STE WILLIAMS

The Brave privacy browser has added another feature to bolster its blossoming anti-surveillance credentials – the ability to use the Tor anonymity system by launching a tab.

Called Private Tabs with Tor (beta version 0.23), launching a session involves clicking on the Private Tab with Tor option from a drop-down list.

Naked Security has covered the inner workings of Tor (The Onion Router) in previous articles, but the privacy benefit of using it is summed up quite nicely in the Brave announcement:

Private Tabs with Tor help protect Brave users from Internet Service Providers, guest Wi-Fi providers, and visited sites that may be watching their internet connection or even tracking and collecting IP addresses, a device’s internet identifier.

Browsers already offer so-called incognito modes, but these offer limited privacy. Sessions are isolated from those opened by the main browser and ostensibly leave no traces of your browsing habits on your computer (although not everyone agrees this is strictly true).

What incognito mode doesn’t do is hide browsing from ISPs, which typically will keep a record of the websites visited from a given IP address.

As Google itself notes:

Going incognito doesn’t hide your browsing from your employer, your internet service provider or the websites that you visit.

Tor is a major step up from this because it blocks the ISP from tracking which websites someone is visiting, and hides a visitor’s true IP address and country of origin from the website they visit (as long as the user doesn’t log into them).

Using Tor comes with downsides, however. The most-often cited is that it can be slower than using a conventional browser, partly because of limited relay capacity which Brave has said it plans to contribute to. Brave also warns that some sites might not work correctly, or demand users prove they are not bots by throwing up annoying reCAPTCHA screens.

A good idea?

Integrating Tor sounds hard to argue against, but as with so many aspects of privacy there are different views.

The argument in favour is that integrating Tor is a shortcut to making it more popular – if you suddenly think you need the privacy afforded by Tor, it’s there at the launch of a tab. You could always download and launch the dedicated Tor browser instead but that would mean using a second application, which is possibly why lots of people don’t bother (assuming they’ve even heard of it).

The counter view is that privacy of the sort offered by Tor is best served by being very careful. If you think you need Tor, use its dedicated browser because that way you’ll know that everything you do inside it is being anonymised. Launching a Tor tab within Brave raises the risk of making a mistake and accidentally switching to one that turns out not to be routing traffic via Tor.

Interestingly, Firefox is also developing a Tor integration through something called Project Fusion, the end objective of which seems to be to replace the Firefox-derived Tor browser with a new super-private mode in Firefox itself. Tor for Firefox users could appear in a stable version not far behind the first release version of the Chromium-based Brave, itself still in beta.

On that note, before rushing out to try Brave, bear this beta status in mind. This might affect its stability but also the privacy it offers at this stage. As Brave says:

For users who currently require leakproof privacy, we recommend using the Tor Browser, which provides much stronger and well-tested protection against websites or eavesdroppers using advanced techniques to uncover a true IP address.

Follow @JohnEDunn
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/NfeHRfyTweA/

As around 35 alleged drug vendors have found out to their cost, you never know who you’ll meet on the dark web.

In the case of the customers of one money laundering operation, it turned out to be agents working for the US Immigration and Customs Enforcement’s Homeland Security Investigations (HSI).

According to a Department of Justice announcement, the authorities spent a year investigating dozens of individuals using the front, turning the bitcoins they had received for illegal drug sales into dollars.

The core of the operation was the takeover of an established laundering outfit, whose owner police arrested and charged in 2016.

This led to the arrest of more than 35 individuals across numerous US states and the seizure of $3.6 million in currency and gold bars, plus 100 handguns, assault rifles, and a grenade launcher.

Police also recovered a long list of drugs, including Oxycodone, MDMA, cocaine, LSD, marijuana, and a “psychedelic mushroom.” They also seized 2,000 BTC and other cryptocurrencies with a value of $20 million.

Said Derek Benner of the HSI:

In this case, HSI special agents were able to walk amongst those in the cyber underworld to find those vendors who sell highly addictive drugs for a profit.

The HSI release was very much of the “criminals have nowhere to hide” type that is often trumpeted after these sorts of operations:

The veil has been lifted. HSI has infiltrated the Darknet, and together with its law enforcement partners nationwide, it has proven, once again, that every criminal is within arm’s reach of the law.

That’s true, even if arresting 35 people barely scratches what goes on within the confines of the dark web.

Turning proceeds into clean money that won’t attract unwanted attention is one of the most vulnerable part of any criminal’s business.

In the case of Bitcoin, transactions are recorded for anyone to see. The difficult bit is correlating those transactions to the real people running the wallets.

But even once that’s been done, there is still the job of relating the transactions entering the wallets to specific, illegal sales.

The other way to attack illegal activity is to close the markets themselves – famous examples of which were the shuttering of Silk Road in 2013, and last year’s attack on the dark web’s AlphaBay. It’s harder to pull off but it has advantages, such as seizing user credentials that in one case careless criminals had re-used on another market.

Follow @JohnEDunn
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/t0A_-kMCBCU/

Clean-up efforts to respond to the VPNFilter malware have accelerated with the release of a free check-up tool.

Even though the utility from Symantec only looks to see if traffic has been manipulated, rather than confirming an infection, third-party experts have nonetheless welcomed its release.

VPNFilter, discovered by security researchers at Cisco Talos back in May, is estimated to have hijacked half a million IoT devices such as routers and network-attached storage (NAS) devices. The malware is capable of infecting enterprise and home routers, accessing encrypted web traffic and establishing a backdoor on compromised devices. The full list of impacted routers is available via Symantec here.

VPNFilter installs a plugin which monitors and modifies web traffic sent through the infected router, allowing cybercriminals to inject malicious content, render routers inoperable or steal passwords and other sensitive user information. The botnet also presents a clear and present danger to internet hygiene more generally since it might easily be turned into a powerful DDoS tool.

Mirai – another IoT botnet – was infamously abused to take out DNS service Dyn in an attack that left many high-profile websites unreachable back in October 2016.

Symantec has developed VPNFilter Check, a free online tool to help individuals and organisations quickly determine if their router might have been compromised by the VPNFilter malware.

More precisely, VPNFilter Check ascertains if traffic into either a home or corporate network is being altered by an infected router.

“This malware is unlike most other IoT threats because it is capable of maintaining a persistent presence on an infected device, even after a reboot,” said Stephen Trilling, senior vice president and general manager, security analytics and research, Symantec. “Symantec’s online VPNFilter Check tool provides individuals and organizations with an easy way to determine if their routers have been compromised by this threat, and suggests steps they can take if infected.”

Antivirus industry veteran Vesselin Bontchev told El Reg that the tool detects if VPNFilter is messing with a connection without providing confirmation whether or not an IoT device is infected.

“It won’t detect VPNFilter in the router in general, it will only detect if something is messing with the HTTPS connection,” Bontchev explained.

“One component of VPNFilter (which is not always present) can do that. If it is there and if it is active, the degrading of HTTPS to HTTP that it performs will be detected.” ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/02/vpnfilter/

The long-awaited encryption standard update is almost here. Get ready while you can to ensure security, interoperability, and performance.

Despite what may seem like draft after draft of specifications, along with continuous proclamations of “it’s almost here!,” the latest encryption standard, TLS v1.3, really is almost ready. The Network Working Group of the Internet Engineering Task Force has pushed to make Draft 28 of TLS v1.3 the final standard.

In addition, OpenSSL added Draft 28 to the pre-release version of its 1.1.1 software library; Google’s Chrome browser added support for Draft 28, beginning with version 65; and Draft 28 is already enabled by default when accessing Gmail (using Chrome). Because TLS v1.3 will be here officially before you know it, now is the time to prepare.

Every organization should be focusing on three crucial issues to ensure the appropriate level of security, interoperability, and performance:

1. How to handle zero round-trip-time resumption (0-RTT)
2. Preparing for downgrades to TLS v1.2
3. The need for infrastructure and application testing

Worth the Round Trip?
One highly discussed feature of TLS v1.3 is the 0-RTT option, which has the potential to significantly increase performance during an encrypted session between endpoints. Even without 0-RTT, TLS v1.3 speeds connection time between a client and server with a slimmer handshake protocol. Secure web communications using TLS v1.2 require two round trips between the client and server prior to the client making an HTTP request and the server generating a response. TLS v1.3 reduces the requirement to one round trip — which is only one round trip more than a simple nonencrypted HTTP transaction — and offers the ability to inherit trust to accomplish zero round trips, or 0-RTT.

Although the 0-RTT option potentially provides better performance, it creates a significant security risk. With 0-RTT, a transaction becomes easy prey for a replay attack, in which a threat actor can intercept an encrypted client message and resend it to the server, tricking the server into improperly extending trust to the threat actor and thus potentially granting the threat actor access to sensitive data.

Organizations should therefore be wary of allowing or using 0-RTT in their services and applications, due to the potential security risks. Developers need to be particularly attentive to this issue because it requires proactive configuration to ensure security. Unless your application or access is highly sensitive to latency, the new option is not worth the security risk.

Don’t Let the Downgrade Drag Security Down
One of the great benefits of TLS v1.3 is that it eliminates support for legacy encryption standards and cipher suites. It allows backward compatibility to TLS v1.2, which, of course, is essential for transitioning to the new standard and to ensure interoperability. Before allowing a fallback to TLS v1.2, however, it is important to review your security settings. Any TLS v1.2 implementation must be configured to support higher security standards. Select strong cipher suites, including ones that leverage elliptic curve key exchange, use large asymmetric keys, and implement perfect forward secrecy. Disabling the lower cryptographic algorithms will help prevent security breaches such as man-in-the-middle attacks.

Testing 1, 2, 3…
Now is the time to be testing your infrastructure and applications for TLS v1.3 compatibility. Changing to this new encryption standard may be disruptive, and you will want to get ahead of any problems or issues. Test for interoperability, security, and performance in a combined, holistic manner, rather than as a series of separate tests that may encourage undesirable trade-offs in decision-making and implementation. Leverage highly realistic traffic mixes and require them to fully emulate your traffic’s characteristics including the appropriate levels of encrypted traffic. Validate how internal and external users will interact with your systems and consider what this change in encryption may mean for an employee, customer, partner, or any other relevant stakeholder.

Test network clients, including mobile devices and tablets. Test servers, including any supporting equipment. Test all components of security equipment, including identity and access management systems, next-generation firewalls and data center firewalls, web proxies and SSL/TLS visibility solutions, IDS/IPS and endpoint security. Test storage and backup, both on-site and cloud-based. Test networking infrastructure, including wireless access points, any cloud resources, and anything else that might be involved with encrypted communication. Consider all applications, including email.

There is much to look forward to with TLS v1.3. New levels of security and performance will benefit everyone and address many issues with current encryption, despite the challenges. If you stay ahead of the process, you can transform changes into opportunities for improvement rather than problems that disrupt your business.

Related Content:

• Ready or Not: Transport Layer Security 1.3 Is Coming
• 5 Ways to Better Use Data in Security
• Encryption Is Necessary, Tools and Tips Make It Easier
• GDPR Requirements Prompt New Approach to Protecting Data in Motion
  

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info. 

David DeSanto is a security expert with more than 15 years of security research, software development, and product strategy experience. At Spirent, David focuses on driving innovation by looking holistically at security testing and defining product requirements with the … View Full Bio

Article source: https://www.darkreading.com/endpoint/preparing-for-transport-layer-security-13-/a/d-id/1332163?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Among the many problems that exist in the venerable Network Time Protocol is its vulnerability to timing attacks: turning servers into time-travellers can play all kinds of havoc with important systems.

Complicating the problem is that timing attacks are enabled by the protocol itself, which makes it hard to change.

Now a group of researchers from Marvell Semiconductor and the Hebrew University of Jerusalem have followed up on a February 2018 conference presentation with an Internet-Draft proposal they hope can block timing attacks.

Their argument, put in depth in this paper, (PDF) presented to the 2018 Network and Distributed Systems Security (NDSS) Symposium, is that timing attacks can affect “TLS certificates, DNS and DNSSEC, RPKI, Kerberos, BitCoin, and beyond”. The authors also note that time-shifting attacks are possible “even if all NTP communications are encrypted and authenticated” – so a fix is well overdue.

Google turns on free public NTP servers that SMEAR TIME

READ MORE

The problem with encrypted/authenticated NTP responses is that a person-is-the-middle can still delay and replay packets to time-shift the victim.

What they propose in “Chronos” is an “alternative set of client mechanisms … that is backward compatible with NTPv4”.

If you take a look at the time configuration in a typical consumer computer, you’ll see one or two NTP servers nominated. In Chronos, what the Israeli team proposes is that the client instead “crowd-source” its time information from multiple servers.

It then applies what they call “a provably secure algorithm” to eliminate suspicious responses, and take an average time from the remaining responses as the “true” time.

A server still receives an NTP query in the existing message format, meaning Chronos gets around sysadmins’ wariness to reconfiguring their servers: there’s no server-side change required.

When it queries a sample of the pool of available time servers nearby to the client – the draft envisages the client interrogating at most tens of servers – the client discards two-thirds of the responses (the highest and lowest values returned).

The only time a Chronos client would query the whole pool in its configuration is if multiple iterations of sampling can’t satisfy the client’s success conditions – a condition the authors call a “panic mode”, in which every server in the pool is checked.

Their bold claim from the academic analysis is that “in order to succeed in shifting time at a Chronos client by even a small time shift (e.g., 100ms), even a powerful man-in-the-middle attacker requires many years of effort (e.g., over 20 years in expectation).”

Chronos’ authors are Neta Rozen Schiff, Danny Dolev, and Michael Schapira of the Hebrew University of Jerusalem; and Tal Mizrahi of Marvell Semiconductor. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/02/ntp_revision_to_end_timing_attacks/

Spanish Web form and survey company Typeform has announced a data breach dating back to May, when someone gained access to one of the company’s backup files.

The company said the intruder accessed files “from a partial backup dated May 3rd, 2018”, and said it will contact all affected customers. “We identified the breach at 14:00 CET on June 27th, and remedied the apparent cause of the breach at 14:30 CET on June 27th”, the company said.

We’ve had a data breach. If you were affected, you will have received an email from us. Click here to learn more: https://t.co/dFVhn1nAht

We’re here to support you ❤️

— Typeform (@typeform) June 29, 2018

The company has not identified what it called “partial information”, but affected customers have detailed the extent of the issue.

British high-end nosh outlet Fortnum Mason wrote to customers saying “Approximately 23,000 of our data entries have been affected” with “email addresses, survey/vote responses and for a smaller number of contacts, postal address and social handles” exposed.

The store added “All other personal information and/or purchase information is safe and protected. We can assure you that no bank or payment details have been involved, and your money and accounts are safe.”

In Australia, the Electoral Commission for State of Tasmania was impacted. In this media release the Commission warned voters that if they had applied for an express vote in the state’s March election, their “name, address, email and date of birth information” was potentially breached. The commission says it used Typeform to host five forms used by citizens.

“The Electoral Commission will be contacting electors that used these services in the coming days to inform them of the breach”, the statement continued.

Clients of other customers might have less – or more – exposure, depending on the information gathered using Typeform.

The service says its customers’ payment details were not compromised, client passwords were not exposed, and all data collected since May 3rd, 2018, is safe.

End-user payment information is another matter. Typeform said that payment data is safe “If you [that is, the Typeform customer – El Reg] collected payments via our Stripe integration”. It doesn’t mention what might happen if a customer stored data like credit card info in a form. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/02/typeform_breach/

Stalkers, fraudsters, saboteurs, and all nature of malicious insiders have put the hurt on some very high-profile employers.

Image Source: Adobe Stock (Andrea Danti)

If recent statistics are any indication, enterprise security teams might be greatly underestimating the risk that insider threats pose to their organizations. One study, by Crowd Research Partners, shows just 3% of executives pegged the potential cost of an insider threat at more than $2 million. Yet, according to Ponemon Institute, the average cost of insider threats per year for an organization is more than $8 million.

And those are just the quantifiable risks. When insider attackers hit hardest — particularly malicious insiders who are looking to commit fraud or intentionally do bad — the ramifications can be much more widespread than the typical data breach.

We’re just six months into the year, and already we’ve seen some particularly damaging malicious insider events illustrate this truth. Here are some of the highest-profile incidents, all of which can act as a warning to enterprises to get serious about their monitoring and controls around employee activity.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/the-6-worst-insider-attacks-of-2018---so-far/d/d-id/1332183?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Roundup This week we dealt with buggered bookies, trouble at Ticketmaster, and a compromised Linux build from Gentoo.

We also have some breaking news as we were writing this story up: two insurance companies, Lexington Insurance Co and Beazley Insurance Co in the US, are suing infosec biz Trustwave over a 2008 hack of payment processing company Heartland Payment Systems. The insurers are furious they had to fork out $148m in claims, legal fees, and other costs, as a result of the network intrusion. Trustwave was, prior to the hack, hired to assess Heartland’s security defenses.

Here’s what else went down during the week.

Exactis doxxes pretty much all of America

340 million people are now a bit more in the public eye, thanks to a screw-up by marketing company Exactis.

The Florida-based outfit was caught out by researcher Vinny Troia, who dug up an unencrypted ElasticSearch database that held about two terabytes of details on the personal interests of “pretty much every US citizen”.

In addition to personal interests (things like your hobbies or pets), the database contained names, addresses, age, and gender information on hundreds of millions of people. Troia says the database has since been taken down.

At least social security numbers weren’t included (looking at you, Equifax).

Wyden stumps for Wireguard

The Wireguard VPN service got a new champion this week after powerful US Senator Ron Wyden pitched it as the next government security tech of choice.

The Oregon Democrat issued the dreaded “open letter” (PDF) to National Institute of Standards and Technology Director Walter Copan asking that that he consider making the open source Wireguard the official VPN for government use.

“Two aging technologies, IPsec and OpenVPN, are currently used for most government VPNs,” Wyden tells Copan. “Cybersecurity researchers now know that the complexity of these old technologies can completely undermine their security.”

Wyden stops short of demanding Wireguard be adopted as the replacement, but he does list the tech as one of the “appropriate replacements” to be considered for IPSec and OpenVPN.

A BFD for BSD

Zerodium is offering up huge cash payouts to anyone who can manage to break BSD.

The bug bounty outfit said this week it was stepping up its efforts to find zero-day flaws in OpenBSD, FreeBSD, Ubuntu, CentOS, Debian, and Tails.

We’re currently acquiring #0day exploits (privilege escalation or RCE) for the following operating systems: OpenBSD, FreeBSD, NetBSD, Ubuntu, CentOS, Debian, and Tails. For related inquiries or submissions, contact us: https://t.co/8NeubPvSdj

— Zerodium (@Zerodium) June 27, 2018

The payouts are given out either as standard wire transfers or as Bitcoin, if that’s your thing. People on US/UN sanctions lists are ineligible, though if you’re under UN sanctions, collecting a bug bounty is probably not a huge concern.

Stop us if you’ve heard this one: Rowhammer flaw abused

Rowhammer, the Phil Collins of security vulnerabilities, is back yet again. This time it’s Android mobes that can have their DRAM contents slurped.

Researchers in Amsterdam, France, Santa Barbara, and India teamed up to explain in a paper [PDF] how memory contents could be brute-forced, and also how they could be thwarted by strictly limiting memory access.

“We propose a practical, isolation-based protection that stops DMA-based Rowhammer attacks by carefully surrounding DMA buffers with DRAM-level guard rows,” the researchers say.

If it means an end to having to write any more Rowhammer stories, we’re all for it.

Spectre patches may need a patch

When is a fix not a fix? When it’s an attempt patch up the Spectre vulnerability, apparently.

Researchers Noam Hadad and Jonathan Afek of Aleph Security said this week that they had devised a way to work around some of the measures browser vendors have used to mitigate the vulnerability.

It turns out the data-timing tricks browsers use to help prevent exploits can be overcome, provided the attackers don’t mind a little performance hit.

“In our research we were able to overcome the cache access timing specific mitigations. Although these mitigations cause a serious slowdown in our POC, they are not effective in preventing this attack,” the duo write.

“These mitigations also have some negative performance implications and are hurting the functionality of some legitimate JavaScript web application use-cases.”

NSA admits massive call slurp

So, the bad news is that Uncle Sam has been hoarding your phone records. The worse news is that those government agencies are now racing to delete the evidence.

This according to the Daily Beast, who says the NSA is now wholesale deleting records of people’s phone calls and text message that it had illegally harvested. According to the report, the government security bod is blaming “technical irregularities” for the unauthorized data collection.

Apparently, the government cock-up meant hundreds of millions of phone records made their way into NSA hands without any review or authorization

“Despite the sweeping remedy for the overcollection, the NSA did not estimate how many records it had purged, let alone how many Americans were affected,” the not at all concerning Daily Beast Report https://www.thedailybeast.com/nsa-admits-it-improperly-collected-a-huge-amount-of-americans-call-records reads.

“The scale is certain to be massive.”

Interactive World Cup match ball not much of a hack risk

An IoT football for knockout games in the World Cup is just a marketing gimmick rather than a potential target for mischievous hackers, according to an expert

Adidas has taken the wraps off a IoT-enabled or interactive ball, the Telstar Mechta, that it said would be used in the knock-out stages of the World Cup, days ahead of keenly-awaited sudden death games that begin on Saturday. Smart things are often hackable, mostly because they are made without any consideration of information security basics.

But a 1966-style Russian linesman* is it/isn’t it over the line hack scenario has ruled out by experts. PTP’s Ken Munro, an expert in IoT security who has hacked everything from a smart kettle to an electric car, pointed out the ball only had a near-field communication (NFC) chip and therefore was out of range of internet hackers.

The utility of an NFC-enabled football, in general, remains unclear. Munro dismissed the concept as a “marketing gimmick”.

Russian cybercrime bust

A pair of Russian suspected of looting the accounts of loyalty program members from popular online stores, payment systems and bookmakers have been arrested by Russian police.

The targets of the attack were websites of dozens of companies, including PayPal, Ulmart, Biglion, KupiKupon and Groupon. In total, about 700,000 accounts were compromised, 2,000 of which the hackers put up for sale for $5 each, or 20-30 per cent of the nominal balance of the accounts. The duo had a sideline in changing the phone numbers and emails on the compromised online accounts they resold, for a 10 per cent fee.

Upon arrest, the pair admitted on the spot that they had earned at least 500,000 rubles (US$7,961). However, the real amount of damage remains to be determined.

Investigation into the case began in November 2015, after a large-scale cyberattack was made on the website of a large online store, targeting the personal accounts of the store’s loyalty program members. In a month, about 120,000 accounts were compromised through a credential stuffing attack that relied on password reuse.

Administration “K” of the MIA of Russia, with the assistance of Moscow-based infosec firm Group-IB, led the investigation, which led to a pair of arrests. The leader of the group was identified as a resident of Ryazan Region, born in 1998. His partner, who provided technical support for their joint online store, resided in Astrakhan Region and was born in 1997.

Both suspects have confessed. Neither has been named. Their arrests took place last month but news of the case was only released this week. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/06/30/security_roundup/

Special report Digital ad fraud is potentially lucrative, difficult to detect, and getting worse.

“It is one of the biggest ways bad guys have of pulling money out of the online economy,” said Louis-David Mangin, co-founder and CEO of Confiant, a firm that helps publishers mitigate the damage done by hosting bad ads, in a phone interview with The Register. “It’s definitely getting worse.”

Augustine Fou, a cybersecurity and ad fraud researcher who advises companies about online marketing, makes a similar point in a report he plans to publish on Monday.

“Ad fraud is the most lucrative way to cash out of other major criminal activities,” his report, provided in advance to The Register, reads.

It’s nearly the perfect crime in the sense that it often goes unnoticed and hasn’t been as high a law enforcement priority as other online threats. Some industry experts talk about digital ad fraud as if it were legal, though they don’t really mean it.

Illegal, or is it

Fou has in the past claimed digital ad fraud is legal, and he says something similar in his latest findings.

“Ad fraud isn’t illegal (no laws pertain to it) but other laws may be broken in the committing of it,” his report says.

“Ad fraud is against the terms of service of most ad exchanges, so it’s almost certainly a breach of contract,” said Ratko Vidakovic, founder and principal consultant at AdProfs, ad tech consultancy based in Toronto, Canada, in an email to The Register.

“Then again, plausible deniability is always on the table, so it’s very hard to prove that a publisher is deliberately engaging in ad fraud without a rigorous investigation. To my knowledge, it’s not explicitly illegal. Although, I’m sure some could argue that it constitutes wire fraud, or violates any number of computer crime laws.”

While online ad fraud may not be specifically defined as a crime, it is nonetheless fraud, and is actionable at least under US law. What’s more, there are various statutes that can be brought to bear related to computer crimes, money laundering and the like, depending on the circumstances.

Asked about this, Fou said what he means is that digital ad fraud isn’t often prosecuted.

A tsunami of scams

Digital ad fraud can mean many different things. It can involve fake websites, fake online traffic, fake ads, fake ad agencies, fake audiences, fake ad bidding, fake accounts, fake devices, fake apps, and fake data.

It’s not just click fraud – bots clicking on ads or loading display ads to get paid. It may involve installation fraud, by which physical or virtual devices download and install apps, cycling through fake device identifiers to collect the installation payment from the app publisher. Or it may involve showing ads that paid to reach a high-value audience to a low-value audience.

AdProfs describes some of the variations: invisible ads, traffic arbitrage (buying low-value traffic and reselling it for more than it’s worth), domain spoofing (bad publishers misidentifying their sites), site bundling (bad publishers bundling networks of domains under a single ad network identifier), ad injection, cookie stuffing (to get credit for affiliate fees), and click farms.

Of course, before anyone asks, El Reg‘s highly capable ad operations team works hard around the clock to ensure our ads are not only served to and seen by millions of real eyeballs each month, but also high quality and safe.

Evolved DNSChanger malware slings evil ads at PCs, hijacks routers

READ MORE

There is at least agreement that digital ad fraud happens, though not everyone considers it all that serious. A 2017 report by the Association of National Advertisers (ANA) put bot fraud losses at $6.5bn in 2017, down 10 per cent from $7.2bn in 2016.

The ANA report said 9 per cent of desktop display ad spending and 22 per cent of desktop video ad spending is lost to fraud. It dismisses mobile ad fraud as less than 2 per cent of spending, while noting “this does not include fraud in mobile web video or pay-per-click fraud, which remain high and problematic.”

Juniper Research last year predicted $19bn will be lost to digital ad fraud in 2018.

But ad fraud statistics offer an incomplete picture of what’s going on because they tend to focus on one specific segment of the industry while omitting others. Fou, who said he has stopped estimating ad fraud as a percentage, previously said 43 per cent of mobile display ad impressions were bogus.

Others have suggested about half of paid programmatic impressions are fake.

Call in the lawyers

Digital ad fraud litigation is not very common, but it does occur.

The US Justice Department brought a click fraud case against six Estonian nationals and one Russian national in 2011. There have been a handful of other criminal click fraud cases, such as one in 2017 against Fabio Gasperini.

There have also been a few notable civil cases as well. Google settled a click fraud claim by Lane’s Gifts and Collectibles in 2006 for $90m and in 2017 settled another click fraud case covering the 2004 through 2008 period for $22.5m. Last year, Uber sued ad biz Fetch alleging click fraud.

One reason for the scarcity of lawsuits, Fou and others have argued, is that there’s an industry incentive to maintain the status quo.

“This is because marketers want the fraud to continue,” Fou explained in an email to The Register. “If they cut out the fraud there will be less impressions to buy.”

Some marketers, at least.

“Certainly some buyers like cheap inventory and don’t care to ask too many questions, said Ben Edelman, an associate professor at the Harvard Business School who had conducted many ad fraud investigations over the years, in an email to The Register.

“But that’s not typical. In my experience most advertisers care about results – they have products to sell, which requires finding real buyers, which requires quality advertising inventory that real people see and engage with. In my view, that’s as it should be.”

“There is no direct incentive from anyone in the industry, with the exception of marketers, to eradicate ad fraud,” observed Vidakovic. “That said, it’s hard to generalize the industry’s will in such a way.”

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/06/29/ad_fraud_bad/

Boffins have demonstrated how intelligence agencies and well-resourced hackers can potentially spy on people – by studying and meddling with mobile data flying over the airwaves.

The computer scientists have described in detail novel surveillance techniques that allowed them to identify people within a phone tower’s radio cell, determine which websites they visited from their handsets, and redirect them to malicious webpages by tampering with DNS lookups.

However, the team cautioned that their work so far is experimental, and difficult to perform in real-world scenarios.

The three attacks – explained on a dedicated website – all target the data link layer of LTE, aka Long-Term Evolution, aka 4G, networks.

The identification and website snooping techniques are passive, in that a spy just listens to what’s going out over the airwaves from phones, whereas the webpage redirection attack is an active operation – an agent needs to set up a malicious cell tower to tamper with transmissions. As such, the academics dubbed their DNS spoofing attack “aLTEr.” The website spying works by identifying, to a particular level of certainty, sites by their patterns of traffic over the air.

The spying methods may not be restricted to 4G, we’re told. Forthcoming 5G networks may also be vulnerable because they rely on the same underlying – and potentially exploitable – technologies.

Countermeasures need to be applied, as the researchers – David Rupprecht, Katharina Kohls, Thorsten Holz, and Christina Pöpper – explained:

The use of authenticated encryption would prevent the aLTEr attack, which can be achieved through the addition of message authentication codes to user plane packets. However, the current 5G specification does not require this security feature as mandatory, but leaves it as optional configuration parameter.

The shortcomings can be exploited by determined and well-funded miscreants to snoop on persons of special interest, for example, politicians, journalists, and human rights activists.

However, the attacks have thus far only been demonstrated using a customized rig in a lab environment – which isn’t to say the issue is purely theoretical. “With some engineering effort, our attacks can also be performed in the wild,” said the researchers, who are computer scientists from Ruhr-Universität in Bochum, Germany, and New York University’s Abu Dhabi campus in the UAE.

Researchers put together a video, and uploaded it to YouTube on Thursday, of how an aLTEr attack can be carried out:

Youtube Video

A paper with all the technical details about the aLTEr attack can be found here [PDF]. Full details due to be presented during the 2019 IEEE Symposium on Security and Privacy next May.

The group informed relevant institutions such as the GSM Association (GSMA), the 3rd Generation Partnership Project (3GPP), and telephone companies as part of a responsible disclosure process before going public with their work.

Previous work on LTE protocol security identified attack vectors in both the physical (layer one) and network (layer three) layers. The latest findings explore issues in the data link layer (layer two) protocols, previously a blind spot in LTE security research, according to the boffins.

News of the so-called aLTEr attacks comes days after another team of eggheads unveiled further security concerns about Diameter [PDF], an authentication, authorization, and accounting protocol which is in the process of replacing RADIUS in 4G and 5G networks.

The flaw has concerned infosec experts. “4G is now looking like it has a serious security problem,” said Professor Alan Woodward, a computer scientist at the University of Surrey in England.

Thorsten Holz, one the researchers, told El Reg: “I definitely agree that LTE [4G] has security problems. Fixing this attack is hard given that it is a protocol-level problem in the standard. 5G will hopefully fix it.” ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/06/29/4g_security/