STE WILLIAMS

Juno this ain’t right! Chinese hackers target Alaska

An attack on US government facilities in Alaska has been traced back to China’s Tsinghua University and a larger hacking effort.

Researchers with security house Recorded Future say [PDF] that the attack, initially focused on seperatist activity in Tibet, grew to to target US government operations in the Pacific including bases in Alaska.

The attack is said to be a combination of political and industrial espionage, with the attackers targeting both public and private entities. German auto house Daimler was also a target.

“We identified the targeted scanning of German automotive multinational Daimler AG that began a day after it cut its profit outlook for the year, citing the growing trade tensions between the U.S. and China,” the report noted.

“In several cases, these activities occurred during periods of Chinese dialogue for economic cooperation with these countries or organizations.”

The researchers note that Tsinghua University has long been affiliated with China’s state-backed hacking campaigns. An attack on Alaska would both give China inroads on Tibetan activists in the US as well as peek on the nascent trade talks between the Middle Kingdom and the Trump administration.

“This targeting of the the State of Alaska Government followed Alaska’s large trade mission into China dubbed “Opportunity Alaska,” the report notes.

“This trade mission occurred in late May and was led by Bill Walker, governor of Alaska. During these talks, one of the highest-profile discussions occurred around the prospect of a gas pipeline between Alaska and China.”

arrest

Chinese chap collared, charged over massive US Office of Personnel Management hack

READ MORE

The report also notes that the attack concerns sites in other areas tied up in trade negotiations with China. Recorded Future says that, among others, Kenya has been hit in the operation.

“In early June 2018, we observed the Tsinghua IP address aggressively scanning ports 22, 53, 80, 389, and 443 of various Kenyan internet-hosting providers and telecommunications companies, as well as ranges dedicated to the Kenya Ports Authority, a state corporation responsible for the maintenance and operation of all of Kenya’s seaports,” their report reads

“Recorded Future also identified network reconnaissance activities directed at the United Nations Office in Nairobi, Kenya’s Strathmore University, and a broader national education network.”

Not surprisingly, China has denied involvement in those shenanigans. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/16/china_hacks_alaska/

  • 16/08/2018
  • adm

Who was it that hacked Apple? Ozzie Ozzie Ozzie, boy boy boy!

An overzealous Apple fanboy from Australia plead guilty to criminal charges after he allegedly cracked the Cupertino giant’s systems in hopes of landing a job.

The 16 year-old hackeroo, who was not named in accordance with local law, is said to have broken into the idiot tax racket’s servers on more than one occasion, downloading around 90GB worth of iStuffs and saving it into a folder hilariously labeled as “hacky hack hack.”

According local reports, the young man’s defense attorneys claim that the hacking was done out of admiration. The junior Apple fan was only trying to get Apple’s attention. Now, instead of a job, he faces a criminal conviction.

The report notes that Apple found out about the breach last year and sent an alert to the FBI. The Feds, in cooperation with Australian law enforcement, were able to trace the intrusion back to machines owned by the unnamed teen. From there, they were able to seize laptops, a phone, and a hard drive that all connected the youngster to the Cupertino break-in.

Money laundering

Florida Man laundered money for Reveton ransomware. Then Microsoft hired him

READ MORE

“A mobile phone and hard drive were also seized and the IP address … matched the intrusions into the organisation,” the Age reported. “The purpose was to connect remotely to the company’s internal systems.”

The report did not specify what the lifted data was or if it included any user account details or personally identifiable information. It was noted that Apple was particularly eager to avoid generating any publicity in the matter. They didn’t get their wish.

Apple did not respond to a Register request for comment on the matter, nor would it commit to offering a job to the pint-sized pentester.

We would argue that if starry-eyed teenagers are pwning internal systems to plunder 90GB worth of data, the company should take all the help it can get. Heck, a criminal hacking conviction is hardly worse for one’s CV than admitting to serving an internship with Uber. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/16/who_hacked_apple_ozzie_ozzie_ozzie_boy_boy_boy/

  • 16/08/2018
  • adm

Facebook Awards $1M for Defense-Based Research

The company today awarded $200,000 to winners of the Internet Defense Prize after spending $800,000 on the Secure the Internet grants.

Facebook today confirmed it’s awarding $200,000 to the top three winners of the Internet Defense Prize, one week after it paid $800,000 at Black Hat for Secure the Internet grants.

The Internet Defense Prize started in 2014 as part of a partnership with USENIX. Its goal is to recognize research intended to improve Internet security, and it awards $100,000 to the author(s) of the winning paper, $60,000 for second place, and $40,000 for third place.

This year’s winners, from KU Leuven, submitted a paper entitled “Who Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies,” which focused on improving the ways that browsers prevent cross-site attacks and third-party tracking using cookies.

Second prize went to a group from Brigham Young University that created a prototype simulation to make it easier for app developers to use cryptography. Third place went to a team from the Chinese University of Hong Kong and Sangfor Technologies, which took a closer look at the implementation of single sign-on code.

Read more details here.

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info. 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/facebook-awards-$1m-for-defense-based-research/d/d-id/1332570?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 16/08/2018
  • adm

Active Third-Party Content the Bane of Web Security

New reports shows many of the world’s most popular sites serve up active content from risky sources.

It isn’t just seedy websites putting browsers at risk anymore: A new report out today shows how the state of the Web today has been rocked by the increasingly toxic combination of dynamic content and the use of third-party data sources to serve up that active content.

“So many people talk about how risky the Web is today, but it is really important to understand why. What’s changed over the last 10 years?” says Kowsik Guruswamy, CTO of Menlo Security. “Back in the day you didn’t have JavaScript, you didn’t have Flash, there were no complicated ad networks and most of the Web was a purely static place. While that wasn’t nearly as exciting from an interactivity perspective, it was much less risky.”

Last year Menlo started to get its arms around quantitative numbers to describe that risk and found that 42% of the Alexa Top 100,000 were serving up risky content or were vulnerable to compromise.

Researchers from the firm followed up on that today with their State of the Web First Half 2018 report. In it they examined Web risk based on the top 50 sites for six major countries worldwide. The study offered up statistics to illustrate the key risk factors of how the Web runs today. Top among those is how much active content from third parties like content delivery networks (CDNs) and ad delivery networks are pushed out to the user every time they visit a site. 

“When a user clicks on a Web link to open a website, they are really opening not just a single website, but at least 25 websites at one time,” the report explains. “If any of these background sites are themselves risky, they could be used by cyberattackers to compromise the site being visited.”

The dynamic nature of most sites today is extremely high. For most countries studied, the average number of scripts executed per website was between 41 and 42. In the US, some top sites used as many as 160 scripts from 40 different background sites. As the report explains, these scripts are usually legitimately used by developers to improve user experience.

But the more scripts used and the more sources they come from, the broader the attack surface. The bad guys love those scripts because they’re perfect for delivering attacks like iFrame redirects and malvertising links.

The study showed that as many as 46% of the top sites in France are serving active code from risky background sites, followed by 32% of the top UK sites. In the US, that proportion was a bit lower—18% of the Alexa Top 50 sites contain active code served from risky background sites—but that’s still a statistically significant chunk of what most people would consider to be legitimate sites.  

In addition to these risk factors, a number of the top sites worldwide exacerbate things by running their Web properties on vulnerable software. Approximately 8% of US sites, 10% of UK sites, and 20% of France sites were running on outdated platforms. 

“I always hammer on websites running old code because of how prevalent that is on the Internet and how it continues to be a big source of malware risks,” Guruswamy says. 

The takeaway for security leaders, he says, is to consider how well categorization-based security or URL filtering is protecting their users online today because they don’t cover these threats coming from sites that would otherwise be deemed legitimate and safe. 

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info. 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/application-security/active-third-party-content-the-bane-of-web-security/d/d-id/1332572?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 16/08/2018
  • adm

Researcher Finds MQTT Hole in IoT Defenses

A commonly used protocol provides a gaping backdoor when misconfigured.

It started with a simple wish: Martin Horn, security researcher at Avast, wanted a smart home. As he began his research into systems, he found that many devices included set-up instructions with no security provisions. And then, it got worse.

Horn realized that many of the hubs gathering IoT devices into a unified system run Message Queuing Telemetry Transport (MQTT) protocol, an ISO standard for device-to-device communications. And quite a lot of the devices acting as MQTT servers have no security at all. It’s not that they use a default user name and password, Horn says, it’s that they don’t have user names or passwords – period.

“It’s not a flaw in IoT devices themselves, it’s just a lack of security,” Horn says. “In this case, it’s wide open, with no password at all.” It’s important to note, he explains in an Avast blog post, that the MQTT protocol itself is secure, if implemented and configured correctly. The lack of security is the fault of the implementation, not the underlying protocol.

And the faulty implementations are widespread. Horn says that a relatively simple Shodan search found more than 49,000 MQTT servers visible on the Internet because MQTT has been improperly configured. Of those, more than 32,000 have no password protection at all.

Once compromised, the MQTT servers are primarily a threat to their owners. “This is more about leaking the data, not about becoming part of a botnet,” Horn says. “I can imagine the possibility, if you could update firmware over MQTT, of recruitment [into a botnet], but it’s mainly about leaking the data or losing control of the home system.”

And the problem is that the MQTT server, by dint of its central position in the IoT network, becomes a central point of security failure that can open the entire network to to compromise even if the individual endpoints are configured securely. Connecting to the unprotected MQTT server and using it to control other devices or reading data from the connected devices becomes almost trivial, according to Horn’s blog post.

Protecting these vulnerable devices is simple in concept: Add a username and password. In some cases that’s a trivial step in a configuration process. In other cases, it’s impossible, because the device manufacturer didn’t make allowances for the addition.

Horn says in his post:  “…we have called for better device-level security for IoT and for manufacturers to develop their products in such a way that encourages and makes it simple for all consumers to properly set up their devices and all the pieces related and connected to it, in order to ensure users’ entire smart ecosystem is secure.”

Related Content:

 

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info. 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/iot/researcher-finds-mqtt-hole-in-iot-defenses/d/d-id/1332573?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 16/08/2018
  • adm

Necurs Botnet Goes Phishing for Banks

A new Necurs botnet campaign targets thousands of banks with a malicious file dropping the FlawedAmmyy remote-access Trojan.

The Necurs botnet has resurfaced in a new phishing campaign targeting banks with malicious Microsoft Publisher and PDF files packed with the FlawedAmmyy remote-access Trojan.

Cofense researchers first detected the campaign early on August 15 and have confirmed 3,071 banking domains have been hit so far. Recipients range from small regional banks to some of the world’s largest financial institutions.

Necurs, a rootkit first discovered in 2012, became famous in 2016 when it was spotted delivering large volumes of Dridex and Locky ransomware. Now it’s resurfacing with new tactics as threat actors experiment with different strategies to see which are most effective.

“As far as this particular campaign, it is a change from what Necurs has been doing,” says Jason Meurer, senior research engineer at Cofense. He compared the attack with a marketing campaign, noting that “it felt like there was a little bit of A/B testing going on here.”

This campaign differed from Necurs’ usual strategy in several ways. For starters, it wasn’t your traditional spam — this was a phishing campaign specifically geared toward the banking industry, using malicious attachments to deliver a payload designed to enable remote access. It also leveraged Microsoft Publisher files, a shift from typical Word and Excel documents. A small subset of this campaign used PDF files, which shows the attackers are trying different tactics.

“It’s extremely rare” to see Publisher files in phishing attacks, says Cofense co-founder and CTO Aaron Higbee. While this type of file has been used in the past — after all, most employees are required to install Publisher as part of Office 365 — it’s not commonly seen in cybercrime.

Digging into the Details
Emails in this campaign are “fairly basic,” researchers report, with subject lines including “Request BOI” and “Payment Advice” with a random alphanumeric code tacked on the end. Higbee points out the phishing email was forged to appear as though it came from an employee at an Indian bank. A different Indian bank, Cosmos, recently lost $13.5 million in a cyberattack when hackers broke into its ATM server and stole customer information.

This campaign could potentially indicate a future ATM attack, says Higbee, and network access may be part of the actors’ motivation. The malicious .pub documents attached to phishing emails have embedded macros that, when executed, prompt a download from a remote host, explain Cofense’s Jason Meurer and Darrel Rendell in a blog post on the campaign.

The final payload is FlawedAmmyy, which is malware based on leaked source code for Ammyy Admin. It gives an attacker with full remote control of a compromised host, which can lead to file and credential theft and enable lateral movement within target organizations.

FlawedAmmyy had gone undocumented until early 2018, when Proofpoint research indicated the Trojan had been used in attacks as far back as January 2016 and as recently as March 2018. At that time, attackers began to use a new distribution method of combining ZIP files with the Server Message Block protocol to deliver FlawedAmmyy onto target systems.

The March campaign dropping FlawedAmmyy appeared to be the work of TA505, the same threat group associated with the Dridex, Locky, and GlobeImposter campaigns. While Cofense has not yet determined the motivation behind the latest Necurs campaign, Higbee says people who have been studying Necurs have linked the botnet to organized crime.

What’s Next for Necurs
Now that the campaign has come to a halt, Meurer anticipates the attackers are probably taking a look at their command-and-control infrastructure to gauge the effectiveness of their strategy. Did .pub files work, for example, or were PDF files more effective?

If there was little to no engagement, “they’ll go back to the drawing board and look for another file format they can use to deliver the next wave,” he says. “If we see Necurs do another phishing campaign using .pub files, it’s an indication people behind it were satisfied with the results.”

It’s a call for banking institutions to stay on their toes. Banks should make sure their perimeter security is in good shape and their email gateways are updated. “The second thing is to make sure banking employees are aware they’re targets of cybercriminals, just by the nature of the fact they work at a bank,” Meurer adds. “Any employee is a rich target for a cybercriminal.”

Related Content

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info. 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/necurs-botnet-goes-phishing-for-banks/d/d-id/1332574?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 16/08/2018
  • adm

Australians who won’t unlock their phones could face 10 years in jail

The Australian government wants to force companies to help it get at suspected criminals’ data. If they can’t, it would jail people for up to a decade if they refuse to unlock their phones.

The country’s Assistance and Access Bill, introduced this week for public consultation, strengthens the penalties for people who refuse to unlock their phones for the police. Under Australia’s existing Crimes Act, judges could jail a person for two years for not handing over their data. The proposed Bill extends that to up to ten years, arguing that the existing penalty wasn’t strong enough.

The Bill takes a multi-pronged approach to accessing a suspect’s data by co-opting third parties to help the authorities. New rules apply to “communication service providers”, which is a definition with a broad scope. It covers not only telcos, but also device vendors and application publishers, as long as they have “a nexus to Australia”.

These companies would be subject to two kinds of government order that would compel them to help retrieve a suspect’s information.

The first of these is a ‘technical assistance notice’ that requires telcos to hand over any decryption keys they hold. This notice would help the government in end-to-end encryption cases where the target lets a service provider hold their own encryption keys.

But what if the suspect stores the keys themselves? In that case, the government would pull out the big guns with a second kind of order called a technical capability notice. It forces communications providers to build new capabilities that would help the government access a target’s information where possible.

In short, the government asks companies whether they can access the data. If they can’t, then the second order asks them to figure out a way. Here’s a flowchart explaining how it works.

No backdoors

The government’s explanatory note says that the Bill could force a manufacturer to hand over detailed specs of a device, install government software on it, help agencies develop their own “systems and capabilities”, and notify agencies of major changes to their systems. In short, it would force communications providers to work extensively with the government to gain access to a target’s data where it was in their power to do so, and it would also compel them to keep all of this secret.

What if the communications provider doesn’t want to help? Then they could face penalties from the government, or “injunctions or enforceable undertakings”.

There are a few things that the Bill doesn’t allow. The government can’t force a company to build weaknesses into a product, or stop it from fixing those that it finds. That rules out encryption backdoors, then. Neither can it access information without a warrant.

However, the proposed legislation also creates a new class of access warrant that lets police officers get evidence from devices in secret before the device encrypts it, including intercepting communications and using other computers to access the data. It also amends existing search and seizure warrants, allowing the cops to access data remotely, including online accounts.

The backdoor war

In proposing this legislation, Australia joins a complex and heated debate about the role of encryption in the tech business. The Bill effectively rules out the inclusion of encryption backdoors, but seeks help from as many people as possible to get at the data, using a variety of loosely-defined methods.

Many services such as Snapchat don’t use end-to-end encryption, meaning that a government could use legislation like this to make it hand over a user’s encryption keys.

In this sense, it mirrors the UK’s Investigatory Powers Act, which asks telecommunications companies to remove electronic protections where possible. It also parrots FBI officials, who have said that they aren’t asking for encryption backdoors but that they do want vendors and service providers to break it where necessary.

The tensions over forced decryption have played out across the globe. In the US, Apple has tussled with the FBI in court over its unwillingness to help the feds break into its devices.

On the other side of the world, Russia blocked privacy-focused messaging company Telegram after it failed to hand over encryption keys that protect its cloud-based chats. However, Telegram also offers ‘secret chats’ for the extra-paranoid, which support end-to-end encryption, and the company couldn’t hand over those keys even if it wanted to.

There are two sides to the encryption argument. Security advocates including Sophos argue against the use of encryption backdoors, warning that criminals could discover and use them. Privacy advocates like Telegram founder Pavel Durov don’t like backdoors or forced decryption because they don’t want the authorities overstepping their bounds.

On the other hand, the authorities want to get at encrypted data somehow because they want it to stop criminals such as child abusers and terrorists. The latter have been known to use the Telegram service to plan their attacks.

The flurry of legislation around the world addressing this issue is a product of that complex debate. It also highlights the disparity between the legal system, which moves at a snail’s pace, and the technology world, which moves at the speed of light. One thing is for sure – it is a debate that is far from over yet.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/DRIAaE-M4k4/

  • 16/08/2018
  • adm

Overcoming ‘Security as a Silo’ with Orchestration and Automation

When teams work in silos, the result is friction and miscommunication. Automation changes that.

While security continues to evolve, adapt, and innovate, there has been a consistent, underlying theme across the industry: Teams are struggling to balance their increasing workloads with the limited resources at their disposal. As a result, it is becoming progressively more difficult for them to accomplish their goals. However, a lesser-known problem has risen, which I like to refer to as a different kind of SaaS: “security as a silo.”

It should come as no surprise that large organizations often struggle with teams working in silos. This creates friction and miscommunication, essentially serving as barriers that hinder the accomplishment of important goals. In many respects, security is no different from other business functions this way. But a few organizations have figured out how to utilize specific technologies to increase productivity, efficiency, and effectiveness among employees and processes

The DevOps Revolution
It wasn’t long ago when software development and IT operations were siloed themselves. Each function was responsible for specific tasks: developers coded and built software, while IT operations deployed and delivered it. However, this method of software development and delivery wasn’t time- or cost-effective, especially as the tech landscape continued to change. Teams were expected to build fast, and deliver even faster, leading to a dev and ops breakdown.

Some good did come out of this, as the heavy stream of security fire drills paved the way for a revolution known as orchestration and automation, which in turn led to the birth of DevOps. With a simple purpose of a single team building, deploying, and delivering software, DevOps changed the game.

The Precipice of Change for Infosec
It’s no secret that security teams are distressed, and many suffer the same challenges that developers and operations teams did before the birth of DevOps. To make matters worse, they are inundated with false positives that need to be investigated, causing teams to chase down logs and other intel, only to find that there’s not an actual threat. Meanwhile, alerts that do pose a real danger may not be investigated fast enough or at all.

The threat landscape is growing exponentially, and bad actors are more creative than ever — think Mirai, botnets, and unique malware. It’s increasingly difficult for defenders to keep up, let alone get ahead of these threats.

Sound familiar?

Security is reaching an inflection point again, and just as security orchestration and automation solutions brought change to software development and IT operations, it will bring change to security operations (SecOps).

The Great Uniters — Orchestration and Automation
As an industry, it’s time that we invested in technologies and methodologies that will enhance our tools, processes, and people. We know that orchestration and automation were critical technologies for DevOps to succeed. Why not bring these same concepts to SecOps?

Orchestration unites disparate systems and tools, while also paving the way for machine-to-machine automation. Machines are fantastic at handling a series of repetitive tasks, while humans are great at deriving context from data. Why not offload these repetitive tasks to machines and allow humans to focus on data correlation?

Therein lies the beauty of automation — and coupled with orchestration, it can be extremely flexible. So, what does this mean for security as a whole? Some initial benefits include:

  • The security function is streamlined and more productive.
  • Defenders can get ahead and aren’t constantly working from behind.
  • The industry is stronger, more connected and more effective.
  • The way is paved for unity amongst IT teams.

Given the well-known cybersecurity shortage and budget constraints, adding automation to security operations seems unachievable for many organizations, but that doesn’t have to be the case. These types of technologies are becoming increasingly accessible for businesses of all sizes, and there is more clarity around which operations should be automated and which require human interaction at some level. Ultimately, the goal is simple — provide security teams with the fastest way to add automation to security processes.

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early-bird rate ends August 31. Click for more info. 

Before joining Rapid7, Jen Andre was the Founder CEO of Komand (acquired by Rapid7), the fastest way to automate your time-intensive security processes. Previously, she co-founded Threat Stack, a pioneering cloud security monitoring company. Jen has spent her career in … View Full Bio

Article source: https://www.darkreading.com/risk/overcoming-security-as-a-silo-with-orchestration-and-automation/a/d-id/1332528?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 16/08/2018
  • adm

Bogus journals being used to publish fake science

If post-truth has an alarming ring to it, try to imagine a world full of fake science – fake science that is incredibly hard to distinguish from the real thing.

According to a DEF CON presentation written up by Motherboard that would sound like the outline for an amusing Sacha Baron Cohen satire if it wasn’t so serious, such fake science is already upon us.

It seems that thousands of scientists and companies across the world want the credibility boost from having research published, and a cottage industry of bogus publishers has sprung up to service this need – for a fee of course.

Analysing the 175,000 articles published by “predatory journals”, journalists Svea Eckert, Till Krause, and Online Privacy Foundation co-founder Chris Sumner, counted hundreds of papers from academics at leading universities as well as volumes promoted by pharmaceutical and tobacco companies.

This isn’t just vanity publishing, however – after studying two major sites in the sector, they discovered tens of thousands of abstracts for fake scientific papers, including 15,000 from India and 13,000 that originated from the US.

In the last decade, these sites alone had even received 162 papers from Stanford, 153 from Yale, 96 from Columbia, and 94 from Harvard.

It’s likely that several slightly different things are going on here. Some academics might be paying sites to cite research that might not pass strict peer review in order to boost their reputations.

That’s bad news: if scientific research hasn’t passed peer review then making it look as if it has is deceptive, regardless of the motive.

Others might be doing it to aid the credibility of research sponsored by companies in order to obscure a conflict of interest.

There may also be some research that is entirely fictitious, a sort of CV padding used to aid employment or gain credit.

Testing the system, the researchers submitted a fake paper to one site that was subsequently published.

The companies publishing this stuff even run pretend conferences to generate a veneer of respectability for what they are doing, as the researchers found when they turned up to present a “bullshit” paper at a bogus two-hour conference – one of thousands run each year by one publisher alone.

An important moment came in 2016 when the FTC in the US filed charges against one of the companies involved in the deception, OMICS Group. The rap sheet wasn’t pretty:

OMICS does not tell researchers that they must pay significant publishing fees until after it has accepted an article for publication, and often will not allow researchers to withdraw their articles from submission, thereby making the research ineligible for publication in another journal.

This would suggest that at least some of the academics who get involved with the company are being naïve, lured by the promise of easy publication.

The counter argument is that predatory publishing is a form of scientific pollution that should be cleaned up before it does real damage.

As fake news has taught us, the risk is not only that some people become confused about what is real science and what isn’t, but also that they start mistrusting legitimate sources.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Acq8pKtL2xk/

  • 16/08/2018
  • adm

Silk Road founder Ross Ulbricht is dictating tweets from prison

Ross Ulbricht is forbidden from going online, but that hasn’t stopped him from tweeting.

Ulbricht – formerly known as Dread Pirate Roberts, founder of the Silk Road Dark Web online market – was convicted in 2015 on charges of money laundering, conspiracy, drug and hacking-related charges.

He was sentenced to double life sentences without parole, plus another 40 years – but that hasn’t kept him quiet: his family opened a Twitter account for him in June, and they’ve been posting his tweets ever since.

After he was convicted, Ulbricht’s mother, Lyn Ulbricht, launched the “Free Ross Ulbricht” campaign, which accuses the government of framing her son as part of the “failed War on Drugs.” The campaign portrays his case as a milestone in the government’s crackdown on internet freedom.

The campaign reads:

This is a sentence that shocks the conscience. The website Silk Road was an e-commerce platform similar to eBay, where individual users chose what to list for sale. Both legal and illegal items were sold, most commonly small amounts of cannabis.

Ross is condemned to die in prison, not for dealing drugs himself but for a website where others did. This is far harsher than the punishment for many murderers, paedophiles, rapists and other violent people.

You might be forgiven if you were to raise an eyebrow at Ulbricht being called nonviolent, given that six separate murder-for-hire incidents were leveled against him. If he had been found guilty of any of those charges, we could safely assume he had a rather harsh way of dealing with business competitors.

But he was not. None of the murder-for-hire allegations turned up in the final charge-sheet.

At the time of his sentencing, however, family members of several people thought to have died of drugs purchased on Silk Road appeared in court. Those deaths were highly significant in what might otherwise seem like an overly harsh sentence for a “nonviolent” offender.

Ulbricht’s lawyers and supporters believe that there didn’t need to be an actual conviction on the murder-for-hire charges: their mere existence influenced his draconian sentencing. Ulbricht’s failed appeal to the Supreme Court asked that the court judge the propriety of sentencing based on unadjudicated accusations.

The court didn’t buy it. They cited “overwhelming evidence” that Ulbricht was “prepared, like other drug kingpins, to protect his profits by paying large sums of money to have individuals who threatened his enterprise murdered,” but that “it would be plainly wrong to conclude that he was sentenced for accidental deaths that the district court discussed only in passing in imposing sentence.”

Ulbricht’s defenders, including his mother, also wonder if the murder-for-hire charges never made it to trial because they relied on the work of federal agents who were themselves charged for crimes committed in the course of the investigation into Silk Road.

One of them, former Secret Service special agent Shaun Bridges, in September 2015 pleaded guilty to stealing Silk Road bitcoins. The other, corrupt ex-DEA agent Carl Force, was sentenced to six years for lining his pockets with bitcoins and for extorting Ulbricht.

Again, the court rejected the notion that the evidence presented by the two corrupt agents was itself invalidated by their crimes.

The murder-for-hire charge – for murders never actually carried out – was finally dropped last month.

The point of the social media campaign is to keep in touch with the outside world. But it’s also to get support for Ulbricht’s petition, which is asking President Trump for clemency. It’s his “only hope of breathing free air again,” Ulbricht said in a 3 August tweet.

According to a 27 July post, Ulbricht is dictating some of his tweets over the phone. They’re then typed in word for word: a technology that could be disrupted if the prison goes on an extended lockdown and he loses phone privileges:

Besides being typed in, Ulbricht’s messages to his supporters have included a hand-written letter, meant to prove that the account is genuine, that was posted to his social media feed as well as to the Free Ross website.

His family is bringing or snail-mailing Ulbricht printouts of comments. The messages are raising his spirits, he says. On 19 July, he tweeted about having received nine pages of comments from his petition: a response that has “deeply moved” him.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/-_S9B3ER250/

  • 16/08/2018
  • adm