hacking – Page 367 – STE WILLIAMS

First American Financial Corp. Left Mortgage Data Exposed on Website

library
crime | hacking | security

Real estate title firm reportedly has closed a hole in its website that had left hundreds of millions of real estate tile insurance files accessible without authentication, according to KrebsOnSecurity.

The website of real estate title insurance company First American Financial Corp. left exposed bank account statements, mortgage and tax information, Social Security numbers, wire transaction receipts, and driver’s license images, KrebsOnSecurity reported today.

Access to some 885 million mortgage-related files dating back to 2003 did not require authentication — a security hole first spotted by a real estate developer who alerted KrebsOnSecurity about the issue on firstam.com. The exposed website was disabled as of 2 p.m. ET today, according to KrebsOnSecurity.

First American sent this statement to the news site: “First American has learned of a design defect in an application that made possible unauthorized access to customer data. At First American, security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers’ information. The company took immediate action to address the situation and shut down external access to the application. We are currently evaluating what effect, if any, this had on the security of customer information. We will have no further comment until our internal review is completed.”

Moody’s Outlook Downgrade of Equifax: A Wake-up Call to Boards

library
crime | hacking | security

The move provides another spark to light a fire under CISOs to improve how they measure and communicate security risks to the board, security experts say.

Wall Street has been abuzz this week over drastic measures by credit ratings agency Moody’s to downgrade its rating outlook of Equifax, with expensive data breach fallout named as a major factor for the poor marks. While the action was not unexpected, the landmark nature of the outlook should provide some needed emphasis to both boards of directors and CISOs of the modern business imperative for cyber resilience, security and risk experts say.

“Today’s news puts a punctuation mark on the business reality of cybersecurity risks,” says Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, who believes this is going to push more boards to take in increasingly active role in understanding and managing cybersecurity risks. “They definitely need to do more than ask the CISO some high-level questions. Equifax is in the hot seat now, but most of the Fortune 500 CEOs and CISOs would do no better in the same situation.”

CNBC broke the news last night of the note from Moody’s changing its rating outlook that cited the $690 million in breach expenses — including costs for settling mounting class action lawsuits — and increased need for infrastructure investments to be made by the company through 2020 to address systemic cybersecurity weaknesses found in post-breach scrutiny.

Joe Mielenhausen, a Moody’s spokesperson, told CNBC that “this is the first time the fallout from a breach has moved the needle enough to contribute to the change” in ratings outlook.

Equifax’s record-breaking data breach, first disclosed in September 2017, was eventually found to have exposed the information of 147.9 million people. Technically the exposure was triggered through the exploitation of an unpatched Apache Struts vulnerability, but security industry experts and government officials say that more serious organizational problems and lack of executive oversight were the true culprit of what Congress called an “entirely preventable” breach.

The fallout from the breach included the ouster of Equifax’s CISO and eventually its CEO, and the company is still feeling the effects of class action suits from consumers and shareholder derivative lawsuits.

“This is Moody’s delivering on their intent last November to take cyber risk into account when grading companies,” says Steve Durbin, managing director of the Information Security Forum. “This will certainly send a clear message to boards in a language that they understand that cyber risk is integral to business risk and that the implications of a breach or loss of data can have very real impact.”

Durbin says he’s been advocating for some time to both the insurance industry and credit rating agencies to take cyber risk into account as they set policy pricing and assess company value. He believes this action by Moody’s will set the tone for assessment of business health in the future.

“Moving forward, this should become the norm since cyber risk is so integral to business risk that an assessment of business health without taking cyber risk and a company’s resilience into account will become meaningless,” he says.

Indeed, CNBC reported that Moody’s hinted as such in its Equifax note, stating that it will increasingly scrutinize cybersecurity “for all data oriented companies” in the future.

Security insiders say that this Moody’s action should not only be a wake-up call to CEOs and boards, but it’s also a crucial inflection point for CISOs.

According to Laurence Pitt, security strategy director at Juniper Networks, it’s another “chance in conversation” for security leaders — one that they shouldn’t blow by lacking the right data or insights about organization-wide cyberrisk.

“This incident changes how business will look at cybersecurity, so cybersecurity needs to change how it talks to business,” he says.

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/moodys-outlook-downgrade-of-equifax-a-wake-up-call-to-boards/d/d-id/1334800?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

How Security Vendors Can Address the Cybersecurity Talent Shortage

library
crime | hacking | security

The talent gap is too large for any one sector, and cybersecurity vendors have a big role to play in helping to close it.

Numerous reports show current unfilled cybersecurity jobs in the hundreds of thousands in the US alone, with with (ISC)² forecasting a shortfall of 1.8 million by 2020. As the dearth of cybersecurity skills continues, it is considered to be among the top cybersecurity risks for many organizations.

Filling this gap is imperative, and it is too big for any one sector or organization to do alone. Cybersecurity vendors have a role to play and a responsibility for closing the cybersecurity skills gap that goes well beyond providing training on products and solutions.

The Pressure Is On
Security operations teams are feeling the crunch of this critical cybersecurity workforce shortage. They are overworked and understaffed, which can often result in either not adhering to best cybersecurity hygiene practices or careless errors in caring for network and security resources.

It’s no wonder that, according to Ponemon’s “2018 Cost of a Data Breach” report, 70% of data loss now occurs because of misconfigured cloud storage servers, databases, networks, and even firewalls. Today’s data leaks caused by negligence now happen half as frequently as security attacks, with breaches due to such lapses having increased by well over 400% over the previous year.

Training All Audiences
While most efforts to address the talent shortage are centered on expanding technical skills to fill cybersecurity jobs, we need to be aware that the cybersecurity skills gap goes far beyond the job market for cybersecurity professionals. One of the biggest cyber-risks in today’s workplace is a general lack of awareness of even the most basic attacks, such as phishing emails and other social engineering techniques. And that is due to a failure in understanding that cybersecurity is everyone’s job, and organizations need training and education programs that address many different audiences.

What cybersecurity vendors are usually quite good at is creating training programs to equip customers and partners with the knowledge and skills required to operate their own products. This is certainly critical as cybersecurity solutions become more sophisticated. However, cybersecurity vendors that truly want to become trusted advisers for their customers need to adopt a training and education strategy with a much wider focus than their own products and solutions. A comprehensive strategy needs to include training and education programs designed for:

Security operations center teams delivering companywide awareness programs for employees
Customers implementing and managing cybersecurity solutions
Recruitment programs focused on women and minorities, along with high-potential candidates such as veterans transitioning back to civilian careers or IT staff members who show an interest in security
Professional services organizations providing services to assist customers
Academic institutions conducting research on advanced topics such as artificial intelligence and its applicability to cybersecurity
Governments and nongovernmental organizations (NGOs) tasked with establishing cybersecurity policies and global initiatives
Teenagers and parents — both in school and at home
Technical colleges and universities implementing new cybersecurity programs or integrating cyber into more traditional IT and computer science courses

Fill the Gap
Formal programs are a necessary element to filling the skills gap, but a comprehensive training and education strategy must include strategic partnerships within government, academia, and NGOs. For cybersecurity vendors, this provides a means for their subject matter experts to share their knowledge and vision with thought leaders and the next generation of cybersecurity experts.

The world’s organizations are facing a significant issue on the verge of a crisis. The cybersecurity skills gap is about much more than HR having a hard time filling open positions; it is a looming existential threat to the ongoing viability of those organizations. That’s why it has become a priority for security operations.

Closing the skills gap involves educating not just those within the education system or the future work force but also current employees who may be unwittingly weakening the company’s security posture. Cybersecurity vendors have a responsibility and a role to play in helping with education in all contexts, extending their ability to train and educate customers and partners to a wider audience for the sake of stronger cybersecurity at a societal level.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Rob Rashotte has 20 years of experience developing training and education strategies for startups as well as complex global organizations. He also has 15 years of experience working with some of the most innovative, fast-paced companies in the high-tech industry. Rob has an … View Full Bio

Article source: https://www.darkreading.com/cloud/how-security-vendors-can-address-the-cybersecurity-talent-shortage/a/d-id/1334685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

NSS Labs Admits Its Test of CrowdStrike Falcon Was ‘Inaccurate’

library
crime | hacking | security

CrowdStrike, NSS Labs reach confidential settlement over 2017 endpoint product testing dispute.

NSS Labs has retracted its 2017 publicly reported and disputed test results of CrowdStrike’s Falcon endpoint security product as part of a confidential lawsuit settlement reached with the security vendor.

The February 2017 advanced endpoint protection test report, which graded Falcon poorly, was challenged in court by CrowdStrike in a lawsuit, which alleged that the testing was incomplete and conducted using illegally obtained Falcon software, and defied CrowdStrike’s request for NSS Labs to halt the testing.

In a statement posted on its website this week, NSS Labs said that its 2017 test results of CrowdStrike Falcon were inaccurate and had been retracted.

“NSS’s testing of the CrowdStrike Falcon platform was incomplete and the product was not properly configured with prevention capabilities enabled. In addition to the results having already been acknowledged as partially incomplete, we now acknowledge they are not accurate and confirm that they do not meet our standards for publication,” NSS Labs said in the statement, which also included an apology to CrowdStrike for the “inaccurate” test results.

NSS Labs released the full AEP test report, including the flawed results of Falcon, during the 2017 RSA Conference. CrowdStrike had requested a temporary restraining order and preliminary injunction against NSS Labs to halt the report’s publication, but the court dismissed that request and the report went out.

George Kurtz, president and CEO of CrowdStrike, at that time said the tests were run using incomplete and incorrect information, and run improperly. CrowdStrike had hired NSS Labs in 2016 to perform private testing of Falcon, but later dropped the testing deal after the concerns over the quality of tests, which detected legitimate applications like Adobe and Skype as malicious, for example.

NSS Labs, however, continued to perform public tests on Falcon using software it acquired via a reseller.

The testing organization has been no stranger to controversy and conflict with security vendors. It’s currently embroiled in another lawsuit with CrowdStrike as well as other security vendors: NSS Labs in September of 2018 filed an antitrust lawsuit against CrowdStrike, ESET, and Symantec as well as the Anti-Malware Testing Standards Organization (AMTSO), over a vendor-backed testing protocol. The nonprofit ATMTSO adopted a testing protocol standard that its members had voted for and plan to adopt.

NSS Labs accused AMTSO and the three security vendors of unfairly allowing their products to be tested only by organizations that comply with the AMTSO. CrowdStrike at the time dismissed the suit as groundless, stating: “NSS is a for-profit, pay-to-play testing organization that obtains products through fraudulent means and is desperate to defend its business model from open and transparent testing.”

Related Content:

What You Need to Know About Zero Trust Security

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/endpoint/nss-labs-admits-its-test-of-crowdstrike-falcon-was-inaccurate/d/d-id/1334810?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Mist Computing Startup Distributes Security AI to the Network Edge

library
crime | hacking | security

MistNet, founded by former Juniper employees, moves AI processing to the network edge to build distributed detection and analysis models for security.

AI-based startup MistNet is moving intelligence to the edge of the network in an attempt to speed recognition of malicious and suspicious activity and reduce the amount of data that has to be moved from edge to cloud for analysis, storage, and forensics. This week’s closing of a $7 million Series A funding round will help it put that intelligence into the field.

MistNet, founded by a team who met while working at Juniper Networks, dubs the technology “mist computing” and its application in its products “CyberMist.” CyberMist uses a distributed analytical mesh that has artificial intelligence (AI)-based analysis occurring at the edge of the network under the control of a central, cloud-based manager.

CyberMist will typically be used to deliver information to security analysts for their work, according to the company. Although integration tools are available to link CyberMist to remediation systems, “We don’t want to be the the automation end of a SOAR [security orchestration, automation, and response solution]. We have integrations with the major SOARs, and we can automate do automatic remediation on that basis,” says CyberMist president and CEO Geoffrey Mattson.

Mattson says more traditional hub-and-spoke architectures make it more difficult to use data from a wide variety (and large number) of data sensors because of the sheer volume of data that must flow from the sensors to a central processor.

“They usually tap the network and look at the raw network data,” Mattson explains. “They often have agents that allow them to look at specific users’ behavior, and they tend to focus on that rather than the output of all the various security appliances.” And that narrow focus is just one of the issues he sees coming from the limitations on how much data most monitoring systems can scan in real time.

“Technically, it’s very difficult to have a separate overlay network to stream very large amounts of data in real time,” he says. “By the time you actually get it to the data center, you’ve lost a lot of the context. You lose spatial and temporal locality that can be very helpful in putting pieces of the puzzle together.”

One of the characteristics of mist computing, Mattson says, is that the edge nodes share a single, sharded, geographically distributed database. They also continually share modeling information so that each edge node has global awareness of conditions and activities on the network.

“We can keep hot data without moving it,” Mattson says. “You can call it up instantly, but we don’t have to move it back to a central repository.” The result is that customers can have real-time access for their own investigations or exploration of events that are occurring, while the MistNet system retains real-time access to do its own modeling and AI processing.

MistNet dubs the technology for its distributed AI modeling “TensorMist-AI,” for which it has applied for a patent. According to the company, TensorMist-AI leverages technology in Google TensorFlow and Apache Spark that it deploys in a mist computing architecture.

The edge nodes each contain sensor and compute functions in the mist computing architecture. In most cases, the product of the modeling run in those edge nodes — not the raw data — will be sent back to a central controlling and storage facility where more complex AI models are created and used for processing. Customers that want the raw edge data stored for potential forensic analysis have an option to do so, Mattson says.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/analytics/mist-computing-startup-distributes-security-ai-to-the-network-edge/d/d-id/1334812?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Google Ad Exchange in data privacy probe

library
crime | hacking | security

The Irish Data Protection Commission (DPC) announced on Wednesday that it’s launched a probe into whether Google’s processing of personal data as part of its Ad Exchange is breaching General Data Protection Regulation (GDPR) rules.

The DPC said that the probe was triggered by Dr. Johnny Ryan, among others. Dr. Ryan is the Chief Policy Officer (CPO) of the privacy-focused Brave browser, which was founded by Brendan Eich, the inventor of JavaScript and co-founder of Mozilla.

According to Dr. Ryan,

Google’s DoubleClick/Authorized Buyers advertising system is active on 8.4 million websites [and] is a driver of Google’s $19.9B revenue from ads served on publishers’ websites and relies on broadcasting users’ personal data, unbeknownst to them.

From the DPC’s announcement:

Arising from the Data Protection Commission’s ongoing examination of data protection compliance in the area of personalised online advertising and a number of submissions to the Data Protection Commission, including those made by Dr. Johnny Ryan of Brave, a statutory inquiry pursuant to section 110 of the Data Protection Act 2018 has been commenced in respect of Google Ireland Limited’s processing of personal data in the context of its online Ad Exchange.

Formal complaint from Brave

In September, Ryan submitted a formal complaint – to both the Information Commissioner’s Office (ICO) in the UK and to the Irish DPC – against Google and a number of other ad technology firms. Joining him in the complaint were Executive Director of the Open Rights Group Jim Killock and Michael Veale of University College London.

The complaint says that Google’s DoubleClick/Authorized Buyers advertising system is leaking personal data of website visitors to thousands of companies, without people being aware, able to consent, nor empowered to do anything about it.

The complaint references what’s called the Ryan report: a report from Dr. Ryan that details how the marketing ecosystem for behavioral advertising interacts with people’s personal data.

On Wednesday, Dr. Ryan testified before the US Senate Judiciary Committee about the issues at the heart of the complaint and the Ryan report: namely, the sensitive personal information that gets broadcast about us nearly every time we visit a website that uses “real-time bidding” ad auctions.

In these ad auctions, data about us is broadcast to tens or hundreds of tracking companies, Dr. Ryan said. Those tracking companies let advertisers compete for the opportunity to show us an ad.

I testified for @Brave at the US Senate Judiciary Committee this morning on the privacy and antitrust in the digita… twitter.com/i/web/status/1…

—
Johnny Ryan (@johnnyryan) May 21, 2019

Advertising is necessary to fund content publishing, so all that’s OK, right? You might think so until you hear what’s in that “big broadcast,” Ryan said:

It can include your – inferred – sexual orientation, political views, whether you are Christian, Jewish, or Muslim, etc., whether you have AIDS, erectile disfunction, or bi-polar disorder. It includes what you are reading, watching, and listening to. It includes your location, sometimes right up to your exact GPS coordinates. And it includes unique ID codes that are as specific to you as is your social security number, so that all of this data can be tied to you, continually, over time. This allows companies you have never heard of to maintain intimate profiles about you and what makes you tick – and on everyone you have ever known.

It’s happening “hundreds of billions of times a day,” Dr. Ryan said, and none of it is necessary for “smart advertising.” It doesn’t bring in much profit, either, he said, referencing research from Carnegie Mellon University – due to be published next month – that shows that the profiling nets publishers only an extra 4% revenue: US $.00008 extra per ad.

If it agrees, the DPC could put on some hurt

The Irish DPC can issue big penalties: companies found not to be compliant with GDPR face fines up to €20m (US $22.36m) or 4% of an organization’s annual global turnover.

The BBC got this response when it asked Google about the probe:

We will engage fully with the DPC’s investigation and welcome the opportunity for further clarification of Europe’s data protection rules for real-time bidding. Authorised buyers using our systems are subject to stringent policies and standards.

The DPC will also look into Google’s data retention practices.

For his part, Brave’s CPO predicts that “surveillance capitalism is about to become obsolete.”

The Irish Data Protection Commission’s action signals that now – nearly one year after the GDPR was introduced – a change is coming that goes beyond just Google. We need to reform online advertising to protect privacy, and to protect advertisers and publishers from legal risk under the GDPR.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/jZTP3pJZ6eQ/

Batterygate news: Apple to warn users if iOS updates throttle iPhones

library
crime | hacking | security

The latest ripple in the years-long, lawsuit-jammed, regulators-aggravating brouhaha known as batterygate: Apple has pledged to warn iPhone owners if an update is likely to slow down their phones.

The UK Competition and Markets Authority (CMA) said on Wednesday that Apple has agreed to “notify consumers in a clear manner” if an iOS update “materially changes the impact of performance management” on an iPhone:

To ensure compliance with consumer law Apple has formally agreed to improve the information it provides to people about the battery health of their phones and the impact performance management software may have on their phones.

The CMA got involved last year, concerned that people might have tried to repair their phone or replace it because they weren’t aware the software update had caused the handset to slow down.

In addition, the CMA said, people couldn’t easily find information about the health of their phone’s battery, which can degrade over time.

What Apple hadn’t told consumers – but which it would later confess – is that in an attempt to work around iPhones shutting off while still showing 30% of battery life, it released iOS 10.2.1, which throttled the CPU performance of the iPhone 6, iPhone 6s and iPhone SE with older batteries.

It all came to a head when hard benchmark data showing the CPU throttling was posted to Reddit.

From the post, by TeckFire:

As for WHY this happens, it’s because the battery degrades over time. The cells die, and the resistance increases, thereby not allowing for peak voltage for the processor. Without slowing down your phone, the phone would just shut off at random times, once your battery would fail to support your phone at peak processor usage. By introducing this slowdown, you can potentially keep using your phone for years as long as you’re fine with a slow phone. Replacing the battery will fix this, and your phone will be back up to full speed.

The result: people were not pleased with Apple. Regulators joined them in that attitude.

Stretching out battery life, or prompting device replacement?

In October 2018, for the first time ever, antitrust regulators found computer makers guilty of using software updates to make their customers’ devices worse.

Italy’s AGCM antitrust investigators found that Apple and Samsung had offered updates that slowed down devices or caused them to malfunction. They were fined €10 million (US $11.4 million) and €5 million (US $5.7 million) respectively.

That was only one of the backlashes Apple would face over batterygate. According to ZDNet, as of January 2018, Apple had been hit by 32 lawsuits over its decision to slow down iPhones with older batteries – something it later admitted it did in order to prolong their battery life.

In 2017, Apple apologized and slashed $50 off of battery replacements for the out-of-warranty iPhones for the next year, bringing the cost down to $29 for anyone with an iPhone 6.

Be good, or be back in trouble with regulators

The CMA says that Apple is legally bound to comply with its commitment to greater transparency.

According to the BBC, Apple believes that it’s already in compliance with the CMA’s demands, given the changes it’s made in how users can monitor their battery’s performance, among other improvements.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/lgVp1gx2kas/

Safari test points to a future with tracker-free ads

library
crime | hacking | security

Apple thinks it has come up with a way for advertisers to track how well their ads are doing without (*gasp*) compromising user privacy.

It sounds like a tall order but according to John Wilander, WebKit engineer and architect of Apple’s Intelligent Tracking Prevention (ITP), a technology called Privacy Preserving Ad Click Attribution has been added as an experimental feature to Preview 82+ of the Safari browser.

Nobody doubts the industry has a problem. Advertising keeps websites and advertisers afloat but at the expense of all sorts of privacy-bashing tracking that follows, profiles and gathers as much data about users as it can using cross-site tracking.

A lot of web users are fed up with this, hence the popularity of ad blockers and the rise of ad-limiting features in rival browsers such as Firefox.

But according to Wilander, the problem isn’t advertising per se, but the sense that web surveillance has become about not merely understanding what users do but who they are.

The combination of third-party web tracking and ad campaign measurement has led many to conflate web privacy with a web free of advertisements.

Undoubtedly true, but arguably a woe the industry has brought on itself. Can privacy and advertising be reconciled?

Safari as gatekeeper

Apple’s solution is a compromise – allow websites and advertisers to see that a user responded to an ad but not who that user is.

Online ads and measurement of their effectiveness do not require Site A, where you clicked an ad, to learn that you purchased something on Site B. The only data needed for measurement is that someone who clicked an ad on Site A made a purchase on Site B.

Instead of advertisers recording this data in the form of tracking pixels and cookies, a mechanism in Safari’s WebKit engine would do that for them instead.

And unlike today’s web, no “opaque third-parties” should see ad attribution data, only the websites visited by the user who generated the click-through.

Attribution reports would, therefore, be sent via a JavaScript API as if the user was in Private Browsing Mode, delaying those reports for 24 and 48 hours (i.e. no live data), and disallowing any ad attribution when users have entered Private Browsing Mode.

To be counted, links will need to be in the main frame (not an iFrame) while ad campaign IDs will be limited to 64 possibilities to avoid this being used as a backdoor tracker by assigning unique strings that might identify users across sites. Wilander sums this up:

Today’s practice of ad click attribution has no practical limit on the bits of data, which allows for full cross-site tracking of users using cookies. This is privacy invasive and thus we are obliged to prevent such ad click attribution from happening in Safari and WebKit.

Will it work?

Judging by the level of detail in Wilander’s blog, Privacy Preserving Ad Click Attribution is no whim. Significantly, Apple says it plans to propose the concept as a standard to the W3C Web Platform Incubator Community Group (WICG) which, if accepted, would mean other browser developers would be able to adopt it.

The obvious problem is whether advertisers will accept tighter control even if it’s imposed on them through Safari. Apple’s ITP anti-tracking has already annoyed advertisers who accused it of economic “sabotage.”

A second hurdle will be avoiding the pitiful fate that befell the Do Not Track initiative the industry made big claims for when it was launched in 2012 but which went nowhere.

When Privacy Preserving Ad Click Attribution makes it to Safari later this year, this will be one to watch.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/nPD15Gbdfww/

Any advance on $1.2m for this virus-infested netbook?

library
crime | hacking | security

Can you call malware art? That’s the question up for debate this week as Chinese Internet artist Guo O Dong puts a laptop hosting a collection of viruses up for auction. Well-heeled patrons certainly seem to think it’s art – bidding had reached a cool $1.2m at the time of writing.

Dong has infected a 2008 Samsung netbook running Windows XP3 with six of the nastiest, most disruptive viruses ever created. You’d think that for $1.2m he could have at least thrown in a desktop computer with a decent GPU.

Some might call it the Netbook of Doom, but he calls the project The Persistence of Chaos. Okey dokey.

If he wanted to highlight viruses that made a splash, he’s certainly got some keepers on his list. He chose these:

ILOVEYOU. Also known as The Love Bug, it was released in 2000 and spread via an email with a VBScript (VBS) file, this infected at least 45 million people.
Sobig. Released in 2003 and distributed by email, this was both a worm and a trojan. At one point, one in every 17 emails was said to be carrying this malware.
MyDoom. This 2004 worm broke SoBig’s record. It enabled the perpetrators to take over the victim’s computer. They used it in a DDoS attack against SCO.
BlackEnergy. First released in 2007, this malware has evolved for years and researchers suspected that it was a weapon in attacks on Ukraine’s electricity grid.
Dark Tequila. Released in 2013, this virus has reportedly been an attack vector against banking customers in Latin America.
WannaCry. Unleashed in 2017, this was the granddaddy of all ransomware attacks. It infected more than 200,000 computers across at least 150 countries.

So, is it art? Absolutely not, according to Naked Security’s very own malware guru Paul Ducklin:

If you want your very own ‘cursed laptop’ for a lot less than $1m, just connect an unpatched, unprotected device to the internet and wait a while… Actually, don’t do that. That wouldn’t be art or science either – you’d simply be putting others at needless risk during your ’experiment’.

Ducklin also wonders…

Will any of the malware authors whose intellectual property has been appropriated for this artwork come forward to ask for their cut of the money? Perhaps they might even consider travelling to somewhere like the US to file a lawsuit – how good would that be!

We’ve seen other, perhaps more innovative approaches to mixing viruses and art in the past. Back in 2008, Romanian digital artist Alex Dragulescu created Malwarez, a collection of images created by analysing system calls and memory references in popular malware strains.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/2nOzz6vPqg8/

7 Recent Wins Against Cybercrime

library
crime | hacking | security

The increasing number of successful law enforcement actions and prosecutions suggest that cybercriminals have plenty of reason to be looking over their shoulders.

Image Source: Shutterstock

The mind-numbing frequency with which new data breaches and attacks happen these days can sometimes cause the impression that cybercriminals have free reign to do what they want.

In reality, law enforcement organizations in the US and in several other countries have been recently notching up some important and impressive wins against cybercriminals. Just like a majority of large cybercrime operations are international in scope, the arrests, website takedowns, and prosecutions have also often been the result of extensive collaboration between US agencies and their counterparts around the world.

The most recent case in point are indictments that were announced against members of GozNym, a cybercrime operation that is believed to have stolen millions of dollars from the online bank accounts of companies in the US and elsewhere.

It’s too soon to see what impact these actions will have on cybercrime activity over the next few years. In some cases, law enforcement actions have had an immediate short-term impact. Last year’s takedown of the Webstresser DDoS-for-hire service, for example, is believed to have contributed to a broad decline in distributed denial-of-service (DDoS) activity through most of last year. Often, though, such positive outcomes have been transient and temporary at best.

Even so, the increasing number of successful law enforcement actions and prosecutions suggest that cybercriminals have plenty of reason to be looking over their shoulders. Here, in no particular order, are some of the more significant arrests, indictments, and takedowns over the past 18 months.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/7-recent-wins-against-cybercrime/d/d-id/1334791?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple