California bank breach

An employee with California-based Bank of Manhattan Mortgage Lending handled mortgage loan files stored on a removable disk drive in a manner contrary to the bank`s policies and instructions, possibly leading to the unauthorized disclosure or use of customer information in the files.

How many victims? Undisclosed.

What type of personal information? Names, addresses, loan numbers, phone numbers, Social Security numbers, birth dates, credit information, tax information and other financial information.

What happened? An employee handled mortgage loan files stored on a removable disk drive in a manner contrary to the bank`s policies and instructions.

What was the response? Bank of Manhattan conducted an investigation and recovered the disk drive. All potentially impacted customers are being notified, and offered a free year of credit monitoring and identity theft protection services.

Details: The files included a loan that was originated at Bank of Manhattan, or was owned by Bank of Manhattan at one point.

Quote: `We are not aware of any fraudulent or improper use of your information,` a notification letter said. `Please be assured that we have taken every step necessary to address the incident to date, and that we will continue to investigate and take any additional steps that may be required.`

Read original article

Flash Flaw Found

Cyber-criminals have added a recently patched Flash Player zero-day vulnerability to the notorious Magnitude exploit kit, significantly raising the risk of users being targeted with attacks making use of the flaw.

Independent malware researcher 'Kafeine' revealed the news in a blog post over the weekend, claiming that the vulnerability was being exploited to drop the infamous CryptoWall ransomware onto victim machines.

CVE-2015-3113, a flaw in the way Flash Player parses Flash video files, was patched by Adobe last week in an out-of-band security update after researchers spotted it being exploited in the wild in targeted attacks.

FireEye claimed that it was being used in a large scale phishing campaign aimed at high tech, telecoms, transportation, construction, and aerospace and defense firms.

The security vendor has attributed the attacks to Chinese group APT3, which it says has a history of introducing new browser-based exploits against commonly targeted software including Flash and Internet Explorer.

The group came to prominence in April last year when FireEye revealed its existence in the Operation Clandestine Fox report, which details a sophisticated targeted attack group capable of evolving its tools and techniques to evade detection.

Similarly, those behind the Magnitude exploit kit are forever enhancing it with new features and functionality. Just a week ago, they added another patched Adobe Flash vulnerability, CVE-2015-03105, to drop CryptoWall 3.0 onto victims' machines.

According to a report from Trustwave last year, Magnitude had 31% of the exploit kit market and was poised to overtake Blackhole as the leading EK on the underground market.

It claimed that the kit generates a weekly income of $60,000 and has already affected hundreds of thousands of users in over 50 countries worldwide.

The news should be a reminder to individual users and sysadmins to keep up-to-date with the latest patches for operating systems and key software like Internet Explorer and Adobe Flash.

Nearly 6% of programs on the average UK computer have already reached end-of-life and are no longer supported – led by Adobe Flash Player 16.x, which is still installed on 81% of machines, according to the latest Secunia PSI Country Report.

Read original article

China Wants Your Data

Since May 2014, the Chinese government has been amassing a `Facebook for human intelligence.` Here`s what it`s doing with the info.

Leading into 2015, the cybersecurity community was still reeling from the impact of a destructive attack unlike any other we have seen in terms of visibility, scale, and impact. Already halfway into 2015, there is no shortage of breaches. We have already witnessed major compromises in healthcare, the US government, the Bundestag, and media being attacked by sophisticated adversaries, in most cases, roaming freely on networks for months at a time.

Attackers from China, Russia, North Korea, ISIS, and even potentially friendly governments have dominated the headlines. In case you have your head in the sand, this is not going away anytime soon. Compared to traditional espionage, `cyber espionage,` or CNE as the military likes to designate it, has a lower cost of entry, less risk if you are caught or compromised, and can often yield equivalent intelligence to feed an ever-growing set of interested consumers. For criminals, the use of e-commerce systems and vulnerable payment mechanisms provides an avenue for rapid monetization and prosperity. Activists or hacktivists as they present themselves on the Internet are able to use electronic mediums to disseminate messaging from banal greets to truly meaningful causes that impact people`s lives across the globe.

Since May of 2014, the Chinese government has been amassing what can only be described as the `Facebook for human intelligence targeting` from the databases lifted from some of our most fundamental and essential systems. Why would anyone want healthcare records? If you take a step back, these records are part of a bigger picture, used in concert with the personnel records of US government workers and any other databases that have been stolen over the years. The beneficiary of that data can build an interesting picture detailing the confidential history, preferences, behavioral patterns, and more, of millions of potential intelligence targets.

The point that most people miss is that `cyber` data doesn`t just get used for cyber attacks, or cyber bullying, or cyber theft. The People`s Republic of China doesn`t only conduct network-based espionage, they are a major government on the world stage. They have human intelligence collectors whose job is to identify people with access to interesting or useful information and to collect that information. MICE is a common acronym we use in the information security industry -- Money, Ideology, Compromise, and Ego - a simple set of motivations that can be used to entice or coerce a target to provide continued or temporary access to data.

Using stolen healthcare data, these human collectors can identify someone with access to sensitive information who unfortunately has a sick relative. As the healthcare bills pile up and they become increasingly despondent to help their sick relative get the medical treatment they need, an opening begins to emerge. The human collector, if they are able to identify this opening, can approach the target and begin to sow the seed for access, a simple trade of money for information, information that may seem insignificant to the target, but in aggregate across many different sources becomes quite valuable.

Learn more from Adam about how to consume, operationalize and integrate threat intel during his training session on the fundamentals of intelligence-driven security, Black Hat 2015 Las Vegas August 1-2 & 3-4.

It has been said that the network defender must be right 100 percent of the time, while the attacker need only be lucky once. The asymmetry of this is terrifying! Your network defenders should be in front of 10 monitors with an intravenous drip of caffeine and sugar twitching at every packet surging across your enterprise. The reality is that this is true, but we have systems and tools to help deter and detect these attackers.

These tools out of the box, while capable, don`t necessarily have all the smarts they need to root out these attackers: these tools need intelligence. Intelligence-driven security means learning from previous attacks whether successful or not, and incorporating what you have learned into your defense posture. The military, in dealing with asymmetry encountered in Latin America in the 1980`s pioneered a process for incorporating intelligence into their targeting processes that has been continuously improved upon in the past 10 years.

This process involves taking the intelligence gleaned from every action, operation, or encounter and feeding it into the next operation to rapidly adapt to the changing environment. This same process introduced into security operations, what I call intelligence-driven security, can drive the cost of protecting the enterprise down, while simultaneously allowing the Security Operations Center (SOC) to have meaningful conversations with the business owners, the C-Suite, and the Board. Enterprise security isn`t just about blocking malware anymore, it`s about protecting the business and against dedicated and sophisticated threat actors.

Read original article

Website Error Leads to Breach

An error in a coding upgrade for a Blue Shield of California website resulted in a breach affecting 843 individuals. The incident is a reminder to all organizations about the importance of sound systems development life cycle practices

In a notification letter being mailed by Blue Shield of California to affected members, the insurer says the breach involved a secure website that group health benefit plan adminstrators and brokers use to manage information about their own plans` members. `As the unintended result of a computer code update Blue Shield made to the website on May 9,` the letter states, three users who logged into their own website accounts simultaneously were able to view member information associated with the other users` accounts. The problem was reported to Blue Shield`s privacy office on May 18.

Blue Shield of California tells Information Security Media Group that the site affected was the company`s Blue Shield Employer Portal. `This issue did not impact Blue Shield`s public/member website,` the company says. When the issue was discovered, the website was promptly taken offline to identify and fix the problem, according to the insurer.

`The website was returned to service on May 19, 2015,` according to the notification letter. The insurer is offering all impacted individuals free credit monitoring and identity theft resolution services for one year.

Exposed information included names, Social Security numbers, Blue Shield identification numbers, dates of birth and home addresses. `None of your financial information was made available as a result of this incident,` the notification letter says. `The users who had unauthorized access to PHI as a result of this incident have confirmed that they did not retain copies, they did not use or further disclose your PHI, and that they have deleted, returned to Blue Shield, and/or securely destroyed all records of the PHI they accessed without authorization.`

The Blue Shield of California notification letter also notes that the company`s investigation revealed that the breach `was the result of human error on the part of Blue Shield staff members, and the matter was not reported to law enforcement authorities for further investigation.`

Similar Incidents

The coding error at Blue Shield of California that led to the users being able to view other individuals` information isn`t a first in terms of programming mistakes on a healthcare-sector website leading to privacy concerns.

For example, in the early weeks of the launch of HealthCare.gov in the fall of 2013, a software glitch allowed a North Carolina consumer to access personal information of a South Carolina man. The Department of Health and Human Services` Centers for Medicare and Medicaid Services said at the time that the mistake was `immediately` fixed once the problem was reported. Still, the incident raised more concerns about the overall security of the Affordable Care Act health information exchange site (see HealthCare.gov: Rebuilding Trust).

Software design and coding mistakes that leave PHI viewable on websites led to at least one healthcare entity paying a financial penalty to HHS` Office for Civil Rights.

An OCR investigation of Phoenix Cardiac Surgery P.C., with offices in Phoenix and Prescott, began in February 2009, following a report that the practice was posting clinical and surgical appointments for its patients on an Internet-based calendar that was publicly accessible. The investigation determined the practice had implemented few policies and procedures to comply with the HIPAA privacy and security rules and had limited safeguards in place to protect patients` information, according to an HHS statement. The investigation led to the healthcare practice signing an OCR resolution agreement, which included a corrective action plan and a $100,000 financial penalty.

Read original article

5 Things you missed

If you`re still digesting this year`s massive Verizon Data Breach Investigations Report (DBIR), you`re not alone. The super-sized 2015 DBIR came with the usual popular data and rare insight on real-world incidents and breach cases, but with the addition of loads of data contributed by 70 other organizations from around the world.

Unless you`ve been combing the DBIR regularly since it was published in April, there`s a good chance you missed a few things in it. Marc Spitler, co-author of the DBIR and senior risk analyst with Verizon, joined Dark Reading Radio yesterday and shared what may have been some of the possibly lesser-noticed or publicized nuggets from the report.

Payment Card Hacking Has Evolved Dramatically

Debit and credit-card accounts have been a hot commodity since the big TJX and Heartland breaches in the early 2000s. But studying the evolution of just how cybercriminals have been stealing that information over the years highlights how their tactics have changed, while their hunger for these cards has not.

Verizon`s Spitler points out that after TJX and Heartland and other big-name retail breaches at that time--mostly via packet-sniffing and pilfering databases--the bad guys shifted their targets to small- to mid-sized businesses, this time stealing lower volumes of card data via point-of-sale (POS) systems.

Then came the fourth quarter of 2013--Target`s data breach--and the floodgates opened again for high-volume, multi-million dollar payment card theft, and from some big-name, big-box retailers. `These were not database hacks. They were going after the PoS sales environment, putting in malicious code to take payment card data when it was processed and exfiltrate it out,` Spitler says.

`It`s been a really interesting rollercoaster ride in terms of payment card breaches studied in our report,` he says. `It`s been interesting to see their tactics change … This isn`t just a lone wolf. These are well-run organizations` stealing volumes of card data, he says.

Read original article

ransomware raked in 18 million

The FBI`s Internet Crime Complaint Center (IC3) has issued an alert warning businesses and individuals about the continued spread of cryptographic ransomware. This malware encrypts a victim`s files with a key held by criminals on a remote server, and it then extorts money from the victim to recover those files. The biggest threat among these continues to be CryptoWall, the ransomware family that first emerged last April.

So far, the FBI`s IC3 has been contacted by 992 victims of CryptoWall, and their combined losses total over $18 million (~£11.4 million). That number falls far short of the actual number of victims, some of whom have not reported being affected by the malware and have simply paid up or abandoned their files. And the current cost figure does not include all of the business losses from those reporting CryptoWall incidents. Those hidden impacts can include lost productivity, the cost of bringing in IT services to clean up the mess, or the price of handling the potential breach of personal information associated with the malware.

`CryptoWall 3.0 is the most advanced crypto-ransom malware at the moment,` said Stu Sjouwerman, CEO of the security training company KnowBe4, in an e-mail to Ars. `The $18 million in losses is likely much more, as many companies do not report their infections to the FBI and the downtime caused by these infections is much higher.`

The FBI`s advice for avoiding ransomware is fairly standard: use antivirus and firewall software from `reputable companies` and keep them updated; enable pop-up blockers to prevent accidental clicks on malicious webpages that could download malware; always do backups; and `Be skeptical...don`t click on any e-mails or attachments you don`t recognize and avoid suspicious websites altogether.`

The last bit of advice may not be of much help at all, since many victims of CryptoWall and other ransomware variants have been infected through malicious advertisements spread through advertising networks on legitimate websites. In some cases, these channels don`t even require user interaction. Some of the most recent CryptoWall attacks have come by way of Web exploit kits using previously-known Adobe Flash vulnerabilities.

Read original article

Magento platform targeted

Attackers are using a sneaky method to steal payment card data from websites using Magento, eBay`s widely used e-commerce platform.

Researchers from Sucuri, a company that specializes in securing websites, said the attackers can collect any data submitted by a user to Magento but carefully filters out anything that doesn`t look like credit card data.

The attackers are injecting their malicious code into Magento, but it`s still unclear how that process happens, wrote Peter Gramantik, a senior malware researcher with Sucuri.

`It seems though that the attacker is exploiting a vulnerability in Magento core or some widely used module/extension,` he wrote.

All POST requests are collected, but there are rules within the attack script that only collects payment card information.

`If the structure of the POST parameters match, the attacker stores them all -- nothing more, but nothing less,` Gramantik wrote. `They`ve got all the billing details processed by the infected site.`

The stolen data is then encrypted using a public encryption key that is included in the malicious script. It is then saved in a fake image file.

If someone were to try to load the image, it wouldn`t be displayed, he wrote. But the attacker can download and decrypt the fake image file, revealing the payment card details.

`Now they have all the billing information processed by the Magento e-commerce website,` he wrote. `It`s all nicely packed, formatted and collected.`

Ebay could not be immediately reached for comment.

Sucuri also found an example of a less-sophisticated but no less effective way to steal data from Magento.

In that example, attack code is injected to Magento`s Checkout Module. It collects payment card data before a transaction is processed. The data is then emailed in plain text to the attacker`s account.

Those behind the method seem to be intimately familiar with how Magento works, Gramantik wrote. `The attacker knows how the module works and the code it`s built on; all he needed to do was use the module`s own variable in which all the sensitive data is stored unprotected.`

Sucuri has seen variations of this attack before. In April, Sucuri`s Denis Sinegubko outlined where hackers see opportunity within Magneto. Most websites using the platform have a checkout form where customers enter their credit card details.

Magento then encrypts that data and either saves it or sends it to a payment gateway to complete the transaction, but there is `a very short period of time when Magento handles sensitive customer information in an unencrypted format,` Sinegubko wrote in a blog post.

Sinegubko wrote that`s a fine method unless hackers find a way to grab the information before it`s encrypted.

Read original article

Pwn Pad 3

Pwnie Express, the company that began as a builder of `drop boxes` for penetration testers and white-hat corporate hackers, has been evolving toward a more full-service security auditing platform vendor over the past few years while continuing to refine its hardware and software in ways that appeal to the corporate security set. Now Pwnie has released the third generation of its flagship mobile penetration testing platform, the Pwn Pad, bringing the Android and Kali Linux-based platform a step further away from the rough-hewn penetration testing tools it began with and into the realm of something with a lot more polish—and performance.

Pwnie Express` Mobile Platform Engineer Tim Mossey and Director of Research and Development Rick Farina recently gave Ars a walk-through of the Pwn Pad 3, which has just begun shipping out to pre-order customers. We expect to do a full review of the Pwn Pad 3 soon but wanted to get an early look at what to expect. The biggest visible change is the hardware itself, as Pwnie has left the relative comfort zone of Google`s reference platform Nexus tablets and moved to the more powerful Nvidia Shield. But there are some changes behind the scenes as well that make the Pwn Pad 3 act more like an actual flagship commercial product and less like something way off the corporate reservation.

Full disclosure is in order here—Ars bought hardware from Pwnie Express to support our own security testing lab, and we enlisted help from Pwnie Chief Technology Officer Dave Porcello for our joint project with National Public Radio last year. So we`ve had a bit of experience with Pwnie`s platform in many of its incarnations. We`ve also worked with a number of open source penetration tools, including the Kali Linux-based NetHunter platform for Android.

First, there`s the hardware. The Nvidia Shield is built on a 2.2 GHz ARM-based Cortex A15 CPU with 2 gigabytes of RAM. Compared to the ASUS Nexus 7 2013 that the previous generation of Pwn Pad was built upon—which has a 1.5 GHz Snapdragon S4 Pro processor—that`s a significant step up in processing power. At the same time, the Shield has significantly longer battery life than the older Nexus 7 hardware.

As a result, Farina said, `on all the benchmarks we`ve run, this tablet is more than twice as fast. It`s more like what your laptop was like four years ago–it has the horsepower for cracking and decrypting SSL on the fly.`

Moving off the Nexus 7 to Nvidia`s hardware was a lot more challenging than just recompiling the code, Mossey said, `but man, have we reaped the benefits.` The Shield was `uncommonly pleasant` to work with compared to other Android platforms, he added. The choice of the Shield came after Pwnie`s team screened dozens of platforms, keeping in mind that they also wanted a hardware platform that would be affordable to users of the open source community edition of Pwn Pad`s software. `It`s a premium device at a reference platform price, which is sort of a unicorn in this space,` Mossey said.

The software updates for Pwn Pad 3 are a bit more subtle, but they`re certainly significant. More of the functionality of the underlying Kali Linux build that powers Pwn Pad`s auditing and penetration testing tools have been surfaced through scripted Android launchers, making them much easier and faster to use on a tablet and reducing the amount of screen typing in a console window. The hardware support within the software for network devices has been improved as well, allowing for the use of a wider range of USB-based Wi-Fi and wired Ethernet adapters via the Shield`s on-the-go (OTG) cable. `We were actually able to bake in support for dozens of wireless chipsets that haven`t been supported in the previous versions,` Mossey said.

There`s also one major improvement to the software functionality of the Pwn Pad with the addition of support for Kali Disk Forensics. Any drive that can be mounted via a USB device based on a range of file systems can be directly connected to the Pwn Pad 3 and accessed by the disk forensics tools built into the underlying Kali Linux platform.

Another change in functionality is the addition of over-the-air updates to the Pwn Pad. In the past, updating the Pwn Pad (or for that matter, any of the Android-based penetration testing suites we`ve looked at) required a complete re-flashing of the system`s image. Now, users can set the device to automatically retrieve over-the-air updates to the software, keeping it current both in terms of Android and Kali updates.

Of course, all this comes with a slightly higher price tag than an off-the-shelf Shield. The fully supported version of the Pwn Pad 3 is $1,095—the original price point of the Pwn Pad 2. For now, you can still get the Nexus 7-based Pwn Pad 2 (now dubbed the Pwn Pad 2014) for $995.

We`re looking forward to a full hands-on test of the Pwn Pad 3 in and around the Ars network test lab. Maybe we`ll even play a little Doom on it as well when we`re done pwning the neighbors` Wi-Fi. (No, we won`t be pwning the neighbors` Wi-Fi, at least not without getting permission.)

Read original article

Europol Targets Botnet

European police agencies have announced a `joint international strike against cybercrime,` reporting that after a two-year investigation, they have disrupted a botnet gang that used and sold banking malware and cybercrime services that targeted victims and banks around the world.

Authorities say that an ongoing operation has now resulted in the arrests of five Ukrainian-based members of the alleged cybercrime ring, who have been accused of infecting `tens of thousands` of PCs with variants of the Zeus and SpyEye banking Trojans. Officials say the gang targeted `many major banks,` sold hacking services for hire, and swapped stolen credentials, bank account information and malware variants on underground fraudster forums, causing at least $2.2 million in damage.

The law enforcement operation comprised a joint investigation team that included six EU countries: Austria, Belgium, Finland, the Netherlands, Norway and the United Kingdom. The operation was supported and coordinated by Europol - the EU`s law enforcement agency - and its European Cybercrime Center (EC3) as well as Eurojust, which is the EU agency that handles judicial cooperation relating to criminal matters. It coordinated the operation at a judicial level with non-EU member states, including Ukraine. Other countries participating in the operation included Germany, Poland and the United States, officials say.

`The aim of this JIT Joint Investigative Team was to target high-level cybercriminals and their accomplices who are suspected of developing, exploiting and distributing Zeus and SpyEye malware - two well-known banking Trojans - as well as channeling and cashing-out the proceeds of their crimes,` Europol says. `The cybercriminals used malware to attack online banking systems in Europe and beyond, adapting their sophisticated banking Trojans over time to defeat the security measures implemented by the banks.`

Rob Wainwright, director of Europol, called this `one of the most significant operations coordinated by the agency in recent years.` He says the five recent arrests, made in Ukraine on June 18 and 19, involved searches of eight houses in four cities there, plus the seizure of computer equipment for digital forensic analysis.

`This case demonstrates that it is only possible to combat cybercrime in a successful and sustainable way if all actors - that means investigative judges and judicial authorities - coordinate and cooperate across the borders,` Ingrid Maschl-Clausen, a Eurojust member for Austria, said at a June 25 press conference in Vienna.

Europol says that 60 individuals have now been arrested as part of this ongoing operation; 34 were busted by Dutch police as part of an operation that targeted alleged money mules.

Authorities have not identified the most recent arrestees; Europol did not immediately respond to a related request for comment.

`This is another successful operation by Europol EC3 and demonstrates the value EC3 brings in dealing with cybercrime by enabling better and more effective cooperation between different law enforcement agencies,` Dublin-based information security consultant Brian Honan, a cybersecurity adviser to Europol, tells Information Security Media Group. `Europol`s work in developing frameworks for international cooperation amongst law enforcement agencies is gaining dividends. The success of this operation and other recent ones, is sending a clear message to cybercriminals that they are no longer untouchable.`

Read original article

Avoid Collateral Damage

How To Avoid Collateral Damage In Cybercrime Takedowns

Internet pioneer and DNS expert Paul Vixie says `passive DNS` is way to shut down malicious servers and infrastructure without affecting innocent users.

Botnet and bad-actor IP hosting service takedowns by law enforcement and industry contingents have been all the rage for the past few years as the good guys have taken a more aggressive tack against the bad guys.

These efforts typically serve as an effective yet short-term disruption for the most determined cybercriminal operations, but they also sometimes inadvertently harm innocent users and providers, a problem Internet pioneer and DNS expert Paul Vixie says can be solved by employing a more targeted takedown method.

Vixie, CEO of FarSight Security, which detects potentially malicious new domain names and other DNS malicious traffic trends, says using a passive DNS approach would reduce or even eliminate the chance of collateral damage when cybercriminal infrastructure is wrested from the attackers` control. Vixie will drill down on this topic during his presentation at Black Hat USA in August.

Takedowns typically include seizing domains, sinkholing IPs, and sometimes physically removing equipment, to derail a botnet or other malicious operation.

Perhaps the most infamous case of collateral damage from a takedown was Microsoft`s Digital Crimes Unit`s takeover of 22 dynamic DNS domains from provider No-IP a year ago. The move did some damage to Syrian Electronic Army and cybercrime groups, but innocent users were also knocked offline. Microsoft said a `technical error` led to the legitimate No-IP users losing their service as well, and No-IP maintained that millions of its users were affected.

The issue was eventually resolved, but not after some posturing in hearings on Capitol Hill, and debate over whether Microsoft was getting to heavy-handed in its takedown operations.

Vixie says the key to ensuring innocent users and organizations don`t get swept up in the law enforcement cyber-sweep is get a more accurate picture of just what is attached to and relying on the infrastructure in question. `There is a tool that you can use to find out whether the Net infrastructure belongs to bad guys so you don`t target anything else` that shares that infrastructure and is not malicious, Vixie says.

Passive DNS is a way to do that, says Vixie. With passive DNS, DNS messages among DNS servers are captured by sensors and then analyzed. While Vixie`s company does run a Passive DNS database, he says he`s advocating that investigators and task forces doing botnet or domain takedowns use any passive DNS tool or service.

Vixie says the two-part challenge in takedowns to date has been ensuring law enforcement `got it all` while not inadvertently cutting off innocent users and operations in the process.

Passive DNS not only can help spot critical DNS name servers, popular websites, shared hosting environments, and other legit operations so they aren`t hit in a takedown operation, he says, but it can also help spot related malicious domains that might otherwise get missed. That helps investigators drill down to the malicious tentacles of the operation, according to Vixie.

Vixie in his talk at Black Hat also plans to lobby for researchers and service providers to contribute data to passive DNS efforts.

Meanwhile, it`s unclear what long-term effects takedowns have had on the cybercrime underground. `I`m involved in the same volume of takedown cases than I ever was. The trend of bad guys is on an upward swing,` Vixie says.

Read original article

Patch early patch often

Yet again, Adobe has released a new patch to fix a critical vulnerability that `could potentially allow an attacker to take control of the affected system,` according to the company.

Adobe acknowledged that the flaw (CVE-2015-3113) is `being actively exploited in the wild via limited, targeted attacks.` Known affected systems run Internet Explorer for Windows 7 and below and Firefox on Windows XP, according to the patch details. Adobe says the following software can potentially be impacted:
•Adobe Flash Player 18.0.0.161 and earlier versions for Windows and Macintosh
•Adobe Flash Player Extended Support Release version 13.0.0.292 and earlier 13.x versions for Windows and Macintosh
•Adobe Flash Player 11.2.202.466 and earlier 11.x versions for Linux

The company recommends updating to the latest version of Flash to avoid the risk of exploitation, but at this point users should take a hard look at how necessary Flash is to their daily Internet use. In 2015 alone, we`ve seen Adobe issue multiple emergency Flash updates to patch critical vulnerabilities under active attack—including three such instances in the first five weeks of the year. The situation has gotten so grim that security reporter Brian Krebs recently experimented with a month without having the Flash Player installed at all. `The result? I hardly missed it at all,` Krebs writes.

This newest flaw was uncovered through the help of FireEye security researchers. A Singapore-based FireEye team discovered the vulnerability in June by detecting a phishing campaign exploiting CVE-2015-3113. `The attackers' e-mails included links to compromised Web servers that served either benign content or a malicious Adobe Flash Player file that exploits CVE-2015-3113,` FireEye writes.

FireEye identified APT3, a China-based group also known as UPS, as responsible for these attacks (see more on the group in FireEye`s report on Operation Clandestine Fox). APT3 has previously introduced other browser-based zero-day attacks against Internet Explorer and Firefox. FireEye notes APT3`s tactics are difficult to monitor given there`s little overlap between campaigns, and the group typically moves quickly (`After successfully exploiting a target host, this group will quickly dump credentials, move laterally to additional hosts, and install custom backdoors,` the new report states). According to the security researchers, APT3 has implemented these phishing schemes against companies in aerospace and defense, engineering, telecommunications, and transportation this year.

Read original article

WhatsApps poor privacy record

WhatsApp, the messaging application that Facebook acquired last year for $16 bn, claims more than a billion mobile downloads, more than 450 million active business and consumer users, and has more than a million users joining every day. But it earns abysmal marks concerning the privacy of all those enthusiastic users, says the Electronic Frontier Foundation.

In all, the service earned just one star in this year's 'Who Has Your Back' report. This is WhatsApp's first year in the roundup, and although EFF gave the company a full year to prepare for its inclusion, it has adopted none of the best practices that EFF identified when it comes to privacy—even if those best practices may not be strictly applicable given the company's data stewardship approach.

Its transgressions in EFF's eyes are myriad:
WhatsApp does not publicly require a warrant before giving content to law enforcement.
It doesn't publish a transparency report or a law enforcement guide.
It doesn't publish information about its data retention policies, including retention of IP addresses and deleted content.

WhatsApp does however have a pro-user public policy to oppose backdoors. In a public, official written format, WhatsApp's parent company Facebook opposes the compelled inclusion of deliberate security weaknesses—i.e., introducing intentional vulnerabilities into secure products for the government's use

On behalf of itself as well as WhatsApp, Facebook signed a coalition letter organized by the Open Technology Institute, which stated: `We appreciate the steps that WhatsApp's parent company Facebook has taken to stand by its users, but there is room for WhatsApp to improve,` the EFF said in its report.

`WhatsApp should publicly require a warrant before turning over user content, publish a law enforcement guide and transparency report, have a stronger policy of informing users of government requests, and disclose its data retention policies. WhatsApp does get credit for Facebook's public position opposing back doors, and we commend Facebook for that.`

All of this said, it should be noted that WhatsApp has always prided itself on not even collecting user data in the first place—a state of affairs that may make moot the EFF's concerns about turning user info over to law enforcement.

`Respect for your privacy is coded into our DNA, and we built WhatsApp around the goal of knowing as little about you as possible,` co-founder and CEO Jan Koum said ahead of the Facebook acquisition. `We don't know your likes, what you search for on the internet or collect your GPS location. None of that data has ever been collected and stored by WhatsApp, and we really have no plans to change that.`

Like any company built on code, privacy flaws do crop up. In February 2015, a researcher uncovered a privacy bug in WhatsApp that allows strangers to view users' profile pictures, even if they have been set to 'contacts only'. The researcher also claimed that if a user sends a photo which is subsequently deleted, it's not blurred out, as happens on the mobile version.

Privileged users were found to pose the biggest risk to their organization—a substantial step up from 38% in last year's study.

Read original article

RubyGems Software Flaw

Trustwave researchers, using collaborative research data from OpenDNS, have discovered a vulnerability that could affect 1.2 million software installations per day.

The issue affects the RubyGems distribution software, which is used by a range of businesses, including start-ups, social media sites and payment gateway companies—to the tune of 438 million installations per year. RubyGems helps businesses and application developers distribute software to a central location so that end users can download it and use it.

The vulnerability can be exploited to unknowingly lead end users to a server that's controlled by criminals. Criminals can then feed the end user malware, compromising the computer and gaining access to all of the victim's sensitive information. And the kicker is that the attack would be unnoticeable to the end user.

To understand the issue, it's necessary to understand how RubyGems works.

`A Ruby gem is a standard packaging format used for Ruby libraries and applications,` explained the Trustwave researchers, in a blog shared with Infosecurity prior to publication. `This…allows Ruby software developers a clearly defined format in which they can reliably build and distribute software. Developers push Ruby gems to a distribution server (aka: a gem server) whereby users can then install the Ruby application.`

The RubyGems client has a Gem Server Discovery functionality, which uses a DNS SRV request for finding a gem server. Here's the crux of the issue: This functionality does not require that DNS replies come from the same security domain as the original gem source, allowing arbitrary redirection to attacker controlled gem servers.

An attacker can redirect a RubyGem client who is using HTTPS to an attacker controlled gem server; this effectively bypasses HTTPS verification on the original HTTPS gem source. This means that the attacker can force the user to install malicious/trojaned gems. Trustwave actually wrote a fully functional Gem Trojaning service that demonstrates how an attacker could simply Trojan Ruby gems transparently over the wire while the user was installing them.

So far there haven't been any in-the-wild exploitation attempts, but the magnitude of the potential attack surface is notable.

`OpenDNS sees roughly 24,000 requests for the DNS SRV record in question per day, inferring 24,000 gem installations per day if we discount local system caches, gem dependencies and gem installation typos,` the researchers said. `Given that OpenDNS sees about two percent of the world's Internet traffic—assuming each region of the world has the same likelihood of installing gem packages—that's a possible 1.2 Million gem installations per day across the entire Internet (or 438 Million gem installs per year) that could be affected.`

Users should upgrade their RubyGem client in all Ruby environments to 2.4.8 or greater, and verify that all Ruby gem sources are using HTTPS. Producers can also sign their gems to provide options to users as to whether they want to verify the integrity of the gem. Gem consumers can meanwhile start using gem installation trust policies.

Trustwave researchers, using collaborative research data from OpenDNS, have discovered a vulnerability that could affect 1.2 million software installations per day.

The issue affects the RubyGems distribution software, which is used by a range of businesses, including start-ups, social media sites and payment gateway companies—to the tune of 438 million installations per year. RubyGems helps businesses and application developers distribute software to a central location so that end users can download it and use it.

The vulnerability can be exploited to unknowingly lead end users to a server that's controlled by criminals. Criminals can then feed the end user malware, compromising the computer and gaining access to all of the victim's sensitive information. And the kicker is that the attack would be unnoticeable to the end user.

To understand the issue, it's necessary to understand how RubyGems works.

`A Ruby gem is a standard packaging format used for Ruby libraries and applications,` explained the Trustwave researchers, in a blog shared with Infosecurity prior to publication. `This…allows Ruby software developers a clearly defined format in which they can reliably build and distribute software. Developers push Ruby gems to a distribution server (aka: a gem server) where by users can then install the Ruby application.`

The RubyGems client has a Gem Server Discovery functionality, which uses a DNS SRV request for finding a gem server. Here's the crux of the issue: This functionality does not require that DNS replies come from the same security domain as the original gem source, allowing arbitrary redirection to attacker controlled gem servers.

An attacker can redirect a RubyGem client that is using HTTPS to an attacker controlled gem server; this effectively bypasses HTTPS verification on the original HTTPS gem source. This means that the attacker can force the user to install malicious/trojaned gems. Trustwave actually wrote a fully functional Gem Trojaning service that demonstrates how an attacker could simply Trojan Ruby gems transparently over the wire while the user was installing them.

So far there haven't been any in-the-wild exploitation attempts, but the magnitude of the potential attack surface is notable.

`OpenDNS sees roughly 24,000 requests for the DNS SRV record in question per day, inferring 24,000 gem installations per day if we discount local system caches, gem dependencies and gem installation typos,` the researchers said. `Given that OpenDNS sees about two percent of the world's Internet traffic—assuming each region of the world has the same likelihood of installing gem packages—that's a possible 1.2 Million gem installations per day across the entire Internet (or 438 Million gem installs per year) that could be affected.`

Users should upgrade their RubyGem client in all Ruby environments to 2.4.8 or greater, and verify that all Ruby gem sources are using HTTPS. Producers can also sign their gems to provide options to users as to whether they want to verify the integrity of the gem. Gem consumers can meanwhile start using gem installation trust policies.

Read original article

OPM Victim count up

The number of data breach victims stemming from the hack attack against the Office of Personnel Management may number in the tens of millions.

FBI Director James Comey has told U.S. senators in recent weeks, in closed-door briefings, that the tally of data breach victims might number 18 million people, CNN reports. That estimate is reportedly based on the results of the FBI`s investigation into the OPM breach, which has found that information pertaining to not just current and former federal employees - but also prospective ones - was exposed.

But according to another report, that 18 million tally only applies to a single breached database. As investigators continue to investigate the year-long intrusion into OPM systems - which pull data from a number of other federal agencies` systems - they now believe that the number of victims may reach into the tens of millions, ABC News reports.

One reason why the breach victim tally could continue to grow is because the exposed information included SF-86 background check questionnaires, which contain personally identifiable information not just for the person being investigated, but also their family members and acquaintances, CNN reports.

Since publicly revealing the OPM data breach on June 4, the White House has only confirmed that a hack attack may have compromised names and PII for 4.2 million current and former federal employees. But last week, officials - speaking on condition of anonymity - first began warning that the breach tally could hit 9 million to 14 million, and include information on employees stretching back to the 1980s (see Millions More Affected by OPM Breach).

`Obviously they started at 4 million,` House Homeland Security Chairman Michael McCaul, R-Texas, told reporters as he exited a June 16 OPM breach briefing with Obama administration officials. `That number is increasing.`

Problem: Interconnected Legacy Systems

Calculating an accurate breach tally to date has been complicated by OPM systems pulling data from a number of other agencies` systems, many of which are legacy systems, OPM CIO Donna Seymour said in a June 16 House Committee on Oversight and Government Reform committee hearing (see Lawmakers Lambaste OPM Chief Over Hack).

At that hearing, Rep. Elijah Cummings, D-Md., questioned whether hackers might have accessed OPM`s systems using data stolen from the 2014 hack of KeyPoint Government Solutions or the 2013 hack of U.S. Investigations Services. Both of those firms have conducted background investigations for OPM. But no representative from either company was present at that hearing.

Neither KeyPoint nor USIS responded to Information Security Media Group`s request for comment. But Cummings has called on them to appear before his committee. `I now feel more strongly than ever that the Oversight Committee must hear directly from OPM`s two contractors - KeyPoint and USIS - either in transcribed interviews or in formal testimony before the committee,` he said after the hearing. `I also believe the committee should now request a much more detailed, comprehensive, and classified briefing from government IT experts about the specific vulnerabilities that contractors pose to our government`s cybersecurity.`

Who Got Hacked First?

FBI investigators have said that when the OPM breach was discovered in April, they found that credentials obtained from a network breach at KeyPoint had been used to access OPM databases, CNN reports. The KeyPoint breach was first disclosed in December, and it may have exposed PII for almost 50,000 people.

Read original article

FitBit security fail

FitBit, Acer Liquid Leap Fail In Security Fitness

Transmissions to the cloud are secured with these Internet of Things devices, but wristband-to-phone comms are open to eavesdropping.

If you don`t want anyone to know how badly you missed your exercise goals this week, the Acer Liquid Leap is not the fitness tracker for you; and the FitBit Charge isn`t much better. According to research released today by AV-TEST, while most fitness trackers succeeded at transmitting users` data to the cloud securely, some brands failed badly at locking down communications between the wristband devices and the smartphone apps.

AV-TEST examined nine different trackers: the Acer Liquid Leap, FitBit Charge, Garmin Vivosmart, Huawei TalkBand B1, Jawbone Up24, LG Lifeband Touch FB84, Polar Loop, Sony Smartband Talk SWR30, and Withings Pulse Ox.

Of those, the Sony Smartband Talk was the lowest-risk -- with the only complaint being that users could not deactivate Bluetooth on the wristband device -- followed by the Polar Loop.

The one with the `highest probability of a successful attack` is the Acer Liquid Leap. (It`s a product that Acer simply bought and sold with its own label on it, unmodified, so it is identical to products sold under other names, including the Striiv Touch, Tofasco 3 Plus Swipe, and Walgreens Activity Tracker. As AV-TEST points out, `It is not clear, however, whether the other vendors have modified the app and the firmware of the wristbands.`)

Among the complaints: Bluetooth cannot be deactivated on the Acer wristband; the wristband would `pair` with a smartphone without requiring any confirmation; the wristband can be used by several smartphones at once; the app does not use code obfuscation, and; the app reveals log data.

Second-worst was the FitBit Charge. It has many of the same failings as the Acer, but what researchers were particularly struck by was that the wristband wasn`t at all picky about who it shared data with.

`The fitness wristband FitBit Charge astonished the test engineers: Any smartphone with Bluetooth is welcome to the fitness tracker. It does not prompt for a PIN or other authentication – it simply connects and voluntarily hands over all its data. The data is not even encrypted or protected in other ways,` AV-TEST said it in its report.

By comparison, the Sony Smartband Talk connects to smartphones automatically, but only with known, trusted devices. And although Bluetooth cannot be disabled on the Sony wristband, it does become invisible once it pairs with a device.

Why the cause for concern? `In the United States, for example, those who demonstrate good fitness using the tracker are eligible for lower premiums on their private health insurance. What would keep people from simply using the data of their neighbor of the same age with a much higher level of fitness? Those familiar with what people pay for health insurance in the United States know how great the criminal potential may be in this area,` the report said.

Data manipulation could also be used for more personal attacks on fitness tracker users: `And if trackers can be manipulated, it won`t be long before kids will be playing pranks on the jogging yuppie by increasing his blood pressure and pulse data by a few notches ... The current test indicates: the potential attack points are more than sufficient.`

Read original article

Mysterious car burglaries

Mysterious car burglaries: Signal amplification or brute-force hacking? No clear answer other than `wow, there are a lot of ways to break into a car.`

Several weeks ago, New York Times columnist Nick Bilton wrote about his car being broken into in front of him. After speaking with security researchers, Bilton arrived at the theory that his car was snatched with the help of a signal repeater that boosted the range of the keyless entry fob. That seemed like a reasonable explanation to us; we reported on a spate of car burglaries in southern California in 2013, arriving at a similar conclusion. In both cases, the work of a Swiss-based security expert named Boris Danev was central to pointing the finger at signal repeaters. This week, Bozi Tatarevic at The Truth About Cars wrote up his attempt to test this potential exploit in quite some detail.

Danev`s 2010 paper `Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars` demonstrated the vulnerability of keyless entry fobs to signal amplification, but doing so required a lab bench full of equipment, and an AC power supply. Tatarevic was unable use Danev`s approach to create a low-cost cordless signal amplifier and instead concludes that the burglaries were more likely the result of a brute force attack against the rolling codes that some manufacturers use for their unlocking signals.

Tatarevic bases this on the work of Silvio Cesare, another security researcher who demonstrated such an attack at last year`s Black Hat conference. That attack involved using a laptop and a software-defined radio (SDR) to send the car code after code until the right one unlocked the doors, something that could take up to two hours. That could fit with the facts; in each burglary, the cars had been parked for some time. This trick would also only unlock the car, unlike amplifying the signal of a keyless entry system, which would allow the car to be started, if only once.

Another possibility involves SDR and RF jamming to copy the code from someone`s remote, which can then be rebroadcast to the car at a time more convenient to the thief. Spencer Whyte described this exploit last year, using a different frequency than the remote to jam the receiver, which prevented the car from recognizing the legitimate signal from the key fob (being broadcast at the same time). Daily Tech—also skeptical of Bilton and Danev`s theory—looked at passive key fob attacks and found devices on sale that claimed to be able to replicate rolling codes used by car manufacturers.

Are these methods more plausible than signal amplification? Tatarevic thinks so, although he notes that he discovered such a device `by a company out of Lebanon that's basically a Radio Shack for car thieves.` Until the miscreants are caught, we`ll remain guessing.

Read original article

US UK Intel subvert antivirus

Documents from the National Security Agency and the United Kingdom`s Government Communications Headquarters (GCHQ) obtained by former NSA contractor Edward Snowden reveal that the two agencies—and GCHQ in particular—targeted antivirus software developers in an attempt to subvert their tools to assure success in computer network exploitation attacks on intelligence targets. Chief among their targets was Kaspersky Labs, the Russian antivirus software company, according to a report by The Intercept`s Andrew Fishman and First Look Media Director of Security Morgan Marquis-Boire.

Kaspersky has had a high profile in combatting state-sponsored malware and was central in the exposure of a secret NSA-backed hacking group that had been in operation for 14 years. More recently, it was revealed that Kaspersky had come under direct attack recently from an updated version of the Duqu malware—possibly launched by an Israeli-sponsored hacking group. The same malware was found on the networks of locations hosting negotiations over Iran`s nuclear program. But the latest Snowden documents show that both the NSA and GCHQ waged a somewhat more subversive battle against Kaspersky—both by attempting to reverse-engineer the company`s antivirus software and leveraging its intelligence-collection operations for their own benefit.

Kaspersky was not the only target, but the company was the one most prominently mentioned in the Snowden documents released today by The Intercept. GCHQ officials mentioned Kaspersky by name in a warrant extension request `in respect of activities which involve the modification of commercial software` in June 2008, requesting authorization to reverse engineer Kaspersky`s and other companies` software products to exploit them for intelligence purposes. (The original warrant had been in place since at least January of 2008.)

In the text of the warrant application, GCHQ officials wrote, `Personal security products such as the Russian anti-virus software Kaspersky continue to pose a challenge to GCHQ's computer network exploitation capability and software reverse engineering is essential in order to be able to exploit such software and to prevent detection of our activities. Examination of Kaspersky and other such products continues.`

Kaspersky has had a high profile in combatting state-sponsored malware and was central in the exposure of a secret NSA-backed hacking group that had been in operation for 14 years. More recently, it was revealed that Kaspersky had come under direct attack recently from an updated version of the Duqu malware—possibly launched by an Israeli-sponsored hacking group. The same malware was found on the networks of locations hosting negotiations over Iran`s nuclear program. But the latest Snowden documents show that both the NSA and GCHQ waged a somewhat more subversive battle against Kaspersky—both by attempting to reverse-engineer the company`s antivirus software and leveraging its intelligence-collection operations for their own benefit.

Kaspersky was not the only target, but the company was the one most prominently mentioned in the Snowden documents released today by The Intercept. GCHQ officials mentioned Kaspersky by name in a warrant extension request `in respect of activities which involve the modification of commercial software` in June 2008, requesting authorization to reverse engineer Kaspersky`s and other companies` software products to exploit them for intelligence purposes. (The original warrant had been in place since at least January of 2008.)

In the text of the warrant application, GCHQ officials wrote, `Personal security products such as the Russian anti-virus software Kaspersky continue to pose a challenge to GCHQ's computer network exploitation capability and software reverse engineering is essential in order to be able to exploit such software and to prevent detection of our activities. Examination of Kaspersky and other such products continues.`

Read original article

5 security tips

Out of the office on holiday this summer? Despite being encouraged to switch off, and enjoy a well-earned break, the reality is that many people find it difficult to `go dark` and so fall into the trap of checking emails by the pool.

So whether you're travelling to a conference or a hitting the beach, you need to take appropriate steps to keep your data secure, particularly when browsing the internet or making online payments from your mobile device.

With Wi-Fi continuously available today in planes, trains, cars and hotels, the potential is there for us to remain constantly connected. However with that, comes the temptation to cut the usual corners where online security is concerned.

With that in mind, here are five simple cyber security tips:

1. Not Using Your Device? Lock It!

However careful you are, we're all at risk of leaving a phone in a cab or perhaps dropping it in a bar, so you need to make sure no one can access important data, should it get into the wrong hands.

Set your devices to auto-lock after two minutes to ensure your content remains private.
Pick the longest and most complex password you can manage. Don't use a four-digit pin on your phone because that seems to be the norm. Changing to eight digits means it takes a hacker 10,000 times longer to guess it.
Making the effort to encrypt your phone will render it useless to a criminal. This is automatic on iOS 8 devices.

2. Public Wi-Fi Is... Public

If something seems too good to be true, chances are, it probably is. Security bugs are common in public Wi-Fi routers, even in the hospitality industry.

You can't always be sure the hotspot is what it says it is. Hackers can set up seemingly kosher network names so they can snoop on your personal information. Consider using your mobile phone network, or buying a SIM when you arrive to use Pay As You Go data as you need it. Better still, use the company VPN if you can.

3. Turn Off Geo-Tagging and Geolocation Features

Before you post a picture of your ice cold beer by the pool to social media, consider this: Does every Tom, Dick and Harry need to know you're away from home?

Go through your applications and make sure as much geo-tagging is turned off as possible.

For the `tinfoil hat` wearers, even if you have GPS turned off, your phone can still work out where you are by keeping track of all the Wi-Fi access points it can see around you. Airplane mode is the only way to guarantee you cannot be tracked.

4. Public Computers and ATMs: The Risks

Sometimes it pays to be more conservative than usual, especially when you're traveling in unfamiliar territory. Public computers, like those at Internet cafes or business centers at hotels, could be infected with malware, which might spy on you when you go online. Crooks can also attach a card reader to an ATM or a sales register to skim the account numbers off your credit card.

If in doubt, travel with cash. For online payments, services such as PayPal allow you to make a transaction without typing in card details.

5. Add Layers of Protection to Your Mobile Devices

Fortify your accounts wherever possible. It's always worth strengthening your cyber defences when in an unfamiliar environment.

For added protection, use an antivirus on your Android smartphones as well as your laptop (both Windows and Mac). This adds another layer to the login process.

As a general rule, you should also update your operating system when it prompts you, and keep an eye on apps permissions. For example, there is no need for an alarm clock to be able to read your list of contacts! This will all stand you in good stead for complete protection of your mobile devices.

Read original article

Hack Grounds Airplanes

Polish airline LOT claims that a hack attack disrupted the state-owned airline`s ground-control computers, leaving it unable to issue flight plans and forcing it to cancel or delay flights, grounding 1,400 passengers.

The airline said the June 21 cyber-attack against its IT systems at Warsaw Chopin airport lasted about five hours and affected the computers that it uses to issue flight plans. `As a result, we`re not able to create flight plans and outbound flights from Warsaw are not able to depart,` the company said in a statement.

But the airline emphasized that the attack had `no influence on plane systems` and that no in-progress flights were affected by the incident. It also said that all flights bound for Warsaw were still able to land safely. The IT disruption did, however, result in the airline having to cancel 10 flights - destined for locations inside Poland, to multiple locations in Germany, as well as to Brussels, Copenhagen and Stockholm - and then delay 12 more flights.

An airline spokeswoman didn`t immediately respond to a request for more information about the disruption, how LOT judged it to be a hack attack or who might be responsible. No group or individual appears to have taken credit for the disruption.

Airline spokesman Adrian Kubicki says that Polish law enforcement agencies are investigating the hack and warned that other airlines might be at risk from similar types of attacks. `We`re using state-of-the-art computer systems, so this could potentially be a threat to others in the industry.`

Follows Plane Hacking Report

It`s been a busy year for airline-related hacking reports (see Malaysia Airlines Website Hacked).

In May, information security expert Chris Roberts claimed to have exploited vulnerabilities in airplanes` onboard entertainment systems more than a dozen times in recent years, allowing him to access flight controls (see Questions Over Plane Hacking Report). Roberts claimed that his repeated warnings about the problems to manufacturers and aviation officials had resulted in no apparent fixes being put in place.

Question: Hack or IT Error?

Despite the presence of vulnerabilities in avionics systems, however, airline-related IT disruptions are often caused by internal problems, and some security experts are questioning whether that might be the case with the supposed cyber-attack against LOT. `The story doesn`t make sense, and most of the actual info so far suggests a `glitch` caused by an unauthorized user,` says the Bangkok-based security expert who calls himself the Grugq, via Twitter.

On June 2, for example, a computer glitch grounded almost 150 United Airlines flights in the United States, representing about 8 percent of the company`s planned morning flights. The airline blamed the problem on `dispatching information,` and some fliers - such as software firm Cloudstitch CTO Ted Benson - reported via Twitter that pilots told passengers that the ground computers appeared to be spitting out fake flight plans.

As a result of the glitch, the Federal Aviation Administration reportedly grounded all United flights for 40 minutes, until related problems were corrected.

United Airlines Bug Bounty

That glitch followed United Airlines in May launching a bug bounty program - not for the software that runs its airplanes, in-flight entertainment systems, or ground-control computers, but rather its website. `If you think you have discovered a potential security bug that affects our websites, apps and/or online portals, please let us know. If the submission meets our requirements, we`ll gladly reward you for your time and effort,` United says on the bug bounty page.

Rather than offering cash rewards like many other bug-bounty programs, however, United is instead offering frequent-flier `award` miles - for example 50,000 miles for cross-site scripting attacks, 250,000 for authentication bypass attacks, and 1,000,000 for a remote-code execution attack


Read original article

reddit goes https

If you were worried about spooks knowing that your favorite subreddit is /r/belize, fear not—reddit has finally joined the HTTPS party. Earlier this week, the site announced that starting June 29, it will refuse plaintext HTTP traffic.

Last September, reddit allowed HTTPS connections for users that turned the feature on or used something like HTTPS Everywhere.

reddit is merely the latest site in a long list of large outlets making the switch. For instance, Wikipedia announced it would be doing the same thing less than a week ago. In April 2015, Netflix announced it would make the switch for its video streams. And the White House Office of Management and Budget (OMB) did too after issuing the HTTPS-Only Standard directive, which requires all publicly accessible federal websites and Web services to use only HTTPS.

`We genuinely value the privacy of the people who trust reddit as a platform for open communication,` Heather Wilson, a reddit spokeswoman, told Ars in a statement.


Read original article

MIE network Breach

Medical Information Engineering`s network breached; undisclosed number of patients compromised

How many victims? Undisclosed

What type of personal information? Personal health information, including patients` names, mailing addresses, email addresses, dates of birth, some Social Security numbers, lab results, dictated reports and medical conditions

What happened? MIE detected suspicious activity on one of its servers, and its internal team, as well as third-party forensics experts, investigated the attack. Access to the company`s network is thought to have began on May 7 of this year and was detected on May 26. Impacted MIE clients include Concentra, a Texas-based organization that runs more than 300 medical centers in 38 states, as well as Franciscan St. Francis Health Indianapolis, Rochester Medical Group in the Detroit area and various health centers in Fort Wayne, Ind. An MIE subsidiary, NoMoreClipboard, was also compromised.

What was the response? MIE began notifying its clients of the breach on June 2 and any impacted patients for whom the company has a mailing address will receive a notification in the mail. MIE has reported the incident to law enforcement and plans to notify state and federal regulators. The company is offering free credit monitoring and identity protection services for two years.

Quote: `Medical Informatics Engineering`s team, including independent third-party forensics experts, has been working continuously to investigate the attack and enhance data security and protection.`

Read original article

Firewalls Irrelevant

Why the Firewall is Increasingly Irrelevant

It will take a dramatic reimagining of security to dedicate focus to the areas where company data actually resides. It starts with tearing down the firewall.

Firewalls only protect what work used to be, not what it is today: a distributed collection of employees connected by mobile devices, in turn connected to the cloud. The only way to secure all company data, then, is to extend enterprise-grade security to these employees' devices and cloud applications. The truth of the matter is that business data is rarely confined to corporate network perimeters anymore. So why are IT professionals still using this vestige of a simpler time?

Inertia has a lot to do with it. Consider the firewall's long tenure in the enterprise: The firewall first started protecting network perimeters in the late 1980s. Couple that with the amount of sweat that IT puts into it (There's no need to remind you of how messy firewall implementations can get.) many companies continue to see the firewall as the cornerstone of their security efforts and increase the firewall investments with the new level of security risks. But whether on-prem or next-gen, the firewall increasingly isn't the cornerstone of security -- and it's time for IT to take steps to expel it.

In environments in which the firewall is still considered one of the primary lines of defense, security threats increasingly have a way of creeping in. To truly dedicate focus away from the firewall and into the areas where company data actually resides, it will take a dramatic reimagining of security. That starts with tearing down the firewall.

There are two key aspects of the new security reality that makes perimeter-based security so irrelevant:

Data resides on company servers and unsecured employee devices.
Employees are increasingly doing whatever it takes to get their jobs done quickly and conveniently. Often, that means they're sharing and syncing company data on a cloud like Dropbox or Office 365 from their corporate computers and personal mobile phones or tablets. IT, meanwhile, remains unaware: A recent Ponemon survey found that 81 percent of IT organizations don't know how much sensitive data resides on mobile devices and the cloud. These devices and cloud sharing applications do not necessarily even cross the corporate network at all and use available public hotspots and high-speed cellular data plans.

Your company data ends up everywhere.
Extrapolate that habit to all everyone who works with your company—from in-house staff, contractors, suppliers, partners, clients—and it's clear that data is ending up everywhere. These people need help to secure the data. Worse, when such habits are playing out in the shadows, you can bet that the extra security measures you need (or require) aren't being implemented.

That, in turn, means that data today is sitting unencrypted—and totally vulnerable—on employee private devices, which hold the same amount of company data that used to be on the network. But the firewall is not protecting them.

Businesses—and enterprises are especially guilty of this—are building a higher and higher wall around their network. However, the data is no longer confined to that network. Instead, reliance on the firewall has increasingly become a noxious threat of its own.


Read original article

HTTPS Exposes passwords

Researchers have unearthed dozens of Android apps in the official Google Play store that expose user passwords because the apps fail to properly implement HTTPS encryption during logins or don`t use it at all.

The roster of faulty apps have more than 200 million collective downloads from Google Play and have remained vulnerable even after developers were alerted to the defects. The apps include the official titles from the National Basketball Association, the Match.com dating service, the Safeway supermarket chain, and the PizzaHut restaurant chain. They were uncovered by AppBugs, a developer of a free Android app that spots dangerous apps installed on users` handsets.

AppBugs CEO Rui Wang told Ars that the Match.com app uses unencrypted hypertext transfer text protocol when sending user passwords, making it trivial for people in a position to monitor the traffic—such as someone on the same Wi-Fi network—to read the credentials. Other apps, such as NBA Game Time and those from Safeway and PizzaHut use HTTPS encryption but don`t implement it correctly. As a result, a man-in-the-middle attacker can use a self-signed or otherwise fraudulent digital certificate to read the login data.

`As shown in the video demo, when the victim user logs into his League Pass account in the app, a third party machine will be able to grab the password and username,` Wang wrote in an e-mail. `The attacker could be some stranger who monitors the traffic of a public Wi-Fi or a compromised router on the Internet which logs the traffic quietly.`

Wang said the NBA app requires an NBA League Pass Account, which according to this official NBA video costs $199. He said his company reported the vulnerability to the app developer in late February but never got a response. The developers of the Match.com, Safeway, and PizzaHut apps, as well as more than 50 other apps, similarly failed to respond. In all, Wang said he discovered 100 apps that didn`t HTTPS-protect login credentials, only 28 of which have since been fixed.

Although it wouldn`t be hard for Google to detect such shortcomings in the apps it makes available on its own servers, there`s no indication that the company does that. The results come a couple months after student researchers at City College of San Francisco found Android apps collectively downloaded at least 350 million times suffered similarly fatal HTTPS flaws. They also come after a critical bug in a popular code library for iOS developers caused fatal HTTPS failures in an estimated 1,500 apps for iPhones and iPads. The results make it clear that Android users, and to some extent, iOS users too, are on their own when it comes to ensuring the safety of the apps they install on their devices.

Read original article

UC Irvine Medical Center breach

University of California (UC) Irvine Medical Center is notifying nearly 5,000 patients that an employee accessed their records without a job-related purpose between June 2011 and March.

How many victims? 4,859, a UC Irvine Medical Center spokesperson told SCMagazine.com on Friday.

What type of personal information? Names, addresses, dates of birth, genders, medical record numbers, heights, weights, UC Irvine Medical Center account numbers, allergy information, medical documentation, diagnoses, test orders and results, medications, employment status, and names of health plans and employers.

What happened? An employee accessed patient records without a job-related purpose.

What was the response? Law enforcement was notified, and a criminal investigation is ongoing. Independent computer forensics experts were called in to analyze the employee`s hard drive and email account. UC Irvine Medical Center removed the employee`s access to computers systems, and imposed disciplinary action. All affected patients are being notified, and offered a year of free credit monitoring and identity theft protection services.

Details: The employee`s job required access to some patient records, but the employee looked at additional records without a job-related purpose between June 2011 and March.

Quote: `The investigation has found no evidence that this employee removed any patient information,` a notification posted to the UC Irvine Medical Center website said.

Read original article

Heartland Dental Breach

Illinois-based Heartland Dental is notifying an undisclosed number of individuals that unauthorized access was gained to a limited portion of its IT systems, and that personal data may have been compromised.

How many victims? Undisclosed.

What type of personal information? Names, addresses, phone numbers, Social Security numbers, email addresses, certain information related to income and employment, education levels, school names, and certain information related to employment references.

What happened? Unauthorized access was gained to three databases containing data from old employment, discount plan, and patient financing applications.

What was the response? Heartland Dental contained the intrusion and is reinforcing its security technologies. All potentially impacted individuals are being notified, and offered a year of free identity protection services.

Details: The attacks compromised certain websites from March 31, 2013, to March 23, allowing access to the personal data.

Quote: `We have not received any complaints relating to the improper use of the compromised data,` a notification posted to the Heartland Dental website said.

Read original article

Apple and Samsung warnings

Security researchers are sounding warnings about separate flaws that put millions of Android, iOS and Apple OS X devices at risk.

A keyboard-related flaw affects more than 600 million Samsung devices, and could be used to remotely run malicious code. Separately, researchers say they have identified a series of vulnerabilities - dubbed `Xara` - in Apple iOS and OS X devices that allow them to sidestep the OS X sandbox. The flaws could be exploited by malware to steal data and passwords, for example, by cracking the built-in Keychain password manager in OS X.

The Xara flaws - for `cross-app remote access` - were discovered by researchers from Indiana University, Georgia Institute of Technology, as well as Peking University and Tsinghua University in Beijing.

The flaws stem from both iOS and OS X failing to authenticate many types of app-to-app and app-to-OS interactions, the researchers write in a related research paper. `We found that the inter-app interaction services, including the keychain and WebSocket on OS X and URL Scheme on OS X and iOS, can all be exploited by custom-developed malware to steal such confidential information as the passwords for iCloud, email and banks, and the secret token of Evernote.`

The researchers have posted online demonstrations of how Xara could be exploited to steal iCloud tokens, passwords from the Google Chrome browser and private notes from Evernote users. They also demonstrated an attack using the WebSocket protocol - used to display Web content in apps - that allowed them to intercept all passwords from 1Password that get used in the Chrome browser. And while they have not given Xara its own logo - as so many firms now seem to do - other researchers quickly obliged.

Apple did not immediately respond to a request for comment about the Xara flaws. But the researchers say that hundreds of apps that they studied have these flaws, although they could be corrected if developers rewrite their apps (see Securing Homegrown Mobile Apps). Still, it`s unlikely such moves would happen quickly. `Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS X, helping protect vulnerable apps.` The researchers have promised to release that program soon.

Read original article

Most botnets in US

US Hosts The Most Botnet Servers

More malicious command and control servers are based in the US than anywhere else, and China is home to the most bots.

The United States leads the world in hosting malicious servers that are used to remotely command and control infected user machines and systems. And the US is the second-most frequent target of those systems, a new report from Level 3 Communications shows.

Level 3 monitored communications between some 1,000 command-and-control servers (C2) and their victims earlier this year to get a better sense of botnet behavior and to examine the potential causes for an increase in the use of botnets in denial of service attacks, data theft, and other malicious activities.

It found that 60% of C2 servers are being used for malicious communications targeting corporate networks. Left unchecked, such C2s have the potential to disrupt businesses and destroy their data assets, Level 3 said.

Level 3 observed botnets being used for malware distribution and phishing services a well as the usual distributed denial-of-service mission. On average, each botnet had 1,700 infected hosts and stayed up for about 38 days before being taken down voluntarily by the criminals themselves or by the service provider. The number of victims per C2 server meanwhile has gone down substantially from a peak of 3,763 in January to 338 in March. Much of that has to do with the increased vigilance displayed by the security industry against the botnet threat, Level 3 said.

From an infrastructure use standpoint, threat actors seem to be taking a page from their enterprise counterparts in using cloud technologies to host their malware tools. Many have begun spinning up virtual machines via legitimate infrastructure-as-a-service providers to host and distribute their malware tools. The relatively limited validation that cloud providers do when provisioning service to new accounts has made it easy for threat actors to subscribe to cloud services, according to Level 3.

The biggest proportion of C2 traffic and most of the victims were from within the United States. But that's only because the US has a network infrastructure that is highly suitable for botnet operators.

`Geographies with robust communications infrastructures are fertile soil for C2s,` says Chris Richter, senior vice president of Managed Security Services for Level 3. `These locations also happen to be in close global proximity to rich industrial and public sector targets for cybercriminals and rogue nation-state actors,` he says.

China, meanwhile, which has been accused by US authorities of being behind numerous attacks against American companies and government organizations, is also one of the biggest botnet victims. During the first quarter of 2015, Level 3 counted 532,000 unique IP addresses in China that were being controlled by C2 systems, compared to about 528,000 systems in the US. Other countries with a relatively high number of victims were Norway, Spain, and Ukraine.

`Tracking the threat purpose of a C2 is key because this data can serve as a predictor of risk,` the Level 3 report said. `It is important to be able to determine if your servers are communicating with botnets that are operationalized to function in specific purposes, so that you can react to stop the threat.`

In many cases, mitigating a threat might involve something as simply as blocking email from infected endpoints to prevent phishing.

`Level 3 published this report to raise awareness of what organizations should expect from their network service providers,` Richter says. The report highlights the need for greater levels of partnership and collaboration across the security community for dealing with the botnet threat, he says.

Read original article

Anonymous Social Network

Facebook's current rival apparently being backed by the famous hacker group Anonymous.

A new social network is hoping to surpass Facebook and other prominent social media giants in popularity, which is not news at all. However, the fact that this new social network is being backed by none other than the online hacktivist Anonymous is definitely big news.

The new social network Minds.com intends to take on social media rivals with strong commitment to security, privacy and transparency regarding promotion of posts.

Like any regular social network, Minds.com offers some standard options such as users would send/receive updates to/from their followers, and will be able to comment on posts and promote them.

`We are a free and open-source platform to launch your digital brand, social network and mobile app. We are also a social network ourselves. It is a global social network of social networks,` as pointed out by Wired.

The feature that makes this new site unique is that it doesn't aims to collect money by eavesdropping on users and stealing their data. On the other hand, all the messages on this site will be encrypted so that governments or advertisers couldn't spy upon them.

The apps will be another unique feature that Minds.com offers in comparison to other social media networks. The site will reward users for interacting with posts either by voting, uploading and/or commenting. Users will be awarded points, which they will be able to exchange for views. This means posts from active members will be promoted by the site itself.

This mechanism has been defined by Minds.com as `a network that rewards you with reach`. This definitely looks more straightforward and user-oriented than Facebook algorithm, which apparently works on an intricate mix of engagement, clicks and viewing duration.

Minds.com has been launched officially with desktop and mobile apps however; the people behind this project have made it completely open-source. This means, anyone can help in improving the design and maintenance process of the network.

An Anonymous-linked page called `ART of Revolution` delivered a message from Anonymous to its supporters (which on the page are over a million currently) to `collaborate to help build minds.com and other open-source, encrypted networks to co-create a top site of the people, by the people and for the people.`

When we asked @YourAnonCentral (one of the active Anonymous handles on twitter) about this project, the reply was:

`If anyone post NSA leaks, claiming to be making something completely secure or encrypted while maintaining they are Anonymous that to me is a severe red flag, especially if they try to appeal to anti-government activists or Anonymous. Besides we don't need another social media network like twitter or FB, we need a new form of social media.`

Read original article

Dangerous Apple 0Day

Apple users are facing serious zero-days that could lay open all of their app credentials to attackers, on both Macs and iPhone/iPads.

A group of researchers from Indiana University say that they've found a string of vulnerabilities in OS X and iOS that, if combined, would allow an attacker to run amok on a device's apps, stealing iCloud passwords, authentication tokens, saved web passwords on Google Chrome and more.

The flaws allow a bypass of app sandboxes and App Store security checks too: The researchers passed the vetting process to get a proof-of-concept malware approved without any alarms, that can pilfer a user's, well, everything.

The researchers dubbed the issue `unauthorized cross-app resource access,` or XARA, but others have taken to calling it Apple Cored. Because the issue is at the heart of the OS.

It all comes down to a bad access-control list (ACL) implementation in the inter-app interaction engine, which Apple calls Keychain (companion issues also exist in WebSocket on OS X, and URL Scheme on OS X and iOS). Keychain manages how apps talk to each other. This includes storing credentials and making them available between apps.

In the PoC, the researchers' malicious app was used to reconfigure how Keychain does its job. By rewriting Keychain to allow itself access to the credentials used by other apps on a given device, it was able to compromise Dropbox, Facebook and Evernote on a Mac, along with the messaging app WeChat, and vaulted passwords from 1Password.

`Looking into the root cause of those security flaws, we found that in the most cases, neither the OS nor the vulnerable app properly authenticates the party it interacts with,` the researchers explained in the paper. `Fundamentally, the problem comes from the challenge for an app to authenticate the owner of an existing Keychain item. Apple does not offer a convenient way to do so.`

Read original article

DuckDuckGo traffic soars

When Gabriel Weinberg launched a new search engine in 2008 I doubt even he thought it would gain any traction in an online world dominated by Google.

Now, seven years on, Philadelphia-based startup DuckDuckGo - a search engine that launched with a promise to respect user privacy - has seen a massive increase in traffic, thanks largely to ex-NSA contractor Edward Snowden`s revelations.

Since Snowden began dumping documents two years ago, DuckDuckGo has seen a 600% increase in traffic (but not in China - just like its larger brethren, its blocked there), thanks largely to its unique selling point of not recording any information about its users or their previous searches.

Such a huge rise in traffic means DuckDuckGo now handles around 3 billion searches per year.

Speaking on CNBC, CEO Gabriel Weinberg explained how mainstream search engines make money by tracking their customers around the web, saying `It`s really a myth that you need to track people to make money in search,` adding that DuckDuckGo makes its money by keyword advertising: `You type in car and you get a car ad. And it`s really that straight forward`.

By way of comparison, Weinberg said:

Google tracks you on all of these other sites because they run huge advertising networks and other properties like Gmail and photos... so they need that search engine data to track you. That`s why ads follow you round the internet.

Weinberg said that by focusing purely on web search - advertisers continue to bid on lucrative keywords such as cars and mortgages - DuckDuckGo could do away with the need to track its users to turn a profit, adding that:

What consumers don`t really understand is that their data is being leaked for other reasons they don`t even realise.

When asked how use of DuckDuckGo differs from using Chrome`s incognito mode, or other browser privacy functions, Weinberg explained how web users often misunderstood the functionality of such features:

This is another big myth people have. Incognito mode actually is only for your computer and not around the internet. So when you`re in incognito mode Google is still tracking you, your ISP still knows where you`re going. All the sites you visit can still track you, including advertisers.

Mozilla decided to add DuckDuckGo as a pre-installed search engine choice in Firefox last year, and it has been included in Apple`s list of search engine providers since iOS 8 and OS X 10.10.

Recent research suggests that 40% of Americans would prefer to use a search engine that does not track their internet activity, and Weinberg believes that indicates huge market potential for the company.

He did, however, concede that brand awareness was an issue, saying that `Our main issue is just that no-one has heard of us`.

When it was put to Weinberg that it would make a big difference to consumers if they knew what information was out there about them, who has it, and how they could control it, he said:

People want transparency, they want to know what`s going on, they want control so they can opt out and unfortunately they`re usually getting neither today. We`re offering some real choice.

Read original article

WhatsApp poor security

Move aside, Snapchat - WhatsApp has seized your billing as the worst privacy protector!

On second thought, maybe `seized` is a bit too active to describe WhatsApp`s lethargy when it comes to fighting back against US snooping on users` data.

Out of all the 24 companies ranked by the Electronic Frontier Foundation (EFF) in its fifth annual Who Has Your Back report, WhatsApp and AT&T tied for the spot at the bottom, with each receiving only one star.

Actually, even the one star WhatsApp got - for publicly opposing backdoors for government spying - was passed down from parent company Facebook.

Here`s how WhatsApp could improve, the EFF says:

Publicly require a warrant before turning over user content.
Publish a law enforcement guide and transparency report.
Have a stronger policy of informing users of government requests.
Disclose its data retention policies.

Facebook was rated separately from WhatsApp and actually did quite well, earning four out of five possible stars.

It`s Facebook`s fifth year in the report, and the EFF says it`s adopted most of the practices that the group rates in the report.

Facebook could still do more to disclose when it blocks content or closes accounts in response to government requests, though.

In fact, Facebook inspired the EFF to come up with a new category: tracking how often companies are removing content or shutting down accounts at the behest of the government.

EFF says that for more than a year, lead investigative researcher Dave Maass has been reporting on how Facebook cooperates with prison systems across the US to block prisoner access to the social network, going so far as to set up a dedicated `Inmate Account Takedown Request` form to help prison officials quickly and easily flag prisoner-run accounts for suspension, even when the accounts didn`t violate any of Facebook`s terms of service.

It`s not that the EFF expects Facebook to refuse takedown requests; rather, it`s simply that the EFF would like to see more transparency about how often Facebook is blocking or removing content or accounts.

It`s WhatsApp first time on the report, but that`s no excuse: Reddit and Slack both debuted this year, and they both managed to fulfill several criteria to earn stars.

All three list newcomers were responsive to conversations with the EFF, the organization said, but in spite of being given a full year to prepare for inclusion in the report, WhatsApp pretty much flunked.

Industry-accepted best practices

What used to be ambitious criteria are now simply industry-accepted standards. As such, the EFF has rolled up these three formerly stand-alone categories into one and labelled it best practices.
1.Does the company require the government to obtain a warrant from a judge before handing over the content of user communications?
2.Does the company publish a transparency report, i.e. regular, useful data about how many times governments sought user data and how often the company provided user data to governments?
3.Does the company publish law enforcement guides explaining how they respond to data demands from the government?

There`s no partial credit in this category: companies have to be doing all three of those best practices to get a star on this one, the EFF says.

AT&T, which also got one star, does in fact follow the EFF`s newly formed category of best practices: it requires a warrant before giving content to law enforcement, as well as publishing a transparency report and law enforcement guide.

And what about the mediocre, three-starred Google, with its lack of transparency around its data retention policies?

Or what about Microsoft, similarly ranked, which the EFF says should clarify its data retention policies and disclose what government content removal requests it receives?

Those who take the EFF`s ratings to heart will probably want to stick with Apple and Dropbox for communications: both got a top-notch, 5-star rating this year, having adopted every best practice the organization has ranked.

Read original article