library – Page 219 – STE WILLIAMS

JP Morgan Hacker Pleads Guilty

library
crime | hacking | security

Andrei Tyurin, a Russian national, pleaded guilty to hacking charges related to a massive cyberattack campaign targeting US financial institutions and other companies.

Russian national Andrei Tyurin, who was extradited to the US last year by Georgian officials for allegedly hacking JP Morgan Chase in 2014 as well as several other cyberattacks on US financial and other organizations, now faces sentencing after a guilty plea in US District Court.

Tyurin, 35, was involved in a wide-ranging hacking campaign that targeted US financial organizations, brokerage firms, financial news publishers, and other companies, from 2012 to mid-2015, stealing information from more than 100 million customers. The JP Morgan attack was a record-breaking breach of more than 80 million customers of the US bank.

His co-conspirators include Gery Shalon, Joshua Samuel Aaron, and Ziv Orenstein, according to a US Department of Justice release. He pleaded guilty to one count of conspiracy to commit computer hacking, one count of wire fraud, one count of conspiracy to violate gambling laws, and one count of conspiracy to commit wire and bank fraud, among other charges. The various charges carry anywhere from five to 30 years in prison, and he will be sentenced February 13, 2020.

Several months after the fact, CafePress finally acknowledges huge data theft to its customers

library
crime | hacking | security

T-shirt flogger CafePress has finally informed its customers about a serious data loss dating back to February and first reported last month.

Several CafePress punters told us they had received an email this morning warning them the company had lost customer names, emails, physical addresses, phone numbers and unencrypted passwords. Some customers have also had the last four numbers of payment cards and expiry dates nabbed by hackers.

The email, addressed to “Dear Valued Customer”, says that the incident happened “on or about February 19”. But fear not: “We have been diligently investigating this incident with the assistance of outside experts.”

The email claims that CafePress “recently discovered” the security hole. But in early August, the company ran a mass-password reset following reports that some 23 million user details were floating around on hacker forums.

Security researcher Jim Scott told The Register at the time: “Out of the 23 million compromised users, roughly half of them had their passwords exposed encoded in base64 SHA-1.” The hack was originally spotted by Troy Hunt, operator of the Have I Been Pwned website.

Today’s email says that an unidentified third party accessed a CafePress database and customer data. They may also have had access to CafePress accounts for a limited time and the information “could have been used for fraudulent activity”.

The company said it is working with US law enforcement and has notified UK and European regulators. It has also shifted the database and “taken various steps to further enhance the security of our systems and your information”.

CafePress claims to have informed regulators and includes links to Experian, Transunion and Equifax for customers wanting to check their credit rating.

The company has not responded to our questions, which include why passwords were not properly encrypted and why it has taken so long to warn customers.

One Reg reader sent us the following:

Pretty damn crappy, isn’t it! I’m just so pissed off that yet another company is keeping (and I guess they may just have worded their email badly) passwords in plain text. Surely, by now, anyone building any sort of site should know better. I’ve been building sites for far more years than I care to think about, and have never needed to do that – just an inherently stupid idea.

An ICO spokesperson said: “CafePress has made us aware of an incident and we are making enquiries.”

We will update this story if we get any response from CafePress. ®

Sponsored:
How to get more from MicroStrategy by optimising your data stack

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/23/cafepress_admits_breach_to_customers/

‘Playing Around’ with Code Keeps Security, DevOps Skills Sharp

library
crime | hacking | security

A project intended to move a small robot around a hazardous board teaches some solid security lessons.

Put six adults together for 41 hours with a pile of parts and a vague goal and what do you get? In my case, amplified lessons in secure software development — and a game where you take a robot to do battle.

So last weekend I participated in a make-a-thon. Described as “like a walk-a-thon with less walking and more making,” it was a fund-raiser and a way for me to scratch my ongoing geek itch. Since mechanical engineering isn’t my forte, I was assigned to be half the programming team. And, as is true for so many real-world dev projects, we began on Friday night with only a vague sense of what the hardware would ultimately look like.

So the first thing I did was sit down, write careful specifications, and start hand-crafting the finest in artisinal code, right? Of course not: I headed for the Internet and started grabbing routines described as doing what I wanted to do. And just like that, I was neck-deep in the reality of most agile and dev-ops software shops.

Now, I was lucky in several respects: I was doing classic OT stuff in a variant of C — I could look at the code and tell what was going on. But the thing that struck me in retrospect was just how easily I was grabbing routines and throwing them into my application, and just how little regard I was giving the variables and code that didn’t have an immediate impact on my job.

So that’s the first amplified lesson: do a security scan on downloaded code before you slap it into your application. GitHub’s Semmle acquisition should make this easier for a lot of open source projects, but it’s got to be considered a critical step regardless of where the code comes from.

The next amplified lesson comes straight out of the instructions for blue jeans: Shrink to fit. At times during the development process we had great herds of unused variables and function names roaming across the rolling plains of our code. The combination of code from repositories and debugging routines left detritus that we ultimately had to clean up late in the process because things were getting confusing.

Unused variables and routines left in code are catnip for attackers. In the heat of a sprint (or a 41-hour deadline), it’s too easy to leave things in place rather than cleaning up as you go. But even in cases where you go back at project end and clean up the code, be careful — it’s all too easy to miss lines tucked up under comments or buried in the middle of complex routines.

As the hardware specs matured, we were able to do more testing and pruning, but we were also passing code back and forth more and more frequently. And that brings up the third amplified lesson: be sure your team communication mechanisms are secure.

In our case, security wasn’t a great concern — in the worst case of intrusion, a toy robot would get whacked by a wooden hammer. But where we ended up tossing code back and forth on our team’s Slack channel, code that truly matters to, oh, anyone, should be shared in a secure private repository. Since there were only two of us, we also didn’t have a lot of trouble figuring out who had last touched a given piece of code. With a larger team a more rigorous change process is critical for both security and reliability.

The last amplified lesson I learned is the one that will, I think, have the longest impact: It’s important to get out there and do stuff. It had been a while since I buckled down to a software project with a deadline and expectations that came from someone other than me. It was fun, it was exhausting, and it was educational in all the best ways. It’s easy to fall into a pattern of tossing out opinions gathered from other sources, but it’s important to get some hands-on time to check your assumptions and find out just why those opinions are right (or wrong).

Oh, and the make-a-thon? My team won, largely because the teammates who took on those mechanical engineering roles were really good. As for the code — well, we’ve still got two months before the next time the project shows up in public and there’s some display driver code that needs serious attention…

Related content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/edge/theedge/playing-around-with-code-keeps-security-devops-skills-sharp-/b/d-id/1335867?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

YouTube Creators Hit in Account Hijacking Campaign

library
crime | hacking | security

The victims, who post car reviews and other videos about the auto industry, were targeted in a seemingly coordinated campaign to steal account access.

A “massive” series of account takeover attacks has for the past few days targeted YouTube creators, many of whom are influential members of the automotive and car review community.

The high-profile channels targeted include Built, Troy Sowers, MaxtChekVids, PURE Function, and Musafir. Creators in other industries were also targeted in the coordinated campaign, which manipulated account holders into visiting phishing sites to steal their login credentials.

According to a report from ZDNet, which investigated the attack, this is likely how the takeovers unfolded: Phishing emails lured targets onto fake Google login pages, which collected credentials attackers used to access Google accounts. The attackers then assigned popular YouTube channels to new owners and changed the channels’ vanity URLs so the accounts appeared to be deleted.

Some victims were looped into group email chains including other creators in the same community; others received individual phishing messages. It seems the attackers were able to successfully bypass multifactor authentication in order to break into the accounts of some YouTube creators.

How Can I Ensure Cyber Insurers Will Pay My Claim?

library
crime | hacking | security

To get the best out of your policy, do more than just sign on the dotted line.

Question: I bought cyber insurance, but I still worry. If I experience a breach or other security incident, how will the cyber insurance company be likely to weasel out of paying my claim?

Jeff Wichman, Practice Director, Enterprise Incident Management, Optiv — In most cases, your cyber insurance company isn’t going to weasel out of paying a claim. My advice is to be prepared!

Your provider is going to have a specific process/requirement for engaging with them and outside resources for an incident. Follow that process, and take these steps to be better prepared:

Validate with your provider that your preferred partner is approved as either an on-panel or off-panel firm you can work with.
Update your incident response plan to include when and how to engage with your claim process. Now is the time to start building that into your documents.
Test, test, test your incident response processes using an applicable scenario-based exercise with your trusted third party. This can help you identify gaps in your efforts.

Do you have questions you’d like answered? Send them to [email protected].

Related content:

The Edge is Dark Reading’s home for features, threat data and in-depth perspectives on cybersecurity. View Full Bio

Article source: https://www.darkreading.com/edge/theedge/how-can-i-ensure-cyber-insurers-will-pay-my-claim/b/d-id/1335878?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Microsoft Issues Out-of-Band Patch for Internet Explorer

library
crime | hacking | security

The security update fixes a vulnerability that could allow an attacker to remotely execute code at the same privilege as the legitimate user.

Microsoft today released an off-cycle patch for a zero-day memory corruption vulnerability in Internet Explorer.

CVE-2019-1367 is a flaw that can corrupt memory in such a way that an attacker could execute arbitrary code in Internet Explorer, and do so in the context (at the permission level) of the current user.

In the worst case, an attacker could install programs, view, change, and delete data, and create new user accounts with full user privileges, while the legitimate user is logged in as an admin.

According to Microsoft, the patch remediates the vulnerability by changing the way in which the scripting engine handles objects in memory.

For more, read here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The 20 Worst Metrics in Cybersecurity.”

Article source: https://www.darkreading.com/vulnerabilities---threats/microsoft-issues-out-of-band-patch-for-internet-explorer-/d/d-id/1335881?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Rethinking Risk Management

library
crime | hacking | security

Where most organizations fall short in risk management tools, technologies, and talent, and how they can improve.

It’s time for organizations to reevaluate their approach to risk management and consider new, more effective techniques and strategies, Jack Jones, chairman of the FAIR Institute and executive vice president of RD at RiskLens, told attendees this week at the FAIR Conference.

Modern businesses are increasingly aware of risk management’s importance; however, many fail to implement the right approach for their specific needs, Jones explained in an interview with Dark Reading ahead of this year’s show, taking place this week in Washington, DC.

“Over the last several years, the conversation around risk quantification and risk analysis has evolved from ‘can it be done’ to ‘should we do it,’ and now, ‘how do we do it,'” he said. The “how” is a problem for many risk professionals who try to implement change and are challenged by organizational and industry inertia that pushes back against them, Jones said.

Some of the pushback they normally hear: “We already do risk management,” “What we’ve been doing works; why change?” and “What you’re proposing is not yet ‘best practice.'”

Jones’ focus today is on the value proposition of risk management programs. “Part of what we expect to provide to this conference is helping people have those conversations and helping them describe the value proposition for change,” he said. There are multiple paths to risk quantification and risk management; Jones wants people to understand which is best for them.

One of the major holes in modern programs is they aren’t actually managing risk. “What’s they’re doing is controls management,” said Jones, explaining how this approach is more checklist-based than compliance-based. “That’s superficial from a risk perspective because they’re not applying any rigor to measuring how those controlled instances matter,” he added.

Compounding the problem are tools and technologies the industry relies on. He pointed to the Common Vulnerability Scoring System (CVSS) as an example. “It’s great at characterizing certain aspects of technical deficiencies, but it’s not a risk measurement,” Jones explained.

If an organization has two systems with the same deficiency – for example, a SQL injection flaw – CVSS would call that critical. But if one of those systems is Internet-facing, doesn’t hold sensitive data, and doesn’t provide a path to other systems, it may not be as critical as it seems.

When something like CVSS labels “a tremendous number of things” critical when they may not be, it can generate a lot of noise for a business. “It’s a losing battle,” said Jones. “You have to have better metrics than that to be cost-effective in risk management.”

Tips for Better Risk Management

There are four components to determine how well an organization can manage the risk landscape: models, the data applied to those models, skills of people doing the work, and the tools they use. Oftentimes, risk analysis is performed by anyone in the business who happens to be assigned to the work, Jones noted, and many companies lack risk measurement tools.

The first step should be training people assigned to risk analysis. “Training accomplishes two things: it normalizes mental models around what risk is and how to measure it, and it also teaches them how to make estimates and use data effectively,” he said. Regardless of whether the organization is a Fortune 100 company or smaller, and regardless of the path they want to take or how far they plan to take risk analysis, “having that sort of clarity is huge,” Jones added.

How to know if a risk management program is actually working? “I would argue noise reduction,” he said. As an example, he describes the “risk register,” or one of the biggest sources of noise in most risk management programs. This might be a spreadsheet or governance, risk, and compliance (GRC) tool where a business lists top worries and concerns.

The risk register should not be a “dumping ground” for things you’re worried about, Jones said. It should contain risk factors, and if you’re going to measure and manage something you must be sure what you’re measuring and managing against. “What we’re actually trying to manage is the frequency and magnitude of loss events,” said Jones. If you stuff things into a risk register that aren’t risks but are measured as risk, it messes with the ability to effectively prioritize.

One of the first things organizations are encouraged to do is reconcile the risk register. Businesses often list hundreds of “risks” that aren’t risks, said Jones. Reconciling the risk register can help them cut down on noise and prioritize risks that matter most to the company.

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The 20 Worst Metrics in Cybersecurity.”

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/risk/rethinking-risk-management/d/d-id/1335883?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

WannaCry – and why it never went away

library
crime | hacking | security

The infamous ransomware worm WannaCry is already more than two-and-a-half years old.

WannaCry spreads using a security hole that was patched two months before the worm first appeared, so you’d be forgiven for assuming that it would have fizzled out by now and become little more than a museum curiosity.

But a paper published recently by Sophos experts tells a very different story, with more than 5,000,000 infection attempts logged in a three-month period last year – and that’s just the ones that were detected and blocked by a Sophos product and reported by Sophos telemetry.

Given that WannaCry doesn’t even bother trying to infect a computer if can can see in advance that it’s patched, each one of those infection attempts was aimed at a still-unpatched device.

In other words, the world is awash with computers that haven’t been patched for well over two years.

We went live to look at the lessons we should have learned, but haven’t:

(Watch directly on YouTube if the video won’t play here.)

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/lIObnk1QnAM/

Two charged with tech-support scamming the elderly for $10m

library
crime | hacking | security

Two US people have been charged with the alleged tech-support scumbaggery of spooking old people by shoving scary “Your computer has a virus, call us!!!!” pop-ups in their faces and then fleecing them for services they didn’t need and never got.

The band of crooks did this to about 7,500 victims, most of them elderly, shaking them down for more than $10 million.

The US Attorney’s Office for the Southern District of New York announced the arrests last week, on Wednesday, 18 September.

On that day, police arrested Romana Leyva, 35, of Las Vegas, and Ariful Haque, 33, of Bellerose, New York. They’re both being charged with one count of wire fraud and one count of conspiracy to commit wire fraud. Each charge carries a maximum sentence of 20 years in prison, though maximum sentences are rarely handed out.

Targeting the elderly in US and Canada

According to the indictment, from March 2015 through December 2018, the two were allegedly members of a fraud gang based in the US and India that targeted the elderly across the US and Canada. The goal: to snooker seniors into believing that their computers were riddled with malware so that they’d pony up hundreds or thousands of dollars for bogus computer repair services.

They’d cause pop-up windows to appear on victims’ computers that lied about their systems being infected with a virus. Better call this number, the pop-ups urged, to get some tech support to help you out. Sometimes, those pop-ups scared victims with dire prognostications: don’t restart or shut down your computer, they’d warn, lest it “cause serious damage to the system,” including “complete data loss”!

Sometimes, the crooks gussied up those pop-ups with official corporate logos – which, of course, they ripped off and which they had no lawful right to plaster on top of their bucket of lies – from what the indictment referred to as a “well-known, legitimate technology company.”

Posing as big tech companies

The Department of Justice (DOJ) didn’t name names, but we know full well how much work Microsoft, for one, has put into battling these logo-absconding name ripper-offers.

In October 2018, for example, after Microsoft filed complaints about customers falling for these lie-o-matic pop-ups, Indian police raided 10 illegal call centers and arrested 24 alleged scammers.

It’s not just Microsoft, of course. Shortly after Microsoft filed those complaints, in late November 2018, more than 100 Indian police swarmed 16 tech support scam call centers in Gurgaon and Noida, arresting 39 people for allegedly impersonating legitimate support reps for companies including Microsoft, Apple, Google, Dell and HP.

Of course, those weren’t really viruses on their victims’ computers, and the phone numbers they got people to call to “fix” their non-existent problems weren’t really associated with the bona fide companies with which they claimed affiliation.

In exchange for victims’ payments of several hundreds or thousands of dollars (depending on the precise “service” victims purchased), the purported technician remotely accessed the victim’s computer and ran an anti-virus tool that can be found for free on the internet. The e-swindlers also re-targeted some victims multiple times.

Leyva’s alleged part in the scam:

creating bogus corporate entities that were used to receive victims’ payments
recruiting others (including by lying) to register bogus corporate entities that became part of and facilitated the fraudsters’ activities, and
helping others to set up bogus corporate entities and bank accounts, including coaching them on how to lie to bank employees when necessary.

Haque’s alleged part in the scam was to register a bogus corporate entity that was used to receive victims’ payments. Haque also allegedly trained a co-conspirator who registered a different bogus business that was part of the fraud ring, and who deposited ill-gotten loot into accounts associated with that entity.

Peter C. Fitzhugh, special agent in charge with the US Immigration and Customs Enforcement’s (ICE’s) Homeland Security Investigations (HSI), said that the law is out to protect the elderly from this type of predator:

It is our duty as citizens to protect our growing elderly population and it is our duty as law enforcement to investigate and arrest those, like Leyva and Haque, who seek to make a profit through fraud and deception.

What to do

Many elders are sitting ducks for these fraud slingers. Two years ago, when the Federal Trade Commission (FTC) launched a crackdown on tech support scammers, it released a 48-minute scam call featuring an actor portraying one of these scammers’ preferred prey: a tentative, gullible, easily sweet-talked, elderly man.

As part of its Operation Tech Trap – a broad crackdown on tech support scams both in the US and elsewhere – it passed along these tips on what to do if you get an unexpected tech-support call or pop-up:

Hang up on callers. They’re not real tech-support staffers. And don’t rely on caller ID to prove who a caller is. Criminals can spoof calls to make it seem like they’re calling from a legitimate company or a local number.
If you get a pop-up message that tells you to call tech support, ignore it. While there are legitimate pop-ups from your security software to do things like update your operating system, you shouldn’t call a number that pops up on your screen in a warning about a computer problem.
If you’re concerned about your computer, call your security software company directly – but don’t use the phone number in the pop-up or on caller ID. Instead, look for the company’s contact information online, or on a software package or your receipt.
Never share passwords or give control of your computer to anyone who contacts you. Doing so leaves your computer open to malware downloads and backdoors.
Get rid of malware. Update or download legitimate security software and scan your computer. Delete anything the software says is a problem.
Change any passwords that you shared with someone. Change the passwords on every account that uses passwords you shared.
If you paid for bogus services with a credit card, call your credit card company and ask to reverse the charges. Check your statements for any charges you didn’t make, and ask to reverse those, too. In the US, report it to ftc.gov/complaint.

Tips like these are great for those of us who can absorb them. But the elderly, all too often, don’t have that capacity.

Please do keep an eye out for any friends, neighbors and loved ones who might fall into that category. Keep an ear out for those who get flustered with technology and bewildered by pop-ups. Let’s do what we can to protect others from these swindlers and their tech-speak razzamatazz, lest they squeeze elders for every dime they have.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/0TbNYtAQBLk/

Could EarEcho change the way we authenticate our phones?

library
crime | hacking | security

We’re used to identifying ourselves to our phones using our fingers, our faces, and even our irises, but now, researchers are targeting a new piece of our body that they say could be the perfect identifier: The inside of our ears.

Researchers at University at Buffalo, State University of New York and Syracuse University have discovered a way to use wireless earbuds as a biometric authentication system. Called EarEcho, it uses a small microphone inserted in a regular pair of wireless earbuds. When the earbuds play audio, it records the sound that bounces back from the ear canal, creating a unique profile of the user’s inner ear.

EarEcho feeds the audio that the microphone picks up into a support vector machine (SVM), which is a machine learning model that learns how to identify the user’s unique ear pattern.

The result is an accurate verification method, according to their paper. It tested the system on 20 subjects, listening to five different pieces of prerecorded conversation in different environments such as a shopping mall, a cafe, and the street. It reached around 97.5% accuracy when identifying people based on just three seconds of audio, it reported.

More secure than other biometrics?

Fingerprints may be among the most popular biometric authentication methods, say the researchers, but they argue it is also subject to spoofing attacks. They also criticise facial recognition, and specifically Apple’s FaceID, for the same reason (researchers claim to have spoofed Apple’s technology before and we know there are use cases that it has difficulty coping with). Earbud-based authentication is a better idea, they added:

With the popularization of wireless earphones, more and more users are getting used to wearing earphones while working, studying or strolling…

Compared with face IDs, fingerprints and voiceprints, the EarEcho presents a more unobtrusive authentication approach with great usability potentials.

One advantage of this approach, they say, is that it is relatively immune to side-channel and replay attacks, in which an attacker can eavesdrop on someone’s biometric information through audio recordings or high-definition photographs and then reproduce it. After all, you might be able to pick up a copy of someone’s fingerprint somewhere, but you’ll have a hard time surreptitiously probing their inner ear canal.

The weaknesses of this technology seem to be more commercial than technical. Phones already feature some form of face and fingerprint recognition built into the device itself, and it seems dangerous to move that authentication entirely onto another device (what if someone forgets their earphones?). Earphones are also easy to lose, especially wireless ones, and losing your main form of authentication would be troublesome.

Finally, if you’re playing any kind of audio through the headphones on your device, then you’ve probably already authenticated to get permission to do so. This means the headphones would have to play their own audio for verification purposes before logging you into your phone, or that they’d become purely a passive authentication mechanism that checked to make sure you were still you periodically after you’d logged on.

That latter use case might have some traction, though. The researchers suggest using EarEcho as an authentication mechanism for mobile payments, or for verifying your identity during sensitive conversations. The true test here is, how many people do you know who walk around with earbuds in all day, and do you consider it acceptable behaviour?

Are we likely to see this inside Apple’s next generation of AirPods? It looks like the company might be concentrating on embedding temperature, perspiration, movement, and heart rate sensors into its iconic white buds for the time being.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/uLNsYYCeWYs/