hospira Drug Infusion Pump could be infected with Linux/Moose,` the pair wrote. While these infections were essentially just `collateral damage,` the worm could have an impact on the safe operation of these devices.

Because of the way that the worm communicates, the ESET researchers were unable to determine the number of devices that have been infected by Moose, which they say they first found late in July of 2014. But based on data obtained from the Internet Storm Center for activity on port 10073 (not a port commonly used by any application on the Internet), they found a rise in traffic that indicates fairly wide distribution of the worm. They have also observed changes made to the malware by C&C servers that allowed the operators of the worm to throttle the amount of scanning done by infected systems—making their operations less noticeable in network traffic.

Fortunately, Linux/Moose apparently has no persistence on a router or other embedded computing device. Once the router is powered off, it restarts without the worm present. But if left poorly configured, routers that are reset could quickly be re-infected by other routers or devices on the local network that have been compromised.

Read original article

IRS Hack Update

In an official statement issued today, the IRS announced that it has shut down an online service to obtain tax records after determining that `unusual activity had taken place on the application, which indicates that unauthorized third parties had access to some accounts on the transcript application.` An initial review of that activity revealed `access was gained to more than 100,000 accounts through the Get Transcript application,` according to the IRS statement.

After the IRS disclosed more information, it became clear the user data was not obtained because of a direct hack of government systems. Rather, weak authentication used by the IRS to protect access to taxpayer data is likely at fault. The attackers were able to acquire taxpayer records using stolen personal identifying information, possibly pulled from online financial fraud marketplaces.

The Get Transcript application, a feature of the IRS` site that allows taxpayers to download tax return and tax payment transaction data, was apparently targeted by financial fraudsters between February and mid-May. The service was shut down last week as the IRS investigated the activity, which may have been linked to the fraudulent filing of tax returns and transfer of tax refunds. Attempts were made to access over 200,000 accounts; roughly half failed because of incorrect information inputted during the IRS` authentication process.

The Get Transcript Online feature of IRS.gov allows taxpayers to get `tax account transactions, line-by-line tax return information, or wage and income reported to us for a specific tax year.` To obtain a transcript online, all that was needed to start the process was a Social Security number and an active e-mail address. Once the e-mail address was confirmed as legitimate, the system would then ask a number of questions about personal, financial, and tax information—including date of birth, tax filing status, and address—before providing the transcript for download.

This sort of authentication, called knowledge-based authentication, is highly vulnerable to fraud. It`s based on information that never changes, and such data is widely available to anyone willing to pay for it from stolen financial information marketplaces. The transcripts that were fraudulently downloaded were likely made accessible due to leaked Social Security numbers and other personal data from any one of the many recent data breaches, including those at health insurers Anthem and CareFirst. In fact, security reporter Brian Krebs reported on the risks inherent in the IRS` transcript request system way back in March. He warned taxpayers to sign up for accounts on IRS.gov if only to prevent someone from creating a fraudulent account for their records first.

Krebs reported on a specific case involving a man who had tried to file taxes online, only to find out that someone had filed using his personal information before him. The attacker then used the victim`s information to get a refund direct deposit. `When he tried to get a transcript of the fraudulent return using the `Get Transcript` function on IRS.gov, he learned that someone had already registered through the IRS's site using his Social Security number and an unknown e-mail address,` Krebs reported. The fraudulent return had been filed through the IRS`s own free tax filing site.

In the case outlined by Krebs, the false return was sent to the bank account of a college student who had `answered a Craigslist ad for moneymaking opportunities.` She sent much of the money via Western Union to addresses in Nigeria while retaining some for her services. The student claimed she was unaware of anything illegal.

Today`s disclosed data breach did not involve the circumvention of any of the IRS` core security systems, an IRS spokesperson noted in the agency`s statement.. `The IRS notes this issue does not involve its main computer system that handles tax filing submission; that system remains secure.`

However, that information may be of little comfort to the approximately 100,000 taxpayers whose data is now in the hands of the financial fraud marketplace. The same goes for the other 100,000 or so individuals whose SSNs were used in an attempt to access their tax records. The IRS will be `sending a letter to all of the approximately 200,000 taxpayers whose accounts had attempted unauthorized accesses, notifying them that third parties appear to have had access to taxpayer Social Security numbers and additional personal financial information from a non-IRS source before attempting to access the IRS transcript application,` the agency said in its statement.

Those whose records were accessed will be offered free credit monitoring `to ensure this information isn't being used through other financial avenues,` the IRS statement noted. Additionally, the affected taxpayers` records will be monitored for fraud for the current and 2016 tax reporting periods. The IRS `is marking the underlying taxpayer accounts on our core processing system to flag for potential identity theft to protect taxpayers going forward—both right now and in 2016,` according to the official statement

Read original article

Text crashes iPhones

There`s yet another iOS bug that causes Apple devices to crash when they receive text messages containing a string of special characters. With further finessing, the same exploit may be able to attack Macs, since OS X is also unable to process the same combination of characters, which are technically known as glyphs.

According to people investigating the bug on reddit, the text causes iPhones running various versions of iOS to promptly crash. A flurry of Twitter users, angry that their devices fell victim to text messages, indicates that the bug is causing problems. Apple will almost certainly issue a fix. In the meantime, users can protect themselves against the nuisance text by going to system settings, navigating to Notifications>Messages>Show Previews, and turning it to off.

That change will prevent attacks that are currently circulating online, but it may not stop miscreants from finding new ways to crash people`s iDevices. According to the reddit thread, messages sent over WhatsApp may also trigger the crash. And depending on the way individual apps parse Unicode glyphs, other programs may do the same thing. The bug can also trip up OS X, although the attack requires a target to concatenate or paste a malicious file into the Mac terminal, according to a researcher who goes by the Twitter handle Hacker Fantastic.

Hacker Fantastic has tweeted a variety of other interesting technical details. The bug, he reported, resides in a part of the operating system that processes Unicode glyphs and causes a string to be written to a particular memory location. The bug is tied to the way banner notifications process Unicode, reddit reader sickestdancer98 reported. The banner is unable to display the text and eventually crashes the entire OS.

While the bug is rightfully regarded primarily as a nuisance, denial-of-service vulnerabilities can often be the result of serious flaws that, with more work, can be exploited to perform code-execution attacks. And even when more malicious exploits aren`t possible, DoS holes can sometimes present opportunities for extortionists or people looking to disrupt large events—for instance people at a conference. Expect Apple to release a patch in the coming week or so.

Read original article

Government PCs Exposed

In a move that throws the UK's government IT footprint wide open to hackers of all stripes, the Government Digital Service has decided not to extend its £5.5m deal with Microsoft for support for Windows XP.

When the contract runs out at the end of the month (as in, Sunday), `weaknesses that are found in unsupported products will remain unpatched and will be exploitable by relatively low-skilled attackers,` the office warned.

After more than six years of fair warning to enterprises, Microsoft cut off support for the discontinued XP operating system last April. Customers no longer receive new security updates, non-security hotfixes, free or paid assisted support options or online technical content updates. And crucially, any new vulnerabilities discovered in Windows XP will never be addressed by security updates from Microsoft, opening the door to zero-day vulnerabilities that last forever.

Obviously, in the case of the UK, the dangers are considerable: NHS patient data, police investigation data, state secrets and other sensitive information can be exposed via Trojans and spyware, among other dangers.

Many companies have completed the long process of transitioning to modern operating systems like Windows 7 or 8, but there are many that have not—even now, more than a year later, 44% of firms are still running at least some PCs on XP. Now, the UK government's PCs will join those millions of non-updated PCs at risk.

The Crown Commercial Service bought a year's extension of support, given the impact on national security and possible chaos that could arise otherwise. The idea was to complete a wholesale upgrade of thousands of PCs across the UK's government IT footprint during that 12 months—but it's a project that never happened. Some departments, like HM Revenue and Customs, have begun the process but are behind schedule in a migration to Windows 7 and 8.1; others haven't started, like NHS Scotland, which has about 2,600 computers still running XP.

The Office of the Chief Technology Officer confirmed to the Guardian, `Technology leaders met last month and took a collective decision to not extend the support arrangement for 2015. The current support agreement ended in April 2015.`

It's a move meant to light a fire under IT staff. But the paper went on to report that instead of migrating immediately, each department is expected to negotiate its own support deal with Microsoft as a stop-gap measure—which will be more expensive, ultimately, than the previous omnibus agreement. The Crown Commercial Service said that it saved the government about £20 million last year by buying in bulk.

`It is vital that all organisations only use software products which are supported by the vendor, and that plans be made to migrate from older products as the end of support period is reached,` the UK's CTO guidance advises—not that the directive has been thus far committed to.

The situation is likely to get worse before it gets better: In July, Microsoft is discontinuing support for Windows Server 2003, which will put around 2.7 million servers at risk.

Read original article

UK Identity Fraud up

Identity fraud grew by 5% from 2013 to 2014 as criminals eschewed account takeover scams in favour of creating new accounts in the name of their victims, according to Cifas.

The not-for-profit fraud prevention service claimed in its annual Fraudscape report that identity fraud accounts for the largest chunk of overall fraud (41%), with almost 114,000 separate cases recorded last year.

It added that in the first quarter of 2015, as much as four-fifths of of identity fraud incidents were perpetrated online.

There was some good news in that `enhanced security procedures` had led to an impressive 38% reduction in so-called `facility takeover fraud` – where criminals typically takeover or hijack an existing bank or store account without the owner's knowledge.

However, account creation fraud, where the scammers use stolen identities to open new accounts in the victim's name, continued to be popular. Some 41% of identity fraud was comprised of criminals opening up new credit card accounts while 27% related to new bank account openings, the report found.

To stem further rises in fraud over the coming year, Cifas called on the government to work with industry to create a `national measure` of fraud levels, claiming its members cannot provide the whole picture across the UK.

There also needs to be more research undertaken into the exact point at which identities are compromised and into the involvement of organized crime, the report argued.

Finally, we need a national education and awareness raising campaign, and comprehensive review of sentencing for related crimes, Cifas said.

The body also claimed that cross-sector prevention efforts are bearing fruit – stating that £1 billion was saved thanks to the Cifas National Fraud Database in 2014, and that 63% of fraud detected last year was done so by matching data across industries.

Tony Larks, director of research at fraud prevention firm ThreatMetrix, argued that the picture of UK identity fraud observed by Cifas is just the tip of the iceberg.

`The number high-risk fraud events is even higher than the Cifas figures as they are based on people reporting fraud, while our data shows actual attempts of fraud that were stopped,` he told Infosecurity. `Companies need to put in place technologies that can identify whether people visiting their sites are good or malicious.`

The ThreatMetrix Cybercrime Report for the past two quarters revealed that 11.4 million fraud incidents were spotted by its filters in the run up to Christmas alone, with scammers increasingly using VPNs and proxy servers to trick prevention tools.

The report did chime with Cifas figures on account creation fraud, however, branding it the highest risk type – more so than account log-in or payment fraud.

Richard Parris, CEO of security firm Intercede, argued that the rise in identity theft could be seen as a result of users being forced to continue with `outdated` password-based authentication.

`This already porous level of security is then made even less effective by the continued use of basic password combinations, which are then used for multiple logins,` he added.

`The fact is that multiple complex passwords are difficult to remember and so inherently insecure. Instead it's time companies took responsibility for the security of their consumers and governments took responsibility for the security of their citizens.`

Read original article

IRS Hacked

Using personal information gained from third-party sources to circumvent authentication protections, hackers breached more than 100,000 accounts of taxpayers who had used the Internal Revenue Service`s `Get Transcript` application, which has been temporarily shuttered.

The Get Transcript service allows taxpayers to review their tax account transactions, line-by-line tax return information or wage and income reported to the IRS for a specific tax year. `The IRS is continuing to conduct further reviews on those instances where the transcript application was accessed, including how many of these households filed taxes in 2015,` the IRS said in a May 26 statement. `It`s possible that some of these transcript accesses were made with an eye toward using them for identity theft for next year`s tax season. `

The IRS branded the hack as a sophisticated effort. `Third parties succeeded in clearing a multi-step authentication process that required prior personal knowledge about the taxpayer, including Social Security information, date of birth, tax filing status and street address before accessing IRS systems,` the IRS said. `The multi-layer process also requires an additional step, where applicants must correctly answer several personal identity verification questions that typically are only known by the taxpayer.`

IRS Commissioner John Koskinen, at a press conference, said several years of taxpayers` returns and tax information were exposed. `We`re confident these are not amateurs, these actually are organized crime syndicates that not only we but everyone in the financial industry are dealing with,` he said.

Breach Didn`t Affect Core Systems

The IRS said the breach did not involve its core computer system that processes tax filings.

Tax agency officials did not specifically identify the third-party sources where the PII originally was stolen, although it characterized them as `questionable email domains.` But several experts suggested that the hackers could have acquired the initial PII from other breaches. `We live in a world where the Internet has become a database of `you` and where one data breach can easily feed another,` says Ken Westin, senior security analyst for the IT security firm Tripwire. `The information that was used to bypass the security screen ... are all components of data that have recently been compromised in health insurance data breaches.`

The IRS said it spotted last week unusual activity occurring on the Get Transcript application, suggesting that unauthorized individuals had access to some accounts on the transcript application. The tax agency said the breach started in February and continued until mid-May.

Attempts Made to Hack 200,000 Accounts

Following an initial review, IRS investigators surmised that hackers attempted to access 200,000 taxpayer accounts through the Get Transcript application and gained access to more than 100,000 accounts. During the tax filing season, the IRS said taxpayers successfully and safely downloaded about 23 million transcripts.

The IRS is offering free credit monitoring services are being offered to the 100,000 taxpayers whose accounts were breached. `The IRS is marking the underlying taxpayer accounts on our core processing system to flag for potential identity theft to protect taxpayers going forward - both right now and in 2016,` the IRS said.

The breach is being investigated by the Treasury Inspector General for Tax Administration and IRS offices, including Criminal Investigation.

`Treasury Trove` of PII

`That the IRS - home to highly sensitive information on every single American and every single company doing business here at home - was vulnerable to this attack is simply unacceptable,` says Senate Finance Committee Chairman Orrin Hatch, R-Utah. `What`s more, this agency has been repeatedly warned by top government watchdogs that its data security systems are inadequate against the growing threat of international hackers and data thieves.`

As recently as March, the Government Accountability Office issued an audit showing that IRS taxpayer and financial data remain unnecessarily vulnerable to inappropriate and undetected use, modification and disclosure, although the report made no reference to the Get Transcript application

Read original article

Iris Scans

Imagine if you could be identified with certainty from 40 feet away by anyone with a special camera and your iris scan in a database. Carnegie Mellon researchers at the Cylab Biometrics Center have invented a device that can do that. It should definitely have criminals feeling nervous, but maybe we should all be nervous.

First the good news. According to SRI International, a spinoff of Stanford Research Institute, iris scans are 1,000 times more accurate than fingerprint scans. We`re already using handheld iris scanners in high security situations. The new Carnegie Mellon device will work up to 40 feet away, even in a mirror, so, for example, a police officer making a traffic stop can safely identify a potentially dangerous suspect before he even exits his vehicle.

The whole system works with fewer false positives than fingerprints, and is effective at the same general range as facial recognition (facial recognition famously failed during the Boston bombings because no pictures were close enough).

Here`s the bad news. At 40 feet away, the government could now (or soon, because this version looks like it needs some focus time and for you to sit still a bit) scan crowds of people for `irises of interest` and literally troll a city street for `the bad guys.` Even the most security-minded person probably feels a little strange about that, especially when you consider that irises can be scanned passively.

For now, this isn`t a major threat. Because if your iris has never been scanned, no one can identify you. The FBI has at least 104 million fingerprints in its database -- 70 million of which are from criminals. It has no known iris database, though it has experimented with the idea.

What if you scanned a city street daily? You may not be able to identify who all the irises belong to, but you could say, `The same iris, which we now call Iris 543-X, walks by here at roughly the same time every day.` The assumption, then, is that Iris 543-X belongs to someone who lives or works in the area. As thousands of irises are scanned and stored, eventually a giant database could be created to track the movements of every iris that walks in front of a camera. Eventually, you`re going to identify Iris 543-X, especially if Iris 543-X can be cross-matched to facial recognition software or other forensic databases.

Pretty soon, with a handful of cameras in the right areas, the numer of irises captured and stored could easily surpass the 140 fingerprints in the FBI`s database. Sounds scarier now, right?

Now, imagine using it in retail to track shoppers to offer them `deals,` or in education to track students in the name of security. The opportunities are endless, as are the chances to violate someone`s privacy and civil liberties.

This is a perfect example of a technology which can save lives if used sparingly, and cost us great freedom if used too much. Who makes the decision how much to use it? Not us.

Read original article

Google Play hosts malicious apps

Malware is still a worry on the Google Play store, even though the rate of malware is dropping to its lowest levels since the inception of the store in 2008.

One of the easiest ways to push malicious apps is by masquerading them under popular names, in this case Minecraft. Guides, tutorials, tricks and other apps would offer help, but quickly turn into a user's worst nightmare with malware and adware spam.

Over 30 apps have been spotted using the Minecraft name, but instead of adding Minecraft content the creators would try and trick users into thinking they had malware issues. The user would be directed to sign up for `premium SMS anti-virus updates`, costing £4 per week.

The 33 apps were scanned and had between 660,000 and 2,800,000 downloads. Some of the apps received over 500,000 downloads alone, showing the severity of the malware issue when it comes to app masquerading.

Most of these apps didn't start out this way, originally offering low quality information to Minecraft fans in an attempt to bait them in. Once downloaded, the app would ask to be updated, and then add the anti-virus malware.

If the user is confident the app is legitimate, he/she is more likely to subscribe to the SMS anti-virus updates. It is not clear how many users actually paid for the premium service, although we wouldn't be surprised to see less than 10,000.

Google has fought back on claims Android is still a cesspit for malware and bugs, claiming its automated service Bouncer removes most of the malware, and its own human checking makes sure all other malicious content is removed.

The issue is updates, Google does not monitor app updates with the same scrutiny Apple's iOS team does, meaning some malicious content can slip through the cracks from time to time.

Read original article

Nitlove POS Malware

Security researchers are warning of new macro-based POS malware designed to steal card data from Windows Point of Sale systems.

FireEye threat researchers Nart Villeneuve and Daniel Regalado explained in a blog post that the Nitlove POS malware is unusually disseminated via an indiscriminate spam campaign.

The unsolicited emails from spoofed Yahoo Mail accounts reference job opportunities and contain a 'CV' as an attachment.

That attachment actually contains an embedded malicious macro, which the attackers try to trick recipients into enabling by claiming it's a protected document.

If enabled, the macro will download and execute a malicious executable from a server containing a wide variety of malware.

`We focused on the 'pos.exe' malware and suspected that it maybe targeted Point of Sale machines,` the blog noted. `We speculate that once the attackers have identified a potentially interesting host form among their victims, they can then instruct the victim to download the POS malware.`

The malware apparently copies itself to disk using NTFS Alternate Data Streams (ADS) – which means the files won't be immediately visible. It will also monitor and `respawn` if there are any attempts to delete it.

Nitlove POS is designed to scrape track one and track two card data, save it and send it out to a hard-coded C&C server located in the Russian city of St Petersburg. It's sent via SSL, which makes it harder to track, according to FireEye.

The firm said this latest discovery is yet another example of the ever evolving nature of POS malware:

`Even cybercriminals engaged in indiscriminate spam operations have POS malware available and can deploy it to a subset of their victims. Due to the widespread use of POS malware, they are eventually discovered and detection increases. However, this is followed by the development of new POS with very similar functionality. Despite the similarity, the detection levels for new variants are initially quite low. This gives the cybercriminals a window of opportunity to exploit the use of a new variant.`

Attacks involving POS malware have exploded over the past year as cybercriminals look to take advantage of security weaknesses in mainly US-based retail and hospitality environments.

It is hoped that with the coming chip and PIN implementations, this avenue for data theft will largely be shut down for attackers.

Read original article

Bluetooth IoT Warning

Security researchers are warning that privacy issues in the Bluetooth Low Energy (BLE) protocol could make users' smart devices easily trackable from potentially long distances.

Context Information Security announced the findings of new research in a post at the end of last week.

In just half an hour hanging around Canary Wharf Underground station, the team used a specially built proof-of-concept Android app to spot 149 devices, including 26 FitBits, two Jawbones, two Nike products and `a lot of iPhones.`

The problem lies with the fact that although most BLE-supporting smart devices have a 'random' MAC address, that address is often fixed, making it easy to identify and track.

BLE was designed for apps which need to constantly beam out signals without running the battery down, with said packets sometimes even containing the device or user's name, Context claimed.

This isn't just a privacy risk but could be used by attackers to help with social engineering as part of a targeted cyber attack, or even for a 'physical' crime if a criminal knew a victim's movements, the firm said.

What's more, although the range of these devices is around 100 meters, with a `high gain directional antenna` it was possible to detect Bluetooth packets at half a mile, the report claimed:

`If I have an easy way to scan for these devices, and can attribute a device to a particular person such as a celebrity, your CEO or the police officer leading an investigation against your company, then I can easily tell when they're nearby. Many of the available fitness trackers are waterproof and measure sleep, so there's no need to ever take them off.`

Context also raised concerns about the use of iBeacons – used by retailers, airline providers and other firms to beam out information via BLE in a constant stream to customers walking by who have a related app on their device.

However, the protocol could become far more intrusive if phone manufacturers begin to ship devices with selected iBeacon apps pre-installed. This means they could start spamming out location-based sales and marketing messages ad nauseam, the report claimed.

`Most of what we found is not a bad implementation or mistake, but is inherent to how BLE works. In their designs, the vendors have prioritised the ease of pairing. BLE devices need to broadcast their presence constantly so that they can be detected by the paired smartphone,` researcher Scott Lester told Infosecurity.

`That said, vendors could do more to anonymise devices, for example by not allowing the user to name the device, or by implementing some of the measures in the latest version of the protocol to obscure the device address.`

Read original article

UC Browser leaks

A visual summary of privacy and security issues presented by UC Browser. PC: Citizen Lab
A report has shown that a security and privacy flaw in a popular mobile web browser in India and China - Transmits users` personal and other information without encryption.

The report titled `A Chatty Squirrel: An Analysis of Privacy and Security Issues with UC Browser` has revealed that Chinese and English-language versions of UC Browser for Android, a mobile web browser which is owned by a China-based company Alibaba.com, allows any network operator or in-path actor on the network to get the user's personally identifiable information like location, search details and mobile subscriber and device ids.
The application is using symmetric AES/CBC encryption for sending device IDs,location data, Wi-Fi Mac Address, SSID and other information rather than encryption.
The key `autonavi_amaploc` used for the encryption is Hard-coded in the application. `The use of symmetric encryption with a hard-coded key means that anyone who knows the key can decrypt UC Browser (Chinese) traffic in transit. Moreover, key holders can also retroactively decrypt any historical data that they have collected or obtained.`
The report reads. Personal identifiers like IMEI, IMSI, android id, build serial number is being transferred to Umeng (a mobile analytics service) in an unecrypted form. The transmission of unencrypted search engine queries enables third parties to monitor searches. Sensitive personal information can be inferred from search results including health conditions like pregnancy, disease, mental and psychological conditions, marital relations, and medical information.
Third parties can use it to develop, use, and sell user profiles and by corporate or government agents to modify or prevent access to certain search results. `We informed our findings to Alibab on April 15, 2015 and we would publish this report on or after April 29, 2015.
The company responded on April 19, 2015, indicating that Alibaba security engineers were investigating the issue. We followed up on April 23, 2015 to reiterate our intention to publish this report on or after April 29, 2015`
The report added that on May 19, 2015 they tested version 10.4.1-576 of the Chinese language version of UC Browser, which was downloaded from the uc.cn website. However, the version does not appear to send location data insecurely to AMAP.

Read original article

New Tor client

With an aim to beat powerful intelligence: like NSA, researchers have developed Astoria, a new Tor client which is said to be capable of protecting user's privacy, even from such powerful intelligence agencies.

A cyber security researcher team from America and Israel come up with a new Tor client which is designed to make spying more difficult for the world`s most capable intelligence agencies.
 According to the research paper, people have used Tor, a popular anonymity system for users who wish to access the Internet anonymously or circumvent censorship, to prevent their activity from being tracked as Internet anonymity becoming difficult to establish. However, Tor is not as safe as it was supposed to be, from the powerful intelligence agencies.
As a result the researchers have developed Astoria, which particularly focuses on defeating autonomous systems that has set up to intrude into Tor's anonymity. `In our experiments, we find that 58% of all circuits created by Tor are vulnerable to attacks by timing correlation and colluding sibling ASes. We find that in some regions (notably, China) there exist a number of cases where it is not possible for Tor to construct a circuit that is safe from these correlation attacks,` said in the research paper. It added, `To mitigate the threat of such attacks, we build Astoria, an AS-aware Tor client. Astoria uses leverages recent developments in network measurement to perform pathprediction and intelligent relay selection.
 It not only reduces the number of vulnerable circuits to 5.8%, but also considers how circuits should be created when there are no safe possibilities. It performs load balancing across the Tor network, so as to not overload low capacity relays. Moreover, it provides reasonable performance even in its most secure configuration.`

Read original article

Dating Website Breach

This summary is not available. Please click here to view the post.

DDoS for hire

Think back to when you were a kid. No matter how well-adjusted and even-tempered you were (or weren't) there was at least one other kid you just could not stand. You hated his face, his hair, his teeth, the way he talked, the way he looked at you, and the way he just existed. Remember the way he'd eat his sandwiches? He ate his sandwiches like a jerk.

Chances are, though, that no matter how much you couldn't stand him, you didn't go marching over to throw a dozen eggs at his house. The chances of getting caught were too high. You'd get in trouble. Everyone would know you did it and your parents would be mortified. But what if there had been a machine you could have secretly put a dollar in from several blocks away, and it would have rolled up in front of that kid's house and started firing eggs? All that mess and damage, with none of your fingerprints on the eggshells. It would have been a strong consideration, right?

That business model all grown-up is how a group of people running services called Booters or Stressers are making a pretty sweet little profit offering DDoS attacks for hire.

DDoS and Booter Basics

DDoS is the acronym for a distributed denial of service attack, which is so named because it denies the use of a website and its services to legitimate users by suspending or disrupting the services of an internet-connected host. Booter services -- which is a term that can be used interchangeably with Stresser services -- offer DDoS attacks to anyone willing to pay for them.

With a Booter, users typically pay a fee and are given access to a user-friendly platform from which they can choose their target and get to DDoS-ing.

To give you an example of the cost-friendliness of this lovely service, one sample Booter charges $40 USD/month (£25) for an unlimited number of DDoS attacks lasting one hour.

What DDoS Can Do

The main area where the egg-firing machine analogy falls apart is in the potential damage. Even with a super-powerful egging machine, the worst possible damage is probably a broken window.

But a DDoS attack? One hour of a DDoS attack can cost an organization $40,000 (£25,000). That's not even mentioning the software or hardware damage that can be done, the IP theft, financial data theft, loss of revenue and loss of consumer trust that can happen.

In order to inflict damage, a would-be DDoS attacker with access to a Booter service doesn't even have to unleash the attack. DDoS ransom notes where someone demands a set amount of money in exchange for not hitting that website with a DDoS attack are becoming increasingly common.

Who Does That?

DDoS attacks are wildly common, and Booter services are popular enough that there are plenty of them online with their numbers always growing. That begs the question: who is it that's using these websites?

The answer is depressing because your website could potentially be made a target by just about anyone. Business rivals are an obvious choice, but when you factor in the chance to make fast money from a DDoS ransom note, your potential attacker net widens considerably. Kids who don't know who you are and have never visited your website before might be keying your url into a Booter.

While many Booter-for-hire users are unsurprisingly gamers who pay the Booter fee in order to DDoS Minecraft servers and similar websites, there have been some high profile attacks from the people behind these services.

The Lizard Squad, famous for its attacks on Sony Playstation Network and Microsoft's Xbox Live, claimed those major attacks were simply advertisements for their Booter service.

Could a Booter Get to Your Website?

DDoS attacks have been found to affect 45 per cent of organizations -- that's very nearly 1 in 2. And with Booter services and DDoS ransom notes gaining popularity, that number could very well rise.

If you're considering whether or not you should look into professional DDoS mitigation, and you haven't yet decided that you absolutely should, consider this: you could pay for months of DDoS protection with what you might end up paying in a single ransom.

It isn't nice to think that your website could fall victim to a DDoS attack. It's even worse to think that the attack might come from someone hiding behind a Booter.

While you ultimately may not have plugged a dollar into that egging machine due to your own principles, there are plenty of people out there who don't mind being cowardly in order to unleash a DDoS attack or make a quick buck on a ransom note. That's the reality your website is living in.

Read original article

Bettys Tea Rooms hacked

The Bettys Tea Rooms firm's website was hacked on Wednesday, affecting more than 120,000 customers.

In a statement released by the company, they apologized, and blamed `industry-wide software weakness` for the data breach.

The hackers gained access to the firm's website database, and stole the personal details of the customers which includes their names, email addresses, postal addresses, encrypted passwords and telephone numbers.

`We would like to stress that your credit or debit card details have not been copied as this information is stored on a completely separate system managed by a certified third party. Bettys takes customer confidentiality extremely seriously and, whilst customer passwords were encrypted, it is important that you change your password as soon as possible by clicking this link or entering www.bettys.co.uk into your browser,` Bettys said.

They also advised their customers to not to respond to any of the phone or email communication regarding their personal and financial information.

`To be clear, Bettys will never contact you and ask you to share any personal financial information,` the tea shop chain said.

Gang of old ladies named `Northern N00bz` is suspected to be behind the data breach. To take revenge for some disservice, they acquired some coding skills. A full investigation is going on.

Read original article

Student Data Breach

The personal information of 4,000 students who use the bus transportation system was put at risk by CPS, after they mistakenly sent out their personal information to five vendors who were seeking to do business with the district.
The 4,000 students who have been affected are a subset of 22,500 students who use the bus transportation system. After learning of the data breach, the authorities have quickly taken measures to avoid a problem and have written confirmations from all vendors that all the sensitive information has been successfully dispose off.
The affected students and parents have also ben notified of the breach. Also, the employees of CPS have been instructed in handling personal information of people in a more sensitive and private manner. The breach happened in March, when CPS accidentally gave the information to five vendors

Read original article

Hacker Attacks

The recently revealed breach of a database at CareFirst BlueCross BlueShield containing information on more than 1.1 million individuals is the latest evidence that hackers are targeting health insurers, and especially Blue Cross and Blue Shield organizations, for the vast amount of protected health information they hold. Security experts warn, however, that other types of organizations, including health information exchanges and large integrated delivery systems, as well as hospitals with electronic health records systems, could be the next targets.

Health insurers `are known to have very large databases of rich personal data that can be sold for identity theft purposes and fraud,` says privacy and security expert Kate Borten, founder of The Marblehead Group consultancy. `Midsize and large healthcare provider organizations should also be on high alert for the same reason.`

Baltimore-based CareFirst BlueCross BlueShield disclosed on May 20 that an `unauthorized intrusion` into a database dating back to June 2014 resulted in a breach affecting 1.1 million individuals. Other Blues plans that have recently reported cyber-attacks are Anthem Inc., which says its breach impacted 78.8 million individuals, and Premera Blue Cross, which says 11 million were affected by its hacking incident.

Other Targets

Katherine Keefe, who heads breach response at the cyber-insurance company Beazley plc, predicts that health information exchange organizations, due to the large volume of data they handle, as well as electronic health record systems at hospitals - which are often configured to provide easy access to harried clinicians in healthcare settings, could be the next targets for hackers.

`The goal of EHRs in a hospital setting is to help make clinical decision-making more efficient and effective, and provide access to clinicians who need this information quickly,` she says. Also, role-based access controls, advanced authentication, and encryption aren`t typically part of the equation for many of these systems, she says. `That technology is perceived to slow down access for clinicians, who`d rather err on the side of good clinical decisions,` rather than worry about data breaches, she adds.

M&A Risks?

One reason why health insurers have proven to be prime targets for hackers, Keefe says, is that many of these companies have grown rapidly through mergers and acquisition, with a patchwork of systems and security practices and `treasure troves` of data.

That`s also true for many large integrated healthcare delivery systems, she adds. `There`s been a lot of consolidation in the healthcare industry,` she notes. For instance, Community Health System, a provider organizations that last August revealed a hacker breach affecting 4.5 million individuals, has also grown in recent years through mergers and acquisitions, she says.

Meanwhile, some health insurers also boast about the tens of millions of enrollees they cover, which also catches the attention of cybercriminals, Keefe says. `It`s like saying, `come and get us`,` she says. Data security needs to be `more front and center` at many healthcare organizations, she stresses.

While Blue Cross and Blue Shield affiliates, such as Anthem and Premera Blue Cross, are independent companies, they are linked together through the Blue Card program, in which these plans process each other`s members` insurance claims, Keefe says.

`The Blue Cross Blue Shield network is simply so large that they are a `rich` environment filled with some of the most valuable data when it comes to identity theft,` says Brad Cyprus, chief of security and compliance at Netsurion, a provider of cloud-based services. `It is also possible that by being one of their affiliates, there is some common technology that has an issue that has not been identified or fixed.

Read original article

Hacking Trooper Cruisers

Working group of federal agencies and private industry launched by the state of Virginia is studying car vulnerabilities and building tools to detect and protect against vehicle hacking and tampering.

A new public-private working group in the Commonwealth of Virginia is testing how state trooper cruisers could be sabotaged via cyberattacks. Virginia Governor Terry McAuliffe this week announced the new initiative, which is aimed at protecting the state`s public safety agencies and citizens from hacks against vehicles.

The project team studying Virginia State Police vehicles includes the US Department of Homeland Security`s Science and Technology division, the US Department of Transportation`s Volpe Transportation Systems Center, the Virginia Department of Motor Vehicles, the University of Virginia, Mitre Corp., Mission Secure Inc. (MSi), Spectrum Comm, Kaprica Security, Digital Bond Labs, and OpenGarages.

Virginia of late has become a hotbed for car-hacking research, with the recently completed crash-test of prototype sensor-based technology initially created for protecting US military drones. The pilot simulated cyber attacks on cars to take control over the braking, acceleration, and collision avoidance features in the vehicles. Late last month, Virginia also became the first state to establish its own Information Sharing and Analysis Organization (ISAO) for cyberattack threat intelligence-sharing.

The state`s car-hacking project, which will run for 90 days, also aims to come up with low-cost technology that can help law enforcement identify if a vehicle or other `mechanized equipment` has been hit by a cyberattack when an accident or other incident occurs, and to find ways for consumers and public safety officials to detect and prevent such threats to vehicles and consumer devices; as well as to identify economic development opportunities in this field for the state.

The project is studying two models of Virginia State Police vehicles -- the 2013 Ford Taurus and 2012 Chevrolet Impala. The research is mostly focused on hacks that would require physical access to the vehicles, much like the initial car-hacking research by Charlie Miller and Chris Valasek, but will also include some remote attacks.

The concern is that criminal or terrorist groups, for example, could physically tamper with state police vehicles to hamper investigations or assist in criminal acts by messing with the car`s acceleration, or deploying airbags while the vehicle is driving at a high speed, for example, says David Drescher, president of MSi, a member of the project team. `What we`re going to be doing is carrying out … these attacks on a car to show that yes, you can cut off the engine via the CAN bus,` for example, Drescher says.

`The primary focus is on the attacks themselves, rather than how they are delivered. Our primary attack will be through the OBDII port,` with various tethered tools or a device that connects to the OBDII port and transmits via Bluetooth or WiFi, he says.

The researchers may also simulate a remote RF-based attack test as well, he says. But since the State Trooper vehicles being tested are older models and not as networking-equipped, the remote testing may be limited to things like Bluetooth and tire pressure-monitoring system attacks that other researchers have already revealed.

A researcher finds security holes in Flo the Progressive Girl`s car plug-in Snapshot insurance policy product. Read Security MIA In Car Insurance Dongle.

`The next phase is looking at protections, and then a cyber scorecard,` a sort of Consumer Reports-style scoring system for how cybersecurity-ready a vehicle really is, he says. That will draw from and build on a similar project by Volvo and others, he says.

Drescher says other states and localities are taking an interest in Virginia`s project. The project will conclude in July, with an assessment of the possible hacks of the vehicles and as well as a report on technologies for detecting a cyberattack on a vehicle. `Today we have no way to know if a car was` hacked, Drescher says. `We`re going to see if there`s a way to collect more data across the CAN bus` for forensics and detection purposes, he says.

The project also will build a database of car vulnerabilities that includes its findings as well as those from previous car-hacking research including that of the University of Washington, Miller and Valasek`s work, as well as research from OpenGarages and Digital Bond, and others.

State officials were quick to note that the car-hacking project is a preventative measure, and not a reaction to any imminent threats. `This initiative is not meant to alarm anyone,` said Virginia`s secretary of Public Safety and Homeland Security Brian Moran. `The threat of `car hacking` is rare, but recognizing that the technology already exists for such criminal and dangerous activities to occur is the first step towards protecting our Commonwealth and its citizens from future harm.`

Drescher says the concern is that as such attacks become automated or `industrialized,` tools will land in the market that simplify them such that a non-sophisticated attacker could execute them.

`High-tech systems now used in most automobiles are opening up potential new avenues for cyber attacks,` Gov. McAuliffe said. `Thanks to the continuing efforts of the Virginia Cyber Security Commission and Virginia Cyber Security Partnership, we have the opportunity to lead the nation in the establishment of safeguards protecting the vehicles of Virginia's 5.8 million licensed drivers.`

Read original article

Starbucks gift card Exploit

A security researcher said he found a way to game Starbucks gift cards to generate unlimited amounts of money on them. Both he and the coffee chain are grumbling after he used a fraudulent card to make a purchase, then repaid the amount and reported the vulnerability.

Egor Homakov of the Sakurity security consultancy found a weakness known as a race condition in the section of the Starbucks website responsible for checking balances and transferring money to gift cards. To test if an exploit would work in the real world, the researcher bought three $5 cards. After a fair amount of experimentation, he managed to transfer the $5 balance from card A to card B, not just once as one would expect, but twice. As a result, Homakov now had a total balance of $20, a net—and fraudulent—gain of $5.

The researcher went on to visit a downtown San Francisco Starbucks location to make sure his attack would actually work. He used the two cards to make a $16.70 cent purchase. He went on to deposit an additional $10 from his credit card `to make sure the US justice system will not put us in jail over $1.70,` he explained in a blog post. Here`s where hurt feelings—and arguably an overreaction on the part of both parties—entered into the story. Homakov wrote:


The hardest part - responsible disclosure. Support guy honestly answered there's absolutely no way to get in touch with technical department and he's sorry I feel this way. Emailing InformationSecurityServices@starbucks.com on March 23 was futile (and it only was answered on Apr 29). After trying really hard to find anyone who cares, I managed to get this bug fixed in like 10 days.

The unpleasant part is a guy from Starbucks calling me with nothing like `thanks` but mentioning `fraud` and `malicious actions` instead. Sweet!

In an e-mail, Homakov told Ars the Starbucks person who mentioned fraud and malicious actions wasn`t an attorney threatening any kind of legal action, but rather a member of the Starbucks infosec team. But it was a far cry from an earlier phone call, Homakov said, in which a Starbucks official promised to pay a $1,000 bug bounty reward.

`It was just completely uncalled for claiming that I committed fraud,` Homakov said of the latter call. `It made me angry.`

The versions of events as described by Homakov don`t reflect well on Starbucks, but they don`t reflect well on the researcher either. Yes, $1.70 is a small amount of money, and he attempted to credit it back to Starbucks even before he reported the vulnerability. But ultimately, Homakov did create a fraudulent balance on a gift card and he used it to make a real purchase. As a professional penetration tester, Homakov knows better than most people that hackers should never access someone else`s computer network or account without explicit permission.

Homakov and his many defenders on Twitter seem to reason that his admirable intentions behind the fraudulent purchase should serve as some sort of get-out-of-jail-free card for actions that were technically a crime. No doubt, Starbucks would have done better to simply thank Homakov for the free security audit. But Homakov seems to act as if he had some special ethical and legal right to make the fraudulent purchase, even though Starbucks had never asked for his security services.

Starbucks officials released the following statement:

Like all major retailers, Starbucks has safeguards in place to constantly monitor for fraudulent activity. After this individual reported he was able to commit fraudulent activity against Starbucks, we put safeguards in place to prevent replication.

While we aren't able to go into specifics about individual contacts, we have had strong success partnering with the research community and will continue to welcome engagements.

Read original article

Data breach at 3 hospitals

Three North Jersey hospitals alerted thousands of patients Thursday that a billing clerk had stolen their personal information, according to reports

The data breach at the Valley Hospital in Ridgewood, Englewood Hospital and Medical Center, and Holy Name Medical Center in Teaneck is being investigated by federal authorities, NorthJersey.com reports.

The size of the breach is unknown, according to the report, but says the clerk gave away patients` names, Social Security numbers and dates of birth.

The billing company has contracts with dozens of providers across the country, the report says.

Read original article

Have You Been Hacked

It`s every modern business`s worst nightmare: You discover there`s been a security breach, and your sensitive business and customer data has ended up in the hands of hackers.

While business owners may have some safeguards in place, the reality is that a data breach can happen to anyone at any time, especially small businesses. In fact, according tothe National Cyber Security Alliance (NCSA), 71 percent of security breaches target small businesses, and nearly half of all small businesses have been victims of cyberattacks. And unlike larger corporations, smaller companies don`t always have the resources to recover: Experian reported that 60 percent of small businesses that suffer a breach go out of business after six months.

It`s likely not possible to regain control of everything the hackers accessed, but you can still take action and salvage your trust and reputation with your customers and clients. Legal and technology experts shared their insights on how to best recover from a small business data breach.

Identifying a data breach

You can`t start recovering from a breach unless you know it`s occurred. That`s why it`s critical to learn how to identify when something has gone wrong. The problem, of course, is that in many cases, there aren`t any telltale signs you`ve been hacked.

`Often, businesses discover that they have been breached for the first time months after it happened, when they are informed by law enforcement, business partners, banks or the media — who themselves discover the businesses` data being sold on the black market,` said David Zetoony, a partner with the international law firm Bryan Cave LLP. `Other businesses may have been breached months, or even years, ago and still do not know.`

There are, however, a few things that may tip you off to a security problem. Francoise Gilbert, founder of IT Law Group, said that slow or lagging computer response time, pop-up windows that you can`t close, client reports of spammy emails from your account, or strange programs or websites asking for your credentials could all be signs of a data breach. If malware or a virus is discovered on your system, you`ll also want to investigate to see if any data was compromised.

Justin Bingham, chief technology officer for digital business solutions firm Janeiro Digital, warned companies that any noticeable issues are signs of a low-quality breach.

`If you`ve been compromised by someone that knows what they`re doing, those signs are going to be few and far between, unless you have a sophisticated team and tools,` Bingham said. `The best way to determine if you`ve been comprised is not to look for the attack, but what is done after it, when the hacker establishes residency within the network.`

What to do when a breach occurs

Recovering compromised information from a hacker is impossible in most cases, Zetoony said. By the time you discover a breach, the hacker has already stolen or misused the information, and has often wiped his or her trail, he said. Therefore, your first priority after discovering a breach should be to piece together what happened, how bad the breach was and which customers might have been impacted, Zetoony said.

`Companies typically call their attorney and have him or her retain a forensic investigator who specializes in finding, preserving and analyzing electronic equipment and data,` Zetoony told Business News Daily. `Lawyers that specialize in data security breaches typically advise companies concerning any legal obligation that they have to notify consumers, the public, insurance carriers or regulators.`

In terms of equipment, Gilbert advised organizations to stop using the server, computer or device where the breach occurred. This will preserve evidence, so the forensic team can look into the cause of the problem.

`If the computer is not performing a vital function, disconnect it physically from its network and the Internet immediately,` she said. `Copy and securely store the access and activity logs from the affected machine, and then attempt to identify the type, nature and categories of information that has been affected — company trade secrets, customer lists, payment and delivery information, etc.`

Informing affected parties

Once you`ve assessed the initial damage and potential cause, your next order of business is to break the news to your business partners, vendors, customers or any other affected stakeholders. Nicholas Gaffney, a lawyer and founder of legal media relations firm Zumado, said it`s important to have a response team in place that will work quickly to preserve and enhance the reputation of your organization after a data breach. This means having a team member assigned as the point person for official responses to inquiries about the breach, and being transparent and consistent in all communications about it.

If possible, your company — rather than an outside party, such as the media — should break the news of the breach. Gaffney said this will demonstrate the organization`s concern for the affected parties.

`Create a statement about the breach, and communicate it through the appropriate channels,` Gaffney said. `Commit to keeping all affected parties informed of developments related to the breach, following appropriate legal guidelines. Accept responsibility for the inconvenience caused, apologize, and make it clear that you will do all you can to help victims deal with the consequences of the breach.`

`Provide information promptly, even if incomplete,` Gilbert added. `You want the affected party to learn about the incident from you, and in your own words. Don`t be vague, or if you have to be, explain why — because you are still investigating the incident and do not have all the details.`

To that end, Zetoony said that any information you provide about the incident must be accurate and verified. As Gilbert noted, this may mean telling stakeholders that you don`t have any information for them, and providing updates only when you are sure of the facts yourself.

`Although waiting can be difficult, providing them with speculation, or information that may turn out later to be false, only hurts trust and reputation further,` Zetoony said.

Preventing future breaches

It`s a long road to recovery after your company has suffered a data breach, but once you`ve gotten the situation under control, you can learn from it and work to prevent another incident from occurring. Bingham said there`s a laundry list of best practices that should be employed, from perimeter network security to secure access mechanisms and route audits, but there is no `silver bullet` solution.

`Establishing security for a given organization requires constant vigilance and attention by trained and dedicated people equipped with the right tools employing industry best practices,` he said.

Gilbert agreed that a highly trained and vigilant staff is the key to minimizing the risk and damages of future breaches. Your employees should take extra care when using company equipment and learn to recognize clues that could indicate compromised information. Additionally, she recommended conducting a periodic `sweep` of all personnel`s equipment to catch any malware and security holes.

Most importantly, Zetoony reminded businesses that, given enough time, a data security incident is as inevitable as any other type of crime — but learning from it will help you handle it better going forward.

`If you view each breach as a learning exercise, you won`t be able to stop them necessarily,` Zetoony said. `But you can learn how to respond to them more efficiently, quickly, and with less impact to your business and your customers.`

Read original article