hacking – Page 1171 – STE WILLIAMS

‘Cyber vulnerabilities’ prompt US Army to ban ‘all use’ of DJI drones

library
crime | hacking | security

The US Army appears to have issued a global order banning its units from using drones made by Chinese firm DJI, citing “cyber vulnerabilities”.

The memorandum, apparently issued by the US Army’s Lieutenant General Joseph Anderson, orders all US Army units with DJI products to immediately stop using them.

“Due to increased awareness of cyber vulnerabilities associated with DJI products, it is directed that the US Army halt use of all DJI products,” the memo read.

In the memo, soldiers are also ordered to remove all batteries and storage media from their DJI drones and await further instructions.

DJI told The Register: “We are surprised and disappointed to read reports of the US Army’s unprompted restriction on DJI drones as we were not consulted during their decision. We are happy to work directly with any organization, including the US Army, that has concerns about our management of cyber issues.”

The firm’s spokesman added: “We’ll be reaching out to the US Army to confirm the memo and to understand what is specifically meant by ‘cyber vulnerabilities’.”

Drone blog sUAS News posted the text of the memo earlier this morning, along with a screenshot of what it says is the original document. sUAS News’ Gary Mortimer vouched for the memo’s authenticity to El Reg but declined to say how it had found its way to him. We have contacted the US Army’s European press office and will update this article if we hear back from them.

Although there is room for doubt about the memo’s authenticity, rumours that such a move were on the cards have been swirling for a while.

Bad news for DJI – and for governmental users around the world

Security concerns have been looming over DJI – Da-Jiang Innovation Corporation – and its products for a while. The company’s background, as its full name suggests, is 100 per cent Chinese and it is headquartered in Shenzhen, south-east China.

In April 2016 news went round the world that DJI drones were quietly beaming data back to Chinese state authorities, via DJI’s proprietary controller app. That data included aircraft telemetry and GPS location data.

All new users of DJI drones must register with the company, meaning it is trivial for it to identify users and what their likely uses of the drones are. The company appears to be co-operating with the US government already, judging by its imposition of no-fly zones in Iraq and Syria during a US-backed military offensive. Irritated hackers later modified DJI’s firmware to allow flights outside of these no-fly zones, bypassing software-imposed performance limitations.

That the US Army would ban use of all DJI products across its 1.4 million personnel is surprising. More or less all modern consumer-grade technology is insecure, to a lesser or greater extent. Nonetheless, ease of use, a relatively low price point (something DJI prides itself on, to the point that nascent US rival 3D Robotics found itself unable to compete with DJI in the drone hardware market) and availability tends to trump security concerns.

This happens in particular at cash-strapped state agencies looking for a cheap and easy way to replace expensive capabilities – such as Devon and Cornwall Police raising a drone surveillance unit as an alternative to deploying the force helicopter at a cost of thousands of pounds. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/08/04/apparent_us_army_memo_bans_dji_drones/

Russian Botnet Creator Receives 46-Month Prison Sentence

library
crime | hacking | security

Federal court sentences the Ebury botnet creator and operator to prison for infecting tens of thousands of servers worldwide.

A federal court sentenced the Russian creator and operator of the Ebury botnet to a 46-month prison sentence and issued an order to have him deported after he’s released from prison, the US Department of Justice (DOJ) announced.

Maxim Senakh, 41, pleaded guilty March 28 to conspiracy to commit wire fraud and violate the Computer Fraud and Abuse Act.

Senakh and his co-conspirators created and operated a botnet using the Ebury malware, which harvests log-on credentials from infected servers. Senakh used the botnet for various spam attacks and click-through fraud schemes, according to the DOJ.

The botnet generated millions of dollars in revenue from the tens of thousands of infected servers around the world.

Are Third-Party Services Ready for the GDPR?

library
crime | hacking | security

Third-party scripts are likely to be a major stumbling block for companies seeking to be in compliance with the EU’s new privacy rules. Here’s a possible work-around.

Like a maelstrom on the horizon, GDPR — the European Union’s General Data Protection Regulation — is coming, and companies both inside and outside the EU are scrambling to comply with its many rules. Among those rules is a requirement for companies that have access to user data to protect it by any means necessary. If they don’t or can’t, they pay — in cash, with hefty fines imposed on companies that fail to fulfill their obligations. And the EU means business; it imposed a $2.7 billion fine on Google in June over what officials said was Google’s misuse of its data power.

Companies, of course, are doing everything they can to comply with the EU’s cybersecurity rules, including the implementation of collaboration and information-sharing between relevant institutions (government, banks, regulators) regarding attacks and defense systems, education efforts to ensure that employees don’t admit malware into the network, and appointing an officer who will be in charge of ensuring that user data remains safe. And the rules apply to all companies and organizations, anywhere, if an EU citizen can connect to their site.

Every company that does business on the Web is now busy ensuring that its security systems are up to the EU’s standards. But there are data issues beyond the control of any organization in the form of the data collected by third-party scripts, which are processed and stored in databases belonging to the third-party script provider. And organizations can’t do without these scripts; they provide the services that users have gotten used to and demand — such as social media, ecommerce, comment services, advertising, content distribution, site analytics, and much more — as part of their Web experience. Without these scripts, there basically is no World Wide Web as we know it, and without those services, the level of engagement on sites is likely to fall considerably.

The Security Factor
There’s no way of knowing how secure the scripts are. We know that there have been numerous examples of third-party scripts being taken over by cybercrooks to pull off some spectacular hacks. There was, for example, the Stegano exploit, which compromised the computers of millions of users around the world. Stegano, which has been around since at least 2014, came into new prominence last fall when it was used to cleverly hijack readers of “popular news sites,” according to ESET Research, which first published details of the exploit. Hackers used ad networks to distribute malicious scripts to run an exploit via an image’s invisible alpha channel (a layer of an image meant to store data but that has no visual representation in the image).

The exploit — which didn’t change the banner ad at all, making it almost impossible for a user to detect that anything was wrong — checked to see if any security software, sandboxes, etc., were present; if they were not, the exploit would redirect to a page that downloaded a payload and used regsvr32.exe or rundll32.exe to install it. The point of the exploit was to install malware that would steal user data from the webpage itself — login and password combinations or credit card numbers if they were entered into a box on the webpage — or to divert their clicks to other servers that served the needs of hackers or their clients.

In either case, the data of users was compromised — a sad story for them, and certainly a black mark on the news sites that were victimized — but under the new rules, sadness and loss of reputation are the least of the problems of the organizations whose sites were compromised. Had GDPR been in effect when the exploit was going full blast, the news sites would likely have been fined, if not prosecuted. That’s how tough the EU rules are, and nearly all sites that use third-party scripts are potential victims.

What can they do to protect themselves? First of all, sites have to even out the equation and find a way to take back control of their websites. In that sense, their experience is similar to administrators who run mail servers — and whose users are plagued with endless amounts of phishing emails that seek to tempt recipients to click on a rogue link or contaminated attachment. Despite the best efforts of administrators, who have tried lecturing, hectoring, threatening, and begging users not to click on suspicious-looking links and attachments, the problem gets worse every year, with more attacks and more opened messages leading to more successes for hackers.

If lecturing, hectoring, threatening, and begging don’t work, what will? One idea is separation — setting up a sort of sandbox between the mail server and the user’s inbox that can examine the contents of a message. If something appears suspicious, either in the attachment or the message itself, the message can be “cleansed” of bad elements, or dumped altogether. If it works for email — and, indeed, for any Web connection — why not for third-party scripts? With sandbox-type solutions, companies can regain control of their websites while retaining the third-party services their users demand. Sites would be able to protect themselves from the unknown threats presented by third-party scripts, ensuring that not only is user data protected but that organizations are protected from the threat of big EU fines and penalties if something goes wrong.

Related Content:

Hadar Blutrich is the CEO of Source Defense. He was formerly the Chief Solution Architect at LivePerson and has led projects with many industry giants, including Bank of America, Chase, and Verizon, among others. View Full Bio

Article source: https://www.darkreading.com/endpoint/privacy/are-third-party-services-ready-for-the-gdpr/a/d-id/1329497?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

What Women in Cybersecurity Really Think About their Careers

library
crime | hacking | security

New survey conducted by a female security pro of other female security pros dispels a few myths.

For once, some good news about women in the cybersecurity field: A new survey shows that despite the low number of them in the industry, many feel empowered in their jobs and consider themselves valuable members of the team.

The newly published “Women in Cybersecurity: A Progressive Movement” report – a survey of women by a woman – is the brainchild of security industry veteran Caroline Wong, vice president of security strategy at Cobalt who formerly worked at Cigital, Symantec, eBay, and Zynga.

Wong says she decided to conduct the survey after getting discouraged with all of the bad news about women being underrepresented, underpaid, and even harassed in the technology and cybersecurity fields. The number of women in the industry has basically plateaued at 11% over the past few years.

She says over the 12 years of her own career in the industry, she has met and worked with many successful women and decided it was time to get their insight firsthand. “These depressing stats [about the number of women in security] are very important to show, but the other side of the story is not coming to light,” Wong says.

“I’ve met and interacted with tons of women who are thriving in their careers and making a real difference in the world,” she says. “There are a lot more women in the industry than people even recognize.”

Wong says she focused on women as part of the diversity equation, mainly because she’s a woman and knows a lot of women in the industry. “It’s really an issue of diversity,” she says. “Women are a subset of the diversity situation.”

More than half of the female cybersecurity professionals in the survey have been in the industry for more than five years and more than a third, for more than 10 years. And when asked what excites them most about cybersecurity, 73% say solving complex problems; 65%, that it’s a growing field with lots of opportunity; 48%, new technology; 46%, future innovation; and 29%, legal and regulatory aspects.

Fewer than half came to security via IT or computer science. The rest came from backgrounds in compliance, psychology, internal audit, entrepreneurship, sales, and art. Ten percent say they joined the industry because they “like to break things.”

“Women in this field say it’s actually fun, and they’re having a good time. They are feeling they are doing meaningful and impactful work and it’s deeply satisfying to them,” says Wong, who also conducted deep-dive interviews with multiple women from the survey who were willing to be quoted in the final report. “You don’t necessarily have to have a computer science degree to contribute.”

Nearly three-quarters of them say the value they bring to cybersecurity is their ability to communicate well across cross-functional teams. Other values they cite: 70%, they get things done; 65%, they multitask well; 62%, they bring fresh insight; 55%, they think about the big picture; 54%, they use their intuition; 50%, they coordinate and supervise; 48%, their drive; 48%, their long-term view; and 41%, they create community. Around 30% say their value is their technical focus and skills.

“So many people naturally go to the threat, think about the threat, want to stop the threat. It’s sexy and adrenaline driven,” Michelle Valdez, senior director of enterprise cyber resilience at Capital One, told Wong in an interview for the report. “I’m the kind of person that takes a different approach. I prefer to look at a problem – what do we want to prevent, and what is the outcome we want. I work backwards from there.”

Wong says even the most technical women she interviewed for the report all value their long-term perspective of security issues. “They take this big-picture approach to solving problems in their work. That’s something that uniquely makes the women I spoke with very successful” in their roles, she says.

Chenxi Wang, founder of the Jane Bond Project and a veteran cybersecurity professional, says the survey shed a positive light on the female experience in the industry. “Many of us feel good about our jobs and the industry,” Wang says.

Wang, who read the report but did not take the survey, notes that the list of women who used their names in the survey represent many accomplished and successful industry veterans, which she says could account for the upbeat tone of the findings. “I don’t know how many junior-level women on this list took the survey … And when people put their names behind a survey, they tend to be a lot more positive” in their responses, she says.

On the flip side, more than half of the women in security say they wish they had more technical skills, and 43% struggle with their own expectations of their performance. “That’s a fairly common thing among women working in technical fields. Many of us have this desire to be so uber-technical. You have to be so good at what you do so that all of your male colleagues will listen to you,” Jane Bond Project’s Wang says. “I do that, too. Whenever I get into a new field [of security], I read technical manuals like crazy to get myself familiar with this new technology.”

Cobalt’s Wong says the goal of the survey is to provide hiring managers with female security pros’ perspectives on what they bring to the table, and to inspire young women to enter the field.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/careers-and-people/what-women-in-cybersecurity-really-think-about-their-careers/d/d-id/1329560?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

HBO Breach Did Not Compromise Full Email System: CEO

library
crime | hacking | security

HBO’s recent security breach likely did not compromise its entire email system as hacker(s) allegedly threaten to expose stolen data.

HBO CEO Richard Plepler does not believe the company’s entire email system was compromised in a recent large-scale security breach, CNN Tech reports. The company is investigating the breach with outside security firms and law enforcement to determine the extent of the attack and players involved.

The unknown hacker(s) behind the breach claim to possess 1.5 terabytes of data, the report continues. If true, this would make the HBO incident significantly bigger than the 2014 Sony hack in which attackers leaked 200GB of information.

HBO has confirmed few details on the breach. But Roderick Jones, security expert and founder of Rubica, theorizes the hack was possible because HBO stores its content using outdated technology. Windows in particular has been used among hackers, including those behind the Sony breach, to target the entertainment industry with cyberattacks.

“The WannaCry attack … That was targeted at an old Windows system,” says Jones in a statement to Digital Trends. “That has created a vulnerability for HBO. I would say that’s probably a certainty, because that’s where the weaknesses are.” Alternatively, Jones continues, hackers may have targeted individual employees to steal personal information.

The Hollywood Reporter obtained an email from the alleged hacker, who calls himself Kind Mr. Smith and claims he will release evidence of his access to HBO emails on Sunday. He also says the breach is “about money,” an indication he demanded ransom from the company.

Should IoT vendors be told what to do by the government? [VIDEO]

library
crime | hacking | security

Earlier this week we wrote about a law that the US Congress just proposed with the intriguing name of The Internet of Things (IoT) Cybersecurity Improvement Act.

It’s as though the US legislators have got together – this is a bipartisan Bill, backed by both sides – and said words to the effect of, “Far too many IoT vendors are taking the [ding] when it comes to security, so it’s time we gave them a kick up the [dong] to get their minds in gear.”

Even if you are generally an opponent of government intervention in IT and the internet, it’s hard not to have sympathy with that point of view.

Paul Ducklin talks you through the issues in this enjoyable short video:

(Can’t see the video directly above this line? Watch on Facebook instead.)

If you have any comments or questions, please leave them below for us to answer. (You may post anonymously.)

Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/-COZcCwzqvs/

To truly stay anonymous online, make sure your writing is as dull as the dullest conference call you can imagine

library
crime | hacking | security

To publish online and remain anonymous, boffins from Bulgaria and Qatar advise being mediocre. And if you can’t manage that on your own, they have a technique to make your prose less scintillating.

Distinctive writing tends to point to a specific author. That’s what stylometry, the study of linguistic patterns, aims to reveal.

Once the domain of literature professors and forensic experts, stylometry has become a competency of computers, which turn out to be adept at digesting text samples and analyzing them for specific characteristics.

Since 2011, at an annual conference called PAN, researchers have been assessing author identification techniques alongside author obfuscation techniques, an evaluation that echoes the back-and-forth pattern seen in cybersecurity research.

A handful of these number crunchers – Georgi Karadzhov, Tsvetomila Mihaylova, Yasen Kiprov, Georgi Georgiev , and Ivan Koychev from Sophia University and Preslav Nakov from Qatar Computing Research Institute – have released a paper describing improvements in techniques put forth last year to be presented at PAN @ CLEF 2017 in September.

People posting anonymously online expect to remain anonymous, but that’s generally unrealistic, the researchers observe, because there are so many ways to track users online. Even without obvious ways to link anonymous posts to data associated with a known user – IP addresses, user names, and the like – written text often contains clues to an author’s identity.

Countering stylometric analysis has its own set of challenges, however.

“Unlike authorship attribution or author profiling, this is not a simple text classification problem but rather a complex text generation task, where not only the author’s style has to be hidden, but the text needs to remain grammatically correct and the original meaning has to be preserved as much as possible,” the paper states.

The researchers note that techniques like cycling text through a series of machine translations, from one language to another and then back to the original, tends to produce nonsensical word salad. They’re not too keen on selective word substitution either.

The authors’ previous attempt to obscure the authorship of sample texts performed well in terms of safety – protecting the author from forensic analysis – but lagged in sensibility – not calling attention to itself as an attempt to conceal authorship.

One of the original passages:

I am proud. Though I carry my love with me to the tomb, he shall never, never know it.

PAN 2016 text:

myself ’m proud in them, and though myself carry my beloved with me to the tomb he shall ever ever know it.

As can be seen from the example above, last year’s transformation of stands out as odd.

The researchers’ revised approach reads better. This particular sample may only feature only minor variations on the original text, but if it can defy stylometric analysis, it has accomplished its job.

PAN 2017 text:

I’m proud of them; and though I carry my beloved with me to the tomb he shall ever ever know it.

The revised approach, which introduces a way to limit the magnitude of text changes, aims for more mediocrity. Described in more detail in the paper, the technique “pushed towards average values for some general stylometric characteristics, thus making these characteristics less discriminative.”

That is, the transformed text scores closer to the average score for metrics like number of nouns, punctuation to word ratios, and the like.

“Overall, we can conclude that our method with transformation magnitude is promising and performs well (better than the three systems that participated in the PAN-2016 Author Obfuscation task) in terms of sensibility and soundness,” they explain. “In future work, we need to study how it performs in terms of safety.” ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/08/04/to_preserve_online_anonymity_make_your_writing_mediocre/

Hacked Chrome web dev plugin maker: How those phishers tricked me

library
crime | hacking | security

The chap behind Chrome Web Developer, a popular third-party extension that was briefly hijacked to inject ads into browsers, today confirmed he was the victim of a phishing attack.

Chris Pederick, a Brit living abroad in San Francisco, California, said he received an email on Tuesday claiming to be from Google warning that his Chrome tool needed to be updated to comply with new store policies.

Occupied with work, Pederick says, he followed the link in the message to a webpage and typed in his developer account login details to continue. That page handed over his credentials to miscreants.

Pederick said he didn’t realize what had happened until about 6:30am the next day, when he was informed that a new version of the extension – which has over one million users – had apparently been uploaded earlier that morning and contained code that injected ads in users’ Chrome browser windows.

“I wake up to a number of tweets and emails from users reporting unusual logging and adware coming from Web Developer,” Pederick said.

“I realize that this is tied to the email from the day before and immediately change my developer account password. I log in to the developer dashboard and see that a version 0.4.9 has been uploaded by someone other than myself and immediately unpublish the extension from the Chrome store.”

Two hours later, Pederick was able to get an updated release of the plugin, version 0.5, uploaded. He has also since enabled two-factor authentication to prevent any further incidents.

“I could make excuses about how I am extremely busy at work or I seem to constantly be logged out of my Google account, so having to log in is not unusual, but the reality is that I am a bloody idiot and blindly logged into my developer account after clicking on a link in the email,” Pederick’s mea culpa reads.

“To add to my stupidity, the developer account did not have two-factor authentication turned on.”

Lest he feel too bad, it should be pointed out that Pederick wasn’t even the first Chrome plugin developer to fall for the scheme that week. A second Chrome plugin, Copyfish, was also compromised and started kicking out ads after one of its developers fell for the same phishing email.

Like Web Developer, the Copyfish attack only impacted the Chrome version of the plugin, not the Firefox build.

What’s worse, Copyfish said its developer account was briefly suspended by Google, even after it took down the ad-injecting version of its plugin. The extension’s team said it believes the attack originated from a machine in Russia. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/08/03/web_developer_plug_creator_confirms_phishing_attack_and_hes_not_alone/

Russian admits being Ebury botnet herder, now jailed for 46 months

library
crime | hacking | security

A Russian man has been imprisoned for 46 months after admitting to using the Ebury malware to create a massive botnet for fun and profit.

Maxim Senakh, 41, of Veliky Novgorod in Russia, was sentenced in Minnesota after pleading guilty to conspiracy to commit wire fraud and violating the Computer Fraud and Abuse Act. He was arrested while on a visit to Finland and extradited to the US after an indictment was filed in absentia.

Ebury is malware specifically designed to run on Linux, FreeBSD, and Solaris systems and harvest login credentials. Senakh and his associates then used them to build a botnet of infected systems made up of tens of thousands of computers. They made millions running spam campaigns and committing advertising click fraud.

“Working within a massive criminal enterprise, Maxim Senakh helped create a sophisticated infrastructure that victimized thousands of Internet users across the world,” said Acting Minnesota US Attorney Gregory Brooker.

“As society becomes more reliant on computers, cybercriminals like Senakh pose a serious threat. This office, along with our law enforcement partners, are committed to detecting and prosecuting cybercriminals no matter where they reside.”

Ebury shot to fame when it was used as part of the attack on the Linux Foundation and the Linux Kernel Organization’s kernel.org. The man accused of that crime, Donald Ryan Austin, is currently awaiting trial on hacking charges.

“The defendant and his co-conspirators sought to turn a network of thousands of infected computers in the United States and around the world into their personal cash machines,” said Acting Assistant Attorney General Kenneth Blanco.

“But cybercriminals like Mr Senakh should take heed: they are not immune from US prosecution just because they operate from afar or behind a veil of technology. We have the ability and the determination to identify them, find them, and bring them to justice.”

Special Agent in Charge Richard Thornton said: “The sentence handed down today sends a strong message to international cybercriminals who mistakenly believe they can prey on the American people with impunity.

“The FBI is committed to working closely with our global law enforcement partners to investigate criminal enterprises such as this and hold those responsible to account for their crimes, wherever they may be.” ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/08/03/russian_ebury_botnet_herder_gets_46_mo/

2017 Pwnie Awards: Who Won, Lost, and Pwned

library
crime | hacking | security

Security pros corralled the best and worst of cybersecurity into an award show highlighting exploits, bugs, achievements, and attacks from the past year.

(Image: Pwnies.com)

Each year, security experts gather to celebrate the achievements and failures of security researchers and the broader infosec community during the Pwnie awards. This year’s ceremony once again took place during the Black Hat USA conference in Las Vegas.

The show’s committee accepted nominations for bugs disclosed over the past year, from June 2, 2016 through May 31, 2017. Nominees are judged by a panel of respected security researchers, which according to its website is “the closest to a jury of peers a likely to ever get.”

Winners were announced the week of Black Hat during an informal (and hilarious) ceremony hosted by judges and infosec pros Travis Goodspeed, Charlie Miller, Brandon Edwards, Katie Moussouris, and Dino Dai Zovi.

Winners in attendance were honored with “Pwnie” statues; some recipients, like Australian Prime Minister Malcolm Turnbull and the Shadow Brokers, were obviously absent.

The 2017 show included award categories ranging from Best Cryptographic Attack to Best Server-Side Bug to Lamest Vendor Response. Who were this year’s winners? Take a look to find out.

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/2017-pwnie-awards-who-won-lost-and-pwned/d/d-id/1329553?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple