STE WILLIAMS

Hackers have lifted not only the social security numbers and personal information of half a million jobseekers in Kansas – but also records on more than five million people from nine other US states.

The compromised database belonged to the Kansas Department of Commerce. The server was set up by the department’s America’s Job Link Alliance-TS to power several state-sponsored job search websites where people upload their resumes and personal information for employers to peruse. Kansas was basically managing this service for 16 US states, although not all were hit in the security breach.

A Freedom of Information Act request by journalists has this month shed more light on the cyber-break-in: although the infiltration was discovered on March 12, and the systems were locked down two days later, only now is the full picture coming into focus, particularly the fact that millions of people are affected.

While the residents of Kansas took a serious hit – 563,568 of them had their info harvested – the good folks of Alabama suffered the most, with 1,393,109 people’s information compromised. Arizona had 896,370 people affected and 807,450 people in Illinois were exposed in the attack. In all, 5.5 million folks had their SSNs and personal data accessed; a further 805,000 just had their personal files exposed, according to state figures.

The full list of affected states in which SSNs were leaked is as follows: Arkansas, Arizona, Delaware, Idaho, Kansas, Maine, Oklahoma, Vermont, Alabama, and Illinois.

Kansas officials called in the FBI as soon as the intrusion was discovered and is now having to spend a pretty penny sorting out the mess. The state paid $235,000 to IT contractor firm SHI for the initial incident response, an unnamed amount to call-center operator Epiq to handle those affected, and $175,000 to lawyers Shook, Hardy and Bacon to cover the state’s ass legally.

Kansas has no data breach notification laws. The state has said it will give a year of free identity theft protection to those affected, further adding to the bill. The 236,134 people affected by the hack in Delaware will get three years of coverage, in line with that state’s laws.

To make life more complicated, Kansas officials say they don’t have the contact details for everyone affected, and has only sent out 260,000 emails to victims. El Reg is happy to help get the word out. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/07/24/kansas_government_loses_5m_ssns/

The Chinese government is requiring citizens in Xinjiang province to install spyware on their mobile phones and is enforcing the policy with police spot-checks, according to several online reports.

Reflecting a country-wide clampdown on internet usage, users of WeChat in the regional capital of Urumqi received a message on their phones earlier this month instructing them to install an app called Jing Wang – “clean internet” in Chinese.

Those who do not install the app face up to 10 days in detention, the noticed warned. And the police have been following up on that threat, according to several online posts.

One news article reported that 10 Kazakh women in the region were arrested after a group chat discussion about immigrants was picked up by censors. And at the weekend, a widely shared Twitter post showed a police checkpoint where citizens were forced to hand over their phones to be checked for the spyware.

The app is itself pretty invasive – it not only blocks specific websites, but also searches a phone’s file storage for “illegal” images and can prevent the installation of other applications. It keeps a copy of chat records and Wi-Fi logins and sends them, along with phone-specific IMEI and SIM details, to a government server.

The main goal of the app is – or was – to shield minors from inappropriate content and things like viruses. However, the Chinese government has repurposed it to act as a mass surveillance tool. In the official notice sent, users were told that the app would “automatically detect terrorist and illegal religious videos, images, ebooks and electronic documents” on their phones.

What’s going on

Why are the Xinjiang province and the city of Urumqi’s four million residents being targeted?

That is due to the region’s long-held tensions with the Chinese government based on the other side of the country. The large, remote region borders eight countries – Mongolia, Russia, Kazakhstan, Kyrgyzstan, Tajikistan, Afghanistan, Pakistan and India – and until recently its population was mostly Uighur, who are Sunni Muslims.

The region’s culture and economy was built on the famous Silk Road travel route and it has a strong sense of cultural identity and independence that has sparked numerous conflicts with the Han people that dominate China.

In 1949, the Uighurs declared independence and a new country – East Turkestan – but the Chinese communist revolution squashed those plans the same year. Officially, it is an autonomous region along the same lines of Tibet.

The old tensions emerged again in the same era as the Tiananmen Square massacre of 1989, when street protests erupted in Xinjang and were brutally put down. The Chinese authorities responded in the same way they did in Beijing – by arresting and imprisoning leaders of the protest movement.

A map showing the location of the city of Urumqi in relation to the rest of the region

In 2008, in the lead-up to the Beijing Olympics, the Uighurs started protesting again. And then in 2009, rioting in Urumqi led to the deaths of 200 people, most of them Han Chinese.

The government has responded in three ways:

1. Encouraged mass migration of Han Chinese to the region.
2. Invested heavily in industry and energy projects.
3. Introduced policies that undercut the local culture, including strict controls on Islamic schools and the number of mosques, and restrictions on what religious practices are allowed. As just one example, in 2014 the Xinjang regional government banned Muslim civil servants from fasting during Ramadan.

The local Uighur population has increasingly complained about the influx of Han Chinese, claiming that they are being given the best jobs. A degree of economic prosperity has also built up resentment.

Bloodshed

In the past five years, the region has undergone a series of attacks and clampdowns. In 2013, 27 died when police opened fire on a crowd that was attacking local government buildings. In 2014, three died following a bomb and knife attack at an Urumqi railway station; a month later, 31 died when two cars drove through a market in the city. Two months after that, another 96 died in an attack on a police station. And two months later, 50 more died in explosions from bombs placed outside police stations and markets.

The Chinese authorities see the measures as increasingly necessary to keep the peace from violent separatists, but critics question the veracity of reports and claim that the government is exaggerating the risk in order to justify ever-greater controls on the Muslim population.

This latest focus on smartphones and online activity has been reflected across China since the introduction of new laws in June.

Last week, we reported on how the authorities had started banning not just political speech, but seemingly harmless content from outside the country. Soap operas, movies and pop stars – including Justin Bieber – were banned in order to fit with new rules that 90 per cent of content must come from within China.

That follows evidence of increased sophistication in the government censorship apparatus that was revealed when Nobel Peace Prize winner and reform activist Liu Xiaobo died earlier this month. Any mentions of Xiaobo or his wife were deleted by censors out of fears of protests.

And that followed successful efforts by the regulatory authorities to shut down VPN services, which Chinese citizens regularly use to bypass content controls. A number of VPN providers decided to shut down their services rather than agree to the government’s licensing requirements – which include providing backend access to their systems and adhering to a government-provided blacklist of websites. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/07/24/china_installing_mobile_spyware/

Researchers will hammer home potentially devastating attacks, and demo a range of vulnerabilities, techniques and tools.

Image Source: Adobe Stock

When enterprises build their security models based on implied trust at the hardware and firmware level, they’re building them on a foundation of sand. Security researchers are going to repeatedly hammer that lesson home at Black Hat this week as they demonstrate a range of vulnerabilities, attack techniques and tools designed to get as close to the bare metal of systems as possible.

“Researchers have started really challenging the assumptions that we have about the security of platforms and digging into that,” says Stefano Zanero, a researcher and associate professor at Politecnico di Milano, as well as a Black Hat review board member. “These are the very basic hardware-related features of our computers — they are things that a very, very limited amount of people have been looking into for decades, but they are growing in importance right now.”

It’s a dangerous category of flaws as they tend to render protections higher up the platform stack completely moot. Exploiting low-level vulnerabilities in hardware, firmware and instruction sets makes it possible for attackers to quietly and persistently take full control over even the most well-patched and defended devices.

Here are the talks most likely to make waves this week.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/7-hardware-and-firmware-hacks-highlighted-at-black-hat-2017/d/d-id/1329442?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Companies that leaked data accidentally chose the sharing setting “public on the Internet,” which enabled anyone on the Web to access all information contained in the messages

Major companies have publicly exposed messages containing sensitive information due to a user-controlled configuration error in Google Groups.

Researchers at RedLock Cloud Security Intelligence (CSI) discovered Google Groups belonging to hundreds of companies inadvertently exposed personally identifiable information (PII) including customer names, passwords, email and home addresses, salary compensation details, and sales pipeline data. Internal messages also exposed business strategies, which could create competitive risk if in the wrong hands, explains RedLock cofounder and CEO Varun Badhwar.

The Weather Company, the IBM-owned operator of weather.com and intellicast.com, is among the companies affected. Fusion Media Group, parent company of Gizmodo, The Onion, Jezebel, Lifehacker, and other properties made the same mistake.

“The RedLock CSI team only looked for a sample of [Google Groups] cases and found dozens,” says Badhwar of this research. “Extending that, there are likely hundreds of companies affected by this misconfiguration.”

Google Groups is a G Suite chat application organizations use to create and participate in email-based group chats and online forums. During the configuration process, admins can set the sharing option for “Outside this domain – access to groups” to make messages public or private.

The companies that leaked data accidentally chose the sharing setting “public on the Internet,” which enabled anyone on the Web to access all information contained in their messages. RedLock advises all companies using Google Groups to ensure “private” is the sharing setting for “Outside this domain-access to groups.”

RedLock’s CSI team routinely checks various cloud infrastructure tools for threat vectors, and monitors publicly available data to detect misconfigurations that could cause security incidents, explains Badhwar. To date, the team has found more than 4.8 million exposed records resulting from cloud misconfiguration problems.

This is the latest example of organizations mistakenly exposing data by failing to properly configure their public cloud settings.

Shortly before RedLock announced its findings, a data leak at Dow Jones Co. exposed millions of customers’ personal information due to a configuration error in an Amazon Web Services S3 bucket. The repository had its settings configured to let any AWS authenticated user access its data, making it available to any of the one million users with a free AWS account.

Dow Jones confirmed 2.2 million people were exposed; however, Upguard, which discovered the leak, places that number around four million based on the bucket’s size and composition. While Dow Jones has “no reason to believe” any of the data was stolen, its incident is one of many signs that companies are struggling to securely adopt cloud services.

Earlier this year, Upguard discovered Deep Root Analytics accidentally leaked millions of voter records from an unsecured public storage account. Exposed data included phone numbers, birthdates, home and mailing addresses, party affiliation, and self-reported racial background.

The analytics firm, working on behalf of the Republican National Committee, had set its S3 storage bucket files to public instead of private. Most records had permissions to be downloaded and files could be accessed without a password.

“The public cloud can be highly secure when configured correctly, but what we’re seeing is there’s an overarching learning curve when it comes to how organizations should properly secure cloud applications and public cloud infrastructure,” says Badhwar.

Unfortunately, many companies are struggling with basic security. Badhwar says the RedLock CSI team found 40% of organizations have exposed a public cloud resource by incorrectly configuring sharing settings, leading to the recent series of major leaks.

“Simple misconfiguration errors — whether in SaaS applications or cloud infrastructure — can have potentially devastating effects,” he adds, citing instances of similar mistakes at WWE and Booz Allen Hamilton.

It’s important for businesses to teach employees about security practices and tools they can use to automate the process of securing applications, workloads, and systems. Until this education happens, he anticipates we will continue to see these problems.

Related Content:

• 7 Hardware Firmware Hacks Highlighted at Black Hat 2017
• Majority of Security Pros Let Productivity Trump Security
• 20 Questions for Improving SMB Security
• BEC Attacks Far More Lucrative than Ransomware over Past 3 Years

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/weathercom-fusion-expose-data-via-google-groups-config-error--/d/d-id/1329449?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

You expect your pacemaker to keep your ticker ticking and nothing more. Little did Ross Compton know that day he is alleged to have burned down his house, that the data from his pacemaker would be the key witness against him.

Earlier this month a judge in Butler County, Ohio, decided that  the evidence provided by Compton’s pacemaker could be presented at trial. The Journal-News tells us Compton is charged with setting fire to his house in September 2016, with the fire caused $400,000 worth of damages. Compton has a pacemaker and an external pump which he uses. The night of the fire he told police that he woke up, packed some items, broke a window, threw his cane and baggage out the window, and then left the house. He then collected his items and went to his car.

The police requested and received a search warrant to review the data stored in Compton’s pacemaker. The data collected showed Compton’s heart rate, cardio rhythms and pacemaker demand – both before and after the fire.

The prosecutor brought forward a cardiologist who opined in court:

It is highly improbable Mr Compton would have been able to collect, pack and remove the number of items from the house, exit his bedroom window and carry numerous large and heavy items to the front of his residence during the short period of time he has indicated due to his medical conditions.

The prosecutor noted that pacemaker data is analogous to subpoened health records of a defendant. The court agreed. Compton’s trial is set for December 4.

It is widely agreed that pacemakers, insulin pumps and the like were not designed with data security in the forefront. Indeed, security of medical devices is of immense importance. The Compton case raises the question of his pacemaker’s data were encrypted, would he be obliged to provide the key so that the information could be used against him?

While this may be the first instance that an embedded medical device’s data has been admitted into court,  there have been instances where data from health wearables, FitBit specifically, has been admitted into court.

Back in April, a murder victim’s Fitbit contradicted her husband’s version of events. The prosecuting DA noted how the information was more accessible than other types of data, like DNA.

Writing in the May 2016 edition of the Catholic University Journal of Law and Technology, Nicole Chauriye raised important points with her paper, Wearable devices as admissible evidence: Technology is killing our opportunity to lie.

In the paper, she notes that consumer wearable health devices come under less stringent privacy rules than medical devices.  For example, when an employer provides the employee with a consumer-grade device, the employee can expect the employer to have unencumbered access to the data from the device.

She goes on to highlight an example where a FitBit was used to provide demonstrable evidence that an individual’s ability to function had been diminished following a serious accident, and concludes that health and medical devices should be placed in the same category as cellphones and computers, which require a warrant to be legally searched (as was the case in the Compton case).

The bottom line is our implanted medical device or wearable health aid are going to tell their own stories about us based on our body’s telemetry.

Follow @NakedSecurity
Follow @burgessct

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/qcZR5mKaYEA/

So, what was it like to work at [redacted entity that administers publicly funded programs]? The US Department of Justice would like to know, and it has no qualms about peeling away the anonymity of Glassdoor reviewers to find out.

Glassdoor, a forum for current and former employers to anonymously post reviews about employers’ labor conditions, salaries, and job interviewing practices, is fighting a subpoena that originally sought to unmask at least 125 reviewers of a company made anonymous in redacted court documents.

The company’s under investigation for potential fraud related to its contracting practices.

An appeals court is scheduled to soon decide whether the government can unmask the anonymous reviewers, and the proceedings are going to take place behind closed doors.

The case was brought to light by Paul Alan Levy, an attorney who works with Public Citizen.

Public Citizen is a nonprofit that champions citizen rights in courts and in front of Congress. It’s one of a number of civil liberties groups and a coalition of ISPs that were looking forward to dissecting the government’s interpretation of the case’s impact on First Amendment rights to speak anonymously.

No such luck: the amicus efforts were aborted by a Ninth Circuit ruling (PDF), filed earlier this month, that said the court saw “no need” to hear from friends of the court at this point.

Not all of the documents are sealed. In Glassdoor’s motion to quash (PDF) the grand jury subpoena, the company notes that between September 2008 and March 2017, 125 reviewers posted about the employer in question.

The subpoena was initially demanding identifying information on anybody who reviewed the company from September 1 2008 to the present, including, but not limited to, IP address; logs associated with all posts, including date and time of post; username; email address; resume; billing information such as name, credit card information, billing address, and payment history; and any other available contact information.

No can do, said Glassdoor: that would infringe reviewers’ First Amendment right to anonymous expression and would have a chilling effect on users’ inclination to use the service.

The government offered to roll the subpoena’s scope back to eight reviewers, to be used as “examples”. The government apparently thinks the eight could prove to be witnesses to “certain business practices relevant to our investigation,” the US Attorney said.

Glassdoor stood fast, but it did offer a compromise: it proposed to the government that it would notify the users in question about the subpoena. If any of them were up for participating, Glassdoor would provide their identifying information to the government.

The government nixed that idea, so Glassdoor’s ready to fight the subpoena in court.

So far, the government has prevailed.

US district judge Diane Humetewa agrees with prosecutors that the 1972 case that Glassdoor relied upon, Bursey v. US, didn’t apply, because it protected the anonymous speech of a political group that “anonymously print[ed] and distribute[d] critiques of the government”. Namely, the Bursey case involved a grand jury subpoena directed at the process of publishing the newspaper of the Black Panther Party.

Glassdoor reviewers of the company under investigation don’t merit the same protection as members of the Black Panthers, she said, in spite of the fact that they worked for a company that handles public funds:

The fact that the relevant users in this case work (or worked) for a publicly funded program does not make this speech political. Nor does it transform the reviewers from individuals voicing concerns about fraud into an association engaged in advocacy.

Levy, for his part, thinks that Judge Humetewa’s reading of the First Amendment is wrong, particularly given that public money is involved:

The government’s contention … that the speech in the employee reviews enjoyed something less than full First Amendment protection, because they are not “political speech,” is … plainly wrong: consumer and employee criticism of companies enjoys full First Amendment protection. Indeed, the public interest in seeing speech about businesses is especially important if, as appears to be the case, the company is one that performs contracts for the government.

He’s also baffled by all the secrecy – secrecy that’s obscuring whatever reason there might be to keep so much of the case secret:

Given that so much of the docket in the District of Arizona remains unsealed, it is hard to see what legitimate secrecy interests are preserved by the requirement that the merits briefs of the parties be kept entirely secret. Will oral argument be held behind doors as well?

Readers, have you ever written about employer improprieties on Glassdoor or other employer-review sites? Does the notion that doing so might lead to you getting unmasked and becoming a witness in a Federal criminal case chill your notion to ever do so?

Please let us know your thoughts!

Follow @NakedSecurity
Follow @lisavaas

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/OzDgixz8SQY/

If you’re running Ubuntu 16.10 Yakkety Yak, released on October 13 2016, Ubuntu developer Canonical warns that now is the time to upgrade to Ubuntu 17.04, known as Zesty Zapus. If you’re running a Linux distribution which is a version of Ubuntu with a different desktop environment, such as Kubuntu or Xubuntu, the same applies to you.

Support for Yakkety Yak ceased on July 20, which means that version of Ubuntu will no longer receive security patches. However, if you’re running Ubuntu 16.04 Xenial Xerus, you’ll still receive functionality and security patches until April 2021. That’s because it’s a long term support (LTS) release. Ubuntu 17.04 Zesty Zapus will be supported until January 2018.

I’m a big fan of Linux operating systems, and I use Kubuntu (Ubuntu with a KDE UI) for my everyday work. Nonetheless, security vulnerabilities and cyberattack aren’t specific to any particular computing platform – Linux can be a focus of attack too, and needs protecting with antivirus software. Any operating system can be insecure, especially if you aren’t receiving frequent and recent security patches.

CVE Details lists 28 known vulnerabilities that are specific to Yakkety Yak. They include a Django vulnerability which enables DNS rebinding attacks, a Django vulnerability that involves a hardcoded password, and an RSA and DSA decryption bug.

Ubuntu version numbers are based on the year and month of release. New versions of Ubuntu are always released in April and October. So Ubuntu 16.10 Yakkety Yak was released in October 2016, and Ubuntu 17.04 Zesty Zapus was released in April 2017. Ubuntu 17.10 Artful Aardvark will be released this October. Distributions based on Ubuntu, such as Kubuntu, Xubuntu, and Lubuntu are released on the same schedule, with the same version numbers and animal codenames.

If you’re running Ubuntu 16.10, Canonical has a handy guide on how to upgrade to 17.04 right now.

Whether you use Windows, OS X, a version of Linux, a version of Unix, iOS, Android, or any other operating system, updating your operating system and all of your applications with proper patch management is vital to keeping your computer secure.

End-of-life periods for operating systems and applications are always a cybersecurity challenge. Software that’s no longer supported with security patches, no matter what it is, can make any system a prime target for cyber attack, as we saw with the WannaCry ransomware outbreak, which attacked an unpatched vulnerability in  Windows. Microsoft moved to patch all the affected versions of Windows, including those that were no longer supported.

Ubuntu EOL (end of life) is predictable. Standard releases are always supported for nine months, and LTS releases are always supported for five years. In an Ubuntu environment, you can always check your support status by entering ubuntu-support-status at the command line.

Because of its enormous market share, when Microsoft ceased extended support of Windows XP on April 8 2014, it caused significant headaches for business, and XP is still not unheard-of in businesses, even though it’s no longer supported.

Sticking with an unsupported operating system is a risk we’d urge you not to take, so as well as checking your Linux versions, now is a good time to check your other devices, too.

Follow @NakedSecurity
Follow @kim_crawley

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/KUHvhzd3ecc/

Analysis A US Federal Bureau of Investigation veteran has spoken out on the international police ops that led to the takedown of dark web drug souks AlphaBay and Hansa, giving an insider’s look at the process.

Joseph Campbell served for 25 years in the FBI, where he led criminal investigations into child exploitation and the trade in contraband prior to moving over to the private sector in April, 2016. Campbell worked in the bureau at the time of the earlier Silk Road bust in 2013.

The FBI vet says the takedowns may help discourage the trade of illicit material in the digital underground – while conceding that other such markets are nonetheless likely to spring up.

The AlphaBay bust, like the Silk Road takedown, was facilitated by targeting site administrators. What has changed in the four years since the Silk Road bust has been improvements in the pooling of intelligence with international partners, such as Europol.

Displacement collar

Law enforcement agencies historically have a reputation for playing catchup against cybercriminals. The AlphaBay and Hansa takedown is an example of law enforcement proactively taking action and planning ahead. Followup police action is promised.

The takedown of AlphaBay redirected users to a market that was already under covert law enforcement control. This allowed law enforcement to collate data on suspects who might otherwise have slipped under the radar.

AlphaBay facilitated numerous illicit activities, including narcotics trafficking and the sale of stolen personal and financial information, firearms and malware, before it was dismantled earlier this month. Hansa experienced an eight-fold increase in the number of users following the 4 July takedown of AlphaBay, according to the US Department of Justice.

Hansa, ranked the world’s third-largest underground marketplace, specialised in sales of the same illicit goods and services as AlphaBay.

But unbeknown to its users, the market had been under the covert control of Dutch law enforcement officers since 20 June, when the two operators of the website were arrested. In the coordinated takedown, Dutch authorities obtained the usernames and passwords of thousands of Hansa users. Police plan to use the data they collected to run follow-up investigations. The shutdown of Hansa is the result of more than a year of investigative work.

Deep cover

Questions have been raised as to why, if cops had control of AlphaBay, they didn’t use this access to monitor its users in the same way that Hansa customers were put under surveillance. Campbell didn’t work on the AlphaBay investigation but he was able to explain that the FBI – as with other undercover investigations – would have weighed the intelligence benefits of letting the marketplace continue, against the negative aspects of allowing criminality to proceed and the harm caused to victims, through ongoing child abuse activity, for example.

The FBI operates seized fronts to secure additional information about the criminals using them, a practice that pre-dates the advent of dark web marketplaces and has been used in drug market investigations (and others) for many years.

The closures of both AlphaBay and Hansa mark the shuttering of two of the largest dark web markets. The multinational law enforcement effort included the FBI and DEA in the US, police and other agencies in Thailand, the Netherlands, Lithuania, Canada, the UK, and France, as well as partners in Europol.

The next step in the investigation will be “following the money” to identify methods the operators used to launder their proceeds into the legitimate economy, a trail Campbell pursued as an agent and now works to prevent as a consultant to the banking industry in his position as a director in management consulting firm Navigant’s Global Investigations Compliance Practice.

Millions of dollars worth of cryptocurrencies were frozen and seized as part of the AlphaBay takedown. “The goal is to seize criminals’ assets after finding out where they came from,” Campbell told El Reg. “It’s similar to traditional money laundering investigations – where money can flow into and out of offshore accounts – but it can be a bigger challenge to understand source of funds.”

Bounce-back

AlphaBay was 10 times the size of the Silk Road. Cybersecurity experts expect to see a short-term downturn in illicit activity on the dark web following the AlphaBay and Hansa takedowns, but most – like threat intel firm Digital Shadows – expect the market to rebound in one form or another.

Andrei Barysevich, director of advanced collection at threat intel firm Recorded Future, said: “The coordinated closure of two of the most popular underground marketplaces shows the level of sophistication and, most importantly, the willingness of international law enforcement agencies to combat cybercrime jointly.”

“The successful takedown of AlphaBay and Hansa marketplaces – the largest police operation since SilkRoad – has already significantly disturbed the underground economy, and I expect to see the level of cybercrime go down in the short term. Despite recent news, we don’t expect criminals to abandon dark web marketplaces, as the business opportunity of exposure to hundreds of thousands of buyers is too lucrative, and as we have seen before, eventually new market leaders will arise, filling the void.”

Kyle Wilhoit, senior cybersecurity threat researcher at DomainTools, added: “Hansa and AB [AlphaBay] were two of the most prolific underground marketplaces that distributed and sold drugs, credit card numbers, and malware. The shutdown of these underground marketplaces are becoming more commonplace. The shutdown of these two sites will dramatically affect the underground marketplace ecosystem in the short term as buyers flock to other sites.

Police were sitting happily on the servers reading users’ unencrypted messages for some time before Silk Road was shut down.

“Individuals with nefarious intentions must either migrate to another underground shop with less reputation, or they must find alternate business techniques, such as selling on deep web forums. Ultimately, this isn’t wholly surprising – considering AB has been compromised on two separate occasions resulting in their API being compromised and over 210,000 private messages leaked. When you are conducting business with criminals, you must expect to some degree that your business is on shaky footing anyway,” he added.

Online intelligence, surveillance, human sources and complaints from scam victims all play a role in the investigation of dark web marketplaces, according to Campbell.

Opsick

As previously reported, AlphaBay’s administrator, Alexandre Cazes, used his personal email on password reset emails, compounding the error by using the same email on LinkedIn and to run a legal business.

Chris Doman, security researcher at AlienVault, commented: “Users of illicit markets on the Dark Web are wrong if they think the forum administrators are capable of protecting their identities.

“The administrator of the previous big forum that was busted – Silk Road – revealed his identity a number of times. And police were sitting happily on the servers reading users’ unencrypted messages for some time before the site was shut down.”

AlphaBay had established itself as a prominent “go to” platform for the trade in illegal goods, with substantial sums of money held in escrow on the platform, meaning many thousands of cyber criminals have been left out of pocket as a result of the site’s takedown.

Some AlphaBay users have created a new iteration of the marketplace, dubbed GammaBay. Additionally, sellers have leveraged their AlphaBay vendor ratings as a measure of their trustworthiness and reputation. “This relocation is made easier as many established vendors and regular customers would have already had multiple accounts across the major markets,” according to Digital Shadows.

“Takedowns like this undermine the confidence of cybercriminals in trading platforms and disrupt the ebb and flow of their trade,” said Rick Holland, VP of Strategy at Digital Shadows. “This is an ongoing battle and law enforcement will seek to stay one step ahead of the cyber criminals.”

Patrick Martin, a cybersecurity analyst at RepKnight, predicted sites like Dream Market will fill the gap created by this week’s takedowns. He described AphaBay and Hansa as part of a much larger group of underground bazaars whose products range far beyond narcotics.

“Many people mistakenly believe the dark web is only about drugs, guns and illicit material – a world away from everyday life, and a world never likely to affect normal society. The truth though is that the dark web is a massive marketplace for corporate and consumer data like credit card details, login credentials and intellectual property – meaning that everyone is at risk from the dark web.

“The good news for law enforcement monitoring the dark web is that they can see users switch to new dark web sites, and use that as evidence of a repetitive pattern or modus operandi of crime, and we’ll hopefully see more convictions in court. However, gathering evidence in this way is time consuming, and in the meantime, business and consumer data remains at risk,” he added. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/07/24/alphabay_takedown_analysis/

The danger of dating sites: If a beautiful woman asks men to click on malware, they’ll probably click.

Bill installed the dating app on his smartphone. To his surprise, he was quickly matched up with several women he found attractive. Better yet, they immediately showed their interest by sending him text messages. 

“One’s a flight attendant and three are models!” he told his friends over coffee. “Why didn’t I jump into online dating years ago?”

Bill’s favorite four ladies all sent him numerous, nearly identical text messages that were inviting yet vague — they didn’t respond directly to his questions. Bill didn’t care. They were gorgeous and texting with him. He noticed that three had attended the same college, and two worked for the same agency in London. Within a day, each sent him a link and wrote Bill, “Want to meet? Check this out.”

I Never Do This, But…Click!
Bill clicked on the links, and so do 70% of men when they unexpectedly receive a link sent by a bot posing as an attractive woman. That’s what PerimeterX observed when we researched top dating sites. This 70% click-through rate may well be the highest conversion rate in the world, and it explains why dating bots pay off for hackers.

One of the first clues to the prevalence of bots on dating sites such as Tinder: Many female profiles in specific cities (Copenhagen and Denver, for example) list similar jobs — modeling or flight attendants, usually — and supposedly attended one of a limited set of colleges. Oddly, they often list workplaces in other cities. Invariably, their photos portray them as above average in appearance. 

Why Bots Want to “Date” You
Dating bots are outgoing and were very quick to match up with me when I posted a profile on Tinder. They also texted me and suggested that I click on links they sent. The links lure men from dating sites to porn sites, or URLs where they can be tricked into downloading malware or giving up money or personal data.

Between 22% and 35% of relationships now start online, and malicious bots are estimated to make up 29% of traffic on enterprise sites, according to a report quoted in Digital Trends. Inevitably, online dating and bots intersected. Hackers create bots on dating sites to steal traffic, obtain personal and financial data on customers, and sometimes defraud them.

We found the same bot infestations on other dating sites, so it’s not only Tinder and its users that are being targeted.

Both Men and Women Exploited on Dating Sites
When we contacted a real-life user whose photographs had been hijacked to set up bot profiles, she was able to have her images removed from the site. For every bot profile, there’s a face that belongs to a real person who probably is not aware her or his photos are being misused.

That’s almost certainly true of the thousands of Tinder users in the Bay Area whose images were scraped and put into a public-domain facial data set. Using automated tools, scam artists copied from Tinder 20,000 profile images of women and 20,000 of men from Tinder without their knowledge.

Relatively primitive bots can make matches, start a text or email conversation, and ask men to click a link that leads to paid content sites (that is, porn). Newer, advanced bots can vary their behavior to be more convincing companions.

Men who fall for these bots may be lured into entering their credit card data on a site of ill repute or a phony “profile verification” service, and then be too embarrassed to report that they were tricked into accepting a porn site subscription.

Dating Sites Get Stood Up by Bots
Bots have a serious impact on dating sites, which lose traffic, advertising revenue, and subscription fees. A site’s reputation suffers when male customers discover that a large portion of attractive women — by far the most communicative — on the site are fake. It’s clear that dating bots destroy the customer experience and probably hurt customer loyalty as well. 

In addition, a dating site might be liable if a user could prove that a malware infection or fraud loss resulted from link sent to him via the site.

People Don’t Spot Fake People Well
Dating sites have used humans to check new profiles. This approach is not scalable and it’s unreliable. People, it turns out, aren’t very effective at catching bot profiles. 

Dating sites bear the burden of stopping bot activity. It is imperative that they do the following:

• Create a safer environment for their customers
• Sustain a legitimate, nondeceptive customer experience
• Protect the mission of providing an honest forum for new relationships
• Sustain revenue and traffic

Stopping Bots Is Tough When You Can’t See Them
If simpler bots are used to chat with human customers, they may be caught with more traditional defenses. Newer, more sophisticated bots are much more elusive and can be directed to vary their behavior, making them undetectable by signature-based security tools.

It’s essential to avoid blocking legitimate customer traffic — that is not an acceptable by-product of protecting users and the site’s reputation. Sites must be able to stop automated account creation and step in the moment a human-created profile begins to employ automated methods to communicate with unsuspecting users.

Dating sites can now turn to new behavior-based approaches to Web protection. One such method learns how human users interact with the site and spots subtle deviations from human behavior. The best practice is to check the profile of every user and all their interactions with the site, in real time. It may lead to fewer supermodels chasing after Bill and guys like him — but will also leave bots out of the dating game and help dating sites protect their reputation and users. 

Related Content:

• How End-User Devices Get Hacked: 8 Easy Ways
• Invisible Invaders: Why Detecting Bot Attacks Is Becoming More Difficult
• Bot-Driven Online Ad Fraud Losses Decline

Inbar Raz has been teaching and lecturing about Internet security and reverse engineering for nearly as long as he’s been doing that himself. He started programming at the age of 9 and reverse engineering at the age of 14. Raz specializes in an outside-the-box approach to … View Full Bio

Article source: https://www.darkreading.com/endpoint/bots-make-lousy-dates-but-not-cheap-ones-/a/d-id/1329426?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A survey found that 64% of IT security professionals will tweak security to give workers more flexibility to be productive when asked to make that move by top executives.

Tension between the IT security department and workers’ desire to remain as productive as possible continues to thrive, according to a report released today by Bromium.

The survey of 175 security professionals found that 64% of respondents admit to lowering the security bar when asked by top executives to allow workers the flexibility to remain productive.

These results reveal that it’s not necessarily the IT security department that is calling the shots when it comes to protecting customer data, the network, and people’s IP, according to the report. Often, these security professionals are trumped by their company’s leadership, the survey notes.

“Whenever an organization adopts a security policy, we are surprised how many will break it,” says Simon Crosby, CTO and co-founder of Bromium.

The willingness to lower the security bar tends to mirror the natural human instinct when it comes to assessing risk, Crosby explains. He compares it to driving to a neighborhood store to get a carton of milk and debating whether to wear a seatbelt. The discussion inside the driver’s mind would rationalize that there is a risk of getting hit but that risk is small, he notes.

“The security guys may also say the risk is tiny when evaluating the request. But it is this repeated risk-taking that opens up tiny holes and leads to a porous security situation,” Crosby says.

He adds that once a security professional grants an exception to a security policy, they may forget to return it to its more secure state once the need to lower the bar has passed.

Hitting the Security Off Button

The survey also found that 40% of IT infosec professionals are willing to turn off security if asked by another department within the organization.

“I am not surprised by the 40%. We need to be productive but need to do it without sacrificing security,” Crosby says. “We are happy to lie to ourselves and think we are securing the organization when we have these policies that we know workers will break.”

In addition to a willingness to turn security off if another department asks, the survey also finds that 55% of respondents would remove security features if they could do it, and still maintain their organization’s safety from user-introduced threats.

On the wish list of security features they would like to remove, 32% of infosec professionsal respondents cite web proxy services and products that limit or slow down users’ access as the first on the list, according to the report.

“In general, people will turn off the web proxy if it impacts user productivity and it gets them off their backs,” says Crosby. “Security teams rely on defense in depth and tell themselves I have antivirus at the endpoint and all these other things to protect me. It makes sense to turn things off and it’s imperative to do so.”

Alternatives to Hitting the Off Switch

One approach to securing an organization is building resilience into the system, Crosby says.

“There needs to be granular isolation between the apps and the OS, and also between the apps themselves,” he notes. “The administered systems will fail at some point but you want them to be able to continue to operate, so you need to build resiliency into the system.”

He compared this approach to Netflix’s use of a Byzantine Fault Tolerance system in which rather than having its operations on one big mainframe which could fail, it operates on a distributed architecture on a number of micro severs. As a result, a portion of the business could fail but it would still be able to operate.

“You can do this in the cloud and you can do this at the endpoint,” he notes.

Related Content:

• Users Overshare Sensitive Enterprise Data
• 95% of Organizations Have Employees Seeking to Bypass Security Controls
• Insider Threat Fear Greater Than Ever, Survey Shows
• 8 Surprising Statistics About Insider Threats

 

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/majority-of-security-pros-let-productivity-trump-security/d/d-id/1329444?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple