STE WILLIAMS

600 armed German cops storm Cyberbunker hosting biz on illegal darknet market claims

Cops have seized the physical premises and servers of the Dutch-German ISP that once hosted The Pirate Bay – after storming the hosting biz’s ex-NATO bunker hideout with 600 gunmen.

Cyberbunker, aka CB3ROB, was shut down by German police in what appears to be a military-grade operation targeting the hosting firm’s Traben-Trarbach premises: a Cold War-era bunker complete with its original anti-intrusion defences.

“Police officers succeeded in penetrating the building, a 5,000-square-metre former NATO bunker with iron doors, which goes five floors deep underground,” reported broadcaster Deutsche Welle (DW).

The bunker is around 96km (60 miles) west of Frankfurt.

CB3ROB has a reasonably long history of providing hosting services to what the rest of the world might regard as the murkier ends of the internet. If German police and prosecutors are to be believed, at the time of the raid CB3ROB was hosting several darknet souks, including ones themed around the sale of “drugs, weapons, counterfeit documents and stolen data” as well as allegedly hosting “sites distributing child [sex abuse material]”.

The holding page currently at www.cb3rob.org

The holding page currently at www.cb3rob.org

DW added: “In the raid, police seized 200 servers along with documents, cellphones and large quantities of cash.”

Thirteen people were arrested in the raid last week, made public over the weekend, with their ages ranging between 20 and 59. Police had named none of them at the time of writing.

Over on the Facebook page (Facebook account required to view; posts are public) of CB3ROB head honcho Sven Olaf Kamphuis, the news of the raid didn’t go down well.

Kamphuis described the raid as an “act of war”, going on to say: “ISPs do not need to know who the customer is, ISPs do not need to know what the customer does (and even if they do know, it doesn’t make them liable – as long as there is no ACTIVE cooperation in the activity).”

German law says ISPs cannot be held liable for the activities of their customers unless, roughly speaking, they actively collude in it. Kamphuis also posted a lengthy history of CB3ROB, which appears to have been machine-translated into English; he appears to be claiming that the bunker was some kind of independent nation state and that he is actually called HRH Prince Sven Olaf of CyberBunker-Kamphuis.

The 600-strong police operation to storm the bunker and arrest everyone in it reportedly included forces from GSG 9, Germany’s federal paramilitary police unit.

CB3ROB was most well known to Reg readers around a decade ago when it was slapped with an injunction from the Motion Picture Association of America forcing it to stop hosting The Pirate Bay, the notorious copyright-breaching torrent site.

A little later, CB3ROB was caught up in the fallout from the infamous Spamhaus DDoS attack. Dutch ISP A2B Internet complained to local police after Spamhaus, an anti-spam project at its heart, allegedly “blackmailed” the company into dropping BGP routes for CB3ROB’s traffic. ®

Sponsored:
What next after Netezza?

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/30/cyberbunker_cb3rob_germany_police_raid/

8 Microsegmentation Pitfalls to Avoid

Don’t fall victim to these common mistakes on the path to developing better security boundaries and limiting the blast radius of security incidents.

PreviousNext

Image Source: Adobe

Image Source: Adobe

The practice of microsegmentation takes the principles of least privilege to their logical conclusion by atomizing the isolating techniques of network segmentation. Security architects use microsegmentation to create security boundaries that can extend all the way into individual workloads by controlling East-West, or server-to-server, traffic flows between applications. The bulkheads put up through microsegmentation make it possible to better limit lateral movement of attackers, even in a cloudy world with no perimeter.

But the practice can be tricky to get right, and many experts warn that the journey to effective microsegmentation is fraught with pitfalls. Here are a few suggestions about how to avoid the mistakes en route to effective microsegmentation.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full BioPreviousNext

Article source: https://www.darkreading.com/8-microsegmentation-pitfalls-to-avoid/d/d-id/1335936?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

‘Harvesting Attacks’ & the Quantum Revolution

Stockpiles of stolen information sitting in foreign databases are ready to be exposed the minute there’s a working quantum computer in five to ten years. The time to act is now.

The Information Age replaced industrial equipment with data. Today, data isn’t just information; it’s process and interaction. Software commands robots to build things in factories. Sensors in fields trigger watering when crops are too dry. Code runs power plants. We’re developing smart cars and smart cities. And it’s all connected to the Internet — the Internet of Things.

But with this progress comes a pitfall: the opportunity for nation-state hackers to beat even our best cybersecurity systems and steal everything from source code to aeronautical blueprints, and have the ability to damage into the physical world as never before.

Attackers constantly find their way into sensitive networks around the globe. Hackers working for China, Russia, Iran, North Korea, and other nations are doing reconnaissance, stealing data, and hiding backdoors and malware in the networks of US agencies and military contractors, nuclear power plants and dams, banks, and Nasdaq. Russia shut down the Ukraine electric grid two years in a row. The US allegedly attacked Russia’s electric power grid, and a decade ago Stuxnet crippled Iran’s nuclear program. These attacks have affected people’s lives — such as turning Ukrainian cities dark for days. Not only do such attacks put sensitive data and intellectual property at risk, but the chances of an attack that could shut down systems that citizens rely on to survive are only increasing.  

In the cat-and-mouse game between cybersecurity and cybercriminals (nation-state or otherwise), a game-changer is in the near future: quantum computing, which is potentially capable of cracking even the most advanced conventional encryption. The US and China are in a heated race to develop quantum computing, which will revolutionize the industry, particularly in the fields of artificial intelligence, medicine, and scientific modeling.

Alongside these benefits is a danger from quantum computing that most people don’t realize is here, now, even though the quantum computers aren’t ready yet. This is because encrypted information stolen by China from the US government and industry is being stockpiled by China. Cheap data storage and the proliferation of valuable data online increases the feasibility and incentive for long-term storage of even the most solidly encrypted data. This offensive strategy is known as a harvesting attack. Encryption protects everything from classified data to the operations of power plants, water supplies, and financial trading systems. Once quantum computers are available, not only will the most critical data be exposed, but quantum-powered attacks will be able to interfere with important cyber-controlled processes as well. Cloaked secrets will be revealed and physical equipment will be manipulated remotely. 

We Need to Get Moving
It may be too late for much of the data that’s already been intercepted, but we can work to protect more of our data going forward — but only if the government takes this threat seriously.

The National Quantum Initiative Act (NQIA), which was signed into law in December, commits $1.2 billion to fund quantum science and computing efforts over five years to be divided between the National Institute of Standards and Technology (NIST), the Department of Energy (DoE), and the National Science Foundation. None of the money has yet been appropriated. Meanwhile, China is building a $10 billion quantum research lab that is slated to open next year.

The US needs to move quickly and invest in tech companies and startups that aren’t hampered by bureaucracy and are efficient with go-to-market strategies. It can take a decade or more to get research from the lab to the market. The Defense Advanced Research Projects Agency within the DoE has provided grants to independent cybersecurity researchers and startups to develop defenses for smart car security, voting machines, and other areas. Given the implications of crypto-breaking quantum computers for the defense industry, it makes sense for it to fund quantum defense as well.

A number of universities are doing important research and development of quantum computing, including MIT, Harvard, the University of Chicago, the University of Waterloo in Canada, and the University of Cambridge in England. NIST is working on post-quantum cryptography designed to protect against quantum computer attacks. And the DoE is doing great research at Oak Ridge National Laboratory on the use of quantum computing to protect the electric grid, which is potentially the biggest risk we face in a post-quantum world. But we need more researchers tackling all the various problems from more of the best minds and labs around the country. Once the NQIA funding is appropriated some grant money will flow to universities, but it will only be a piece of the overall $1.2 billion. Whatever it is, it needs to be more.

There are some quantum efforts that are in operation today, but they involve hardware as opposed to cryptographic algorithms, which can be broken. The Swiss government has been protecting its national elections with quantum key distribution (QKD), a quantum-based method for preventing the interception of encryption keys, for 12 years. However, here too, China is ahead — with a 2,000-kilometer QKD fiber network and a quantum science satellite that was launched in 2016.

Given what’s at stake — and the stockpiles of stolen information already sitting in foreign databases that will be exposed the minute there’s a working quantum computer — we don’t have time to spare. That is estimated to be five to ten years away, and the quantum clock is ticking.

Related Content:

 

Throughout his 30-year career, John Prisco has demonstrated success driving revenue growth, implementing operational excellence, and bringing companies such as Triumfant, GeoVantage, and Ridgeway Systems to successful exits. His depth of experience in telecommunications, … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/harvesting-attacks-and-the-quantum-revolution/a/d-id/1335870?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

218M Words with Friends Players Compromised in Data Breach

The same attacker was reportedly behind the Collection #1 and Collection #2 data dumps earlier this year.

A cybercriminal operating under the alias Gnosticplayers has broken into the Words with Friends database and gained access to 218 million player records, The Hacker News reports.

The popular puzzle game is owned by Zynga, one of the biggest names in the social gaming market with other well-known offerings, including FarmVille, Mafia Wars, and Zynga Poker. Zynga issued a disclosure on September 12 to say some player data may have been obtained by unauthorized parties; now, a new report sheds light on the extent of the security incident.

Gnosticplayers, the same cybercriminal also reportedly behind the Collection #1 and Collection #2 data dumps earlier this year, told The Hacker News he was able to breach a Words with Friends database containing more than 218 million user records. The incident affects players using iOS and Android devices who installed and registered for the game on or before September 2.

A sample of the stolen data revealed the range of user data exposed: names, email addresses, login IDs, hashed and salted passwords, requested password reset tokens, provided phone numbers, Facebook ID if the user had connected, and Zynga account ID, the report states.

The attacker also claims to have accessed information belonging to 7 million players of the also-popular Draw Something game, as well as a game called OMGPOP that is discontinued, The Hacker News found. Exposed data included plaintext passwords.

Read more details here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The Etiquette of Respecting Privacy in the Age of IoT.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/218m-words-with-friends-players-compromised-in-data-breach/d/d-id/1335948?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Microsoft changes encryption, another D-Link bug, phishing dangers, and more

Roundup Let’s look at some of the latest security news you may have missed this week.

Baltimore ransomware outbreak made worse by bad storage practices

This year’s ransomware infection at the City of Baltimore made headlines, in part because of the eye-popping $18.2m price tag its damage and recovery bills racked up. It turns out that the city’s bad data collection policies are playing a big role in that.

The Baltimore Sun reports that one of the reasons the data loss from the infection was so severe was because many of the important files were being kept locally on the PCs of individual employees, rather than backed up to a central server.

This meant that, as the ransomware infection spread from PC to PC, that data was lost and could not be recovered from a backup server, as should be the case.

“One of the things I’ve learned in my short time here is a great number of Baltimore City employees store entity information on their local computers. And that’s it,” said city auditor Josh Pasch.

Not surprisingly, Baltimore’s City Council and auditors are less than happy to learn of this policy, and the city’s IT department is planning to change it.

CS-Pwn

Online game Counterstrike- Global Offensive is the target of an RCE bug that could allow gamers to be compromised by a hostile server. CVE-2019-15943 is a memory corruption bug that arises when handling a malformed map file.

In practice, the attacker could set up a server then send connecting players the malformed file. A successful exploit could either crash the game or allow for remote code execution.

Microsoft tweeks encryption settings

The latest update to Windows 10 is bringing a change to the way Microsoft handles encryption.

From now on, Redmond says the default settling for Bitlocker with new hard drives will be software encryption, a more secure method of locking down drives. The setting can be changed, and the policy will not apply to existing drives.

Cloudflare drops week’s worth of new features

Edge network provider Cloudflare is wrapping up its annual birthday week rollout of new features and products. The week saw one new feature released each day.

These include a mobile app called WARP, a new set of browser statistic reports for site owners, a security tool to trap and occupy online bots, and support for HTTP/3.

Cheeky ATT redirects pentest pings to FBI

ATT had a bit of explaining to do after researchers discovered that one of its pages contained code that would redirect the traffic generated by pentests to the FBI’s website.

Fortunately, this was spotted before anyone got their door kicked down and was written off as a joke from someone in ATT’s IT department. The redirect has since been taken down.

D-Link storage boxes flagged for arbitrary code execution bug

The research team at CyStack Security in Vietnam has laid claim to the discover of a critical vulnerability in D-Link’s network-attached storage boxes.

CVE-2019-16057 is remote command execution vulnerability in the DNS-320 model. The bug was patched on September 11 and was detailed by the team recently.

“While doing some research on network devices we found a command injection vulnerability at the login module of a D-Link DNS-320 device,” CyStack says.

“The flaw exists at a hidden feature called SSL Login which its required parameter, port, can be poisoned.”

The vulnerability has a CVSS score of 10/10, so you will definitely want to make sure your storage boxes are patched.

Phishing scam imitates Adobe

A Reg reader pointed us to this sysadmin’s report of a particularly phishing flaw that appears to disguise its credential-harvesting fake login pages as legitimate Windows login sites.

Furthering the scheme, the phishing attack seemed to direct through a legitimate Adobe domain.

“I got an alert about a user click on a phishing email. Took a look at the alert and the URI originally looked legit – adobe.com, no problem. But something was still whiffy so I dug deeper,” the admin explained.

“Tested the link – it redirected to a fake Office 365 login page hosted at Windows.net. Holy shit. I tested the URI string from Adobe, and sure enough you can put anything after “p1=” and adobe will redirect you.”

The admin noted the matter was reported to Microsoft and the scammer’s account was deleted. ®

Sponsored:
How to Process, Wrangle, Analyze and Visualize your Data with Three Complementary Tools

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/30/270919_security_roundup/

The Etiquette of Respecting Privacy in the Age of IoT

Is it rude to ask someone to shut off their Alexa? Ask the family who’s written the book on etiquette for nearly 100 years — the descendants of Emily Post herself.

(photo of Emily Post, June 1912. Library of Congress Prints and Photographs division)

Her polite robotic voice pipes up in the background, followed by a giggling human apology. So sorry, that was Alexa responding to something one of us said on the conference call. I’ll go on mute.’ Those of us on the line, who’ve been placed on speakerphone, will no longer hear Alexa (or Siri, or Google)…but, of course, she’ll still hear us. 

Some chuckle, and bond over anecdotes about the foibles of their voice-activated digital assistants, just like they do about their toddlers’.

Other people are like me. We scowl and grind our teeth.

We think about privacy violations and security vulnerabilities. Like the couple whose conversation was recorded by an Amazon Echo and sent to a contact of theirs. Or the German Amazon customer whose Alexa recordings, which contained intimate “hair standing on end” personal details, were sent to a stranger. Or Amazon workers tapping into conversations, listening and recording for quality control purposes? Or researchers discovering vulnerabilities that would allow for “skill-squatting” (or voice-squatting) attacks that can turn legitimate commands into malicious executables. Or the vulnerable Google Nest, smart coffee pot or other unknown item that might be lurking in the background.

We wonder what things we might have said over the past 45 minutes, before we knew the recording device was stealthily listening. Did we mention anything sensitive or confidential? Anything that would violate privacy law if it were leaked? Anything that would help attackers write a good spearphishing message or guess our passwords? Or just say something stupid and embarrassing? 

What’s a grumpy, privacy-conscious person meant to do in these situations? Make angry demands, spiked with obscenities and snide comments about the foolishness of anyone who’d invite such spy equipment into their life? 

Well, that feels right. But just in case, it isn’t, I decided to consult an expert.  

An Etiquette ‘Gold Star’

In 1922, Emily Post wrote the first edition of Etiquette in Society in Business in Politics and at Home. Covering everything from weddings to precisely when and how a gentleman should lift his hat, the book made Post the unofficial arbiter of good manners in America.

Although Emily is no longer with us, the Emily Post Institute has carried on her legacy since 1946. Now led by her great-great-grandchildren Lizzie Post and Daniel Post Senning, the Institute is currently working on the 20th edition of Etiquette.   

Who better to consult about the etiquette of the Internet of Things than the family who has been the authority on etiquette for nearly 100 years?

So last Friday afternoon, sitting alone in my dumb home (not smart home), beside my laptop with the disabled microphone and covered webcam, I called Daniel Post Senning. I picked up my phone—which is equipped with a rose-printed carrying case, five security-related apps, and a dazzling array of no and don’t privacy settings—and dialed.

I asked if it he’d mind if I put him on speakerphone and record our conversation. I hit Record only after he gave his approval. 

“I am always curious where the next frontier is going to be in etiquette,” said Post Senning. “And this idea of privacy in a world where we’re all carrying these increasingly powerful recording devices both audio and visual … I think it’s a fascinating question.”

The Institute hasn’t yet written official guidance on the topic yet. (It might be coming in the 20th edition.)

“Whenever I’m in new territory, I always look back to tradition,” says Post Senning. “All the courtesies that survived around conference calls, video calls, using speaker phones, generally would apply in the scenarios where the ‘person’ listening isn’t necessarily a person, but might be artificial intelligence or a device that’s connected to the Internet, in the case of Alexa.”

Therefore, in professional situations like this, says Post Senning, “The idea of letting people know when they’re being recorded and who they’re being broadcast to are, for me, just core courtesies, no matter what technology you’re using.

“And it’s impossible to know every situation you walk into what combination of technology is going to be at play,” he says. “So I think the onus really falls on the person who’s chosen to deploy it in their home to warn others or to let other people know.”

If the owner of the technology fails to extend this courtesy, however, is it rude for a concerned (paranoid) house guest or colleague to ask, or even request they turn the device off?

The short answer, says Post Senning, is no. However, that depends on the way you ask. 

“There are kind and benevolent truths and there are harsh and brutal truths,” says Post Senning. “and if you had that conversation in a way that was accusatory or insulting or even just self-absorbed – ‘I can’t believe you have that device in your house, don’t you know that I don’t like to be listened to by evil tech giants’ – there’s a way to have that conversation that could be really offensive.”

(Baser impulses nearly drove me to such an offensive conversation. Post Senning gave me “an etiquette gold star” for resisting them.)

Reasonable Expectations

We scowling teeth-grinders must recognize too, that the world must not necessarily bend to our whims just because we asked nicely, and our needs are not the only ones that matter.

“Etiquette is most powerful when you’re using it as a tool for self-improvement, self-assessment,” says Post Senning.  

So, etiquette would tell a privacy-conscious guest in a smart-as-a-whip home to also consider carefully what you’re asking of your host. The inconvenience of turning a microphone off of one device might be small, but entirely altering the operation of an entire building (particularly if the homeowner requires voice activation for accessibility purposes) is a far greater inconvenience. “As the practical landscape changes,” says Post Senning, “the nature of the request and how you make it is going to change as well.” 

Nevertheless, “It’s hard to make demands of your host, as a guest. But you can make a request, and you can adjust your behavior and your participation accordingly,” says Post Senning. “‘Oh no we’re gonna leave that on? Well I’m just going to talk about things that are tier-1 conversation topics. We’re gonna talk about the weather and sports and pop culture now.’

“Or you say ‘maybe next time I’ll get myself an Air BB.'”

Another very practical piece of advice he gives is to get familiar with all the IoT and communications technology you use in the workplace, becausing using it well can protect your privacy. (Using it not-well might mean forgetting to hit “stop sharing my screen” before beginning an instant message conversation complaining about the people on the conference call.)   

Of course that would be less of an issue if we followed one of the oldest etiquette rules, going, Post Senning says, almost back to Emily’s time: “the headline rule.” The idea was that before you wrote something in a letter, ask yourself if you’d be okay with it becoming a newspaper headline; because even if you trusted the person you were sending the letter to, could you trust everyone else who might obtain access to it?

“As the question about not just what we write, but what we say and what we do becomes also potentially public and permanent,” says Senning, “I think it raises some really interesting questions about what privacy is and how we continue to value it and show value for it in the way we behave and make choices.”

Post Senning says the heart of all good etiquette is holding yourself accountable to standards of consideration, honesty and kindness. In that case, we all ought to practice it. Because if recording devices are going to capture our behavior no matter what we do, good etiquette is behavior we wouldn’t mind being caught. 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad … View Full Bio

Article source: https://www.darkreading.com/edge/theedge/the-etiquette-of-respecting-privacy-in-the-age-of-iot/b/d-id/1335939?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Got a pre-A12 iPhone? Love jailbreaks? Happy Friday! ‘Unpatchable tethered Boot ROM exploit’ released

A programmer claims to have found a way to execute arbitrary code on recent-ish iPhones and iPads, paving the way for full-blown tethered jailbreaks.

And, we’re told, it is impossible for Apple to block these shenanigans as it involves a vulnerability baked into the devices’ immutable Boot ROM.

Specifically, the coder, who goes by the handle axi0mX, on Friday said they had built checkm8: “A permanent unpatchable bootrom exploit for hundreds of millions of iOS devices … Most generations of iPhones and iPads are vulnerable: from iPhone 4S (A5 chip) to iPhone 8 and iPhone X (A11 chip).”

That means gear using Apple’s A12 system-on-chip, such as the iPhone XS, XS Max, and XR, are immune to checkm8; iPhones and iPads made before 2018 are not, it is claimed.

The exploit is a first stepping stone to properly jailbreaking the aforementioned vulnerable iThings via a USB connection. What’s said to be working exploit code targeting the Boot ROM flaw is now available on GitHub, for research purposes, cough, cough, and a completed suite of software to install whatever suitable operating system and apps you want – Cydia, etc – is expected to follow from the jailbreaking community.

“During iOS 12 betas in summer 2018, Apple patched a critical use-after-free vulnerability in iBoot USB code,” axi0mX said on Twitter, in explaining how they found the bug.

“This vulnerability can only be triggered over USB and requires physical access. It cannot be exploited remotely. I am sure many researchers have seen that patch. That’s how I discovered it. It is likely at least a couple other researchers were able to exploit this vulnerability after discovering the patch. The patch is easy to find, but the vulnerability is not trivial to exploit on most devices.”

They continued:

Jailbreaking, for the uninitiated, is basically installing your own OS and programs on a handheld, circumventing any of the built-in protection mechanisms that lock you inside Apple’s walled garden, in this case.

For those interested, the guts of the use-after-free() exploit are here: it appears to involve connecting the iThing to a computer via USB, forcing the device into DFU mode, and then abusing the USB connection to inject software that the firmware then executes. A payload of code is sent over during this process, meaning this is a tethered attack: you have to hook your gizmo up to a computer to pull off the technique.

While such an exploit will be of great use to hobbyists, it can be used by cops and snoops with physical access to a device to commandeer it and install spyware, though they will need to brute-force the passcode to decrypt any private data already encrypted by iOS.

Earlier today, a new iPhone Boot ROM exploit, checkm8 (or Apollo or Moonshine), was published on GitHub by axi0mX, affecting the iPhone 4S through the iPhone X,” explained Ryan Stortz, of infosec biz Trail of Bits, in an early analysis of the code.

“The vulnerability was patched in devices with A12 and A13 CPUs. As of this writing, the iPhone XS, XS Max, XR, 11, 11 Pro and 11 Pro Max are all safe from this exploit.

“We strongly urge all journalists, activists, and politicians to upgrade to an iPhone that was released in the past two years with an A12 or higher CPU. All other devices, including models that are still sold — like the iPhone 8, are vulnerable to this exploit. Regardless of your device, we also recommend an alphanumeric passcode, rather than a 6-digit numeric passcode. A strong alphanumeric passcode will protect the data on your phone from this and similar attacks.”

Here’s another summary:

In other Apple news…

Apple did not respond to a request for comment on the matter. The Cupertino phone slinger did, however, post a handful of updates this week to address other flaws in its products.

For phones running iOS 13, Apple patched the lock-screen workaround bug discovered by researcher Jose Rodriguez. On iOS 12 devices, Apple fixed CVE-2019-8641, a remote code execution flaw uncovered by Samuel Groß and Natalie Silvanovich of Google’s Project Zero.

Meanwhile, on the Macintosh, Apple released an update to clean up the same CVE-2019-8641 flaw in Sierra, High Sierra, and Mojave macOS systems. Updates were also dropped for bugs in tvOS (CVE-2019-8704), watchOS (CVE-2019-8641), and Safari (CVE-2019-8654, CVE-2019-8725). ®

Sponsored:
Beyond the Data Frontier

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/27/unpatchable_exploit_for_ios/

What’s that smell? Perfume merchant senses the scent of a digital burglary

Online merchant fragrancedirect.co.uk has confirmed a miscreant broke into its systems and made off with a raft of customers’ personal data, including payment card details.

The e-retailer, based in Macclesfield, England, wrote to punters this week to inform them of the digital burglary and the subsequent data leakage.

“We recently discovered that some of our user data may have been compromised as a result of unauthorised access to our website by a malicious third party,” the email states.

The online store then launched an investigation and “quickly identified the root cause and have taken the necessary steps to address the issue”, the note continues.

It added that “Fragrance Direct Username and Password”, along with “Name, Address and Phone Number”, and “Credit and Debit Card Details”.

The obligatory advice to users of changing their password and contacting the bank or card issuer for further advice was then handed out. The email adds:

Twitter logo

JACK OF ALL TIRADES: Twitter boss loses account to cunning foul-mouthed pranksters

READ MORE

“We are working closely with the card companies and have retained a digital security firm to assist us with further investigations. We have also informed the relevant regulators and supervisory authorities.

“We are very sorry for any concern or inconvenience this may cause you.”

The Information Commissioner’s Office told us that “Fragrance Direct has reported an incident to us and we will assess the information provided”.

El Reg called Fragrance Direct and spoke to founder and owner Katie Jowle, who told us her company had contacted all people that had their data accessed by “malicious code” during the period in question.

We have asked for details of the code, when it was spotted, how long it had been on the site, and the measures taken to prevent a repeat incident. We will update this article when the business replies. We suspect it was a card-stealing MageCart infection. ®

Sponsored:
How to get more from MicroStrategy by optimising your data stack

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/27/online_perfume_merchant_hacked/

Cybersecurity Certification in the Spotlight Again

Swiss technology non-profit group joins others, such as the Obama-era President’s Commission, in recommending that certain classes of technology products be tested.

The case for certifying the cybersecurity of specific classes of devices is gaining momentum as cybersecurity professionals worry that the growing number of interdependencies between software, hardware, and online services, puts consumers and workers at risk.

This week, a group of 14 cybersecurity experts at the Supply Chain Security working group of the Cybersecurity Commission of ICTswitzerland called for that country’s government to work to establish a testing and certification authority for the nation. The group is not alone: In 2016, the Commission on Enhancing National Cybersecurity formed by the Obama Administration called for similar certification of consumer technology and the creation of a “nutrition label” to collect simple cybersecurity metrics. In addition, other testing initiatives—from NetSecOPEN to the Cyber ITL—are aiming to shed more light on a variety of classes of products. 

The Swiss cybersecurity group aims to test products, evaluate source code, and prevent the insertion of malicious code into critical devices and applications, says Stefan Frei, cybersecurity principal at Accenture and head of the supply chain security group at ICT Switzerland. 

“Looking at supply-chain security, [cybersecurity is] a huge problem—we deploy anything that is given us without thinking,” he says. “If those devices are already compromised … because we have more cyber-physical applications, the result of attacks on that infrastructure is physical harm.” 

IoT’s Influence

The latest call for cybersecurity certification of products comes as three technology trends are gaining steam. 

First, an increasing number of devices are becoming part of the Internet-of-things—embedded with a processor and connected to the Internet—expanding the attackable surface area of businesses and consumer households alike. There will be more than 25 billion connected devices in 2020, according to business intelligence firm Gartner.

Because more consumer appliances, such as TVs and refrigerators, and industrial devices such as machine controllers and environmental monitors are becoming “smart,” untested technology is also becoming embedded in many devices with long lifespans or use-cycles. Non-critical personal electronics typically are replaced every few years. Smartphones, for example, have the shortest lifespan, being replaced every three years on average, while desktop computers last five or six years, according to survey data from small-business IT information firm Spiceworks. Household appliances typically last 10 years and cars last 15 to 17 years on average.

Finally, the deployment of such connected technology into devices that can have a physical impact means that cyber-physical attacks are now a reality. An online attacker’s actions can have real-world consequences.

Because there has been little oversight of the technology incorporated into companies’ infrastructure and consumer households, the ICTswitzerland report argues that its likely that many organizations have already been compromised.  

“In the absence of a reliable quality inspection of digital products, we have to assume that compromised components are already in use today,” the group said. “Further compromised components will be added continuously, sometimes in critical functions.”

The group of cybersecurity professionals called for a non-profit testing firm, funded by the companies whose products it tests, to review source code and configurations, to analyze and reverse engineer, and to conduct risk assessments. All testing would be open and the results published. 

The certification authority would work even if it could not test every product, Frei says.

“You don’t need to test everything,” he says. “The police do not need to have radar at every intersection to prevent speeding. You just need periodic checks.”

‘Nutrition Labels’

The idea for creating a testing and certification center is not new. The Obama Administration’s Report on the President’s Commission on Enhancing National Cybersecurity included, among its recommendations, the creation of testing and certification groups that could produce cybersecurity “nutrition labels” to allow consumers to compare technology services and products. 

The current “lack of information leaves most consumers unaware of the risks associated with using technology products and services, how these risks might easily be reduced, or how competing products’ security characteristics compare with each other,” the report stated. “Making matters worse, security considerations increasingly may lead to safety concerns, as many Internet-enabled devices can affect the world physically.”

While a broad certification system for electronic devices has not been created yet, a number of private organizations and businesses have arisen to test the cybersecurity capabilities of certain classes of—mostly security—products. 

AV-Test and AV-Comparatives both test anti-virus products, while groups such as the ICSA Labs, UL Labs, and NSS Labs both do independent testing of broader classes of products. Because such groups typically may not have open methodologies, various industries have also created their own groups to either inform testing or set industry-approved standards for testing.

The Cellular Telecommunications Industry Association (CTIA), for example, maintains the CTIA’s Cybersecurity Certification Program for wireless devices, and the Anti-Malware Testing Standards Organization (AMTSO) sets industry-approved standards for testing antivirus products.

Related Content

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The Beginner’s Guide to Denial-of-Service Attacks: A Breakdown of Shutdowns

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/iot/cybersecurity-certification-in-the-spotlight-again-/d/d-id/1335940?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Apple Patches Multiple Vulnerabilities Across Platforms

Updates address two separate issues in Apple’s desktop and mobile operating systems.

On the heels of the upgrade to iOS 13, Apple has released a series of security updates to iOS, macOS, iPadOS, and watchOS. There are two separate updates, each addressing a specific vulnerability on multiple platforms.

The first update, released on Thursday, addresses an out-of-bounds memory read that might allow an attacker to execute arbitrary code on the target machine. This update affects a number of operating systems across several Apple platforms. Apple released updates designated macOS Mojave 10.14.6 Supplemental Update 2, Security Update 2019-005 High Sierra, and Security Update 2019-005 Sierra; watchOS 5.3.2; and iOS 12.4.2.

Today, Apple also released iOS 13.1.1 and iPadOS 13.1.1. These updates address errors in the “sandbox” that iOS and iPadOS use to limit the permissions and resources available to an app. Because of the error, third-party app extensions could run with the wrong permissions, gaining access to resources they should not have been able to reach.

For more, read here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Why Clouds Keep Leaking Data.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/apple-patches-multiple-vulnerabilities-across-platforms/d/d-id/1335941?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple