STE WILLIAMS

Need to spy on your spouse? Your employees? That suspect who refuses to unlock his Android? It was easy-peasy up until a few weeks ago: you could have just grabbed their phone, placed a Skype call to it, answered the call, then poked around, no passcode needed.

In October, Florian Kunushevci, a 19-year-old bug hunter from Kosovo, reported the Skype for Android security flaw to Microsoft. It patched the hole for the latest version of Skype, which was issued 23 December.

He said in a post on LinkedIn that after he Skyped a target phone, the vulnerability let him view the photos,  albums, names and phone numbers in a victim’s contact list, as well as allowing him to access the phone’s browser. He also discovered that he could send messages from the phone, all without unlocking it.

Here’s Kunushevci’s proof of concept video:

None of that should happen. A user/attacker/thief/snoop shouldn’t have access to data such as photos and contacts without having gone through authentication via password, PIN, lock-screen pattern, or fingerprint.

Kunushevci told The Register that he wasn’t hunting for Skype for Android bugs. He was just using the Voice-over-IP (VoIP) app when he noticed something odd about how it accessed files on his handset. That’s when he started investigating to see how it might be exploited:

One day I got a feeling while using the app that there should be a need to check a part which seems to give me other options than it should. Then I had to change the way of thinking as a regular user into something that I can use for exploitation.

This is similar to an iOS 9 flaw from a few years ago that let you do the same thing. In September 2015, Apple patched a lock screen hole that let anyone view and edit your contacts, send text messages, and rummage through your photos, all without entering a passcode.

If you had an iOS 9 or 9.0.1 device with Siri accessible from your lock screen, you were vulnerable regardless of the type or length or your passcode, and regardless of whether you had turned on TouchID.

Hey, stuff happens when you code, Kunushevci said:

For the specific bug that I have found on Skype, it is more of a bad design and also a bug in coding. I think to put it all together, humans make mistakes.

Kunushevci said the Skype for Android vulnerability probably affects all Android devices using an unpatched Skype version. To protect themselves from the bug, users should update their Skype for Android app if they haven’t already.

The researcher wasn’t awarded a bug bounty, he said, but he should be getting a mention in Microsoft’s bug-hunter hall of fame, whenever that’s updated.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/-CvG-1u38Yo/

Welcome to 2019, just a few days into the year and we already have Chromecast chaos, Skype backdoors, and a Weather Channel privacy suit.

We also have plenty of other news to catch up on.

Stop the presses! LA Times grinds to a halt over ransomware

Most of us made a point of unplugging from the news over the holidays, but for those who read the LA Times, a ransomware infection nearly made that unplugging mandatory.

Late last week, a mysterious malware attack crippled key parts of the Times infrastructure and other papers in its parent Tribune Company, including portions of its printing systems. This sparked fears of state-sponsored or terrorist hackers at work.

How bad was it? El Reg has learned that, at its worst point, the Tribune Company was seriously considering asking the publishers of the San Francisco Chronicle to print their papers for them so that the weekend editions could get out on time.

Eventually, the panic settled and the issue was traced back to a ransomware infection that had managed to bork the systems that link the papers editorial office with those of the printing plants.

UK military withdraws from Gatwick drone duty

Anyone who had the misfortune of having to travel to, from, or in the general vicinity of London Gatwick airport over the holidays is by now familiar with the “drones” that menaced the airport.

As The Register reported, there was panic over the possibly non-existent drones that were thought to be buzzing planes on the airfield. This caused the airport to temporarily shut down and kicked off a man..er.. dronehunt to catch the rogue copter and its operator. The military was also called in to bring a calm to the situation.

We assume this all happened to the tune of Yakkity Sax.

Fortunately, the worst of the microflyer crisis seems to have passed, and the men and women of the RAF can finally make their triumphant homecoming from the harrowing fields of Gatwick.

There have to date been no arrests made, save for the Sussex couple who were released without charges on December 23.

HackerOne flaw vets cop to rookie mistake

A note to all the developers out there: Don’t beat yourselves up too much over security flaws, as even the bug-brokers at HackerOne fall victim to the occasional slip-up.

An in-house researcher discovered that the RFC2142 system HackerOne uses for its @wearehackerone.com email forwarding service hadn’t properly reserved key names such as “security” or “admin”.

This would have, potentially, allowed someone who was up to no good to register a name like “admin@wearehackerone” or “abuse@wearehackerone” and then use the address to cause chaos.

To its credit, HackerOne not only acknowledged and addressed the vulnerability, but published a report on it on their ‘hacktivity’ feed.

Israeli security shop wants to be a pain in the dong

A secretive security firm exposed in Israel has a highly unusual name.

The outfit wants to sell hacking tools to governments and law enforcement, although experience has shown these aren’t just used to track down criminals but also people governments find tiresome.

The group calls itself Candiru, after the small fish in the Amazon which, legend has it, can swim up a stream of urine and embed itself in a victim’s urethra using a barbed head.

Presumably the name is a reference to how the biz’s malware is both highly invasive and difficult to remove. No doubt someone in marketing no doubt thought this was a terribly clever and/or funny idea. We’d go with the former.

Nice patch Google, too bad it only took three years to arrive

Tardy patching is nothing new in the security industry, but Google is usually thought to be better than most at getting stuff fixed. Not so in this case.

According to flaw finders Nightwatch Cybersecurity there was a serious flaw in the Chrome browser used by Android which would allow an attacker to work out the hardware a particular handset is using. It did this thanks to flaws in WebView and Tabs for Android, which could show the hardware model, firmware version and security patch level of a phone.

Such information is obviously invaluable for an attacker and in May 2015 Nightwatch reported the issue to Google, but the security team at the Chocolate Factory said it wasn’t really an issue.

However, in October the new build of Chrome, version 70, appears to have finally fixed the issue – at least in part. The firmware build information isn’t now readable but the device model number. Better than nothing, but still not good enough.

Whose switch is it anyway?

Anonymous switches pose a little known, but significant, threat to security. Don’t believe us? Check out this report into the prevalence of unauthenticated HP and Aruba switches that can be found using Shodan.

Unauthenticated switches pose a danger because they do not log activity and could be accessed over Web UI or, even worse, Telnet.

“From Telnet, an attacker could do a number of things from this switch, from redirecting traffic/ports, to serving malware, to pivoting within the network that the switches live in,” the report, authored by one of the hosts of the ThugCrowd podcast reads.

Admins are advised to set usernames and passwords, and disable WebUI if it is not needed.

Insinia pulls mass Twitter ‘hack’ to prove a point

Call it the Twitter security crisis that wasn’t. Earlier this week, mobile security company Insinia pulled something of a cross between a publicity stunt, protest, and a proof of concept when it kicked out a number of fake Tweets to various celebrity accounts.

The company would later explain that it did not actually take over any accounts, but rather exploited a little-known feature on Twitter that lets users send tweets over SMS.

The idea is that a user who has their phone number linked to their account could send an SMS from that number and have the message contents automatically posted as a Tweet from their account.

This also means that anyone who could spoof that number, as Insinia did with the celebrity accounts, could post Tweets as well.

Insinia is urging Twitter to kill the feature and for users to unlink their accounts from their phone numbers.

Luas website hacked, ransom set at $4,000.. er… $3,500… er… $3,800

Irish tram operator Luas is the latest transit agency to fall victim to ransom-demanding hackers. The exact price of that ransom depends on whatever the cryptocurrency market is doing at the moment.

In this case, someone took over the train company’s official website and said they would only hand it back if they were paid one Bitcoin. If the company opted not to pay up within five days, the hacker also threatened to release company emails.

By late Friday, the site was not yet back online, though Luas has apparently been able to regain control of the domain.

“Luas technicians are still investigating [the attack] and are working to restore the site,” the notice reads.

“Luas has contacted the Commissioner for Data Protection and we have in accordance with best practice contacted everyone whose information may have been compromised.”

Bad news from OSnews

Long-running tech news site OSnews appears to have fallen victim to data thieves.

The site announced this week that some or all of its data had apparently been lifted by an intruder. This after readers reported getting spam and phishing emails. It was eventually concluded the site had been breached and OSnews went offline for a few days before returning with an explanation.

“Our best guess is that someone was able to exploit a vulnerability in old, unmaintained code in the site’s content management system, and made off with at least some user data, which may be as little as a few user records or, at worst, our entire database,” the site said.

“Your email addresses were in there, and the encryption on the passwords wasn’t up to modern standards (unsalted SHA1). The truth is that once we concluded it was likely that we were breached, our small volunteer team decided it was better to go offline than it was to learn the avenue of exploit, given that we had no interest in continuing to rely on the aged codebase.”

How many times do we have to do this? Fix your terrible router security, vendors!

Yet again, we have a damning report on the state of security in home wireless routers.

This time, it is Cyber-ITL who peered into (PDF) the safety of 28 popular home routers and found that, depending on the architecture, the state of security was either grim… or totally hopeless.

In the latter category are routers based on MIPS SoCs, which were all found to contain a flaw that renders data execution prevention (DEP) in effective, potentially allowing an attacker to feed in and execute malicious code.

ARM-based routers fared a bit better, but only slightly.

“Though the Linux/ARM stack is completely unaffected by the aforementioned bug, for many devices it makes almost no difference,” the report reads.

“Of the access points and routers we reviewed, not a single one took full advantage of the basic application armoring features provided by the operating system. Indeed, only one or two models even came close, and no brand did well consistently across all models tested.”

And on that cheery note, we hope everyone enjoys the weekend! ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/05/security_roundup_040119/

The Weather Channel app duped users into providing location data that the company then sold for advertising and other commercial purposes, according to a lawsuit brought by Los Angeles City Attorney Mike Feuer.

The complaint, filed in Los Angeles Superior Court on Thursday, alleges that the mobile application, owned by IBM’s Weather Company (TWC), in seeking user permission to gather location data, fails to explain clearly how it shares the information.

“When seeking users’ permission to track geolocation data, the app does not disclose to users that TWC will transmit that data to third parties, nor that the data will be used for advertising and other commercial purposes bearing no relation to weather or the services provided by the app,” the complaint says.

“To the contrary, the app misleadingly suggests that such data will be used only to provide users with ‘personalized local weather data, alerts and forecasts.'”

The complaint alleges that the Weather Channel app has collected detailed location data on app users for years and that the Weather Company has analyzed and/or transferred the data to third parties for targeted advertising and to help hedge funds understand consumer behavior.

It contends that one of IBM’s primary reasons for buying the Weather Company was to profit from this data. And it says that TWC intentionally hides the fact that it shares location data in its lengthy privacy policy because the company recognizes many users would object to such data sharing if they knew of it.

“If the cost of a weather forecast will be the sacrifice of deeply private information – like precisely where we are, day and night – it must be clear, in advance,” said Feuer in a statement. “But we allege TWC elevates corporate profits over users’ privacy, misleading them into allowing their movements to be tracked, 24/7. We’re acting to stop this alleged deceit.”

Feuer argues Americans need to be properly informed before making privacy decisions.

IBM hardly alone in this

The lawsuit follows a report last month in the New York Times that delved into the extent to which mobile apps gather location data without adequate disclosure and a year of scrutiny of Facebook over its sharing of user data with partners and developers.

TWC, according to the complaint, has been able to convince about 80 per cent of users to grant access to geolocation data. The company is said to collect more than a billion pieces of location data per week.

At least it asked. Google evidently didn’t even do that: In 2017, the search biz was accused of collecting data on Android phones regardless of whether users allowed such collection. Google insisted it didn’t use location data harvested from cell towers though it said it discontinued the practice.

In 2018, the Associated Press published similar claims about Google while the ACLU accused Facebook of tracking people without permission.

Windows 10 can carry on slurping even when you’re sure you yelled STOP!

READ MORE

IBM defended TWC’s disclosure practices. “The Weather Company has always been transparent with use of location data; the disclosures are fully appropriate, and we will defend them vigorously,” the company said in an emailed statement.

In a press conference streamed via Twitter – under investigation by Ireland’s Data Protection Commission over its collection of user location data – Feuer expressed skepticism about IBM’s defense of its subsidiary.

“If a company were really transparent, that first screen [in the Weather Channel app] would tell the user that their location data was being used for far more than weather,” he said.

The lawsuit seeks the statutory penalty under California’s Unfair Competition Law, up to $2,500 per violation, or twice that when the victim is disabled or a senior citizen. The app is said to have 45 million monthly users; it’s not yet clear how many reside in California. Feuer said it’s premature to discuss how much a potential penalty might be.

Feuer made clear that many companies engage in similar downplayed location data gathering. TWC’s app was targeted, he said, because it touches all demographics and seems benign and innocuous, because the company claims to have the largest trove of geolocation data and because the company did little to change its practices in the wake of the New York Times expose.

“The issue of our privacy in the digital age is one of the most fundamental issues we confront today,” he said. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/04/ibm_weather_company_app_privacy/

A new phishing campaign that uses a custom font to hide its tracks and evade detection has been uncovered.

Security house Proofpoint reports this week that miscreants hoping to steal login credentials from customers of “a major retail bank” were able to hide their phishing emails from automatic detection tools by seemingly scrambling their messages into gibberish. Once rendered in an email client, the messages appear as coherent text, thanks to a custom font unscrambling the letters.

Proofpoint said the phishing campaign has been in operation since at least May 2018, and is still active.

Here’s how it works: the page loads a custom font that would, for example, draw the “A” as “E”, “B” as “H”, and so on. This creates a primitive substitution cipher fooling security tools looking for certain keywords, as the software would only observe a set of random letters, but the user would see readable text.

Detailed: How Russian government’s Fancy Bear UEFI rootkit sneaks onto Windows PCs

READ MORE

“In this case, actors developed a phishing template that uses a custom web font to implement a substitution cypher, among other techniques, to render well-crafted phishing pages for credentials to a major US bank,” Proofpoint said in its analysis.

“While the substitution cypher itself is simple, the implementation via web font files appears to be unique, giving phishing actors yet another technique to hide their tracks and defraud consumers.”

That a phishing page would use a cipher to disguise its actual displayed text is not uncommon, says Proofpoint. Normally, however, that operation is performed through JavaScript. Most browser security tools now know to look for decryption or deobfuscating scripts in a message’s source code, forcing the hackers in this operation to find another way to obfuscate their text.

The logos used in the fake banking email are also obfuscated. Instead of embedding the actual corporate logos, which might be spotted by anti-phishing systems, they are rendered using scalable vector graphics, so the logo and its source do not appear in the source code

As always, one way to avoid phishing attacks (along with running antivirus and spam filters) is to avoid following links from any unsolicited or suspicious emails that purport to be from your bank. If in doubt, users can always open a new browser window and manually type in the bank’s correct address and login to make sure they are on an authentic website. Viewing messages in plain-text will also reveal or neuter any shenanigans. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/04/phishing_homebrew_fonts/

Some of the computer security boffins who revealed last year’s data-leaking speculative-execution holes have identified yet another side-channel attack that can bypass security protections in modern systems.

While side channel attacks like Spectre and Meltdown exploited chip design flaws to glean privileged information, this one is hardware agnostic, involves the operating system page cache, and can be exploited remotely, within limits.

In a paper provided to The Register in advance of distribution early next week through ArXiv, researchers from Graz University of Technology, Boston University, NetApp, CrowdStrike, and Intel – Daniel Gruss, Erik Kraft, Trishita Tiwari, Michael Schwarz, Ari Trachtenberg, Jason Hennessey, Alex Ionescu, and Anders Fogh – describe a way to monitor how certain processes access memory through the operating system page cache.

“We present a set of local attacks that work entirely without any timers, utilizing operating system calls (mincore on Linux and QueryWorkingSetEx on Windows) to elicit page cache information,” the researchers. “We also show that page cache metadata can leak to a remote attacker over a network channel, producing a stealthy covert channel between a malicious local sender process and an external attacker.”

Access to such otherwise hidden information allows the bit boffins to conduct local attacks such as bypassing sandbox protections, interface redressing, and keystroke-timing attacks on a PHP password generation script. The technique can also be adapted to operate remotely, though such exploitation would have to be tailored for specific hardware and would need to incorporate hardware timing measurement. The researchers consider their page cache side channel attacks comparable in terms of performance to hardware cache attacks.

In short, this side-channel attack can be exploited by rogue users and malware running on a vulnerable system to potentially tamper with the software and siphon secret data from other applications, or potentially can be exploited remotely over a network in limited circumstances.

The operating system’s page cache stores in RAM chunks of executables, libraries, and assorted data, that are stored on disk and are regularly used by applications and the operating system. Rather than slowly pull information from, or write information to, disk when accessing these files, it’s much faster to load the objects once from disk into memory, access that memory, and deal with any writes later on.

These cached pages can be mapped into the virtual memory areas of multiple processes at the same time. For example, a code library can be loaded into physical memory once, and mapped into multiple applications’ virtual memory spaces, saving physical RAM and time.

If a process wants to alter memory that’s shared this way, the operating system creates a private copy of that data for that particular application to scribble over so that it doesn’t affect other programs’ view of the information. Such sharing of memory, and bringing it in and out of the cache, opens avenues of attack: it’s possible to snoop on access patterns of other programs and extract data based on how long it takes for pages to be copied or moved between the disk and cache.

Local or remote?

For the local attack, the researcher’s technique assumes the attacker and victim are running processes under the same operating system or in isolated sandboxes with shared files. The method uses the mincore system call on Linux and the QueryWorkingSetEx system call on Windows to determine which pages of a memory range are present in the page cache and which are not.

The remote attack looks to measure soft page faults: errors that occur when an application touches memory that is valid but doesn’t have physical pages assigned to it at that moment, causing the operating system to allocate any necessary pages. It involves an attacker running a process on a remote server that measures the latency of memory pages in public files.

In an email to The Register, researcher Daniel Gruss, one of the paper’s co-authors, characterized the work as mainly a matter of academic interest; it has been responsibly disclosed and, for Windows at least, patched.

In case you’re not already sick of Spectre… Boffins demo Speculator tool for sniffing out data-leaking CPU holes

READ MORE

“We think this is an important step in showing that on the operating system level, we run into the exact same problems as on the hardware level,” he said.

According to Gruss, the vulnerability was addressed in Windows 10 Insider Preview Build 18305, although he’s not sure when the patch will appear in a public release.

The fix requires the PROCESS_QUERY_INFORMATION flag for QueryWorkingSetEx instead of PROCESS_QUERY_LIMITED_INFORMATION, so less privileged processes cannot directly access page cache information. It also omits Share Count information, the number of processes a page has in its working set, which can be useful for making indirect observations of changes in other processes.

The Linux security team is said to be aware of the issue though the paper provides no details about mitigation efforts. The developers of phpMyFAQ, used to demonstrate the PHP password generation attack, were also informed of the work and have issued a corrective patch. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/05/boffins_beat_page_cache/

In a newly published editorial and video, Intel details what specific actions it has taken in the wake of the discovery of the CPU vulnerabilities.

In January of 2018, the world was introduced to two game-changing CPU vulnerabilities, Spectre and Meltdown, that brought “speculative execution side-channel vulnerability” into the enterprise IT security lexicon. Since then, a number of variants of the initial vulnerabilities have been found, along with new vulnerabilities taking advantage of similar functions within the CPUs.

Early on, chip manufacturers and software publishers rushed to release mitigation code, some of which had significant unintended consequences, including multiple system reboots and dramatic application slowdown. Since those early days after the vulns were disclosed, the response has become more measured. But many customers are still wary of any response — especially since many of the updates are either mandatory within an operating system’s update stream or baked into new releases of hardware and software.

Intel kicked off 2019 with a Jan. 2 editorial laying out its response to the Spectre and Meltdown vulnerabilities over the past year. The chip giant says the culture of the company has changed since the advent of Spectre and Meltdown, and its response has been effective. But vulnerabilities in the core of a CPU tend not to lend themselves too rapid, complete fixes, Intel says.

Here’s a look at Intel’s retrospective on Spectre and Meltdown as well as commentary from industry experts. While questions remain about whether most users should place these vulnerabilities high on their list of concerns, there is no question that the vulnerabilities – and the response to the vulnerabilities – have had an impact on every organization and individual purchasing a computer in 2018 and beyond.

Have Spectre and Meltdown figured into your security planning? Let us know in the comment section below.

(Image: Meltdownattack.com)

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities-and-threats/how-intel-has-responded-to-spectre-and-meltdown/d/d-id/1333587?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The vulnerabilities could be remotely exploited and give attackers control over affected systems.

The CERT Coordination Center (CERT/CC) today published data on vulnerabilities affecting versions of Microsoft Windows and Windows Server.

Microsoft had issued an advisory for CVE-2018-8611, a Windows kernel elevation of privilege bug that exists when the Windows kernel fails to properly handle objects in memory. An attacker who exploited this flaw could run arbitrary code in kernel mode. They could then install programs and view, change, or delete data, or create new accounts with full user rights.

The company also issued CVE-2018-8626 for a Windows DNS server heap overflow vulnerability. A remote code execution flaw exists in Windows DNS servers when they don’t properly handle requests, Microsoft explains. Unauthorized actors who exploit this bug could run arbitrary code in the context of the Local System Account. Windows servers configured as DNS servers are at risk.

US-CERT, meanwhile, today advised users and system administrators to review CERT’s vulnerability notes VU#289907 and VU#531281. 

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/cert-cc-details-critical-flaws-in-microsoft-windows-server-/d/d-id/1333590?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Authorities are investigating if breach resulted from a leak or a cyberattack.

Private emails, contacts, copies of identity cards, and other personal information belonging to hundreds of German politicians — including Chancellor Angela Merkel — were recently stolen and published on Twitter through the course of December.

The cause of the huge breach is still being investigated. But some media outlets, including Reuters, quoted Germany’s Interior Minister Horst Seehofer as saying the data appears to have been illegally obtained by someone using stolen login information for cloud services, email accounts, and social media accounts belonging to the victims.

There is no evidence that the German government’s IT systems or networks were compromised, Seehofer said. German investigators are trying to figure out if the breach was the result of a deliberate leak by someone with access to the data or came from a cyberattack, according to Reuters, quoting an unnamed source.

The data that was leaked via Twitter last month included figures from every major political party in Germany except Alternative for Germany (AfD), a far-right-wing party, the BBC reported. The leaked information included Merkel’s email address and several emails that she sent and received. Other victims included member of Germany’s national parliament, MPs from state parliaments, and a handful of journalists and TV personalities.

The victim profile has led to speculation that some German right-wing groups may have been behind the leak. There is also some suspicion that a Russian advanced threat group, working on behalf of the government, may have been involved, the BBC said.

CrowdStrike, a security vendor that tracks multiple Russian threat groups, says the data currently available suggests the Twitter accounts that were used to post the data were likely managed by the same group of individuals.

 “An analysis of the Twitter follower network used to leak the data indicates that the leak may have a political angle,” says Adam Meyers, CrowdStrike’s vice president of intelligence. “The motivation behind the leaks remains unclear. With the analysis presently available, CrowdStrike Intelligence cannot rule out an information operation.”

On Friday, the Hamburg Commissioner for Data Protection and Freedom of Information noted that the office had asked Twitter to remove access to links pointing to the stolen data but has not heard back from the company. The Twitter account that was used to publish the data has already been shut down. The effort now is try and block links pointing to other platforms where the actual data is located, the Commissioner said in a statement.

“The amount of data published is immense,” the Commissioner’s office noted. Even though the information that has been leaked has no public safety implication, the potential damage to the affected individuals is significant, it said.

Dave Weinstein, vice president of threat research at Claroty, says that based on the range of information leaked, the breach appears to result from numerous types of account compromises, including email as well as social and financial accounts.

The hackers could have used numerous tactics to compromises these accounts, including spearphising and other forms of social engineering. “It’s also possible that these accounts were protected by weak passwords and little to no other authentication controls, which would have made it easier for the attackers to gain access without detection.”

Given the victim profile the motivations are very likely political and ideological in nature, Weinstein says. “The absence of right-wing victims suggests that the perpetrator might be a right-wing activity, but it is hardly a conclusive indicator at this point.”

The nature of the German data compromise has evoked some comparisons to the 2016 attacks on the Democratic Party networks in the US and the misinformation campaign in the run-up to the presidential election.

“There is a history of Russian state sponsored interference and cyberattacks into western democracies, particularly those aligned with NATO,” says Matt Walmsley, EMEA director at Vectra.

Though there’s no evidence to support any direct attribution yet, if Russia was the attack, it would not be surprising if threat actors like the Sofacy group (aka Fancy Bear/APT28) were involved. In the past, the group has been linked to attacks on the German parliament, he notes. “Erosion of confidence in the government could benefit nation states wishing to promote political instability in Germany,” Walmsley says.

Related Content:

• Cyberattacks in Finland Surge During Trump-Putin Summit
• Dutch Intel Agency Reportedly Helped US Attribute DNC Hack to Russia
• Russian Hackers Behind DNC Breach Wage Post-US Election Attacks
• 5 Things We Know So Far About The DNC Hack

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/data-on-hundreds-of-german-politicians-published-online-in-massive-compromise/d/d-id/1333591?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

New information on the Starwood breach shows that the overall breach was somewhat smaller than originally announced, but the news for passport holders is worse.

Commenting on a new round of information about the massive data breach that struck Starwood Hotels, Marriott International now says that the breach was somewhat less massive than originally thought, affecting roughly 383 million records rather than the 500 million originally said to have been compromised.

The news about the passport information released is not as good: Marriott has now put a number on the breached passport records, and it’s 5.25 million. That’s the number of unencrypted passport numbers that were accessed; roughly 20.3 million encrypted numbers were grabbed by the perpetrators, though Marriott says that there is no evidence that the criminals got the key required for unencrypting the files.

Responding to the announcement, Matt Aldridge, senior solutions architect at Webroot, said, “A key question we need to ask is why do hotels need to store passport numbers? One of the biggest impacts of GDPR was that it forced companies to consider the personal data they hold and ask customers for, whether this data was really needed and if so how to properly protect it. This is a great example of too much data being collected and retained.”

Marriott says that it will have a mechanism available on its website for guests to check in order to see whether their passport number was accessed; the company promises to update the website and notify the public when the mechanism is running.

For more, read here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/marriott-sheds-new-light-on-massive-breach-/d/d-id/1333592?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

We wrote about the resurgence of a year-old Facebook hoax during the holiday season…

…and ended up with many people asking us, “Does it really matter?”

Over the years we’ve seen hoaxes telling you that you definitely should post a picture of an egg, that you definitely shouldn’t set your profile picture to a giraffe, and even a hoax telling you that the text BFF added to a comment would turn green if your account security was up to scratch.

(Actually, the text BFF did turn green, but only to make it look cool.)

Is this mostly harmless fun, or a genuine security risk?

Here’s what you need to know, all in plain English.

(Watch directly on YouTube if the video won’t play here.)

Yes, you can buy those shirts for yourself – head to https://shop.sophos.com/.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/6Z0Kn9GHWMY/