STE WILLIAMS

Although ‘password’ is no longer the #1 sesame opener, it’s still STUPID

The Benefits and Significance of Private Platform as a Service

Despite the fact that users continue to cling to predictable and insecure passwords, the worst of them all is no longer the most popular.

Security firm SplashData reports that in 2013, “password” slipped from the top spot as the most popular log-in code. Taking over the dubious distinction of most popular (and perhaps least secure) passphrase was the numerical string “123456”.


After “password”, “12345678” was the third most popular login. Rounding out the top five passwords were “qwerty” and “abc123”.

The top five will be enough to make any security administrator cringe, but the list should hardly come as a surprise. Despite countless warnings and advisories to move away from the predictable number sequences, such simple passwords have been pervasive for decades.

SplashData researchers also noted that the prevalence of simple passwords continues despite efforts by application vendors and service providers to mandate more secure passwords. Even when tasked with picking more sophisticated passcode combinations, users are opting for the simplest possible codes.

“Another interesting aspect of this year’s list is that more short numerical passwords showed up even though websites are starting to enforce stronger password policies,” said SplashData CEO Morgan Slain.

“For example, new to this year’s list are simple and easily guessable passwords like ‘1234’ at number 16, ‘12345’ at number 20, and ‘000000’ at number 25.”

Other notable entries on the list were “iloveyou” as the ninth most popular bad password and “admin” as number 12; “monkey”, interestingly enough, slipped all the way from the sixth spot last year down to number 17 overall.

Users also seem to harbor delusions of grandeur, as “princess” was the 22nd most popular password. Wordplay appeared at number 24 – “trustno1” – which was obviously not as clever as users thought it was.

The rankings, which were pulled from public dumps of pilfered passwords, added an Adobe feel this year. SplashData said that that company’s massive 2.9 million–user password dump helped get terms such as ‘adobe123’ and ‘photoshop’ into the top 25.

Avoiding the use of easily-guessed passwords is simple enough if users employ a bit of creativity and standard best practices, such as using hard-to-guess mnemonic device and mixing letters and numbers (non-sequential, obviously) in their passwords.®

The Benefits and Significance of Private Platform as a Service

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/20/password_no_longer_the_worst_password_still_a_terrible_password/

International webcam child abuse ring uncovered by routine police visit

Image of webcamA routine visit to the home of a registered sex offender in the UK has led law enforcement to bust an international organised crime group centered in the Philippines that arranged, and profited from, children being sexually abused live on webcam.

An international investigation, “Operation Endeavour,” started in 2012 and has so far resulted in the rescue of 15 children in the Philippines, aged between 6-15, with some of the victims’ own families having arranged for the abuse.

The rescued victims have been placed in the custody of the Philippine Department of Social Welfare and Development.

Child protection agencies have pointed to the emerging use of webcams to stream live abuse, particularly in countries with extreme poverty, increasing availability of high-speed internet, and the access it brings crime rings to wealthy overseas customers willing to pay for the exploitation of children.

Buyers of the video streams paid what law enforcement has so far identified as £37,500 ($61,684).

The crime ring spanned 12 countries.

The British National Crime Agency said in a statement that the investigation has led to 17 arrests in the UK, which have in turn led to 5 convictions and 9 ongoing investigations. One of the arrests required no further action, while two of the individuals are now dead.

The crime ring’s UK customers paid over £5,351 ($8,802) for the video streams, police said.

The investigation started after Northamptonshire Police found a number of indecent videos on the computers of registered sex offender Timothy Ford during a routine visit.

Police say that Ford had been paying for the live abuse of children and planned to move to the Philippines to set up an internet café. He was sentenced in March 2013 to eight and a half years in prison.

Investigations into Ford’s activities and the crime ring’s wider customer network with which he was associated led police to other suspects, including Thomas Owen, who was sentenced in July 2013 to seven years in prison.

When Owen was arrested, police found nearly four million indecent images of children in his possession.

Police also found evidence of Ford and Owen discussing online how they could travel to the Philippines to carry out “contact” abuse of children.

In one such chat log, Ford, who uses a wheelchair, suggested that Owen could act as his caregiver so they could travel to the Philippines together and avoid detection.

After finding the indecent images on Ford’s computers, police called in the Child Exploitation Online Protection Centre (CEOP).

The law enforcement groups together identified a number of “customers” and associates, and a global law enforcement investigation then commenced.

Operation Endeavour has resulted in 29 international arrests so far.

Separate investigations

Meanwhile, three other separate investigations into the live streaming of child sexual abuse are ongoing.

Those investigations have already identified 733 suspects, 139 of whom are in the UK and 594 from other countries.

The investigations have resulted in the conviction of Michael Eller, who has been sentenced to serve 14 years in prison.

Andy Baker, Deputy Director of CEOP, said in the statement that having thousands of miles and a computer between an abuser and his victims doesn’t lessen the guilt of the “customers” who pay for this abuse:

This investigation has identified some extremely dangerous child sexual offenders who believed paying for children to be abused to order was something they could get away with. Being thousands of miles away makes no difference to their guilt. In my mind they are just as responsible for the abuse of these children as the contact abusers overseas.Protecting the victims of abuse is our priority and that means attacking every link in the chain, from dismantling the organised groups who are motivated by profit through to targeting their customers.

Baker went on to say that this type of operation can only be done when law enforcement agencies work together across borders. That includes a host of agencies, including the Philippine National Police and the International Justice Mission (IJM), all of whom worked to share information and intelligence and also to identify and remove exploited children and to safeguard them from further harm.

The idea that technology is aiding in the abuse of children is disheartening. Fortunately, technology is also working on their behalf.

That was evidenced in November with the news about “Sweetie”, a 10-year-old Filipina CGI girl who had at that point been used to identify 1,000 alleged paedophiles.

Using Hollywood-style animation techniques, researchers created a lifelike character and seeded 19 public online chat forums with her very convincing live-action image.

Over 20,000 alleged predators asked her to perform paid sex acts over the course of 10 weeks, of whom 1,000 were identified, using no hacking methods whatsoever.

Kudos to the investigators who rescued 15 children in Operation Endeavour and to ongoing efforts to use technology to fight back against the very sex tourism that technology is, unfortunately, abetting.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/RP6fPZOwyOo/

Starbucks admits "your security is incredibly important", updates password-spilling app

Starbucks got into and out of privacy trouble over the past week.

The brouhaha started when a US researcher named Daniel Wood went public on the Full Disclosure security mailing list, reporting a rather serious data leakage problem in the Starbucks iOS mobile app.

We’ve written (and spoken) about the shortcomings of mobile apps before.

Even organisations that take security seriously when you interact with them in your browser, such as financial institutions, have been found wanting when it comes to their mobile apps.

Starbucks, it seems, fell into the same trap.

Wood didn’t say in his Full Disclosure posting, but one news report suggested he went public to push Starbucks to act after getting the run-around for a couple of months from Starbuck’s customer service.

The main part of Wood’s complaint was that Starbucks was sloppy with the data it wrote into its log files, dumping usernames and passwords in plaintext.

Of course, app logs can be very handy, notably if something goes wrong with your software.

Mobile apps are on-line most of the time, so you can easily and efficiently collect logfiles after a crash.

Logfiles are really useful when you are debugging software that is used by millions of people in a myriad of different configurations on thousands of different networks.

Indeed, it looks as though the main purpose of the Starbucks logfile was to help the company’s developers, because the logs are created by a third-party software component called, amusingly, Crashlytics.

As Wood found out, even if you protected the Starbucks app with a PIN (thus inhibiting someone who snatched your phone from firing up the app and paying for their own coffee at a click), the logfiles were unencrypted and accessible to attackers who got hold of your device.

Of course, the most effective crash-busting logs are those that include useful information leading up to the crash, rather than merely what could be extracted from the app’s memory image after it has imploded.

In other words, even if an app doesn’t crash, it may be quietly squirreling away a hoard of information, including, in the case of Starbucks, your username and password.

But usernames and passwords constitute PII (personally identifiable information) and ought not to be stored unencrypted, not least in this case because anyone who acquires them can freely spend your money at Starbucks.

→ Starbucks offers an “auto-reload” feature that will grab money from your payment card to replenish your Starbucks account if it runs low, so that you will never be caught short at the checkout with a steaming Grande in your hand. If you have that feature turned on, your financial risk from a security blunder in the mobile app is, obviously, much greater.

Starbucks, it seems, has published an update to the app, and no longer logs the offending information.

Sadly, the company didn’t manage to avoid the now-traditional cliches, leading with the words, “Your security is incredibly important to us,” and claiming that the software update was produced “out of an abundance of caution.”

We’ll disagree with both of those statements, because they don’t explain why anyone thought it was appropriate to store the user’s raw password in cleartext the first place, for any purpose.

Here’s our advice:

  • If your app must store actual passwords, for example so that users don’t have to type them in every time they grab a cup of coffee, use a secure storage mechanism such as the Apple Keychain (as the updated Starbucks app now apparently does).
  • Never allow decrypted passwords to be written to disk, even to temporary files, or sent across the network except over a secure connection such as SSL/TLS.
  • Never store the passwords for an online service on the server, even encrypted. You simply don’t need to. Use a salt-hash-stretch technique instead, and store one-way hashes that will validate passwords, but can’t be reversed to recover the actual password.

Further information

Learn more about SSL in our Techknow podcast, Understanding SSL:

(Audio player not working? Download to listen offline, or listen on Soundcloud.)

Learn more about server-side safe password storage in our Serious Security article How to store your users’ passwords safely:

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/88nDBsvPWWc/

Obama calls for change to NSA’s bulk phone record collection

Obama image couresy of Filip Fuxa / ShutterstockLast month, a panel of presidential advisors recommended that the National Security Agency’s (NSA’s) massive data trawling carry on, but that the data be kept in private hands for “queries and data mining” only by court order.

On Friday, US President Barack Obama gave a speech at the Department of Justice in which he called for just that: an end to the NSA’s maintenance of a database containing US persons’ phone records.

From his speech:

I believe critics are right to point out that without proper safeguards, this type of [telephone metadata bulk collection] program could be used to yield more information about our private lives and open the door to more intrusive bulk collection programs in the future. They’re also right to point out that although the telephone bulk collection program was subject to oversight by the Foreign Intelligence Surveillance Court (FISC) and has been reauthorized repeatedly by Congress, it has never been subject to vigorous public debate.

I believe we need a new approach. I am therefore ordering a transition that will end the Section 215 bulk metadata program as it currently exists and establish a mechanism that preserves the capabilities we need without the government holding this bulk metadata.

In other words, the bulk collection of phone metadata will continue, but the hands on the reins of that data will change, as the president’s panel recommended.

As pointed out by American Civil Liberties Union (ACLU) Staff Attorney Alex Abdo in an annotated version of the speech, the president only addressed changes to the bulk collection of telephone data while ignoring bulk collection of financial records, email metadata, or location information, among other data types.

And whose hands will take over?

Obama didn’t specify.

Saying the transition “will not be simple”, he left the details up to Attorney General Eric H. Holder Jr. and Director of National Intelligence James R. Clapper.

The intelligence review group had recommended that the current approach be replaced by one in which the telephone service providers or a third party retain the bulk records, with government accessing information as needed.

The president gave Holder and Clapper until 28 March to come up with somebody to whom the intelligence database buck may be passed and a new way to pass it.

So that’s one deadline.

But as the Washington Post noted, there’s another date, June 2015, that many in the administration are more worried about still.

That’s when Section 215 of the Patriot Act – the law that authorizes the bulk collection of Americans’ phone records – is set to expire.

Administration officials requesting anonymity told the newspaper that there’s little chance that the authority granted by that law will be renewed, given the ferocious backlash triggered by whistleblower Edward Snowden’s revelations.

The Washington Post quotes one official who wasn’t authorized to discuss the matter:

Congress’s deadline hangs over all of this.

But the authority granted by Section 215 certainly won’t die without a load of squealing.

Defenders of the data collection program issued a statement that played up Obama’s remarks about the importance of the program in supposedly thwarting terrorist plots.

From the joint statement from the chairmen of the House and Senate intelligence committees, Sen. Dianne Feinstein (D-Calif.) and Rep. Mike Rogers (R-Mich.):

The president underscored the importance of using telephone metadata to rapidly identify possible terrorist plots, a gap that existed on September 11, 2001, and which has been closed through the NSA’s collection of telephone metadata under Section 215 of the USA PATRIOT Act. As the president said, this is a capability that is ‘critical’ and must be ‘preserved’.

In Friday’s speech, Obama also said that the government will have to obtain a court order for each phone number it wants to query in its records database.

Also, the number of steps a given phone call is away from a terrorist organisation in order for it to be snoop-able is shrinking.

Before, intelligence analysts could review calls that were three steps away. Now, they’ll only be able to query calls that are two steps removed.

The ACLU’s Abdo notes that this is an “important narrowing” of the government’s phone-records program:

The so-called ‘three hop’ queries [intelligence analysts have] been using since 2006 likely swept up many thousands — or even millions — of innocent Americans. Two hops might not be the right answer, either, but it is certainly an improvement.

But it’s one seemingly unremarkable passage that Abdo singles out as the “single most significant passage of the speech.”

The passage from Obama’s speech:

During the review process, some suggested that we may also be able to preserve the capabilities we need through a combination of existing authorities, better information sharing and recent technological advances, but more work needs to be done to determine exactly how this system might work.

And Abdo’s interpretation of why this part matters more than anything:

If President Obama wants to end bulk collection – both by the government and through forced data retention by the companies – then individualized surveillance using existing authorities is the answer.The problem with bulk collection is that it puts the search before the suspicion.

Other parts of the president’s speech pertained to spying on foreign leaders.

In spite of the fact that every other country is spying on each other and they all know it, Obama said, and some countries privately thank the US for the benefits they get from its snooping, he said, the country will no longer eavesdrop on dozens of foreign leaders and governments that are friends or allies.

That move will, the administration is likely praying, appease a cadre of very indignant and much spied-upon foreign leaders such as German Chancellor Angela Merkel.

The president’s policy directive included a number of other facets, including getting input from a newly established panel of advocates from outside government to provide an independent voice in significant cases before the FISC.

Here’s the transcript of the full directive.

All in all, civil liberties groups were unimpressed by Obama’s directive.

Anthony D. Romero, the executive director of the ACLU, said in a statement that increased transparency for the FISC, improved checks and balances at the FISA (Foreign Intelligence Surveillance Act) court through the creation of a panel of advocates, and increased privacy protections for non-US citizens abroad are all “necessary and welcome reforms.”

But the continuance of the bulk data collection and retention is “troubling”, he said, and called on it to come to an end:

The president’s decision not to end bulk collection and retention of all Americans’ data remains highly troubling. The president outlined a process to study the issue further and appears open to alternatives. But the president should end – not mend – the government’s collection and retention of all law-abiding Americans’ data. When the government collects and stores every American’s phone call data, it is engaging in a textbook example of an ‘unreasonable search’ that violates the Constitution. The president’s own review panel recommended that bulk data collection be ended, and the president should accept that recommendation in its entirety.

Image of Obama courtesy of Filip Fuxa / Shutterstock.com

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Kw5TMlQ_PiA/

Why aren’t we learning long-term lessons from security disasters?

Graph and man images from Shutterstock. Why aren't we learning long-term lessons from security disasters?Security and privacy problems seem to have grown bigger and badder over the last year, with ever larger breaches and data leaks, continual revelations on the depth and breadth of government snooping, worries about the efficacy of encryption techniques (even when properly applied), and gluts of software vulnerabilities building to a crescendo with the impending end of patches for one of the world’s most popular platforms.

For the most part our reaction to these developments is to plug leaks, implement workarounds, and make quick fixes.

But wiser heads need to be thinking further ahead, developing new protocols, processes and technologies that don’t stick a hasty patch over the latest problem, but push us towards a world where whole categories of problems are no longer a risk.

POS malware, XP end-of-life and data leaks

The recent massive data theft from retail chain Target appears to have been performed using point-of-sale (POS) malware infecting checkout systems in stores. The malware itself has been variously claimed to have Russian and Romanian origin, and may also have been involved in several other breaches.

POS malware has been a problem for a while, especially in the US thanks to the slow adoption of modern banking card security .

While not unbreakable, EMV technology and Chip and PIN offer a much better security against malware, usually requiring hardware-based attacks to get the data needed to clone cards.

So of course many people are pointing out that this upgrade is long overdue – both bankers and card makers have taken the opportunity to push for more speedy adoption, while others have gone even further, saying we should maybe think of dumping cards entirely in favour of fully digital solutions.

Banks have also been caught up in the XP end-of-life debacle, with apparently 95% of the world’s ATMs running XP and many of them unlikely to be upgraded in time for the final batch of patches.

Similar issues have been predicted in UK government and health service networks, with thousands of systems expected to miss the deadline for safe upgrading.

Again, why are we only doing this now? The “full” support period for XP came to an end in 2009, and it was pretty clear that we only had five years to plan our upgrade schedules. Many people are only now taking action, leaving too little time to organize a smooth and inexpensive transition.

Reactions to the biggest security story of the last year, the Snowden/NSA leaks, has been similarly overdue. Now that we know what’s been going on, we’re once again scrambling to fix the problem.

Big data security and zero-day exploits

The US may get some stricter rules controlling how much data spies can hoover up, while  governments are redefining how we expect software flaws and vulnerabilities to be treated.

Zero-day vulnerabilities should be patched to keep us all safe, rather than kept secret so that snoops can exploit them to sneak into any machine they feel like exploring.

Here too, we’re late to the table. It’s been well known for a while now that government agencies had deep pockets when it came to buying vulnerability info, but no one really tried to ensure they were buying them up for the right reasons.

As for the data gathering, of course such information will be of interest to spies, but there was never any real impetus to ensure it was properly controlled until the scandal broke.

Prevention is better than cure

So what’s our problem? Is it just our natural predilection for procrastination, putting off until tomorrow things that we really should have done quite some time ago?

That’s not a good way of implementing security or privacy controls. They need to be there as early as possible, well thought through and built in from the ground up in any system or process we use.

We can’t keep waiting for a disaster before we decide to put in disaster prevention procedures.

We need to start thinking further ahead, about what our potential weak points might be many years down the line, instead of scrambling to react to dangers as they emerge.


Images of graph and pointing man courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/mJULSJ_evT8/

EE BrightBox routers can be hacked ‘by simple copy/paste operation’

The Benefits and Significance of Private Platform as a Service

BrightBox routers supplied by UK telco EE as standard kit to its broadband and fibre customers are riddled with security shortcomings that make the devices hackable, a UK security researcher warns.

Scott Helme warns that security vulnerabilities expose WPA encryption keys, passwords and ISP user credentials. Hackers might also have the ability to change a router’s DNS settings in order to intercept a target’s internet traffic.


A cache of sensitive traffic including ISP user credentials, WiFi SSIDs and WPA2 keys is kept in a file called cgi_status.js that can be accessed without logging into the device.

“The vulnerability allows for a complete bypass of the administrative login and total disclosure of all settings, passwords, configuration and credentials stored on the device,” Helme told El Reg.

“Security appears not to be a factor in the design of the device. it appears to be a case of only making it functional,” he added.

The security shortcomings of home networking kit have been much in the news of late and this prompted Helme to take a close look at the BrightBox router he received when he signed up to a broadband contract with EE. What he subsequently found led him to believe the kit had not been put through a proper security evaluation prior to its release.

“Once a user has access to your ‘Guest Network’ for example, they could simply view the WPA key for your ‘Main Network’ and completely bypass all of your restrictions with a simple copy/paste operation,” Helme warns. “Not only that, but if someone has brief access to your premises and perhaps connects to your LAN, they can steal a copy of your WiFi password/s. This would allow them remote access to your WiFi from outside the premises without you ever divulging the passwords to anyone.”

Access to the ISP user credentials might be abused to hijack a target’s broadband account. Access to the device admin password’s MD5 hashes creates a means for hackers to crack the credential using a brute force attack and rainbow tables before changing the admin password, successfully commandeering the device in the process.

The vulnerabilities lend themselves to remote exploitation as the result of a cross-site reference forgery flaw involving the BrightBox routers, which Helme estimates is used by more than 700,000 customers in the UK. The same kit was previously supplied to Orange subscribers.

“Being able to grab details like the WPA keys or the hash of my admin passwords was bad enough, but exposing my ISP user credentials represents a huge risk,” Helme concludes. “This is made even worse by the fact it’s possible to access all of the data remotely. Even if the device is only used in the home or small office, this represents a total compromise of the device’s security and an attacker could wreak havoc with your account causing huge inconvenience and even financial losses.”

After looking into the software, Helme physically open up the router and probed its internal components in order to access the underlying operating system. Having done with the device he decided to physically destroy it using a shotgun. The video of the router’s demise is at the bottom of this article.

Helme reported his research to EE back in November before going public with his findings last week. El Reg invited EE and device manufacturer Arcadyan to comment on the research.

In response, EE issued a statement on Friday promising to release a software update, while downplaying the severity of the security issues highlighted by Helme.

We are aware of Mr Helme’s article. As is the case for all home broadband customers, regardless of their provider, it is recommend they only give network access to people they trust. Customers should also be suspicious of any unsolicited emails and web pages, and keep their security software up to date.

We treat all security matters seriously and while no personal data will be compromised by the device itself, we would like to reassure customers that we are working on a service update which we plan to issue shortly, and which will remotely and automatically update customers’ Brightboxes with enhanced security protection.

Helme responded to the statement by arguing that there are multiple levels of trust but EE has not acknowledged this and put too much onus on consumers.

“You might give a friend or someone else your Wi-Fi password but you wouldn’t want to give them access to the admin account – but that’s what EE is doing here,” Helme said. He added that the multiple security shortcomings he identified with the device might all be resolved with a firmware update. ®

The router disintegrates as Scott Helme fires his shotgun at it.

The Benefits and Significance of Private Platform as a Service

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/20/brightbox_routers_vuln/

Nearly HALF of South Korea hacked in insider data theft

The Benefits and Significance of Private Platform as a Service

The personal details of as many as 20 million South Koreans may have been exposed after an employee at a credit ratings firm was arrested on suspicion of selling the records to marketing firms.

The temporary consultant, who worked at the Korea Credit Bureau (KCB), is suspected of lifting the data from the servers of KB Kookmin Card, Lotte Card, and NH Nonghyup Card, before selling it to phone marketing companies.


The data included customer names, social security numbers, credit card numbers and expiry dates, the Korean Financial Supervisory Service (FSS) said in a statement seen by AAP.

“The credit card firms will cover any financial losses caused to their customers due to the latest accident,” the regulator said.

An investigation has also been launched into whether the security measures the affected firms had in place weren’t up to scratch.

This kind of thing is not unheard of in South Korea.

In 2012, two hackers were arrested for illegally obtaining the personal details of 8.7 million KT mobile customers before selling it on to telemarketing firms.

A year earlier, a breach at South Korean game developer Nexon exposed data on 13 million subscribers, while local retailer Shinsegae and several others were hit in 2010 in an attack which stole 20 million customer account details.

However, the biggest to date remains the attacks on the Cyworld social networking website and the Nate web portal, which breached personal info on as many as 35 million users.

To put that in perspective, there are around 50 million people living in the north-east Asian nation today. ®

The Benefits and Significance of Private Platform as a Service

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/20/korea_personal_details_card_breach_20_million/

Java bug burns Borg

The Benefits and Significance of Private Platform as a Service

Cisco has asked users of its Secure Access Control System 5.5 or lower to implement an urgent patch, as it has spotted several problems with its RMI implementation.

There are three independent bugs: one privilege escalation vuln (CVE ID CVE-2014-0649, here), an unauthenticated user access vulnerability (CVE 2014-0648 here), and CVE 2014-0650 (here) which is an operating system command injection vulnerability.


The first two, Cisco says, arise from “insufficient authentication and authorisation enforcement”. while the third is caused by “insufficient input validation”.

The Secure ACS products, part of the Borg’s TrustSec solution, provides RADIUS and TACACS+ services for enterprise networks and VPN access.

The Java Remote Method Invocation system provides communication between ACS devices, using TCP port 2020 and 2030. This allows users to replicate confirmation information and data in multi-server environments.

In a separate note, Cisco advises that users can restrict access to these ports to trusted servers only, and can use Transit Access Control Lists to drop packets trying to exploit the vulnerabilities, while the Cisco ASA 5500. the ASA module for the Catalyst 6500, or the firewall services module for the Catalyst 6500 and 7600 can all be deployed to mitigate the risk.

The Borg states that the problem was discovered during internal testing. The update is available here. ®

The Benefits and Significance of Private Platform as a Service

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/20/java_bug_burns_borg/

SPAM supposedly spotted leaving the fridge

The Benefits and Significance of Private Platform as a Service

It’s still silly season, it seems. Tell the world that a bunch of small business broadband routers have been compromised and recruited into botnets, and the world yawns.

Add in a television or a multi-media centre, and there’s a faint flicker of interest – perhaps a raised eyebrow, but not much more. Add in the word “refrigerator”, as Proofpoint did in this press release, and the world goes nuts.


Which is why, of course, the refrigerator is in there. Here’s what the security outfit actually said about a spam-spreading caper it spotted:

“The global attack campaign involved more than 750,000 malicious email communications coming from more than 100,000 everyday consumer gadgets such as home-networking routers, connected multi-media centers, televisions and at least one refrigerator that had been compromised and used as a platform to launch attacks.”

Let’s put that in context: the “Internet of things”, says Proofpoint, was the source of three quarters of a million messages in a “global attack campaign”. Meanwhile, estimates for the world’s daily spam centre around 100 billion spam messages a day (depending on the success of efforts to disrupt the spammers’ operations.

In other words, what Proofpoint found is, right now, a very small proportion of the world’s attack traffic.

The Register is also concerned that Proofpoint’s media release doesn’t identify which refrigerator (of the handful that run some kind of Linux) was involved (which would enable owners to at least unplug their fridges from the Internet), nor how many messages apparently originated from the fridge.

Here’s another inconsistency that worries Vulture South: since we’re not aware of any refrigerator in possession of its own WAN interface, we presume it was on a home network somewhere, and the router was so insecure that the attackers could recruit it into their botnet. And that they chose to attack the fridge rather than the gateway router that they were passing to reach it.

I guess it makes sense for attackers, like security researchers, to look at new platforms – and that what Proofpoint has turned up is someone’s proof-of-concept.

However, Vulture South is not, as our peers seem to be, lying awake at night over the refrigerator spambot, for a few reasons: the platform itself is constrained; it’s relatively easily detected and defeated; and there are more attractive targets on the same networks as the refrigerators live on.

If you don’t want your refrigerator recruited into a botnet, the answer’s easy: don’t give it the right to connect to your network. ®

The Benefits and Significance of Private Platform as a Service

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/20/spam_spotted_leaving_the_fridge/

Oracle and Java, Apple and the FTC, Google and privacy – 60 Sec Security [VIDEO]