STE WILLIAMS

Microsoft Patch Tuesday

It’s Patch Tuesday this week – the last one, indeed, for 2013, the year in which we celebrated the tenth anniversary of Microsoft’s formularised process for security updates.

So here’s our news-in-brief, as usual, to give you a quick summary of what to look forward to on Tuesday.

You’ll be facing a pretty regular-sized effort, with eleven bulletins, five of them critical and six of them closing potential remote code execution (RCE) holes.

The non-critical RCE bug is rated important, which is a level usually used by Microsoft for compromises that provoke some sort of warning or prompt, even if it’s not a very helpful warning (in other words, where there is some visual signal to look out for).

But important is also used for some vulnerabilities that result from “sequences of user actions that do not generate prompts or warnings,” though you and I would probably just say, “drive-by install” or, for that matter, “RCE.”

→ The difference in urgency and timing between criticals and importants has never been terribly clear. You are urged to update the former “immediately” and the latter “at the earliest opportunity,” though quite how you could perform any update earlier than at the earliest opportunity is unclear.

In fact, all of this month’s patches fall into the “earliest opportunity or sooner” category, with none of the eleven rated softer than important.

Affected products include:

  • Windows end-user operating systems
  • Windows server operating systems
  • Office
  • Lync
  • Internet Explorer
  • Exchange
  • Microsoft Developer Tools

The Developer Tools patches apply to ASP.NET SignalR, a programming library that simplifies the coding of cloud-style applications, and Team Foundation Server (TFS), Microsoft’s source code control and code project management system.

If you have developers in your organisation, and you are using TFS, don’t delay this patch.

The vulnerability is an Elevation of Privilege (EoP), rather than a full-blown RCE, but EoPs are risky at the best of times, and can be particularly pernicious in a version control system.

They typically turn any user into an administrator, which, in a programming project control system, could quite literally result in history being rewritten unexpectedly.

We know that cybercrooks have a special interest in getting into, and potentially modifying, your source code.

Amongst other things, it means that they can build their malware into your software up front, saving them from finding and exploiting hitherto unknown vulnerabilities later on.

→ We’ve written recently about a giant source code theft from Adobe; a source code compromise at open source ad server project OpenX; and a sustained, systematic and at least somewhat successful password guessing attack, apparently using a 40,000-strong botnet, at popular online source code repository GitHub.

Talking of EoPs, you will no doubt have read Microsoft’s announcement, at the end of November, of CVE-2013-5065, a kernel-based privilege escalation bug in the driver NDPROXY.SYS on Windows XP.

The CVE-2013-5065 vulnerability is known to have been exploited in the wild.

What we don’t know yet is whether the December 2013 Patch Tuesday fixes that one or not.

It seems probable, given that Bulletin 8 is listed as an EoP in Windows, with updates available only for XP and Server 2003. (That’s the only bulletin that applies exclusively to XP/2003.)

But we shall have to wait until Tuesday tell you for sure.

By the way, this month really is an omnibus (a Latin word meaning “for everyone”) update.

All platforms are affected, from XP to 8.1 and from Server 2003 to 2012, including installs of the stripped-down Server Core variants.

In addition, this month’s Internet Explorer update covers the whole product range, from IE 6 to IE 11.

In short: plan to patch (and to reboot) every Windows-based computer and virtual machine in your business, no later than at the earliest opportunity.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/qORFTOnuR6k/

FTC slapdown, no iPhone for Mr President, and Dutch banks get tough – 60 Sec Security [VIDEO]

Troll victim upset as tormentor escapes with written warning

Tablet. Image courtesy of Shutterstock.On Tuesday, Nicola Brookes told me, she received a Christmas card in the post, sent to her home address.

On the front of the card was a picture of a dog. The message wished Happy Christmas To A Dog.

Inside the card, she found a large photo of herself, in the hospital, eyes closed, with tubes taped to her throat, nose and temple. The picture had been scraped from her daughter’s Facebook posts regarding Ms. Brooke’s emergency surgery for Crohn’s disease.

The image of a “Get Well Soon” balloon was pasted over the photo.

That might not seem like a terribly vicious troll attack. After all, the image included a “get well” message. But the card also must be placed in the context of preceding troll-crafted images.

One such: Ms. Brookes’s face is pasted over the image of a woman, on the floor, hogtied, with her hands tied behind her back, her feet tied together, one end of the rope tied around her neck in such a way that she would, eventually, tire of keeping her legs elevated, relax, and thereby strangle herself to death.

The woman in the photo is surrounded by troll dolls. The caption: “TROLL RAPE: You never even saw it coming”.

She claims to have received much worse images than that. I have been shown the images. They are even more abhorrent than the troll rape one, so we’ll refrain from describing them.

Not that any of this is new, mind you. It’s been going on for over two years.

During that time, since posting a message of support for another troll victim, Ms. Brookes has been the subject of website hate pages: one about Brookes’s Crohn’s disease, and another falsely labeling her a paedophile and a drug dealer.

One Facebook clone account sent suggestive messages to young girls in her name.

Brookes has also been the subject of many headlines for stories about internet trolls, many of which had a feel-good tone: they often trumpeted a “victory over cyber bullies“, given a landmark case in which Ms. Brookes forced Facebook to reveal her trolls’ names, email addresses and IP addresses.

An active UK policeman, Lee Rimell, was arrested in connection with the abuse.

Following an investigation by Sussex Police the Crown Prosecution Service (CPS) subsequently decided that PC Rimell shouldn’t face criminal charges.

In order to bring a case to court the CPS must be satisfied that there is sufficient evidence to bring a conviction and in this case they were not. The BBC quotes the CPS as saying:

“You engaged with the ‘trolls’ contrary to the specific advice given to you by Sussex Police on at least three occasions.”

Ms. Brookes denies that Sussex Police ever gave her that advice at all, let alone told her three times.

The quote also appears in a letter supplied by Brookes that details the decisions taken by the CPS (the Police wouldn’t confirm or deny that the letters originated from CPS). The letter, apparently from the CPS’s Appeals and Review Unit, states:

“I have also been provided with snapshots from Facebook where you appear to seek out correspondence from the ‘trolls’ … These snapshots would likely lead a Court to conclude that you actively followed and engaged in the profile pages of trolls; indeed seeking the suspect Lee Rimmell when he was not engaging … It is my decision therefore that there is no realistic prospect of conviction in relation to any offence arising from these messages.”

Brookes claims that the examples of her engaging with the trolls are “not a fair reflection of the full extent of the online comments exchanged between myself and PC Rimell on his troll abuse page.” They have, she claims “been taken out of context and used to victim-blame”.

The letter goes on to explain that Rimell was arrested and interviewed in respect of Brookes’s Hotmail account being hacked into and why the CPS concluded that there was insufficient evidence to charge him:

Lee Rimmell [sic misspelled surname in all instances] was arrested and interviewed in respect of the allegation that your Hotmail account was hacked into. The computer which was seized and examined by the Police was shown to be reconditioned in July 2012. This post-dates the offence. Lee Rimmell denied the offence and stated that his account was hacked into. He further intimated that it was possible that this person also hacked into your account from his account. The Police inform me that they contacted an expert who confirmed that it is possible for another individual to access and use Lee Rimmell’s IP address to hack into your account. We are at a disadvantage as Lee Rimmell’s computer for the relevant period is no longer available and cannot be examined. There is therefore insufficient evidence on the material provided to us to prove that Lee Rimmell was responsible for hacking into your computer.

The letter also states that another man was arrested and interviewed in relation to the false Facebook account but that his computer was not examined because he told Police that other people had access to it.

All of this is just part and parcel of a dragged-out ordeal, which has included Ms. Brookes dismissing her pro bono legal counsel, alleging malpractice; and the police’s claims, according to Brookes, that she didn’t file a complaint months ago, which has sent her back to square one.

PC Rimell won’t be facing criminal charges but on Tuesday he attended what’s called a “Misconduct Meeting” in regards to Sussex Police’s decision that his conduct towards Nicola Brookes breached their Standards of Professional Behaviour.

At the end of the meeting, Rimell was given the harshest possible penalty for a Misconduct Meeting. Namely, he was given a “Final Written Warning”.

The UK police have not provided any details about just what it is that Rimell did to earn this “Final Written Warning.” All I can say for sure is that he carried out online activities which merited the most severe of four outcomes of a misconduct hearing.

The warning will be placed on PC Rimell’s personal file and will remain live for eighteen months from Thursday, 5 December. Further misconduct (that justifies more than management advice) will result in dismissal in all but unspecified “exceptional circumstances,” at which point the slap on the wrist “final” warning may extend to yet another 18 months, but “on one occasion only”.

Disappointed and angry, Nicola Brookes has described the police investigation as a “flawed white wash” and has made a complaint to the Independent Police Complaints Commission about the original investigation. She told us:

It took six months before police would open a case. My solicitors for months wrote letters, since 2011, trying to force police to investigate what’s happening. They just wouldn’t.

Meanwhile, Ms. Brookes believes that the advice being handed out to victims – “don’t engage cyber bullies,” for example – is a joke:

In the beginning, I answered them back. I felt I had every right to defend myself at the time.

She also relates to cyber-bullying victims who take their own lives, she said:

I can completely understand [teen suicides]. I had very, very low days. Very low.

The advice going on, [victims find ourselves] just screaming and shouting at the TV and our monitors, saying ‘We do all that anyway.’ They still get to us. The police are completely uneducated. They don’t have the training or resources to tackle this problem.

As The Independent reported in late November, the national stalking advocacy service Paladin reports that less than a third of UK police officers have received training on a new stalking law, despite its implementation a year ago.

Out of 320 people arrested in the first six months under the new law in England and Wales, only 189 have been charged, while 27 received a conviction and only six served jail time, The Independent reports.

Despite it’s limitations “don’t feed the trolls” remains the best advice. Clearly it’s not always that that easy and it is not by any means a guarantee of success.

Brookes continues to persue her case through the legal channels available to her and I encourage others to do the same. If you want to know how to report abuse at the hands of online trolls to the appropriate legal authority then read our guide on how to report a computer crime: Trolling.

Today Nicola Brookes reported the sinister Christmas card to the Sussex police. She told us the police are dealing with it as a new offence that is unconnected with the previous 2 years of abuse and that because they don’t anticipate getting any useful forensic evidence from the envelope it is doubtful that the matter will be taken any further.

Image of tablet courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/txl-NdcORRY/

iPhones are off limits to President Obama for “security reasons”

Obama, image courtesy of ShutterstockThe powers that be won’t let US President Barack Obama use an iPhone because of security reasons, he told a group of young people while pitching his signature healthcare law at the White House.

From the Wall Street Journal’s coverage:

I am not allowed, for security reasons, to have an iPhone.

However, the president’s daughters, Sasha and Malia, do have iPhones and “seem to spend a lot of time” using them, he said.

President Obama is constrained to using a phone from the surprisingly enough still-not-dead BlackBerry.

All things Apple are not entirely forbidden, mind you. Mr. Obama can, in fact, use an iPad to scan news headlines and surf the internet, Vanity Fair reported last year.

What’s so darn scary about the iPhone?

The US government didn’t pass out details so we don’t know if they’ve definitely found something they don’t like or they just haven’t finished looking yet.

If they’re still mulling it over there are a few security-related things they’ll want to look at:

That last predilection actually got Siri banned from IBM, given that Big Blue didn’t take a shine to the idea that transcripts of its employees’ musings would be lying around at Apple.

Another thing that’s historically made the US government shy away from Apple is its apparent allergy to openness.

In 2012, when the US was moving to equip military and government officials with mobile devices, it specifically looked to Google’s Android operating system to meet its security requirements.

Why not the iPhone? Because Apple has never let developers fiddle with its code as freely as Google has.

In February 2011, Apple did make a tentative step toward opening up, offering a copy of the developer preview of Mac OS X 10.7, aka Lion, to security researchers and asking for feedback – by invitation only, and only under a non-disclosure agreement regarding whatever researchers found.

That door wasn’t ajar long. Nine months later, it slammed shut on security researcher Charlie Miller – aka “that Apple 0day guy” – who had the gall to uncover a potentially dangerous bug he found in iOS that allowed unapproved code to be run on iPads and iPhones.

Miller packed a proof-of-concept bug into a fake stock ticker program for distribution in Apple’s App Store.

Apple didn’t appreciate it.

Instead of thanking him for pointing out a dangerous hole with a harmless demo, they ripped up Miller’s license as an Apple developer.

Obviously, Apple has a history of being a bit queasy when it comes to opening up its code.

Likewise, there is nothing surprising whatsoever about the Feds refusing to open the doors of the White House to the iPhone – at least, not to the commander in chief.

Sorry, President Obama. I hope that getting to use your iPad is some consolation.

Image courtesy of Action Sports Photography / Shutterstock.com

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/E4_1sBixLOk/

FTC acts against “Brightest Flashlight” app for deceptively tracking your location

We’ve written several times recently about the problems we face – whether as consumers, programmers, vendors or users – from mobile adware.

Ads in mobile apps are generally regarded with less suspicion and more tolerance than they are in desktop apps, as a sort of quid pro quo for not having to pay a monetary price to use them.

Indeed, lots of apps have a free version that is ad-supported, and a fairly inexpensive paid version that dispenses with the ads.

A few dollars, or a few ads? You choose…

Sadly, however, if you give app developers a centimetre, a few of them will take 633.6 metres. (Yes, there are 63,360 inches in a mile.)

And one example that we’ve heard lots of people use as an archetype for “going too far” is the story of the torch (flashlight) app that collected your location data.

Really? A torch that needs to know where you are? What on earth for?

So it can adapt the intensity of the light to your latitude? To tell you the number of hours until sunrise, and whether your phone battery will hold out that long?

Of course not!

The data was mined and sold to advertisers.

Sure, you could decline the data harvesting if you wanted to, at least in the Brightest Flashlight app from Goldenshores Technologies, LLC, by clicking a [Refuse] button.

But it turned out to mean REFuse in the sense of the noun meaning “garbage,” not reFUSE in the sense of the verb meaning “to say no.”

That’s because the app called home anyway, reporting both your device ID and your precise location, before you’d had time to say whether you wanted it to or not.

The good news is that the US Federal Trade Commission (FTC), which aims to protect consumers against fraud, deception, and unfair business practices, has decided that this is unacceptable.

The FTC has reached a settlement – a so-called consent decree – with the makers of this info-grabbing app, officially labelling them in its press release as “deceivers”, and saying:

When consumers are given a real, informed choice, they can decide for themselves whether the benefit of a service is worth the information they must share to use it. But this flashlight app left them in the dark about how their information was going to be used.

The penalty doesn’t add up to much – it pretty much boils down to an agreement not to do it again, or else.

But it’s a start.

Image of brightly-shining torch courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/sej1GUG9EM0/

Facebook trolling UK cop gets off with wrist-slap following closed-door hearing

Tablet. Image courtesy of Shutterstock.On Tuesday, Nicola Brookes told Naked Security, she received a Christmas card in the post, sent to her home address.

On the front of the card was a picture of a dog. The message wished Happy Christmas To A Dog.

Inside the card, she found a large photo of herself, in the hospital, eyes closed, with tubes taped to her throat, nose and temple. The picture had been scraped from her daughter’s Facebook posts regarding Ms. Brooke’s emergency surgery for Crohn’s disease.

The image of a “Get Well Soon” balloon was pasted over the photo.

That might not seem like a terribly vicious troll attack. After all, the image included a “get well” message.

But besides the obvious pejorative of calling its recipient a dog, the card did a number of things.

First, it presented further evidence of known facts: namely, that a troll or trolls had published Ms. Brookes’s home address online, that they had scraped personal photos to use in attacking her, and that they’d been following people close to her.

The card also must be placed in the context of preceding troll-crafted images to appreciate its malevolence.

One such: Ms. Brookes’s face is pasted over the image of a woman, on the floor, hogtied, with her hands tied behind her back, her feet tied together, one end of the rope tied around her neck in such a way that she would, eventually, tire of keeping her legs elevated, relax, and thereby strangle herself to death.

The woman in the photo is surrounded by troll dolls. The caption: “TROLL RAPE: You never even saw it coming”.

She claims to have received much worse images than that. Naked Security have been shown the images. They are even more abhorrent than the troll rape one, so we’ll refrain from describing them.

Not that any of this is new, mind you. It’s been going on for over two years.

During that time, since posting a message of support for another troll victim, Ms. Brookes has been the subject of many headlines for stories about internet trolls.

Many of these headlines had a feel-good tone: they often trumpeted a “victory over cyber bullies“, given a landmark case in which Ms. Brookes forced Facebook to reveal her trolls’ names, email addresses and IP addresses.

It has turned out to be anything but a victory. Her torment has continued unabated.

An active UK policeman, Lee Rimell, was arrested in connection with the abuse, which included website hate pages: one about Brookes’s Crohn’s disease, and another falsely labeling her a paedophile and a drug dealer.

One Facebook clone account sent suggestive messages to young girls in her name.

The charges resulted in an investigation by the Crown Prosecution Service (CPS), who subsequently decided that PC Rimell shouldn’t face criminal charges.

In fact, the CPS apparently figured that Ms. Brookes was at least partially to blame, given that she had the audacity to talk back to the trolls.

A quote from CPS, courtesy of the BBC’s coverage:

“You engaged with the ‘trolls’ contrary to the specific advice given to you by Sussex Police on at least three occasions.”

For what it’s worth, Ms. Brookes denies that Sussex Police ever gave her that advice at all, let alone told her three times.

But little does it matter, given that police figured they didn’t have much to go on.

That was largely because, Brookes told us, according to investigators, Rimell had his PC “reconditioned” in July of 2012, just a few weeks before his arrest.

This “reconditioning”, the investigators told Brookes, destroyed the hard drive history and all digital, forensic evidence off his PC. Therefore, Brookes said, when investigators seized and examined Rimell’s PC, they couldn’t find evidence of abuse with which the CPS could charge him.

Police wouldn’t confirm or deny that an investigation summary letter detailing the “reconditioned” PC originated from CPS, but here’s an excerpt from the letter that Brookes claims they sent her in October:

Lee Rimmell [sic misspelled surname in all instances] was arrested and interviewed in respect of the allegation that your Hotmail account was hacked into. The computer which was seized and examined by the Police was shown to be reconditioned in July 2012. This post-dates the offence. Lee Rimmell denied the offence and stated that his account was hacked into. He further intimated that it was possible that this person also hacked into your account from his account. The Police inform me that they contacted an expert who confirmed that it is possible for another individual to access and use Lee Rimmell’s IP address to hack into your account. We are at a disadvantage as Lee Rimmell’s computer for the relevant period is no longer available and cannot be examined. There is therefore insufficient evidence on the material provided to us to prove that Lee Rimmell was responsible for hacking into your computer.

All of this is just part and parcel of a dragged-out ordeal, which has included Ms. Brookes dismissing her pro bono legal counsel, alleging malpractice; and the police’s claims, according to Brookes, that she didn’t file a complaint months ago, which has sent her back to square one.

So no, PC Rimell won’t be facing criminal charges, and a civil suit may be unlikely, given the enormous amounts of money involved to file and to conduct computer forensics—money Ms. Brookes doesn’t have.

Instead, Rimell on Tuesday attended what’s called a “Misconduct Meeting” in regards to alleged breaches of the police’s Standards of Professional Behaviour.

At that meeting, evidence to support the misconduct allegation was to be presented from Sussex Police, including Rimell’s admission that he sent such messages, albeit “claiming he didn’t intend such consequences,” according to an email that Naked Security has seen that was sent by Adrian Taylor, Detective Inspector for the West Midlands Police Professional Standards Department.

At the end of the meeting, Rimell was given the harshest possible penalty for a Misconduct Meeting. Namely, he was given a warning.

A “Final Written Warning,” that is.

This will be placed on PC Rimell’s personal file and will remain live for eighteen months from Thursday, 5 December. Further misconduct (that justifies more than management advice) will result in dismissal in all but unspecified “exceptional circumstances,” at which point the slap on the wrist “final” warning may extend to yet another 18 months, but “on one occasion only”.

To sum it all up: A UK police officer was arrested. He admitted to abusive content. He got off with a warning. Whilst this was going on troll abuse of the victim skyrocketed.

Ms. Brookes does not believe that receiving a troll’s Christmas card two days before PC Rimell’s hearing amounts to merely a coincidence, but who can prove otherwise, given how proxies cover proxies that shield proxies behind which hide cowardly people, and given how expensive court filings and digital forensics are, and given how little training police receive in investigating these matters?

As The Independent reported in late November, the national stalking advocacy service Paladin reports that less than a third of UK police officers have received training on a new stalking law, despite its implementation a year ago.

Out of 320 people arrested in the first six months under the new law in England and Wales, only 189 have been charged, while 27 received a conviction and only six served jail time, The Independent reports.

The UK police have refrained from giving details about just what it is that Rimell did to earn this “Final Written Warning.” All we can say for sure is that he carried out online activities which merited the most severe of four outcomes of a misconduct hearing.

That alone, however, might be construed as being enough to question whether he is in the correct line of work, given that the taxpayers of the UK are keeping him on the payroll as a public protector whose sole and express role is to help prevent abuse.

Brookes is one example of law enforcement’s failure to proactively, swiftly shut down and investigate online abuse, as she told me:

It took six months before police would open a case. My solicitors for months wrote letters, since 2011, trying to force police to investigate what’s happening. They just wouldn’t.

Meanwhile, Ms. Brookes believes that the advice being handed out to victims – “don’t engage cyber bullies,” for example – is a joke:

In the beginning, I answered them back. I felt I had every right to defend myself at the time.

She also relates to cyber-bullying victims who take their own lives, she said:

I can completely understand [teen suicides]. I had very, very low days. Very low.

The advice going on, [victims find ourselves] just screaming and shouting at the TV and our monitors, saying ‘We do all that anyway.’ They still get to us. The police are completely uneducated. They don’t have the training or resources to tackle this problem. They don’t have a bl**** clue what they’re doing.

We like to end our reports with useful advice for our readers but that is a difficult thing to do when Nicola Brookes’s story has shown the stark limitations of “don’t engage”.

It’s not that easy. Clearly it’s not that easy but until we find a better solution it remains the best advice even though following it is, as Ms Brookes has discovered, very far from a guarantee of success.

Equally we encourage victims not to be put off from reporting the abuse they suffer at the hands of trolls to the appropriate law enforcement agency. If you want to know how then read our guide on how to report a computer crime: Trolling.

Nicola Brookes is disappointed, angry and still being abused, and today she reported the sinister Christmas card to the Sussex police. She told us the police are dealing with it as a new offence that is unconnected with the previous 2 years of abuse and that because they don’t anticipate getting any useful forensic evidence from the envelope it is doubtful that the matter will be taken any further.

Image of tablet courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/txl-NdcORRY/

FTC acts against "Brightest Flashlight" app for deceptively tracking your location

We’ve written several times recently about the problems we face – whether as consumers, programmers, vendors or users – from mobile adware.

Ads in mobile apps are generally regarded with less suspicion and more tolerance than they are in desktop apps, as a sort of quid pro quo for not having to pay a monetary price to use them.

Indeed, lots of apps have a free version that is ad-supported, and a fairly inexpensive paid version that dispenses with the ads.

A few dollars, or a few ads? You choose…

Sadly, however, if you give app developers a centimetre, a few of them will take 633.6 metres. (Yes, there are 63,360 inches in a mile.)

And one example that we’ve heard lots of people use as an archetype for “going too far” is the story of the torch (flashlight) app that collected your location data.

Really? A torch that needs to know where you are? What on earth for?

So it can adapt the intensity of the light to your latitude? To tell you the number of hours until sunrise, and whether your phone battery will hold out that long?

Of course not!

The data was mined and sold to advertisers.

Sure, you could decline the data harvesting if you wanted to, at least in the Brightest Flashlight app from Goldenshores Technologies, LLC, by clicking a [Refuse] button.

But it turned out to mean REFuse in the sense of the noun meaning “garbage,” not reFUSE in the sense of the verb meaning “to say no.”

That’s because the app called home anyway, reporting both your device ID and your precise location, before you’d had time to say whether you wanted it to or not.

The good news is that the US Federal Trade Commission (FTC), which aims to protect consumers against fraud, deception, and unfair business practices, has decided that this is unacceptable.

The FTC has reached a settlement – a so-called consent decree – with the makers of this info-grabbing app, officially labelling them in its press release as “deceivers”, and saying:

When consumers are given a real, informed choice, they can decide for themselves whether the benefit of a service is worth the information they must share to use it. But this flashlight app left them in the dark about how their information was going to be used.

The penalty doesn’t add up to much – it pretty much boils down to an agreement not to do it again, or else.

But it’s a start.

Image of brightly-shining torch courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/BNUTp6aOOb8/

Russia charges ‘criminal organization’ behind Blackhole malware kit

Email delivery: Hate phishing emails? You’ll love DMARC

The Russian government has charged a group of people with organized crime offenses related to the creation and use of the Blackhole malware kit.

Word first leaked out via Europol in October that a man going by the alias “Paunch”, who was suspected of being the creator of the infamous crimeware tool, had been arrested in Russia.


On Friday, the Russian Ministry of Internal Affairs Investigation Department posted a notice that a total of 13 individuals had been charged with crimes under Article 210 of the Criminal Code of the Russian Federation, which covers “creation of a criminal community (criminal organization) and participation therein.”

According to the Ministry’s press release, the group used Trojan horse programs and other malware to engage in “massive embezzlement of funds from the accounts of individuals and legal entities,” to the tune of about 70m Russian rubles ($2.1m).

Russian banks throughout Moscow, Tyumen, Ulyanovsk, Krasnodar, Petrozavodsk, and the Kursk region were reportedly targeted in the scheme.

All of that seems to have come to an end now, however, as security researchers report that the Blackhole kit stopped being updated shortly after the suspects were arrested – aren’t life’s little coincidences funny sometimes? – and cybercriminals have reportedly begun moving on to other tools.

None of the accused were named in the Russian government’s notice.

Under Russian law, anyone convicted under paragraph 1 of Article 210, “creation of a criminal community (criminal organization) for the purpose of committing one or several grave or especially grave crimes,” faces imprisonment for 12-20 years and fines of up to 1m rubles ($30,600).

The accused have also been charged under paragraph 2 of Article 210, “participation in a criminal community (criminal organization) or in an association of organizers, leaders, or other representatives of organized groups,” which carries an additional penalty of 5-10 years’ imprisonment and fines up to 500,000 rubles ($15,300).

The accused are all currently being held under “pretrial restraints,” although no date was given for when the case is expected to be brought before a judge. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/12/06/blackhole_malware_suspects_charged/

Frustrated fanbois rejoice as Facebook releases MIDAS Mac security tool

Email delivery: Hate phishing emails? You’ll love DMARC

Facebook and Etsy have teamed-up to develop and publish as open source a security tool for Apple’s Macs, following similar moves by Google.

The “Project MIDAS” Mac intrusion detection framework was announced by Facebook in a blog post on Friday, and sees the two companies collaborate on a tool to help companies manage large deployments of Macs.


The Python-based MIDAS framework lets Mac admins monitor clients for things such as changes to kernel extensions, LaunchAgents, LaunchDaemons, and Network Configurations.

“This gives you the ability to quickly audit your assets for threats like IceFog, Dockster, Imuler, Morcut, PubSab, etc,” they write.

It is extensible, and the initial open source code comes with a few helper utilities, and an example module for client monitoring.

Code for the project is stored on Github.

Facebook imagines that if people want to deploy MIDAS they will create a private fork of the public project, add specific modules and helpers, deploy the customized MIDAS framework, and then analyse the logs afterward for anomalies.

With the tech, Facebook and Etsy have joined Google in building their own custom tools for managing Macs. Google was compelled to build its own suite of Mac management tools – many of which it plans to publish as open source – due to Apple’s lack of willingness to provide new features in a timely manner.

Though Apple has recently seen great success in consumer electronics, it has also stepped back from providing tools to the enterprise.

In recent years, for instance, it retired its Apple server line, and slowed the pace at which it updated its main management software and its workhorse Mac Pro.

Though this devotion of resources to the larger and faster-growing markets of iPads, iPhones, and other iWotsits is sensible from a business point of view, it seems to be causing grief among Valley tech companies due to their employees’ love of Mac products. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/12/07/facebook_midas_security/

Experts Offer Advice for Developing Secure Cloud Applications

Building security into the application development process has always been a challenge. The reality of cloud computing however introduces new hurdles that need to be identified and climbed.

In a new paper, the Cloud Security Alliance (CSA) and the Software Assurance Forum for Excellence in Code (SAFECode) joined forces to release guidance to help developers navigate the sometimes troubled waters of application security. The report is focuses on security considerations for platform-as-a-service (PaaS), though the authors say the advice in the paper is relevant to software-as-a-service (SaaS) and infrastructure-as-a-service (IaaS) as well.

“Among all of the cloud security challenges, this report is focused on the challenges faced by software developers who are developing applications for the cloud,” says Eric Baize, senior director of the product security office with EMC. “Most of the activities required to develop secure software for the cloud are identical to the fundamental security practices required for any software. However, cloud has some unique characteristics that demand some customization of these practices.”

The most notable among these is multi-tenancy, says Baize. Multi-tenancy, the report explains, allows multiple consumers or tenants to maintain a presence in a cloud service provider’s environment in a manner where the computations and data of one tenant are isolated from other tenants.

Cloud providers should model all their application’s interfaces with threats to multi-tenancy in mind, such as information disclosure and privilege escalation, the report advises. In addition, providers should use a “separate schema” database design when building multitenant applications as opposed to adding a “TenantID” column to each table.

“APIs are the front door into any application and it is critical that they are properly secured,” according to the report. “In many ways, API security for cloud applications is similar to API security for web applications hosted in data centers. Traditional application layer security risks, such as the OWASP Top 10, are still present when deploying your application to the cloud.”

To secure APIs, the report recommends determining if the APIs can be restricted so that only trusted hosts can call them and ensure that inter-service communication is securely authenticated. Also, testing should be used to validate security monitoring and alerting capabilities.

The paper touches on a number of other topics as well, including the use of trusted compute pools and the challenges of dealing with authentication and identity management. The focus is on mitigating the primary threats to cloud computing: data breaches, data leakage, denial-of-service and insecure application interfaces.

The report can be viewed as a set requirements and capabilities that PaaS should be providing to developers, says Steve Orrin, chief technologist for Intel Federal, LLC.

“To that end, organizations and their developers need to evaluate the security capabilities and services that their PaaS provides and then ensure they adopt these security capabilities and/or demand their availability from their provider,” he says.

Security, Baize adds, has increasingly become an integral part of the design process.

“CSA cloud security recommendations are widely used by cloud practitioners and SAFECode secure software development practices are increasingly part of standard software engineering processes,” he says. “What this report provides is the connection between these two sets of practices by translating cloud-specific security requirements into security practices for software developers.”

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/applications/experts-offer-advice-for-developing-secu/240164509