ste williams

Agentless Backup is Not a Myth

LinkedIn is working on its right-on-the-ball-with-security reputation, this time letting slip its domain details.

According to this App.net post:

“LinkedIn just got DNS hijacked, and for the last hour or so, all of your traffic has been sent to a network hosted by this company [confluence-networks.com]. And they don’t require SSL, so if you tried to visit, your browser sent your long-lived session cookies in plaintext.” (User @berg)

The Register hasn’t yet confirmed that Confluence Networks is receiving the traffic as asserted by Berg, but LinkedIn.com was delivering a big white nothing at Vulture South around 03:15 GMT on 20 June 2013.

LinkedIn says it is working on the issue:

Our site is now recovering for some members. We determined it was a DNS issue, we’re continuing to work on it. Thanks for your patience.

— LinkedIn (@LinkedIn) June 20, 2013

Meanwhile, it requests patience, a commodity that may be in short supply for those who last year had their passwords for the service perused by pilferers. ®

Steps to Take Before Choosing a Business Continuity Partner

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/20/linkedin_dns_hijacked/

Agentless Backup is Not a Myth

LinkedIn is working on its right-on-the-ball-with-security reputation, this time letting slip its domain details.

According to this App.net post:

“LinkedIn just got DNS hijacked, and for the last hour or so, all of your traffic has been sent to a network hosted by this company [confluence-networks.com]. And they don’t require SSL, so if you tried to visit, your browser sent your long-lived session cookies in plaintext.” (User @berg)

The Register hasn’t yet confirmed that Confluence Networks is receiving the traffic as asserted by Berg, but LinkedIn.com was delivering a big white nothing at Vulture South around 03:15 GMT on 20 June 2013.

LinkedIn says it is working on the issue:

Our site is now recovering for some members. We determined it was a DNS issue, we’re continuing to work on it. Thanks for your patience.

— LinkedIn (@LinkedIn) June 20, 2013

Meanwhile, it requests patience, a commodity that may be in short supply for those who last year had their passwords for the service perused by pilferers. ®

Steps to Take Before Choosing a Business Continuity Partner

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/20/linkedin_dns_hijacked/

Agentless Backup is Not a Myth

LinkedIn is working on its right-on-the-ball-with-security reputation, this time letting slip its domain details.

According to this App.net post:

“LinkedIn just got DNS hijacked, and for the last hour or so, all of your traffic has been sent to a network hosted by this company [confluence-networks.com]. And they don’t require SSL, so if you tried to visit, your browser sent your long-lived session cookies in plaintext.” (User @berg)

The Register hasn’t yet confirmed that Confluence Networks is receiving the traffic as asserted by Berg, but LinkedIn.com was delivering a big white nothing at Vulture South around 03:15 GMT on 20 June 2013.

LinkedIn says it is working on the issue:

Our site is now recovering for some members. We determined it was a DNS issue, we’re continuing to work on it. Thanks for your patience.

— LinkedIn (@LinkedIn) June 20, 2013

Meanwhile, it requests patience, a commodity that may be in short supply for those who last year had their passwords for the service perused by pilferers. ®

Steps to Take Before Choosing a Business Continuity Partner

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/20/linkedin_dns_hijacked/

Agentless Backup is Not a Myth

LinkedIn is working on its right-on-the-ball-with-security reputation, this time letting slip its domain details.

According to this App.net post:

“LinkedIn just got DNS hijacked, and for the last hour or so, all of your traffic has been sent to a network hosted by this company [confluence-networks.com]. And they don’t require SSL, so if you tried to visit, your browser sent your long-lived session cookies in plaintext.” (User @berg)

The Register hasn’t yet confirmed that Confluence Networks is receiving the traffic as asserted by Berg, but LinkedIn.com was delivering a big white nothing at Vulture South around 03:15 GMT on 20 June 2013.

LinkedIn says it is working on the issue:

Our site is now recovering for some members. We determined it was a DNS issue, we’re continuing to work on it. Thanks for your patience.

— LinkedIn (@LinkedIn) June 20, 2013

Meanwhile, it requests patience, a commodity that may be in short supply for those who last year had their passwords for the service perused by pilferers. ®

Steps to Take Before Choosing a Business Continuity Partner

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/20/linkedin_dns_hijacked/

Agentless Backup is Not a Myth

LinkedIn is working on its right-on-the-ball-with-security reputation, this time letting slip its domain details.

According to this App.net post:

“LinkedIn just got DNS hijacked, and for the last hour or so, all of your traffic has been sent to a network hosted by this company [confluence-networks.com]. And they don’t require SSL, so if you tried to visit, your browser sent your long-lived session cookies in plaintext.” (User @berg)

The Register hasn’t yet confirmed that Confluence Networks is receiving the traffic as asserted by Berg, but LinkedIn.com was delivering a big white nothing at Vulture South around 03:15 GMT on 20 June 2013.

LinkedIn says it is working on the issue:

Our site is now recovering for some members. We determined it was a DNS issue, we’re continuing to work on it. Thanks for your patience.

— LinkedIn (@LinkedIn) June 20, 2013

Meanwhile, it requests patience, a commodity that may be in short supply for those who last year had their passwords for the service perused by pilferers. ®

Steps to Take Before Choosing a Business Continuity Partner

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/20/linkedin_dns_hijacked/

Agentless Backup is Not a Myth

Microsoft is breaking its long-standing tradition of not paying for security vulnerabilities by offering a $100,000 cash prize for the first penetration tester to crack Windows 8.1 and a $50,000 bonus to explain how they did it.

At this year’s Black Hat USA conference – held at the end of July in the sweaty hell that is Las Vegas at that time of year – Microsoft will offer $100,000 (and a laptop) to the hacker who can demonstrate a critical vulnerability in Windows 8.1, either at the conference or afterwards.

Any successful hacker can earn an additional $50,000 “BlueHat Bonus” if they can tell Redmond how to fix a major flaw in the operating system. In addition, there’s an $11,000 bounty on Internet Explorer 11 Preview Edition vulnerabilities – but with a 30 day time limit – presumably so that any new problems can be fixed in time for the final release.

The market for software vulnerabilities is a contentious issue. Proponents point out that cash payouts are the only way for independent security researchers to make a living and that the resulting disclosures have immense benefits for end users. Opponents suggest that hackers should disclose responsibly as a matter of morality. Meanwhile, there’s a thriving black market for software flaws, especially zero-day vulnerabilities.

Many software companies, including Google, Paypal, and Facebook, offer bug bounties of varying amounts, and security researchers have reaped millions of dollars and built successful businesses as a result. Redmond has held off from similar policies until now.

Part of the reason for change at Microsoft is the appointment of Katie Moussouris to Redmond’s team senior security strategist. She has championed the rights of researchers to disclose flaws without fear of prosecution and pushed for Microsoft to share vulnerability data with third parties at the earliest opportunity. Now she appears to have helped Redmond cross the final frontier.

“Speaking with Katie Moussouris of Microsoft, this has been something that’s been hotly debated and discussed internally and externally at Microsoft for a long time,” Trey Ford, general manager of Black Hat told The Register. “It took her, I think, three years ago to help get this through the ranks and I’m really excited, this is a really great move I’m hoping to see Apple follow suit.”

Apple is still holding out against paying for vulnerability disclosures, and its debut Black Hat briefing last year was a disappointment. It wasn’t too long ago that Apple’s minions were breaking down journalists’ doors in the pursuit of intellectual property, and Cupertino is making a few mistakes of its own on the security front in the meantime.

Getting Microsoft online has been a major coup for the Black Hat conference, but Ford said this year’s jamboree (with DEFCON afterwards) covers sessions on security issues in 18 different security areas – a long way from the first conference in 1997, where the two-day event was dominated by enterprise server, ActiveX, and UNIX issues.

Since their inception, Black Hat and DEFCON have provided a forum where the suits of corporate culture and the freer spirits of the security research world can mingle and exchange ideas. As a result, we’ve seen major flaws patched in the internet’s backbone and useful insight into the current security landscape. Long may it continue. ®

Steps to Take Before Choosing a Business Continuity Partner

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/19/microsoft_bug_bounty_black_hat/

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Exclusive An IT blunder splashed photos of suspected criminals and details of Brits who reported them over the internet, The Register can reveal.

The Facewatch website, which allows police and businesses to upload and share evidence of alleged petty crimes, was left wide open thanks to a web-server misconfiguration. The schoolboy error allowed anyone to easily access a huge cache of CCTV footage, photos and information about companies that sign up to the service.

El Reg was able to look through almost 5,000 records containing images and films of suspects dating back to March 2011.

We saw shoplifters pilfering from department stores, a man brandishing a stick inside a bookies, and people looking shifty in packed pubs presumably just before a crime took place. Some of the images even had names on them, which would be legally problematic if those pictured turned out to be innocent.

We also saw long lists of shops around Britain which have signed up to Facewatch, along with the names and contact details of their security guards and managers. This could come in handy for any crook wishing to intimidate a witness or exact revenge on the person who reported them to the police.

Big high-street names whose staff details were available for anyone to look at include the Carphone Warehouse, Lloyds Bank and Ladbrokes, which runs a nationwide chain of betting shops. There were also extensive lists of small businesses.

Publicly distributing images of suspected criminals could cause a legal headache due to strict rules on defamation and contempt of court: publishing evidence of a person apparently committing a crime risks prejudicing a jury, should the case ever come to trial, or could ruin their reputation.

Blighty’s privacy watchdog – the Office of the Information Commissioner – told us it was beginning inquiries that could lead to a formal investigation.

A spokesman said: “We have recently been made aware of a possible data breach which appears to involve the Facewatch website.

“We will be making enquiries into the potential breach of the Data Protection Act before deciding what action, if any, needs to be taken.”

‘Secured by design’

The website boasts it was declared “secured by design” by a police-run body that recognises products or business that meet the “Police Preferred Specification” on security. This badge of honour is normally given to secure buildings or products, such as window locks and burglar alarms, but Facewatch was awarded the online equivalent.

But with a gaping security hole in its website, this could make businesses think again about how stringent this standard actually is.

You didn’t have to be a light-fingered thief nor an elite hacker to get into the sensitive files: all that was required was changing “http” to “https” in the website’s address and all the information was there to be accessed.

Specifically, the Nginx software running the HTTPS site was incorrectly configured to list the contents of file directories on the web server rather than serving the intended web pages. Visiting http://facewatch.co.uk/ redirects to http://facewatch.co.uk/cms/ but this did not happen on the HTTPS site, which instead revealed the index of the server root directory, which could be explored to find website code, databases of users and folders packed with images.

We were told about the security hole by a source who was trying to report a crime. While trying to find the address of a HTTPS-encrypted server to send the images to, he found https://facewatch.co.uk/ gave him full read-only access to Facewatch’s file tree.

Our source said: “A novice who runs a church website would know not to allow directory browsing.”

We reported the security flaw to Facewatch, which closed the hole immediately.

The organisation’s chairman Simon Gordon told us the “accessible code related to a previous version” of its website software. And he argued the long lists of email addresses we saw were in the public domain already and could be “accessed by the public in order for people reporting crime to contact those who reported a crime on their behalf”.

The chairman admitted that contact details of security staff were left visible but they were people who took “all necessary precautions to protect their personal safety”. He continued:

We have undertaken penetration testing to ensure that the information stored in the Facewatch systems is secure and can confirm that all personal data are secure and that our systems are secure. The URL to which you referred us has been closed as this is no longer in use.

Facewatch takes the security of the information which it holds very seriously and works with its clients, including the UK police services, and the data protection regulators to ensure that all data is secure when it is being transmitted to the police or held on behalf of our clients.

The crimes which are reported through the Facewatch system do not relate to crimes against the person or which include violence and those using the system are aware that their business email addresses are made available to a variety of people, both by their own organisations and third parties.

Therefore, any risks in the publication of the email addresses are very unlikely. Our clients are required to post signs confirming that they are using CCTV and that images will be disclosed, many of our clients advertise that they are using the Facewatch system through such signs and by using other means. Therefore, the images of those that the police wish to contact are published with the full knowledge of the individuals concerned.

No names of any crime victims were hosted on the site due to ICO rules that state they should be deleted within 36 hours of recording them.

Some 63,000 people have downloaded Facewatch’s smartphone app and its images have been viewed nine million times, we’re told. As well as allowing officers and shop bosses to upload files, Facewatch allows Brits to use their mobiles to view CCTV stills and other photos of people wanted for questioning by cops.

Facewatch’s Gordon claimed some of the images we found on the server were part of that public mug-shot gallery.

“Some residual images of individuals that the police would like to contact in relation to certain reported crimes were available, these images had been made available to see if members of the public would be able to help with their identification,” Gordon said.

The scheme was first tested in London, before being rolled out across the UK. It is operated by a private company called FaceWatch Limited, based in Ipswich. ®

Agentless Backup is Not a Myth

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/19/facewatch_https_directory_index_error/

Agentless Backup is Not a Myth

Pic Cops have arrested two men following a failed “smash and grab” robbery at Apple’s flagship store on Regent Street, London.

Detectives want to hear from anyone who may have witnessed the incident, which took place at 1am on Tuesday morning.

Damage to the shop window

Officers told The Register that up to eight people may have been involved in the attempted burglary. Cops said the gang used an axe to smash through a glass door, but were chased off by the fruity firm’s security team.

The gang then sped off on a number of scooters, forcing the police to scramble a helicopter to find them.

Two men, aged 21 and 18, were later cuffed in the fashionable North London borough of Islington: the pair are still being quizzed by the plod.

They were both arrested on suspicion of aggravated attempted burglary and dangerous driving, although the two have not yet been charged with any offence.

Anyone with any infomation on the attempted break-in should call the Westminster division of the Metropolitan Police’s Serious Acquisitive Crime Unit via 101. Anonymous tipsters can ring the confidential Crimestoppers hotline on 0800 555 111 instead. ®

Customer Success Testimonial: Recovery is Everything

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/19/two_detained_after_apple_store_raid_attempt/

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

36 Privacy Commissioners from around the world have written to Google to ask, in the polite-but-firm language of international diplomacy, for some details about Google Glass.

The letter, signed by Privacy Commissioners or their equivalents from Canada, Australia, New Zealand, Mexico, Switzerland and Israel, plus several Canadian provinces.

The authors’ beef is simple: it looks like Glass could invade privacy in dozens of ways, but Google has told the world almost nothing about how the device works. That observation produced the following list of questions the Commissioners want answered:

• What are the privacy safeguards Google and application developers are putting in place?
• What information does Google collect via Glass and what information is shared with third parties, including application developers?
• How does Google intend to use this information?
• While we understand that Google has decided not to include facial recognition in Glass, how does Google intend to address the specific issues around facial recognition in the future?
• Is Google doing anything about the broader social and ethical issues raised by such a product, for example, the surreptitious collection of information about other individuals?
• Has Google undertaken any privacy risk assessment the outcomes of which it would be willing to share?
• Would Google be willing to demonstrate the device to our offices and allow any interested data protection authorities to test it?

At the time of writing Google has not responded to the letter, which is addressed to Larry Page himself.

“We would be very interested in hearing about the privacy implications of this new product and the steps you are taking to ensure that, as you move forward with Google Glass, individuals’ privacy rights are respected around the world,” the authors say. “We look forward to responses to these questions and to a meeting to discuss the privacy issues raised by Google Glass.”

As do we all. ®

Agentless Backup is Not a Myth

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/19/six_nations_ask_google_for_answers_on_glass_privacy/

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Despite weekly news of successful and nasty online attacks damaging organisations of every stripe, executive types remain blasé about security and don’t pay it enough attention, says Jason Clark, chief security officer at Websense, who recommends fighting back by phishing CEOs and board members.

Clark’s suggested attacks are controlled fakes, run by dedicated white hat outfits, and are designed to ensure suits get a brief jolt of fear rather than having to ask their personal assistants to arrange delivery of new platinum cards. Clark feels the experience of being phished is sobering because its delivery by email demonstrates how anyone in an organisation can be attacked.

Once suits understand that, Clark’s hope is it becomes easier for security professionals to have meaningful conversations with business decision makers and those who hold the purse-strings.

Such discussions need to get deeper and more frequent, he feels, because today too few executives pay more than lip service to security. When they do, they ask for assurance that the organisations they lead are complying with legislation and can demonstrate they have appropriate security controls.

Once suits are properly scared, they’ll be more interested in learning more about security, will ask more and more probing questions of their IT departments and eventually lead their organisations to a security regime that gives them the protection they need.

Clark’s advice is otherwise mundane: he suggests organisations ensure they have advance malware repulsion tools, spear phishing blockers and data protection tools to ensure valuable documents can’t leave the building. Few organisations he visits – Clark claims to meet 400 CSOs or CEOs a year – have all three in place. Around ten per cent of organisations he visits have used phake phishing.

Fewer still perform comprehensive threat modelling, a practice he recommends as the best route to understanding appropriate security investments. ®

Agentless Backup is Not a Myth

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/19/spear_phish_your_boss_to_win_more_security_cash/