STE WILLIAMS

Your daily round-up of some of the other security stories in the news

DC cameras hit by ransomware ahead of inauguration

Most of the storage devices that record footage from Washington DC’s police surveillance cameras were infected with ransomware just eight days before President Trump’s inauguration, police said.

Hackers managed to plant the ransomware on 123 of the city’s network of 187 video recorders, each of which controls up to four CCTV cameras. They were unable to record any video between January 12 and January 15, the Washington Post reported.

The city’s CTO, Archana Vemalapalli, said that no ransom was paid and that the attack didn’t go any further than those devices.

Trump ‘not ready to deal with Russian cyberattacks’

Donald Trump’s administration has neither a policy nor a strategy for dealing with Russian cyberwarfare, Senator John McCain has warned Republicans.

Speaking at the GOP’s congressional retreat in Philadelphia, McCain said that the administration is not prepared to respond to Russian attempts “to influence elections in France and European countries in the coming months”.

McCain’s warning comes as France prepares for its first round of presidential elections in April, where the rightwing populist Marine Le Pen is doing well in the polls. Le Pen supported Russia’s 2014 invasion of Crimea, and last year she asked for a $30m loan to help fund her campaign from a bank close to Vladimir Putin.

Lawmakers probe fake news

British MPs are launching an inquiry into whether the rise of “fake news” is a threat to democracy. The House of Commons culture, media and sport select committee will examine what impact “fake news” has on “public understanding of the world” and the point at which “biased but legitimate commentary shades into propaganda and lies”.

The role of social media platforms and search engines will come under scrutiny, with the MPs examining what their responsibilities should be, and if how advertising is sold and placed has had an impact.

Damian Collins MP, the chair of the committee, said: “The growing phenomenon of fake news is a threat to democracy and undermines confidence in the media in general.”

Catch up with all of today’s stories on Naked Security

Follow @NakedSecurity
Follow @katebevan

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/gC2l1EyuWMI/

A top Austrian hotel coughed up thousands in ransom to cybercrooks, who hacked its computer system and locked guests out of their rooms until the money was paid.

The Romantik Seehotel Jaegerwirt went public with its problems as a warning to other hotels. This is the second time the four-star destination has been hit.

The latest attack left the Jaegerwirt unable to program room keycards – thus preventing arriving guests from getting into their rooms – and also infiltrated the reservation and cash desk systems. The extortionists demanded €1,500 (US$1,605), according to reports.

Sales terminals in hotels have been a key target for hackers over the past two years. But Romantik Seehotel Jaegerwirt appears to be a victim of a different targeted attack, aimed at extortion rather than extracting payment card details.

On receipt of the ransom, hackers unlocked the key registry system and other computers. They also left a backdoor in the system and tried to exploit it again in a subsequent attack – however the hotel had at that point replaced computers, implemented new security measures, and decoupled networks, foiling the crooks.

Managing director of the hotel, Christoph Brandstaetter, said: “We are planning at the next room refurbishment for old-fashioned door locks with real keys. Just like 111 years ago at the time of our great-grandfathers.”

Tyrone Erasmus, a director of consulting firm MWR InfoSecurity, commented: “This is an interesting case, as the technique used to hold the hotel to ransom was unconventional and entirely targeted. Commonly, ransomware affects the availability of data held by businesses, but in this case the attackers understood that denying access to hotel rooms would be an effective way to extort money.”

“This was a targeted attack against the hotel’s room access control systems with the intention of extorting money, indicating that the attackers may well have already had a foothold within the hotel’s IT system,” Erasmus pointed out. ®

Sponsored:
Customer Identity and Access Management

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/01/30/austrian_hotel_ransomware_attack/

Hong Kong’s Securities and Futures Commission announces DDoS attacks on brokers and warns firms of future threats.

The Securities and Futures Commission (SFC) of Hong Kong has issued a circular to licensed firms, warning them of possible distributed denial-of-service (DDoS) attacks and asking them to gear up their IT systems, Reuters reports. This alert was sounded soon after SFC received feedback from Hong Kong police that brokers in the country had been target of DDoS attacks.

“The DDoS attacks have caused service disruption to the brokers for a short period. It is possible that similar cyber security incidents would be observed across the securities industry,” said the commission.

Hong Kong’s regulators have been fighting cyberattack threats over the past year. A November survey discovered between 2014 and 2016, cyberattacks detected within the country and mainland China increased 969%.

Read details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/hong-kong-securities-firms-warned-of-cyberattacks-/d/d-id/1328007?_mc=RSS_DR_EDT

Measuring risk isn’t as simple as some make it out to be, but there are best practices to help you embrace the complexity in a productive way. Here are five.

Broadly speaking, cybersecurity is risk identification and risk mitigation in the cyber domain.  Measuring risk quantitatively is good because it helps security teams measure their capabilities somewhat objectively, which helps everyone make better decisions. For example, when deciding whether to upgrade all your firewalls or invest in organization-wide two-factor authentication, that decision should be based, in part, on what risk exists now and what risk will be after you implement a change. It may surprise you but people are generally pretty bad at this, resulting in things like transportation disasters, major breaches, economic bubbles, wars, and bad movies. 

In the book How to Measure Anything in Cybersecurity Risk by Hubbard Seiersen, the method for evaluating risk is, and I’m paraphrasing, identifying likelihood using modeling principles, and impact using cost estimation and the CIA (Confidentiality, Integrity and Availability) model. 

Here’s where it gets more complicated: evaluating current and future risk requires accounting for people … and people make everything harder. A good risk analysis should account for risky behaviors by users, administrators, and security personnel, both before and after you make the change. 

There is a bunch of research that shows that when you tell people about safety features, they change their behavior to be more risky. Examples include risk for traffic safety, child-proofed medicine bottles, bicycle helmet use, and mobile phone use while driving. They do it for convenience, out of boredom, and other bad reasons. Here are some hypothetical examples in cybersecurity:

Table 1: Examples of Risk Compensation in Infosec

There’s another group of people who alter their behavior when you implement a risk mitigation – and they’re even tougher to account for. Who is it? No, it’s not furries. It’s miscreants. (OK, they might also be furries.) Risk mitigation should account for how attackers will evolve. If you’re facing a persistent threat with a lot of resources, and one attack is unsuccessful, you should anticipate that the persistent threat will evolve their TTP (Techniques, Tactics and Protocols). If you attempted to mitigate the risk of banking trojans served by botnets but failed to account for the evolution to ransomware, your risk model was probably faulty. 

Getting Risk Management Right: Five Recommendations

1. Gather threat intelligence and data about the behavior of your users.  Threat intelligence should be a description of a series of attacks that can help you understand and predict future attacks. Data could include behavior analytics from logs but might also be information based on defining groups of users and interviewing them to see how they operate.

2. Do not reveal to miscreants how they were detected if you can help it.  If miscreants don’t know that a risk mitigation exists, they will not be able to react to it. If you block/detect them, try to hide your capabilities. For insider threats, the decision on what to communicate may already be determined by your legal department or HR.

3. Be deliberate in how you publicize risk mitigations in your organization. While hiding a risk mitigation in your organization would prevent a change in behavior, it might be unethical or prevent you from getting credit for your work. A better solution is to emphasize to users and decision-makers what risks still exist to help them make informed decisions that reduce risky behaviors.

4. Be deliberate in how you share information externally.  Risk mitigations implemented by other organizations may also change the behavior of miscreants. If you’re selective with whom you share data, or share along with guidance on how it should be handled, there’s less of a chance of others being careless, and causing unexpected miscreant behavior changes. If you share publicly, account for uncertainty created by a likely change in attacker TTP.

5. Don’t spread FUD.  FUD (Fear, Uncertainty and Doubt) is incorrect data that causes improper risk or uncertainty measurement. Some people spread FUD because of sloppy work, some do it unintentionally, and some do it deliberately for business reasons. It’s bad for the cybersecurity community/industry as a whole, it’s bad for decision makers, and it’s counterproductive in the long run.

Related Content:

• Cyberrisk Through A Business Lens
• Balancing The Risk Promise Of The Internet Of Things
• Cloud-driven IT Decentralization Increases Security Risk

 

Daniel Gordon, CISSP, is a member of the Lockheed Martin Computer Incident Response Team. He has worked in IT and information security for over 10 years. He holds a BA in political science from St Mary’s College of Maryland and a graduate certificate in modeling and … View Full Bio

Article source: http://www.darkreading.com/risk/why-youre-doing-cybersecurity-risk-measurement-wrong-/a/d-id/1328003?_mc=RSS_DR_EDT

This week: how to get paid by cyber insurers and avoid paying ransoms.

We know every cybersecurity team is overworked and understaffed, but we also know that every team needs all the knowledge and training it can get. So, draw straws with your small squad, decide who will keep both eyes on the incoming alerts, and make sure at least one of you catches some of the educational events coming from Dark Reading soon: 

THIS WEEK

Tuesday, Jan. 31, at 1 p.m. E.T., meet us as we kick off a three-part series, “Preparing For The Ransomware Onslaught.” The first installment, presented by independent security consultant Gal Shpantzer, focuses on Ransomware Prevention, and will provide techniques for stopping ransomware in its tracks before it can run rampant through your environment.

Thursday, Feb. 2, at 1 p.m. E.T., in another session from the Dark Reading Cybersecurity Crash Course, David Bradford, chief security strategy officer and director of strategic partnership development for Advisen, will tackle the question “Cyber Insurance: Does It Really Work?”  He’ll break down some of the questions you should ask yourself, your legal team, and your cyber insurance provider to make sure your policy does what you think it should. (Registration required.)

COMING SOON

Tuesday, Feb. 28, beginning at 11:00 a.m., we’ll host our next Dark Reading Virtual Event and devote the day to tackling Cybersecurity: Costs, Risks, and Benefits. 

Topics will include cyber insurance, measuring risk, measuring the security department’s performance, assessing the real costs of a data breach, and managing the everyday costs of an IT security department.

DOWN THE ROAD

Interop ITX is coming to the MGM Grand in Las Vegas May 15-19. The conference program is overflowing with security sessions this year. Plus, the Dark Reading team will be back with the Cybersecurity Summit – a two-day crash course that will bring security teams, from newbies to time-crunched pros, up to speed. 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/risk/this-week-on-dark-reading/a/d-id/1328010?_mc=RSS_DR_EDT

A program found on suspicious websites aims to trick Windows/PC users into creating fake Netflix logins so it can deliver ransomware.

A newly discovered threat aims to steal Netflix user credentials and hold them hostage, according to researchers at Trend Micro.

Netflix has 93 million subscribers in more than 190 countries. It’s a popular app, but many people aren’t willing to pay the monthly subscription fee. They’ll try to bypass the cost and watch content for free – and cybercriminals are now taking advantage of them.

This newly detected ransomware, RANSOM_NETIX.A, aims to trick Windows PC users with a login generator typically used for software and account membership piracy. This type of program is found on malicious websites promising access to paid Web-based services.

How does it work? Victims click a “Generate Login” button to kick-start the encryption process. The ransomware uses fake login prompts as a distraction while it encrypts 39 file types under the C:Users directory.

The program then demands $100 in Bitcoin from victims. While it targets Windows users, it’s worth noting the ransomware destroys itself on systems not running Windows 7 or Windows 10.

Netflix, with its massive user base, presents a tempting opportunity for hackers to exploit vulnerabilities, infect systems to steal user data, and monetize data on the dark Web. Stolen credentials can be used to bargain among criminals or trick victims into installing malware, which can generate profit.

“We regularly see threat actors utilize popular apps or services as a lure to get victims to infect themselves,” explains Jon Clay, global director of threat communications at Trend Micro. “Also, by using imagery that is similar to the real vendor’s imagery, [criminals] trick the victim into thinking it’s real.”

Clay says this discovery marks a continuation of 2016 ransomware trends, which included the creation of new tactics to generate more victims. After seeing nearly 750% growth in new ransomware families in 2016, Trend Micro predicted 25% growth in new families for 2017.

The Netflix scam carries implications for how ransomware will evolve later in the year.

“We will likely see other popular vendors targeted with their brands, especially if the actors behind [the Netflix scam] find success,” he continues. “They will use this tactic again with other vendors.”

This is a wake-up call for potential victims to protect their accounts. Best practices include regularly updating account credentials, employing two-factor authentication, limiting downloads to official sources, and being wary of illegitimate emails.

Businesses should educate their employees on how ransomware threats work, and how using legitimate brands in social engineering attacks can trick victims into making dangerous decisions. Employees should be aware that trying to obtain a free Netflix account is “bogus,” says Clay, and should not be acted upon.

Social engineering is core to this type of scam, and users can protect themselves by avoiding downloads from sketchy websites or clicking suspicious ads. If a deal seems too good to be true, it typically is.

Related Content:

• Are Security Concerns Over Trump’s Android, Twitter Use Overblown?
• What To Watch For With Ransomware: 2017 Edition
• Most Companies Still Willing To Pay Ransom To Recover Data, Survey Shows
• How I Would Hack Your Network (If I Woke Up Evil)

Kelly is an associate editor for InformationWeek. She most recently reported on financial tech for Insurance Technology, before which she was a staff writer for InformationWeek and InformationWeek Education. When she’s not catching up on the latest in tech, Kelly enjoys … View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/netflix-scam-spreads-ransomware/d/d-id/1328012?_mc=RSS_DR_EDT

Voice-activated, internet-connected personal assistants are all the rage these days. Ask a group of friends what they got for Christmas and at least one will tell you how much they love their new Amazon Echo, Google Home or some equivalent.

This piece of smart home technology is a beautiful thing. But like all good things, there are risks.

Tomorrow is Data Privacy Day, an appropriate time to review those risks – and what users can do to protect their sensitive information.

Your technology is listening

The main concern among security experts when it comes to smart home devices is the degree to which they are listening. They obviously listen for any commands the user might utter, but what else is it taking in, and how could that put privacy at risk?

A murder case in Arkansas makes for an interesting case study.

Arkansas police are hoping that an Amazon Echo found at a murder scene in Bentonville will help them with their investigation into the death of a man strangled in a hot tub.

The Echo answers to the name of Alexa and will play music and answer simple questions on voice command. It also records what you say and sends that recording to a server.

While Amazon’s smart assistant only records what’s said to it after it’s triggered by someone saying “Alexa”, police are hoping that the devices’ habit of piping up in response to a radio or TV might mean it inadvertently recorded something that might be of use to them.

But like other tech retailers, Amazon has resisted pressure to hand over this kind of customer information to law enforcement. Amazon stores voice recordings from the Echo on its servers to improve its services, but the Seattle-based company, which has apparently released the account details of the alleged attacker to police, has declined to provide the voice recordings they are seeking via a search warrant.

Though it remains unclear if this particular Echo recorded anything useful, the case raises a bigger question: with Echo/Alexa, Siri, Cortana and Google’s Home assistant in many homes these days, and knowing that some of the technology is listening and recording, who might be able to exploit that?

In this case law enforcement wants to access a device. But in the future, it may be hackers looking to have a listen.

Lessons from the Dyn attack

Personal assistants fit into the larger concept of the smart home, so it’s useful to look at threats that have already targeted Internet of Things (IoT) devices.

Security experts have long predicted threats targeting everyday home devices connected to the internet, and the threat was made plain last fall when Mirai malware was used to hijack internet-facing webcams and other devices into massive botnets that were then used to launch a coordinated assault against Dyn, one of several companies hosting the the Domain Name System (DNS). That attack crippled such major sites as Twitter, Paypal, Netflix and Reddit.

To be clear, that attack infected IoT devices and used them to target a company. It’s not the same as being snooped on, but in many cases the end goal is on the same wavelength: the bad guys want to see or hear what you have for personal data so they can use the information to benefit themselves or their cause.

A few short years ago, IoT attacks were discussed as some potential threat in a distant future. Now they are real. To some experts, it’s only a matter of time before hijacked personal assistants become a clear and present danger.

Defensive measures

Those who choose to use this technology can’t and shouldn’t expect 100% privacy. If not for the ability of Amazon Echo and Google Home to listen, these things would become nothing more than doorstoppers and paperweights.

But there are certainly things users can do to limit the risk of unintended consequences. Here are just a few examples:

• Not currently using your Echo? Mute it The mute/unmute button is right on top of the device. The “always listening” microphone will shut off until you’re ready to turn it back on.
• Don’t connect sensitive accounts to Echo On more than a few occasions,  daisy chaining multiple accounts together has ended in tears for the user.
• Erase old recordings If you use an Echo, then surely you have an Amazon account. If you go on Amazon’s website and look under “Manage my device” there’s a handy dashboard where you can delete individual queries or clear the entire search history.
• Tighten those Google settings If you use Google Home, you’re already aware of the search giant’s appetite for data collection. But Google does offer tools to tighten things up. Like the Echo, Home has a mute button and a settings page online, where you can grant or take away various permissions.

Follow @NakedSecurity
Follow @BillBrenner70

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/M9lRpy5oVv4/

Sophos Security Chet Chat – Episode 257 – Jan 27, 2017

Join Sophos security experts Chester Wisniewsi and Paul Ducklin for the latest episode of our regular security podcast.

In this episode

• [00’45”] Cisco WebEx code execution hole – what you need to know
• [06’04”] Android Pattern Lock can be cracked in five attempts
• [09’43”] World’s most popular email server ‘near impenetrable’
• [12’11”] The return of the Cyber Squirrel
• [15’00”] Data Privacy Day 2017
• [18’27”] Get a free Expo Pass for RSA 2017 (code XS7SWPHSS)

If you enjoy the podcast, please share it with other people interested in security and privacy and give us a vote on iTunes and other podcasting directories.

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/PSxi2jI1_gc/

Nothing like a little remote monitoring software to see who’s got their mitts on your stolen laptop, eh?

…or to log into that person’s Facebook page, discover all her phone numbers, find her friends’ lists and photos, read her past chats, and contact one of her chat buddies to inform them that their friend was about to become very famous indeed.

(Please don’t do that. Yes, you’re a victim of theft, but it’s still an invasion of privacy.)

That’s what happened to Stu Gale, from the Canadian town of Cochrane, in Alberta.

As reported by CTV News Calgary,  somebody stole a truck on January 16. Then someone stole Gale’s laptop from his car, which was parked nearby.

And thus the game was on. Gale remoted into his laptop, where he found that a woman was using his laptop to log in to her Facebook account.

Eventually, she wandered away. That’s when Gale had a chance to snoop through her profile and get her personal information and give one of her friends a call. CTV News Calgary quotes Gale:

I went through and got her phone numbers, friends list and pictures, and while I was doing that, two [chat] conversations started. I called one of them and told her [that the person in possession of his computer] was on a stolen laptop and told her I’d give [that person] the opportunity to return it.

Gale didn’t stop there. He also sent text messages to all the phone numbers he found on her Facebook account, saying that he planned to report the woman to the police.

He also left a note for the woman, presumably on her Facebook page. He went on to post her information to a number of Facebook groups. She reportedly shut down the computer when she came back to the room. She also deleted her Facebook account.

You’ll notice, if you look at the news coverage of this vengeance piece, that the woman is being referred to as a “thief”.

She’s been convicted without a trial. Unfortunately, it’s the kind of assumption that sparks virtual mobs carrying torches to burn people who should be considered innocent until proved guilty. This woman, regardless of how red-handed she appears to be, could in fact turn out to be innocent.

After all, just because somebody’s got your stuff doesn’t mean they stole it. All it might mean is that…

• They’re a thief,
• They bought stolen goods from a thief,
• They found it, or …
• A thief gifted them with the loot and they might not even be aware it was stolen.

If you want to emulate Gale by tracking stolen gadgets, best be careful. It’s far too easy to break privacy laws by accessing people’s private accounts.

Tom Keenan, a computer security expert at the University of Calgary, had this to say to CTV News Calgary about the legal ramifications of publishing such people’s information:

If you take somebody’s Facebook and you repost it, that’s a form of privacy invasion. You really do need to think about what you’re doing. Probably a better idea to take it to law enforcement.

In other words, just because we’ve been victimized by a thief doesn’t exonerate us from the crime of privacy invasion.

At any rate, Gale did in fact take the information he collected from the woman’s Facebook page and handed it over to local police.

RCMP said that they’re confident they’ll catch the thief, according to CTV News Calgary.

Follow @NakedSecurity
Follow @LisaVaas

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ZtABmZk5cl4/

How much privacy does the US government promise to outsiders? Less today than before Donald Trump took power. Section 14 of Trump’s new Executive Order: Enhancing Public Safety in the Interior of the United States requires federal agencies, “to the extent consistent with applicable law,” to “ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information”.

Trump’s Executive Order aims to strengthen enforcement of immigration laws, but nothing in Section 14 appears to limit its use to individuals attempting to enter the US: it could easily refer to all personally identifiable data the US government can lay hands on, excluding data about US citizens and lawful permanent residents.

So, when the order was first publicized, Edward Snowden’s first reaction was that Trump was “suspend[ing the] legal framework enabling the US-EU data-sharing pact (#PrivacyShield)”.

German Green MEP Jan Philipp Albrecht quickly responded: “If this is true @EU_Commission has to immediately suspend #PrivacyShield sanction the US for breaking EU-US umbrella agreement.” Uproars quickly ensued among both privacy and international business communities.

Four days later, however, the story seems a bit more nuanced… maybe.

Remember what Privacy Shield is: a recently negotiated agreement between the US and EU (and separately, Switzerland) to “provide companies on both sides of the Atlantic with a mechanism to comply with data protection requirements when transferring personal data… to the US. in support of transatlantic commerce”. As TechCrunch writes, Privacy Shield promised to give Europeans “essentially equivalent” privacy protection whether their data was stored in the EU or the US.

Privacy Shield became necessary after the EU’s Court of Justice ruled that older “Safe Harbour” rules didn’t adequately protect EU residents’ privacy. The court stated, among other things, that:

… national security, public interest and law enforcement requirements of the United States prevail over the safe harbour scheme, so that United States undertakings are bound to disregard, without limitation, the protective rules laid down by that scheme where they conflict with such requirements.

Given the court’s language, it’s no surprise privacy advocates instantly feared Trump’s new executive order would override Privacy Shield. But a closer look suggests that this might not be the case – at least not yet. As reported by PC World, a European Commission spokeswoman pointed out that as part of the deal, the US Congress adopted “the US Judicial Redress Act, which extends the benefits of the US Privacy Act to Europeans and gives them access to US courts”. That law, says the EC, is still at work protecting Europeans’ data as it sojourns in the States.

Just before the Obama administration left office, its Justice Department gave notice of new regulations that will implement the Judicial Redress Act by extending Privacy Act protections to 26 European countries. These rules are set to go into effect February 1. Nobody’s said otherwise. (Yet!)

Want to get even further down into the weeds on this? Check out Lawfare’s ongoing discussion/debate on the meaning of Trump’s ambiguous executive order.

Ready to climb out of the weeds? Here are a few bigger-picture thoughts:

• Privacy Shield is focused on data transfers between EU and US, and doesn’t protect any of the rest of the world’s juicy, surveillable data.
• As Snowden tweeted in response to a question from Forbes , “EU-US [Data Protection] is more than [Privacy Shield]… The problem is bulk collection combined with lack of enforceable regs.”
• Privacy Shield faces its own privacy-related legal challenges inside the UK. Until recently, says TechCrunch, the EC has “professed itself satisfied with ‘assurances’ secured from the Obama administration”. If “Obamassurances” become inoperable, Privacy Shield may become tough for EU authorities to defend.
• Besides the US Privacy Act, other US regulations relate to foreigners’ data privacy (for example, Obama’s PPD-28 establishing principles for balancing intelligence data collection with non-citizen privacy). Will Trump’s new order impact these? Nobody knows for sure.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Bz65Q2DviKU/