hacking – Page 443 – STE WILLIAMS

New scam accuses you of child abuse, offers to remove evidence

library
crime | hacking | security

Here’s a new twist to sextortion, the cybercrime that gets its name because it melds sex with extortion.

Usually, the approach is to send you an email saying, “We infected your computer with malware, we snooped via your webcam, we monitored your browsing…

…and we recorded you on a porn site, so send us money or we’ll send the recording to your friends and family.”

To reinforce the claim to have remote control over your computer, the crooks often add some personalised content into the email they send you.

For example, the crooks may include a password from one of your accounts, list your phone number, or set the From: line in the email to make it look as though they sent the message directly from your own email account.

Don’t panic if you see “personal” data in one of these spams. The passwords and phone numbers almost certainly come from a data breach – in fact, you might recognise the password as an old one you had to change because the service provider got hacked. And the From: header in an email is essentially part of the mail message itself – the sender can set it to anything they like.)

But there’s a new sort of sextortion message going around, and instead of asking you to pay to have a video file deleted, it’s inviting you to pay to have a corrupt law enforcement official modify your docket so you don’t get charged with a serious criminal offence:

Having set the scene, the allegedly crooked CIA officer says:

I am one of several people who have access to those documents and I have enough security clearance to amend and remove your details from this case. Here is my proposition.

Transfer exactly $10,000 USD (ten thousand dollars – about 2.5 BTC) through Bitcoin network to this special bitcoin address:

3XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Upon confirming your transfer I will take care of all the files linked to you and you can rest assured no one will bother you.

Please do not contact me. I will contact you and confirm only when I see the valid transfer.

The case number, “agent’s” name and Bitcoin address change every time, but the rest remains the same: send money to buy your way out of a criminal case.

The good news, if you can call it “good”, is that in this instance the crooks are going too far to be believable – while a significant percentage of internet users do watch porn, fortunately only a tiny number are disseminators of child abuse material.

We’ve checked the Bitcoin addresses in a few samples of this scam and have found no evidence of anyone having paid up.

Nevertheless, it’s the thought that counts, and the way that the crooks are thinking here is both intimidating and disturbing – they’re not just insulting you but the CIA too, by presenting themselves as corrupt officials who will take a bribe to alter the course of an investigation.

As always: don’t engage, and don’t reply – not even if you think you have something cutting remarks you want to say to the crooks.

They’re crooks, after all, who are happy to make false accusations, to demean public officials, and to solicit bribes.

Delete the email, offensive though it is, and move on…

LEARN MORE: WATCH OUR VIDEO

(No video showing above? Watch on YouTube.)

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/4Lk-PjfggFQ/

Sorry, Linux. We know you want to be popular, but cyber-crooks are all about Microsoft for now

library
crime | hacking | security

Eight out of the ten most exploited vulnerabilities tracked by threat intelligence biz Recorded Future in 2018 targeted Microsoft products – though number two on its list was, surprise surprise, a Flash flaw.

The most exploited vuln in the firm’s hall of shame was a remote code execution flaw in Windows’ VBScript engine that could pwn users who opened a booby-trapped web page with Internet Explorer.

“Exploit kits associated with this vulnerability were noted to spread the malware Trickbot through phishing attacks,” said Recorded Future in a report published today.

The Flash vuln was none other than one exploited by North Korean state-backed hackers – first detected by South Korea’s CERT, which discovered a flood of booby-trapped MS Office documents, web pages, spam messages and more.

Meanwhile, a near three-year-old vuln continues to be one of the most exploited flaws tracked by Recorded Future. Unveiled in July 2016, the Neutrino exploit kit was built out of code first published by white hats trying to provoke Microsoft into cleaning up an Internet Explorer zero-day vuln.

Recorded Future said it had seen five new exploit kits using the underlying code to target hapless IE users, warning that “the only workarounds are restricting access to two common dynamic-linked library files: VBScript.dll and JScript.dll”.

The threat intelligence biz used a list of 167 exploit kits to define its master list of commonly abused vulns, as well as 492 remote-access Trojans. Its report specifically excluded Spectre, Meltdown and Eternalblue, on the grounds that the latter was “not used by the criminal underground”, while the former pair were also not “heavily utilized” by miscreants. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/19/8_in_10_most_used_vulns_2018_targeted_microsoft/

Ransomware drops the Lillehammer on Norsk Hydro: Aluminium giant forced into manual mode after systems scrambled

library
crime | hacking | security

Norwegian power and metals giant Norsk Hydro is battling an extensive ransomware outbreak on its computers.

The biz, one of the world’s biggest makers of aluminum with sites in 50 countries, said on Tuesday that file-scrambling malware had infected its IT systems in the US and Europe. This cyber-intrusion forced a shutdown of its global computer network to contain the spread, and workers have had to switch to manual operations at its plants or temporarily halt production entirely, as a precaution.

Norsk Hydro did not say whether the attack is limited to office PCs or if embedded industrial control hardware was also infected by the malware. Presumably, the software nasty has encrypted documents and data, and is demanding a ransom be paid to restore the files. It sounds as though the infection, described as “severe” by CFO Ivan Eivind Kallevik, was kept within its office network.

“IT systems in most business areas are impacted and Hydro is switching to manual operations as far as possible,” Norsk Hydro said in a statement today. “Hydro is working to contain and neutralize the attack, but does not yet know the full extent of the situation.”

A company spokesperson told The Register the infection is believed to have originated in America. Media reports have named LockerGoga as the ransomware culprit, though Norsk Hydro told us that that particular malware is just one of several possible suspects.

Cyber-insurance shock: Zurich refuses to foot NotPetya ransomware clean-up bill – and claims it’s ‘an act of war’

While so far there is no indication that Norsk Hydro has any plans to pay the ransom, there’s still no news on restoring the encrypted systems and how long it will impact day-to-day operations.

Phil Neray, veep of industrial cybersecurity at factory and industry specialist CyberX, told The Register that it was inevitable hackers would look to get ransomware onto networks at manufacturing and power giants, given how valuable system uptime is in those environments.

“Manufacturing companies are an obvious target for ransomware because downtime is measured in millions of dollars per day – so as you might expect, CEOs are eager to pay. Plus the security of industrial networks has been neglected for years, so malware spreads quickly from infected employee computers in a single office to manufacturing plants in all other countries,” Neray explained.

“These attacks are especially serious for metal or chemical manufacturers because of the risk of serious safety and environmental incidents, and the bottom-line impact from spoilage of in-process materials and clean-up costs.” ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/19/norsk_hydro_ransomware/

Crowdsourced vs. Traditional Pen Testing

library
crime | hacking | security

A side-by-side comparison of key test features and when best to apply them based on the constraints within your budget and environment.

Crowdsourced security has recently moved into the mainstream, displacing traditional penetration-testing companies from what once was a lucrative niche space. While several companies have pioneered their own programs (Google, Yahoo, Mozilla, and Facebook), Bugcrowd and HackerOne now carve up the lion’s share of what is a fast-growing market.

How does crowdsourced pen testing compare with traditional pen testing, and how does it differ in methodology? Does this disruptive approach actually make things better? Read on for a side-by-side comparison.

Time-Limited vs. Open-Ended Engagements
One of the major downsides of pen testing today is that it doesn’t match the development speed of modern applications. Most companies pen test annually, but in today’s environments, applications are updated frequently, sometimes once a day, and sometimes even more than that. This results in your pen test being merely a snapshot of your security posture at a particular point in time. That’s it. Once you’ve updated your website or application, those findings are out of date, which means potential new vulnerabilities.

Crowdsourced pen tests are typically open ended, which maps better to how applications are built today and, most importantly, how attackers behave. An attacker can spend three to four months examining one of your assets if he pleases; a traditional pen tester doesn’t have that luxury. On the other hand, crowdsourced pen testers do, and it shows as they dig up highly critical bugs from live sites they have been pen testing for years.

I once found a vulnerability that took me over 50 hours to find (way longer than a pen test), and the vulnerability gave me access to the internal company network as well as all its data. This company used to run pen tests, but what surprised me most was that its crowdsourced program had been open for a year without anyone finding this particular bug, which proves another point: The more eyeballs you throw at something, the more things you’ll discover.

Proof-of-Concept vs. Theoretical Vulnerabilities
I’ve read dozens of pen-testing reports over the years filled with “junk” risk, where a vulnerability is listed as “high” just because a system is not on the latest patch but without showing how. When asked for a proof of concept on how this is exploitable, the report’s authors usually remove that from the report. This is now referred to as pen-tester syndrome — making things appear worse than they actually are. Garbage such as missing HTTP headers with absolutely no context as to how or why they are exploitable also falls into this category. In a crowdsourced pen test, you will only get exploitable vulnerabilities with actionable proof of concept. This does wonders for preventing companies from chasing phantom risk and focusing their remediation where it matters. Crowdsourced security really shines in this respect.

Pay per Pen Test vs. Pay per Vulnerability
Pen testing, for now, has held its ground against crowdsourced security because it’s cheap. Since you pay per day and a typical website will take you between four to five days, you know exactly how much you will pay up front, regardless of how many vulnerabilities are found. Crowdsourced pen tests, on the other hand, can vary, and because you have to pay both a platform fee and, on top of that, pay per vulnerability found, it can get expensive. While different providers now vary their models (some will charge just a platform fee so you don’t pay per vulnerability), it can be difficult to budget for the pay-per-vulnerability approach.

Testing Different Types of Assets
If you want someone testing from “inside” your network in a traditional pen-testing environment, a pen tester physically turns up at your office and just plugs in his or her laptop. In a crowdsourced scenario, it can get messy. Some of the engagements I’ve participated in require VPN or proxy setups, and you’re usually in a test environment, not a live environment with real users. This increases the cost for companies, not to mention doing this not just for one but dozens of testers. Other assets such as embedded and Internet of Things devices require a physical asset in hand, and while I have seen a few crowdsourced programs send out devices to testers in the mail, it’s more convenient and cheaper just to hand a single device over to a pen tester. For now, if you want to test anything inside your network or an IoT device, pen testing is just more convenient and cheaper!

Salaried Employee vs. Disposable Resource
While rarely considered, there is a glaring difference between both crowdsourced and traditional pen tests: how people are rewarded. In a traditional pen test, you know that work is carried out by a salaried employee who is remunerated correctly and paid regardless of whether he or she finds vulnerabilities or not. It’s likely this person has other “soft” benefits such as a pension plan and pen-testing tools paid for by the company, and probably gets regular training and sick pay.

Crowdsourced pen testers do not have any of that because they are paid per vulnerability. Referring back to my previous example of spending over 50 hours on a vulnerability, if I had turned up empty handed, I would have been rewarded nothing at all. Crowdsourced pen testers also have to fund their own training and their own tools. Want to test an iOS app? Better have your own test device set up. You’re sick? Too bad. Pension plan? What’s that? The crowdsourced industry is acutely aware of this criticism and has started offering standard flat fees for certain tests and certain researchers, so that if you don’t find any vulnerabilities, you still get paid.

Related Content:

Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Bounty Hunters Find 100K+ Bugs Under HackerOne Program in 2018
White-Hat Bug Bounty Programs Draw Inspiration from the Old West

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Alex Haynes is a former pentester with a background in offensive security and is credited for discovering vulnerabilities in products by Microsoft, Adobe, Pinterest, Amazon Web Services and IBM. He is a former top 10 ranked researcher on Bugcrowd and a member of the Synack … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/crowdsourced-vs-traditional-pen-testing/a/d-id/1334179?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Stealing Corporate Funds Still Top Goal of Messaging Attacks

library
crime | hacking | security

Cybercriminals focus on collecting credentials, blackmailing users with fake sextortion scams, and convincing privileged employees to transfer cash. The latter still causes the most damage, and some signs suggest it is moving to mobile.

Attackers continue to use many of the same phishing techniques as in the past, but, increasingly, the scams are much more targeted and, in some cases, have moved to mobile devices, according to two reports published today.

In its report, messaging-security firm Barracuda Networks found that 83% of targeted phishing attacks, also known as spear-phishing, appear as a message from an administrator at a popular service, asking for the user to log in. The scams use a variety of reasons, from claiming the account has been frozen to asking the user to review a document.

Overall, attackers are moving to spear-phishing attacks because they are relatively low volume and can be sent from popular e-mail services, making it less likely they will be blocked, says Asaf Cidon, vice president of content security at Barracuda.

“Because they are not sending a high volume of attacks — it’s quality and not quantity — and it is usually a human manually sending the e-mail and tailoring it, they can afford to send it from a Gmail account,” he says. “And basically the popular e-mail security services and cloud providers won’t block the e-mail because those services have a high reputation.”

Despite advances in anti-spam systems, fraudulent messages continue to reach end users, aiming to take advantage of nontech-savvy workers to steal their credentials, convince them to pay fake invoices, or convince them that lurid secrets are in criminals’ hands.

While e-mail scams that attempt to fool users into giving up their credentials for popular services are the most numerous, the most costly threat continues to be business e-mail compromise (BEC), where the fraudster attempts to fool an employee into paying a fake invoice. While BEC attacks only make up 6% of all spear-phishing attacks, according to Barracuda, they account for the most losses.

In 2017, for example, more than 15,000 BEC complaints were filed with the Internet Criminal Complaint Center (IC3), amounting to an adjusted loss of $675 million, according to the center’s annual report. By comparison, ransomware only accounted for $2.3 million in losses in 2017, the latest data available, according to the annual IC3 report.

Reprising the theme of using high-reputation services, more than 60% of BEC attacks come from one of 10 different e-mail service providers, Barracuda’s Cidon says.

“What happened over time is that all these services actually started getting very high sender reputation,” he says. “So, effectively, Gmail and Office 365 treat free e-mail services as very high-reputation sender domains.”

In some cases, attackers have also started moving victims over to text messaging as the primary conduit for the scam, according to the second report from messaging-security firm Agari. In its analysis, the firm described how the attack starts with a purported message from the company CEO asking for the employee’s personal cell to “complete a task for me.” The attacker then moves the discussion to SMS text messaging.

Rather than aim for high-value accounts, the scam typically focuses on getting the employee to buy gift cards with the corporate credit card, the Agari report states. Gift cards have become a common way for scammers to cash out, with a quarter of fraud ending in payment by gift card, up from 7% in 2015, according to the U.S. Federal Trade Commission.

For victims of BEC scams, text messaging presents additional dangers. The attacker now has the target’s mobile number, which allows them to potentially punish non-compliant victims with spam. Employees need to be trained to recognize such fraud, says Crane Hassold, director of threat research at Agari.

In addition, companies need to have a procedure in place to catch the fraudulent transactions before they occur, he says.

“There needs to be a secondhand verification for that request,” Hassold says. “If someone is asking for a wire transfer, confirm through a second channel.”

Perhaps the easiest way to monetize leaked credentials — no matter what service the username and password originates — is through the increasingly popular sextortion scam. Blackmail, primarily sextortion, accounts for 1 in 10 spear-phishing messages, Barracuda stated in its report. The attackers typically pretend to have access to an online cache of pornography accessed by the target, to have recorded the target watching pornography, or to be a law enforcement agency investing child pornography.

“The fact that, at this point, it is 10% of targeted attacks is surprising,” Barracuda’s Cidon says. “It didn’t exist a few months back, and now it is one of the most popular attacks on e-mail.”

The attacks are likely underreported because of the sensitive nature of the threats, he says.

The vast majority (88%) of all sextortion e-mail messages used subject lines having to do with a security alert or requesting a password change, Barracuda said. The majority of e-mail messages (60%) used only 30 subject lines.

Messaging attacks will continue to be a major threat for companies because they offer an easy way to gain employee credentials, compared with other cyberattacks based on malware, says Agari’s Hassold.

“We have seen cyberattacks decrease significantly over the past couple of years compared to social engineering attacks,” he says. “The ROI for social-engineering attacks is much lower. I do not have to stand up that much infrastructure, and I do not need a lot of technical knowledge.”

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/stealing-corporate-funds-still-top-goal-of-messaging-attacks/d/d-id/1334194?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Norsk Hydro Shuts Plants Amid Ransomware Attack

library
crime | hacking | security

The cyberattack, first detected on Monday night, has shut down Norsk’s entire global network.

Update 3/19: This article has been updated to reflect the discovery of LockerGoga ransomware in the Norsk Hydro attack.

Norsk Hydro, a major Norwegian aluminum producer, was hit with a ransomware attack that started Monday evening and worsened overnight, affecting IT systems for operations in Europe and the United States.

The attack was first detected around midnight Norwegian time on Monday, when IT experts noticed unusual activity on servers across global IT systems, said CFO Eivind Kallevik in a webcast briefing. It recognized Hydro was subject to “a serious cyberattack,” which the company took measures to contain and neutralize as it spread. Hydro determined it was a ransomware attack.

Norsk has shut down multiple metal extrusion plants, which turn aluminum ingots into parts for auto manufacturers and other firms. It has isolated all plants and operations from its global network and is switching to manual procedures for some operations, Kallevik said. This includes potlines, which process molten aluminum and must always be running, Bloomberg noted. Norsk’s giant smelters in Norway, Qatar, and Brazil have also switched to manual operations.

Kallevik called the incident “quite severe,” noting the company’s entire worldwide network is down. Primary plants in Norway are running as normal with a somewhat higher degree of manual operations. There is no indication primary plants outside Norway have been hit, he continued, but global products are having difficulty connecting to production systems, which is causing production challenges and temporary stoppages at some plants.

“[Our] main priority now is to ensure safe operations and limit the operational and financial impact,” he explained. The day following the attack was spent isolating plants to ensure the virus didn’t spread from one location to another. Kallevik said the company has good backup data, which will be its main strategy for restoring operations back to normal.

The Norsk cyberattack had a slight effect on the price of aluminum, which went up 1.2% to hit a three-month high of $1,944 per ton in early trade on the London Metal Exchange, Reuters reports.

Update: a spokesman for the Norwegian National Security Authority has confirmed to Reuters that Norsk was exposed to LockerGoga ransomware. This is the same ransomware CrowdStrike Intelligence asserts was involved with the infection of Altran, a French engineering company, in January of this year, says Adam Meyers, CrowdStrike vice president of intelligence.

“While details of the Norsk Hydro incident are still developing, CrowdStrike Intelligence has been able to identify a new sample of the LockerGoga ransomware that was uploaded to a public malware repository in two ZIP files from an IP address based in Oslo, Norway,” Meyers says.

The Case of the Missing Data

library
crime | hacking | security

The latest twist in the Equifax breach has serious implications for organizations.

When the Equifax breach — one of the largest breaches of all time — went public nearly a year-and-a-half ago, it was widely assumed that the data had been stolen for nefarious financial purposes. But as the resulting frenzy of consumer credit freezes and monitoring programs spread, investigators who were tracking the breach behind the scenes made an interesting discovery.

The data had up and vanished.

This was surprising because if the data had, in fact, been stolen with the ultimate goal of committing financial fraud, experts would have expected it to be sold on the Dark Web. At the very least, they would have expected to see a wave of fraudulent credit transactions.

Nada.

CNBC recently published an article that takes an in-depth look at what exactly happened to the credit, Social Security, and other sensitive data of 143 million people after it was stolen. The deeper the threat hunters have gone down the rabbit hole of this story, the more convinced they have become that the motive was actually even more sinister than pure financial gain.

In essence, security experts most familiar with this breach believe that a nation-state — likely China or Russia — stole the data in order to suss out current spies and pick out potential targets they could recruit as spies.

It’s the latter part that should concern organizations in the US and beyond. While the complex spy scheme sounds like something out of a movie, it actually has serious, real-world implications.

The Rise of State-Sponsored Threats
State-sponsored threats are increasingly one of the biggest threats to information assets across the globe. Threat actors are increasingly targeting businesses, universities, and other organizations with powerful and sophisticated trade-craft techniques designed to steal confidential information that can result in massive data and revenue loss.

People have many different motives to spy on behalf of a foreign government. The vast majority of nefarious insiders are acting on financial greed, but other motivations include, anger, ideology, patriotism, and organizational conflicts. The news has been flooded about employees convicted for working on behalf of a foreign government. Most recently, Chinese-born scientist You Xiaorong was accused of using her employment at Coca-Cola to steal trade secrets, with the intent to set up a competing venture in China and win a reward from a Chinese government-backed program. Apple also has come under fire, with two employees charged with stealing self-driving car project secrets in the past year.

Power-hungry executives are a major target for state-sponsored recuitment, along with those who may be suffering from financial problems. These executives can be lured into revealing secrets in return for money or power – from credentials to highly confidential documents and trade secrets. If nation-state spies have enough information to identify potential financial instability, they can determine the best targets to identify as spies, especially individuals they can convert for monetary gain.

Are There Spies in Your Organization?
As more employees become the targets for spy recruitment, it is more important than ever for businesses to quickly defend themselves before it is too late.

However, the reality is that most organizations do not have much visibility into what their employees and other insiders are doing with valuable company data. One study found that 42 % of organizations rely on server logs to detect threats. These are very difficult to parse and rarely provide sufficient context to indicate that an employee may be conducting nefarious activity. The study also found only about a quarter of organizations are using keylogging or session recording, while 8% admit they have zero visibility whatsoever into all employee activity.

These gaps can leave organizations open to some major risks. Criminal insider incidents can have serious financial repercussions – to the tune of an average annualized cost of $2.99 million, according to a recent Ponemon report. Many organizations simply can’t recover from the financial loss and reputational damage that an insider incident can bring.

Security teams’ lack of visibility into insiders’ actions also poses a massive security risk to organizations. With the Equifax breach’s true implications becoming increasingly clear, it has never been more important to understand what actions users are taking related to sensitive corporate data and systems. In particular, organizations should aim to gain visibility into all employee activities, especially when they are related to:

Unauthorized cloud storage or large file-sending sites
Disposable or temporary email clients
USB storage devices and other removable media
Copy/pasting, cut/copying, and large print jobs

These are just a few examples of user activities that, when put into context with the specific types of data in play and other factors, can shed valuable light on potential malicious employee activity.

Given the likelihood that we will see some major spy-recruitment efforts take place over the coming years, any business that stores or handles sensitive data should have full visibility into exactly how all employees are using organizational data. It might sound like the plot for a good movie, but when it’s valuable company or customer data on the line, the ending could be very unpleasant.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Mike McKee brings 20-plus years of cross-functional, global experience in technology to ObserveIT. Previously, he led the award-winning Global Services and Customer Success organizations at Rapid7, served as senior vice president, CAD Operations and Strategy, … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/the-case-of-the-missing-data/a/d-id/1334181?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

6 Ways Mature DevOps Teams Are Killing It in Security

library
crime | hacking | security

New survey shows where “elite” DevOps organizations are better able to incorporate security into application security.

Image Source: Pixabay

The automation, stability of infrastructure, and inherent traceability of DevOps tools and processes offer a ton of security and compliance upsides for mature DevOps organizations.

According to a new survey of over 5,500 IT practitioners around the world, conducted by Sonatype, “elite” DevOps organizations with mature practices, such as continuous integration and continuous delivery of software, are most likely to fold security into their processes and tooling for a true DevSecOps approach.

Throughout the “DevSecOps Community Survey 2019,” responses show that mature DevOps organizations have an increasing awareness of the importance of security in rapid delivery of software and the advantages that DevOps affords them in getting security integrated into their software development life cycle.

“The incorporation of security as part of the product development cycle is key,” said Ariel Kirshbom of Ernst Young, in response to one question about why DevSecOps is important to her organization. “To really embrace DevOps, security needs to be seamlessly integrated to the software development life cycle.”

Most importantly, the study offers concrete statistical evidence that DevOps organizations are doing better in key areas including automating security functions, tracking components and changes for compliance purposes. They are also making faster headway on securing emerging infrastructure technologies like containers and container orchestration. Read on for more about why they excel.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading. View Full Bio

Article source: https://www.darkreading.com/application-security/6-ways-mature-devops-teams-are-killing-it-in-security/d/d-id/1334182?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Child-friendly search engines: How safe is Kiddle?

library
crime | hacking | security

Every now and then the following meme does the rounds on the family-focused corners of social media. The meme/public service message encourages parents and teachers to switch children to a kid-friendly search engine called Kiddle.

Kiddle’s tagline is that it’s a “safe visual search engine for kids.” It has been around for a few years, and is certainly not the only search engine marketed as child-friendly – similar services include Kidrex.

To be clear, neither Kiddle or Kidrex are reinventing the search engine wheel, and, despite what some news stories imply, neither are owned by Google – they just use heavily customized versions of Google’s search engine under the hood, going beyond SafeSearch with the goal of making internet sleuthing as safe as possible for little ones.

In fact, Kiddle got into a little hot water a few years ago for making its search engine too exclusive, when it erased LGBT-related terms right out of existence from its search engine results pages. Kiddle soon fixed their search engine so kid-safe LGBT terms do show up in their searches.

Why bother with “kid-friendly” search engines?

The idea behind kid-friendly search engines like Kiddle is to make use of Google’s SafeSearch options and a thick layer of other filters to sanitize search engine results from any potentially inappropriate websites or images. This seems like a gift from the heavens for children learning how to use the internet at home, or for students that need access to lightly supervised internet time at school.

Kiddle also specifically offers a “Kimages” search option, which returns images that are all free to use under the Creative Commons Attribution-ShareAlike license (a feature that, frankly, many adults might find useful as well).

Ultimately, since these search engines are not hand-curating every single search engine result, it is always technically possible for something naughty or age-inappropriate to sneak past even the most stringent of filters.

For example, let’s say a young child gets an assignment for school to research their favorite number, and let’s say that number happens to be 14. This is a number that has been co-opted by white supremacy hate groups, but this child thankfully doesn’t know that and we would like to keep it that way.

Should the child search for the number 14 on Kiddle, the results that come up are both age-appropriate and educational:

Should you search on plain old Google using SafeSearch, the top result is about how hate groups use this number. The story is from a reputable source, but this still might be too much information for a child to parse, especially if they’re younger.

And on other search engines like KidRex, the results also include a lot of unnecessary tabloid fodder of dubious educational value:

Such search engines are indeed great training wheels for younger kids who need to do online homework and research, but it can’t replace supervision and teaching a child how to be smart online.

In other words, kid-friendly search engines are not absolutely safe – but they are safer.

In the example above, it’s very possible that an older child is searching that number to find out why it’s “bad” – and it’s certainly better for someone to find out from a reputable source that gives appropriate context, than from the hate groups themselves.

Any privacy concerns?

As mentioned before, the base functionality of these search engines tends to be a “skin” on a custom Google search.

This means that ultimately the really heavy technical lifting is being done by Google’s servers, so if you are trying to avoid Google products these kid-safe search engines won’t help there.

If you have a Google account that you are actively logged into, your search queries on any website that uses Google search will still be stored under your search engine activity in your Google account, thanks to the magic of cookies:

Kiddle specifically does not require any registration and its privacy policy says it does not collect personal information, and that it purges server logs every 24 hours. But again, ultimately this information all goes back to Google in some way, with or without a Google account.

If this is a concern, you’ll want to use an alternate search engine altogether, like DuckDuckGo, which has Safe Search mode.

DuckDuckGo returns marginally more child-appropriate – though overall far less educational – options in our test than some of the “kid safe” options listed above when used on “Strict” mode:

In summary

For younger children who need to be online but are far too young to be left to their own devices, and for parents and educators that want little ones to easily avoid age-inappropriate content, these search engines are quite a handy tool.

For older children, however, the results in these search engines may be too restrictive to be useful, and will likely only frustrate children to use other means. One Kiddle reviewer, who writes that they’re 15 and that their school exclusively uses Kiddle and not plain-vanilla Google, wrote that Kiddle was the:

Worst ting ever [sic] … it’s too safe…. you look up YouTube and it says “Oops TRY AGAIN!”

Now, keeping a teen from watching YouTube at school was likely the exact desired result, but hoping that this strategy will thwart them in the long term, or work at home or when they’re on their own, is folly.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/u6t5EqmpcRI/

MySpace loses 50 million songs in server migration

library
crime | hacking | security

For at least a year, MySpace users have been complaining about broken links to music.

On 1 February 2018, Redditor JodiXD got a dispiriting reply from MySpace, to the effect that there was “an issue” with all songs/videos uploaded more than three years ago. Hang tight, should be a fix on the way, support said, though they weren’t exactly sure when that would be. Sorry for the inconvenience!
·
Well, 13 months later, the arrival date of the fix has been determined. It is, as MySpace said on Monday, “never.” Here’s the statement it finally put out:

As a result of a server migration project, any photos, videos, and audio files you uploaded more than three years ago may no longer be available on or from Myspace. We apologize for the inconvenience and suggest that you retain your back up copies. If you would like more information, please contact our Data Protection Officer, Dr. Jana Jentzsch at [email protected].

Back-up copies? That’s a great idea. Unfortunately, it’s apparently not one utilized at MySpace before it does a server migration.

As a result, as Rolling Stone reports, about 50 million songs have been erased. That includes everything uploaded to the site prior to 2015.

The long-drawn-out issue boiled to the surface again this past weekend, once again on Reddit, when BlueRajasmyk2 posted this unhappy-face update. The update was then tweeted out by Kickstarter advisor and former CTO Andy Baio, who said that he was “deeply skeptical” that this was an accident.

I’m deeply skeptical this was an accident. Flagrant incompetence may be bad PR, but it still sounds better than “we… twitter.com/i/web/status/1…

—
Andy Baio (@waxpancake) March 18, 2019

NewsCorp bought MySpace in 2005 for $580m (£437m). It was sold in 2011 for $35m to ad targeting firm Specific Media. At the peak of its popularity, it beat Google as the most visited site in the US.

Gen Z may not remember MySpace, but as the BBC points out, some of its fans are still using it as an archive. Or, more accurately, they were using it as an archive, before the social-media-from-the-Jurassic-era got blotted out by a server migration meteor.

@waxpancake Welp, there goes my high school experience

—
ℹ️❤️🖥 aka Compy-chan (@ilovecomputers) March 18, 2019

Unfortunately, this is how it can go with any cloud storage: when you store your stuff on other people’s computers, your stuff is only as safe as those people can manage, or choose, to make it.

We strongly recommend keeping your own backups of the stuff you really care about – backups that are offline (where hackers, ransomware, search engines and other active network gremlins can’t directly reach them) and encrypted (in case they get stolen).

If you encrypt your backups onto USB sticks, for instance, then you might do a deal with a friend to store each other’s devices. You won’t be able to spy on each other by accident or design, but if something bad should happen at one guy’s house, there’s an offsite copy of the vital stuff accessible at the other.

It’s a tiny inconvenience, but it’s neither difficult nor expensive to do and could save your data when you need it most.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/gKs9kUbTmmQ/