STE WILLIAMS

The United States Internal Revenue Service has said that citizens affected by the Equifax breach need not panic, because it probably didn’t reveal anything that hasn’t already been stolen and the agency has tooled up to deal with fraudulent tax claims.

Commissioner John Koskinen, discussing whether the breach would interfere with tax collection, told journalists “a significant percent of those taxpayers already had their information in the hands of criminals”, according to a report of a QA session after a speech at the Service’s “Security Summit”.

In his prepared remarks, the commissioner said “We’ve seen the number of identity theft-related tax returns fall by about two-thirds since 2015. Over the past two years, fewer false returns have entered the system, fewer fraudulent refunds have been issued and fewer taxpayers have reported to the IRS that they were victims of identity theft. This dramatic decline helped prevent hundreds of thousands of taxpayers from facing the challenge of dealing with identity theft issues.”

But that still leaves as many as 100 million individuals at risk of Equifax-sourced data giving them problems beyond the IRS. Koskinen added that Americans should assume their data is in criminal hands and act accordingly.

As we reported at the time of the mega-breach, not everything Equifax knew about Americans was leaked: “only the names, social security numbers, birth dates, addresses and, in some instances, driver’s license numbers of 143 million Americans”.

It later emerged that the patching error that left the credit reporting company trouserless was common, with estimates that as many as 50,000 organisations downloaded still-vulnerable Apache Struts 2 packages after the software was patched against CVE-2017-5638.

Koskinen promised taxpayers the IRS wouldn’t end up on the breach list, given how much “sensitive personal information has fallen into the hands of criminals recently”.

The Register decided a reality test was in order, and asked Troy Hunt (who maintains the HaveIBeenPwned database of breached accounts) whether Koskinen’s remarks ring true.

“I think that would be just under one-third of the population … it may be fractionally on the high side,” Hunt said.

However, any general statement that “what’s technically called a sh*tload” of Americans were already pwned is “probably accurate”. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/18/internal_revenue_service_tells_americans_their_data_was_probably_stolen_before_equifax_lost_it/

Hundreds of products, more than 250 vulnerabilities … yes, it’s Oracle’s quarterly critical patch update day!

Oracle opens its bulletin with news that it “… continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released fixes.”

“In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update fixes without delay.”

With puny humans failing it, no wonder Big Red’s talking autonomous databases that patch themselves.

Enough reflection! Back to the bug news, which tells us Oracle Fusion Middleware has 38 vulns, while 37 turned up in Hospitality Applications and another 25 in MySQL.

Many of the bugs hit multiple products: CVE-2016-6814, for example, is inherited from Apache Groovy, and is present in Oracle Database Server, the Construction and Engineering Suite, Enterprise Manager Grid Control, Oracle Fusion Middleware, Health Sciences Applications, and two Retail Applications components.

Twenty-four vulnerabilities carry Common Vulnerability Scoring System scores of nine or better, and the three standouts with perfect 10 are:

• CVE-2017-10402 in a reporting component of Hospitality Applications, exploitable over HTTP for a complete takeover;
• CVE-2017-10405, also in Hospitality Application reporting, also exploitable over HTTP, for access to all data as well as denial-of-service; and
• CVE-2013-1903 (yes, it’s four years old), in Siebel; the Field Service component can be pwned over HTTP.

CVE-2017-10332 only scores 7.5, but it’s easy to exploit, and “successful attacks of this vulnerability can result in unauthorised access to critical data or complete access to all Oracle Universal Work Queue accessible data”.

Java Platform SE got 22 fixes, 20 of which are network-exploitable. The top two, with CVSS scores of 9.6, are CVE-2017-10285 which affects implementations running untrusted code, is easy to exploit, and offers full pwnage over the network; and CVE-2017-10346, with a similar profile.

Here’s the “verbose” version of Oracle’s advisory in all its gory glory.

The shorter version offers links to product-specific reports. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/18/oracle_october_2017_quarterly_patches/

Europol has asked cellphone networks and other internet providers to stop using Carrier Grade Network Address Translation (CGNAT) – because it’s making life too difficult for cops trying to track cyber-villains across the web.

CGNAT is used by telcos running short of public IPv4 addresses. By deploying CGNAT, a mobile network or ISP can stick a bunch of customers – typically small businesses and home subscribers – on private IPv4 addresses and route them through a small set of global IPv4 addresses. This technique has been widely deployed by providers unwilling or unable to bung their users on world-routable IPv6 addresses.

Having so many people sitting behind a small pool of public IP addresses is upsetting the Euro plod: identifying and tracking suspects by their network addresses in server logs is tough as it’s not clear exactly who is who. Officers can ask network providers to unmask subscribers, but that’s not always easy if an investigation is in its early stages and there are hundreds of thousands of people behind just a few IP numbers.

The courts are already split on whether an IP address can be used to formally identify someone. CGNAT muddies the waters further, especially when mobile networks are involved as they are heavy users of CGNAT. In short, loads of people on their phones are behind a small brick wall of IPs and the cops are banging their heads against it.

Finally a reason not to bother with IPv6: Uh, security concerns…?

READ MORE

“CGN technology has created a serious online capability gap in law enforcement efforts to investigate and attribute crime,” said Europol’s executive director Rob Wainwright in a statement on Tuesday.

“It is particularly alarming that individuals who are using mobile phones to connect to the internet to facilitate criminal activities cannot be identified because 90 per cent of mobile internet access providers have adopted a technology which prevents them from complying with their legal obligations to identify individual subscribers.”

The call came after a conference was held in Estonia to discuss the issue, in which crime fighters gave examples of investigations that had been stymied thanks to CGNAT. Various options are being considered including a voluntary agreement with cellular networks and ISPs not to have too many users per IP address or a legal requirement that they record detailed logs so customers can be traced back through a mega-NAT.

“Ensuring EU law enforcement investigations are effective and result in the arrests of responsible parties is one of Europol’s key functions,” said Steven Wilson, head of Europol’s European Cybercrime Centre. “The issues relating to CGN, specifically the non-attribution of malicious groups and individuals, should be resolved.”

The nuclear option is to force network operators to use IPv6, but that’s unlikely to happen anytime soon. The industry is banking on making a slow transition that minimizes costs. Legal action to fend off the plod would hurt profits and potentially result in even less enthusiastic cooperation between network providers and investigating officers. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/18/europol_cgnat/

Updated Malware exploiting Microsoft Word’s DDE features to infect computers has been lobbed at US government-backed mortgage biz Freddie Mac.

Well-crafted phishing emails were sent to staff promising free tickets to a Halloween event at a nearby Six Flags amusement park. If employees click through a link in the message, they’re receive an Office document to register and a prompt warning that the file wants to access data from other apps appears. If OK is clicked, a payload is downloaded from a Halloween-themed domain – sixflags-frightfest.com – for extra authenticity.

This payload is a Visual Basic script that tries to obfuscate its execution by pivoting through Microsoft Excel before unpacking a secondary payload that decodes another packed bunch of data that eventually turns into a generic nasty known as Cometsys or Cometer that appears to open a backdoor to receive further commands and siphon off internal data to its masterminds.

“Notice the above payload begins by modifying the registry for additional privileges,” explained network security firm Inquest on Tuesday.

“This is done in order to pivot execution through Microsoft Excel. Once modified, it later restores the registry setting to the previous value. This technique is generally used to mask execution chains in an attempt to hide from endpoint security solutions.”

It’s the latest in a series of cyber-attacks leveraging DDE, which seems to be popular again with malware developers. Microsoft still supports it, so expect to see more of this kind of attack.

Good intentions go bad

DDE is, frankly, ancient: it was introduced in Windows 2.0 back in 1987 and, at the time, it was a pretty good idea. The protocol allows Office files to share data so that, for example, you could embed an Excel spreadsheet in a Word document.

So far so good, but from a malware perspective, it’s an interesting way to evade security software. A clean file, such as the Word document used in the Freddie Mac case, can be spammed out and security filters will let it through, but the document can use DDE to pull in payloads and run them, if the user allows it.

That last point is crucial, and without victims carelessly clicking on OK buttons, the attack won’t work. Fooling people into clicking OK on dialogue boxes isn’t hard – most users, particularly non-technical ones, will just click OK to get on with what they are doing…

What computer users see in security warning boxes #enigma2016 Very, very true. pic.twitter.com/8V4SlGwKAV

— Iain Thomson (@iainthomson) January 26, 2016

The software actually asks users twice to OK the data exchange. The first warning box asks if you’re OK bringing in linked files, and the second states there’s a problem and asks permission to execute commands via cmd.exe. For seasoned users, this should set off alarm bells. For non-savvy people in a hurry to go to Six Flags, it’s another whizzbang space-age technospeak jargon-pest to click through.

Not a bug but a feature

Analysis by security consultancy Sensepost last week showed that this second box, the more alarming one for users, can be hidden by tweaking the syntax in the exploit code. This means marks only have to click on one OK button to become infected. This makes infiltrating and spying on an organization a lot easier.

However, Redmond has made it clear that because the user needs to OK, this is a WONTFIX issue.

“Microsoft responded that as suggested it is a feature and no further action will be taken, and will be considered for a next-version candidate bug,” Sensenet claimed after alerting the Windows giant to the bypass.

That may change, however, if exploitation rates of DDE expand, and it’s looking like they are. On Tuesday, Brad Duncan from the Internet Storm Center wrote that he has already seen scumbags pushing Hancitor malware – also known as Chanitor or Tordal – using DDE. ®

Updated to add

“This technique requires a user to disable Protected Mode and click through one or more additional prompts. We encourage customers to use caution when opening suspicious email attachments,” a Microsoft spokesperson told The Register after this story was published.

The spokesperson also claimed that the file mentioned in the Inquest blog post would have been stopped by Windows’ builtin security. Let’s hope it nails whatever malware is lobbed around next.

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/17/microsoft_dde_attacks/

Top ad-blocking plugin uBlock Origin has come under fire for being a little too eager in its quest to murder nasty stuff on the internet: it prevents browsers from sounding the alarm on hacking attacks.

At the heart of the matter is a fairly new technology called content security policy reporting, or CSP reporting. It’s documented here as a W3C draft, here by Google, and over here by Mozilla. Websites can use CSPs to whitelist the scripting code that’s allowed to run on their pages, thus stopping attackers from injecting malicious JavaScript into browsers that hijack users’ logged-in accounts.

It’s supposed to kill cross-site-scripting, aka XSS, attacks, and automatically report hacking attempts back to the website’s administrators. It’s very handy.

However, uBlock Origin is blocking browsers from sending these CSP alerts, infosec consultant Scott Helme reported on Monday in a bug report on the uBlock Origin GitHub repo. The free Chrome and Firefox plugin bins all CSP reports if any script neutered to protect the user’s privacy is allowed onto the page, such as a defanged Google Analytics script.

In his bug report, Helme wrote:

uBO is blocking the sending of legitimate CSP reports. I have a policy setup on https://scotthelme.co.uk which fires multiple reports that are all blocked.

uBlock Origin developer Raymond Hill replied that this is “by design,” and that the plugin kills all CSP alerts if any neutered scripts, such as Google traffic analytics, are allowed to run. He added users could manually whitelist Google Analytics for a particular site to avoid any CSP reports being suppressed, and closed the bug:

uBO will block CSP reports if it injects at least one neutered script in a page. This is what is happening on https://scotthelme.co.uk/, uBO is injecting a neutered Google Analytics script. In such case, uBO conservatively assumes that the injected script is what is causing the CSP reports and blocks them. If you create an allow rule for Google Analytics for that site, the CSP reports are not blocked.

The trouble is that websites won’t receive alerts from browsers when uBlock Origin is installed and miscreants are trying to execute XSS attacks. That means site developers and admins may be unaware of attempts to exploit weaknesses in their code, vulnerabilities may not be addressed, and people may end up losing control of their accounts if attacked. Ultimately, Helme and others want to end uBlock Origin’s broad blockade of CSP alerts.

“uBO can block Google Analytics without interfering with CSP reports. The two things aren’t related, they’re choosing to prevent the CSP report being sent,” Helme told El Reg. Troy Hunt, ‏who runs the Have I Been Pwned website, added: “This is the problem: if you’ve got an XSS risk on your site, for example, a browser running uBlock Origin can no longer report it to you.”

Hill countered that CSP reports are a potential privacy issue, in that it is data phoned home to a remote server. “CSP reporting helps a host to fix their own problems in configuring their server, it does not help at all to fix users’ own problems. CSP reports are not for the benefits of users – to say so is just marketing,” he argued.

Essentially, uBlock Origin is trying to stop Google Analytics from tracking people across the web. Hill warned that spurious CSP reports may be generated when it neuters scripts, and it blocks these reports to prevent information leakage.

Helme told El Reg that uBlock Origin’s blanket policy was not only unworkable but ill-conceived. Any information reported back to a website from one of its own webpages should be known to the website anyway: the site generated the page, after all.

Revealed: The naughty tricks used by web ads to bypass blockers

READ MORE

“uBO is taking unilateral and indiscriminate action against all reports,” Helme explained. “If they want to restrict reports caused by them then fair enough, but to stop the site sending any reports about security incidents just seems dangerous at best.

“I don’t see how sending a CSP report to a reporting service is any more privacy violating than loading an image, script or stylesheet from a content delivery network. 99.99999 per cent of users aren’t even going to know about CSP so suggesting that users can manually whitelist this to make it work is a non-starter.”

The issue has sparked a lively debate on social media. Techie Dmitry Chestnykh, a uBlock Origin user, argued that the plugin is enhancing user privacy: “CSP reporting is not a security feature for users, CSP blocking is. It’s not user’s responsibility to report that your site is broken.”

Paul Moore, a UK-based chief information security officer with an interest in web privacy, disagreed. “It seems bizarre that a plugin to aid security and privacy not only breaks enhanced user agent features but actively refuses to fix it,” he said.

Meanwhile, Hill has since reopened Helme’s bug to reinvestigate the matter, noting: “I will look into whether it is possible and practical for uBO to block only whatever CSP reports are fired as a result of uBO doing its job.”

In short, if you use uBlock Origin, for now, your browser can’t warn websites when they and their users are under attack from account and session hijackers. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/17/ublock_origin_csp_reports/

Domino’s Pizza’s Australian outpost has blamed a partner for a security breach, after angry customers went online complaining about finding themselves on spam lists.

The company owned up to the breach after Redditor “Pinchie McPinch” complained about receiving e-mails from “Sarah” and “Jess”.

What tipped Pinchie that the data may have come from the pizza chain was that the spammers were referring to his/her favourite Domino’s locations to make the approaches look more plausible.

Domino’s acknowledged the breach and said it is investigating what happened. The company blamed the breach on an unnamed “former” supplier.

The company’s statement says the breach was limited to “email addresses, names and store suburbs (related to pizza orders) … at no time has customer financial information (including credit cards) or passwords, been accessed or compromised.”

The statement added that the company will “work closely with the relevant privacy authorities in Australia.”

Electronic Frontiers Australia board member Peter Tonoli isn’t satisfied with Domino’s handling of the situation:

How about @Dominos_AU contact their customers about the privacy breach, instead of relying of customers unawareness of the problem? Asking customers to email Dominos is disingenuous and opaque #privacy #databreach @OAICgov pic.twitter.com/Bw6f5bezxZ

— Peter Tonoli (@peter_tonoli) October 17, 2017

It seems the unnamed supplier was a trans-Tasman operation, since last week similar complaints emerged in New Zealand.

The Register has asked Domino’s for comment. And a Supreme for lunch, plus a Coke Zero.^* ®

^*Not really.

Update: A Domino’s spokesperson has sent a statement to The Register which mostly reproduces what is on its Website, but which confirms it has notified the Office of the Australian Information Commissioner of he breach.

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/18/dominos_pizza_australia_data_breach/

Products from Lenovo, HPE, Google, Microsoft, and others impacted by flaw in Infineon chipset.

The set of key reinstallation vulnerabilities disclosed Monday in the WPA2 protocol is actually the second disclosure in recent days to hammer home just how difficult it can be getting cryptography right.

Last week a team of security researchers from Masaryk University in the Czech Republic and other organizations disclosed a bug in a Trusted Platform Module (TPM) chipset from Infineon Technologies AG that some believe is worse than the KRACK WiFi flaws.

The factorization vulnerability gives attackers a way to recover the private half of any RSA encryption key generated by the chipset, using only the public key. Unlike the KRACK flaws, an attacker does not need to be close to a vulnerable device or have access to it, in order to exploit the flaw. Any RSA key generated by a vulnerable Infineon chipset is open to attack, the researchers said in an alert.

“It’s a huge deal in terms of the integrity of the infrastructure. Once the private key is derived, integrity is lost.” says Scott Petry CEO and Founder of Authentic8.

“The practical nature of the vulnerability is a function of how broad the TPM installed base is and whether an attacker can determine a vulnerable private key from the public part — in other words, can an attacker determine if a key was generated by the chipset or not,” he says.

According to the researchers, the bug makes factorization of 1024 and 2048 bit key lengths practically possible in terms of time and cost. “The worst cases for the factorization of 1024-bit and 2048-bit keys are less than 3 CPU-months and 100 CPU-years, respectively, on a single core of a common recent CPU, while the expected time is half of that of the worst case,” the researchers said.

Using multiple CPUs to do the factorization can reduce the time significantly. At current prices, an attacker would spend about $76 to do the factorization for a 1024-bit key using an Amazon AWS c4 instance and roughly $40,000 to do the same with a 2,048-bit key.  Currently, at least 760,000 keys generated by the chipset are confirmed to be vulnerable. But it is quite possible that between two and three magnitudes more keys are broken.

The researchers will present a research paper titled “The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli’ (ROCA) that will describe the attack more in detail Nov. 2 at the ACM CCS conference in Dallas.

The ROCA issue impacts any product in which the buggy chipset is integrated. The list includes products from Google, Microsoft, HPE, Lenovo and Fujitsu as well as trusted boot devices, authentication tokens and software package signing tools from other vendors. All of the vendors have released updates and advice to mitigate the issue. Infineon itself was informed about the bug in February and given time to address the issue before public disclosure. The company has developed firmware updates and made it available to OS and device makers.

“Cryptography is undoubtedly the most difficult problem to get right when it comes to information security,” says Sean Dillon, senior security researcher at RiskSense.

If the number of cryptographic weaknesses that have been discovered in once widely trusted algorithms in recent years is any indication, more related vulnerabilities continue to be found for years to come, he predicts.

Vulnerabilities such as the ROCA flaw suggest the use of quantum computing and large prime factorization is not just a research concept, he says. Rather they portend “practical attack(s) that can break the entire trust model, even amongst big players such as governments and financial institutions,” Dillon says.

Related content:

• Secure Wifi Hijacked by KRACK Vulns in WPA2
• The Long Slog To Getting Encryption Right
• When Encryption Becomes The Enemy’s Best Friend
• 7 Hardware Firmware Hacks Highlighted at Black Hat 2017

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/factorization-bug-exposes-millions-of-crypto-keys-to-roca-exploit/d/d-id/1330151?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cybercriminals are advertising ATM malware that’s designed to exploit hardware and software vulnerabilities on the cash-dispensing machines.

ATM malware advertisements are making the rounds on the Dark Web, touting capabilities to clean the machines out of cash with hardware and software exploits, Kaspersky Lab announced Tuesday.

For example, one ad posted on the now-defunct AlphaBay Darknet marketplace offered detailed manuals, a list of required equipment, ATM models to target, and tips for operating the malware, Kaspersky notes. The sellers of this kit wanted $5,000.

Buyers were told they could steal all the cash from ATM machines infected with the malware, without having to bother accessing individual accounts and data used by ATM card holders, Kaspersky stated.

The malware works on vendor-specific APIs and was discovered in May by Kaspersky, which noted the assumed development period was June to August 2016.

Read more about the ATM malware here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/atm-machine-malware-sold-on-dark-web-/d/d-id/1330154?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Five anonymous former Microsoft employees tell Reuters that Microsoft’s database of internally discovered vulnerabilities was compromised in 2013, but Microsoft will not confirm it occurred.

In early 2013, Microsoft, Apple, Facebook, and Twitter all reported being compromised by the same threat group, via a Java exploit on Mac endpoints. Until today, however, there were no indications that the intrusion at Microsoft included a compromise of its vulnerability database. According to a Reuters exclusive, five anonymous former employees now say that this bug repository was indeed compromised.

If attackers did access a database that could have included yet-unpatched critical vulnerabilities, it could have enabled the attackers to launch more effective, dangerous campaigns against other targets. A 2015 Mozilla breach that exposed 10 unpatched vulnerabilities, for example, resulted in an attack on Firefox users; Mozilla subsequently disclosed the attack. 

However, Microsoft has not confirmed that the 2013 breach led to attacks on users of Microsoft products, nor have they confirmed the breach impacted the bug repository at all.   

Today, a Microsoft spokesperson told Dark Reading in an emailed statement:

“In February 2013, we commented on the discovery of malware, similar to that found by other companies at the time, on a small number of computers including some in our Mac business unit. Our investigation found no evidence of information being stolen and used in subsequent attacks.” 

In February 2013, in a Microsoft Technet blog, Matt Thomlinson, then general manager of Trusted Platform Security, wrote:

“As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion. 

Consistent with our security response practices, we chose not to make a statement during the initial information gathering process. During our investigation, we found a small number of computers, including some in our Mac business unit, that were infected by malicious software using techniques similar to those documented by other organizations. We have no evidence of customer data being affected and our investigation is ongoing.”  

According to the Reuters report, the exposed bugs were patched within months and “Microsoft tightened up security after the breach, the former employees said, walling the [vulnerability] database off from the corporate network and requiring two authentications for access.”

“It sounds like they responded to the breach in a reasonable fashion,” says Chris Eng, vice president of research at application security company Veracode, “both in terms of prioritizing fixes and monitoring for real-world exploitation of the leaked vulnerability information.” 

[Chris Eng will be speaking about “Security, Application Development, and DevOps” at Dark Reading’s upcoming INsecurity conference, Nov. 29-30 at the Gaylord National Harbor in Maryland.]

Yet, according to the Reuters report, some former employees feel that the company relies too heavily on automated crash reports to determine whether or not vulnerabilities have been used in sophisticated attacks. 

Eng cautions against making comparisons between this event and the National Security Agency breach of exploit tools that led to the outbreak of WannaCry infections earlier this year.

“Comparing the theft of vulnerability reports to the theft of exploits (the NSA situation) is apples and oranges,” says Eng. “Obtaining information on a given vulnerability is not the same as obtaining a reliable, working exploit. The attackers would have had to determine which of the bugs were actually security-related, then figure out which ones were exploitable, then develop exploits for them, each of which can take months.”

Nevertheless, a database or bug tracking system “is as essential to protect as customer data,
 says Chris Goettl, product manager at asset and patch management firm Ivanti. “If a system holds information that can put your customers at risk. as in this case, it would be one you would want to focus additional security controls and limit access to.”

“Disclosure of data from a bug tracking system is a high concern,” says Goettl. “With access to a bug system where developers may have deconstructed an issue and even proposed resolutions an attacker would gain considerable insight into how to exploit those systems or applications. Even more concerning is the possibility that a bug could be resolved in currently supported products at the time, older versions could have the same flaws and not have been slated for resolution because they were no longer being supported.”

For more information, see Reuters.  

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/reuters-microsofts-2013-breach-hit-bug-repository-insiders-say/d/d-id/1330148?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Two major players announced cross-border payment networks built on blockchain technologies Monday, and more financial services will follow soon, despite opinions about Bitcoin.

The distributed ledger technology that underpins cryptocurrency like Bitcoin is rapidly going mainstream. Blockchain is building a tremendous amount of buzz as technology and financial industry heavyweights and startups race to apply the technology in innovative new applications for the banking sector. Their efforts are starting to bear fruit in the area of cross-border payments, as three separate announcements from IBM, J.P. Morgan, and Bank of Canada highlighted this week. 

Each company announced their own flavor of payment network solutions built on blockchain technology. Working in conjunction with technology partners Stellar.org and KlickExGroup and over a dozen financial institutions, IBM rolled out a banking product that leverages its IBM Blockchain platform. The project, announced Monday, is designed to clear and settle financial transactions worldwide in near-real-time.

The ultimate goal is to provide a secure, speedy and transparent financial platform between global markets that may have found it difficult to do business with one another due to the bureaucratic pitfalls of legacy international payment networks.

That’s a similar goal shared by J.P. Morgan, which together with partners Royal Bank of Canada and Australia and New Zealand Banking Group Limited also Monday launched the Interbank Information Network (IIN). It’s a cross-border payment network built upon Quorum, J.P. Morgan’s internally developed blockchain technology. According to J.P. Morgan, its first two banking partners are just the start for IIN and other correspondent banks are expected to join soon.

Tuesday, the Bank of Canada, Payments Canada and TMX Group Ltd, operator of the Toronto Stock Exchange, announced that they will get together to test the use of blockchain for automating securities settlement.

J.P. Morgan’s commitment to Quorum and blockchain capabilities are interesting considering its CEO Jamie Dimon’s well-documented dismissal of Bitcoin as a “stupid” idea. Clearly, his bank isn’t one for throwing the baby out with the bathwater.

The developments this week underline that banking executives are increasingly seeing the upside of combining distributed ledgers with solid cryptographic applications for new means of facilitating payments, trades, contracts, and transactions of all stripes.

“The technology is particularly useful when you combine a distributed ledger together with a cryptotoken,” wrote MIT Sloan Assistant Professor Christian Catalini in an explainer piece from MIT earlier this year. “Suddenly you can bootstrap an entire network that can achieve internet-level consensus about the state and authenticity of a block’s contents in a decentralized way. Every node that participates in the network can verify the true state of the ledger and transact on it at a very low cost. This is one step away from a distributed marketplace, and will enable new types of digital platforms.” 

For security and risk professionals, blockchain stands as an especially appealing option because it is a technology that’s essentially security native; its fundamental design from day one has kept security top of mind.

“Blockchain is designed with security in mind and can help optimize processes,” says Bob West, a former banking CISO and current CEO of consultancy Echelon One. Moving beyond announcements like the ones Monday, other examples of optimized processes would be the settlement of stock trades. “The settlement of stock trades could become close to real-time if blockchain were used throughout the trading supply chain.”

The trick will be convincing senior executives it can add value to the business, West says, eplaining that he believes it will be three to five years before the financial sector adopts blockchain broadly.

[Bob West will discuss “Creating and Managing User Identities in the Real World” at the upcoming INsecurity Conference, Nov. 29-30 in the D.C. area. See the full agenda at https://insecurity.com.]

Others agree it’s going to take time including Brian Conneen, CIO and CTO of Marlette Funding, an online lending company. He says his team is “keeping a close eye on blockchain” as they look for ways to put it to use in their business. 

“The biggest challenge today to leveraging blockchain is that many large players have not yet bought into the nascent technology, most likely due to unfamiliarity or in some cases lack of central control,” Conneen says.  “We are still a few years from reaching critical mass, but once a few major players leverage blockchain in a way that is core to their business, the acceleration to adoption will be exponential.”

Related content:

• If Blockchain is the Answer, What is the Security Question?
• Blockchain’s New Role in the Internet of Things
• 7 Things to Know About Today’s DDoS Attacks

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/cloud/banks-start-broad-use-of-blockchain-as-jp-morgan-ibm-lead-way/d/d-id/1330153?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple