Pakistan Bans BES

Pakistan is set to ban the BlackBerry Enterprise Service (BES) over government concerns that state spooks can't tap conversations made over the corporate communications platform.

The Ministry of Interior told regulator the Pakistan Telecommunication Authority (PTA) on Friday to co-ordinate the block – instructing mobile phone companies to ensure there are no BES services available in the country from 30 November.

`The decision to block the BES was taken on the directives of the interior ministry due to security reasons,` PTA spokesperson, Khurram Mehran, told The Express Tribune.

`There was a challenge that the BlackBerry email service could not be tracked or decoded, which leads to the security reasons.`

Mehran claimed that there are fewer than 5000 BES users in Pakistan, so the decision would not cause widespread business disruption.

The more consumer-oriented BlackBerry Internet Service (BIS), however, will not be touched by the authorities, presumable because carriers can already be instructed to allow law enforcers to monitor communications made via the platform.

BES has been suspended in Pakistan before for vague `security reasons` but never banned permanently, although the PTA tried back in 2011.

The move comes as governments around the world become increasingly intolerant to strong encryption in communications products and services.

Intelligence services in the US and UK in particular are lobbying hard to force providers to build backdoors into their products so law enforcers can gain access if it is deemed necessary by a court.

Rights groups are unsurprisingly strongly opposed to such moves, and security experts have pointed out that were such backdoors built into platforms, they would eventually find their way onto the cybercrime underground, exposing businesses to the black hats.

There's also little evidence to suggest that being able to request such access would give law enforcers a vital pre-warning in the case of attacks such as those perpetrated on Charlie Hebdo.

Read original article

Fiat Chrysler recalls

In the wake of the demonstration of a vulnerability in the `connected car` software used in a large number of Chrysler and Dodge vehicles in the United States, Fiat Chrysler NV announced today that it was recalling approximately 1.4 million vehicles for emergency security patches.

The company has already issued a patch on its website for drivers, and on Thursday it performed an over-the-air update of some vehicles to block unauthorized remote access, Bloomberg Business reports. The vulnerability, revealed in a report by Wired earlier this week, allowed security researchers Charlie Miller and Chris Valasek to take remote control of a Jeep Cherokee`s onboard computer and entertainment system, remotely controlling the throttle of the vehicle while a Wired reporter was driving it at 70mph on a St. Louis-area interstate highway. Miller and Valasek also demonstrated that they could take control of the vehicle`s brakes and (in some cases) even its steering, as well as the vehicle`s windshield wipers, navigation, and entertainment systems.

The vehicles covered by the recall include the 2015 model year Dodge Ram pickup, Dodge`s Challenger and Viper, and the Jeep Cherokee and Grand Cherokee SUVs. While Fiat Chrysler officials said that there was no known real-world use of the vulnerablity (outside Miller`s and Valasek`s proof of concept), they were taking the recall step out of `an abundance of caution.`

There isn`t a read-only CAN bus. There could be, if a hardware CAN firewall were made...

Basically the CAN bus is how all car systems talk to each other. It`s just one bus for the car and it`s kind of neat in its implementation: each message contains its own priority and that`s used for bus conflicts. MessageIDs are either 11 or 29-bit numbers and lower numbers are higher priority. AIRBAG_WLAMP is 0x12 so it`s quite high priority, to light up an airbag malfunction. 0s on the bus take priority and transmitting devices also listen at the same time, and if what they see on the bus isn`t what they are transmitting they stop for the higher priority message to go through.

What makes this function is that per the standards, only one device is allowed to send any given message ID. Your brake system can`t send an AIRBAG_WLAMP, and your entertainment system sure as hell can`t tell the brakes that the radar detects an imminent collision please press the brakes hard as hell. This is normally fine because yeah, the uConnect doesn`t know how to send those messages so no problem, right?

The remotely accessible nature of the system combined with a vulnerability in the system combine to allow the attacker to overwrite the firmware of the entertainment system, teaching it how to send all these nifty CAN bus messages, thus allowing this.

I doubt that the recall will involve this, but having a hardware firewall between the CAN bus and the remotely accessible portions would be a real solution - the hardware would have to have two transceivers, allow all CAN traffic through to the entertainment system, but only allow some specific messages back through (with potential sanity checks on the content of said messages). That way you get the nifty remote-start features without the ability to remotely disable the brakes because the system thinks it`s trying to park for you

Read original article

Better Faster Tor

Tor, the world`s largest and most well-known `onion router` network, offers a degree of anonymity that has made it a popular tool of journalists, dissidents, and everyday Internet users who are trying to avoid government or corporate censorship (as well as Internet drug lords and child pornographers). But one thing that it doesn`t offer is speed—its complex encrypted `circuits` bring Web browsing and other tasks to a crawl. That means that users seeking to move larger amounts of data have had to rely on virtual private networks—which while they are anonymous, are much less protected than Tor (since VPN providers—and anyone who has access to their logs—can see who users are).

A group of researchers—Chen Chen, Daniele Enrico Asoni, David Barrera, and Adrian Perrig of the Swiss Federal Institute of Technology (ETH) in Zürich and George Danezis of University College London—may have found a new balance between privacy and performance. In a paper published this week, the group described an anonymizing network called HORNET (High-speed Onion Routing at the NETwork layer), an onion-routing network that could become the next generation of Tor. According to the researchers, HORNET moves anonymized Internet traffic at speeds of up to 93 gigabits per second. And because it sheds parts of Tor`s network routing management, it can be scaled to support large numbers of users with minimal overhead, they claim.

Like Tor, HORNET encrypts encapsulated network requests in `onions`—with each layer being decrypted by each node passing the traffic along to retrieve instructions on where to next send the data. But HORNET uses two different onion protocols for protecting anonymity of requests to the open internet and a modified version of Tor`s `rendezvous point` negotiation for communication with a site concealed within the HORNET network.

When sending a request to a site that isn`t protected by HORNET, a more Tor-like `Sphinx` onion protocol is first used to set up the channel. `Each Sphinx packet allows a source node to establish a set of symmetric keys, one for each node on the path through which packets are routed,` the researchers explained. Those keys, created via a Diffie-Helman exchange, are used to encrypt the `Forwarding Segment`—the chain of session state information for the stream of data packets that follow. `The Forwarding Segment allows its creating node to dynamically retrieve the embedded information (i.e., next hop, shared key, session expiration time), while hiding this information from unauthorized third parties,` Chen et al wrote.

For the actual data packets, the sending system collects all of the forwarding segments from each node on the channel to the destination and combines them into what the researchers call an anonymous header (AHDR). `An AHDR grants each node on the path access to the forwarding segment it created, without divulging any information about the path except for a node's previous and next nodes,` they explained. The data itself is `onioned`, encrypted with the keys for each of the nodes in the channel, until it reaches its destination. The upside of this approach, Chen et al said, is that it drastically reduces the cryptography work required for each packet, as well as the amount of session flow information the network has to manage.

For communications between two nodes that are both anonymized by HORNET—a scenario like Tor`s method of connecting users` requests to `hidden services`—the researchers propose an approach that lets any node on the network act as a rendezvous point for communication to keep both the source and destination of traffic hidden from each other. Hidden services select a rendezvous point and set up a session using the Sphinx protocol, then publish an AHDR to a directory that has the encrypted information about how to get from the rendezvous point to the service. When a client goes to connect to a service, it finds the rendezvous point in the directory, along with the AHDR for the trip to the service, and then builds its own connection to the rendezvous point—adding the AHDR provided to get to the service to its own and a header with information for the return trip back.

The upsides of this scheme—in addition to the fact that any node can act as a rendezvous point without having to maintain state information about the connection—are that a service can advertise multiple rendezvous points in a directory, and a client can pick one that is closest in terms of network time. The two ends can also re-negotiate the route traffic takes through a better rendezvous point to improve performance as channels are expired. On the downside, the size of the headers used to communicate between the two is doubled in size,

As implemented in its testing, HORNET`s routing nodes can actually be embedded in network routers. The researchers build HORNET infrastructure code into Intel software routers using the Data Plane Development Kit (DPDK). HORNET client code, which included hidden services, was built in Python. `To our knowledge, no other anonymity protocols have been implemented in a router SDK,` the researchers wrote.

HORNET, like Tor, is not immune to targeted attacks on anonymity. If an attacker, such as a government agency or law enforcement organization, could control more than one of the nodes along a path selected for a HORNET channel, they would be able to perform `confirmation attacks`—the sort of timing analysis, flow analysis, and packet tagging that other security researchers have demonstrated could be used against Tor. `HORNET cannot prevent such confirmation attacks targeting individual users,` the researchers concluded. `However, HORNET raises the bar of deploying such attacks for secretive mass surveillance: the adversary must be capable of controlling a significant percentage of ISPs often residing in multiple geopolitical boundaries, not to mention keeping such massive activity confidential.`

Read original article

ID Theft Case

A lawsuit seeking class-action status filed against information services firm Experian alleges the company failed to detect that a customer of its data aggregator unit was a fraudster.

The customer allegedly provided false business information to mask his intent to use the information purchased to commit fraud.

The Experian subsidiary involved in the case, Court Ventures, an aggregator of electronically available U.S. public records data, accepted the business of this customer, Vietnamese national Hieu Minh Ngo, years before Experian acquired Court Ventures in March 2012. It wasn`t until well after Experian had taken Court Ventures under its belt that the sale of PII to Ngo was called into question.

Ngo was sentenced July 14 to 13 years in prison for selling to other cybercriminals fraudulently obtained PII. The lawsuit against Experian was filed July 17.

Vetting Customers

Cybersecurity and privacy attorney Ron Raether, who is not involved in the case, says the lawsuit against Experian is far from cut-and-dry. `The big question here is related credentialing,` says Raether, a partner at law firm Faruki Ireland & Cox. `What was Experian doing to ensure its business customers were legitimate?`

Experian should have conducted due diligence research into Court Ventures` credentialing/client verification process before it acquired the firm, Raether contends. `Firms want to make sure that the processes and procedures used by companies they acquire are on par with their own policies, processes and procedures,` he says.

ChoicePoint Case Was Similar

Cybersecurity attorney Chris Pierson, who is not involved in the Experian case, says the Experian lawsuit raises issues similar to those raised by the Federal Trade Commission in its complaint against data aggregation firm ChoicePoint, which eventually agreed to a $15 million settlement.

The FTC in 2006 cited ChoicePoint for failing to protect consumers` personal information. The FTC claimed that ChoicePoint sold PII about some 163,000 consumers to an alleged crime ring that provided fraudulent business information when it signed on to be a ChoicePoint customer. ChoicePoint was acquired in February 2008 by legal research firm LexisNexis Risk Solutions.

ChoicePoint settled the case with the FTC, agreeing to pay $10 million in civil penalties and $5 million in consumer redress. The settlement requires ChoicePoint, now part of LexisNexis, to obtain audits by an independent third-party security professional every other year until 2026.

Pierson contends that if plaintiffs in the Experian case can prove the company was negligent in its customer verification processes and procedures, they could have a solid case.

`The situation of alleged improper access is similar to ... ChoicePoint,` says Pierson, who serves as chief security officer at an invoicing and payments provider. `A person was able to gain approved access to the credit information of consumers based on false pretenses and use this data to help in the commission of other identity crimes.`

Ensuring that know-your-customer reviews are completed before giving a customer access to sensitive consumer information is critical, he adds.

`When dealing with identity thieves, advanced controls are needed that are more sophisticated, because the ability of these persons to `fake` a real company are really good,` Pierson says.

Plaintiffs` Claims

In the lawsuit against Experian, plaintiffs claim that Ngo was a Court Ventures customer who feigned to be a private investigator, but was actually an identity thief who sold the PII he purchased to other criminals on the Superget.info and findget.me fraudster websites he owned and managed.

Last week, the Department of Justice announced that Ngo had been sentenced to 13 years in prison after pleading guilty to illegitimately buying, and in some cases stealing, U.S. consumers` PII from numerous U.S. companies and then selling it on his websites (see Breached PII: Why KBA Has to Go).

The Internal Revenue Service has confirmed that 13,673 U.S. citizens, whose stolen PII was sold on Ngo`s websites, have been victimized through the filing of $65 million in fraudulent tax returns.

In the lawsuit, plaintiffs` attorneys name specific individuals who say their PII data sold to Ngo through Experian was used to file fraudulent federal tax returns and commit `other acts of identity theft and/or identity fraud.`

Experian declined to comment about the pending class-action litigation, as did attorneys for the plaintiffs. But last year, Experian issued a statement about the Court Ventures incident, noting that `no Experian database was accessed.`

Authentication is Key

Had Court Ventures and Experian done more to authenticate and verify the validity of their customers, Ngo never would have been granted access to so much sensitive information, contends Tom Kellermann, chief cybersecurity officer at threat intelligence firm Trend Micro.

Data-aggregation firms should be required to put limits on the kind of information customers are allowed to access, he argues.

`This case is all about information supply chain management,` Kellermann says. `It`s ironic to me that there are contracts written to manage these types of risks, but there is no mandate for more stringent security controls.`

Compensating Consumers

The lawsuit claims that Experian violated the Fair Credit Reporting Act, which regulates the collection, dissemination and use of consumer information, including consumer credit information. Plaintiffs are seeking to recover unspecified statutory damages, and they are asking the court to require Experian to notify each U.S. citizen whose PII was accessed by Ngo, or sold to him or one of his fraudster customers.

The suit also asks that Experian be required to provide credit monitoring and `substantial` ID theft coverage to each affected consumer and establish a fund to provide consumers with reimbursement for expenses and losses they`ve had to pay for ID fraud or ID theft remediation.

Financial fraud expert Avivah Litan, an analyst at the consultancy Gartner, predicts that more lawsuits will ask that funds be established to provide consumers a means of monetary compensation.

`Maybe these cases will have an impact on shedding light on the limitation of much of these credit monitoring services and how they do very little to help consumers whose information or payment data has been compromised,` she says.

Read original article

Terror on Wheels

Hacks of the IT used to run cars have been a story for years—but a new approach using simple radio waves should, well, make waves for automakers.

NCC Group says that it has developed an exploit that infiltrates a car's `infotainment` system via everyday digital audio broadcasting (DAB) radio signals. A remote attacker from there could take control of various critical control systems—including the brakes, and the steering. And yes, that's terrifying.

NCC research director Andy Davis explained to the BBC that network sequestration is the issue here—taking over the fun and colorful (did we/should we say `distracting?`) radio display in the dash is one thing—but once a hacker is in, he or she or they can simply pivot to gain control of critical systems, including steering and braking.

Worse, the security firm said that it was able to transmit the malignant DAB signal using a laptop and a box made from cheap, easily accessible parts—no specialized equipment required. And, the bigger the signal booster, the larger the affective radius. In other words, it's called `broadcast` for a reason, and in theory, the signal could be sent to many cars at once.

`As this is a broadcast medium, if you had a vulnerability within a certain infotainment system in a certain manufacturer`s vehicle, by sending one stream of data, you could attack many cars simultaneously,` he said. `An attacker would probably choose a common radio station to broadcast over the top of to make sure they reached the maximum number of target vehicles.`

All together now: `Aiiiiiggggggggggghhhhhhhhh!!! Aiiiggghhhhhhhhhhhhhh!!!!!`

OK, now that we have that out of our system…it's important to remember that clearly, it would take some doing to actually execute this kind of attack. The car couldn't be moving very fast, for one, unless the attackers had a whole radio station tower to use to transmit the malicious airwaves.

Davis didn't say which cars featured the flaw. According to the BBC, which first reported the story, the UK`s Society of Motor Manufacturers and Traders has responded by saying that car companies `invest billions of pounds to keep vehicles secure as possible.`

Does that sound a little defensive to you? Me too.

But, one could get around that by using the mobile phone network. Chris Valasek, director of vehicle security research at IOActive, and Charlie Miller, the renowned white hat and Twitter researcher that has made mobile hacks a specialty, have done just that, and are prepping a similar exploit to show off at Black Hat 2015 in August.

They were able to remotely take control of a Jeep Cherokee`s air-conditioning system, radio and windshield wipers, using the mobile phone network and the car's internal 4G connection. They demonstrated this to an unaware journalist at 70 MPH as well. And even uploaded a picture of themselves to the affected car's dash display, just to ratchet up the poor guy's terror.

Using the mobile network improves reach, but requires specialized know-how and equipment, unlike the NCC hack. `We took over the infotainment system and from there reprogrammed certain pieces of the vehicle so we could send control commands,` Valasek said. `It takes a lot of time skill and money. That isn`t to say that there aren`t large organizations interested in it.`

But someday—won't someone be able to achieve BOTH ease-of-exploit and effectiveness?

Read original article

Alfa Insurance Breach

Alfa Specialty Insurance Corporation and Alfa Vision Insurance Corporation are notifying around 86,000 individuals that their personal information was inadvertently made accessible to the internet.

How many victims? Around 86,000.

What type of personal information? Names, addresses, dates of birth, driver`s license numbers and Social Security numbers.

What happened? Information stored on one of Alfa`s computer servers at a Tennessee location was inadvertently accessible to the internet.

What was the response? Alfa secured the computer server so that the information is no longer accessible to the internet, and removed data cached on the internet. All potentially impacted individuals are being notified, and offered free identity protection and credit monitoring services.

Details: Alfa learned of the issue on May 4.

Quote: `While we are not aware of any attempted or actual misuse of your information, this notice is being provided so you may take steps to monitor your identity,` a notification letter said.

Read original article

Password Strength Meters

I've spent a depressingly large proportion of the last few years writing about the fact that so few people recognize that they're using poor password and PIN selection strategies. This is unsurprising, perhaps. After all, this issue is not just technological, but psychological and even ergonomic. If you're not confident of your ability to create a sound password, you might use a password strength meter like Microsoft's. I can't vouch for how good it is, but a lot of people seem to find it helpful to have some guidance.

However, an article by Mark Stockley for Sophos suggests that a poor meter may be worse than useless. He took five of the 10,000 most common passwords, according to xato.net, all of which the cracking software John The Ripper cracked more or less instantly, and then ran them against five plug-in strength meters. One meter categorized all five as good, another classified two of them as good. Ten were classified as weak by various meters, six as medium, and two as 'norm' (normal, presumably).

Stockley's contention is that:

A password strength meter that doesn't reject all five out of hand is not up to the job of measuring password strength.

They all failed. And not only that, they don't agree.

Well, I won't disagree: the results are inconsistent between meters and the classifications are misleading, unless you believe that 'iloveyou!' or even 'abc123' are good passwords. Why did they fail so spectacularly? The answer lies in the fact that the harshest categorization is 'weak'.

There are a number of characteristics you can use to assess the strength and entropy (randomness or unpredictability) of a password or, preferably, passphrase, such as:
Number of characters
Variety of characters – a very long password consisting of the same repeated character is not resistant to password cracking software
The types of character used: alphabetical, numeric, symbols and special characters, and where they're placed in relation to the other characters. (To take a simple example, when people append a number to their password which is augmented every time they're required to change it, that offers no effective barrier to password-cracking software.)

There are any number of algorithms that might be used to assess the effectiveness of a given string used as a passphrase. Obviously, some are better than others and you have to expect some variation in categorization. I tried the same passwords against the Microsoft checker, which wasn't one of those tested by Stockley

Clearly, there isn't a separate category for 'Don't use this password because an awful lot of other people already do so hackers will find it quickly'. And the fact that trustno1, confirmed by at least one other list to be far more common than ncc1701, is categorized as medium, suggests that ranking (or appearing at all) on such lists is not one of the categorization criteria applied by the Microsoft meter or, apparently, any of the five tested by Stockley.

That's not to say that the lists are only used by password crackers. At one time, Twitter used a script to check passwords created by its users against a list of strings: if someone tried to set a password that was found on the list, it would not be allowed. And yes, abc123, trustno1, and ncc1701 could be found there (the list was very trivially obfuscated). iloveyou! wasn't included, though iloveyou was. Nor was primetime21 or anything close to it.

So how do these meters reach their conclusions? Well, one of them considered all five of those passwords 'good', so maybe it doesn't have any negative criteria. All the others considered abc123 weak, even though it consists of a mix of letters and numbers, perhaps because it features two strictly serial sequences (abc and 123).

Perhaps ncc1701 fares better according to some meters because it doesn't include a dictionary word (though it is, of course, the instantly recognizable number of the Starship Enterprise, which is why so many people use it). iloveyou! probably gains favor because strength meters like passwords that include punctuation characters.

Read original article

MongoDB Instances issues

Nearly 30,000 MongoDB instances are accessible over the Internet without any authorization enabled, an expert has warned.

With more than 10 million downloads, 2,000 customers and 1,000 partners, MongoDB is the most popular NoSQL database system. MongoDB is used by organizations such as eBay, LinkedIn, SAP and Sourceforge.

According to John Matherly, founder of the computer search engine Shodan, roughly 30,000 MongoDB instances containing nearly 600TB of data are exposed on the Internet.

The expert said he was surprised by the results of the Shodan search considering that the `mongodb.conf` configuration file available on GitHub since 2013 specified that MongoDB listens on localhost by default.

The issue was reported in early 2012 by Roman Shtylman (SERVER-4216), but it took MongoDB developers more than two years to actually address it.

`The default install of mongodb ... does not have a 'bind_ip 127.0.0.1' option set in the mongodb.conf,` Shtylman warned in 2012. `This leaves a user's server vulnerable if they are not aware of this setting. The default should be to lockdown as much as possible and only expose if the user requests it.`

Matherly says MongoDB 2.4.14, a maintenance release from April 28, 2015, is the last version that still listens to 0.0.0.0 by default, which means listening is enabled on all interfaces. The expert believes early versions of MongoDB 2.6 might also lack binding to localhost.

Matherly also noticed that a majority of the publicly accessible MongoDB instances are hosted in the cloud, particularly DigitalOcean, Amazon, Linode and OVH.

`I`ve actually observed this trend across the board: cloud instances tend to be more vulnerable than the traditional datacenter hosting. My guess is that cloud images don`t get updated as often, which translates into people deploying old and insecure versions of software,` the expert said in a blog post.

These poorly configured instances expose a total of 595.2TB of data. The ten most common database names identified as a result of the Shodan search are local, admin, db, test, config, mydb, video, hackedDB, storage, and trash.

`Faceting on the database name reveals widespread installations that might`ve been misconfigured or otherwise exposed. There are a lot of instances that have some sort of administrative database, so the app that uses MongoDB probably has authentication but the database itself doesn`t,` said Matherly.

This isn't the first time researchers report finding MongoDB databases exposed on the Web. In February, students from the Saarland University in Germany revealed finding nearly 40,000 exposed instances.

The experts noted at the time that many precompiled MongoDB packages are shipped with a default configuration that binds the service to the localhost (bind_ip is set to 127.0.0.1). However, since in many cases the database and the service using the database are running on different machines, developers remove the `bind_ip` flag to allow all network connections to the database.

This allows access from outside the trusted network and if transfer encryption and proper access control are not set up, the database becomes exposed, researchers said.

MongoDB is encouraging users to follow best security practices to ensure their instances are protected against potential attacks.

`Recently a blog post was published that claimed some users had not properly secured their instances of MongoDB and were therefore at risk. As the article explains, the potential issue is a result of how a user might configure their deployment without security enabled. There is no security issue with MongoDB - extensive security capabilities are included with MongoDB,` Kelly Stirman, VP of Strategy at MongoDB, told SecurityWeek.

`We encourage all users to follow the guidelines we prescribe for security. Security best practices are summarised here, or customers can contact MongoDB support. This is an important opportunity for everyone to ensure they are following security best practices.`

Read original article

Facebook Vs Belgium

In privacy cases, European internet companies may not be subject to just their home regulator, explains Sam Pfeifle

Being the world's biggest social media platform has its advantages: the pick of the world's top talent, a voice on the national policy stage, and a growing revenue stream among them.

But it has its drawbacks, too. Facebook currently finds itself in the unenviable spot of being part of a test case in similar fashion to Google, just a few years back. Just as Spain used Google to show that it, indeed, had jurisdiction to bring an enforcement action, regardless of where Google is headquartered, so, too, is Belgium (alongside Spain, Germany, and the Netherlands) using Facebook to show that it has the right to regulate a company, even if the company's EU headquarters reside inside a different set of borders.

Ostensibly, Belgium and its partners are looking at how the Facebook Like button sets a cookie and how the site tracks users who don't have accounts or aren't logged in, but the privacy industry doesn't much care about all that, truth be told. Facebook has shown itself, through its response to FTC enforcement action for example, to be a good corporate privacy citizen. If a regulator tells finds it to be violating privacy law, it takes the required corrective action and figure it out.

The company's momentum is not likely to be derailed by having to tweak cookie policy at Belgium's behest.

Rather, what industry observers care about is whether, under the current European Data Privacy Directive, and, going forward under the proposed European General Data Privacy Regulation, companies in the EU are going to find themselves under the jurisdiction of 28 separate regulators all interpreting the law in their own separate way, or whether they can expect to be under the auspices of a single privacy regulator.

Large companies are in the business of predicting risk. How will markets change, consumers' desires change, world environmental conditions change in ways that will affect their ability to turn a profit? All of those, of course, are difficult to pin down. Generally, however, the law is a fairly slow-moving target. Companies peg their risk against operating in a jurisdiction with a certain law and lay plans accordingly.

If a bill is introduced that would change that risk assessment, they monitor it and adjust if necessary.

However, these risk managers wonder, how is a company to lay plans and operate in a world where there is a single law, but 28 potential interpretations?

In the case of Facebook, the company's cookie practices have been audited by their regulator in Ireland and deemed up to snuff. And thus they went forward. Now, however, they are told by another country, operating under the same directive, that they are not up to snuff.

You can see why they sound like a child arguing with her mother: `But dad said it was okay!`

`If there is really to be such thing as an EU Digital Single Market, where companies can operate in the EU with the freedom that the internet provides, how can they be asked to abide by 28 different sets of privacy law?`

You might also see why there is momentum in the European policy community for the so-called 'one-stop shop' in the proposed Data Privacy Regulation. If there is really to be such thing as an EU Digital Single Market, where companies can operate in the EU with the freedom that the internet provides, how can they be asked to abide by 28 different sets of privacy law?

However, there is of course the opposite argument: If privacy is actually a human right, and someone feels that human right has been violated, how is that they don't have redress against the company who committed that violation just because a regulator in some other country decided it wasn't really a violation?

These countries in Europe have long and storied histories and it's understandable that they would have differing cultural opinions about what constitutes something like a legitimate interest to process data.

Thus, all eyes are on this Facebook case. Given the proposed Regulation has already been three years in development, we may find ourselves under the current Directive for some time yet. Is it now open season on internet companies? Or can companies be reasonably confident that their home regulator is all they need to worry about?

And as the Regulation comes into focus, will this case swing public opinion toward the one-stop shop or away from it?

It is not an exaggeration to say just about every company collecting personal data puts itself in Facebook's shoes and awaits the answer just as expectantly.

Read original article

Fiat Chrysler bug

A pair of computer security researchers based in St. Louis demonstrated weaknesses in an automobile system with cellular connectivity installed in as many as 471,000 vehicles in the US. Charlie Miller and Chris Valasek highlighted the vulnerability of the system by attacking a Jeep Cherokee equipped with the Uconnect system remotely while Wired`s Andy Greenberg was driving it.

Uconnect, a `connected car` system sold in a number of vehicles produced by Fiat Chrysler for the US market, uses the Sprint cellular network to connect to the Internet and allows owners to interact with their vehicle over their smartphone—performing tasks like remote engine start, obtaining the location of the vehicle via GPS, and activating anti-theft features. But vulnerabilities in Uconnect, which Fiat Chrysler has issued a patch for, made it possible for an attacker to scan Sprint`s cellular network for Uconnect-equipped vehicles, obtaining their location and vehicle identification information. Miller and Valasek demonstrated that they could then attack the systems within the car via the IP address of the vehicle, allowing them to turn the engine of the car off, turn the brakes on or off, remotely activate the windshield wipers, and take control of the vehicle`s information display and entertainment system.

Miller and Valasek also found that they could take remote control of the steering of their test vehicle, the aforementioned Jeep Cherokee—but only while it was in reverse.

In 2013, the two researchers conducted DARPA-funded research into vehicle security, demonstrating vulnerabilities that could be exploited in vehicles from a wide range of automakers. But these attacks required a direct connection to the vehicle. The Uconnect vulnerabilities are unique in that they can be launched against a vehicle from practically anywhere via a connection to Sprint`s cellular network.

Fiat Chrysler alerted customers to the vulnerability in its vehicles on July 16 with a notice on its website, but the patch the company has released must be manually installed from a USB drive by the owners or a dealer.

Read original article

OpenSSH Bug

A recently disclosed bug in OpenSSH software used to remotely access Internet-facing computers and servers allows attackers to make thousands of password guesses in a short period of time, a defect that could open systems to password cracking, a security researcher has warned.

Under normal circumstances, OpenSSH will allow just three or six login attempts before closing a connection, the researcher who goes by the moniker KingCope wrote in a blog post published last week. The recently discovered vulnerability, however, allows attackers to perform thousands of authentication requests during an open login window, which by default lasts two minutes. As a result, attackers who cycle through the most commonly used passwords face much better odds of finding the right one, since the vulnerability allows them to try many more candidates than they otherwise would.

The post includes exploit code that works with the latest release of OpenSSH, which is version 6.9. In a separate post, KingCope said his exploit worked against a version of OpenSSH included in a 2007 release of the FreeBSD operating system. OpenSSH developers didn`t respond to an e-mail seeking comment for this article.

In some respects, the severity of vulnerability can be viewed as mild. But that assumes OpenSSH users are using a cryptographic key for authentication. Under such an arrangement, only computers with the private key are able to access the Internet-facing server. On top of that, servers themselves should be configured to limit the number of login attempts, and that measure should also go a long way toward making exploitation impractical.

In other respects, the vulnerability has the potential to create serious problems. Brute-force password attacks against SSH-enabled machines are a regular event, suggesting that enough servers remain vulnerable to password guessing to make it worth attackers` time.

Sadly, SSH brute-force attacks are still a credible threat on the Internet, so this vulnerability will make those attacks easier and more efficient,` Jon Oberheide, CTO of two-factor authentication provider Duo Security, told Ars. `It`s one of those bugs where the well-configured servers won`t be affected at all, but the poorly configured servers that were already at risk due to low-throughput brute-force attacks are now at even greater risk.`

People who rely on OpenSSH should take the time to ensure that they`re using a cryptographic key pair that`s at least 2,048 bits in length. They should also make sure the private key is protected by a strong password. And again, users should ensure servers are configured to use rate limiting. Still, assuming OpenSSH developers fix the bug, users should install the patch out of an abundance of caution.

Read original article

37 Million Cheaters exposed

Hackers have stolen 37 million records for customers of Ashley Madison, the online `dating` website for married people looking to have an affair. The information includes `all the customers` secret sexual fantasies and matching credit card transactions,` the perpetrators said.

`The secretive nature of Ashley Madison and its especially intimate customer information means that this breach is particularly worrying to the site's subscribers,` John Smith, principal solution architect at Veracode, said via email.

The hackers, who call themselves The Impact Team, said they plan to release real names, profiles, nude photos, credit card details and `secret sexual fantasies` unless their demands were met, according to independent researcher Brian Krebs.

Apparently, those demands are motivated by morality. Ashley Madison, which carries the tagline, `Life is short. Have an affair` is only one of a few `niche` offerings from Canada-based Avid Media. It also runs sugar-daddy site Established Men, and CougarLife, which caters for women looking for `a young stud` and younger men who would like to play that part. The hackers apparently have no issue with the latter…but said that they also want Established Men shut down.

It's unlikely that the site will bow to the demands easily. Cheating is big business, and Ashley Madison has been prepping for an IPO with an eye to raising $200 million on the London Stock Exchange.

`Shutting down AM (Ashley Madison) and EM (Established Men) will cost you, but non-compliance will cost you more,` the hackers said.

Avid said that the incursion has been stopped and the site secured. It also characterized the attack as `cyber–terrorism,` and lumped itself in with the other companies that have seen data breaches of late, saying that despite `stringent security,` it was not enough, `as other companies have experienced.`

`We apologize for this unprovoked and criminal intrusion into our customers` information,` the company said in a statement. `The current business world has proven to be one in which no company`s online assets are safe from cyber-vandalism, with Avid Life Media being only the latest among many companies to have been attacked, despite investing in the latest privacy and security technologies.`

Smith noted that this is a lackluster take on the situation and signals a lack of responsibility. `Whilst Ashley Madison sold a service to its users which promised secure deletion of their personal data, it seems in reality that it did not completely purge all of that data from all systems,` he said. `As businesses collect and hold personal data they have a duty of care to protect that information against a wide range of threats, whether it is a malicious insider (as may be the case here), an external attacker or accidental release.`

And indeed, these hackers themselves said that users who had paid a fee to Avid Life to have their personal data permanently deleted had been duped—the company had actually retained records, including credit card information.

Read original article

More Retailers Hit

CVS, Rite-Aid, Sam`s Club, Walmart Canada and other large retail chains have suspended their online photo services following a suspected hack attack against a third-party service provider that may, in some cases, have resulted in the compromise of payment card data.

The suspected breach centers on PNI Digital Media Inc., a Vancouver-based firm that manages and hosts online photo services for numerous retailers. The incident serves as a reminder of the security challenges that organizations face when it comes to managing their third-party vendors and entrusting them with sensitive customer information.

Numerous chains have confirmed that they are investigating potential breaches - some involving payment card data - after being warned by PNI Digital Media that it may have suffered a hack attack that resulted in the compromise of retailers` customers` names, addresses, phone numbers, email addresses, photo account passwords and credit card information. But none of the retailers involved have so far reported that they believe the breach would affect any of their in-store customers, including anyone who used in-store photo services.

PNI Digital Media did not immediately respond to a request for comment on its reported breach investigation. Until July 17, the company`s investors page reported that it worked with numerous retailers, and while that page is now blank, a recent version cached by Google`s search engine reads: `PNI Digital Media provides a proprietary transactional software platform that is used by leading retailers such as Costco, Walmart Canada, and CVS/pharmacy to sell millions of personalized products every year. Last year, the PNI Digital Media platform worked with over 19,000 retail locations and 8,000 kiosks to generate more than 18M transactions for personalized products.`

CVS Confirms Investigation

On July 17, CVS spokesman Mike DeAngelis confirmed that CVSPhoto.com may have been affected by the suspected PNI Digital Media breach. `We disabled the site as a matter of precaution while this matter is being investigated,` DeAngelis tells Information Security Media Group.

The cvsphoto.com site now reads in part: `We have been made aware that customer credit card information collected by the independent vendor who manages and hosts CVSPhoto.com may have been compromised. As a precaution, as our investigation is underway we are temporarily shutting down access to online and related mobile photo services. We apologize for the inconvenience.`

CVS says PNI Digital Media collects credit and debit information for customers who purchase online photo services through CVSPhoto.com. Accordingly, CVS recommends that all customers of its online photo service review their credit card statements `for any fraudulent or suspicious activity` and notify their bank or card issuer if anything appears to be amiss. `Nothing is more central to us than protecting the privacy and security of our customer information, including financial information,` CVS says. `We are working closely with the vendor and our financial partners and will share updates as we know more.`

Rite Aid: No Suspected Card Theft

Drugstore chain Rite Aid has also taken its online and mobile photo services offline. `We recently were advised by PNI Digital Media, the third party that manages and hosts mywayphotos.riteaid.com, that it is investigating a possible compromise of certain online and mobile photo account customer data,` Rite Aid`s site reads. `The data that may have been affected is name, address, phone number, email address, photo account password and credit card information.`

Unlike CVS, however, Rite Aid reports that it does not believe that its customers` payment-card data is at risk. `Unlike for other PNI customers, PNI does not process credit card information on Rite Aid`s behalf and PNI has limited access to this information,` it says, adding that it has received no related fraud reports from its customers.

Sam`s Club has also taken its online photo service offline, `in an abundance of caution and as a result of recent reports suggesting a potential security compromise of the third-party vendor that hosts Sam`s Photo website.` As with Rite Aid, however, Sam`s Club reports that `at this time, we do not believe customer credit card data has been put at risk.`

Costco and Tesco Photo have also suspended their online photo services.

Walmart Canada, which also outsources online photo services to PNI, also may have been affected by the possible breach, according to the The Toronto Star, and the retailer has since suspended its online photo services website. `We were recently informed of a potential compromise of customer credit card data involving Walmart Canada`s Photocentre website, www.walmartphotocentre.ca,` Walmart states. `We immediately launched an investigation and will be contacting customers who may be impacted. At this time, we have no reason to believe that Walmart.ca, Walmart.com or in-store transactions are affected.

Walmart did not respond to Information Security Media Group`s request for comment. ISMG also reached out to office supplier Staples, which owns PNI, but did not get a response.

`PNI is investigating a potential credit card data security issue,` a Staples spokesperson told The Toronto Star.

Growing Third-Party Breach Concerns

PNI`s potential breach comes just a week after Denver-based managed services provider Service Systems Associates announced that a breach linked to a malware attack against its network had likely affected about 12 of the payments systems it operates for gifts shops at retail locations, which include zoos, museums and parks, across the country (see Denver POS Service Provider Breached).

Service Systems Associates says debit and credit purchases made between March 23 and June 25 may have been compromised.

On July 7, the Financial Services Information Sharing and Analysis Center, along with Visa, the U.S. Secret Service and The Retail Cyber Intelligence Sharing Center, which provides threat intelligence for retailers, issued a cybersecurity alert about risks merchants face when dealing with third parties.

The alert lists a number of security recommendations for managing third-party risks, including using multifactor authentication for remote-access login to point-of-sale systems and including specific policies related to outdated operating systems and software in contracts with vendors.

Earlier this month, Chris Bretz, director of payment risk at the FS-ISAC, warned that managed service providers that offer outsourced services to numerous merchants are increasingly being targeted by cybercriminals.

`Criminals continue to find success by targeting smaller retailers that use common IT and payments systems,` Bretz said in an interview with ISMG. `Merchants in industry verticals often use managed service provider systems. There might be 100 merchants that use a managed service provider that provides IT and payment services for their business.`

Read original article

Army National Guard Breach

The Army National Guard has exposed the personal information of more than 850,000 current and former members, by improperly handling a data transfer.

The servicemen and women may have had their names, home addresses, Social Security numbers, and dates of birth exposed when that data was transferred to a non-Department of Defense-accredited data center by a contract employee as part of a budget analysis.

An Army National Guard spokesperson described it as `more of a poor security practice,` than a breach, though classified as a breach.

`We believe the specific files containing personal information were safeguarded and not used to compromise anyone`s identity,` Kurt Rauschenberg told Army Times. `However, we want the public to know what happened just in case.`

IDT911's chairman and founder and the former director of NJ Division of Consumer Affairs, Adam Levin, told Infosecurity that the problem with most government agencies (and thousands of businesses) is that they have `perfected poor security practices as an art form.`

`These sub-par efforts leave the door open to breaches—and literally none was a serious as the recent breach of the Office of Personnel Management where over 22 million Americans have seen their most sensitive information exposed and are now at risk due to an epic security fail,` he said. With breaches having become the third certainty in life, we cannot afford to allow poor security practices to put our people—particularly the defenders of our way of life—in harm's way. This incident demonstrates once more that any system is only as secure as its weakest link and humans have proven yet again that we are the weakest link.`

Read original article

0day attacks exploiting

A string of weaponized attacks targeting Adobe`s Flash media player—including three in the past 10 days—has kept software engineers scrambling to fix the underlying vulnerabilities that make the exploits so dangerous. Fortunately, they have also been busy making structural changes to the way the program interacts with computer operating systems to significantly reduce the damage that can result not only from those specific attacks but entire classes of similar ones.

At the moment, the defenses are fully implemented only in the Flash version included in Google Chrome, having made their debut earlier this week. One of the two mitigations is available in other versions of Flash, and the remaining one is expected to be added to other browsers in August. Had they been widely available earlier, they likely would have blunted the effects of at least some of the three most recent zero-day vulnerabilities, which were leaked following the thorough hack of Hacking Team, the malware-as-a-service provider that catered to governments around the world. To block entire classes of new exploits, Adobe engineers, with the help of their counterparts at Google`s Project Zero team, have made two key changes, which were documented in a blog post published Thursday.

The first, which is currently available only in Chrome, is a new partition added to the heap, which is a large pool of computer memory. The partition isolates different types of memory contents, typically known as objects, from each other so one can`t be used to hijack or otherwise tamper with another. Heap partitioning has long been a mainstay in Chrome and other browsers. Now it`s a key defense in Flash.

Had heap partitioning been a part of Flash earlier, it would have significantly complicated some of the exploits that recently came to light in the Hacking Team breach. That`s because the exploits modified the `Vector.` object after a portion of heap where it had resided was freed. The tampering allowed the attackers to inject malicious code into computer memory and from there install their malicious software on the underlying computer. Similar Vector. tampering was also a part of separate, in-the-wild exploits from earlier this year.

Under the new Flash design, an unmapped space forming a no-man`s land of sorts is put between the Flash heap and the system heap, making it significantly harder for exploit code to access the Vector. object. Not only does it help defend against use-after-free classes of attacks, it also makes it harder to carry out buffer-overflow exploits.

`We have now defended the integrity of Vector buffers from both heap overflow and use-after-free attacks!` the Project Zero researchers wrote. `In the case of a heap overflow within the Flash heap, the Vector buffer objects are simply not there to corrupt. In the case of the use-after-free, when the attacker tries to allocate the Vector. buffer to occupy the free heap chunk of interest, it will not end up being allocated there because it lives in a different heap.`

Read original article

Bug affects cars

A software bug has been discovered by Land Rover in two of its cars. The issue is about a bug in the system that can unlock the doors of the car without warning to the driver.

The company will recall vehicles and do the necessary repairs without any charge to the customers.

The bug affects two models of Land Rover, the Range Rover and Range Rover Sport. 65,000 vehicles have been recalled due to this. The company has placed ads in newspapers and is contacting the owners to call them in for the recall.


Read original article

phone apps at risk

Smartphone apps from Walmart, CNN, ESPN, and dozens of other organizations put user accounts at risk of compromise because they allow attackers to make an unlimited number of login attempts, according to recently published research.

Security experts have long recognized the benefit of limiting the number of unsuccessful login attempts that users can make to online accounts. While such limits make it possible for attackers to lock out legitimate users, such denial-of-service drawbacks are generally outweighed by the protection they provide against online password cracking attempts, in which attackers make huge numbers of password guesses against specific user accounts in the hopes of trying the right one. Until last September, Apple`s iCloud service failed to limit the number of login attempts to that service, a shortcoming that may have contributed to last year`s mass celebrity hack and nude photo thefts.

Despite Apple mending its ways, many smartphone apps still allow users to make an unlimited number of login attempts. That failure allows attackers to cycle through long lists of the most commonly used passwords. Given the difficulty of entering strong passwords on smartphone keyboards, it`s a likely bet that it wouldn`t be hard to compromise a statistically significant number of accounts over a period of weeks.

According to research from smartphone security firm AppBugs, dozens of Android and iPhone apps downloaded more than 300 million times contain no limits on the number of logins that can be attempted. Per the company`s disclosure policy, researchers give app developers up to 90 days to fix vulnerabilities before making them public. That means most of the 50 or so apps identified by AppBugs still aren`t being made public. Still, the grace period has expired on at least 12 apps, including those from CNN, ESPN, Slack, Expedia, Zillow, SoundCloud, Walmart, Songza, iHeartRadio, Domino's Pizza, AutoCAD, and Kobo. Three other apps, from Wunderlist, Dictionary, and Pocket, were found to be vulnerable but were later fixed after AppBugs brought the weaknesses to the developers` attention.

As noted earlier, rate limiting has a dark side because it makes it possible for attackers to lock legitimate users out of their own accounts. Besides putting rate limiting in place, app developers may want to consider two-factor authentication as a means of preventing the compromise of user accounts.

Read original article

TeslaCrypt 2 Ransomware

Researchers at Kaspersky Lab have uncovered version 2.0 of TeslaCrypt, a file-encrypting ransomware first spotted in February 2015.

TeslaCrypt made numerous headlines earlier this year because in addition to the file types targeted by most ransomware, this piece of malware also encrypts video game files. However, the encryption scheme used in some of the earlier versions was not too efficient and researchers managed to develop tools that victims could use to recover encrypted files.

The latest version of TeslaCrypt (detected by Kaspersky as Trojan-Ransom.Win32.Bitman.tk) comes with several improvements, including a new encryption scheme that makes it impossible to recover files encrypted by the malware, Kaspersky experts said.

According to the security firm, TeslaCrypt 2.0 comes with a new ransom screen copied from CryptoWall 3.0. Researchers have pointed out that the first versions of the ransomware used a graphical interface taken from CryptoLocker. In later versions, the malware developers came up with their own design for the ransom screen, and now it appears that they're getting their inspiration from CryptoWall.

It's worth noting that TeslaCrypt authors have not only copied the CryptoWall ransom screen, but they are also using the ransomware's name. Cybercriminals might be leveraging CryptoWall's reputation because many users know that files encrypted by this piece of ransomware cannot be recovered without paying the ransom, experts said.

Kaspersky has also noted that the ransom screen is no longer an application window, but an HTML webpage displayed in the victim's web browser.

The TeslaCrypt 2.0 encryption scheme involves master keys generated for each infected computer, and session keys generated each time the malware is executed on the system.

`Keys are generated using the ECDH algorithm,` Kaspersky's Fedor Sinitsyn explained in a blog post. `The cybercriminals introduced it in versions 0.3.x, but in this version it seems more relevant because it serves a specific purpose, enabling the attackers to decrypt files using a 'master key' alone.`

The malware developers have now completely removed the file decryption feature found in previous versions, Sinitsyn noted.

The malware uses the tor2web service to communicate with its command and control (C&C) servers which are located on the Tor anonymity network. Recent versions of the ransomware encrypt requests using the AES-256-CBC algorithm before sending them to the server.

For evasion, TeslaCrypt 2.0 relies on a technique that involves the use of COM objects. This method has been utilized since version 0.4.0, but it has undergone slight modifications in later versions.

TeslaCrypt has been distributed mainly with the aid of exploit kits such as Angler, Sweet Orange and Nuclear. The highest number of victims was detected by Kaspersky in the United States and Europe.

Read original article

Morrisons data breach

The perils of the disgruntled insider were highlighted again after it was alleged that an employee at supermarket giant Morrisons posted online sensitive personal information on staff because he held a `grudge` against the firm.

Andrew Skelton, 43, a senior internal auditor at the Morrisons head office in Bradford, is accused of leaking the details of nearly 100,000 supermarket employees – a breach which cost the firm over £2 million to mitigate, according to the BBC.

The data, including NI numbers, birth dates and bank account details, was posted online and sent to several newspapers last year, Bradford Crown Court heard.

Skelton had previously been cautioned for using the company`s mail room to conduct eBay deals. After that disciplinary action, he was left harboring a grudge against the supermarket chain, apparently writing in a draft resignation letter found by police: `I have almost as little concern for the company as it does for me.`

Skelton denies fraud by abuse of position, unauthorized access to data with the intent of committing an offence, and disclosing personal data, according to the report.

Todd Partridge, director at secure collaboration provider, Intralinks, argued that companies often fail to recognize the insider threat.

`Companies spend millions defending their data against malicious activities from beyond the corporate firewall yet their own employees are routinely breaching IT policies and placing company documents at risk.

`Morrisons is certainly aware of this threat after spending £2 million to clear up the consequences of a data breach after a disgruntled auditor leaked bank and pay details of 100,000 store staff. This news highlights how the consequences of an attack from the inside can be every bit as serious as being hacked from the outside.`

Research from Intralinks conducted by the Ponemon Institute in the US, UK and Germany late last year found that 51% of organizations aren't convinced they have the ability to manage and control insider access to sensitive documents and how they are shared.

Read original article

Darkode is dismantled

More details are emerging about the international law enforcement operation that dismantled Darkode, described by authorities as the world`s biggest English-language online crime forum. Among the 70 people arrested worldwide are the site`s alleged administrator, aged 27, and a 20-year-old man who allegedly designed malware intended to remotely control and steal data from Google Android devices.

The site had from 250 to 300 active members. Before it was shut down Tuesday, it had been secretly infiltrated by FBI agents for more than 18 months. While monitoring the day-to-day activities of members, agents observed advertised products including personal information of 39,000 people taken from a database of Social Security numbers, 20 million e-mail addresses and user names used in a variety of scams, ransomware programs, and other online criminal wares. Some of the users allegedly took part in hacks late last year on Sony`s PlayStation and Microsoft`s Xbox networks.

`Of the roughly 800 criminal Internet forums worldwide, Darkode represented one of the gravest threats to the integrity of data on computers in the United States and around the world and was the most sophisticated English-speaking forum for criminal computer hackers in the world,` US Attorney Hickton of the Western District of Pennsylvania said in a statement published Wednesday morning. `Through this operation, we have dismantled a cyber hornets` nest of criminal hackers which was believed by many, including the hackers themselves, to be impenetrable.`

Operation Shrouded Horizon, as the enforcement action was dubbed, was coordinated among the FBI and its counterparts in 19 other countries, including the UK, Denmark, Finland, Germany, and Israel. It`s the biggest coordinated international law enforcement action ever directed at an online criminal forum. Like many such forums, Darkode was password-protected and required prospective members to be sponsored by an existing member and then vetted before being accepted. Candidates were required to submit a résumé of past criminal activity, notable hacking skills, and potential contributions to the forum. Active members would then decide whether to approve the applicant.

Word of the Darkode dismantling began spreading Tuesday when publications in Brazil reported arrests made in that country. The enforcement action was formally unveiled by US prosecutors Wednesday morning in Pittsburgh, Pennsylvania.

Read original article

Java ZeroDay

Security experts have discovered a new attack as part of the long-running state-sponsored 'Pawn Storm' campaign using the first Java zero-day threat spotted since 2013.

Malicious emails targeting a NATO member and a US defense firm were caught by researchers at Trend Micro, the firm noted in a new blog post.

The malicious URLs in these emails are similar to those in attacks targeting NATO members and the White House back in April, the firm said.

The exploit in question apparently affects Java 1.8.0.45, but not earlier versions 1.6 or 1.7.

Trend Micro continued:

`Once successfully exploited, it executes arbitrary code on the default Java settings thus compromising the security of the system. Trend Micro detects the exploit code as JAVA_DLOADR.EFD. The file which Trend Micro detects as TROJ_DROPPR.CXC drops the payload, TSPY_FAKEMS.C to the login user folder.`

The security vendor is recommending users disable Java in the browser and referred those that can't to a handy guide on how to mitigate the risk of being hit by an exploit.

`The discovery of these attacks demonstrates that Operation Pawn Storm is still very much in play,` said Tom Kellermann, chief cybersecurity officer at Trend Micro. `We've seen geopolitical tension manifest in cyberspace, and this campaign has escalated in parallel with tensions in Eastern Europe.`

Operation Pawn Storm, or APT28 as it's also known, is a state-sponsored group widely thought to be linked to Moscow.

First discovered in October last year, it has been accused of launching attacks in the past on European defense, government and media organizations, using the SEDNIT malware to steal sensitive information from victims.

It has also focused efforts on the Ukraine region currently at the center of a geopolitical conflict with Russia. Several local activists were targeted, for example.

Pawn Storm was even pegged for a notorious 'Cyber Caliphate' attack on French TV station TV5Monde which took several channels off air for hours.

Read original article

Evans Hotels breach

California-based Evans Hotels – which operates Bahia Resort Hotel, Catamaran Resort Hotel and Spa, and The Lodge at Torrey Pines – announced that malware was installed on computers at the front desks of its properties that could have compromised payment card data.

How many victims? Undetermined.

What type of personal information? Names, account numbers, expiration dates, and verification codes.

What happened? Evans Hotels had on occasion been using backup payment card readers that do not encrypt card data when cards are swiped – later, Evans Hotels discovered that malware was installed on computers at the front desks of its properties, and data from cards swiped through those backup readers may have been compromised.

What was the response? The backup payment card readers were removed from all properties. Evans Hotels is working with a computer security firm to implement additional enhanced security measures.

Details: Evans Hotels removed the backup card readers from its properties on March 5. Cards swiped through the backup card readers between September 2014 and March 5 may have been compromised.

Evans Hotels learned in February that guests who used payment cards at its properties were seeing unauthorized charges on those cards. During an investigation, Evans Hotels learned that backup card readers that do not encrypt card data when cards are swiped were being used in addition to its current system during the check-in of large groups. Several years ago, Evans Hotels began using card readers that encrypt payment card data when the card is swiped, and the older card readers were kept as a backup for IT disaster recovery purposes.

Quote: `We worked extensively to identify only those guests whose cards were swiped through the backup readers during this time frame, but we were not able to reliably make that distinction from our records,` a notification posted to the Evans Hotels website said, going on to add, `Because we were not able to specifically identify the small percentage of guests whose cards were swiped through the backup readers, if you used a card at one of our properties during this time frame, we recommend that you regularly review your account statements for any unauthorized activity.`

Read original article

US blames China Again

Experts are blaming Chinese hackers for Data breaches at the US government's personnel management agency.
The data lost covers millions of state sector employees including Social Security numbers and other sensitive information on 21.5 million people who have undergone background checks for security clearances. This is in addition to data on about 4.2 million current and former federal workers that was stolen in what the OPM called a `separate but related` hacking incident.
 Because many people were affected by both hacks, a total of 22.1 million people were affected, or almost seven percent of the US population. Lawmakers from both parties demanded OPM Director Katherine Archuleta's removal. House of Representatives Speaker John Boehner, a Republican, said President Barack Obama `must take a strong stand against incompetence in his administration and bring in a new leadership at OPM.` Virginia Democratic Senator Mark Warner said the technological and security failures at the Office of Personnel Management predate this director's term, but Director Archuleta's slow and uneven response has not inspired confidence that she is the right person to manage OPM through this crisis.
Archuleta said no one is going to quit and the White House said Obama retains confidence in her. As you would expect, the US government is blaming China which is handy because the Chinese government always denies it and no-one ever believes them. The allegation this time comes from Hillary Clinton who claimed that China was trying to hack everything that was not nailed down in the US. Clinton said the US must be `fully vigilant` about China's military, adding that Beijing had stolen commercial secrets from defence contractors and `huge amounts of government information`.
However if it was a Chinese hack, what would they get out of the personal data of millions of ordinary Americans? What is much more likely is that it is the normal team of Russian hackers wanting data to spam people. Clinton also has a political reason to slag off China. She was previously seen as being soft on the country when she was secretary of state. I blame Microsoft, actually.

Read original article

Info Stealing Pita Bread

It's like something out of Mission Impossible, or, perhaps more accurately, Get Smart: Imagine being able to steal data out of the air using a gadget hidden inside a piece of pita bread.

Researchers at—where else?—Tel Aviv University have done just that, pioneering a way to break encryption keys using radio waves using a raft of cheap, off-the-shelf components that can be combined into a small, concealable gadget. A gadget that's just perfect for tucking into an innocuous-looking piece of flatbread.

Hackers could be sitting in a café, silently intercepting the online activities of those around them, while appearing to be doing nothing more than noshing away at a plate of roasted red pepper hummus.

The team of four Israeli researchers led by Daniel Genkin said that they were able to capture radio emissions given off by laptops. Those radio signals are generated by laptop CPUs crunching data (if not toasted pocket breads), and they're subtly different depending on the activity. So, playing a game has a different radio signature than sending an email, and file decryption looks different than watching a video—etc. etc.

The differing power consumption needs for each activity give rise to the specific signatures, the researchers noted. And further, they found that they were able to uncover the encryption key for emails if they intercepted them in the process of being downloaded. In all they were able to recover keys used in several widely used encryption programs and algorithms to protect data.

The group has created a proof of concept dubbed the Portable Instrument for Trace Acquisition, aka, yes, you guessed it, PITA.

But don't fear the café too much: Improvements would need to be made to make it as useful as, say, a shoe phone or the Cone of Silence. When PITA meets a pita, the attack has been demonstrated to work from a distance of only about a foot and a half—so the hacker would need to be really, really close to the victim, at which point he or she could probably save themselves a lot of trouble by just leaning over and reading the screen.

There are other issues too to work out before PITA is ready for mass consumption, as it were.

`The research from Tel Aviv University serves as a timely reminder of the innovative techniques that cybercriminals may use in the future, but it is highly unlikely that such an attack would yield positive results in a real-life environment outside laboratory conditions,` said Darin Welfare, vice president and GM for EMEA at WinMagic, in an email. `For example, replicating this attack in a generic environment like a coffee shop would likely be interrupted by the prevalence of other radio waves in the vicinity, skewing the results.`

Read original article

OPM director resigns

Less than 24 hours after the recent hack against the Office of Personnel Management (OPM) was announced to have reached 21.5 million affected individuals, its director has stepped down.

In a statement, Katherine Archuleta wrote that it was `best for me to step aside` from leading the agency charged with managing federal employees. She had been in the position for just over two years.

This is quite a reversal for the OPM boss. Speaking before a Senate hearing on June 23, Archuleta said, `I`m as angry as you are that this is happening... I am dedicated to ensuring that OPM does everything in its power to protect the federal workforce and to ensure that our systems will have the best cyber security posture the government can provide.`

Yet she insisted that no one at the OPM was to blame for the breaches: `If there is anyone to blame, it is the perpetrators.`

The hack has affected huge number of federal employees.

`If you underwent a background investigation through OPM in 2000 or afterwards (which occurs through the submission of forms SF-86, SF-85, or SF-85P for either a new investigation or a re-investigation), it is highly likely that you are impacted by the incident involving background investigations,` OPM officials warned in an update published Thursday. `If you underwent a background investigation prior to 2000, you still may be impacted, but it is less likely.`

SF-86 is the form that all federal employees are required to fill out to obtain a security clearance.

Earlier this week, FBI Director James Comey told a Senate panel that he `was sure` the hackers now had his personal information.

`I`m sure the adversary has my SF-86 now,` Comey said. `My SF-86 lists every place I`ve ever lived since I was 18. Every foreign travel I`ve ever taken. All of my family, and their addresses.`

Read original article

POS Service Provider Breached

Denver-based managed services provider Service Systems Associates has reported a breach that likely affected about 12 of the payments systems it operates for gifts shops at its clients, which include zoos, museums and parks across the country.

The incident is yet another example of the growing POS risks associated with third-party managed services providers, as highlighted in this week`s cybersecurity alert from the Financial Services Information Sharing and Analysis Center and others.

In a July 8 statement posted to its site and Facebook page about the breach, Service Systems Associates says debit and credit purchases made between March 23 and June 25 in gift shops that it manages for several U.S. clients may have been compromised by a point-of-sale malware attack that infected its system.

`As soon as we learned about the attack, SSA began working with law enforcement officials and a third-party forensics investigator, Sikich, to investigate the breach,` SSA states. `Though the investigation into this attack continues, the malware that caused the breach was identified and removed. All visitors should feel confident using credit or debit cards anywhere in these facilities. SSA is also taking several steps to improve its security and prevent future attacks.`

Impact of Breach Unkown

SSA spokeswoman Kara Hamstra tells Information Security Media Group that the company is not yet revealing the number of cards and locations that may have been affected. Whether some of the locations share one of the dozen payments systems infected with the malware was not noted in SSA`s statement, and Hamstra was not able to offer additional details.

SSA`s clients, according to its website, include the History Colorado Center, the Detroit Zoo, the Cincinnati Zoo, the Cincinnati Museum Center, the Minnesota Zoo, Oklahoma`s Tulsa Zoo, the Denver Zoo, the California`s Monterey Bay Aquarium, Kentucky`s Louisville Zoo, the Dallas Zoo, Zoo Miami, the Nashville Zoo, the Pittsburgh Zoo, the Honolulu Zoo, New York`s Buffalo Zoo and New Mexico`s Albuquerque Bio Park.

Several card-issuing institutions contacted by ISMG say they are not aware of any fraud related to cards that may have been compromised in the SSA breach. However, all point out that tracing fraud back to a third party that provides outsourced or managed payment services is difficult.

`The POS software vendor is not visible to the issuer, so it is difficult to recognize the commonality of the point of purchase,` says one executive with a leading issuer on the West Coast, who asked not to be named.

Risks to Smaller Merchants

Charles Bretz, director of payment risk at the FS-ISAC, notes that smaller merchants are at greatest risk of breaches involving managed services providers because they commonly use these vendors for payments processing and POS management.

`Criminals continue to find success by targeting smaller retailers that use common IT and payments systems,` Bretz explains in a recent interview with ISMG. `Merchants in industry verticals use managed service provider systems. There might be 100 merchants that use a managed service provider that provides IT and payment services for their business.`

Read original article

Detroit Zoo breach

The Detroit Zoo along with eight other zoos across the country announced that Service Systems Associates (SSA), a third party vendor that handles retail and concession payments, experienced a point-of-sale (POS) breach that affected customers between March 23 and June 25 of this year.

How many victims? Unknown.

What type of personal information? Customer names, credit and debit card numbers, expiration dates, and three-digit CVV security codes.

What happened? Malware was detected on SSA software in nine zoo gift shops that compromised information of customers at the Detroit Zoo and eight other zoos across the country.

What was the response? The malware responsible for the incident was identified and removed. SSA has notified the credit card companies of the situation and is working with law enforcement and the forensic investigator firm Sikich to investigate the breach.

Details: Anyone who visited a SSA partner facility between March 23 and June 25 of this year and used a credit or debit card may have had their information compromised. The breach did not affect food, ticket or membership sales at the Detroit Zoo.

Quote: `Upon learning of the breach, SSA installed a separate credit card processing system in the gift shops and new transactions have not been affected by the previous breach,` according to the Detroit Zoo`s release


Read original article

Critical OpenSSL bug

There`s a critical vulnerability in some versions of the widely used OpenSSL code library that in some cases allows attackers to impersonate cryptographically protected websites, e-mail servers, and virtual private networks, according to an advisory issued early Thursday morning.

The bug allows attackers to force vulnerable end-user applications into treating an invalid certificate as a legitimate transport layer security (TLS) or secure sockets layer (SSL) credential. As a result, adversaries with the ability to monitor a connection between the end user and trusted server could intercept or even modify data passing between them. The vulnerability resides in OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n, and 1.0.1o. The flaw appears to have been added earlier this year, based on this Github contribution dated January 27. It wasn`t introduced into the actual OpenSSL versions until last month, however.

The flaw has the potential to be extremely serious because in certain cases it makes it trivial to bypass the most popular—and in many cases, the only—form of encryption and cryptographic authentication available for websites, e-mail servers, and virtual private networks. The bug allows attackers to bypass certain checks that are supposed to be carried out when an end-user app is establishing an encrypted session with a server. As a result, the attacker can make an invalid certificate appear as if it belongs to a trusted certificate authority and issue forged certificates for any website.

`The advisory makes it look pretty bad,` Matt Green, a professor specializing in cryptography at Johns Hopkins University, told Ars. `If you can look like a CA, then you can issue a certificate for any site.`

Silver lining

Fortunately, the flaw can be exploited only in limited cases, specifically only when browsers or other types of end-user applications use a vulnerable version of OpenSSL for certificate verification. By default, Google Chrome, Mozilla Firefox, Microsoft Internet explorer, and Apple iOS use Boring SSL, Network Security Services (and more recently libPKIX), SChannel, and Secure Transport respectively for such validation. There`s no indication that any of those alternate code libraries contain the same flaw, meaning the vulnerability most likely can`t be exploited against people using those programs or operating system. BoringSSL developers have confirmed it`s not affected. Android handsets, meanwhile, use OpenSSL and BoringSSL depending on the version, but according to Google cryptography engineer Adam Langley, all versions remain unaffected.

Still, individual apps often use their own code for verifying certificates. That means certain apps may still be vulnerable even when running on an operating system that by default uses an unaffected crypto library. It will take days or weeks for vulnerable apps to be identified and fixed. In the meantime, readers should rely on browsers whenever possible until they receive verification that e-mail, VPN, and other types of apps are safe.

As critical as the flaw is, its effects are greatly limited because it was discovered before it made its way into mainstream applications. That`s a testament to recent industrywide efforts to secure the widely used code base. The catastrophic Heartbleed vulnerability, by contrast, resided in production versions of OpenSSL for more than two years. The bug reported Thursday was identified by Langley, the Google cryptography engineer, and David Benjamin, a developer with the BoringSSL project. This post will be updated as more details become available.

Read original article

Orlando Health breach

Orlando Health announced that a former nursing assistant accessed about 3,200 patient medical records outside of their normal job responsibilities.

How many victims? About 3,200.

What type of personal information? Names, addresses, dates of birth, medications, medical tests and results, last four digits of Social Security numbers, and other clinical information. About 100 records may have contained insurance information.

What happened? A former nursing assistant accessed patient medical records outside of their normal job responsibilities.

What was the response? Orlando Health is reeducating its workforce and increasing its program of auditing and monitoring of patient record access. The employee was fired. All affected patients are being notified.

Details: The incident – which was identified on May 27 during a routine patient record access audit – affected certain patients treated between January 2014 and May at Winnie Palmer Hospital for Women & Babies, Dr. P. Phillips Hospital, and Orlando Regional Medical Center.

Quote: `Despite a thorough investigation, including numerous interviews with the former employee, Orlando Health was unable to determine the reason for the access,` a press release said. `However, there is no evidence that the information has been used in any way or removed from the hospital.`

Read original article

NHS Blunder Breach

The NHS has been forced to apologize after another insider data handling error led to the exposure of more than 3000 patients' details.

East Sussex NHS Trust sent a letter of apology to the affected individuals, claiming that personal information stored unencrypted on a USB stick was lost by staff, according to the BBC.

It was subsequently found by a member of the public and handed in, the report continued.

The CEO of East Sussex Healthcare NHS Trust, Darren Grayson, told reporters that the member of staff who had downloaded the data onto the removable media device had broken official hospital policy.

`It was an isolated incident and the trust takes the security of patients' personal information extremely seriously,` he said.

Luke Brown, EMEA general manager at Digital Guardian, argued that human error is often overlooked when organizations work with sensitive data.

`There are numerous technologies out there designed to combat human error, and small investments can go a long way,` he added.

`When organizations deploy technology that protects data at source, it removes the risk factor associated with human error and insider threats. Furthermore, staff quickly become aware of the impact of their actions, leading to rapid behavioral changes.`

US-based non-profit the Online Trust Alliance revealed in a February report that a sizable 29% of breaches last year were `due to lack of internal controls resulting in employees' accidental or malicious events.`

Data protection watchdog the Information Commissioner's Office (ICO) gained the power during the past year to conduct compulsory audits of NHS bodies to check data handling.

Of the 1677 self-reported data loss 'incidents' from 2014/15, a staggering 439 came from the health sector, according to the ICO's annual report. That amounts to just over a quarter of the total.

In comparison, the next biggest affected industry was local government, which reported 125 incidents, followed by education (79) and 'general business' (73).

Read original article

Encryption Backdoor Plan

A dozen well-known cryptographers and cybersecurity specialists have published a paper explaining why they believe it`s unrealistic to create a so-called `backdoor` to allow law enforcement and intelligence agencies to decrypt coded information.

The paper was published July 7, the day before FBI Director James Comey and Deputy Attorney General Sally Quillian Yates were scheduled to testify before the Senate Judiciary Committee on the dangers they believe new encryption technologies pose in preventing law enforcement from monitoring criminals, terrorists and adversaries.
The paper contends providing law enforcement with `exceptional access` to encrypted data would pose grave security risks, imperil innovation and raise thorny issues for human rights and international relations.

`Building backdoors into all computer and communication systems is against most of the principles of security engineering, and it also against the principles of human rights,` one of the paper`s authors, University of Cambridge Professor Ross Anderson, writes in his blog.

Three Obstacles

The paper`s authors identify three problems with providing law enforcement and intelligence agencies with exceptional access to decrypt data:

1. Providing exceptional access would force a U-turn from the best practices being deployed to make the Internet more secure. These practices include forward secrecy, in which decryption keys are deleted immediately after use, so that stealing them would not compromise other communications. A related technique, authenticated encryption, uses the same temporary key to guarantee confidentiality and to verify that the message has not been forged or tampered with.

2. Building in exceptional access would substantially increase system complexity. Security researchers see complexity as the enemy of security; each new feature can interact with others to create vulnerabilities. To achieve widespread exceptional access, new technology features would have to be deployed and tested with hundreds of thousands of developers all around the world, creating an extremely complex computing environment.

3. Exceptional access would create concentrated targets that could attract bad actors. Security credentials that unlock the data would have to be retained by the platform provider, law enforcement agencies or a trusted third party. If law enforcement`s keys guaranteed access to everything, an attacker who gained access to these keys would enjoy the same privilege. Law enforcement`s stated need for rapid access to data would make it impractical to store keys offline or split keys among multiple keyholders, as security engineers would normally do with extremely high-value credentials. As the recent Office of Personnel Management breach demonstrates, much harm can arise when many organizations rely on a single institution that itself has security vulnerabilities.

Clipper Chip Debate Revisited

This isn`t the first time security experts have voiced joint opposition to government efforts to bypass encryption. In 1997, the cryptographic community lobbied against the proposed Clipper Chip, which sought to have all strong encryption systems retain a copy of keys necessary to decrypt information with a trusted third party that would turn over keys necessary to decrypt data to law enforcement with a court order. The government eventually abandoned its Clipper Chip initiative.

Read original article

Emerging Android Threats

By the end of 2015, researchers expect the number of new Android malware strains to hit 2 million.

Although mobile malware hasn`t yet been blamed for any major data breach or cybercrime event, attackers are churning out a new piece of Android malware every 18 seconds -- and the rate is trending upwards.

In the first quarter of 2015, 440,267 new samples of Android malware appeared, and the number may reach over 2 million by the end of the year, according to researchers at anti-virus firm G DATA, which just celebrated its 30th anniversary. That is a 6.4 percent increase over Q4 2014.

`The trend is heading upward,` says Andy Hayter, Security Evangelist for G DATA. `Android malware is growing and Android malware is profitable.`

Yet, according to the Verizon Data Breach Investigations Report, less than 0.03 percent of mobile devices are infected with `high-impact` malware each year, and mobile phones were not being used in remote attacks.

`We haven`t seen the `Melissa virus` for mobile malware yet,` says Hayter. `That day will come. I predict sooner, than later. I think it`s a matter of installed base and profit.`

Hayter says that the use of premium SMS messages and mobile phone banking is not as high in the United States as it is in some other countries, so that may delay the explosion of Android malware used for financial gain. About half the samples (50.3 %) G DATA analyzed were financially motivated malware.

Globally, Android phones have a far higher market share than other smartphone platforms (78%, versus 18.3% for iOS, according to IDC), yet mobile devices have still been used less than desktop devices. That`s shifting. According to G DATA`s report, the global market share of Android smartphones and tablets used for Internet access exceeded 61 percent in the first quarter of 2015.

As for the malware itself, says Hayter, `It`s sophisticated enough ... There are some stand-outs for uniqueness, but nothing that has spread widely yet.`

The report outlines two financially motivated Trojans of note. The Svpeng Trojan combines the `functionality of a finance malware program with the potential of ransomware,` according to the report. It can steal credentials or other access data when a banking app is used or it can encrypt the device. The Faketoken Trojan steals mTANs (transaction authentication numbers), which attackers can then use to transfer money to their own accounts.

There`s also plenty of cross-platform malware -- that can make the jump from a phone to a desktop client for example -- but nothing significant in number yet, says Hayter.

The concern is that when an Android malware strain really does try to hit hard, the users` devices won`t be ready to defend themselves. Although there are anti-virus products out there for Android, Hayter says they aren`t in very widespread use.

`Does everyone know they need anti-virus for their phone?` he says. `I don`t think they know that yet.`

He suggests Android users avoid malware, adware, and other potentially unwanted programs by only downloading from very trusted sources like the Google Play Store or your device manufacturer`s store.

Read original article