STE WILLIAMS

Crackas With Attitude troll gets five years in prison for harassment

A member of the short-lived Crackas With Attitude hacking troupe has received five years in prison, despite the fact that he hadn’t actually hacked any accounts himself and had accepted a plea deal.

Justin Liverman was sentenced to 60 months inside by Judge Gerald Bruce Lee in the Federal Court of the Eastern District of Virginia on Friday. He had earlier pled guilty to conspiracy to hack US government computer systems and the court awarded him the maximum sentence it could, along with a $145,000 fine.

“These are no pranks,” said Judge Lee at sentencing, the Washington Post reports. “This computer hacking, Crackas With Attitude, caused chaos. Your intent was clear, and that was to wreak havoc.”

The CWA team first rose to prominence in October 2015 when the group claimed to have hacked the personal AOL account of then-CIA boss John Brennan and forwarded some of the contents to WikiLeaks.

The next month other high-profile scalps followed, including the then-US National Intelligence Director James Clapper, FBI Deputy Director Mark Giuliano and President Obama’s senior advisor and director of the Office of Science and Technology, John Holdren.

Liverman wasn’t one of the team members who managed to social-engineer access to these accounts – that was done by a teenage British hacker going under the unimaginative handle Cracka. But Liverman hired a phone spamming service to harass Deputy Director Giuliano.

Once an hour for about a month, Giuliano would get threatening or explicit phone messages from the service. Liverman also texted him directly with messages about his “slut wife” and claiming he was planning to “keep a close eye on your family, especially your son!”

“Liverman leveraged Cracka’s superior social engineering skills to his own ends – namely, to cause disruption/fear through harassment and to continue to perpetrate his online fraud of being an administrator of a hacking group and a successful hacker himself,” said Special Assistant US Attorney Joseph Longobardo.

In January last year, Liverman also claimed to have hacked NASA’s servers and released a dossier of materials on his Twitter account. It turned out the cache was of publicly available documents after NASA spent plenty of time and $41,300 researching the issue.

As you’d imagine, law enforcement was royally pissed off about the intrusions and set to work. A month after Liverman’s NASA dump, the first member of the team, Andrew Otto Boggs (aka Incursio), was arrested along with Liverman after investigators found he was using his home IP address to access Twitter, and British police swooped down on Cracka shortly afterwards.

Boggs was sentenced to two years in prison in July – Liverman would, no doubt, have been looking at a similar sentence. He has already done three months in the Big House after overdosing on cocaine while out on supervised release.

In court Liverman said that he had taken part in the hacking team to expose the insecurity of senior government officials’ email accounts. He added that he was also fighting back against government overreach.

“I thought what I was doing was right in terms of political justice,” he said in court Friday. “But two years later, I realize I was completely wrong.” ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/11/crackas_with_attitude_troll_gets_5yrs/

What can you do if you’re stuck in Robocall Hell? Nothing

What’s the more horrifying part of robocall Hell: getting some 700 nuisance calls a day over the course of five days, or being told that there’s nothing anybody can do to stop it?

For Kim France, it’s the latter.

She’s a real estate agent who lives in Hilton Head Island, in the US state of South Carolina. In her line of business, she gets plenty of calls from numbers she doesn’t recognize.

But hundreds a day? No wonder the sound of her ringing phone still makes her cringe. Ars Technica quotes her:

Every time a number flashes up on my display that I do not recognize, the hair on the back of my neck stands up.

She talked to Ars’ Jon Brodkin three days into what she described as the “cell phone nightmare” that mysteriously enveloped her in June, making it near impossible to answer legitimate calls from friends, family or clients.

On the first night, she went to bed, slept for seven and a half hours, and found 225 missed calls when she awoke. It kept up at that pace for five days, for a total of roughly 700 calls a day.

She tried robocall blocking services. They didn’t work. That’s not surprising: such tools, which rely on blacklists of known scam numbers, don’t generally work when the numbers’ caller IDs have been spoofed.

Adam Doupé, a security researcher and professor at Arizona State University, told Ars that the core problem is that Caller ID is extremely easy to spoof. There’s no way to verify who’s calling, unlike with email, which relies on making a TCP connection to an email server with a specific IP address:

Because it’s an old, circuit-switched network, none of the switches along the way need to know who actually is placing the call. I was shocked to find out that the Caller ID is just an optional part of the original address message that gets sent along. You don’t need it, and nobody is checking it along the way for authenticity, and, really this means you can put that to be whatever you want. To top it off, there are a lot of online services that allow you to send out phone calls and specify exactly what Caller ID you want them to come from.

This is a problem that the Federal Communications Commission (FCC) is painfully aware of. In March, FCC Chairman Ajit Pai said in a blog post that the commission has proposed greater leeway for providers to block spoofed robocalls:

Specifically, they could block calls that purport to be from unassigned or invalid phone numbers (there’s a database that keeps track of all phone numbers, and many of them aren’t assigned to a voice service provider or aren’t otherwise in use). There is no reason why any legitimate caller should be spoofing an unassigned or invalid phone number. It’s just a way for scammers to evade the law.

Was it a scammer who plagued Kim France? No. She heard from neither robot nor human scam artist when she answered. Rather, she heard the sound of a fax. Most of the calls came from fake numbers: from area codes or exchanges that don’t exist. Scammers go to more effort than that, spoofing their Caller IDs to make people think they’re getting a local call.

Nobody’s even sure it was actually robocalls she was receiving. The Federal Trade Commission defines a robocall as one in which the recipient hears “a recorded message instead of a live person” …but “robocall” is as good a word as any to describe these nuisance calls, which basically amounted to the phone equivalent of a distributed denial-of-service (DDoS) attack.

Ars quotes RoboKiller co-creator Ethan Garr:

It is possible that whoever did this to Kim France did play a recorded file of the fax-like sound, but I think it’s also possible that they just generated the sound programmatically with each call.

It’s more of a DDoS attack over the telephone lines rather than a spam or scam call.

France tried to get her carrier, Verizon, to help. No luck. After six calls, all the company could come up with was a suggestion that she change her phone number: a no-starter, given that her business’s number is spread across a real estate landscape of third-party websites. Changing it would have been hugely disruptive to her business.

The response when she contacted a consumer rights attorney who specializes in phone call harassment: there’s nothing you can do to figure out where these calls are coming from.

The response from police: sorry, we can’t stop the calls.

The response from the FCC: a form letter explaining what spoofed Caller ID is… as if she didn’t know by that point.

There are intriguing tools in the works that could help to cut spoofed nuisance calls.

For example, Doupé and a PhD student are working on a caller verification system, to integrate into the core backbone of the SS7 signaling protocol, that adds an authentication token to messages so the call recipient can verify that the caller owns the phone number. It’s described in this paper (PDF). Brodkin says it’s similar to the green security lock displayed in browsers with HTTPS-enabled websites.

It relies on SMS, so the prototype is only working with mobile phones at this point.

When the possibility of this being a targeted attack was suggested, France couldn’t fathom who might want to target her. Then again, maybe it wasn’t a phone DDoS; maybe it was a glitch in auto-dialing software? Or then again, maybe it was, as RoboKiller’s Garr suggested, a “fax scam gone awry”.

Garr’s advice for handling an attack like this: “Weather the storm.” Stop answering, and tell friends and family to contact you some other way.

It is unlikely that anybody is going to make harassing calls to your number indefinitely. Scammers and spammers change their numbers very often – most numbers are active for just two hours. Kim’s attack lasted a long time, but even someone trying to do such an attack is likely fearful that if they do it forever they will get caught, and it is probably costing them a little bit to do this consistently.

He suggested using your phone’s Do Not Disturb mode and not allowing repeated calls from the same number.

As for France, so far, the robocall bombardment hasn’t recurred, thankfully. Now, all she’s left with is astonishment that there’s nothing anybody can do to stop this type of attack:

I just feel like there has got to be something that could be done to protect consumers from this type of crime. Being told that no one can do anything for me was the most shocking part to my story.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/WC0DXWqFh8E/

What your phone can tell city transport planners

For four weeks before Christmas last year, Transport for London conducted a very interesting experiment. Using the Virgin Media WiFi network on the London Underground, TfL tracked the movement of people who had phones with WiFi turned on. The only data they recorded on each individual was their MAC address and their movement throughout the area of London’s subway system – known as the Tube – that the experiment was conducted in.

The MAC addresses stored were hashed, and warning posters were posted in the Tube, notifying customers of the test. This is what the posters said:

We are collecting WiFi data at this station to test how it can be used to improve our services, provide better travel information and help prioritise investment. We will not identify individuals or monitor browsing activity. We will collect data between Monday 21 November and Monday 19 December.

Keep calm and carry on! People who preferred to opt out could simply turn their devices’ WiFi off if they didn’t want to participate in the study.

Of London’s 270 Tube stations, 54 were involved, mainly in the central Zone 1. According to data from one day at Vauxhall station, for every three people to go through the gates, one person connected to Virgin Media’s WiFi.

Here are some of the findings of the study:

  • Of the people travelling between Liverpool Street – a major terminus for east London and Essex – and Victoria, a big terminus for south London’s commuter rail routes into Surrey and an important interchange with the Tube network, 44% transferred lines at Oxford Circus, while 26% used only the Circle line.

  • The Finchley Road to Wembley Park section of the Jubilee and Metropolitan lines was observed carefully, to see which line customers would choose as one is much faster than the other between the stations. More people did indeed choose the much faster Metropolitan line.
  • At Victoria station, it takes customers an average of 86 seconds to take the escalator from the ticket hall to the Victoria Line platforms, and 67 seconds to walk along the platform from end to end.

What’s been most amusing Londoners who know the intricacies of their transport system, some of which dates back to Victorian days, is what it revealed about the routes people choose between popular points. London’s Tube is notoriously Byzantine, thanks to its long history, meaning there are often several alternative routes.

One key journey, between northern rail terminus King’s Cross St Pancras, and Waterloo, the other key railway station for points south and west, can be made via 18 different routes, some quicker and more efficient than others. Many Londoners were astonished that even 0.1% of those tracked would even think of making that journey via Liverpool Street, Bank and London Bridge.

So, what did customers think? According to consumer research firm 2CV, customers are a bit apprehensive about mobile tracking, but feel better when they believe they’re making an informed decision. The posters were all over the stations used for research before and during the study. Customers who were able to read the posters probably knew they would be participating in the study if they had WiFi on, and could opt out by turning WiFi off.

A document about the study mentioned that privacy concerns could be raised if the data was compared with CCTV footage or tracking via the Oyster cards that many Londoners use to travel around the city. Only the MAC addresses of devices with WiFi enabled and their path through the study area were recorded.

Other considered options studies tracking how people get around London include using Bluetooth to track vehicles in order to collect real-time congestion data, and developing an app for customers to share their location data with TfL and have it connected to their Oyster or Congestion Charging account. Using the kind of mobile tracking that was used in the Tube study in other areas of London transport, such as bus and cycle routes, has also been considered.

TfL has probably collected all sorts of intriguing data about how Londoners use the Tube. The data can be used to improve routes, frequency, and station design.

So what about tracking in the transportation systems of other cities?

Barcelona has been using IoT-driven technology since 2012 to acquire responsive data from waste management, parking, street lighting, and yes, public transit. Xavier Trias was the mayor from 2011 to 2015, and he campaigned on technological innovation in city services.

Using about 500km of fiber optic cable throughout the city and 670 WiFi hotspots, Barcelona has been collecting data that has helped improve various city services, transport included.

A sensor system has been deployed in city parking lots and spaces. The asphalt-embedded sensors can determine whether or not there’s a vehicle on that space, and that information is used to notify motorists of available parking spaces, with the city claiming that this has reduced congestion and emissions.

Barcelona has also used smart data to reduce energy consumption from their street lights. The city had converted more than 1,100 lamposts  to LED by 2014, and added sensors to those that detect whether or not people are nearby. If there are, the light turns on, and if there aren’t, the light turns off. The lamposts are also part of the city’s WiFi network.

Now on to transportation. Digital bus stops tell customers when the next bus will arrive, and the location of the buses are tracked. The stops also broadcast free WiFi, have USB charging stations for people’s phones, and help people download apps to learn more about the city.

What about my hometown of Toronto? I’ve noticed the kind of parking spot sensors Barcelona uses at Square One Shopping Centre in nearby Mississauga. Square One is the second largest shopping mall in Canada, and the largest in  Ontario. My childhood was practically spent at that mall, so I’m very happy to see electronic signs in front of Square One’s many parking lot entrances that tell motorists how full each lot is.

Like many other cities with subway systems, Toronto’s TTC has been gradually deploying WiFi in stations over the past few years, and now every station has TCONNECT free public WiFi. The TTC and TCONNECT will deploy WiFi in the subway tunnels themselves in 2018. Good, soon I can keep on tweeting as I zip back and forth between Toronto Union Station and the Toronto Eaton Centre.

Toronto’s TTC has yet to publicly announce any customer tracking experiments like the one that was conducted in the London Underground in late 2016. If they ever get around to it, London can show us how.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/EcM3GhLNlnw/

When is a bug not a bug? When Microsoft says ‘it’s a feature’

Is it a bug or a feature in Microsoft’s Edge browser?

As of this writing, the answer to that question remains in dispute between Cisco Talos researchers and the software giant.

According to Cisco Talos’s Nicolai Grødum, it’s definitely a bug, in the browser’s Content Security Policy (CSP), who said:

A specially crafted web page can cause a content security policy bypass resulting in an information leak. An attacker can create a malicious webpage to trigger this vulnerability.

He included technical detail on how to pull off the CSP bypass – he said attackers could create a data disclosure in Edge if they modified the CSP header with the “unsafe-inline” directive to allow inline script code.

And perhaps to lend some support for his conclusion, Grødum noted that a similar flaw existed in earlier versions of Apple’s Safari and Google Chrome, which both companies patched.

Grødum, who made the vulnerability public this last week, included a timeline that said he had notified Microsoft on November 28 last year, but was told in March that the “vendor says this is by design and does not consider it a vulnerability”. He asked the company to reconsider, and wrote on June 7 that Microsoft had re-opened the case to do so. But after more than two months went by without any further response, he went public.

There is still no official response from Microsoft so far (we tried), so that is apparently how it stands. The bug, or the feature, will remain – at least until the next version of CSP is made official. CSP2 is the current standard, while CSP3 is in draft form.

But a bit of the company’s rationale came from a source who would be identified only as “a middleman”, who said:

This behavior was undefined in CSP2, which has been used by modern browsers across the industry.

The severity of the issue is low since it requires a modifier on the policy that relaxes it. In order to address this, some have implemented a draft of CSP3.

Given the low severity and draft state of CSP3, we will intend to implement CSP3 when the standard is final.

According to “the middleman” there is no word on when CSP3 will be finalized.

Microsoft had posted a statement at the beginning of the year announcing its support for CSP2, calling it “another step in our ongoing commitment to make Microsoft Edge the safest and most secure browser for our customers. CSP2, when used correctly, is an effective defense-in-depth mechanism against cross site scripting and content injection attacks.”

All of which sounds like another example of the ongoing debate about compliance standards. One side says if organizations have met the letter of the law in a standard, then they have taken all reasonable measures to make their products secure. In this case, Microsoft said the vulnerability that Cisco Talos describes is “undefined” in the current standard.

But that, observers have been preaching for decades, amounts to a “check-the-box” security mentality. Their argument is that “compliance is not security”, and that what is intended as a security floor too often becomes a ceiling.

The dispute over the severity of the Edge vulnerability is not the only one for Microsoft this past week. Security firm enSilo reported it had found a kernel bug that it said affects Windows versions going back 17 years, from Windows 2000 to the current Windows 10.

They said the vulnerability affects PsSetLoadImageNotifyRoutine, a function that should notify registered drivers in different parts of the kernel when a PE image file has been loaded. But, they said, “after registering a notification routine for loaded PE images with the kernel, the callback may receive invalid image names”.

The response from Microsoft? Dark Reading quoted a spokesperson saying:

Our engineers reviewed the information and determined this does not pose a security threat and we do not plan to address it with a security update.

Maybe part of what’s going on is that Microsoft is getting tougher about paying out bug bounties. As Naked Security’s Kate Bevan noted in June, the company announced it had extended its bug bounty program for Edge, after having paid out more than $200,000 in the previous 10 months.

But obviously, if there’s no bug, there’s no bounty.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ZiPh5qILamU/

Concerns raised over claim that neural networks can detect sexuality

Deep neural networks (DNNs): meant to mimic the brain’s hidden layers of interconnected neurons, they’re complex machine learning systems that can learn tasks on their own by analyzing vast amounts of large, unstructured data such as digital images, sound, or text in order to make predictions.

Think DNNs that are better than humans at lip-reading because of the way they can not only interpret “spatiotemporal” changes in the mouth’s shape as a human speaks but which can also make predictions based on the entire sentence being spoken, so as to use sentence context to improve guesses.

Another development relying on DNN is Google’s ability to turn heavily pixellated images back into recognizable faces: just one thing Google’s doing with AI and its enormous ocean of images.

DNNs are being developed to diagnose lung cancer, to detect early signs of diabetic blindness in eye scans, to beat your doctor at predicting whether you’ll have a heart attack, and to replicate voices, including that of current or former presidents, with the only training needed being a snippet of real, live, recorded voice.

And now, the latest: researchers are claiming that DNNs have beaten humans at figuring out whether somebody’s gay or straight.

They fed 35,326 facial images to a DNN and say that it beat humans hands-down when it comes to sussing out sexual orientation. Given one photo each of a straight man and a gay man, the model they used distinguished between them correctly 81% of the time, the researchers claim. When shown five photos of each man, they say it correctly nailed their sexuality 91% of the time.

The model wasn’t so hot with women: it accurately differentiated between gay and straight with 71% purported accuracy after looking at one photo, and 83% accuracy after five.

Either way, with one or five images, it purportedly did far better than humans. Using the same images, people could tell gay from straight only 61% of the time for men and 54% of the time for women. In fact, the finding supports research that suggests humans can determine sexuality from faces only slightly better than pure chance.

As the researchers tell it – they’re Yilun Wang and Michal Kosinski, of Stanford University’s Graduate School of Business – the features they extracted from the facial images include both fixed (such as nose shape) and transient characteristics (such as grooming style: beards, moustaches, sideburns etc). They described their findings in a paper due to be published soon in the Journal of Personality and Social Psychology.

Wang and Kosinski say that they know whether the faces belonged to gay or straight people because they pulled the images off a dating site: a place where sexual orientation is accessible as part of everybody’s profile. Note bene, however: their work is controversial, and it’s been questioned.

The researchers point to what’s known as the prenatal hormone theory (PHT) of sexual orientation, which predicts the existence of links between facial appearance and sexual orientation. The theory holds that same-gender sexual orientation stems from the underexposure of male fetuses or the overexposure of female fetuses to androgens that are responsible for sexual differentiation – such as the differences between men and women’s faces. The PHT predicts that gay people will have faces that aren’t typical for their gender: gay men will have smaller jaws and chins, slimmer eyebrows, longer noses and larger foreheads, the theory goes, while gay women will have the opposite facial characteristics.

The same hormones that influence facial structure are suspected to also influence sexuality, the theory goes. Like all DNNs that can pick up on subtle clues, the researchers suggest their system is picking up on subtle facial clues to point to a supposedly correlating sexuality. They found that their program focuses most of its attention to the nose, eyes, eyebrows, cheeks, hairline and chin to determine male sexuality, while it zeroed in on the nose, mouth corners, hair and neckline for women. (Note that there’s also been research that finds no such correlation between facial structure and sexuality, however.)

The researchers admit that the study has its limitations. For one thing, images coming from a dating site might be more revealing of sexuality than most photos. They tried to address that issue by training their model to focus on non-transient facial features, such as nose shape. Of course, there are also possible issues around self-reported sexuality: maybe some users call themselves straight but are actually bisexual or gay, and vice versa. The possibility that users haven’t self-identified their sexuality accurately apparently hasn’t been incorporated into the study: Kosinski writes in the report that the researchers didn’t see much incentive for people to advertise themselves as something they’re not on a dating site.

What’s the point of all this? They’re not trying to out anybody, the researchers say. Rather, with all of our images being amassed on Facebook, LinkedIn, and Google Plus profile pictures, to name a few, it’s good to know, from a privacy standpoint, what can be gleaned from them.

Such images are public by default, accessible to one and all. Given all this easily accessible public data, and given the progress of machine learning tools, accurate classifiers could – in theory – be built that spot our sexuality.

It’s feasible that it could be done without subjects’ consent or knowledge, they say. It’s feasible that it could be used as a weapon in cultures that stigmatize LGBT people.

They didn’t build a tool to invade people’s privacy, the researchers said. Rather, they used what they say are widely available, off-the-shelf tools, publicly available data, and methods known to those well-versed in computer vision.

Given that companies and governments are increasingly using computer vision algorithms to detect people’s intimate traits, our findings expose a threat to the privacy and safety of gay men and women.

We did not create a privacy-invading tool, but rather showed that basic and widely used methods pose serious privacy threats. We hope that our findings will inform the public and policymakers, and inspire them to design technologies and write policies that reduce the risks faced by homosexual communities across the world.

Some still see major ethical and science-based issues with the project. Sarah Jamie Lewis, a cybersecurity researcher who studies privacy, called the paper simplistic and naïve:

That, among other problems regarding invasion of privacy…

Unfortunately, researchers all too often feel emboldened to scrap public profile data to do with as they like. We saw that in January, when the people behind Pornstar.ID—a reverse-image lookup for identifying porn actors — scraped 650,000 adult film actors’ images in order to tune their neural network.

I wrote that up in January, and I still haven’t heard back regarding if those performers consented to being identified and listed on the Pornstar.ID site, nor if they agreed to having their biometrics scanned so as to train a neural network.

What’s the difference between Pornstar.ID and the grab for images made by Kosinski and Wang?

Is there any law that says people’s published images — be they porn stars or those on a dating site, both of which are presumably published online for all to see (or purchase) — aren’t up for grabs for the purpose of training facial recognition deep learning algorithms?

As a matter of fact, there are such laws concerning face recognition. The Electronic Privacy Information Center (EPIC) considers the strongest of them to be the Illinois Biometric Information Privacy Act, which prohibits the use of biometric recognition technologies without consent.

Indeed, much of the world has banned face recognition software, EPIC points out. In one instance, under pressure from Ireland’s data protection commissioner, Facebook disabled facial recognition in Europe: recognition it was doing without user consent.

So yes, depending on where you live, there are laws against facial recognition without consent. It’s not clear whether Pornstar.ID’s use of facial scanning falls foul of these laws; ditto for the work done on DNNs and the images used to see if they can detect sexual identity.

Note that, as pointed out by the Economist, this isn’t the first controversial research we’ve seen from Kosinski.

He also developed a method to analyze people in minute detail based on their Facebook activity: called psychometric profiling, it’s generated its share of criticism. It’s also drawn the threat of a lawsuit from Facebook and a job offer from Facebook, on the same day.

Remember the firm Cambridge Analytica? The big-data crunching, ad-buying firm that gained notoriety for what its execs call psychological warfare in both the Trump and Brexit campaigns?

Kosinski claimed he had nothing to do with the firm. But try explaining that to all the friends and acquaintances who wrote to him, telling him to “look at what you’ve done”.

Big data: is it best to keep it to yourself when you find new ways it can be used to manipulate people or invade their privacy? Is it wise, or safe, or altruistic, to point out what this stuff can be used to do, if nobody else has (to our knowledge) figured it out on their own?

Maybe the genie’s out of the bottle now. Maybe repressive, anti-LGBT regimes can use facial recognition to slap labels on people. Maybe those labels will be utterly wrong, given the questionable nature of the controversial prenatal hormone theory.

All we know for sure, right now, is that neural network/machine learning/facial recognition/computer vision researchers are like kids in a candy store, given the plethora of freely accessible facial images online. We might all want to bear that in mind when we post ours.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/qF0EYKFxm08/

44m UK consumers on Equifax’s books. How many pwned? Blighty eagerly awaits SPEX ON THE BREACH

The impact of the Equifax breach in the UK remains unclear days after the disclosure of a breach that could potentially affect up to 44 million British consumers.

The credit reference agency and its UK subsidiaries provide services for UK companies including BT, Capital One and British Gas. Customers of these companies might therefore be affected by the attack despite not having signed up for Equifax’s services. The US agency holds the personal details of 44 million UK citizens, the Daily Telegraph reports. What percentage of these users are affected remains unclear and unconfirmed.

BT has confirmed it was a user of Equifax services, with a spokesman adding it was in dialogue with credit reference agency about the matter. A BT spokesman courtesy told El Reg he wasn’t able to share any more at this point.

Data privacy watchdogs at the Information Commissioner’s Office (ICO) have advised Equifax to alert affected UK customers as soon as possible. Notification in such cases is not mandatory under current UK data protection laws. A spokeswoman at the ICO wasn’t able to provide any guidance on the extent to which UK consumers were affected by the breach when we called on Monday early afternoon.

In a breach disclosure notice last Thursday, Equifax said criminal hackers had exposed the personal data of 143 million customers in the US, which was stolen between mid-May and late July this year after taking advantage of an (unspecified) “web application vulnerability”. Weekend speculation that hackers might have exploited a recently disclosed flaw in Apache Struts has been denied, as previously reported.

According to Equinox, the purloined US data includes names, social security numbers, dates of birth, addresses and, in some instances, driver’s licence numbers. In addition, credit card numbers for approximately 209,000 US consumers, and certain dispute documents with personal identifying information for approximately 182,000 US consumers, were accessed.

Equifax added that “limited personal information” from British and Canadian residents had been compromised without going into details. El Reg put in a query to Equifax’s UK PR representatives asking for clarification on what information belonging to UK consumers had been exposed and how many had been affected. Our query was redirected towards a central (crisis management) PR team, which we understand is US-based.

We’ll update this story as more pertinent information comes to light.

Equifax’s dedicated breach-handling site can be found here. In updates on Friday, Equinox said that it had drafted more people to work in its call centres. It also said that the “arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident” in response to US consumer concerns that finding out if they had been affected by the breach might mean foregoing participation in a class action lawsuit. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/11/equifax_breach_uk_exposure/

42: The answer to life, the universe and how many Cisco products have Struts bugs

More than 42 Cisco products might inherit the Apache Struts bug that emerged last week.

Last Tuesday, Semmle researchers revealed the bug, which lets an attacker send a crafted request to Struts’ REST API to inject malicious code.

Like many vendors, Cisco long ago adopted the open-source Apache for its Web interfaces, and went to work identifying where the vulnerable Struts frameworks are in use.

To date, Switchzilla announced on Friday, it’s found 42 products across a wide swathe of its portfolio.

Products in its collaboration and network management ranges, the Identity Services Engine, a bunch of Cisco Prime software, voice and unified communication, video and telepresence, and hosted services are currently under investigation.

Because the bug allows remote attackers to execute code – in this case, on sensitive kit – Cisco has assigned the “critical” tag to its advisory (in line with Apache).

Cisco says the advisory will be updated if and when it identifies vulnerable products, posts patches, or develops workarounds. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/11/ciscos_crack_vuln_investigators_get_the_file_marked_apache_struts/

Virginia scraps poke-to-vote machines hackers destroyed at DefCon

Virginia’s State Board of Elections has decided its current generation of electronic voting machines is potentially vulnerable, and wants them replaced in time for the gubernatorial election due on November 7th, 2017.

The decision was announced in the minutes of the Board’s September 8th meeting: “The Department of Elections officially recommends that the State Board of Elections decertify all Direct Recording Electronic (DRE or touchscreen) voting equipment.”

In addition to the “current security environment”, the report cites the DefCon demonstration in July that showed how quickly DRE voting systems could be pwned.

With the DefCon bods showing some machines shared a single hard-coded password, Virginia directed the Virginia Information Technology Agency (VITA) to audit the machines in use in the state (the Accuvote TSX, the Patriot, and the AVC Advantage).

None passed the test. VITA told the board “each device analysed exhibited material risks to the integrity or availability of the election process”, and the lack of a paper audit trail posed a significant risk of lost votes.

Local outlet The News Leader notes that many precincts had either replaced their machines already, or are in the process of doing so.

The election board’s decision will force a change-over on the 140 precincts that haven’t replaced their machines, covering 190,000 of Virginia’s ~8.4m population. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/11/virginia_to_scrap_touchscreen_voting_machines/

Apache Foundation rebuffs allegation it allowed Equifax attack

The Apache Software Foundation has defended its development practices in the face of a report alleging its code was responsible for the Equifax data leak.

QZ.com, an outlet run by Atlantic Media, alleged that the hack was the result of an attack on Apache Struts, which as we reported last week was found to have a flaw allowing malware to be injected into corporate networks. The outlet pointed out that the flaw may have been present in Struts for nine years.

Which has Apache antsy, as it’s not willing to wear responsibility for a hack that took place before it knew it had a problem, or to be labelled as the kind of outfit that lets bugs go un-patched for years at a time.

As the veeo for Struts, René Gielen, explains in rebuttal post, “We are sorry to hear news that Equifax suffered from a security breach and information disclosure incident that was potentially carried out by exploiting a vulnerability in the Apache Struts Web Framework. At this point in time it is not clear which Struts vulnerability would have been utilized, if any.”

The post goes on to explain that Equifax says it was breached in May 2017 and learned about the problem was discovered in July 2017 The recent Struts bug, CVE-2017-9805, was announced in early September 2017. Other problems in the code were revealed in March 2017.

Gielen therefore suggests that “the attackers either used an earlier announced vulnerability on an unpatched Equifax server or exploited a vulnerability not known at this point in time [July] – a so-called Zero-Day-Exploit.”

While nobody wants to have bugs in their code, Apache argues it responded properly to the bugs revealed in September.

“Regarding the assertion that especially CVE-2017-9805 is a nine year old security flaw, one has to understand that there is a huge difference between detecting a flaw after nine years and knowing about a flaw for several years. If the latter was the case, the team would have had a hard time to provide a good answer why they did not fix this earlier. But this was actually not the case here – we were notified just recently on how a certain piece of code can be misused, and we fixed this ASAP.”

QZ has since altered its allegation, saying that “An earlier version of this article said the vulnerability exploited by the hackers who broke into Equifax was the one disclosed on Sep. 4. It’s possible that the vulnerability that was targeted was one disclosed in March.”

To make the matter even odder, Equifax hasn’t said how it was breached. Just that it was breached by something to do with a web app. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/11/apache_rebuts_equifax_allegation/

Everybody without Android Oreo vulnerable to overlay attack

Any unpatched Android phone running a version older than Oreo is going to need patching fairly soon, with researchers turning up a class of vulnerability that lets malware draw fake dialogs so users “okay” their own pwnage.

The risk, according to Palo Alto Networks’ researchers, comes from what’s known as an overlay attack.

It’s a straightforward way to trick users: draw a bogus screen for users to click on (for example, to install an app or accept a set of permissions), hiding what’s really happening.

Android is supposed to prevent this happening. As the authors write, “everyone has believed that malicious apps attempting to carry out overlay attacks must overcome two significant hurdles to be successful:

The vulnerability turned up by Palo Alto’s Unit 42 threat research team bypasses these requirements, by exploiting a notification type called Toast that Android documentation describes as “a view containing a quick little message for the user.

Android Toast attack

Palo Alto’s demonstration of an overlay attack: the bogus dialog tricks the user

The Palo Alto discovery builds on a paper published by the IEEE (PDF) that showed the permissions granted by the SYSTEM ALERT WINDOW and the BIND ACCESSIBILITY SERVICE. These, Yanick Fratantonio and fellow-researchers Chenxiong Qian, Simon Chung and Wenke Lee showed, can be exploited to “successfully and completely compromise the UI feedback loop”.

Exploiting these permissions, the paper explains, “allows an attacker to both modify what user sees and inject fake input, all while maintaining the expected ‘user experience’ and remaining stealthy”.

Palo Alto’s people say the overlay attack they’ve discovered “could carry out an overlay attack simply by being installed on the device”. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/11/everybody_without_android_oreo_vulnerable_to_overlay_attack/