STE WILLIAMS

Disaster recovery protection level self-assessment

Apple has updated iOS 7 to fix a security bug that allowed miscreants to buy stuff from the online Apple Store without having to tap in a valid password.

The Cupertino idiot-tax operation said new version 7.0.4 patches a flaw that affected in-app and app purchases.

Usually, one must supply his or her Apple account username and password to authorize a sale, which is charged to the fanboi’s credit card on record. This is to stop pranksters from blowing big bucks on your device if they manage to fiddle with it without you knowing.

The update restores the aforementioned authentication check.

Additionally, the iPhone giant said the new release will fix a stability bug in FaceTime, which caused some users to experience dropped calls. For iPod owner who are not yet able to access iOS 7, the company is releasing iOS 6.1.5 to fix the FaceTime dropped-calls bug.

As with all iOS updates, users will be able to obtain the updates by synching with iTunes or connecting via Wi-Fi to install updates over the air.

The release comes one day after researchers at a show in Japan showed off a fresh new set of techniques for infiltrating iOS devices. Presenting at the PacSec security conference, the Chinese team of researchers demonstrated a technique for bypassing security protections and accessing stored files on iOS 7.0.3 devices. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/16/apple_fixes_bug_for_ios_password_flaw/

ioControl – hybrid storage performance leadership

The infamous Cryptolocker malware, which encrypts your computer files and demands a payment of £534 ($860) to unlock them, may have been sent to “tens of millions” of Brits, Blighty’s crime-busters warned today.

According to an alert from the UK National Crime Agency (NCA), authorities said a fresh round of ransomware-loaded spam posing as bank notices has been sent out, with small and medium-sized businesses targeted in particular. The messages, described as a “significant risk”, carry booby-trapped attachments and claim to be official documents from financial institutions.

Lurking within the attachments is a Trojan called Cryptolocker, which when executed, silently installs itself and quietly begins encrypting documents one by one on the Windows PC using tough-as-nails AES256. When it’s finished, it demands a ransom payment of 2 Bitcoins (at least 500 quid or 800 bucks) to decrypt the data, which must be paid within a time limit.

The software nasty is particularly fiendish: The malware first contacts its master’s control server, which generates a new public-private 2048-bit RSA cryptographic key pair and sends the public half to the malware.

Then for every file discovered on the computer, Cryptolocker generates a new 256-bit key and uses it to encrypt that document using the virtually unbreakable AES256 algorithm. That AES key is then encrypted using the RSA public key and stored with the obfuscated document.

Only when the victim pays up does the Trojan download the private half of the RSA key, which is used to decrypt the per-file AES keys and ultimately restore all the protected documents. Targeted files include anything with .doc, .docx, .xls, .xlsx, .ppt, .pptx, .dwg, .dxf, .dxg and .jpg extensions and plenty more.

Users are urged to maintain regular backups of their data, kept separate from their computers, as the encryption is essentially uncrackable, and consider using tools to thwart the software nasty. The Trojan infects systems running Windows 8, Windows 7, Vista, and XP.

“The emails may be sent out to tens of millions of UK customers, but appear to be targeting small and medium businesses in particular,” the UK’s NCA said.

“This spamming event is assessed as a significant risk.”

Cryptolocker’s operators are also apparently developing a keen sense of economic opportunism, upping their Bitcoin demands at a time when the digital currency’s exchange rate has never been higher.

While authorities have yet to finger any suspects behind the Cryptolocker epidemic, the NCA believes the operation is the work of a tech-savvy crime ring.

“The NCA are actively pursuing organized crime groups committing this type of crime,” said Les Miles, deputy head of the NCA’s National Cyber Crime Unit.

“We are working in cooperation with industry and international partners to identify and bring to justice those responsible and reduce the risk to the public.”

In addition to installing and updating trusted security software, users and administrators can protect against infections by using best practices (read: common sense) such as avoiding links and attachments from unknown or suspicious sources and scanning all attached files for malware. ®

Quick guide to disaster recovery in the cloud

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/15/cryptolocker_menace_triggers_nca_alert/

ioControl – hybrid storage performance leadership

Jeremy Hammond, the hacker who cracked open the database of intelligence organization Stratfor, had hoped for some leniency when he pleaded guilty to one charge of violating the Computer Fraud and Abuse Act.

But instead a judge in New York today gave him the maximum sentence, 10 years, and three years’ post-imprisonment probation with severe limits on his internet access.

“They have made it clear they are trying to send a message to others who come after me. A lot of it is because they got slapped around, they were embarrassed by Anonymous and they feel that they need to save face,” Hammond told The Guardian the day before his sentencing in anticipation of a “vengeful, spiteful” punishment.

Hammond, acting with the LulzSec hacking crew offshoot of Anonymous, cracked Stratfor’s servers in December 2011 and harvested a trove of emails and credit card numbers. The 200GB of emails went to WikiLeaks, and LulzSec dumped 60,000 credit card numbers online after claiming to use them for making millions in charitable donations (although that figure turned out to be a not-insignificant $700,000).

Hammond was arrested in March 2012 after the head of LulzSec Hector Monsegur aka Sabu, told the FBI who had compromised Stratfor’s network. Sabu was pinched by the Feds in June 2011, and had agreed to act as a stool pigeon in exchange for a lesser sentence; his evidence has put the core members of LulzSec behind bars.

According to Hammond, Sabu approached him to carry out the Stratfor attack because he’d heard Hammond had a hacking tool that could crack its break into the company’s systems. Hammond said he had never even heard of Stratfor before the hack, but that Sabu gave him details of how and where to attack.

“I felt betrayed, obviously. Though I knew these things happen,” Hammond said. “What surprised me was that Sabu was involved in so much strategic targeting, in actually identifying targets. He gave me the information on targets.”

Hammond said he didn’t personally profit from the Stratfor hack, and carried it out for ideological reasons; saying people had a right to know what was going on in these intelligence-gathering companies. He said he was inspired by whistleblower Chelsea Manning and by the Occupy movement.

However, sentencing judge Loretta Preska disagreed, branding the aim of the Stratfor campaign as “destroying the target, hoping for bankruptcy, collapse.”

“These are not the actions of Martin Luther King, Nelson Mandela … or even Daniel Ellsberg,” she said. “There’s nothing high minded or public-spirited about causing mayhem.”

It seems unlikely that any of the stolen credit cards will have cost their owners much in the way of costs, given the obviously fraudulent use. But the hack did cost Stratfor $1.75m in free subscriptions after customers who had their personal data swiped brought a class-action suit against the firm.

The emails Hammond lifted were published by WikiLeaks in February last year under the title “Global Intelligence Files,” and revealed names of some of Stratfor’s governmental, military and commercial contacts.

One email reference the existence of a sealed indictment that had been prepared for Wikileaker-in-chief Julian Assange, while another said Osama Bin Laden’s body hadn’t been buried at sea but delivered to Dover Air Force Base. Stratfor CEO George Friedman said some of the emails were accurate, while others had been tampered with, while declining to say which were which.

As for Hammond, he has served 20 months in prison already and has at least another four years to spend in the big house before he is eligible for parole – during which his use of encrypted communications will be banned. He said he will spend his time inside “reading, writing, working out and playing sports – training myself to become more disciplined so I can be more effective on my release.”

“I think my days of hacking are done. That’s a role for somebody else now,” he explained. ®

Quick guide to disaster recovery in the cloud

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/15/judge_throws_book_at_stratfor_hacker_with_decadelong_sentence/

Waterloo, Canada – November 15, 2013 – The Centre for International Governance Innovation (CIGI) is pleased to announce the recent appointment of Internet governance and cyber security expert Melissa Hathaway as Distinguished Fellow.

At CIGI, Hathaway will contribute to CIGI’s Global Security program and research on Internet governance. The Organized Chaos: Reimagining the Internet project aims to play a constructive role in creating strategies for states committed to multi-stakeholder models of Internet governance. The project is laying the analytical groundwork for future Internet governance discussions, most notably the upcoming decennial review of the World Summit on the Information Society, by considering the kind of Internet the world wants in 2020.

Prior to her appointment, Hathaway authored the CIGI commentary, “Change the Conversation, Change the Venue and Change Our Future,” which argues that the Internet’s economic importance, and the massive financial risk posed by cyber security threats, warrant making the issue a G20 agenda item.

“I am excited to join CIGI and contribute my time and expertise to such an important initiative. The Internet is at the very core of every aspect of life. There is nothing more important than ensuring that we engage in an international discussion about the priorities required to strengthen the services and infrastructures that are dependent upon the Internet,” said Melissa Hathaway, CIGI Distinguished Fellow. “There are many entangled economic, technical, regulatory, and policy issues that are part of every negotiation and discussion about the Internet and its future. I look forward to working with the CIGI team to bring more clarity to the international discussion and encourage governments to take actions and reduce risks.”

“Melissa Hathaway brings a wealth of practical experience at the highest levels of the US government, including the time she served at the White House working for two US presidents, that will prove invaluable to CIGI’s ongoing programs in internet governance,” says Fen Osler Hampson, Director of CIGI’s Global Security Research Program. “She has played a key role in both the public and private sectors on cyber security issues and has a depth and level of understanding that is unparalleled. We are very excited to welcome her to CIGI.”

Hathaway has worked as a cyber security advisor to U.S. Presidents George W. Bush and Barack Obama, and is the former acting senior director for cyberspace at the National Security Council and former advisor to the Director of National Intelligence. She is now president of Hathaway Global Strategies, where she brings a multi-disciplinary and multi- institutional perspective to strategic consulting and strategy formulation for public and private sector clients. She is also a senior advisor to Project Minerva, a joint cyber security project by the Department of Defense, Massachusetts Institute of Technology, and Harvard University, where it is based at the Belfer Center. Hathaway has a B.A. degree from The American University in Washington, D.C., and is a graduate of the U.S. Armed Forces Staff College, with a special certificate in Information Operations.

For more information, please visit: www.cigionline.org/person/melissa-hathaway.

Article source: http://www.darkreading.com/management/cybersecurity-expert-melissa-hathaway-jo/240164022

Legitimate user credentials are the digital lifeblood of attackers looking to compromise a network. With valid credentials, attackers can infiltrate a target network, elevate their privileges to gain access to more sensitive data, and take control of critical systems.

To combat attacker’s ability to use stolen credentials, companies need to model the behavior of every user–especially those people, such as system administrators, with access to privileged accounts. Using that baseline, businesses can detect whether the use of a credential falls outside of what is typical or allowed by policy, says Philip Lieberman, president of Lieberman Software, a privileged-account management provider.

“You have to look at, not only what a person can do and who they are, but to look at their behavior and whether that behavior has become risky,” Lieberman says. “Then, you can respond to a high risk score by shutting down the account, if the behavior of the user is becoming anomalous.”

At the Cloud Security Alliance (CSA) Congress in December, Lieberman and industry experts will discuss how authentication can be used to better secure cloud services and network infrastructure from attack. The fundamental problem is that few companies have a good idea of how many privileged-user credentials are in existence, where they are stored and whether an account is still necessary for business, he says.

Companies typically have 3 or 4 privileged accounts per employee, most which are not monitored or managed by the business, according to a recent survey by CyberArk, a privileged-account security firm. Finding those accounts and monitoring their access is critical to heading off insider attacks and more persistent external attackers, says John Worrall, chief marketing officer for CyberArk.

“The advanced threat from the outside really goes south for (companies) once the attackers compromise an insider’s privileged credential,” he says. “So you really want to have real-time monitoring of behaviors, then you can build these profiles of what is expected.”

Similar to financial firms tracking credit-card usage, monitoring behavior allows companies to determine whether an employee’s account exhibits irregular behavior. Logging in from a different country, outside of work hours or to several accounts in one session are all likely signs of compromise, Worrall says.

[Top executives, power users, and IT administrators may have access to more than they should. Here are some tips for keeping them in check. See How To Monitor And Control Privileged Users.]

In addition, companies should look at their password policy and work to limit privileged access, says Lieberman. A single user should not be logged into their privileged account while doing day-to-day work. Rather, they should have to elevate privilege only when necessary. Taking that approach limits the exposure of that particular user and the account credential, he says.

“This is a matter of behavior, not a matter of technology,” he says. “We have to spend a lot of time on training the behavior of our customers, to operate their business in a sane way that gives them some resiliency.”

Companies also need to survey their usage of privileged accounts, searching for default passwords, backdoor accounts, accounts for workers no longer employed by the company, and accounts that are rarely, or never, used.

Companies also can work with their authentication provider to use the most appropriate type of security for privileged accounts. Mobile authentication provider Nok Nok Labs can query a mobile device and attempt to use the strongest possible type of authentication, a technique that helps secure the cloud service from attackers, says Brendon Wilson, director of product management for Nok Nok Labs.

“There is a bunch of advanced capabilities on mobile devices–increasingly secure chips and secure elements–all of these things can be used to make the authentication piece stronger, whether for an enterprise, a consumer business, or a Web service,” he says.

Yet companies cannot just rely on strong authentication to keep out attackers. They have to assume the attackers are already inside their perimeters, says Lieberman of Lieberman Software.

“If you wake up every day knowing that someone is in your systems, and you shouldn’t stop looking for them, then I think you have a pretty good chance of preventing a breach,” he says.

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/monitoring/modeling-users-monitoring-credentials-pr/240164024

Snapchat has thumbed its nose at Facebook’s $3 billion, all-cash offer, the Wall Street Journal reports.

Snapchat is a messaging service that, for some reason, in spite of research to the contrary and having admitted that it shares its images with US law enforcement, still promises that your sexting or other photos will disappear from its servers and from your friends’ phones up to 10 seconds after you send them.

The WSJ says Facebook’s just one of many eager suitors currently wooing the supposedly-disappearing-photo service, and it’s not even the most generous.

In fact, the Chinese e-commerce giant Tencent Holdings had offered to lead an investment that would value the 2-year-old Snapchat at $4 billion, the WSJ reports.

But wait, why rush into marriage at such an early age?

The company most certainly will not, it turns out.

People briefed on the deal told the WSJ that Snapchat’s 23-year-old co-founder and CEO, Evan Spiegel, probably won’t look at acquisition or investment offers until at least early 2014, in the hope that Snapchat’s user base and message volume will grow enough to get an even fatter offer.

It’s easy to see why Facebook, for one, is so hot for the “Poof! Photos-B-Gone!” service.

In its most recent earnings announcement Facebook admitted it was seeing a “decrease in daily users, specifically among teens”.

They’re still on Facebook, mind you – just not that much.

Instead, they’re hanging out in other places – particularly in places where their parents/adults are not hanging out and are not peering over their shoulders.

Think WhatsApp, WeChat, KakaoTal and yes, Snapchat.

Facebook wants those teens back.

That’s likely one motivation behind its recent move to allow teens to post publicly, whereas prior to October they were only allowed to share with friends or friends of friends.

Then again, one can’t underestimate the appeal of a service that might curtail the horror show of stalking, cyber bullying, and internet trolling that has befallen victims of sexting, including the tragedy of teen suicides often related to nude photos having been circulated online.

Facebook’s hunger for Snapchat makes sense. Anything associated with mobile ads or teens makes sense for Facebook from a financial standpoint.

Teens’ hunger for Snapchat is also understandable, albeit disturbing.

Snapchat was designed to allow senders to control how long a message or picture could be seen.

Snapchat photos expire after a maximum of 10 seconds.

Except they don’t.

US-based computer forensics specialist Richard Hickman studied the app’s premise and found that Snapchat photos don’t actually disappear at all.

Studying a forensic image of a phone running Snapchat, Hickman found a directory called received_image_snaps.

Its contents: Both unviewed and supposedly “expired” images.

Sharing with Snapchat entails your images being stored both on Snapchat’s servers and on recipients’ phones, though marked “not for display.”

Does it sound too hidden away, too tough to sniff out unless you’re a bored security researcher?

No worries. Last time I checked, there were anti-Snapchat apps on the market.

I found one for sale for $1.99 as of August. Called Screenshot Save for Snapchat, it promised to keep those supposedly disappearing images on hand forever, for as long as the recipient likes, thereby enabling them to be saved “for easy sharing with friends!”

As Naked Security has urged in the past, anybody who wants to continue to snap nude selfies – or any other sensitive content they don’t necessarily want to be made public – should please refrain from putting too much faith in an app that promises self-destruction.

As for Facebook, if it wants to make a few billion disappear, it will have to try again in a few months, when Snapchat will likely be bigger than ever.

Follow @LisaVaas

Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/8oh13dHgOAA/

Mavis Batey MBE, codebreaker extraordinaire at Bletchley Park during World War II, died this week at the age of 92.

Ironically, perhaps – to cryptographers and computer scientists, at least – her MBE was awarded in recognition of her work in preserving and conserving British gardens.

This was a task to which she applied herself with conspicuous success after her secretive work as a cryptanalyst during the war.

Batey’s big cryptographic breakthrough, tackling the Italian military’s use of the Enigma encryption machine in the early 1940s, gives us an fascinating insight into how cryptanalysts think.

Where the rest of us might see random gibberish or algorithmic confusion, gifted cryptanalysts are able to spot important questions – and, more importantly, to answer them.

The enigma of Enigma

The Enigma was an electromechanical encryption device, patented by a German engineer in 1918.

It was adopted enthusiastically in various flavours by the Nazis and their European allies, and enhanced for additional security over the years leading up to the outbreak of World War II.

Enigma used three or more electrically-wired rotors that moved forward like a car’s odometer after each character, creating an electrical circuit that varied randomly every time.

So even if you typed in AAAAAA, you might get back EJMXLR.

Presumably in an effort to boost the mixing effect, the designers made the leftmost rotor a “reflector” that re-routed the circuit back through the other rotors.

So, in a four-rotor engima, there were seven (3+1+3) rotors’ worth of mixed-up wiring for the current to follow.

The weak link

But one consequence of this, which would immediately be recognised today as an unacceptable cryptographic flaw, was that the reflector had to send the current back on a different wire, so a letter could never end up encrypted as itself.

For all that AAAAAA might give you EJMXLR, it could never give you BCDANF or YANQQP.

And one day, Mavis Batey looked at an intercept – not the one above, of course, but something that would have seemed just as meaningless to you or me – and realised that it had a curious characteristic.

The letter L, and only L, was missing, and she asked herself the important question, “Why?”

She surmised, correctly as it turned out, that she had stumbled across a test transmission, presumably generated by a pair of Italian radio operators who were checking that they had the day’s configuration settings correct.

(Enigma settings – the cryptographic keys – were varied each day according to closely-guarded printed books.)

The sender had simply pressed L repeatedly, so that Bletchley Park now had what’s called a known plaintext for an intercepted message.

Today, encryption algorithms are expected to be immune to attacks based on a known relationship between input and output, but for the Bletchley codebreakers it was just the start they needed.

Today’s the day

Indeed, building on this success, Batey later decrypted an Italian message that read TODAY’S THE DAY MINUS THREE.

But what did it mean?

One problem cryptanalysts face – even today, with modern computers at their disposal – is where to focus their efforts.

If you can reliably crack 1% of all encrypted messages, you are doing really well.

But if you don’t pick the right 1% to attack then you may end up knowing an awful lot about the regulations governing how Sergeant Majors should wax their moustaches, and not very much about impending attacks.

As Batey describes, the codebreakers went into overdrive:

[W]e worked for three days. It was all the nail-biting stuff of keeping up all night working. One kept thinking: ‘Well, would one be better at it if one had a little sleep or shall we just go on?’ — and it did take nearly all of three days. Then a very, very large message came in.

And what a message it was, documenting a massive attack against an Allied convoy en route from Egypt to Greece.

The Allies turned the tables, sending out a spotter plane that “just happened” to sight the Italian attackers (thus providing a plausible explanation for the intelligence), drawing the Italians into the Battle of Matapan, and subjecting them to an enormous naval setback.

Lest we forget

So, let’s take this opportunity to remember the war-time heroism of Mavis Batey MBE and the thousands of other cryptological soldiers who served so industriously against Nazism and Fascism in 1940s Europe.

→ If you have ever visited Bletchley Park (if you haven’t and you can, do it!), you will know how truly awful the working conditions were, with thousands of workers crammed into mostly cold, damp and insanitary huts to pit their intellects against what must have seemed not just unknown but unknowable. The operators of Tommy Flowers’ groundbreaking Colossus codebreaking computers, installed at Bletchley near the end of the war, famously had to wear Wellington boots to work, not merely to keep their feet dry but to avoid electrocution in the wet and leaky conditions.

And, while we’re about it, let’s draw a modern lesson from the work at Bletchley, taught to us by the Italian operator’s apparently-innocent use of LLL…LLL as a plaintext.

When using cryptographic tools, follow or exceed the manufacturer’s recommendations – don’t make up your own operating procedures, even if it feels as though you’re doing the right thing.

You can well imagine that the Italian signalman who sent the long-but-repetitious message was trying to improve things by making sure that he was ready to send and receive for the day, and not risking the mis-transmission of a real and possibly important message.

(Enigma was operationally slow and clumsy, since decryption required considerable manual effort, including transcribing the output, which appeared character-by-character on an illuminated letterboard.)

But he wasn’t supposed to do that, and if he hadn’t…

…who knows whether Mavis Batey would have deciphered that three-day warning in time?

Lest we forget.

Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/DG8cbub_OQY/

European travellers will soon be able to use their personal electronic devices (PEDs) for the entire duration of their flights following a new ruling from Europe’s air safety agency.

The European Aviation Safety Agency (EASA) has approved the use of some electronic devices during all stages of a flight. A full list of allowable electronics, along with details of safety testing, will be published by the end of November 2013.

The EASA are likely responding to a similar change of policy by the US Federal Aviation Administration (FAA) which itself opted to allow a more widespread use of in-flight electronics on October 31.

From the FAA’s press release:

The PED Aviation Rulemaking Committee (ARC) concluded most commercial airplanes can tolerate radio interference signals from PEDs. In a recent report, they recommended that the FAA provide airlines with new procedures to assess if their airplanes can tolerate radio interference from PEDs. Once an airline verifies the tolerance of its fleet, it can allow passengers to use handheld, lightweight electronic devices – such as tablets, e-readers, and smartphones – at all altitudes.

Currently, European flyers with smartphones, tablets and other personal electronic devices can only use them in-flight and not during taxiing, take-off or landing.

The new rules, however, will allow some items to be used at all times, as long as they are in ‘Flight Mode’ or ‘Airplane Mode’, though sending text messages, making voice calls or using mobile data will still be prohibited.

While the ban on in-flight phone calls continues, the EASA are examining the possibility of relaxing the rules in the future, saying that:

In the long term, the Agency is looking at new ways to certify the use of mobile phones on-board aircraft to make phone calls. EASA recognises the wide proliferation of personal electronic devices and the wish of the travelling public to use them everywhere.

Even though the agency will permit some additional use of electronic devices during all stages of flights, the airlines themselves will have the final word on what they allow on their own services. It is likely that all will still require larger items, such as laptops, to be stowed away other than when flights are at cruising altitude.

Airlines who wish to allow their passengers to take advantage of the new guidelines will need to present their case to the UK Civil Aviation Authority (CAA) in order to gain approval. The CAA may well be surprised at the timing of the announcement from the EASA, having told CNET earlier this month that it will be “months rather than weeks” before UK airlines could follow the lead of their US counterparts.

The Guardian believes that the new guidelines may be implemented swiftly, quoting a CAA spokesperson who said that:

The airlines now have access to new methodology for the safety testing of devices, which could be a relatively quick process, especially as some airlines are likely to have already done a fair bit of testing

So what do you think – do you welcome this change, or are you quite happy with the current rules as they are?

Follow @Security_FAQs

Follow @NakedSecurity

Image of plane taking off courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/kIR58tq7Fwc/

ioControl – hybrid storage performance leadership

The infamous Cryptolocker malware, which encrypts your computer files and demands a payment of £534 ($860) to unlock them, may have been sent to “tens of millions” of Brits, Blighty’s crime-busters warned today.

According to an alert from the UK National Crime Agency (NCA), authorities said a fresh round of ransomware-loaded spam posing as bank notices has been sent out, with small and medium businesses targeted in particular. The messages, described as a “significant risk”, carry booby-trapped attachments and claim to be official documents from the financial institutions.

Lurking within the attachments is a Trojan called Cryptolocker, which when executed, silently installs itself and quietly begins encrypting documents one by one on the Windows PC using tough-as-nails AES256. When it’s finished, it demands a ransom payment of 2 Bitcoins (at least 500 quid or 800 bucks) to decrypt the data, which must be paid within a time limit.

The software nasty is particularly fiendish: The malware first contacts a its master’s control server, which generates a new public-private 2048-bit RSA cryptographic key pair and sends the public half to the malware.

Then for every attacked file on the computer, Cryptolocker generates a new 256-bit key and uses it to encrypt that document using the virtually unbreakable AES256 algorithm. That AES key is then encrypted using the RSA public key and stored with the obfuscated document.

Only when the victim pays up does the Trojan download the private half of the RSA key, which is used to decrypt the per-file AES keys and ultimately restore all the protected documents. Targeted files include anything with .doc, .docx, .xls, .xlsx, .ppt, .pptx, .dwg, .dxf, .dxg and .jpg extensions and plenty more.

Users are urged to maintain regular backups of their data, kept separate from their computers, as the encryption is essentially uncrackable, and consider using tools to thwart the software nasty.

“The emails may be sent out to tens of millions of UK customers, but appear to be targeting small and medium businesses in particular,” the UK’s NCA said.

“This spamming event is assessed as a significant risk.”

Cryptolocker’s operators are also apparently developing a keen sense of economic opportunism, upping their Bitcoin demands at a time when the digital currency’s exchange rate has never been higher.

While authorities have yet to finger any suspects behind the Cryptolocker epidemic, the NCA believes the operation is the work of a tech-savvy crime ring.

“The NCA are actively pursuing organized crime groups committing this type of crime,” said Les Miles, deputy head of the NCA’s National Cyber Crime Unit.

“We are working in cooperation with industry and international partners to identify and bring to justice those responsible and reduce the risk to the public.”

In addition to installing and updating trusted security software, users and administrators can protect against infections by using best practices (read: common sense) such as avoiding links and attachments from unknown or suspicious sources and scanning all attached files for malware. ®

Quick guide to disaster recovery in the cloud

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/15/cryptolocker_menace_triggers_nca_alert/

NEW YORK, Nov. 15, 2013 /PRNewswire/ — Mobile transactions — running the gamut of everything from having your payment card swiped through a smartphone attachment to using mobile apps to redeem offers to tapping your smartphone to a special in-store device to pay for an item — are showing growth in the percentage of Americans who have experienced them firsthand. However, the segment — particularly in its tap-to-pay application — is still struggling to earn consumer interest.

(Logo: http://photos.prnewswire.com/prnh/20100517/NY06256LOGO)

These are some of the results of The Harris Poll of 2,577 adults surveyed online between September 18 and 24, 2013 by Harris Interactive. (Full results, including data tables, available here)

‘Tap-to-Pay’ expectations mixed

Consistent with a 2012 Harris Poll, majorities of Americans appear to be anticipating tap-to-pay smartphone payments eventually replacing payment card

(64%) and cash (59%) transactions (72% and 66%, respectively, among smartphone

users) in the future – but not in the near future. Three in ten Americans (29%; 33% among smartphone users – down slightly from 32% and 38%, respectively, in

2012) believe such transactions will replace payment card transactions in less than five years, and one-fourth (26%; 29% among smartphone users – comparable to 26% and 31%, respectively, in 2012) believe it will replace cash transactions within that timeframe.

However, more smartphone users than in 2012 indicate that tap-to-pay transactions will never replace payment card (24% 2012, 28% 2013) or cash (30% 2012, 34% 2013) transactions.

Firsthand experiences on the rise…

Taking a step back, it’s been an eventful year for exposure to the smartphone payment realm. Americans – smartphone users in particular – are more likely than in 2012 to have either personally completed or witnessed firsthand each of a series of mobile transaction types, including (but not limited to):

— Paying for a product or service with a credit card and having your card

swiped through an attachment on the seller’s smartphone, sometimes

referred to as “Mobile vendor” type transactions (Americans: 25% 2012,

32% 2013 / Smartphone users: 35% 2012, 43% 2013).

— Processing a payment by tapping your smartphone against a special

receiver at a store or other merchant, instead of using cash or a

payment card (Americans: 13% 2012, 17% 2013 / Smartphone users: 18%

2012, 23% 2013).

..but interest declining for tap-to-pay

Looking at the consumer side of the equation, while tap-to-pay experiences may be on the rise, interest in using a smartphone to process in-person payments instead of cash or cards has dropped slightly since last year among Americans as a whole (27% 2012, 24% 2013) and more notably among smartphone users (44% 2012, 37% 2013).

— Echo Boomers (35%) and Gen Xers (30%) display stronger interest in doing

so than Baby Boomers (16%) or Matures (12%).

Among those not interested in using a smartphone to process payments, a simple lack of compelling motivation remains one of the top factors impeding interest, with 53% saying they don’t see any reason to switch from cash or payment cards.

This also holds true for smartphone users where a majority (58%) don’t see any reason to switch from cash or payment cards either, although this perspective did decline a bit from 2012 (62%).

Security concerns are the other top impediment; 53% of those uninterested in using a smartphone to process in-person transactions also say they don’t want to store sensitive information on their phone, while nearly half (47%, up from 40% in 2012) don’t want to transmit sensitive information to the merchant’s device.

Security concerns are also a worry among smartphone users, albeit with some changes since 2012:

— Though over six in ten (62%) listed the fact that they don’t want to

store sensitive information on their phone as a reason for lack of

interest, it’s worth noting that this position softened from 68% in

2012.

— On the other hand, the 55% indicating that they don’t want to transmit

sensitive information to the merchant’s device represents a modest

increase for this concern since 2012 (51%).

Consumers still waiting for Mobile Payment Motivations Initiatives to ease the transition over to mobile payments, while moderately impactful on attitudes in 2012, also seem to be losing their footing. Just under one-fourth of Americans (24%) and roughly one-third of smartphone users (34%) indicate that being able to make mobile payments while still taking advantage of their existing credit card reward programs would make them more interested in doing so, representing drops of four and six percentage points, respectively from 2012 (when 28% of Americans and 40% of smartphone users said it would make them more interested).

The ability to use a smartphone as a “digital wallet” with electronic versions of all the identifications, loyalty program cards and other documentation normally carried in a wallet (thus freeing consumers to leave their wallets at

home) experienced similar drops, with 26% of Americans and 36% of smartphone users (down from 30% and 43%, respectively, in 2012) saying this would make them more interested in doing so using a smartphone to make in-person payments.

“Dwindling interest since last year may be an indication that the initial interest has fallen short with practical use, and has not yet been followed up by a constructive call to action by manufacturers and retailers,” explains Aaron Kane, senior research director at Harris Interactive and a key consultant on Harris Poll TECHpulse, a new research product designed to track consumer awareness of and attitudes toward emerging technologies, such as mobile payments. “Right now, the bottom line is that consumers don’t yet feel as if they’re being presented with a compelling enough reason to switch their payment habits, nor are they confident that these new methods are secure. This knowledge ‘gap’ represents an opportunity for companies to change the conversation by addressing these issues head-on.”

For information regarding Harris Interactive’s TECHpulse research tool [email protected].

To see other recent Harris Polls, please visit the Harris Poll News Room.

Want Harris Polls delivered direct to your inbox? Click here!

Methodology

This Harris Poll was conducted online within the United States between September

18 and 24, 2013 among 2,577 adults (aged 18 and over). Figures for age, sex, race/ethnicity, education, region and household income were weighted where necessary to bring them into line with their actual proportions in the population. Propensity score weighting was also used to adjust for respondents’

propensity to be online.

All sample surveys and polls, whether or not they use probability sampling, are subject to multiple sources of error which are most often not possible to quantify or estimate, including sampling error, coverage error, error associated with nonresponse, error associated with question wording and response options, and post-survey weighting and adjustments. Therefore, Harris Interactive avoids the words “margin of error” as they are misleading. All that can be calculated are different possible sampling errors with different probabilities for pure, unweighted, random samples with 100% response rates. These are only theoretical because no published polls come close to this ideal.

Respondents for this survey were selected from among those who have agreed to participate in Harris Interactive surveys. The data have been weighted to reflect the composition of the adult population. Because the sample is based on those who agreed to participate in the Harris Interactive panel, no estimates of theoretical sampling error can be calculated.

These statements conform to the principles of disclosure of the National Council on Public Polls.

The results of this Harris Poll may not be used in advertising, marketing or promotion without the prior written permission of Harris Interactive.

The Harris Poll(r) #84, November 15, 2013

By: Larry Shannon-Missal, Harris Poll Research Manager

About Harris Interactive’s TECHpulse Research Tool TECHpulse is a multi-client product development and marketing research-based tool that provides trendable business information on consumer consumption and attitudes towards a variety of technology categories (i.e., Wearable Technologies, Mobile Payments and more). It also delivers strategic consumer insight into new and emerging technologies to support business decision-making.

Companies can use TECHpulse research to…

— Fine-tune existing product lines

— Develop new product lines

— Help prioritize feature development

— Help with feature packaging and pricing

— Guide the direction of technology strategy About Harris Interactive Harris Interactive is one of the world’s leading market research firms, leveraging research, technology, and business acumen to transform relevant insight into actionable foresight. Known widely for The Harris Poll(r), Harris offers proprietary solutions in the areas of market and customer insight, corporate brand and reputation strategy, and marketing, advertising, public relations and communications research across a wide range of industries.

Additionally, Harris has a portfolio of multi-client offerings that complement our custom solutions while maximizing a client’s research investment. Serving clients worldwide through our North American and European offices, Harris specializes in delivering research solutions that help our clients stay ahead of what’s next. For more information, please visit www.harrisinteractive.com.

Article source: http://www.darkreading.com/mobile/exposure-to-mobile-payment-grows-but-con/240163983