STE WILLIAMS

News in brief: micro robots heal mice; Scottish Parliament hacked; Google Allo on desktops

Your daily round-up of some of the other stories in the news

Micro robots heal infections in mice

Micro robots could soon be used to administer drugs to fight diseases.

Researchers at the University of California San Diego have been using micromotors, the width of a human hair, to treat stomach infections in mice.

For five days the team used bubbles to drive doses of antibiotics into the stomach walls. They discovered that the method was more successful than regular doses, which can be demolished by the body before they can treat the disease.

The minute robot comprises of a spherical core of magnesium, covered in several layers for protection, treatment and to allow it to stick to the stomach walls. Once a robot is swallowed, the magnesium and stomach acids react to create hydrogen bubbles that force the motors around.

The process encourages acidity levels to be temporarily reduced. The micromotor responds to the surrounding acidity, releasing the antibiotics when the levels lower.

Just 24 hours after, acidity levels were back to normal and the robots dissolved in the stomachs of the mice.

Scottish Parliament hit by “brute force” attack

The Scottish Parliament’s IT systems have been hit by a “brute force” cyberattack, reports The Guardian.

In an internal statement, Chief executive Sir Paul Grice confirmed that the attack “from external sources” was similar to the email attacks on Westminster back in June.

Mr Grice warned that “Symptoms of the attack include account lockouts or failed log-ins” and urged parliamentary staff to be cautious and secure their accounts with stronger passwords. And, as an additional security measure, the parliament’s IT department would “force a change to weak passwords”.

He wrote:

The parliament’s robust cybersecurity measures identified this attack at an early stage and the additional security measures which we have in readiness for such situations have already been invoked. Our IT systems remain fully operational.

Google Allo now on desktops, but only for some

A year since its release, Google Allo is no longer confined to just iPhone and Android devices.

Google’s messenger service is now available on desktops via a web browser, reports Ars Technica. But, it’s currently only available for Android users, with iPhone support marked as “coming soon”, and it’s only supported by Google Chrome.

The setup for accessing Allo on a desktop requires users to scan a QR code, using the Allo mobile app, to link it to the web client. Once this is completed the web version acts like a mirror of the mobile device.

With its slow development, Google taking a step back on its privacy promise and fierce competition from the likes of Whatsapp and Facebook messenger will this feature be enough to give Allo the boost it needs to win over users?

Catch up with all of today’s stories on Naked Security

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/DqYUtHegW7o/

Disgraced US Secret Service agent coughs to second Bitcoin heist

An ex-Secret Service agent who stole Bitcoins from the Silk Road dark web drugs bazaar he was supposed to be investigating has admitted stealing even more sacks of the digital currency.

Shaun Bridges, who is already serving a six-year sentence for nicking Bitcoins from the underground souk, pleaded guilty on Tuesday to stealing a further 1,600 Bitcoin (worth $359,005 at the time and approximately $6.6m today) during a separate investigation.

According to court documents [PDF] Bridges, 35, was probing European Bitcoin trading firm Bitstamp, which led to the US government seizing 1,606,6488 BTC in November 2014. These were transferred into a digital wallet that only Bridges had the access code for.

In March 2015, while under investigation for the Silk Road thefts, Bridges resigned from the Secret Service and in June pleaded guilty to money laundering and obstruction charges. A month later, while still free and awaiting sentencing, he took the Bitcoins seized from Bitstamp and moved them into an account run by the BTC-E exchange.

Over the next four months Bridges shifted small amounts of Bitcoin into various different digital wallets for his use – prison commissaries can be expensive places. However, these movements were traced by Uncle Sam’s g-men and agents sized 600 of the Bitcoin.

Bridges, of of Laurel, Maryland, has now returned the rest of the Bitstamp dosh as part of agreeing to plead guilty to one count of money laundering in the US District Court of the Northern District of California. He faces sentencing in November and can expect an extension to his stretch in the cooler. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/08/16/secret_service_shaun_bridges_agent_bitcoin_theft/

NotPetya ransomware attack cost us $300m – shipping giant Maersk

The world’s largest container shipping biz has revealed the losses it suffered after getting hit by the NotPetya ransomware outbreak, and the results aren’t pretty.

The malware surfaced in Ukraine in June after being spread by a malicious update to MeDoc, the country’s most popular accounting software. Maesk picked up an infection that hooked into its global network and shut down the shipping company, forcing it to halt operations at 76 port terminals around the world.

“In the last week of the quarter we were hit by a cyber-attack, which mainly impacted Maersk Line, APM Terminals and Damco,” CEO Soren Skou said in a statement today.

“Business volumes were negatively affected for a couple of weeks in July and as a consequence, our Q3 results will be impacted. We expect that the cyber-attack will impact results negatively by USD 200-300m.”

Admittedly Maersk is massive – it’s responsible for around 15 per cent of the world’s entire shipping network – but that kind of financial damage is close to a record for such an attack. Then again, the company’s entire network was down for days, Skou told the Financial Times.

“It was frankly quite a shocking experience,” said Skou. “Your email goes down, all your address system. We ended up having to use WhatsApp on our private phones. Most business problems, you will have an intuitive idea on what to do. But with this and my skills, I had no intuitive idea on how to move forward.”

Skou said that he decided to take personal charge of the situation, sitting in on IT meetings and getting daily updates on the malware’s progress. He says he learned that there was nothing that could have been done to stop the attack, but he wants to strengthen the company’s systems against further attacks.

Maersk wasn’t the only multinational to be hit by NotPetya. WPP, the world’s largest advertising agency, also took a major hit, as did deliveries firm TNT. While the latter biz hasn’t responded to requests for comment it’s understood to have taken weeks to sort out its infection with a permanent loss of data. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/08/16/notpetya_ransomware_attack_cost_us_300m_says_shipping_giant_maersk/

Toronto woman joins the fight against creepshot image sites

There’s a Toronto woman named Roxanne who has an on-again, off-again hobby. For the past four years, she’s spent her time reaching out to those whose photos, some explicit, she’s found on a site dedicated to titillating men by, among other things, humiliating women by posting their stolen images and personal details.

As CTV News Canada tells it, Roxanne (who prefers not to use her full name, given concerns about her activities affecting her career in social work) learned that her own photos had cropped up on the image-sharing site Anon-IB.

People can post images anonymously on Anon-IB. In fact, its tagline boasts that it’s the “Best Anonymous Image Board”.

Yes, it’s sort of anonymous, but only in a lopsided way. As in, the people who post photos, many of them stolen or taken with hidden cameras, can do so anonymously. It’s certainly not anonymous for the women in the photos, though. They have no say when it comes to keeping their personal information off the site. Hell, nobody asked them if they wanted their photos posted in the first place.

Because the women in the photos are denied the luxury of anonymity, Roxanne is able to search for, contact, and warn them that their photos and personal information are on Anon-IB. To find the women in the photos, Roxanne uses information she gets from Anon-IB – their first names, the first letter of their last names, and the communities they’re believed to live in – to search for them on Facebook. In fact, the site lets users search for images by US state or by country. There are also pages dedicated to specific universities, and users often request highly specific nudes: “Hamilton hoes”, “Nanaimo Thread!”, “Markham wins”, or topless photos from a BC music festival called Shambhala or from a nudist beach in Vancouver that has a no-photos policy.

Roxanne has to admit, searching for them like this makes her feel like a bit of a creep. But at least she’s got their best interest at heart. Best to know how easily you can be found, she figures, before stalkers find you:

If I can track them down this easily, somebody with a worse motive can too.

The site caters to the typical hodgepodge of fetishes, but as you can see in its category list, it has no qualms about letting users post photos that they’ve captured via photo-stalking – be it through surveillance videos, downblousing, or upskirting:

Plus, in spite of a ban on photos of the under-aged, there appear to be photos of children on the site, Roxanne notes.

Roxanne’s photos – in them, she was wearing underwear and a crop top – had been socially engineered out of her by somebody wielding a fake Facebook profile. The person had claimed to be a queer feminist, survivor of sexual violence and women’s studies student called Mary.

A few years after Roxanne shared her photos and grown suspicious of “Mary’s” increasing demands for more explicit images, the photos were posted to a sub-forum on Anon-IB titled “wins”. That’s slang for nude photos. She found out about it when a friend gave her a heads-up.

How is it that a site like this hasn’t been shuttered? As it is, the site prohibits the posting of images of minors and bans posting “personal details like addresses, telephone numbers, social networks links, or last names”. But as CTV News found, users pull a run-around by posting messages that contain the women’s first names, plus the first letters of their last names, plus what word their last names rhyme with. As in,

[First name], L., anyone? Surname rhymes with mammoth.

It isn’t as if law enforcement hasn’t managed to shut down other creep sites. Hunter Moore got more than two years in prison for his revenge porn activities. A henchman who stole photos to sell to Moore got two years himself.

But when Roxanne approached the police about her own photos, the officer “just looked bewildered,” she said. According to CTV News, York regional police said they’re aware of Roxanne’s case, that the force is still investigating, but that there have been no charges filed. Other Canadian police forces have investigated occasional complaints about the site, but likewise, no charges have been made by either the Royal Canadian Mounted Police (RCMP) in Antigonish, Nova Scotia, or by police in Peterborough, Ontario.

Of course, it’s pretty tough to complain about a site if you’re not even aware that your photos are posted on it. And it’s not uncommon for police to look baffled at the notion of prosecuting such a site. Revenge porn laws, where they exist at all, have only been added in recent years.

Canadians are protected under the Protecting Canadians from Online Crime Act, which makes it a crime to post or distribute an “intimate image” of another person without their consent. Whether the officer Roxanne was speaking to even knew about that law is an open question. At any rate, given that she was wearing her underwear, the photos wouldn’t be considered explicitly sexual, a lawyer told CTV News.

A Toronto-based lawyer, Jordan Donich of Donich Law, told VICE that these sites have been around for a long time. The current domain for Anon-IB was registered to a “private person” in 2015, though it was up for several years before that and went offline briefly in 2014. When it reported on the site last week, Vice noted the domain ended in “.ru.” As of Saturday, however, it ended in “.la,” the top-level domain for Laos.

The shell game of hosting such a site offshore, be it from Russia, Laos or elsewhere, makes it tough to investigate and prosecute the administrators, Donich said:

The people who organize these communities set up hubs in other jurisdictions, so Canadian law isn’t even applicable or enforceable a lot of times.

Roxanne had sent requests to take down the photos, but they were ignored. For whatever reason, after that lull in 2014, they weren’t reposted.

What can be done about sites victimizing women with stolen photos? For one thing, we can stop the photos from being taken or shared in the first place. These steps can help to protect your images:

  • Don’t click on links in email and thus get your login credentials phished away.
  • Use strong passwords.
  • Lock down privacy settings on social media (here’s how to do it on Facebook, for example).
  • Don’t friend people you haven’t met on Facebook, and don’t share photos with people you don’t know and trust. For that matter, be careful of those who you consider your “friends”. There are photos on Anon-IB posted by users who say they’ve been taken from Instagram feeds of “a friend”.
  • Use multifactor authentication (MFA) whenever possible. MFA means you need a one-time login code, as well as your username and password, every time you log in. That’s one more thing the scumbags need to figure out every time they try to phish you.

So there’s that. That’s what’s we do all the time: we put the onus on women. We tell victims how to not be victims. It’s good advice, for any gender, to avoid having images stolen and accounts compromised. But it sure doesn’t help when photos are taken surreptitiously, without permission.

Like, say, when male Marines, Navy corpsman and British Royal Marines put up a private Facebook group – “Marines United” – to swap nude photos, some taken without their female colleagues’ knowledge.

Which brings us to putting onus where it belongs: on the creeps themselves.

Laws should help, but they often don’t. Beyond the difficulties in international investigations and prosecutions, in many places, laws haven’t even caught up with the age of mobile phones.

For example, it should be illegal for anybody to stick their camera-holding hand between women’s legs and take photos of their crotch/underwear/genitals without permission.

That’s commonly referred to as upskirting. It’s hard to imagine that such a harassing violation of privacy is legal anywhere, but it is. In the US, the legal situation is a patchwork of state laws: for example, upskirting was legal in Georgia until just a few months ago.

Upskirting is also perfectly legal in England. That will hopefully change soon: 25-year-old Gina Martin, a woman who was victimized last month at the BST Festival in London’s Hyde Park, has already garnered tens of thousands of signatures on a petition to make upskirting illegal.

I was targeted by a creep, who put his hand between my legs and took pictures of my crotch without me knowing. 📱😔 I gave the police the phone, the picture and the guy… and they closed my case. 🗄And told me that if I hadn’t been wearing knickers they might have been able to do more. 👗👚👙I started a petition to get him prosecuted and it now has 53,000 signatures. 👫👭👬Now, the fight has changed. I’m campaigning to get upskirting listed as a Sexual Offence and I need your help. 💭♥️ ✍🏽Sign the petition, share it with the women in your life and listen out, because soon i’m going to need your help to push our MP’s to make a change. 🤜🏼💥🤛🏽 Let’s do this, girls. 📣❤️ What you’re wearing should have nothing to do with how you’re treated. You are NOT the stylist of your own abuse. 😤🤛🏽 Link is in my bio. ☝🏻☝🏻☝🏻

A post shared by Gina Martin (@beaniegigi) on Aug 8, 2017 at 12:36pm PDT

And before anybody goes blaming women for not wearing knickers, or for wearing low-cut blouses, or any of that victim-blaming nonsense, bear in mind that these bozos will steal the most chaste of turtleneck/maxi-skirt photos and doctor them to appear as if the women are nude. It’s the people taking, creating and sharing the images who are to blame, not their victims.

That’s what happened to an underage girl who was tormented for months by an online sextortionist who stole iCloud backups of her perfectly innocent, fully clad dance videos, edited them to grab random shots – say, an elbow – and did a copy-paste job to make it look like they were nude videos.

(They got him. Or, rather, somebody arrested on suspicion of being behind the “Brian Kill” alias used by the sextortionist. The FBI used a booby-trapped video to do it.)

Similarly, an Anon-IB poster stole and doctored photos from one woman whom Roxanne managed to inform: “Katelyn”. Katelyn said her photos were taken from Facebook and from an online dating profile and edited to make her light-colored shirts appear see-through.

What lesson learned do we take away from that? “Don’t wear light-colored clothing?” Stay offline completely? Maintain a 10-mile no-camera/no mobile phones/no drones radius around our persons at all times?

Or do women have to mobilize, as have Roxanne and Gina Martin, to take it into their own hands when it comes to passing legislation and/or reaching out to inform the subjects whose images have been stolen?

Guys will be guys, they say. But police will be police, too. The best possible situation is when police know what’s legal and what’s not, make an effort to inform victims of obviously illegal photo-stealing, and make an effort to arrest the thieves.

In the past few years, the FBI infamously used a legally tainted tool to get to those who share illegal photos. I’m referring to the malware the FBI inflicted on 8,000 computers worldwide in the Playpen child abuse images investigation. The FBI was criticized for that.

The same technique – the FBI’s so-called Network Investigative Technique (NIT), also known as police malware  – can be used in a more targeted fashion, as it was in the “Brian Kil” investigation.

The investigative tools are there. Granted, in order to go after photo thieves, the victims first need to know that they’ve been victimized: tough to do when the posting is done anonymously.

Similarly, it was a former Marine who initially discovered the revenge porn site Marines United, monitored it, and spent more than a month, near-daily, reporting offending images and groups. Another former Marine, Erin Kirk-Cuomo, runs a Facebook group Not in My Marine Corps as a support network for women affected by Marines United.

It’s not just down to ordinary people: technology such as facial recognition can be put to work. It’s facial recognition that’s being used in the sprawling Marines United revenge porn investigation, which had led to 21 felony cases as of May.

More than a dozen military members, mostly women, have asked the task force whether any of their intimate photos wound up on what are largely private sites without their consent. Facial recognition had helped match up four potential victims as of May, one of whom confirmed that a photo was of her, and another three that were still getting checked out at that time.

The laws are slowly, stutteringly coming on to the books. The technical tools are out there. Let’s hope they’re slowly putting an end to sites such as Anon-IB and others like it.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/coZzx8Q7zDM/

Bot armies of fake followers are the footsoldiers of fake news

We’ve been hearing for some time now that fake news is real – as in, it exists. A lot of it. We’ve also been hearing that one of the major ways it spreads is fake – through bots, not humans.

And now comes a team of researchers from Indiana University who say they have the data to confirm it. In a paper titled “The Spread of Fake News by Social Bots,” they reported that an analysis of 14m social media messages regarding 400,000 claims on Twitter during and following the 2016 US presidential campaign and election provided, “evidence that social bots play a key role in the spread of fake news. Accounts that actively spread misinformation are significantly more likely to be bots”.

Propaganda is nothing new, of course. It has always been a reality of human societies, especially when it comes to politics. What makes things different now is scale and distribution – it is disseminated not as much by word of mouth, speeches and traditional media outlets but by an army of bots that can amplify fraudulent stories in seconds, pushing out millions of tweets or posts on other social media platforms before the fact-checkers even get in gear.

The researchers said several fact-check sites list 122 websites that “routinely” publish fake news, which then gets picked up and amplified by the bots.

The bot accounts are, of course, designed to trick other users into thinking they are real people expressing opinions or promoting agendas. The scale and reach of bots has also been growing – no surprise, since it doesn’t take much time or money to unleash them. They’ve been around for several election cycles.

Gawker reported back in 2011 that up to 80% of then Republican presidential hopeful Newt Gingrich’s alleged 1.3m Twitter followers were fake – generated by agencies Gingrich hired to boost the number.

Trump himself claims to have 100m social media followers, including about 32.4m on Twitter alone. But most estimates have concluded that about a third of his Twitter audience – 11.6m – are bots.

Which doesn’t make the president an outlier. Every celebrity has fake followers – some of them in the millions. A couple of years ago, singer Katy Perry supposedly had 64m Twitter followers – of which a TwitterAudit sample report said 65% were fake.

Twitter itself is a participant in the inflation game. Naked Security reported in March that the company’s own estimate that up to 8.5% of its accounts are managed by bots was low – seriously low. It cited a UK Sunday Times report that, “up to 48m – or 15% – of the social media giant’s 319m users were in fact bots”.

Perhaps the only thing reality has going for it is that when it comes to fake news, bots are less and less under the mainstream radar. They are now very big news, which has to be good for public awareness and good timing for the paper’s authors: Chengcheng Shao, Giovanni Luca Ciampaglia, Onur Varol, Alessandro Flammini and Filippo Menczer.

Last week, on the day that the MIT Technology Review published a review of their work, the Washington Post also carried a story about a Nicole Mincey, a “super fan” of President Donald Trump, is likely a fake. Twitter suspended the account after other users complained.

The Post cited experts who said the account “bears a lot of signs of a Russia-backed disinformation campaign”. They included Clint Watts, a former FBI agent and fellow at the Foreign Policy Research Institute who is the creator of Hamilton 68, a dashboard tracking Russian propaganda on Twitter.

This, of course, was after the president had tweeted his praise of “her” to his 32.4m (minus 11.6m) followers.

Shortly after, the syndicated National Public Radio political talk show “On Point” did an hour on the topic.

According to the researchers, some small comfort may be that the use of bots is bipartisan. “Successful sources of fake news in the US, including those on both ends of the political spectrum, are heavily supported by social bots,” they wrote. They also listed “manipulation strategies” that the bots use to be more effective in influencing public opinion:

First, bots are particularly active in amplifying fake news in the very early spreading moments, before a claim goes viral.

Second, bots target influential users through replies and mentions.

Finally, bots may disguise their geographic locations. People are vulnerable to these kinds of manipulation, retweeting bots who post false news just as much as other humans.

And they said other platforms – Facebook, Instagram, Snapchat and others – can be just as easily manipulated “automatically and anonymously”.

What to do? The researchers offered a couple of suggestions, but acknowledge that those have limits. One is to create, “partnerships between social media platforms and academic research. For example, our lab and others are developing machine-learning algorithms to detect social bots.”

That, however, can be “fraught with peril,” since algorithms are not perfect. “Even a single false-positive error leading to the suspension of a legitimate account may foster valid concerns about censorship,” they wrote.

Another is to use CAPTCHAs – challenge-response tests – to determine if a user is human. They has been effective in curbing spam and other online abuses, but they do add, as the researchers delicately put it, “undesirable friction” to legitimate uses of automation by organizations like the press or emergency response systems, saying:

These are hard trade-offs that must be studied carefully as we contemplate ways to address the fake news epidemics.

Indeed. If you’ve got better ideas, feel free to share them in the comments section.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/2XKaSKEFjLw/

Who will own the data from your autonomous car?

Who owns your car?

Assuming it’s paid off, you might think you do. It’s your responsibility to maintain it. If something breaks, you have to pay to fix it. If you hit somebody or something with it, you’re liable for the damage.

But the data you generate in your autonomous car of the future? Apparently not so much. If you expect the US Congress to protect your personal privacy, including ownership and control of those data, as the nation moves into the era of autonomous vehicles (AV), you need to temper your expectations.

Legislation is in the works in both houses of Congress to regulate AVs, although the House is ahead of the Senate – the Committee on Energy and Commerce released the text a couple of weeks ago of a proposed bill titled the SELF DRIVE Act.

Yes, that’s an acronym. As is regularly the case, legislators craft a tortured phrase to yield an acronym that is easy to remember. This one’s complete name is the “Safely Ensuring Lives Future Deployment and Research in Vehicle Evolution Act”. Try remembering that.

The bill does have an entire section on privacy, even though that didn’t make it into the title. But, as privacy advocates note, while it requires manufacturers to develop a privacy plan that spells out to consumers what is collected, used, shared and stored, and also tells them what choices they have regarding those practices, there is nothing in the bill that says who owns the data, and how owners can access or delete it.

In response, the Electronic Privacy Information Center (EPIC) issued a statement arguing that, as they had recommended in testimony while the bill was being drafted, “consumers (should) control the personal information that is created and stored by the vehicles they operate, rent, and own”.

Based on support for the bill, EPIC and other advocates have an uphill climb. It was reported out of committee on a unanimous (54-0) vote.

The major focus of the bill is to create “a regulatory structure that allows for industry to safely innovate with significant government oversight,” according to committee chairman Greg Walden (R-Ore.).

It also includes a section on cybersecurity, but the language is not terribly reassuring there either, when it comes to vehicles moving at 65mph (105kph) miles per hour or more. It requires only that manufacturers have cybersecurity practices that will guard against “reasonably foreseeable” risks. Try getting agreement on that in a courtroom.

Besides the lack of anything explicit about who owns the data generated by the vehicle, EPIC also objected, in a letter to the committee in June, to a provision that forbids states, “from issuing any rule, regulation, or law that is not identical to a previously issued Federal Motor Vehicle Safety Standard (FMVSS) issued by NHTSA (National Highway Transportation Safety Administration), including in the areas of software and communications systems”.

While EPIC agrees there may be a need for national uniformity on vehicle design and mechanics, the software and communication regulation will “prevent states from developing innovative privacy safeguards. This stands in contravention to the historic role that states have played in the privacy arena,” EPIC said

The organization called for the creation of an “Automated Driving System Cybersecurity Advisory Council that will include members from “privacy and consumer organizations” outside government and industry.

None of those objections or recommendations are addressed in the current language of the bill. And Walden’s office did not respond to several requests for comment.

All of which will leave AV users exposed – both to physical and privacy risks – according to critics. Susan Grant, director of Consumer Protection and Privacy at the Consumer Federation of America, agrees with EPIC that the bill doesn’t give consumers “any privacy rights or control” over the personal data that will be collected.  She added:

Even worse, it gives neither the Department of Transportation or the Federal Trade Commission any rulemaking authority in that regard.

Autonomous cars are computers on wheels, raising all the same concerns about online privacy and security. The committee should go back to the drawing board to craft better legislation to address those concerns.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/90b6BP2_jdk/

Och. Scottish Parliament under siege from brute-force cyber attack

Hackers are trying to break into Scottish Parliament email accounts weeks after similar campaigns against Westminster.

MSPs and Holyrood staff were warned on Tuesday that as-yet unidentified hackers were running “brute-force” attacks on systems in the devolved assembly, The Guardian reports. Similar attacks on Westminster back in June, subsequently blamed on Russia by intel sources, led to the compromise of 90 accounts.

In an internal bulletin Sir Paul Grice, Holyrood’s chief executive, warned: “The parliament’s monitoring systems have identified that we are currently the subject of a brute-force cyber attack from external sources.

“This attack appears to be targeting parliamentary IT accounts in a similar way to that which affected the Westminster parliament in June. Symptoms of the attack include account lockouts or failed logins.

“The parliament’s robust cybersecurity measures identified this attack at an early stage and the additional security measures which we have in readiness for such situations have already been invoked. Our IT systems remain fully operational.”

Legislators and support staff have been advised to update their passwords with longer and stronger combinations of letters, numbers and special characters in response.

Left unexplained is why staffers are able to set substandard passwords and whether two factor authentication (2FA) technology – a well-established defence against exactly this type of malfeasance – is supported. ®

Updated at 14:53 UTC to add: El Reg has seen an update issued to all MSPs and staff at Holyrood that explains: “

  • the cyber-attack remains ongoing
  • there is no evidence to suggest that the attack has breached our defences
  • our IT systems continue to be fully operational.”

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/08/16/scottish_parliament_cyberattack/

She’s arrived! HMS Queen Lizzie enters Portsmouth Naval Base

Pics Britain’s newest warship, its biggest warship of all time, HMS Queen Elizabeth, entered Portsmouth Harbour for the first time this morning.

The 65,000-tonne aircraft carrier entered the port at 0710 this morning under the watchful eye of half a dozen tugboats, a small flotilla of police vessels – and crowds of thousands lining the sea front along Portsmouth and Southsea.

In addition, scores of smaller civil vessels accompanied the carrier at a respectful distance. A flypast of Royal Navy helicopters and fast jets – Hawk training aircraft – also took place as the carrier made her stately way towards the naval base.

Royal Navy aircraft fly over HMS Queen Elizabeth as she enters Portsmouth Harbour. Pic: Gareth Corfield

Royal Navy aircraft fly over HMS Queen Elizabeth as she enters Portsmouth Harbour. Click to enlarge

Admiral Lord West, the former head of the navy and now a Labour Party peer, told The Register as the ship came in: “This is a very joyous day. She looks splendid. We had lost sight of our maritime capability. This is something very special for Portsmouth and the Navy.”

When asked if the Queen Elizabeth-class carriers were necessary, the admiral said: “The one thing you can’t guarantee is what will happen tomorrow. When they’ve got their fixed wing assets, they’ll be one of the only capabilities [the UK has that will have] a strategic impact. It’s 4.5 acres of British sovereign territory.”

HMS Queen Elizabeth arrives in Portsmouth

Crowds gathered to greet the warship. Pic courtesy Reg reader

The £3.5bn carrier, and her £3bn sister ship, HMS Prince of Wales, will both be based at Portsmouth. Each ship will take it in turns as the on-duty vessel.

Lieutenant Commander Neil Twigg, a Royal Navy pilot who flew Harriers from the UK’s last carrier, HMS Illustrious, and who had completed a three year exchange with the US Navy, flying F/A-18s, described the task of integrating the new carriers, their F-35B Lightning fighter jets and their Merlin helicopters as “quite a challenge”, adding: “Once we see the jets arrive on board next year, it’ll be able to operate seamlessly.”

The forward (navigation) island aboard HMS Queen Elizabeth. Pic: Gareth Corfield

The forward (navigation) island aboard HMS Queen Elizabeth

According to Lt Cdr Twigg, the carrier’s operational practices will be a blend of American and British drills, drawing on British experience with the Harrier jump-jet and current US operational doctrine.

HMS Queen Elizabeth has no catapults or traps for launching and landing fixed-wing aircraft, unlike US Navy ships.

Instead, her F-35B jets are so-called Short Takeoff and Vertical Landing (STOVL) aircraft, using the vertical lift fan mounted in the airframe to provide vertical lift and so shorten the takeoff run. Routine landings aboard ship will be vertical.

After the ship had entered the harbour and safely berthed alongside at Portsmouth Naval Base, Admiral Sir Philip Jones, the First Sea Lord, made a speech.

The professional head of the Royal Navy welcomed the ship, her crew, and the hundreds of engineering contractors aboard her from the Aircraft Carrier Alliance.

He also thanked the US Navy, US Marine Corps and the French Navy for helping sustain Britain’s “seedcorn” of experienced carrier personnel.

Admiral Sir Philip Jones, First Sea Lord, gives a speech in front of HMS Queen Elizabeth in Portsmouth. Pic: Gareth Corfield

Admiral Sir Philip Jones, First Sea Lord, gives a speech in front of HMS Queen Elizabeth in Portsmouth

“She will be the embodiment of Britain, in steel and in spirit” – Admiral Philip Jones RN

Wing Commander Reg Roberts, the sole Royal Air Force officer currently attached to Navy Command HQ, told us that the new technology aboard the two carriers is intended to future-proof her: “It’s a bit like your iPad. You don’t know what you’ll be using it for in two years’ time. Combined with the F-35… her future uses will be exploited to the full.”

Although today is a proud day for the Armed Forces, Portsmouth and British engineering, it is important not to lose sight of the bigger picture. While the carrier herself is a floating monument to what British industry can do when the money and the will are both available – Capita, for example, installed 14,000 IP connection points aboard the ship as well as the main round-the-ship fibre optic network – finding the manpower for the 700 or so permanent crew of each ship has stretched the Navy considerably.

White-suited engineers from the Aircraft Carrier Alliance pictured on HMS Queen Elizabeth's starboard lift

White-suited engineers from the Aircraft Carrier Alliance pictured on HMS Queen Elizabeth’s starboard lift. The effort to build the two carriers created, directly and indirectly, around 10,000 jobs around the UK

In addition, planned buys of other ships have been cut back, most notably the halving of the Type 45 air defence destroyer order from 12 to six ships, and the one-third cut in future Type 26 anti-submarine frigate orders.

While capable, Big Lizzie, as her crew have reportedly nicknamed their ship, will never operate alone. Time will tell whether the effort of putting her and her sister ship to sea will tip the fleet out of balance. ®

Biggreyboatnote

The UK Hydrographic Office used the smallest commissioned “ship” in the Navy, Her Majesty’s Survey Motor Launch Gleaner, to precisely map the channel which the carrier must follow into and out of the harbour so her 11 metre draft doesn’t foul the sea bed. The video below is a visualisation of the survey results.

Youtube Video

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/08/16/shes_arrived_hms_queen_lizzie_enters_portsmouth_naval_base/

HBO Game Of Thrones leak: Four ‘techies’ arrested in India

Four arrests connected with the leak of an unaired Game of Thrones episode have been made in India.

Star India Private Limited, a HBO distribution partner owned by 21st Century Fox, said on Tuesday that local police had arrested four workers associated with its technology vendor, Prime Focus Technologies, apparently in connection the GoT leak.

A stolen episode from the current seventh series of the hugely popular show leaked online on 4 August, three days before its official worldwide debut.

“This is the first time in the history of Star India that an incident of this nature has occurred. We are deeply grateful to the police for their swift and prompt action,” the media firm said. “We believe that valuable intellectual property is a critical part of the development of the creative industry and strict enforcement of the law is essential to protecting it.

“We at Star India Novi Digital Entertainment Private Limited stand committed  ready to help the law enforcement agencies with any technical assistance and help they may require in taking the investigation to its logical conclusion,” it added.

HBO last month confirmed that it had suffered a cyberattack that may have compromised a Game of Thrones script and other programming materials. However, the leak of the fourth episode online was not part of that hack and related to a separate incident focused on India.

In an earlier statement released in the immediate wake of the leak, Star India said: “We take this breach very seriously and have immediately initiated forensic investigations at our and the technology partner’s end to swiftly determine the cause. This is a grave issue and we are taking appropriate legal remedial action.”

The Indian Express reports that three of the four people arrested worked for Prime Focus Technologies, which hosts episodes offered through Star India’s streaming service Hotstar. The fourth suspect is a former worker at the firm.

All four suspects have been remanded in police custody until 21 August, Indian Express adds. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/08/16/got_leak_arrests/

Months after breach at the ‘UnBank’ Ffrees, customers complain: No one told us

Customers of UK financial services firm FFrees said they were unaware of a breach that took place there four months ago until a security researcher got in touch with them.

The same anonymous white hat who discovered the now infamous AA shop accessories breach back in April also uncovered the exposure of data by Ffrees Family Finance, a Sheffield-based firm that offers a no-frills digital current account, at around the same time.

Obfuscated sample query of Ffrees leak dump. Note extent of info exposed (including the driver’s licence numbers) courtesy Troy Hunt

The leaked information, the researcher told us, included physical addresses; 94,574 unique email addresses; phone numbers; dates of birth; and driving licence numbers; as well as over 300k transaction logs. Passport numbers and their expiry dates have also been exposed. A small number of the records, around 95, appeared to relate to children.

The researcher said they’d contacted Ffrees immediately after coming across the data to tip it off about the problem. He followed up three months later in July, becoming concerned after his outfit failed to get a clear assurance from Ffrees that it had informed potentially affected parties. The researcher was told that “appropriate action has been taken”.

The white hat then enlisted the help of Troy Hunt, who runs the Have I Been Pwned? breach notification service, to assess the validity of the seemingly leaked data and exclude the possibility that it was dummy or test data.

Multiple Have I Been Pwned? subscribers confirmed their data including addresses, phone numbers, transactions and driver’s licence number were inside the leaked information, yet, curiously, none of those people reported having received breach notifications from Ffrees.

While Ffrees did post information on the breach, notifications to some of the people affected by the incident and an FAQ section on its website that repeatedly brought up the idea that ID theft was a possibility due to exposure of users’ “personal data”, it omitted any specific mention of the possibility that passport or driving licence data or transaction records might have been exposed.

The notice on its site reads:

The exposure involved information held by Ffrees between 2012 and early 2014. It included personal information and Ffrees account information for some accounts. A batch of Ffrees account passwords stored in an encrypted form were also accessed.

The financial service also appears to have notified some of the affected users, although the users Hunt contacted maintain they were not contacted.

“Multiple HIBP subscribers found themselves in there and had no idea why they were in a Ffrees data breach,” Hunt told El Reg.

Full programme of customer notification

In response to queries from El Reg, Alex Letts, chief exec of Ffrees Family Finance, said:

“There was an incident of data exposure which was reported to us. It was fixed straight away and we are grateful that we were informed about it.

“There has been a full programme of customer notification with dedicated support line and apology made; we reported the incident to the relevant authorities too, as we have to.

“We worked hard to remedy the problem and continue to monitor accounts for signs of suspicious activity.”

Data privacy watchdogs at the Information Commissioner’s Office (ICO) confirmed they had been notified. “We are aware of an incident involving Ffrees Family Finance Ltd and are looking into the details.”

“All organisations have a duty under the Data Protection Act to keep people’s personal information safe and secure,” the ICO spokesman added.

The breach at Ffrees received little coverage aside from a report on a legal website in mid-June. That report omits any mention of the passport and driving licence numbers and expiry dates security researchers say were exposed, although it does mention that transaction details were exposed.

What are organisations obliged to report?

The upcoming General Data Protection Regulation (GDPR) will require that:

Businesses must notify the ICO within 72 hours of a data breach taking place, if the breach risks the rights and freedoms of an individual. In cases where there is a high risk, businesses must notify the individuals affected.

It’s worth noting, however, that under current legislation, the Data Protection Act of 1998 (DPA) data controllers are not obliged to report the scope of security breaches, or the breaches themselves, to the data subjects.

Ffrees’ Letts declined to respond to a request from El Reg to clarify the scope of compromised information. As we stated previously, it does appear to have sent out a breach notice to some of the affected customers and provided an FAQ on its website.

A copy of a breach notification from Ffrees that one customer had received was posted to a forum on personal finance website Money Saving Expert in May.

However, there was no mention that passport or driving licence data or transaction records might have been exposed in the notice, which referred only to “information held for marketing purposes between 2012 and early 2014”. This, the notice added, included users’ full names, dates of birth and email addresses.

In the dark

Hunt put us in touch with a number of HIBP? subscribers affected by the breach who said that they hadn’t heard anything from Ffrees.

Daniel B, a Ffrees customer for around three or four years, confirmed his driving licence details had been exposed.

“My driver’s licence was exposed on the internet and I was not contacted by FFrees themselves; I was only made aware [of] the situation by Troy [Hunt] because he contacted me with partial data that he had been sent regarding the breach – and it indeed was my personal data,” he told El Reg.

The personal details of Michael W, who had signed up through a restaurant booking website to the OscarUK service, which was later bought by Ffrees, were also exposed, he confirmed. Ffrees acquired Oscar (OscarUK.co.uk), a leading concessions website for the over-50s, back in 2013.

“I was somewhat upset to find out the my full name, date of birth, address, maybe password of the time and booking detail (only used once!) has suddenly been released for anybody with knowledge to view,” he said. “I have had no contact about this so-called breach or how it was allowed to occur, nor understand what is being done to protect me.”

Independent security consultant Scott Helme said he had serious concerns after reviewing the data.

“It seems there are many or possibly even tens of thousands of valid sets of credentials [that are] able to log in on this payment gateway,” Helme told El Reg. “There was some data related to children as young as five at the time of the breach and personal notes on accounts like the reasons they opened them including weddings, holidays, life savings and money for children. It was pretty grim reading for some of them.”

Ffrees provides customers with a “virtual account” with MasterCard. Users transfer money to accounts linked to a “pre-paid card”. They earn financial rewards for using this card to buy products and services from Ffrees’ partners.

The firm declined multiple requests from El Reg to share the timing and content of the breach notification it sent to affected customers.

Under current UK law there is no legal obligation to notify customers about the suspected leak of financial information, something that will change next May once the UK’s Data Protection Bill (which will incorporate EU General Data Protection Regulation legislation) comes into effect, as previously noted in the case of the recent AA accessories shop breach.

A data protection Bill incorporating the EU General Data Protection Regulation (which comes into force in May 2018) is expected to be introduced in Parliament after summer recess. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/08/16/ffrees_breach/