STE WILLIAMS

Accused computer hacker Lauri Love is in court today arguing with the National Crime Agency over whether the British government agency should return PCs they seized from him.

Love once again brought his application under the Police (Property) Act 1897, which gives members of the public a means to force police and others to return items seized during investigations.

Those items are a Fujitsu Siemens laptop, an Acer computer tower, a Compaq computer tower, a Samsung laptop “and attachments”, an SD card, a Western Digital hard drive and a hard drive from within one of the laptops.

Police Property Act hearings are normally held in private (with the public excluded) under Criminal Procedure Rule 47.

District Judge Margot Coleman, sitting at Hendon Magistrates’ Court today, agreed to lift that prohibition but made what she said was an order under Rule 47 that banned the press and the public in court today from publishing anything about the hearing other than the fact of Love’s application, what property he wants to recover, and the outcome of the case.

The assembled press, including The Register, Central News, the BBC, the Guardian and others, challenged the order.

The case continues. A ruling on Love’s application is expected by the end of the day. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/11/nca_vs_lauri_love/

As lawmakers face a Friday deadline to prevent the federal government from closing a second time, we examine the cost to the digital domain, both public and private.

The partial shutdown of the US government last month prevented ranchers from applying for farm loans, Coast Guard personnel from getting paid, and tourists from visiting the Smithsonian Institution. It also had an impact on cybersecurity. For example, the security certificates used by more than 130 US government websites expired, which made it easier for threat actors to trick people into visiting malicious sites that masquerade as legitimate government sites, until they were renewed when the government reopened.

This week, as lawmakers face a Friday deadline to prevent a second closure, the negative impact on the public and private sectors is in danger of repeating. Here’s what’s at stake.

Outdated NIST Guidelines Leave the Private Sector in the Dark
The website for the National Institute of Standards and Technology (NIST) wasn’t updated from December 22, 2018, until January 28, 2019 — making it essentially offline for more than a month. With NIST shut down, cybersecurity professionals couldn’t access the technical documents that help them architect their organizations’ security programs. Many use NIST standards to evaluate security tools and as a reference on how to implement security technologies. Without this documentation, security practitioners were hindered from trying to roll out strong security measures; with NIST down, they weren’t able to make sure that they followed best practices during security rollouts.

Returning Employees Experience Alert Fatigue
A backlog of threat alerts and log files likely greeted federal government security professionals when they eventually returned to work. To handle the flood of alerts, analysts may have focused on the most recent ones and, because of time constraints, overlooked the older ones. If overlooked activity turns out to be a successful infiltration, there’s a chance that attackers could still be in a government network without anyone realizing it. Spotting and immediately investigating suspicious activity is the defender’s best chance of minimizing the damage caused by a data breach, especially since attackers prefer “low and slow” operations to decrease the likelihood of being detected.

Password Resets Lead to Weakened Security
Password resets are inevitable after the government reopens. With so many employees not working for more than a month, many of them may have forgotten their login credentials. In other cases, some agencies may have password management policies that require workers to change their passwords after a certain period of time (every 60 days, for example). Miss the deadline and they’ll have to reset their passwords.

In both cases, help desk employees who handle password resets likely were inundated with requests. To get people back to work faster, the help desk may have relaxed password management policies by permitting the reuse of old passwords. While this approach would get government agencies online faster, attackers could benefit from this situation since password reuse is rampant, a fact not lost on adversaries, who could leverage weakened passwords policies as they search for ways to infiltrate government defenses.

Recruitment Gets Tougher
Finding skilled cybersecurity workers is already difficult for many organizations and is likely to become even more challenging in the coming years. Enrollment in computer science programs peaked in 2017, according to the Computing Research Association’s annual survey. Typically, after an enrollment peak there’s a two- to four-year period when fewer people pursue computer science degrees. In other words, the already limited security talent pool could grow even shallower.

Factor in the lingering effects of the shutdown and the federal government could face an even tougher recruiting battle as security professionals’ negative perception of working for the federal government turns them away from considering careers in public service.

As for the cybersecurity professionals and contractors already employed by the federal government, being out of work for more than a month brings down their morale and may lead to early and midcareer jumps. We’re already seeing this situation play out with some people who have government STEM jobs . These workers are loyal and smart and they believe in serving their country, but they also have to pay mortgages and purchase groceries. This brain drain could mean that already understaffed cybersecurity teams take on even more responsibilities. Even the most talented security professionals have a limited amount of capacity.

Related Content:

• Credential Compromises By the Numbers
• Government Shutdown Brings Certificate Lapse Woes
• Kudos to the Unsung Rock Stars of Security

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dr. John Callahan is responsible for the development of the company’s world class enterprise-ready biometric solutions, leading a global team of software developers, computer vision scientists and sales engineers. He has previously served as the associate director for … View Full Bio

Article source: https://www.darkreading.com/what-the-government-shutdown-teaches-us-about-cybersecurity/a/d-id/1333836?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Network attached storage maker QNAP’s customers have reported being hit by a mystery issue that disables software updates by hijacking entries in host machines’ hosts file.

The full effects are, as yet, unknown – but users have reported that the most visible symptom is that some 700 entries are added to the /etc/hosts file that redirect a bunch of requests to IP address 0.0.0.0.

This, said forlorn QNAP forum user ianch99, stopped his antivirus from updating by sinkholing all of the software’s requests to the vendor’s website. Others reported that the Taiwanese NAS appliance maker’s own MalwareRemover was borked, though it is not known whether these two things are linked.

“If you remove these entries, the update runs fine but they return on after rebooting,” posted ianch99. So far the only cure appeared to be a script provided by QNAP itself, which one helpful Reddit user posted the link to after apparently being given it by one of the storage firm’s techie in live chat.

No time for nap, update your QNAP: RAIDed NAS data corruption bug squashed

READ MORE

Other users publicly wondered about the QNAP’s seeming reluctance to say anything about the issue, with a Reg reader telling us: “The wider QNAP-using population could perhaps do with a heads-up from your esteemed organ.”

QNAP failed to respond when The Register asked the company to comment on these goings-on, and has made no public statement at the time of writing.

A couple of years ago firmware from the Taiwanese headquartered biz was discovered to have a catastrophic bug that corrupted data on RAID drives during a rebuild “through faulty calculations”. It was eventually patched.

For those who haven’t poked around the quieter corners of their operating systems, /etc/hosts forces domain name lookups made from the host machine to go to specified IP addresses. The normal non-malicious use is to enforce blocking of unwanted sites.

While useful for persistent windups on colleagues by doing silly things like redirecting Google to Bing, that very same simplicity makes it an attractive target for malware authors bent on stopping updates to counter-malware programs, as Malwarebytes pointed out a few years ago. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/11/qnap_hosts_file_issues/

Citrix issues update for encryption weakness dogging the popular security protocol.

Turns out a major design flaw discovered and patched five years ago in the old SSL 3.0 encryption protocol, which exposed secure sessions to the so-called POODLE attack, didn’t really die: A researcher has unearthed two new related vulnerabilities in the newer TLS 1.2 crypto protocol.

Craig Young, a computer security researcher for Tripwire’s Vulnerability and Exposure Research Team, found vulnerabilities in SSL 3.0’s successor, TLS 1.2, that allow for attacks akin to POODLE due to TLS 1.2’s continued support for a long-outdated cryptographic method: cipher block-chaining (CBC). The flaws allow man-in-the-middle (MitM) attacks on a user’s encrypted Web and VPN sessions.

“Specifically, there are products out there that did not properly remediate the first POODLE issue,” says Young, who will detail his findings next month at Black Hat Asia in Singapore. He found the latest flaws while further researching, and then testing, just how an attacker could exploit the original POODLE MitM attack.

Among the affected vendors is Citrix, which is also the first to issue a patch for the flaw (CVE-2019-6485). The bug could allow an attacker to abuse Citrix’s Delivery Controller (ADC) network appliance to decrypt TLS traffic.

“At Citrix, the security of our products is paramount and we take all potential vulnerabilities very seriously. In the case of the so-called POODLE attack, we have applied the appropriate patches to mitigate the issue and advised our customers on actions needed to secure their platforms,” the company said in a statement given to Dark Reading. “We will continue to vigorously monitor our systems to ensure the integrity of our solutions and provide the highest levels of security for our customers around the world.”

Young declined to name other vendors currently working on patches, but he says the products include Web application firewalls, load-balancers, and remote access SSL VPNs.

Young has christened the two new flaws Zombie POODLE and GOLDENDOODLE (CVE). With Zombie Poodle, he was able to revive the POODLE attack in a Citrix load balancer with a tiny tweak to the POODLE attack on some systems that hadn’t fully eradicated the outdated crypto methods. GOLDENDOODLE, meanwhile, is a similar attack but with more powerful and rapid crypto-hacking performance. Even if a vendor has fully eradicated the original POODLE flaw, it still could be vulnerable to GOLDENDOODLE attacks, Young warns.

Some 2,000 of the Alexa Top 1 Million websites are vulnerable to Zombie POODLE, with some 1,000 to GOLDENDOODLE as well hundreds still vulnerable to the nearly 5-year-old POODLE, according to findings from Young’s online scans.

It’s not just small sites that are vulnerable, he says: “It seems to be more prevalent in sites that are spending more money on running websites,” such as government agencies and financial institutions that run hardware acceleration systems like Citrix’s platforms, he notes.

“This [issue] should have been put to bed four or five years ago,” Young says, but some vendors either didn’t fully remove support for the older and less secure ciphers or didn’t fully patch for the POODLE attack flaw itself. Citrix, for instance, had not fully patched for the original POODLE, he says, leaving it open for the next-generation POODLE attacks.

The core problem, of course, is that HTTPS’s underlying protocol (first SSL, now TLS) hasn’t been properly purged of old cryptographic methods that are outdated and less secure. Support for these older protocols, mainly to ensure that older legacy browsers and client machines aren’t locked out of websites, also leaves websites vulnerable. Like its predecessor, TLS 1.2 is riddled with workarounds and countermeasures for protecting against abuse of the older crypto, such as CBC and RC4.

The new Zombie POODLE and GOLDENDOODLE attacks – like POODLE – allow an attacker to rearrange encrypted blocks of data and, via a side channel, get a peek at plaintext information. The attack works like this: An attacker injects a malicious JavaScript into the victim’s browser via code planted on a nonencrypted website the user visits, for example. Once the browser is infected, the attacker can execute a MITM attack, ultimately grabbing the victim’s cookies and credentials from the secured Web session.

The First POODLE
The original POODLE flaw (Padding Oracle On Downgraded Legacy Encryption), aka CVE-2014-3566, was initially discovered by researchers at Google. It wasn’t easy to execute, and neither is POODLE Zombie or GOLDENDOODLE. That’s because attackers must be able to set up a MitM attack on the victim’s network or via Wi-Fi.

“Every attack has to be rather targeted, and there are a lot of moving parts,” Young says. “From the attacker’s perspective, you have to know who you are targeting and what kind of system they are running so you can predict where the sensitive material is you are trying to steal. The goal of this attack is to steal an authentication cookie.”

An attacker could gain access to the victim’s SSL VPN and ultimately pose as that victim on the organization’s VPN and move around the network, for example. That would require the attacker on via a public Wi-Fi network to employ ARP spoofing or trick the user’s client machine or phone to a phony Wi-Fi hotspot where the attacker then could discern the victim’s authentication cookie for his or her VPN session.

Young says it’s not likely the POODLE family of attacks are being exploited by cybercriminals, but even so, these attacks would be difficult to detect. Servers don’t typically log for this type of activity, for example, he notes.

GOLDENDOODLE kicks it up a notch and executes the POODLE attack at a faster and more efficient rate, he explains. Why the seemingly silly name? It actually retrieves the key intel it needs: “[It’s] deterministic such that the attacker is able to test whether the byte being decrypted has a specific value,” Young explains.

Go TLS 1.3
The long-term fix for POODLE-based attacks is adoption of the latest version of the TLS encryption protocol, TLS 1.3, which deleted the older crypto methods like CBC rather than including confusing and easily misconfigured workarounds. “It takes away all nonauthenticated ciphers” so attacks like POODLE and its successors can’t be executed, Young says.

While TLS 1.3 is available in popular browsers and networking products, website operators have been slow to deploy it mainly out of fear that the move will inadvertently “break” something.

Meantime, organizations not quite ready to go full TLS 1.3 just yet can disable all CBC encryption suites in their TLS 1.2-based systems to protect themselves from the new attacks. Young says his recent scans are showing some organizations he contacted about their sites’ vulnerabilities to the POODLE family are now all clear:  “I have … noticed some websites that are able to remediate the flaw without disabling CBC or patching,” but it’s not clear what workarounds they employed, he says.

The challenge is that larger websites often must support older Web browsers, Android devices, and Windows systems connecting to them. “While I’d like these businesses to disable CBC ciphers, it would probably create business issues for them” if older client systems couldn’t reach their sites, he says.

At Black Hat Asia, Young plans to release the scanning tool he created for his research for vendors and security experts to test Zombie POODLE and GOLDENDOODLE attacks. Tripwire’s IP360 scanner also detects the flaws, he notes.

Meantime, researchers at NCC Group today published new research on an attack that would downgrade TLS1.3 to the older, more vulnerable versions.

Related Content:

• TLS 1.3 Won’t Break Everything
• Access Control Lists: 6 Key Principles to Keep in Mind
• Preparing for Transport Layer Security 1.3
• Crypto In The Crosshairs Again

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/new-zombie-poodle-attack-bred-from-tls-flaw/d/d-id/1333815?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Roundup Here’s a summary of more infosec news beyond what we’ve already reported this week – enjoy.

Beware of pretend Italian plumbers bearing gifts: Mario, the beloved video game plumber with a porn-star mustache, should be treated with caution, according to security shop Bromium. Well, at least images of him.

Engineer Matthew Rowen was investigating a Windows Trojan that has an unusual pattern of behavior. The malware’s PowerShell commands are hidden in a picture of Nintendo’s Mario, which is odd. What’s more interesting is that the code is programmed to only run when the infected machine is in Italy. Who’s writing this software nasty – Wario?

Panda pops… How China’s hacker spies apparently ransacked US, Euro biz: Chinese government hackers, dubbed APT10 aka Stone Panda, broke into at least three businesses in the US and Europe to steal valuable confidential information, infosec outfits Recorded Future and Rapid7 claimed this week.

We’re told these compromised organizations include IT and business cloud provider Visma; a billion-dollar Norwegian company with more than 850,000 clients worldwide; an international clothing firm; and US intellectual property lawyers with high-tech clients in sectors from pharmaceutical and biomedical to electronics and automotive.

The miscreants, according to researchers, were able to break in using stolen login details for Citrix and LogMeIn remote-desktop software, and then exploited elevation-of-privilege vulnerabilities to compromise Windows networks as administrators. Against Visma, the alleged Beijing spies used the Trochilus malware to infect computers and remote-control them from command servers. Technical details, and advice on how to stay safe, over here.

Crypto-hungry SIM swap suspects cuffed: Two men have been collared by the Feds on allegations they tricked mobile network staff into transfering strangers’ phone numbers to their SIM cards so they could hijack and drain the victims’ online crypto-coin wallets.

Ahmad Wagaafe Hared, 21, of Tucson, Arizona, and Matthew Gene Ditman, 23, of Las Vegas, Nevada, were charged in the US with conspiracy to commit computer fraud and abuse, conspiracy to commit access device fraud, extortion, and aggravated identity theft. According to prosecutors:

The conspirators allegedly convinced the representatives of cellphone service providers to transfer or port cellphone numbers from SIM cards in the devices possessed by victims to SIM cards in devices possessed by the conspirators, a practice known as SIM swapping. The indictment further alleges that after Hared, Ditman, and others gained control of victims’ cellphone numbers, they used additional deceptive techniques to gain access to email, electronic storage, and other accounts of victims and ultimately to cryptocurrency accounts of victims. Hared, Ditman, and their co-conspirators also extorted victims of the SIM swapping scheme.

The pair are among of a number of alleged, or convicted, SIM swappers that have been popping up in the news lately.

Chinese bank IT admin jailed for $1m theft: An IT administrator at China’s Huaxia Bank is facing more than ten years in the clink after admitting stealing a hefty amount of cash.

Qin Qisheng, 43, found a number of flaws in the bank’s core operating system that could be exploited to withdraw cash from ATMs for free. He siphoned off amounts ranging from $740 to $2,965 with each withdrawal, and put the dosh in his own account, investing some of it in the stock exchange.

When his bosses uncovered the caper, he agreed to give all the money back, claiming it had just been “resting” in his account. The authorities were less forgiving, however, and he’ll now be spending the next 10 and a half years behind bars.

Google, New York City cops clash over Waze police checkpoint alerts: Cops in the Big Apple sent a cease-and-desist letter to Google, demanding it remove alerts from its Waze app that warn drivers of nearby drink-driving checks. These so-called driving-while-intoxicated (DWI) checkpoints are set up by the plod to test motorists aren’t over the booze limit, though Waze tips off citizens. Google has refused to comply, arguing that alerting folks to checkpoints preemptively makes them drive safer.

Cisco emits wad of security fixes: There are a bunch of product updates from Cisco this week that address security vulnerabilities in its gear. Some are updates to much earlier advisories. Of the new ones, we’ve got cross-site scripting holes in Cisco Identity Services Engine (CVE-2018-15440, CVE-2018-15463), a bug that can anyone can use to crash a Cisco Meeting Server (CVE-2019-1676), a content injection vulnerability in Cisco WebEx Business Suite (CVE-2019-1680), and various other issues that need patching, where support contracts allow, to keep the bad people out.

In space, er, Apple, no one can hear, er, see you scream, er, your screen: Apple has reminded iOS app developers not to use code that monitors exactly how people use their software without informing them. It turns out a number of high-profile applications are using an analytics package called Glassbox that beams back telemetry, from app to developer, so coders can observe how folks interact with the user interfaces, which is a no-no as it may leak sensitive information like credit card numbers.

Following a TechCrunch probe, Apple this week said: “Our App Store Review Guidelines require that apps request explicit user consent and provide a clear visual indication when recording, logging, or otherwise making a record of user activity. We have notified the developers that are in violation of these strict privacy terms and guidelines, and will take immediate action if necessary.”

Wi-Fi me to TheMoon, let me fraudulently view ads on YouTube: A botnet of compromised home broadband routers, dubbed TheMoon, has been caught fetching YouTube video pages seemingly to inflate vid ad impressions, according to US ISP CenturyLink. The malware infects Linksys, ASUS, MikroTik, GPON, and D-Link routers by scanning for known vulnerabilities in the devices and in web applications running on Internet-of-Things gadgets. The botnet is also used for brute-forcing credentials to log into websites and causing other mischief.

Phishing attack mimics Google using Translate: Phishing attacks are nothing special these days, however, researchers at Akamai have found one cunning criminal using Google Translate to steal credentials.

The superbly-named Larry Cashdollar at Akamai was sent an email that looked as though it came from Google telling him a new Windows machine had logged into his Facebook account. His suspicions were aroused when he noticed the email was sent from Hotmail, and decided to dig deeper. After clicking on a link in the message that claimed to offer more details, he clocked the URL had taken him to Google Translate: what he was seeing was a translated page that was trying to trick him into typing in his Gmail email address and password. The Google logo in the top left corner, and google.com in the URL, may have convinced a few victims at least to hand over their credentials.

Plus, some anti-phishing tools do not check Google Translated URLs. As ever, with suspicious emails check, check, and check again.

Swiss cheesed off with crap election security: Switzerland’s national postal system is inviting folks to hack its e-voting technology in a simulated federal vote so as to test the security of its networks and software. There’s up to roughly $50,000 (40,000 quid) up for grabs if you’re able to change votes without being detected. Source code, here.

Hacked remote-desktop login souk shut down: xDedic, a marketplace for buying and selling stolen RDP login details as well as people’s private personal information, has been torn offline by the FBI and officials in Belgium, Ukraine and Europol. We’re told the operation’s website has been seized, and three suspects cuffed in connection with the cyber-souk, ending what has been years of criminality. At its height, xDedic touted logins for 85,000 systems at a few bucks a pop, allowing fraudsters to bank as much as $70m from their victims. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/09/security_roundup/

The New York Police Department (NYPD) over the weekend sent a cease-and-desist letter to Google, demanding that it stop giving away the location of police driving while impaired (DWI) checkpoints.

According to Streetsblog, the letter came from Ann Prunty, NYPD’s Acting Deputy Commissioner for Legal Matters.

From the letter, which has since 404’ed from a number of news sites but which CNET still has up:

This letter serves to put you on notice that the NYPD has become aware that the Waze Mobile application, a community-driven GPS navigation application owned by Google LLC, currently permits the public to report DWI checkpoints throughout New York City and map these locations on the application.

Those checkpoints are part of New York’s Vision Zero initiative, the letter said: a program to eliminate traffic fatalities by, among other things, enforcing DWI laws. It’s putting “significant resources” into the effort, the letter said, and Waze users are gumming it up by giving away their unannounced road blocks and thereby helping drunk drivers evade them.

That interference could cross over into the criminal, the NYPD said:

Individuals who post the locations of DWI checkpoints may be engaging in criminal conduct since such actions could be intentional attempts to prevent and/or impair the administration of the DWI laws and other relevant criminal and traffic laws. The posting of such information for public consumption is irresponsible since it only serves to aid impaired and intoxicated drivers to evade checkpoints and encourage reckless driving. Revealing the location of checkpoints puts those drivers, their passengers, and the general public at risk.

The letter was sent following Google’s launch of a new feature on its Google Maps app, alerting drivers to the location of police speed cameras. The new speed camera alerts began showing up on Google Maps last week.

This isn’t the first time that police have tried to get Google to muzzle Waze: In 2015, US police asked Google to pull the plug on citizens using the mobile app to “stalk” police locations, regardless of whether they’re on their lunch break, assisting with a broken-down vehicle on the highway, or hiding in wait to nab speeders.

Acquired by Google in 2013, Waze describes itself as “the world’s largest community-based traffic and navigation app”.

The GPS navigation app relies on community-generated content that comes from a user base that, as of June 2013, reportedly consisted of nearly 50 million. It lets people report accidents, traffic jams, and speed and police traps, while its online map editor gives drivers updates on roads, landmarks, house numbers, and the cheapest nearby fuel.

In response to the NYPD’s letter, Google sent this statement to CBS2:

Safety is a top priority when developing navigation features at Google. We believe that informing drivers about upcoming speed traps allows them to be more careful and make safer decisions when they’re on the road.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/aY7BfM63694/

Police’s body-worn cams can be covert surveillance tools, the Investigatory Powers Tribunal has said.

The UK’s independent cops-and-spies oversight court ruled that a police officer’s decision to video a meeting inside a person’s home, without warning them in advance, amounted to covert surveillance under Part II of the Regulation of Investigatory Powers Act (2000).

The case was brought by an individual, AB, who had reported a burglary at a non-residential property he owned. Hampshire Constabulary officers later visited his home address to tell him the force would not be investigating.

UK Supreme Court considers whether spy court should be immune to legal probes

READ MORE

It was only after the officers had been in the home “for some time” that they told him one of their body-worn cameras was recording the interview. This prompted the complaint.

Initially, the officer didn’t tell the court why they had turned the cam on, leading the complainant’s counsel to note that it was “difficult to understand why any user would wish to utilise a body-worn camera when interviewing the owner of premises that have been subject to an attempted break-in”.

However, when the tribunal issued a direction to respond, the officer – who also attended with a colleague – explained his reasoning thus: “Before attending the address I was warned by my sergeant and members of the Lymington Neighbourhood’s Team that AB was renowned for making complaints against the police on a regular basis.

“At no point had I operated the body-worn video device for surveillance purposes, it was to record the interaction between myself and AB.”

The court, however, said that whether the device was being used for surveillance purposes was a matter for the court, not the officer, to decide.

In their judgment, the tribunal considered a previous case, which involved an audio recording of a voluntary declared interview, for note-taking purposes.

AB’s case, the court said, was sufficiently different from this for a number of reasons, namely that it involved a video recording, was carried out in someone’s home, wasn’t an interview and didn’t act simply as an aide-memoire.

“Rather it was, it would seem, to record by way of anticipation anything that might happen, in other words the behaviour (possibly anticipated misbehaviour) of AB,” the court said.

The court also pointed out that a video will record more than audio does, saying: “It is a much greater intrusion to have something which is recorded permanently and could be viewed by others much later on.”

MI5: Gosh, awkward. We looked down the sofa and, yeah, we *do* have intel on privacy bods

READ MORE

Moreover, the court said the fact it was in AB’s home brought Article 8 (which protects the right to private life, family life, correspondence and home) into play. “It would not be unusual, for example, for a person to have things like family photographs in the room,” it said.

“Even if there were no such private material which was recorded, the simple fact of the inside of their home being recorded, in our view, constitutes an act which falls within the scope of Article 8.”

The decision – the first since new rules governing the tribunal came into force on 31 December – is a preliminary issue in this case (AB v Hampshire Constabulary).

Having decided this issue of law, the tribunal said it would continue with its investigation of the matters after liaising with each party. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/08/body_worn_cameras_video_covert_surveillance/

The Australian Parliament has reset all passwords on the parliamentary computing network following an unspecified security incident.

In a joint statement on February 8, the legislature’s presiding officers – Speaker of the Australian House of Representatives Tony Smith, and Scott Ryan, President of the Australian Senate – said the action was “undertaken for abundance of caution” in response to an incident that occurred overnight and Friday morning.

“The Department of Parliamentary Services and relevant agencies are working jointly to take the necessary steps to investigate the incident, while our immediate focus has been on securing the network and protecting data and users,” the officials said. “There is no evidence that any data has been accessed or taken at this time, however this will remain subject to ongoing investigation.”

Smith and Ryan also said they had no evidence that the incident represents an attempt to sway the upcoming election, due in three months time, or to disrupt the electoral or political process.

Citing unnamed sources, The Sydney Morning Herald, however, suggests a foreign government may have tried to hack Oz’s parliamentary systems.

Australia has form on this

There’s precedent for that. Australian government systems have been targeted frequently in recent years, like just about every significant military and economic power in the world.

In 2011, computers used by Australian Prime Minister Julia Gillard and two senior ministers were hacked and Chinese intelligence agencies were suspected. In 2013, Chinese hackers were blamed for pilfering the blueprints of the new Australia Security Intelligence Organization headquarters.

In 2016, Australian Prime Minister Malcolm Turnbull committed AUD$400m over ten years to improving cyber security. In 2017, Australian defense data was stolen. And in 2018, government officials blamed Russia for an attack on routers in Australia the previous year.

South Korea reckons mystery hackers cracked open advanced weapons servers

READ MORE

In December last year, in conjunction with the indictments of two men alleged to be Chinese government hackers by the US Justice Department and similar claims from UK officials, Alastair MacGibbon, the head of the Australian Cyber Security Centre, warned tens of thousands of Australian companies may have been compromised in the so-called Cloudhopper campaign against global IT service providers like HPE and IBM.

The statement from Smith and Ryan nonetheless maintains, “Since 2012, DPS [Department of Parliamentary Services] has made substantial strides in strengthening cyber defenses for the APH [Australian Parliament House] IT networks.”

In a statement emailed to The Register, the Australian Signals Directorate, an intelligence collection and detection agency similar to the National Security Agency in the US, confirmed it is working with the Department of Parliamentary Services to secure the government’s network but offered no indication about the suspected source of the attack.

“At this early stage our immediate focus is on securing the network and protecting its users,” the ASD spokesperson said. “Proper and accurate attribution of a cyber incident takes time.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/08/australia_parliament_password_reset/

Twelve members of 20-person group extradited to US to face charges related to theft of millions via fake ads other scams.

US and international law enforcement authorities have dismantled a group operating mostly out of Romania that over the past five years allegedly stole millions of dollars from American citizens using false advertisements for goods online.

Twenty people, including 15 Romanians and 1 Bulgarian national, have been indicted for their roles in the operation. Twelve of the foreign nationals have been extradited to the US and are set to face trial later this year. The arrests stem from a 24-count indictment that a federal grand jury in Kentucky returned in July 2018.

This is the second win against online crime in recent weeks for US law enforcement and their counterparts in other countries. In January, the government announced it had taken down xDedic, one of the Internet’s largest sites for stolen goods.

The latest indictments allege that the Romanian group — identified in charging documents as the Alexandria Online Auction Fraud Network — engaged in numerous activities designed to defraud Internet users in the US and elsewhere by posing to sell goods that didn’t exist.

The most common scam was to place fake advertisements for automobiles and other items on online auction sites and multiple business-to-consumer and consumer-to-consumer sites, including eBay, Craigslist, and Amazon.

Often, the group used stolen identity information belonging to US residents to create online accounts for posting these advertisements and establishing email addresses, the US Department of Justice (DoJ) said in a statement.

Emails and invoices they sent to victims would contain the trademarks of reputable operations, like AOL Motors and EBay Motors, to trick victims into believing they were engaged in a legitimate transaction. The invoices would include phone numbers and email addresses for questions and contain language that guaranteed refunds and indicating the seller was a “verified” or “certified” seller on the particular platform.

The money that victims sent was converted to bitcoins and deposited in overseas accounts.

Members of the Alexandria Online Auction Fraud Network often assumed the personas of individuals working with the US armed forces to try and add credibility to their ads. One of the gang members, for instance — identified in a DOJ press release Thursday as Ionuţ Ciobanu, 28, of Romania — allegedly communicated with victims about potential vehicle sales, using the persona of “Sgt. Judith Lane,” a supposed member of the US Air Force. Ciobanu even created a Facebook profile for Judith Lane and posted at least two Facebook advertisements listing vehicles for sale. Another gang member pretended to be a “Sgt. Logan Burdick” when attempting to sell nonexistent goods.

“These members would convince American victims to send money for the advertised goods by crafting persuasive narratives, for example, by impersonating a military member who needed to sell the advertised item before deployment,” the DOJ said.

The 24-count indictment unsealed this week in US District Court for the Eastern District of Kentucky charges members of the Romanian group with racketeering and criminal conspiracy, wire fraud, money laundering, and aggravated identity theft. Some of the charges carry up to 20-year sentences in federal prison. The aggravated ID theft charges carry a mandatory two-year sentence that will be tacked on to the end of any other prison term the individual might receive.

Related Content:

• US Law Enforcement Shuts Down Massive Marketplace for Compromised Servers
• ‘London Blue’ BEC Cybercrime Gang Unmasked
• Major Online Criminal Marketplaces AlphaBay and Hansa Shut Down
• 8 Ways Hackers Monetize Stolen Data

 

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/us-law-enforcement-busts-romanian-online-crime-operation/d/d-id/1333832?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A newly discovered malware campaign uses steganography to hide GandCrab in a seemingly innocent Mario image.

In the Mario Brothers universe, Mario is a hero, but that “good guy” status doesn’t extend to the real world — at least not for victims of a malware campaign that wraps the GandCrab ransomware in a Mario graphic package.

Matthew Rowan, a researcher at Bromium, discovered the campaign in a malware sample he was analyzing. In his blog post detailing the discovery, he shows how threat actors hide their true intentions, why it’s a very bad idea to disable software protection mechanisms, and why old encryption techniques like steganography are still useful in the modern era.

The steganography comes into play with heavily obfuscated Microsoft PowerShell commands hidden within the color channels of a picture of Mario in a particularly cool pose. Rowan notes that hiding commands in the image makes it very difficult for a firewall to pick up the threat and apply a standard filter against the malware.

The new campaign is a threat to computer users in Italy, though, like most such campaigns, it could easily be modified by a different criminal to target users in any (or every) geography. 

Read more here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/malware-campaign-hides-ransomware-in-super-mario-wrapper/d/d-id/1333831?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple