STE WILLIAMS

GCHQ is being challenged over its offensive hacking practices at a hearing that started on Tuesday morning. The challenge is being heard by the Investigatory Powers Tribunal, which is the only judicial body in the country with the authority to hear complaints about the intelligence agencies.

Two complaints were filed last year, by Privacy International and a global coalition of ISPs and related organisations, regarding offensive hacking practices that GCHQ is alleged to have conducted unlawfully.

Privacy International claims there was no clear lawful authority for GCHQ to conduct computer network exploitation (CNE) operations when these cases were filed. The government subsequently introduced an amendment to the Computer Misuse Act which Privacy International alleged was an “underhand and undemocratic” act which was “seeking to make lawful GCHQ’s hacking operations.”

A Home Office spokesperson denied the amendment “increase[d] or expand[ed] the ability of the intelligence agencies to carry out lawful cyber crime investigation.”

CNE, as defined by MI5, “allows a hostile actor to steal information remotely, cheaply and on an industrial scale. It can be done with relatively little risk to a hostile actor’s intelligence officers or agents overseas.”

According to Privacy International, the government has tried to fill a legal void by publishing a draft Equipment Interference Code of Practice (PDF), while the new draft Investigatory Powers Bill (PDF) attempts to firmly place CNE “on a statutory footing, including provisions for ‘Equipment Interference’ (Part 5) and ‘Bulk Equipment Interference’ (Part 6, Chapter 3).”

Draft Equipment Interference Code of Practice, section 1.9

The potential cross-purposes of GCHQ’s offensive and defensive security practices have consistently concerned technologists. Speaking at IA15, an information assurance conference organised by GCHQ’s information assurance arm, CESG, the agency’s director-general dismissed accusations that the agency’s actions are not conducive to the UK’s security ecology.

Speaking to The Register at the time, Privacy International technologist Dr. Richard Tynan said: “Mr Hannigan is extremely nuanced with his words when he asserts that GCHQ does not encourage system weaknesses and regularly reports found vulnerabilities. While we may never know the full extent of coercion used by GCHQ, we do know that its big brother, the NSA, paid $10m to RSA, a company that provides encryption products.”

Dr Tynan continued:

We also know from the Edward Snowden revelations that GCHQ does not disclose all the vulnerabilities it finds and instead uses them for offensive hacking purposes. We have seen GCHQ target a variety of providers, from anti-virus vendors to software commonly used for online blogs and forums around the world.

There is no basis in law at present, or in the proposed Investigatory Powers Bill, authorising GCHQ to fail in its duty to protect the privacy and security of the public. Furthermore, this conduct undermines trust in devices, networks and services as users can be betrayed at any moment by anyone aware of the flaw, including cyber criminals and governments.

GCHQ declined to comment when questioned by The Register about the existence of a Vulnerabilities Equity Policy, such as that the NSA uses to hoard zero-day exploits.

Privacy International maintains that CNE “is far more intrusive than any single surveillance technique currently deployed by the intelligence services because once entry to a device is gained, there is no technical barrier preventing agents from obtaining far more information.”

In the campaign group’s words:

The [GCHQ] agent can gain access to any stored data, including documents, emails, diaries, contacts, photographs, internet messaging chat logs, and location records on mobile equipment.

The agent can also see anything typed into the device, including passwords, internet browsing, and draft documents and communications never intended to share.

Deleted files can be accessed and the functionality of the device can be controlled, such as turning on the microphone, webcam, and GPS-based locator technology.

CNE is not only deployed against individual computers and mobile phones, but can be used against entire communications networks, undermining privacy and security en masse.

The hearing begins at 10:30 this morning. ®

Sponsored:
Data Loss Prevention Data Theft Prevention

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/12/01/gchq_privacy_international_investigatory_powers_tribunal/

Conficker was the most common malware used to attack UK and international organisations in October, accounting for 20 per cent of all attacks globally, according to security vendor Check Point.

When it first appeared in November 2008, the Windows-affecting Conficker worm caused all manner of problems mainly because of its ability to spread across networks, infect windows machines and brute force passwords.

Networks of the French Navy, the UK House of Commons and Greater Manchester Police were all laid low by the malware. Its recent resurgence hasn’t caused anything like the same amounts of problems but still highlights the generally poor state of corporate security.

The return of the worm has seen the reported infection of police body cameras. Cameras from supplier Martel Electronics came pre-infected with the malware, according to researchers at Florida-based iPower.

Globally, three malware families (Conflicker, Sality and Cutwail) accounted for 40 per cent of all recorded attacks, revealing a trend for attacks focusing on gaining remote control of infected PCs, turning Windows machines into DDoS and spam-spewing botnet drones. Sality was first spotted in 2010 and Cutwail in 2007.

The latest monthly stats from Check Point further reveal that the Neutrino Exploit kit had become the fourth most common malware detected globally in October. The exploit kit can be used to attack computers using Java, and is associated with ransomware scams.

Ransomware and data-stealing malware attacks more generally rose sharply in October, according to Check Point. The Fareit malware, which steals users’ credentials from web browsers and emails, jumped from from a lowly position to become one of the top 10 strains in October, for example.

Check Point’s stats are pulled from its Threat Cloud World Cyber Threat Map. ®

Sponsored:
Data Loss Prevention Data Theft Prevention

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/12/01/conficker_dominates_threat_landscape_malware/

Documents released by GCHQ to the Investigatory Powers Tribunal suggest the agency may be allowed to hack multiple computers in the UK under single “thematic” or “class” warrants.

Responding to complaints brought by Privacy International and seven global internet and communication service providers, the British spy agency told the tribunal it was applying for bulk hacking warrants from secretaries of state and then deciding internally whether it was necessary and proportionate to hack the individuals targeted.

The “soft touch” oversight regime for GCHQ’s offensive hacking activities has been revealed during an IPT hearing, which has received two sets of complaints to hear over the course of this week – one from Privacy International, and one from an international coalition of internet and communications service providers which Privacy International assisted.

The complaints regard the offensive hacking, or computer network exploitation (CNE) activities, of GCHQ, which are alleged to have been unlawful under the Computer Misuse Act 1990, as well as in violation of Articles 8 and 10 of the European Convention on Human Rights. The agency denies the allegations.

In a 31-page Amended Statement of Grounds (PDF), the seven ISP and CSP claimants state their proceedings concern “GCHQ’s apparent targeting of internet and communications service providers in order to compromise and gain unauthorised access to their network infrastructures in pursuit of its mass surveillance activities.”

Privacy International’s 25-page Amended Statement of Grounds (PDF) specifically concerns the spooks’ CNE activities, including its development of malware (such as “Warrior Pride”) which may leave devices “more vulnerable to attack by third parties (such as credit card fraudsters), thereby risking the user’s personal data more broadly”, and of doing so without a legal basis. Privacy International said:

Govt hacking isn’t just about laptops phones. Smart watches, cars, televisions, toys… https://t.co/ghfJ5NsnWH pic.twitter.com/yMEr6LDg4J

— PrivacyInternational (@privacyint) December 1, 2015

Privacy International claimed that previously secret documents, and witness statements produced by GCHQ, show that:

• GCHQ confirmed that the Secretary of State does not individually sign off on most hacking operations abroad, but only when “additional sensitivity” or “political risk” are involved [Witness Statement of Ciaran Martin (PDF), paragraphs 65, 72C].
• Overseas hacking does not require authorisations to name or describe a particular piece of equipment, or an individual user of the equipment [56].
• The Commissioner only formally reviewed the individual targets of GCHQ hacks overseas in April 2015 [71I].
• The Intelligence and Security Committee Report in March 2015 called MI5’s and SIS’s failure to keep accurate records of their overseas hacking activities “unacceptable”, [ISC report, p.66] as it makes effective oversight impossible [71L].

Responding to these allegations in his witness statement (PDF), GCHQ’s Director-General for Cybersecurity, accepted that such interference causes additional damage. However, GCHQ merely attempts to “minimise that risk”.

The complaints follow the outing of GCHQ’s “Operation Socialist”, in which the spooks attacked Belgacom, the largest telecommunications company in Belgium, to gain access to its core GRC routers – ultimately for the purpose of running man-in-the-middle attacks against targets roaming with smartphones.

The coalition complaint stated: “It is important to note that the employees of Belgacom were not targeted because they posed any legitimate national security concern. Instead, they were subject to intrusive surveillance because they held positions as administrators of Belgacom’s networks. By hacking the employees, GCHQ could secure access to the customers.”

All of the accusations regarding GCHQ’s conduct were reliant upon on public disclosures made by former NSA contractor Edward Snowden, which have been published in various outlets by the journalists to whom he has entrusted the documents.

The IPT heard the claimants’ submissions this morning and will hear the responses tomorrow. The hearing is set to continue until Friday 4 December. ®

Sponsored:
Data Loss Prevention Data Theft Prevention

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/12/01/gchq_v_privacy_international_bulk_hacking/

5 Ways VTech’s Scrooge-like security spending put young users at risk.

As news unfolds about the huge data breach at toymaker VTech that exposed personal information and passwords for s close to 5 million parents and 200,000 children, it’s becoming clear that sometimes the Grinch isn’t the thief. Sometimes the Grinch is the company with poor security practices that makes it possible for thieves to take innocent consumers’ data–especially when those consumers are minors.

The VTech breach, which was first reported in a Motherboard article last week, seems to have been carried out not to steal the data, but to prove a point through its exposure: VTech’s security stinks, and there’s loads of data at risk as a result. Included in the data dump were poorly encrypted passwords, secret questions stored in plaintext and names, birthdays, photos, and chat logs for children using VTech toys that were easily tied to their parents’ identifiable information like home addresses.

“Fortunately, the damage appears to be limited in that this attacker hasn’t shared the data, but there’s no way of knowing whether other attackers may have already obtained the same data,” says Shuman Ghosemajumder, vice president of strategy at Shape Security. “Parents in general should, of course, be very careful about who they give their children’s information to, and should watch for telltale signs that a company isn’t taking security seriously.”

The attention garnered by the exposure has certainly drawn the security community’s microscope over VTech and what it found isn’t pretty.

 

Willful Ignorance On What Kind Of Data Is Valuable

“VTech is proud that no credit card or banking information was stolen, but the data that was stolen could potentially make this breach more damaging and dangerous over the long run,” says Jeff Hill, channel marketing manager for STEALTHbits, who explains that while credit card information can be cancelled, personal information cannot.

As he explains, patient criminals can stash information like names, birthdays, and mailing addresses to carry out future attacks that take advantage of initially stolen informatoin. In particular, information on minors can be seriously valuable as parents are less likely to do credit checks on their kids than on their own identities–giving attackers a longer time to use a stolen minor’s information without any repercussions.

“Much more disturbing, however, is the potential for child predators to obtain and exploit the children’s information,” Hill says.

 

Atrocious Encryption Practices

In a thorough analysis of VTech’s data collection practices and weaknesses observable through its Web applications’ customer interface and through information from the breach’s data dump, development security expert Troy Hunt dismantled the company’s data security practices. One of the first glaring problems? VTech is encrypting all of its parent passwords using only an unsalted MD5 hash. 

“Once the passwords hit the database we know they’re protected with nothing more than a straight MD5 hash which is so close to useless for anything but very strong passwords, they may as well have not even bothered,” he wrote.

As Hunt explains, VTech’s encryption at rest is second only to no encryption at all–which is exactly the route the company chose to go with for data in transit.

“All communications are over unencrypted connections including when passwords, parent’s details and sensitive information about kids is transmitted,” he says. “These days, we’re well beyond the point of arguing this is ok – it’s not.” 

Similarly, all data surrounding password reset questions were also stored in plaintext.

 

No Data Retention Boundaries

Beyond the crummy encryption, though, is an even more endemic data governance problem at VTech. Given the volume and variety of data breached, its clear that no thought had been given about data collection and retention policies. Exhibit A on this is the news yesterday that chat logs were also left exposed on VTech servers–leading most security experts to wonder why that data was even available to take.

If the firm had some kind of philosophy with regard to either collection or retention, VTech likely would have thought twice about the risk it incurred by keeping this kind of sensitive information.

“You should only collect and store data for well understood use,” wrote Mark Nunnikhoven, vice president of cloud research for Trend Micro in a blog discussing the breach. “Data should be evaluated for its overall value to the organization and—just as importantly—the risk it can pose to the organization.”

 

Bad Data Design

VTech’s data governance woes extended beyond just promiscuous collection and retention practices. Another huge flaw exposed by this breach is the sloppy data design that allowed sensitive information about kids to be tied to even more identifiable information stored about those kids’ parents.

These kinds of considerations are absolutely huge for companies that collect data on children, says Beth Marcus, CEO and founder of children’s app developer Playrific.

“Through the data access structure, it’s crucial to prevent various data pieces from being put together by any external player – even when parental permission in given,” Marcus says. “You have to break the link between the data and the child, and the links between the various pieces of the data vault containing different elements of the individual’s data. When kids are involved, saying ‘sorry we didn’t think about that’ doesn’t cut it. Hackers may never exploit data the way you think they might, that’s why you can’t risk having identifying information and behavior information tied together anywhere in the system at rest.”

  

SQL-Laden Error Messages

VTech has gone on record saying that the likely attack vector for the breach was the tried and true SQL injection. That’s no surprise given the fact that the company’s error messages are serving up attackers valuable infrastructure on a silver platter. According to Hunt, VTech’s password error messages were returning SQL statements to users. That’s pretty much putting out the welcome mat for SQLi attackers.

 “This breach is another sad example of a company ignoring some very basic application security best practices,” says Chris Eng, vice president of research for Veracode. “Why are websites still vulnerable to SQL injection today? The industry has known about this for decades, is one of the OWASP Top 10 most dangerous vulnerabilities and they are not difficult to find or fix.”

 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: http://www.darkreading.com/vulnerabilities---threats/the-grinch-who-exposed-your-kids-identities/d/d-id/1323356?_mc=RSS_DR_EDT

In the modern enterprise, chief information security officers need a broad mandate over security and risk management across all operational silos, not just the datacenter.

As data breaches continue to escalate, organizations, regardless of size or industry, need a new mindset to rise to the pervasive challenge of cybercrime and cyber espionage. Despite the fact that the FBI claims that their number one criminal priority is cybercrime, less than five percent of computer intrusions are successfully prosecuted, according to the Department of Justice and FBI. With jail time and other penalties few and far between, corporate decision makers are on their own when it comes to protecting corporate reputations, intellectual property, finances, and customers.

Facing this challenge boils down to risk management and financial investment. But with only 8 cents of every corporate IT dollar allocated towards security, the current picture isn’t reassuring, especially given the hostility and unregulated nature of cyberspace. Worse, today’s security investment deficit is jeopardizing corporate brands and exacerbating their risk of serious reputational damage.

Board-level mandate beyond the datacenter
Typically, organizations serious about cybersecurity appoint chief information security officers (CISOs) to lead the charge. Historically, a CISO answers to the chief information officer (CIO). The problem with this model is that the CIO role is similar to that of a football offensive coordinator, a position that is concerned primarily with increasing efficiencies, access, and resiliency within the IT realm.

While important, none of these elements aid the CISO, (continuing our football analogy, the defensive coordinator), whose principal job is to improve security and risk management across all operational silos within the enterprise. From a governance perspective, the CISO needs a broader mandate than that of a defensive coordinator, a mandate befitting an executive with more far-reaching responsibilities and reporting to the COO or CEO.

In the modern enterprise, all corporate leaders should be held accountable for their cybersecurity posture, even though their position might be far from managing the datacenter. For instance, chief marketing officers are typically focused on the actual use of the Web, such as email campaigns, mobile app development, website updates, blogs and search engine optimization. Even though these responsibilities may seem like strictly promotional endeavors, they can leave the door open for malware or other cyberattacks against unsuspecting customers’ systems. It’s not a good outcome for the company or the constituency.

Preventing the systemic spread of malware
Malware infections often times migrate from one part of the enterprise to the other, even from a third-party partner. Once a network is compromised, an attack can become widespread throughout the entire IT infrastructure supply chain in a practice known as “island hopping.” A classic example of island hopping was the infamous Target breach, which ultimately resulted in the resignation of both the CEO and CIO. A holistic mentality toward cybersecurity will mitigate the systemic risk of the spread of threats across an IT infrastructure.

The subsequent investigation at Target also revealed that thieves had infiltrated a third-party vendor to steal the retail giant’s credentials. The result? Cybercriminals successfully gained access to approximately 40 million customer credit cards, potentially affecting more than 100 million individuals. The repercussions are still being felt throughout the retail sector today.

As Target shows us, third-party partnerships are another overlooked aspect of many security strategies – strategies that demand attention and support from the corporate leadership team to be effective. Organizations looking to strengthen security should examine the policies of their partners — including law and accounting firms — particularly if a company is publicly traded. These partners have access to sensitive information that make very attractive targets.

A new level of safety in the digital world
For two decades, corporate focus has predominantly been on cutting cost, improving access and increasing efficiencies to goods and services. The same commitment should now transition to policies that make customers, partners and investors feel safe in the digital world created for their convenience. Just as a customer at a shopping center should expect a level of safety from the landlord and retailers, an online environment should have the same trust factor.

To accomplish this, a concerted effort should be made to elevate cybersecurity to an operational and reputational risk management priority. It is the obligation of boards of directors to improve oversight and governance for cybersecurity. This translates to analyzing investment strategies regarding information technology, cybersecurity and drastically improving training in order to stay ahead of sophisticated cybercriminals.

The Internet is not a comforting environment. Proper due diligence of cybersecurity is not only a risk management function but also a reality of modern-day brand protection.

 

Within his role as chief cybersecurity officer, Tom Kellermann is responsible for analysis of emerging cybersecurity threats and relevant defensive technologies. Tom served as a commissioner on The Commission on Cyber Security for the 44th Presidency and serves as an advisor … View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/how-cisos-can-change-the-game-of-cybersecurity/a/d-id/1323357?_mc=RSS_DR_EDT

An anti-racism group in Brazil is waging an intriguing campaign against intolerant internet commenters – ironically, by attempting to make racist comments as visible as possible.

The group Criola (a Portuguese word meaning “Creole”) is bringing offensive comments made on Facebook and Twitter from the virtual world into the real world by publishing them on giant billboards in neighborhoods where the commenters live.

Criola says on a website publicizing the “Virtual Racism, Real Consequences” campaign that it’s trying to educate people about the effects of racist comments, and hopes it will make people think twice before posting.

The group launched its campaign last July in response to what it says were racist attacks on an Afro-Brazilian TV broadcaster, Maria Julia Coutinho, after the news organization Journo Nacional posted her photo on its Facebook page.

Because some of the commenters had geolocation turned on, Criola was able to track down those users to their home cities and plaster their comments on billboards in their neighborhoods.

One billboard in the city of Feira de Santana, in the state of Bahia, shows a Facebook comment reading:

If you washed properly, you wouldn’t be so dirty.

We’re not fluent in Portuguese, but according to the BBC, that was one of the milder comments highlighted by the campaign.

In an interview with the BBC, Criola founder Jurema Werneck said the campaign is supposed to encourage people to report racism they encounter online.

The billboards don’t show the names or faces of the commenters and the profile images and names are blurred out – Criola says it has “no intention of exposing anyone.”

But there is an intimidation factor too – Werneck told the BBC abusive commenters think they can “do whatever they want” in the comfort of their own homes, but they “can’t hide” from her group:

Those people [who post abuse online] think they can sit in the comfort of their homes and do whatever they want on the internet. We don’t let that happen. They can’t hide from us, we will find them.

The campaign is definitely shining a bright spotlight on big issues facing social media users, including harassment, trolling and even free speech (in Brazil, racist comments are illegal).

There’s another lesson in here for people concerned about their online privacy: anything you say online can come back to haunt you in the real world.

Consider turn off geolocation on your mobile devices – it can save you from online harassers coming straight to your doorstep.

And one more technique to avoid being outed as a racist: don’t be a racist.

Follow @JohnZorabedian

Image of Brazil flag courtesy of Shutterstock.com. Billboard image courtesy of Criola.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ATwO0v9b9OE/

Analysis Although Chancellor George Osborne recently spoke of the National Grid, hospitals and air traffic control as being potential targets of online attacks in a recent high-profile speech at GCHQ, only the financial services sector runs comprehensive stress tests.

The lack of exercises designed to hone defences raised serious questions about the robustness of key components of the UK’s critical national infrastructure.

The banking industry is getting tested but there isn’t anything like Waking Shark II and Resilient Shield for other elements in the critical infrastructure (power, telecoms etc.) And the need for preparedness against attack in other sectors is certainly there.

“For our country, defending our citizens from hostile powers, criminals or terrorists, the internet represents a critical axis of potential vulnerability,” Osborne said during his speech at GCHQ. “From our banks to our cars, our military to our schools, whatever is online is also a target.”

“We see from this place every day the malign scope of our adversaries’ goals, their warped sophistication and their frenetic activity. The stakes could hardly be higher – if our electricity supply, or our air traffic control, or our hospitals were successfully attacked online, the impact could be measured not just in terms of economic damage but of lives lost,” he added.

Osborne said during his speech that “GCHQ is monitoring cyber threats from high end adversaries against 450 companies across the aerospace, defence, energy, water, finance, transport and telecoms sectors”. The Chancellor warned that “every British company is a target, that every British network will be attacked”.

In the line of fire

Evidence that targeted attacks have spread and have affected victims far outside the financial sector is all too apparent, even though incidents of hackers taking out power grids (squirrels are a much bigger threat to power distribution systems, at least) or threatening lives are conspicuous by their absence.

Ed Wallace, director of incident response and advanced threats at security consultancy MWR Infosecurity, told El Reg: “After Stuxnet, Shamoon is probably the most widely known destructive computer attack and is frequently attributed to Iran. It targeted several organisations’ networks, most publicly Saudi Aramco (one of the world’s largest companies), wiping out their corporate network of nearly 30,000 machines, along with a similar attack against RasGas, as well as several others.”

Media and telecoms have also been hard hit by nation-state orchestrated attacks.

“The ’Dark Seoul’ attacks that wiped computers at three banks and three media organisations in South Korea [were an example]. Since then many parts of CNI [Critical National Infrastructure] in different countries have been attacked from telecommunications to nuclear power plants.

“By far and away the majority of these attacks have continued to focus on information theft but the recent attack a few months ago against French TV5 news channel (now attributed to Russia and the ‘APT-28’ group, often thought to be running under the Russian Military service, the ‘GRU’) shows that it’s not just the financial sector that is increasingly at risk.”

Wallace added: “At MWR we track various countries’ cyber programmes and most are looking to adopt variants of China’s ‘Unrestricted Warfare’ doctrine, which singles out five key sectors: Finance, Media, Energy, Telecommunications and Transport. The focus for most remains on Finance (as it is in China’s UW doctrine) but the other sectors are also under attack and are at risk.”

Jim Gumbley, who worked on security within the Cabinet Office before moving on to the private sector with global IT consultancy ThoughtWorks, said that financial sector firms are ahead of the resilience game.

“Our finance clients almost always have a structured and resourced approach to protecting against attack, however things are patchier in other sectors,” Gumbley told El Reg. Most of the finance sector works within regulation or policy that explicitly makes handling information security risk an executive responsibility. When the leaders of an organisation take information security risk seriously, it does seem to have an impact on outcomes.”

The high-profile hacks over the last year underline the need for companies to build more secure software from the outset, rather than adding it on at the end, according to Gumbley.

Dr Evangelise Ouzounis, head of secure infrastructures and services unit ENISA, the EU cyber-security agency, told El Reg that the banking sector does resilience testing because the regulator in that area has more authority.

Simply the CBEST

Cyber resilience tests are currently mandatory for the financial sector, and this is enforced by the bank of England.

MWR Infosecurity’s Wallace added that CBEST, a vulnerability testing framework designed to properly test key financial organisations cyber security, has no equivalent outside the banking sector.

He said: ”CBEST is a trail-blazing scheme in the UK and one which many other countries across the globe are following with great interest as they also look to implement similar improved security testing regimes. However, beyond the financial sector, there are little similar testing methodologies as advanced as CBEST for other parts of the critical national infrastructure.”

Other infosec experts warn that replicating this capability outside finance may take time and a lot of heavy lifting.

Greg Tebbutt, head of engineering at Sparrho, a London-based startup developing a scientific literature recommendation service, commented: “Resilience testing is costly, difficult to address, and without immediate payoff. This is why companies don’t like spending on it in general. Add in the fact that many managers aren’t directly involved in or familiar with the technical side of things, and the financial and, more importantly, time commitment becomes too much.”

Traffic

Rob Partridge, head of The BT Security Acadamy, at the Cyber Security Challenge UK’s masterclass, said that the telco was active in running resilience tests internally despite the lack of telecoms industry framework, or at least the absence of one as mature as that already established by the banking industry.

“We are fully prepared for any threat that comes our way and we respond accordingly, and we practice and practice, and test, and we do that both as tabletop exercises,” Partridge told El Reg. “But clearly we wouldn’t want to discuss that openly because that would then mitigate our responses.”

Telcos already co-operate on security, Partridge explained.

“We certainly work together and cooperate. Government but cooperation strategies in place, things like the Cyber Information Sharing Partnership which is a publicly subscribable organisation run by CERT UK for us to share intelligence about threats and things like that.”

A comment from NATS (the “UK’s leading provider of air traffic control services”, according to its website) received Monday afternoon read:

“NATS is part of the UK critical national infrastructure and while we don’t discuss the details of our security controls, we are working closely with the UK government and other aviation industry partners to ensure that security levels are monitored, managed and appropriate.”

“NATS is ISO27001-certified  and we constantly review our procedures and technologies to understand, and guard against, the latest threats,” it added.

State of readiness

Marcus de Wilde of mobile application security testing biz Codified Security, highlighted one US precedent that illustrated how regulators might play a role in insisting in improvements to corporate security. The FTC had insisted on improvements at hotel chain Wyndham Worldwide Corporation and this policy was upheld by the courts when the hotel chain appealed. “Wyndham Worldwide Corporation is interesting due to Starwood hotel and others facing breaches recently,” he said.

The US National Cybersecurity Center of Excellence (NCCoE) recently released a draft document called “Identity and Access Management for Electric Utilities,” which was based on the NIST Cybersecurity Practice Guide. The proposals underscored the need for energy sector companies to do better and also displayed the state they are in through inference. Industry comment on the proposals from Lieberman Software Corporation can be found here.

Public-private partnership

During a recent high profile speech, GCHQ director Robert Hannigan said private industry wasn’t doing enough to improve cyber-security.

Jonathan Sander, VP of product strategy at privileged identity management firm Lieberman Software Corporation, responded that the spy centre boss may have a point and that private sector firms need to learn how to share information, something that cuts against the grain.

Herd immunity

“Doing cybersecurity well means doing at least two things that commercial organisations are very uncomfortable with – admitting errors in public and sharing information they create through their own investment to benefit all,” Sander said.

“These are things that fly in the face of what most think of as postmodern business practice in many cases. There are organisations who see past the petty competitive impulses and do wish to share and collaborate. However, since true cybersecurity will take a large dose of herd immunity, these information-sharing outliers are not enough to immunise the pack against today’s relentless attackers,” he added.

Sander added that pushing tougher regulations is not necessarily the way to improve security.

“While putting more laws and regulations into place will likely be ineffective, the government could create safe spaces for commercial organisations to share and collaborate that reduce their perception of the risks of that sharing,” Sanders said. “They could act as a clearing house for signal intelligence and threat data.”

We asked GCHQ’s press team for a comment on resilience testing outside the financial sector but it referred our inquiry to the CPNI, the lead UK agency for infrastructure protection.

“CPNI (the Centre for the Protection of National Infrastructure) works on programmes to protect major industries (example here) so for a response to your enquiry you would be best to contact them. CESG’s role is to work in conjunction with CPNI,” GCHQ told El Reg.

Press inquiries about the CPNI are run by the Home Office. Nobody knowledgeable on the topic was available for comment on Friday afternoon. We’ll update this story as and when we hear more. ®

Additional reporting by Alexander Martin

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/30/cyber_resilience_analysis/

Pwned ransomware Linux Encoder has infected 3000 machines in a month, Russian security firm Dr Web says, despite the fact both versions of the software have been neutered.

The first version of the ransomware was decrypted by security boffins at BitDefender days after it was first revealed by Dr Web.

Linux.Encoder.1 encrypts all files in the home, root, MySQL, Apache, and Nginx directories using 128-bit AES.

It then encrypts directory contents that include in strings public_html, www, webapp, backup, .git, and .svn.

WordPress and Magento sites are the main targets. The software had infected 2000 sites by 12 November and surpassed 3000 two weeks later.

Dr Web reported the second iteration of Linux Encoder on 20 November noting that it was different thanks to its use of another pseudorandom number generator, the use of OpenSSL over PolarSSL, and encryption made using AES-OFB-128 mode with context reinitialisation every 8 AES blocks.

That too can be unlocked using Dr Web’s online portal.

BitDefender bod Radu Caragea says most ransomware like Cryptowall are solid pieces of malware that resist decryption efforts.

“If your machine has been compromised, consider this a close shave,” Caragea says. “Most crypto-ransomware operators pay great attention to the way keys are generated in order to ensure your data stays encrypted until you pay.”

System admins should back up to offline media and consider running the low-impact the Cryptowall pre-eemptive defence tool on PCs where critical data resides which prevents the nasty malware from executing. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/12/01/cant_get_a_break_pwned_linux_ransomware_pwned_again_infects_3000/

A love-struck British woman has been fleeced of £1.6 million by two men posing as romantic interests she met through an online dating site.

The businesswoman handed over increasingly large sums of cash over 10 months last year to the men totalling US$2.4 million (A$3.3 million).

Nigerian Ife Ojo, 31, and Olusegun Agbaje, 43, pled guilty to the romance scam.

Ojo posed as a student of the London School of Business and Finance while Agbaje claimed to be an admin assistant for the National Health Service in Essex.

Detective Chief Inspector Gary Miles of the MET’s FALCON operation team said 100 Britons had lost a whopping £4 million to love scams last year alone, but losses are likely much higher.

“The suspects showered them with compliments and confided their seemingly innermost secrets to them [and] in many cases, the suspects were talking to their victims online or over the phone for hours every day,” Miles says.

“Victims typically feel embarrassed and ashamed when they realise they have been duped, so they often don’t report what has happened to them or even confide in a friend.

“Victims of this fraud must understand that they are not foolish and they are not alone – the reality is that the fraudsters are extremely manipulative and go to great lengths to convince their victims they are in love and desperately in need of their financial assistance.”

Aussies have according to public figures lost more than their British counterparts sending a staggering A$7500 (£3600) a day or A$28 million (£13.5 million) in 2014 alone to romance scammers.

NPR’s Reply All speaks to a woman and her romance scammer.

The scammers are making big bucks and those based in countries including Nigeria are largely getting away with the crimes thanks to low levels of police resources.

Australian law enforcement have targeted the love rats for years and report that many victims will continue to hand over money to the scammers, unable to accept that the cash already sent and emotional investment is lost. ®

Sponsored:
Data Loss Prevention Data Theft Prevention

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/12/01/british_woman_loses_16_million_to_busted_romance_scam_love_rats/

GCHQ is being challenged over its offensive hacking practices at a hearing beginning right now. The challenge is being heard by the Investigatory Powers Tribunal, which is the only judicial body in the country with the authority to receive complaints regarding the intelligence agencies.

Two complaints were filed last year, by Privacy International and a global coalition of ISPs and related organisations, regarding offensive hacking practices that GCHQ is alleged to have conducted unlawfully.

Privacy International claims there was no clear lawful authority for GCHQ to conduct computer network exploitation (CNE) operations when these cases were filed. The government subsequently introduced an amendment to the Computer Misuse Act which Privacy International alleged was an “underhand and undemocratic” act which was “seeking to make lawful GCHQ’s hacking operations.”

A Home Office spokesperson denied the amendment “increase[d] or expand[ed] the ability of the intelligence agencies to carry out lawful cyber crime investigation.”

CNE, as defined by MI5, “allows a hostile actor to steal information remotely, cheaply and on an industrial scale. It can be done with relatively little risk to a hostile actor’s intelligence officers or agents overseas.”

According to Privacy International, the government has tried to fill a legal void by publishing a draft Equipment Interference Code of Practice (PDF), while the new draft Investigatory Powers Bill (PDF) attempts to firmly place CNE “on a statutory footing, including provisions for ‘Equipment Interference’ (Part 5) and ‘Bulk Equipment Interference’ (Part 6, Chapter 3).”

Draft Equipment Interference Code of Practice, section 1.9

The potential cross-purposes of GCHQ’s offensive and defensive security practices have consistently concerned technologists. Speaking at IA15, an information assurance conference organised by GCHQ’s information assurance arm, CESG, the agency’s director-general dismissed accusations that the agency’s actions are not conducive to the UK’s security ecology.

Speaking to The Register at the time, Privacy International technologist Dr. Richard Tynan said: “Mr Hannigan is extremely nuanced with his words when he asserts that GCHQ does not encourage system weaknesses and regularly reports found vulnerabilities. While we may never know the full extent of coercion used by GCHQ, we do know that its big brother, the NSA, paid $10m to RSA, a company that provides encryption products.”

Dr Tynan continued:

We also know from the Edward Snowden revelations that GCHQ does not disclose all the vulnerabilities it finds and instead uses them for offensive hacking purposes. We have seen GCHQ target a variety of providers, from anti-virus vendors to software commonly used for online blogs and forums around the world.

There is no basis in law at present, or in the proposed Investigatory Powers Bill, authorising GCHQ to fail in its duty to protect the privacy and security of the public. Furthermore, this conduct undermines trust in devices, networks and services as users can be betrayed at any moment by anyone aware of the flaw, including cyber criminals and governments.

GCHQ declined to comment when questioned by The Register about the existence of a Vulnerabilities Equity Policy, such as that the NSA uses to hoard zero-day exploits.

Privacy International maintains that CNE “is far more intrusive than any single surveillance technique currently deployed by the intelligence services because once entry to a device is gained, there is no technical barrier preventing agents from obtaining far more information.”

In the campaign group’s words:

The [GCHQ] agent can gain access to any stored data, including documents, emails, diaries, contacts, photographs, internet messaging chat logs, and location records on mobile equipment.

The agent can also see anything typed into the device, including passwords, internet browsing, and draft documents and communications never intended to share.

Deleted files can be accessed and the functionality of the device can be controlled, such as turning on the microphone, webcam, and GPS-based locator technology.

CNE is not only deployed against individual computers and mobile phones, but can be used against entire communications networks, undermining privacy and security en masse.

The hearing begins at 10:30 this morning. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/12/01/gchq_privacy_international_investigatory_powers_tribunal/