STE WILLIAMS

Looking for browser privacy? A group of researchers in France and Japan say RequestPolicyContinued and NoScript have the toughest policies, while Ghostery and uBlock Origin offer good blocking performance and a better user experience.

The study also gave a nod to the EFF’s Privacy Badger, which uses heuristics rather than block lists, but once trained is nearly as good as Ghostery or uBlock, demonstrating that its heuristics are reliable.

In their study, currently a pre-review publication at arXiv, the researchers (Johan Mazel of France’s National Institute of Informatics, Richard Garnier at the National School of Computer Science and Applied Mathematics of Grenoble (ENSIMAG) and Kensuke Fukuda) took existing privacy footprint techniques, but added an evaluation of HTML quality to test various blockers’ impact on site usability.

The list of systems tested included both blocklist-based products, heuristic systems, as well as other techniques.

The blocklist tests covered AdBlock Plus, uBlock Origin, Ghostery, Disconnect, NoTrace, DoNotTrackMe/Blur, and BeefTaco. As well as Privacy Badger, the other heuristic-based system tested was MyTrackingChoices. NoScript and RequestPolicyContinued were classified as “indiscriminate” blockers, while “others” included HTTPSEverywhere, Decentraleyes and WebOfTrust.

Their privacy footprint tests followed a format familiar to anyone who takes an interest in how Web sites they visit interact with third parties, by graphing first-party/third-party interactions of the Alexa Top 1,000 sites.

The graph let them measure the number of third parties seen (tracking breadth); the “mean number of third parties per first party corresponds” to capture intensity of tracking; and “the number of first parties associated with the top 10 third parties”, intended to identify the most prominent trackers.

Would it surprise you to learn that the DoNotTrack header is almost universally ignored? Here’s the summary of what the researchers found:

“The most popular extensions show a wide overlap. Ghostery and uBlock Origin block specific resources that are not affected by other extensions. In terms of overall privacy protection, RequestPolicyContinued and NoScript show the best performances. Ghostery and uBlock Origin protect users slightly less. Remaining techniques provide average to low protection. The DoNotTrack HTTP header provides almost no protection.”

Noting that block lists are cumbersome to maintain, the trio suggest that future research focus on heuristic products, and automatic blocklist building. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/12/20/ghostery_ublock_lead_the_antitrack_pack/

Looking for digestible, not-too-technical holiday season security advice?

Here’s a video that gives you some handy tips that you can use yourself, or pass on to friends and family so they don’t get scammed while they’re supposed to be enjoying themselves.

(Can’t see the video directly above this line? Watch on Facebook instead.)

Note. With most browsers, you don’t need a Facebook account to watch the video, and if you do have an account you don’t need to be logged in. If you can’t hear the sound, try clicking on the speaker icon in the bottom right corner of the video player to unmute.

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/fZnp251DA20/

UK Foreign Office Minister Lord Ahmad of Wimbledon today claimed North Korea was behind the WannaCry ransomware incident.

He joins the US government, Canada, Australia, New Zealand, Japan, Microsoft, Google, Kaspersky, Symantec, FireEye, and others, who have all by now more or less blamed Kim Jong-un’s hackers for unleashing WannaCry on the world – Uncle Sam today named and shamed the Norks as well, for instance.

Of course, the usual pinch of salt is required. Assigning attribution in cyber-assaults is hard, miscreants can hijack networks in another nation to launch attacks and thus shift the blame, and so on. On the other hand, the UK and US seem pretty certain it’s North Korea’s fault here.

In a statement, Lord Ahmad said the hermit state’s spy unit, the Lazarus Group, was behind the malware epidemic in May this year. The Lazarus crew, which also goes by the name Guardians of Peace, has been active since 2009, and uses DDoS botnets, keyloggers, remote access tools and wiper malware in their activities.

The decision to publicly attribute this software nasty to North Korea sends a clear message that the UK and its allies will not tolerate malicious cyber activity, the Foreign Office thundered.

The WannaCry ransomware wrecked 300,000 computers in 150 countries and included 48 NHS trusts among the casualties.

Back in October, British security minister Ben Wallace appeared to blame North Korea for the infamous ransomware attack that disrupted the operation of one in three NHS trusts in England as well as numerous other organisations worldwide.

This week, Ahmad said: “The UK’s National Cyber Security Centre assesses it is highly likely that North Korean actors known as the Lazarus Group were behind the WannaCry ransomware campaign – one of the most significant to hit the UK in terms of scale and disruption.

“We condemn these actions and commit ourselves to working with all responsible states to combat destructive criminal use of cyber space. The indiscriminate use of the WannaCry ransomware demonstrates North Korean actors using their cyber programme to circumvent sanctions.”

He said the UK is determined to identify, pursue and respond to malicious cyber activity regardless of where it originates, imposing costs on those who wish to attack us in cyberspace. “We are committed to strengthening coordinated international efforts to uphold a free, open, peaceful and secure cyberspace.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/12/19/fco_confirms_north_korea_behind_wannacry/

Loki malware, built to steal credentials, is distributed via Microsoft Excel and other Office applications rigged with malicious ‘scriptlets’ to evade detection.

A stealthy new attack distributes Loki malware in Microsoft Excel spreadsheets and other Office applications.

The attack, which was discovered by Lastline Labs, is tough to detect in its early stages. It bypasses traditional antivirus and is often dismissed as a false positive because it relies on malicious “scriptlets” that are added to Office files using external links.

Earlier this month, Lastline published findings on a malicious Excel file with the ability to download and execute malware. They saw no evidence of macros, shellcode, or DDE functionality, and it showed a low detection on Virustotal, which typically indicates it’s either an unknown technique or a false positive.

Less than two weeks later, the malicious Excel scriptlet-laden spreadsheet garnered 12 detections on Virustotal across 60 AV tools, a sign it went from false positive to potential infection.

“One of the things [researchers] saw was a spike in Microsoft Office documents, Excel spreadsheets that were calling back and downloading a new payload without the use of any sort of macros or shell code,” explains Andy Norton, director of intelligence at Lastline. “We found criminal groups were embedding URLs in scriptlets inside Office documents and using that as a method of evading detection.”

When victims open a malicious Excel file they are prompted to update the workbook’s external links, an Office feature that lets authors reference external resources rather than embedding them directly. This keeps files small and easier to update. Unfortunately, external links can reference malicious scriptlets and deliver payloads without leveraging traditional delivery methods.

In this case, Excel scriptlets are delivering Loki, a type of malware known for exfiltrating usernames and passwords. The password stealer is designed to take credentials from software including email clients, browsers, FTP clients, and file management clients.

“What we’re witnessing is an evolution in how bad guys are going to put malicious payloads into organizations,” says Norton. “We’ve seen that a lot of the samples of what we’ve collected are not known to Virustotal.”

The malicious files arrive via standard email. Once credentials have been lifted, Loki displays to attackers which websites are vulnerable to identity theft. This could include social media sites, payment portals, or bitcoin wallets.

This attack exploist CVE-2017-0199, a Microsoft Office/WordPad RCE security vulnerability with Windows API, which was patched in April 2017 and updated in September. The flaw exists in the way that Office and WordPad parse specially crafted files. Exploitation requires a victim to open or preview a malicious file. An attacker could install programs, view or edit data, or create accounts with full user rights. Norton says while attackers could move across the internal environment, the primary goal here is to steal credentials from the target victim’s system.

‘Double Whammy’

Lastline calls this vector a “double whammy” for security response teams because it aims to both evade detection and correct remediation. The attack vector’s low detection rate leads to the assumption it’s a false positive. However, even if businesses discover the threat is Loki, most don’t correctly address the problem. Attackers know this.

The guidance around remediation for generic Trojans is to “reinstall a backup” or “reimage and start fresh,” Norton explains. “Now if you do that, Loki’s won. There’s nothing in remediation advice about changing all the passwords on the systems.”

“It’s important to get clear information about the capabilities and capacity of the threat,” he continues. “If you don’t, you’re making yourselves vulnerable to a secondary stage of attack where credentials are used to get back into the environment.”

Norton says victims can tell they’ve been hit if they understand the behaviors of the attack, something he says is “becoming increasingly vital.” Behavioral analysis platforms can help here, he notes. For those who have been hit, he advises reimaging and resetting all passwords.

Lastline’s work is a “live research project,” he says, so expect more updates. On Friday, the researchers discovered payload distribution was changed to a website that had been linked to an Iranian botnet attack in May 2017. About five different threat groups have been using this particular payload, Norton notes, and they likely come from all over the globe.

Related Content:

• New Database Botnet Leveraged for Bitcoin Mining
• Trump Adviser: North Korea Waged WannaCry Attack
• Comprehensive Endpoint Protection Requires the Right Cyber Threat Intelligence
• Kaspersky Lab Files Lawsuit Over DHS Ban of its Products

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/microsoft-office-docs-new-vessel-for-loki-malware/d/d-id/1330678?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Operation Copperfield appears focused on data theft and reconnaissance, Nyotron says.

Damaging attacks from second and third-tier nation-state threat actors – especially in the Middle East – could become more of a pressing issue for enterprises next year if a couple of recent incidents are any indication.

Days after FireEye reported a recent attack where a likely nation-state actor disrupted operations at a critical infrastructure facility in the Middle East, there’s another report of an ominous new cyberattack campaign targeting similar organizations in the region.

This time, the warning is from Nyotron, which says it has spotted a threat actor with likely links to Saudi Arabia, Iran, or Algeria using a repurposed malware tool to target specific critical infrastructure organizations in the Middle East.

The tool, which Nyotron has dubbed Copperfield, is based on H-Worm aka Houdini, a four-year-old remote access trojan (RAT) believed to be the work of an Algerian hacker. The malware is primarily being spread via infected USB drives; once installed on a system, it uses other methods to propagate.

The operators of the Copperfield campaign have used a $25 generic crypter tool called BronCoder to change the structure and hash of the Visual Basic Script-based H-Worm so it cannot be spotted by typical signature-based anti-malware tools.

The attackers have also use a unique masquerading technique to conceal files on infected systems and replace them with identically named malicious LNK files with the same icons as the hidden files. When a user clicks on a malicious file, it executes exactly as expected, but while running malicious commands silently in background.

Like H-Worm, Copperfield uses an automation tool in Windows — Windows Script Host — to gain full control of an infected system. It then can perform tasks like collecting and transmitting system information, exfiltrating data to an external server, downloading and executing keyloggers and other malware, and updating itself.

“We believe that H-worm was an inspiration for Operation Copperfield,” says Nir Zuk, Nyotron’s chief technology officer. “However the Copperfield worm is significantly more sophisticated and professionally developed … Among the core enhancements is the infection mechanism that has been introduced in the wild for the first time.”

Based on the malware tool’s capabilities, the main goals of Operation Copperfield appear to be data theft for the purposes of conducting reconnaissance on critical infrastructure targets, Zuk says.

‘La La Land’

Nytoron spotted Copperfield activity earlier this month when its software identified and stopped the malware from causing damage on a shared workstation at one of the security vendor’s Middle Eastern clients. The malware was introduced on the system via a USB drive that a night-shift worker had plugged in to watch the movie La La Land, which he had recently downloaded on it.

Zuk says Nyotron is still collecting information on the scope of the campaign and its main purpose. But the company has found infections in countries as dispersed as China, Columbia, South Korea, and Iran.

Nyotron’s investigation of the incident at its client showed the attackers using a command and control server apparently based in Mecca, Saudi Arabia, to run the campaign. “The worm was designed to execute any shell command sent from the CC, and specific commands were developed for uploading and downloading data,” Zuk says.

“The spread mechanism of Operation Copperfield and previously unseen masquerading techniques, leads us to believe that the attacker, who’s currently still active, is relatively sophisticated,” he notes. 

Evidence suggests that the attackers are Saudi Arabia-based. But some of the language used in the malware code and previous attributions to H-Worm suggest an Iranian or an Algerian connection as well.

The Nyotron advisory comes just days after FireEye’s warned about an incident where threat actors gained access to a critical safety system at an industrial facility in the Middle East and inadvertently triggered a shut down of a process there. The attacks suggest heightened cyber threat activity in the region and the growing sophistication of the groups behind it.  

In September, Palo Alto Networks reported finding a large adversary infrastructure in the Middle East comprised of numerous credential harvesting systems, CC servers, compromised websites, and post-exploitation tools available to threat actors in the region. Another study by Trend Micro uncovered a booming underground market for malware in North Africa and the Middle East, where many sophisticated tools are being distributed for free or next to nothing to threat actors in the region.

Threat actors in mid-tier countries have acquired the capability to take on critical infrastructure and other targets in advanced nations Nytoron said in its report.

“Tier-2 and tier-3 nation states (and their for-hire agents) will mostly drive bolder actions that aim to disrupt economies of their adversaries, impact unfavorable legislation or simply create fear and uncertainty in the market and among the targeted population,” the vendor noted.

Related Content:

• TRITON Attacker Disrupts ICS Operations, While Botching Attempt to Cause Physical Damage
• Malware Investigation Leads to Sophisticated Mideast Threat Network
• Cybercrime Meets Culture In Middle East, North African Underground
• 7 Indicted Iranian Nationals Now Hit with Sanctions by US Treasury

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/another-cyberattack-spotted-targeting-mideast-critical-infrastructure-organizations/d/d-id/1330679?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Here’s the experts’ take on how miserable or gleeful social media can make you:

1. If you passively consume content like a couch potato watching TV, you’ll feel bad.
2. If you actively engage with friends, relatives, classmates and colleagues, you’ll feel good.
3. If you walk away from social media entirely… you’re just an unfathomable question mark of a person and don’t factor into Facebook’s recent soul-searching whatsoever.

Said soul-searching happened on Friday, when Facebook researchers posted what they deemed “hard questions” about whether or not social media is bad for us. Given that their hard questions leave out the “hey, how about if I just dump Facebook entirely?” option, those questions are, really, about as hard as tapioca pudding.

Here’s the spoiler: in the post, Facebook publicly recognized some of its platform’s detrimental effects but suggested the cure is to engage with the platform more: more messages, more comments and more posts.

A study we conducted with Robert Kraut at Carnegie Mellon University found that people who sent or received more messages, comments and Timeline posts reported improvements in social support, depression and loneliness. The positive effects were even stronger when people talked with their close friends online. Simply broadcasting status updates wasn’t enough; people had to interact one-on-one with others in their network.

David Ginsberg, Facebook director of research, and Moira Burke, a Facebook research scientist, noted that in one experiment at Cornell University, when comparing stressed-out college students, those who scrolled through their own Facebook profile for 5 minutes experienced more boosts in self-affirmation than those who scrolled through strangers’ posts.

From the Facebook researchers’ post:

The researchers believe self-affirmation comes from reminiscing on past meaningful interactions – seeing photos they had been tagged in and comments their friends had left – as well as reflecting on one’s own past posts, where a person chooses how to present themselves to the world.

And from that study:

…users gravitate toward their online profiles after receiving a blow to the ego, in an unconscious effort to repair their perceptions of self-worth.

That’s the bright side of the coin. On the darker side is social media-enabled trolling that can lead to problems as severe as suicide.

One of too many examples was that of Rebecca Ann Sedwick, a 12-year-old Florida girl who leapt to her death from an abandoned cement factory silo in 2013. One month after her suicide, the offline and online bullying that tormented Rebecca for over a year was still a sickening miasma thriving in venues such as Facebook, with two girls being arrested after one allegedly bragged on Facebook about cyber bullying the victim.

There have been many studies that have looked at this dark side of Facebook. Five themes emerged from one such: managing inappropriate or annoying content, being tethered to Facebook, perceived lack of privacy and control, social comparison and jealousy, and relationship tension.

Of course, Facebook is well aware that its platform can be used both for cyber bullying and to post cries for help. In March, it announced that it planned to update its algorithms to keep an ear out for people who might be in danger of suicide, by looking out for key phrases and then referring the matter to human Facebook staff so they might ask whether the writer is OK.

The is-social-media-good-or-bad post from last Friday comes days after a former Facebook executive gave a scathing speech about the corporation. Chamath Palihapitiya, former vice-president of user growth, said that he regrets his part in building tools that destroy “the social fabric of how society works.”

The short-term, dopamine-driven feedback loops that we have created are destroying how society works. No civil discourse, no cooperation, misinformation, mistruth.

…a proclamation that followed an admission last month, from Facebook ex-president Sean Parker, that Facebook creators were from the start well aware that they were exploiting a “vulnerability in human psychology” to get people addicted to the “little dopamine hit” when someone likes or comments on your page.

It’s a social validation feedback loop… You’re exploiting a vulnerability in human psychology… The inventors, creators – it’s me, it’s Mark [Zuckerberg], it’s Kevin Systrom on Instagram, it’s all of these people – understood this consciously. And we did it anyway.

Other ex-Facebookers who’ve lately stepped back to question the repercussions of what they’ve created include Facebook “like” button co-creator Justin Rosenstein and former Facebook product manager Leah Pearlman, who have both implemented measures to curb their social media dependence.

It’s not just Facebook; in the midst of the current analysis of fake news, Snapchat CEO Evan Spiegel, for one, has also been doing some introspection.

Friday’s post doesn’t ignore the research published on the negative effects of social media, but, perhaps unsurprisingly, it concludes that the good results/bad results boil down to how you use social media.

But what of the non-users? Such research does exist, of course.

A recent study out of Harvard Business Review found that while face-to-face, real-world social networks were positively associated with overall well-being, the use of Facebook was negatively associated with overall well-being. In fact, researchers concluded, it might even affect your physical health, never mind your mental well-being:

These results were particularly strong for mental health; most measures of Facebook use in one year predicted a decrease in mental health in a later year. We found consistently that both liking others’ content and clicking links significantly predicted a subsequent reduction in self-reported physical health, mental health, and life satisfaction.

Don’t like that conclusion? No worries: another study from a year ago found that Facebook users tend to have higher levels of subjective happiness, life satisfaction and social support compared with non-users.

Facebook used its soul-searching post to announce some changes to its platform designed to help us do more of the things that make us happy, and to shield us from the things that don’t.

There’s no need to wait for Facebook to take the lead though. You probably started playing the social media game because it did something fun or useful to you. If it’s no longer doing that for you then maybe it’s time to ask some questions about which platforms and interactions are working for you, and which aren’t, and adjust accordingly.

And of course there’s always the option-that-dare-not-speak-it’s-name. As Naked Security’s Mark Stockley points out, if you walk away from Facebook, or social media “you might be missing out on something that’s potentially beneficial but you’re not missing out on something that homo sapiens hasn’t successfully gone without for 150,000 years or so.”

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/e3vOabjzvT0/

Don’t want anybody tracking you through your smartphone? Just turn off “location services” or whatever your device calls your GPS, and you will vanish from the online radar screen, right?

Of course not. That’s never been entirely true – since your phone continues connecting with cell towers even with GPS turned off, anyone with access to that data can come reasonably close to locking in on your location.

Recall, as Naked Security’s Lisa Vaas reported just a few weeks ago, that lawyers for Timothy Ivory Carpenter, convicted in 2014 of a string of robberies in the Midwest, are arguing that the convictions should be thrown out because prosecutors relied in part on cell tower data for which law enforcement didn’t obtain a warrant. Legal arguments aside, the point here is that, as Vaas noted, whether he had his GPS turned on or not was irrelevant:

The cellphone records… revealed that over a five-month span in 2010 and 2011, his cellphone connected with cell towers in the vicinity of the robberies.

But adding yet more evidence to the bulging “privacy-is-even-more-dead-than-that” folder are several researchers from the Electrical Engineering Department at Princeton University who created an app they call “PinMe” to show that, with just a couple thousand lines of added code (plenty of games and apps have hundreds of thousands of lines of code), smartphone users can be tracked just as precisely as their GPS, even when it’s turned off.

The researchers – Arsalan Mosenia, Xiaoliang Dai, Prateek Mittal and Niraj Jha – in a 15-page paper published on the IEEE (Institute of Electrical and Electronics Engineers) website (paywall), describe how their app collects data from sensors in the device that don’t require special permission to access.

As they put it, in tests using an iPhone 6, iPhone 6S and Galaxy S4 i9500:

We describe PinMe, a novel user-location mechanism that exploits non-sensory/sensory data stored on the smartphone, e.g., the environment’s air pressure and device’s timezone, along with publicly-available auxiliary information, e.g., elevation maps, to estimate the user’s location when all location services, e.g., GPS are turned off.

This does come with a caveat. Mosenia, a post-doctoral research scientist at Princeton’s EDGE and INSPIRE labs, acknowledged to Naked Security that he and his colleagues had no way to verify if commercial apps are doing this kind of data collection and tracking, “since their codes are not publicly available and we cannot modify/examine their codes.”

But through their “proof of concept,” they have demonstrated that it is possible. Which is more than creepy enough, if not outright dangerous to those for whom privacy can be a life and death matter.

As they say, both iOS and Android are designed to run with third-party apps, of which there are hundreds of thousands on the market. And while smartphone operating systems are also designed to protect most personal information, “several types of non-sensory/sensory data, which are stored on the smartphone, are either loosely protected or not protected at all.”

Those include a gyroscope, accelerometer, barometer and magnetometer. According to the researchers, measurements from those sensors:

…are accessible by an application installed on the smartphone without requiring user’s approval. As a result, a malicious application that is installed on the smartphone and runs in the background can continuously capture such data without arousing suspicion.

Using what they describe as “presumably non-critical data” from those sensors, the app first determines what the user is doing – walking, driving a car, riding in a train or an airplane. As Christopher Loren put it, writing on Android Authority:

Moving at a slow pace in one direction indicates walking. Going a little bit quicker but turning at 90-degree angles means driving. Faster yet, we’re in train or airplane territory. Those are easy to figure out based on speed and air pressure.

And then, the sensors also tell the app your speed, your relation to true north and how far above sea level you are. It takes four algorithms to narrow down the location of somebody on a plane. It is even simpler if you’re in a car:

The app knows the time zone you’re in based on the information your phone has provided to it. It then accesses information from your barometer and magnetometer and compares it to information from publicly available maps and weather reports. After that, it keeps track of the turns you make. With each turn, the possible locations whittle down until it pinpoints exactly where you are.

During a test run in Philadelphia, the researchers said it took only 12 turns for the app to know exactly where the car was.

Cryptography and privacy researcher Bruce Schneier, CTO at IBM Resilient, linked to the research on his blog, adding the observation that:

This is a good example of how powerful synthesizing information from disparate data sources can be. We spend too much time worried about individual data collection systems, and not enough about analysis techniques of those systems.

That is the concern of other privacy experts as well. “It’s pretty alarming and definitely creepy,” said Joseph Lorenzo Hall, chief technologist at the Center for Democracy Technology (CDT).

Location data is extremely sensitive personal information, especially when it is collected over a long time, with high frequency and in real-time. It can be dangerous for victims of domestic violence or stalking, and for people with very sensitive roles in society, like law enforcement, judges, politicians, etc.

And Rebecca Herold, CEO of The Privacy Professor, said commercial apps are not only, “collecting, storing, and sharing all the data possible from the devices upon which they are loaded,” but are combining that data with other datasets about users, including their locations.

They may be correct in saying they are not collecting explicitly named data from you specifically, but they almost always are combining what they do collect with other datasets, to then establish very detailed insights into your life, activities, locations, likes and dislikes, and a wide range of views into your private life.

What, if anything, can you as an individual do about that? Not all that much, other than to practice basic “security hygiene.” One of the most obvious, Herold says, is to remove all apps you’re no longer using. Stay away from sketchy apps – get them from “stores” that have done some vetting. Do a bit of homework on the companies that develop and sell them.

Beyond that, “users also need to periodically shut down and clear out cache, memory, and delete unnecessary files,” she said. “These are also valuable sources of data for apps.”

But that, of course, takes time, and most users are much more interested in the features of an app than in its security or what it collects.

So, for years, advocates have been lobbying for legislation to require apps that want to use the sensors to request access. This might get as much (very little) attention as Terms of Service and Privacy Policies, but at least it would raise awareness of what apps are collecting, and give users a chance to opt out.

The researchers offer some recommendations for the industry. Among them:

• Require sensors to decrease their sampling rate when they are inactive. That would make it harder for malicious apps to get the data they need.
• Add hardware switches to phones, allowing users to deactivate the sensors when they aren’t in use.

And Hall says it’s long past time for Congress to pass, “general data protection legislation that steps away from the silo-ed, sector-specific manner we legislate privacy protections now.” He said for years, CDT has pointed out that only the US and Turkey lacked such general privacy regulations.

But Turkey actually passed such a law recently, making the USA the lone hold out… we’re an opt-out country living in an opt-in world; something has got to give.

Follow @tarmeding
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/I6cGUHfsrvE/

It’s the epic legal battle that has bitterly divided US business opinion, and its critics believe could have a chilling effect on digital competition.

It’s about the future of the internet, and it’s not net neutrality, amazingly, but another head-to-head some think has the potential to be every bit as significant and then some: the court case pitting social media giant LinkedIn against a miniscule Silicon Valley startup called hiQ Labs.

The latest development is that an alliance of the Electronic Frontier Foundation (EFF), search engine DuckDuckGo, and the Internet Archive, have weighed in on hiQ’s side, last week filing documents backing the startup’s case and accusing LinkedIn of trying to stifle “open access to information online.”

Why the angst? As ever, money, authority and who gets to own precious disruption.

LinkedIn, of course, is a professional networking platform, while hiQ is a company that makes its money by “scraping” LinkedIn’s public member profiles to feed two analytical systems, Keeper and Skill Mapper.

Keeper can be used by employers to detect staff that might be thinking about leaving while Skill Mapper summarises the skills and status of current and future employees.

For several years, this presented no problems until, in 2016, LinkedIn decided to offer something similar, at which point it sent hiQ and others in the sector cease and desist letters and started blocking the bots reading its pages.

LinkedIn’s case has two main arguments:

1. hiQ is scraping data that belongs to LinkedIn and threatens its members’ privacy
2. It does this using bot-scraping programs that have negative effects

Controversially, it invoked the famous 1986 Computer Fraud and Abuse Act (supposedly inspired by Hollywood movie WarGames) as part of its case, a criminal anti-hacking law that also featured in a famous 2009 case Facebook brought against Power Ventures.

More recently, similar issues have emerged from airline Ryanair’s case against Expedia for alleged fare scraping.

Data scraping, its seems, has become a booming tech sector that increasingly divides the industry ideologically.

One side believes LinkedIn is simply trying to shut down a competitor wanting to access public data LinkedIn merely displays rather than owns. Allowing it to do this using a law as draconian as the CFAA would threaten competition and perhaps even (in an echo of net neutrality arguments) the open internet.

Said the EFF:

LinkedIn’s position will also impact journalists, researchers, and watchdog organizations, who (increasingly) rely on automated tools including scrapers to support their work, much of which is protected First Amendment activity.

The other sees companies such as hiQ as parasitic. According to Rammi Essaid of Distil Networks, allowing hiQ’s case to succeed might also inadvertently legitimise “bad bots” which conduct harmful activities such as:

Denial-of-service attacks, competitive data mining, online fraud, account hijacking, data theft, stealing of intellectual property, unauthorized vulnerability scans, spam and digital ad fraud.

So far, hiQ is just about winning the legal battle and in August was handed an interim court judgement requiring LinkedIn to stop blocking hiQ’s scraping bots from accessing its site. The next stop in this case comes in March 2018 when the court will hear oral arguments.

Caught in the middle of this are millions of LinkedIn users who set about creating and building a profile they hope will gain them professional visibility.

Having that possibly inaccurate or out-of-date information mined by a hidden third party in ways that might disadvantage them was probably not what they had in mind when they joined.

Or perhaps, because all hiQ is doing is accessing what anyone can already see, that’s inevitable anyway.

Which raises the disturbing possibility that what hiQ v LinkedIn is really about is not so much the adage that users are now the product, but whose product they are destined to become.

Follow @NakedSecurity
Follow @JohnEDunn

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/E6Tt_UBWgeg/

New British aircraft carrier HMS Queen Elizabeth has sprung a leak. The warship takes on around 200 litres of water per hour thanks to a faulty propeller shaft gland packing, according to reports.

The packing in question, according to The Sun, which broke the news and knocked up a graphic illustrating the problem, was rapidly identified as faulty during the warship’s basic sea trials.

One of the watertight packings where one of the ship’s two propeller shafts enters the sea is not as watertight as it should be. While water is entering the ship, standard ship design practice is for there to be plenty of drains into the bilges at points where water can enter a ship’s hull. Being a naval warship and therefore designed to accept a certain level of damage, it is certain that Big Liz has more than enough bilge pumps to cope.

It is said that the Aircraft Carrier Alliance, the BAE Systems-dominated conglomerate formed to build “Big Liz” and sister ship HMS Prince of Wales, is liable for repairing the leak because it pre-dated the ship’s formal handover to the Royal Navy.

Mechanically minded readers will have worked out that 200 litres per hour equates to three and a third litres per minute, which in turn is a little bit more than your average kitchen jug. If confined to a tap, the rate of flow is about that which you’d use to fill the kettle.

Commercially available bilge pumps designed for fishing boats can move upwards of 50 litres per minute, as a very brief internet search by El Reg found. It is vanishingly unlikely that a leaky gland seriously affected the carrier’s ability to operate (we encourage older readers not to draw comparisons with their personal situations) – after all, the point of sea trials is to find these types of problems and fix them before sending the ship on Her Majesty’s business.

A naval spokesman told The Sun: “An issue with a shaft seal has been identified during HMS Queen Elizabeth’s sea trials. This is scheduled for repair while she is alongside at Portsmouth. It does not prevent her from sailing again and her sea trials programme will not be affected.”

The Telegraph got hold of Defence Secretary Gavin Williamson, who told them: “This isn’t going to cost the British taxpayer a penny. This is the reason why we have the sea trials, to make sure that everything is working absolutely perfectly.”

HMS Queen Elizabeth first sailed this summer, following her multi-year build in Scotland.

Fixing a leaky gland (stop it…) involves stripping out the packing around the propeller shaft and replacing it. The principle is explained here, in the context of a small pleasure boat. Though the MoD seems keen to stress that the ship won’t need dry docking for the gland to be stripped and repacked, folk who know more than El Reg does about boaty things seem to think a spell in dry dock is the answer.

This involves putting the ship into a sealable dock which is emptied of water so maintenance folk can get below the ship’s water line and strip out components that need repair and replacing. Typically, this an expensive and time-consuming process.

Defence blogger Sir Humphrey has a useful list of other navies’ early problems with new ships, giving some very useful context. This is not a unique feature of British naval architecture.

Though defence commentators are, rather predictably, shouting about this being a non-story – and to a point it is an expected defect – it is very much a matter of public concern. Big Liz cost the taxpayer £3.5bn to build. If there are problems with the new aircraft carriers, which are set to become Britain’s flagships for the next half-century or more, it is right and proper that the public knows about them – and, in the context of stagnating defence budgets under severe pressure from currency fluctuations and inflation, it is also right that the public knows that they are being fixed and who is paying for the repairs.

HMS Queen Elizabeth is due to put to sea again in the New Year. In the second half of 2018 she will sail to the US for flight trials with the new F-35B fighters that will fly from her during her British service life. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/12/19/hms_queen_elizabeth_leaky_gland/

The Foreign Office Minister Lord Ahmad of Wimbledon has confirmed North Korea was behind the WannaCry ransomware incident.

In a statement today he said the hermit state’s spy unit, the Lazarus Group, was behind the attack. The group, which also goes by the name Guardians of Peace, has been active since 2009 and uses DDoS botnets, keyloggers, remote access tools and wiper malware in their activities.

The decision to publicly attribute this incident sends a clear message that the UK and its allies will not tolerate malicious cyber activity, the Foreign Office said.

The WannaCry ransomware incident affected 300,000 computers in 150 countries and included 48 NHS trusts among the casualties.

Back in October, security minister Ben Wallace appeared to blame North Korea for the infamous ransomware attack that disrupted the operation of one in three NHS trusts in England as well as numerous other organisations worldwide.

Ahmad said: “The UK’s National Cyber Security Centre assesses it is highly likely that North Korean actors known as the Lazarus Group were behind the WannaCry ransomware campaign – one of the most significant to hit the UK in terms of scale and disruption.

“We condemn these actions and commit ourselves to working with all responsible states to combat destructive criminal use of cyber space. The indiscriminate use of the WannaCry ransomware demonstrates North Korean actors using their cyber programme to circumvent sanctions.”

He said the UK is determined to identify, pursue and respond to malicious cyber activity regardless of where it originates, imposing costs on those who wish to attack us in cyberspace. “We are committed to strengthening coordinated international efforts to uphold a free, open, peaceful and secure cyberspace.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/12/19/fco_confirms_north_korea_behind_wannacry/