STE WILLIAMS

Brighton perv cops community service for ‘hacking’ women’s Facebook accounts

A man who hacked women’s Facebook accounts to steal their intimate images has been ordered to carry out 200 hours’ unpaid work after admitting three criminal charges under the Computer Misuse Act.

The Worthing Herald reported that Kieren Kennedy, of Montpelier Place in Brighton, “caused a very significant level of distress” to three women in Worthing.

Prosecutor Francesca Baynham said: “[Kennedy] disclosed that he had obtained certain photographs of [women] and the nature of those photographs were of these women in a state of undress. He disclosed to his friend that he was able to obtain these images by accessing Facebook accounts.”

His crimes were committed in January 2018, Worthing Magistrates’ Court heard. Kennedy had no previous convictions.

He was sentenced on Friday to 200 hours’ community service, ordered to pay £600 compensation and £85 in court costs, as well as being hit with an £85 victim surcharge tax. He is now the subject of a sexual harm prevention order (SHPO) for the next five years and must attend the Horizon sex offenders’ rehab programme.

A leaflet (PDF) published by the Prison Reform Trust gives more information on SHPOs and the Horizon programme.

Another day, another conviction

Although public reporting gives very few details of whatever “hacking” Kennedy carried out to access his victims’ social media accounts, the use of the Computer Misuse Act (CMA) to prosecute him marks how the Act is increasingly being deployed by prosecutors.

Last year the Information Commissioner’s Office used the CMA to convict a car repairman who illegally took customer details with him when he changed job. Also last year, a Santander bank manager pleaded guilty after being caught passing customers’ details to her boyfriend for him to carry out financial frauds.

More recently, a London police worker was found guilty under the CMA of illegally monitoring an internal police investigation into his own misconduct – though he remained employed by the Metropolitan Police.

Prison is generally unlikely for someone convicted of a CMA offence, as a recent analysis by The Register showed.

NCC Group and other UK infosec companies have started a campaign to reform the CMA in order to draw a clearer line between black-hat hackers, be they like Kennedy above or like Talktalk hacker teen Elliott Gunton, and responsible information security practices by industry actors. ®

Sponsored:
How to get more from MicroStrategy by optimising your data stack

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/10/01/kieren_kennedy_brighton_facebook_computer_misuse/

Stop us if you’ve heard this one before: Yet another critical flaw threatens Exim servers

Amins of Linux and Unix boxes running Exim would be well-advised to update the software following the disclosure of another critical security flaw.

The Exim 4.92.3 patch, released on September 28th, includes a fix to close up the CVE-2019-16928 flaw.

Discovered by bug-hunters with the QAX A-Team, the vulnerability is caused by a buffer overflow error that occurs when Exim processes an extremely long string in an Extended HELO (EHLO) Extended Simple Mail Transfer Protocol (ESMTP) command message.

In practice, an attacker could write an exploit into the EHLO message and remotely trigger the bug to get control over the targeted server. So far, no active attacks on the flaw have been reported in the wild.

“It’s a simple coding error, not growing a string by enough,” said Jeremy Harris, the Exim dev who patched the flaw in what he described as a simple “one-line fix.”

A treasure map with an X marking the spot

Exim marks the spot… of remote code execution: Patch due out today for ‘give me root’ flaw in mail server

READ MORE

Debian and Ubuntu have already posted updates to address the bug in their respective distros, so most admins should be able to get a fixed Exim build through their package managers. Interestingly, the flaw is only present in Exim 4.92 and later, so boxes that still use 4.91 or earlier are not vulnerable.

The update arrives just a few weeks after Exim was patched for another critical RCE bug. That flaw, designated CVE-2019-15846, would have allowed a remote attacker to run code and commands with root level privileges.

While not particularly well known, Exim is an extremely common component for Unix and Linux servers and workstations where it is used as a message transfer agent (MTA) to handle emails.

Thanks to the advent of Shodan and other IP-crawling tools, it has been shown that there are millions of internet-facing that use Exim, making the software an attractive target for exploits. ®

Sponsored:
Your Guide to Becoming Truly Data-Driven with Unrivalled Data Analytics Performance

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/30/critical_flaw_exim/

Microsoft Announces Ability to Force TLS Version Compliance

Transport Layer Security (TLS) can be critical for security, but it must be deployed in a current version. Microsoft now provides a mechanism for administrators to guarantee the right version in their network.

Transport Layer Security (TLS) is an important network security component with a critical caveat: TLS 1.0, introduced in 1999, has been deprecated and is no longer considered secure. TLS 1.3 is the current version, though millions are still using TLS 1.2. Now, Microsoft has introduced TLS version enforcement on Windows Server 2019 in a move that should help companies avoid inadvertently deploying TLS 1.0.

According to Microsoft, beginning with KB4490481, Windows Server 2019 allows customers to block weak TLS versions from being used with individual customer-designated certificates. The feature, called “Disable Legacy TLS,” allows administrators to enforce a minimum TLS version and cipher suite for any certificate in use.

If administrators are worried about their customers or users that may still be deploying TLS 1.0, they can divide the traffic by TLS version, with one stream using TLS 1.2 or higher and the other using TLS 1.0, and both streams going to destinations on a single server.

For more, read here and here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The Etiquette of Respecting Privacy in the Age of IoT.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/microsoft-announces-ability-to-force-tls-version-compliance/d/d-id/1335955?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Holy smokes! Ex-IT admin gets two years prison for trashing Army chaplains’ servers

A former system admin for a US Army contractor has been sentenced to two years behind bars for trashing his employer’s network on his way out the door.

Barrence Anthony, 40, of Waldorf, Maryland, was given the sentence by US District Judge Leonie Brinkema in the Eastern District of Virginia court after pleading guilty to one count of accessing a protected computer without authorization.

In December of 2016, Anthony learned his job with government contractor Federated IT was soon to be terminated. Anthony, who had been assigned as an administrator for a series of AWS servers managed for the US Army Chaplain Corps, responded by removing all admin accounts apart from his own and having DNS registration transferred to his name.

This resulted in an outage of the Army’s Chaplain Corps Religious Support System as pastoral staff were unable to log into the portal and students were locked out of training materials.

Anthony went on to delete critical project files from the server, including network diagrams and login information for the AWS accounts, while also making backups of the machine’s data for his personal use. In the following weeks it is said that Anthony, who by now had been terminated, also launched a series of denial of service attacks against the Army’s AWS servers to further disrupt the portal.

Train crash

Rogue IT admin goes off the rails, shuts down Canadian train switches

READ MORE

“He specifically targeted his actions to do harm to one of the company’s most lucrative contracts with the US Army Chaplain Corps,” the DOJ said in announcing the two-year sentence.

“The proprietary information that Anthony took was specifically built for the US Army Chaplain Corps and the victim company assigned it a value of over $1m. The cyber sabotage also disrupted a Chaplaincy Resource Management Course in Jackson, South Carolina, impacting 19 chaplain corps students.”

Anthony’s legal team countered that while he did make backups of the data, he never used that information and the $1m estimate for damage caused was overblown. They also noted that well into 2017, long after he had left the company, Federated left Anthony’s access rights to the AWS servers active, without any further incidents occurring.

In addition to two years with credit for time served, Anthony has been ordered to pay Federated IT $49,233.09 in restitution and will get three years supervised release once he is out of prison. ®

Sponsored:
What next after Netezza?

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/30/army_chaplain_admin_jailed/

Baltimore Reportedly Had No Data Backup Process for Many Systems

City lost key data in a ransomware attack earlier this year that’s already cost more than $18.2 million in recovery and related expenses.

The government of Baltimore reportedly lost a lot of key data in ransomware attacks earlier this year because it did not have basic policies for backing up employee systems.

A new audit has shown that prior to the attack, at least, the only copies of critical data that the city had in many instances was what was stored on user systems, the Baltimore Sun reported Friday.

Despite concerns over damaging ransomware attacks, Baltimore’s IT department had no cloud backup or other data-recovery mechanisms in place. Many employees were simply saving files to their local computer drives with no other copies of the data existing anywhere else. As a result, when attackers encrypted data on those systems during the ransomware attack, the city had no way of recovering it.

The newspaper quoted one city councilman as expressing disbelief over what had happened. “Wow. That’s mind-boggling to me,” the Sun quoted city Councilman Eric Costello as saying. “They’re the agency that should be tasked with educating people that that’s a problem.”

Baltimore’s office of information technology did not immediately respond to a Dark Reading request for comment on the findings of the new audit.

Baltimore is one of several municipal governments that have been hit with ransomware attacks this year. The May 7 attack on the city disrupted multiple critical services and forced several operations into manual mode. The services that were affected included real estate transactions, online bill payments, telecommunication, and email.

The attackers demanded the equivalent of over $76,000 in bitcoin as ransom for decrypting the encrypted data. But city officials refused to accede to the demand and instead set out on recovering data and systems on their own.

By early July, Baltimore had already spent over $5 million on recovery. Of that, $2.8 million was on forensic analysis and detection; nearly $600,000 on technicians to deploy new systems, to replace hard drives or in staff overtime; and another $1.9 million on new hardware and software related to ransomware recovery.

The city has said it expects to spend some $10 million in response and recovery efforts this year alone. The Sun and several other news sources have also quoted city officials as saying Baltimore will lose at least an additional $8.2 million in revenues from property taxes, fines, and real estate fees.

Fundamental Oversight
Baltimore is by far not the first entity impacted in this manner after a ransomware attack, nor is it likely to be the last. Scores of organizations over the past year have either lost data or been forced into making substantial payments to recover it after a ransomware attack because they did not have proper backups or did not want to spend the time and effort on self-recovery.

Such incidents have highlighted the criticality of proper data backup and disaster recovery planning. Mark Chaplin, principal at the Information Security Forum says formal data restoration measures are a fundamental precaution for organizations these days.

“With so much attention on ransomware as a prevalent method of attack, lack of backup represents a significant oversight that could so easily be avoided,” he notes. “Backup, like secure builds, patch management, and access control, [are] a fundamental security measure required for cybersecurity hygiene.”

Cost can be a challenge for organizations when planning for data recovery scenarios, he admits. Legal and regulatory obligations such as those related to the EU’s General Data Protection Regulation can also present difficulties when it comes to backing up and archiving data, but should not be an excuse for not doing so, Chaplin says. “Backup can be challenging on a large scale, but as a basic security measure it should be at, or near, the top of the list. Ignore at your peril,” he cautions.

Terence Jackson, CISO at Thycotic, says a good disaster recovery and business continuity plan should include well-defined policies and procedures. Organizations need to conduct tabletop exercises at least once a year to ensure their plan is effective. Relationships with vendors, insurance companies, forensic firms, and law enforcement should also be established in plan development.

“In the event of a ransomware attack, an organization should be able to detect the event, isolate the endpoints effected to stop the further spread, and be able to recover any data that may have been destroyed,” says Jackson. On-site and off-site backup strategies should be implemented to prevent damage to data recovery efforts and enforcing least privilege will also stop some processes from executing.

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The Etiquette of Respecting Privacy in the Age of IoT.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/baltimore-reportedly-had-no-data-backup-process-for-many-systems/d/d-id/1335953?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Is the era of social media Likes over?

Cast your mind back to 2014, and you might recall Mark Zuckerberg mulling the public’s desire to have a “dislike” button on Facebook.

During a public QA, the CEO presented button semantics as being something like a Marvel comics battle between good and evil, with the Like button presumably being, to his mind, a “force for good”:

There’s something that’s just so simple about the ‘like’ button’ … but giving people more ways of expressing more emotions would be powerful. We need to figure out the right way to do it so it ends up being a force for good, not a force for bad and demeaning the posts that people are putting out there.

But now, as a mounting body of research points to the number of content Likes – or lack thereof – negatively influencing some users’ self-esteem, it may be time to question whether the Like button might have turned out to be a force for bad.

Recent studies have linked increased depression, poor sleeping habits, and unhealthy body image in children and teens with higher use of social media and digital devices.

To address the mess they’ve made, at this point, Instagram – which a 2017 study found to be the worst social media app for young people’s mental health – and Facebook are taking a serious look at the possibility of doing away with Likes.

In April 2019, Instagram announced that it was running a test in Canada: it was hiding Like counts on some users’ photos and videos as an experiment to try to lessen competitiveness on the platform.

The idea: to make us feel less envious, less ashamed, and more focused on self-expression rather than like we’re vying in a personality competition. It’s all about getting people to focus on the content they share, not the likes, a spokesperson said when news about the test was announced at F8, Facebook’s annual developers conference:

We are testing this because we want your followers to focus on the photos and videos you share, not how many likes they get.

And now, three months later, Facebook itself has begun its own test: it’s removing public visibility of Like, reaction and video view counts from people’s posts and ads across Facebook. The test is only happening in Australia: Facebook told Engadget that it hasn’t decided whether to expand the test to other places in the future. Before it decides what to do next, it wants to see how the Australia test goes, Engadget reports.

While Instagram hasn’t shared the results of its Canada test yet, it can’t have gone all that poorly. In July, it expanded the Like hiding to select users in six additional countries: Australia, Brazil, Ireland, Italy, Japan and New Zealand.

The users selected to be a part of the experiment were presented with a banner notifying them about the test. This is what is says:

We want your followers to focus on what you share, not how many likes your posts get. During this test, only you will be able to see the total number of likes on your posts.

While likes get submerged from public view, they’re still viewable to the users in the test. Instagram shared a sample image with a line below the post that reads “Liked by [user] and others.”

Are these moves signaling an end to the era of social media Likes? If so, will anybody miss them?

Yes. There are influencers who’ve made careers out of posting content that racks up copious Likes. CNN Business points to one such, Sam McAllister: a 23-year-old photographer whose gorgeous photos pull in thousands of Likes. He doesn’t have a huge number of followers, but with well-Liked photos like this aerial view of Venice canals, he’s managed to get paying campaigns for companies such as airline Aer Lingus and an energy drink maker.

The loss of Likes could be a game-changer for talented newcomers who don’t already have big followings. McAllister told CNN Business that it might not work out well for him:

The fact that my posts are massively engaged has paid off for me. My main concern right now is that the number of followers a user has now defaults to be the main metric.

Another group that stands to lose out if Likes die off: companies that make millions by selling fake likes, followers and retweets to celebrities, businesses or anyone who wants to puff themselves up online.

One thing’s for sure: If Likes get to the chopping block, it’s going to be a lot easier to feel for content creators like McAllister. But in the best possible case scenario, there will be ample benefits to offset that: less competition, less posts removed by users too embarrassed to leave them up in the face of scanty Likes, less ruined self-esteem.

Unfortunately, there are plenty of ways to cyberbully on social media. There are many ways to ruin people’s self esteem besides not Liking their posts. But let’s give credit where credit’s due: the platforms are trying to fix at least one aspect of the tangled milieu they created.

After working so hard to get us addicted to the dopamine hits those Likes have been injecting for lo, these 10 years, it’s the least they can do.

I say thumbs-down on the Like button. Readers, are you with me?

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/OX4X4nRKm0M/

Outlook on the web bans a further 38 file types

News for Outlook on the web users who regularly email attachments: Microsoft is about to put another 38 file extensions on its too risky to receive blocklist.

Once there – implemented through Outlook’s BlockedFileTypes filter – Outlook for the web recipients will no longer be able to receive attachments using these extensions.

Microsoft already restricts 104 file extensions and, in truth, the 38 added to this list aren’t ones most Outlook for the web users will have need to send often, assuming they’ve heard of some of them at all.

The better-known extensions on the latest list are:

Python.py, .pyc, .pyo, .pyw, .pyz, .pyzw

PowerShell.ps1, .ps1xml, .ps2, .ps2xml, .psc1, .psc2, .psd1, .psdm1, .psd1, .psdm1, .cdxml, .pssc

Java.jar, .jnlp

Digital certificates.cer, .crt, .der

And some less well-known ones:

Windows ClickOnce.appref-ms

Microsoft Data Access Components (MDAC).udl

Windows sandbox.wsb

Vulnerable legacy applications.appcontent-ms, .settingcontent-ms, .cnt, .hpj, .website, .webpnp, .mcf, .printerexport, .pl, .theme, .vbp, .xbap, .xll, .xnk, .msu, .diagcab, .grp

The reason for the move is security.  Attachments, including obscure ones, have long been a popular technique for sneaking malware past inbox security checks when widely used extensions such .docx and .pdf became too obvious.

Outlook’s 142-strong blocklist opens even more clear water between itself and Google whose current Gmail GSuite blocklist contains only the following 44 extensions:

.ade, .adp, .apk, .appx, .appxbundle, .bat, .cab, .chm, .cmd, .com, .cpl, .dll, .dmg, .exe, .hta, .ins, .isp, .iso, .jar, .js, .jse, .lib, .lnk, .mde, .msc, .msi, .msix, .msixbundle, .msp, .mst, .nsh, .pif, .ps1, .scr, .sct, .shb, .sys, .vb, .vbe, .vbs, .vxd, .wsc, .wsf, .wsh

The restriction on Java .js and .jse having been implemented as recently as February 2017.

Bypassing blocking

What happens if there is a genuine need to receive files with a banned extension?

Assuming the sender and recipient aren’t able to use a different email system, the easiest way is for Office 365, Exchange Server, or Exchange Online admins to allowlist specific extensions.

In a strange anomaly, one file extension not on the blocklist is .ace, a compressed WinRAR file format which earlier this year was discovered to have a 19-year-old flaw (CVE-2018-20250) cybercriminals had started exploiting.

Although not discovered by Microsoft, the company was prominent in warning users about the threat posed by malicious files using this file extension.

It’s true that admins can configure Exchange/Outlook to block this extension, but wouldn’t it have been easier to do it by default?

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/9PAQW38fA1c/

Social media manipulation as a political tool is spreading

Social media manipulation is getting worse: as more governments use it to manipulate public opinion, it’s becoming a rising threat to democracy, according to a new report from the Oxford Internet Institute.

There’s nothing new about political parties and governments using propaganda, but the new normal includes toxic messaging that’s easy to spread on a global scale with the brawny new tools for targeting and amplification, they said.

According to the University of Oxford’s Computational Propaganda Research Project, the use of algorithms, automation, and big data to shape public opinion – i.e. computational propaganda – is becoming “a pervasive and ubiquitous part of everyday life.”

For its third annual report, the project examined what it calls “cyber troop” activity in 70 countries. Cyber troops is the collective term for government or political party actors that use social media to manipulate public opinion, harass dissidents, attack political opponents or spread polarizing messages meant to divide societies, among other things.

Over the past two years, there’s been a 150% increase in the number of countries using social media to launch manipulation campaigns, the project found.

The use of computational propaganda to shape public attitudes via social media has become mainstream, extending far beyond the actions of a few bad actors. In an information environment characterized by high volumes of information and limited levels of user attention and trust, the tools and techniques of computational propaganda are becoming a common – and arguably essential – part of digital campaigning and public diplomacy.

What accounts for the growth?

Part of the growth can be attributed to observers getting more sophisticated when it comes to identifying and reporting such manipulation campaigns, given digital tools and a more precise vocabulary to describe the cyber troop activity they uncover, the researchers said.

The researchers say that some of the growth also comes from countries new to social media that are experimenting with the tools and techniques of computational propaganda during elections or as a new tool of information control.

Their favorite online platforms

The researchers found evidence that 56 countries are running cyber troop campaigns on Facebook. That makes it once again the No. 1 platform for such activity, the researchers found, due to its market size – it’s one of the world’s largest social network platforms – as well as its reach, with the ability to influence not only target audiences, but also their networks, including close family and friends. Facebook also works well as a propaganda tool due to its dissemination of political news and information, and the ability to form groups and pages.

In response to media inquiries about the report, Facebook said that showing users accurate information is a “major priority” for the company. From a spokesperson:

We’ve developed smarter tools, greater transparency, and stronger partnerships to better identify emerging threats, stop bad actors, and reduce the spread of misinformation on Facebook, Instagram and WhatsApp.

Over the past year, the project has also seen cyber troop activity growing on image- and video-sharing platforms such as Instagram and YouTube, as well as on WhatsApp. The researchers believe that in the next few years, political communications will grow on these visual platforms.

Samantha Bradshaw, one of the report’s authors, told Reuters that on platforms like these, users are seeing fake news that’s delivered in quick, easily digestible hits that don’t strain the brain:

On Instagram and YouTube it’s about the evolving nature of fake news – now there are fewer text-based websites sharing articles and it’s more about video with quick, consumable content.

It’s difficult to police visual content

Bradshaw said that the move to visual content as a propaganda tool will make it tougher for platforms to automatically identify and delete this kind of material. Unfortunately, we can’t rely on users to report even horrific videos, let alone visual content that’s merely misleading or biased.

The Christchurch, New Zealand terrorist attack in March is an example of what type of material can flow freely on social media. Facebook said in a statement that it took 29 minutes and thousands of views before it was finally reported and ultimately removed.

During that time, the video was repeatedly shared and uploaded across even more platforms.

Bradshaw:

It’s easier to automatically analyze words than it is an image. And images are often more powerful than words with more potential to go viral.

Strategies, tools, techniques

Over the past three years, the researchers have been tracking the use of three types of fake accounts used in computational propaganda campaigns: bot, human, and cyborg. Bots, highly automated accounts designed to mimic human behavior online, are often used to amplify narratives or drown out political dissent, they said. They found evidence of bot accounts being used in 50 of the 70 countries they tracked.

They found that humans are behind even more fake accounts, though. Such accounts engage in conversations by posting comments or tweets, or by private messaging people. These accounts were found in 60 out of the 70 countries covered in this year’s report. The third type of fake account, cyborg accounts, is a hybrid that blends automation with human curation.

This year, the project added a fourth type of fake account: hacked or stolen ones. They’re not fake, per se, but high-profile accounts with a wide reach are attractive to hijackers. Such accounts are used strategically to spread pro-government propaganda or to censor freedom of speech by revoking access to the account by its rightful owner, the researchers say.

Some key findings from the report:

  • 87% of countries use human-controlled accounts
  • 80% of countries use bot accounts
  • 11% of countries use cyborg accounts
  • 7% of countries use hacked/stolen accounts
  • 71% of these accounts spread pro-government or pro-party propaganda
  • 89% attack the opposition or mount smear campaigns
  • 34% spread polarizing messages designed to drive divisions within society
  • 75% of countries used disinformation and media manipulation to mislead users
  • 68% of countries use state-sponsored trolling to target political dissidents, the opposition or journalists
  • 73% amplify messages and content by flooding hashtags

As far as communication strategies go, the most common is disinformation or manipulated media – a more nuanced term for what we’ve been referring to as fake news. The report found that in 52 out of the 70 examined countries, cyber propagandists cooked up memes, videos, fake news websites or manipulated media in order to mislead users. In order to target specific communities with the disinformation, they’d buy ads on social media.

Trolling, doxxing and harassment are also a growing problem. In 2018, 27 countries were using state-sponsored trolls to attack political opponents or activists via social media. This year, it’s up to 47 countries.

Other tools of repression include censorship through the mass-reporting of content or accounts.

What to do?

It’s a tough nut to crack. The report doesn’t mention how you might spot, block or ignore manipulation, but it does say that we can’t blame social media for what’s happening. Democracy was starting to fall apart before social media blossomed, the researchers said:

Many of the issues at the heart of computational propaganda – polarization, distrust or the decline of democracy – have existed long before social media and even the Internet itself. The co-option of social media technologies should cause concern for democracies around the world – but so should many of the long-standing challenges facing democratic societies.

For strong democracies to flourish, we need “access to high-quality information and an ability for citizens to come together to debate, discuss, deliberate, empathize, and make concessions,” the researchers assert. In these times, we currently turn to social media to stay current. But are the platforms up to the task?

Are social media platforms really creating a space for public deliberation and democracy? Or are they amplifying content that keeps citizens addicted, disinformed, and angry?

Start them young

While the Oxford University researchers didn’t delve into methods to spot fake news, others are working on it. For example, in June 2019, Google launched an initiative to help train kids to spot fake news.

The lesson plans are designed to keep kids safe and to be better online citizens, teaching them how to scrutinize emails and text messages to try and spot phishers, how to respond to suspicious messages to verify the sender’s identity, and other techniques that come in handy at shielding people from the mental warfare of cyber troops: how to spot and interact with chatbots, how to use criteria like motive and expertise to establish credibility when evaluating sources, spotting fake URLs and evaluating headlines.

Google’s initiative – part of its Be Internet Awesome initiative – is part of a broader effort to stop the spread of fake news. Earlier this year, it also released fact-checking tools for journalists to tag stories that debunk misinformation. Mozilla also has its own fake news-fighting effort.

And if the social media platforms and other internet giants can’t work this out, and if all else fails, at least we have mice.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/-Wc88WInp-I/

Checkm8 jailbreak and AltStore put cracks in Apple’s walled garden

Jailbreaking iPhones has become a lot harder with each new version of the hardware, but this weekend saw two new announcements that enable people to install apps on their phones. One of them is a traditional jailbreak, while the other is an alternative app store that uses a loophole in Apple’s code-signing process.

Jailbreaking is a form of privilege escalation. Hackers figure out ways to change the operating system kernel, unlocking features that Apple had locked down. One of its most common uses is to install apps that Apple doesn’t allow into its app store because they fall outside the company’s strict developer review policy.

On Twitter last Friday, iOS security researcher @axi0mX released a jailbreak bug that affected devices from Apple’s iPhone X all the back to the iPhone 4S running Apple’s A5 chip, which the company released in 2011. It doesn’t hit the iPhone 11 family announced this month, powered by the company’s new A13 chip.

The code, released on GitHub for free, relies on a race condition in Apple’s bootrom. This is the first piece of hardware that the iPhone loads code from when it is turned on, and it’s a read-only part of the hardware that Apple can’t patch.

To prove the point, @axi0mX also tweeted a video of an iPhone booting in verbose mode, using the latest iOS 13.1.1 version. They labelled the jailbreak checkm8, and said that it is a “permanent unpatchable bootrom exploit for hundreds of millions of iOS devices.”

There are some limitations. It isn’t a persistent jailbreak, because it only works in memory. That means you must run it each time the phone boots up. Neither does it work remotely. You must execute it by booting the phone into Device Firmware Update (DFU) mode and tethering it to another computer. Finally, it doesn’t break Touch ID or Apple’s Secure Enclave (the encrypted chip inside the iPhone which holds its most valuable secrets). All this means that it isn’t that useful for companies wanting to steal data from iPhones.

Nevertheless, the code will help researchers to develop their own jailbreaks, the hacker said. It will also make it easier for developers to find bugs in various versions of iOS because they will be able to probe more deeply into phones without obtaining special developer versions distributed by Apple on a limited basis.

Company launches alternative app store

Another developer, USC student Riley Testut, took a different tack to get around Apple’s tightly controlled phone rules by publishing AltStore, an alternative app store for non-jailbroken devices.

Apple only allows people to install apps approved by its own app store, with the exception of companies granted enterprise certificates, which allow their own employees to install their custom apps.

Testut’s system relies on an Apple policy that allows users to install their own apps using their own Apple ID.

Users first install a program called AltServer on their computer, which then controls the iPhone via the iTunes wireless sync capability. It uses the owner’s Apple ID to register first the AltStore app on the phone, and then other unapproved apps that the user wants to install. Testut explained:

…since there’s no single enterprise certificate to revoke (because technically every user now has their own developer certificate using this process), Apple can’t simply shut it down with the press of a button like they have with some 3rd party app stores

The app has to perform some workarounds. Apple only allows apps installed with a user’s Apple ID to work for seven days before renewing them, so AltServer renews the apps on your behalf (which means you have to sync with AltServer at least once per week).

Apple also only lets three apps signed by the iPhone’s owner on the phone at any time, and it does this by checking for files called provisioning profiles when you install a new app. AltServer gets around this by removing all the other unapproved apps’ provisioning profiles when you want to add a new app, and then putting the other profiles back. Because Apple only checks for these profiles when installing an app, AltServer can use this technique to install as many apps as it likes.

It seems as though Testut has found a viable way to get apps onto the phone without jailbreaking them, although Apple could limit his system’s abilities by changing the way it checks for provisioning profiles. @axi0mX’s discovery promises to be a lot more concerning for the phone manufacturer. As Shahar Tal, VP of research in the security research labs at Cellebrite (which unlocks iPhones for law enforcement ) put it:

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/wSp7NxeUhpU/

Thanks-thanks to TalkTalk teen hacker: UK cops’ first auction of ill-gotten Bitcoin nets £240k

British cops have raised £240,000 in their first ever UK-based auction of cryptocurrencies understood to have been seized from former TalkTalk hacker Elliot Gunton , who’d “earned” it selling hacking services and flogging people’s stolen personal details online.

The sell-off of Bitcoin, Ripple and Ether to the highest bidder ran for 24 hours from noon on 25 September as part of the Eastern Region Special Operations Unit’s (ERSOU) asset recovery process.

The assets were said to have had a fluctuating value of up to £500,000 and were spread across various sized lots.

Gunton’s wallet contained over £400k worth of Bitcoin at the time of the seizure.

The bidders for the digital currency were vetted by ERSOU’s procured asset management and realisation contractors, we are told, to ensure only ethical buyers participated and the crypto-coins stayed out of the hands of criminals, for the time being at least.

man in leather jacket rummages through bin

UK reaches peak Bitcoin as bin firm accepts cryptocurrency

READ MORE

“This historic auction should help us instill the public’s confidence in our open, transparent system to recoup the proceeds of crime in a secure and innovative way,” said detective chief inspector Martin Peters of ERSOU’s cyber crime division.

“Asset recovery in a digital world has evolved, so it’s really important that, working alongside commercial partners, we have a clear process for the storage of the cryptocurrency,” he added in the statement.

Wilson’s Auctions was fully insured to store the assets on behalf of the police before the sales process kicked off. This is the second time it has been involved in a crypto-cash auction: the first was in March, when it sold some 315 Bitcoin on behalf of a private company.

Aidan Larkin, asset recovery director at the auctioneer, said this was the first such sale of Bitcoin “under the instruction of a UK police force” and claimed to have received worldwide interest.

He said it received over 7,500 bids from “as far as Brazil, Australian, Dubai, USA, Canada and Singapore”.

There was no reserve on the Bitcoin lot that fetched £240,000. Larkin said that given the roller-coaster nature of Bitcoin valuations, he decided to break the coins into lots.

Both Australian and American cops have been auctioning off crypto-coins over the past few years. In 2016, Aussie police and the US marshals flogged off $11.5m and $1.6m worth of Bitcoin respectively. The American auction saw off blockchained loot once belonging to dark web souk Silk Road’s boss, the Dread Pirate Roberts, aka Ross Ulbricht, among others.

Earlier this year, Surrey Police became the first force in the UK to have succeeded in having Bitcoin confiscated by a court, worth £1.25m.

With the cops scrambling for budget after years of cuts, cryptocurrency auctions like this might be just the fillip the police need. Let’s hope this helps the Home Office avoid having to dip into cops’ IT budget. Just hold onto your Airwaves, peeps. ®

Sponsored:
What next after Netezza?

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/30/blightys_first_bitcoin_auction_on_behalf_of_the_cops_nets_240k/