STE WILLIAMS

The number of times Brits’ sensitive data has been lost or leaked in the UK has risen 1,000 per cent over the past five years. Councils recorded the biggest increase in breaches of data protection law, according to figures obtained by a Freedom of Information Act request.

The stats from the Information Commissioner’s Office (ICO) revealed a huge jump in the number of self-reported bungles each year since 2007. Local government data law breaches increased by 1,609 per cent over that period of time. The average increase across Blighty’s private and public sectors is 1,014 per cent.

Incidents of lost or leaked information in the private sector grew 1,159 per cent in that five-year period. NHS record breaches increased 935 per cent over the same period while central government data cock-ups increased 132 per cent.

Only the telecoms sector delivered a decrease in the number of info blunders from year to year, falling from six breaches in 2010/11 to zero in 2011/2012.

The latest full-year figures log 821 data breaches in the UK in 2011/2012. Precisely how many individuals were affected by each breach was not disclosed. The most recent quarterly results show that the NHS was responsible for the most incidents in Q2 2012 with 61 breaches, closely followed by local government (59) and private business (26).

The ICO has levied £2m in fines for data cock-ups in the 12 months running up to July 2012 – more than triple the penalties handed in the previous year, when the watchdog first gained powers to fine organisations responsible for particularly serious breaches of the law. Fines are typically applied for data breach incidents involving elements of negligence, repeat offending or other aggravating factors.

“The massive increase in data breaches in just five years is fairly startling,” said Nick Banks, head of EMEA and APAC at Imation Mobile Security, which filed the information request.

“Perhaps more alarming is the consistent year-on-year increase in data breaches since 2007. The figures obtained from the ICO by Imation seem to show that increasing financial penalties have had little effect on the amount of data breaches each year.”

“Undoubtedly there are some mitigating circumstances which have contributed to the rise in annual data breach numbers, such as the introduction of mandatory reporting in certain sectors, plus the increasing amounts of data being stored and accessed. But none of these factors obscures the clear trend of constant increases. Organisations must take responsibility for preventing breaches, and with so much available technology there really is no excuse for failing to adequately protect data,” he added. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/30/data_breach_increase/

A potent Java security vulnerability that first appeared earlier this week actually leverages two zero-day flaws. The revelation comes as it emerged Oracle knew about the holes as early as April.

Windows, Mac OS X and Linux desktops running multiple browser platforms are all vulnerable to attacks. Exploit code already in circulation first uses a vulnerability to gain access the restricted sun.awt.SunToolkit class before a second bug is used to disable the SecurityManager, and ultimately to break out of the Java sandbox.

“The beauty of this bug class is that it provides 100 per cent reliability and is multi-platform,” Esteban Guillardoy, a researcher at Argentina-based security outfit Immunity explains in a technically detailed blog post here. “Hence this will shortly become the penetration test Swiss knife for the next couple of years.”

Unpatched vulnerabilities to the so-called Gondvv exploit were introduced in Java 7.0, released in July 2011. All versions of Java 7 are vulnerable but older Java 6 versions appear to be immune. This factor means that Mac OS X users who follow best practice and apply the latest version of software applications are more at risk of attack.

As a result of the dual vulnerability in the most recent version of Java, attackers can spread malware simply by tricking users into visiting booby-trapped websites. Malicious code can be loaded onto vulnerable computers without user interaction. The zero-day exploit has already made its way into the infamous Blackhole Exploit kit. “Due to the Java 0-day, BlackHole exploitation success rate increased from 10 per cent to 25 per cent,” Aviv Raff, chief technology officer at Seculert, warns.

Modules to test for the exploit have also been folded into Metasploit, the widely used penetration testing framework. In addition, the exploit has already appeared in targeted attacks originating on Chinese-hosted domains, security researchers at FireEye warn. AlienVault has also spotted examples of active malfeasance.

Oracle, which has maintained Java since the enterprise systems giant bought Sun Microsystems, has yet to issue an advisory on the problem. Its quasi-dormant security blog can be found here.

In the absence of a patch for a potent and already abused vulnerability, the best advice is to disable Java in web browsers, the most obvious attack route. Instructions on how to do this can be found in an advisory by US CERT here and on F-Secure’s website here.

Sean Sullivan, a security adviser at F-Secure, commented: “The perpetual vulnerability machine that is Oracle’s Java Runtime Environment (JRE) has yet another highly exploitable vulnerability (CVE-2012-4681). And it’s being commoditised at this very moment. There being no latest patch against this, the only solution is to totally disable Java.”

When you disable Java in Chrome, it’s still possible to enable the technology for a specific site that users trust. This is a useful exception for banking sites and the like that require the use of Java. The site exception controls built into Chrome are explained in a Google knowledge base article here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/30/java_zero_day_latest/

The critical Java vulnerabilities that have security experts cautioning users to disable Java in their browsers are not new discoveries, a security firm claims. On the contrary, Oracle has known about them for months, and it has probably had a patch ready since before an exploit was discovered in the wild.

Security Explorations, a startup based in Poland, says it disclosed details of a total of 31 Java security issues to Oracle in April of this year, including the ones currently under attack. Of that list, only two issues were fixed in the last Java Critical Patch Update (CPU), which was issued on June 12.

“We … expected that the most serious of them would be fixed by June 2012 Java CPU,” Security Explorations CEO and founder Adam Gowdiak told The Reg, “But it didn’t happen and Oracle left many issues unpatched with plans to address them in the next Java CPUs.”

Ordinarily, Oracle only issues CPUs three times a year, which means the next one isn’t due to arrive until October 16.

Oracle continued to provide Security Explorations with updates on its progress toward fixing the flaws throughout the following months, Gowdiak says, and by August 23 it reported that it had developed fixes for all but six of the issues.

Gowdiak did not disclose details of which specific vulnerabilities Oracle confirmed it had fixed and when, but if we assume that the vulnerabilities currently being exploited aren’t among the six that remain open, then Oracle very likely could have made patches available to customers months ago. Instead, it stuck to its roadmap.

As a result, the vulnerabilities remain unpatched, and on Sunday security firm FireEye discovered a working exploit for one of the flaws on a website based in Asia.

Since then, the exploit has been incorporated into some of the more popular hacking and penetration testing tools, meaning even the most inept script kiddies can potentially use it to execute arbitrary code or install malware on affected systems.

Much like Microsoft’s “Patch Tuesday,” Java’s slow-but-steady patch schedule is designed to give enterprise customers time to properly test the fixes before deploying them.

But although such long lead times might be necessary for IT departments in charge of critical Java applications and middleware, individual users running Java in their browsers have different needs. While backend systems are usually shielded from exploits by firewalls and security systems, a user whose browser is directed to a malicious website is essentially wide open to attack.

“Oracle’s patching cycle should take into account that from time to time there is a need to release and out-of-band patch for ongoing 0-day attacks threatening the security of the users of the company’s Java software,” Gowdiak says.

Oracle has made no public statement regarding the issue and it did not respond when contacted for comment by The Reg. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/30/oracle_knew_about_flaws/

The critical Java vulnerabilities that have security experts cautioning users to disable Java in their browsers are not new discoveries, a security firm claims. On the contrary, Oracle has known about them for months, and it has probably had a patch ready since before an exploit was discovered in the wild.

Security Explorations, a startup based in Poland, says it disclosed details of a total of 31 Java security issues to Oracle in April of this year, including the ones currently under attack. Of that list, only two issues were fixed in the last Java Critical Patch Update (CPU), which was issued on June 12.

“We … expected that the most serious of them would be fixed by June 2012 Java CPU,” Security Explorations CEO and founder Adam Gowdiak told The Reg, “But it didn’t happen and Oracle left many issues unpatched with plans to address them in the next Java CPUs.”

Ordinarily, Oracle only issues CPUs three times a year, which means the next one isn’t due to arrive until October 16.

Oracle continued to provide Security Explorations with updates on its progress toward fixing the flaws throughout the following months, Gowdiak says, and by August 23 it reported that it had developed fixes for all but six of the issues.

Gowdiak did not disclose details of which specific vulnerabilities Oracle confirmed it had fixed and when, but if we assume that the vulnerabilities currently being exploited aren’t among the six that remain open, then Oracle very likely could have made patches available to customers months ago. Instead, it stuck to its roadmap.

As a result, the vulnerabilities remain unpatched, and on Sunday security firm FireEye discovered a working exploit for one of the flaws on a website based in Asia.

Since then, the exploit has been incorporated into some of the more popular hacking and penetration testing tools, meaning even the most inept script kiddies can potentially use it to execute arbitrary code or install malware on affected systems.

Much like Microsoft’s “Patch Tuesday,” Java’s slow-but-steady patch schedule is designed to give enterprise customers time to properly test the fixes before deploying them.

But although such long lead times might be necessary for IT departments in charge of critical Java applications and middleware, individual users running Java in their browsers have different needs. While backend systems are usually shielded from exploits by firewalls and security systems, a user whose browser is directed to a malicious website is essentially wide open to attack.

“Oracle’s patching cycle should take into account that from time to time there is a need to release and out-of-band patch for ongoing 0-day attacks threatening the security of the users of the company’s Java software,” Gowdiak says.

Oracle has made no public statement regarding the issue and it did not respond when contacted for comment by The Reg. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/30/oracle_knew_about_flaws/

A fired former IT contractor for Toyota’s US manufacturing wing has been ordered not to leave the country after allegedly accessing the company’s servers, downloading proprietary information, and sabotaging its systems.

The automaker accuses Ibrahimshah Shahulhameed, who was dismissed from his contract programming job on August 23, of logging back into Toyota’s systems that same night and spending roughly six hours trashing the place, the Lexington Herald-Leader reports.

Shahulhameed allegedly accessed Toyotasupplier.com, a web portal where Toyota and its suppliers exchange information about upcoming vehicle projects. Although Toyota hasn’t said what data it believes he may have stolen, it could include pricing, parts specifications, quality testing, or design information.

“If this information were disseminated to competitors or otherwise made public, it would be highly damaging to Toyota and its suppliers, causing immediate and irreparable damage,” Toyota attorney Mindy Barfield wrote in a complaint to the court.

Toyota also claims Shahulhameed altered at least 13 different applications on its servers, including removing security certificates, causing the systems to crash.

“It will take days for Toyota’s IT department to determine the full extent of its damage as a result of defendant’s efforts to sabotage its system,” the company’s complaint says.

On Monday, Judge Karen Caldwell of the US District Court in Lexington, Kentucky granted Toyota a restraining order preventing Shahulhameed from leaving the US or sharing any proprietary information he may possess.

A native of India, Shahulhameed had told his Toyota bosses that he planned to return there after losing his contract work.

Toyota spokesman Rick Hesterberg said that so far the company doesn’t believe any sensitive information has been leaked to the public or to its competitors, but he declined to say what measures the company planned to take should anything get out.

“It’s too early to speculate on what-if’s,” he said.

However much damage Toyota claims the data leak could potentially cause, however, the court released Shahulhameed on bond of just $2,500, pending trial. That’s just over twice the cost of a one-way flight from Lexington to Bombay, assuming he were to leave on Friday. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/29/toyota_disgruntled_contractor_hack/

Security researchers have discovered a potential dangerous Linux and Mac OS X cross-platform trojan.

Once installed on a compromised machine, Wirenet-1 opens a backdoor to a remote command server, and logs key presses to capture passwords and sensitive information typed by victims.

The program also grabs passwords submitted to Opera, Firefox, Chrome and Chromium web browsers, and credentials stored by applications including email client Thunderbird, web suite SeaMonkey, and chat app Pidgin. The malware then attempts to upload the gathered data to a server hosted in the Netherlands.

The software nastie was intercepted by Russian antivirus firm Dr Web, the company that carried out much of the analysis of the infamous Flashback trojan. Dr Web describes Wirenet-1 as the first Linux/OSX cross-platform password-stealing trojan.

Multi-platform virus strains that infect Windows, Mac OS X and Linux machines are extremely rare but not unprecedented. One example include the recent Crisis super-worm. Creating a strain of malware that infects Mac OS X and Linux machines but not Windows boxes seems, frankly, weird given the sizes of each operating system’s userbase – unless the virus has been designed for some kind of closely targeted attack on an organisation that uses a mix of the two Unix flavours.

Analysis work on the Wirenet-1 is ongoing and for now it’s unclear how the trojan is designed to spread. Once executed, it copies itself to the user’s home directory, and uses AES to encrypt its communications with a server over the internet. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/29/linux_mac_trojan/

US police have arrested a second suspect in the June 2011 hacktivist attacks on Sony Pictures Entertainment, an assault that resulted in a breach of passwords and personal data involving 38,000 accounts.

Raynaldo Rivera, 20, of Tempe, Arizona, surrendered to authorities on Tuesday after he was named in a federal grand jury indictment charging him hacking and conspiracy offences over the attack, which has been linked to the infamous LulzSec hacktivist crew, Threatpost reports. He gave himself up to authorities after he was the only suspect named in the recently unsealed indictment.

The arrest follows four months after another suspect – Cody Kretsinger, 24, also of Tempe – pleaded guilty to hacking offences related to the breach, according to the FBI. Kretsinger faces a sentencing hearing on 25 October.

At the time of the hack LulzSec boasted that it had lifted passwords and other details related to one million profiles using a SQL injection-style attack. Sony Pictures maintained that only 38,000 accounts were actually compromised.

LulzSec leaked the names, birth dates, email addresses, phone numbers and passwords of thousands of Sony Pictures competition entrants. The incident ultimately cost the entertainment giant $600,000 in security consultant fees and other charges, Reuters reports.

Charges against Rivera come a week after it emerged that alleged LulzSec kingpin Hector “Sabu” Monsegur had been granted a six-month delay in his sentencing as a reward for his continuing “assistance” to authorities. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/29/second_lulzsec_arrest/

Intel has revealed it’s working behind the scenes to strike a deal with Chinese regulators that will effectively make the country’s closed crypto standard Trusted Cryptography Module (TCM) interoperable with the rest of the world.

TCM was invented in the People’s Republic as a home-grown rival to the Trusted Computing Group’s Trusted Platform Module (TPM) – a hardware authentication standard related to chips of the same name which store cryptographic keys to uniquely authenticate host devices.

Jason Fedder, Intel’s GM of data centre products in Asia Pacific, told El Reg at a Chipzilla Cloud Summit on Tuesday that the firm is trying to thrash out interoperability between TCM and TPM with government, academia and other related parties in the People’s Republic.

The closed standard hasn’t been popular among Chinese banks because of its non-interoperability with TPM, but the integration roadmap between the competing standards is lengthening – because Intel has to get the Trusted Computing Group on board and account for the next version of TPM which is coming out soon, he added.

Of course, there’s something in it for the chip giant – its Trusted Execution Technology (TXT) relies on TPM so it needs to thrash out interoperability in order to sell it in the People’s Republic.

The US ITC has already slammed China for going it alone with “indigenous innovation” and complicating global supply chains.

The Chinese TCM requires that cryptographic algorithms and protocols used to perform specific security tasks, such as verifying that only authorized codes run on a system, be based on Chinese technology. US industry representatives have raised concerns that Chinese development of TCM is motivated by the desire to reduce royalties for patents embedded in TCG technology standards and that it will negatively affect interoperability and globally integrated supply chains.

®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/29/intel_tpm_tcm_interoperability/

Security researchers have discovered a potential dangerous Linux and Mac OS X cross-platform trojan.

Once installed on a compromised machine, Wirenet-1 opens a backdoor to a remote command server, and logs key presses to capture passwords and sensitive information typed by victims.

The program also grabs passwords submitted to Opera, Firefox, Chrome and Chromium web browsers, and credentials stored by applications including email client Thunderbird, web suite SeaMonkey, and chat app Pidgin. The malware then attempts to upload the gathered data to a server hosted in the Netherlands.

The software nastie was intercepted by Russian antivirus firm Dr Web, the company that carried out much of the analysis of the infamous Flashback trojan. Dr Web describes Wirenet-1 as the first Linux/OSX cross-platform password-stealing trojan.

Multi-platform virus strains that infect Windows, Mac OS X and Linux machines are extremely rare but not unprecedented. One example include the recent Crisis super-worm. Creating a strain of malware that infects Mac OS X and Linux machines but not Windows boxes seems, frankly, weird given the sizes of each operating system’s userbase – unless the virus has been designed for some kind of closely targeted attack on an organisation that uses a mix of the two Unix flavours.

Analysis work on the Wirenet-1 is ongoing and for now it’s unclear how the trojan is designed to spread. Once executed, it copies itself to the user’s home directory, and uses AES to encrypt its communications with a server over the internet. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/29/linux_mac_trojan/

Analysis Saudi Aramco said that it had put its network back online on Saturday, 10 days after a malware attack floored 30,000 workstations at the oil giant.

In a statement, Saudi Arabia’s national oil firm said that it had “restored all its main internal network services” hit by a malware outbreak that struck on 15 August. The firm said its core business of oil production and exploration was not affected by the attack, which resulted in a decision to suspend Saudi Aramco’s website for a period of a few days, presumably as a precaution. Corporate remote access services were also suspended as a result of the attack.

Oil and production systems were run off “isolated network systems unaffected by the attack, which the firm has pledged to investigate. In the meantime, Saudi Aramco promised to improve the security of its network to guard against fresh assaults.

Saudi Aramco has restored all its main internal network services that were impacted on August 15, 2012, by a malicious virus that originated from external sources and affected about 30,000 workstations. The workstations have since been cleaned and restored to service. As a precaution, remote Internet access to online resources was restricted. Saudi Aramco employees returned to work August 25, 2012, following the Eid holidays, resuming normal business.

The company confirmed that its primary enterprise systems of hydrocarbon exploration and production were unaffected as they operate on isolated network systems. Production plants were also fully operational as these control systems are also isolated.

A previously unknown group called Cutting Sword of Justice claimed responsibility for the attack, which affected three in four of the estimated 40,000 workstations used by the oil giant. The group said that it had hacked Saudi Aramco in retaliation against the Al-Saud regime for the “crimes and atrocities taking place in various countries around the world, especially in the neighboring countries such as Syria, Bahrain, Yemen, Lebanon [and] Egypt”.

The group said it hacked Aramco after compromising systems in “several countries” before implanting malware to “destroy 30,000 computers” within Aramco’s network. The infected machines claim was made days before Saudi Aramco confirmed the same number of machines had been hit, lending credibility to the hacker group’s claims.

Neither victim nor perpetrator named the malware that featured in the attack but security researchers implicated the Shamoon malware in the security breach (analysis by Seculert here). Shamoon, which emerged days before the assault, has both the capability to over-write data on infected machines and to destroy Master Boot Record files, thus making infected Windows machines impossible to boot.

Over-written files were reportedly replaced by an image of a burning US flag.

According to researchers, the malware also has the capacity to extract information from compromised before uploading it to the internet.

Core router names and admin passwords along with email address and supposed password of Saudi Aramco chief exec, Khalid A Al-Falih, were uploaded to Pastebin on Monday. The latest leak may be a result of the threatened follow-up attack, due to take place last weekend, rather than the fruits of the original malware-fuelled assault.

Rob Rachwald, director of security strategy at Imperva, described that Saudi Aramco attack as the first hacktivist-style assault to use malware.

“In the past, hacktivists have typically used application or distributed denial of service (DDoS) attacks – in which they clog a website with traffic until it goes offline. However, the attack on Saudi Aramco is the first significant use of malware in a hacktivist attack. Hacktivists rarely use malware, if other hacktivists jump on this trend it could become very dangerous,” he said.

A blog post by Imperva on the attack can be found here.

Similar data-wiping malware disrupted systems at Iranian oil exploration facilities in May in an attack that led researchers at Kaspersky Lab to the discovery of the Flame cyber-espionage tool. US gas prospecting firms have been hit by previous attacks, most of which are suspected to have been state-sponsored.

It seems wise to view claims that the Saudi Aramco assault was a case of politically motivated hacktivism with some skepticism, at least until a clearer picture of the previously unknown Cutting Sword of Justice group emerges. It could be the group is solely motivated at hitting back at Saudi’s ruling royal family for the country’s support in putting down Arab Spring-style revolts in other nations, such as Bahrain, but other motives are also possible.

More commentary on the information security aspects of the attack can be found in a post on Sophos’ Naked Security blog here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/29/saudi_aramco_malware_attack_analysis/