STE WILLIAMS

5 ways to reduce advertising network latency

A security researcher has suggested that Apple’s claim that its iMessage app is spook-proof and secure does not stand up to scrutiny.

Cyril Cattiaux, who works at the research firm QuarksLab, made his claims during a speech to the Hack in the Box conference, which were quoted by PC World – the tech news site, rather than the British retailer.

In a detailed blog post, Cattiaux said that the public key cryptography used by Apple in its iMessages made them vulnerable to snooping.

He said: “The weakness is in the key infrastructure, as it is controlled by Apple. They can change a key any time they want, thus read the content of our iMessages.”

However, there is no suggestion that Apple wilfully misled its customers and it has not been accused of actually reading fanbois’ iMessages.

In June, Apple released the following statement which discussed the security of iMessage:

Conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data.

Apple’s iMessage is a text-messaging service which allows fanbois to send free messages over Wi-Fi. ®

ioControl – hybrid storage performance leadership

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/21/apple_accused_of_lying_about_spookproof_imessage/

Free Regcast : Managing Multi-Vendor Devices with System Centre 2012

A US district court has ruled that self-confessed “hackers” have all the skills needed to swiftly destroy evidence, allowing anyone suing them to seize their equipment without warning.

The court in Idaho decided that a software developer’s computer could be confiscated without prior notice primarily because his website stated: “We like hacking things and don’t want to stop.”

The ruling [PDF] came down in a case brought by Battelle Energy Alliance against ex-employee Corey Thuen and his company Southfork Security.

Thuen, while working for Battelle, helped develop an application today known as Sophia, which fires off alerts if it detects industrial control equipment coming under electronic attack. Battelle – which was tasked with beefing up the computer security of US electricity plants, energy sources and other critical sites – wanted to license this technology, but Thuen hoped to open source the code, according to the plaintiffs.

Sophia, which had been in development since 2009, underwent testing in 2012 and attracted the attention of power companies.

Thuen left Battelle before setting up Southfork Security. According to Battelle, Southfork Security competed against other firms to license Sophia from Battelle before withdrawing in April 2013, a month before an outfit called NexDefense was awarded the right to negotiate an exclusive commercial licence.

Around the same time, in May 2013, Southfork Security began marketing a “situational awareness” program called Visdom that Battelle alleges is a knockoff of Sophia.

Battelle Energy Alliance sued Thuen, claiming that Visdom was based on stolen code, and accused Southfork and Thuen of copyright infringement, trade secret misappropriation and breach of contract, among other allegations, according to legal filings seen by The Register.

What elevates the case from a run-of-the-mill intellectual property dispute is that Battelle persuaded the court to allow it to seize Thuen’s computer to copy its files. The district court ruled that the programmer has the skills, as a “hacker”, to release the contested code publicly, cover his tracks and destroy any evidence, if he knew a seizure was imminent:

The court has struggled over the issue of allowing the copying of the hard drive. This is a serious invasion of privacy and is certainly not a standard remedy… The tipping point for the court comes from evidence that the defendants – in their own words – are hackers. By labeling themselves this way, they have essentially announced that they have the necessary computer skills and intent to simultaneously release the code publicly and conceal their role in that act. And concealment likely involves the destruction of evidence on the hard drive of Thuen’s computer. For these reasons, the court finds this is one of the very rare cases that justifies seizure and copying of the hard drive.

The plaintiff also obtained a temporary restraining order against Thuen and Southfork Security without prior notice primarily because, again, the Southfork website declared “we like hacking things and we don’t want to stop”.

This statement was used to prop up the claimants’ argument that Thuen and Southfork “have the technical ability to wipe out a hard drive [and] will do precisely that when faced with allegations of wrongdoing”. That would seem to fall short of the usual legal test for granting a restraining order, that the defendants have “a history of disposing of evidence or violating court orders”, but the district court granted the restraining order nonetheless.

The order prevents Thuen and his company from releasing any of the contested source code.

Battelle’s lawyers also raised national security concerns by arguing that releasing the Sophia utility as open-source code would hand strategic and vital information to wannabe power-plant hackers. Thuen and Southfork were not given the opportunity to appear before the court and contest this argument before the seizures were carried out and the restraining order on the business imposed.

A good overview of the whole contentious case so far can be found in a blog post by control system security consultancy Digital Bond. ®

Updated to add

There is a debate over whether the court’s ruling ran roughshod over a person’s rights against unreasonable seizures, enshrined in the US Constitution’s Fourth Amendment: some have argued that such protections do not extend to discovery requests in private civil cases.

ioControl – hybrid storage performance leadership

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/23/hacker_seizure_rights_case/

5 ways to reduce advertising network latency

The Adobe Flash Player plugin runs in a locked-down sandbox environment under Safari in OS X 10.9 “Mavericks,” making Apple the latest major browser vendor to provide additional security when viewing Flash content on the web.

According to a memo posted by Adobe security strategist Peleus Uhley on Thursday, Flash Player in Mavericks is protected by an OS X App Sandbox, a security feature first introduced in OS X 10.7 “Lion” in 2011.

Apple’s relationship with Flash has long been a fraught one. In his landmark “Thoughts on Flash” memo in 2010, Steve Jobs spelled out the reasons why Adobe’s tech wouldn’t be allowed on iOS devices, and security ranked high among his points.

“Symantec recently highlighted Flash for having one of the worst security records in 2009,” Jobs wrote. “We also know first hand that Flash is the number one reason Macs crash. We have been working with Adobe to fix these problems, but they have persisted for several years now.”

With Flash running in an OS X App Sandbox, the plugin is restricted to reading and writing files from only those locations on disk that are necessary for it to function properly. Its access to local device resources and inter-process communications (IPC) channels is also limited, and it has diminished network privileges.

Apple’s App Sandbox feature in OS X enforces security controls at the kernel level

Safari is not the first browser to implement such protections. Google took the lead in working with Adobe to develop sandboxing technology for Flash running in its Chrome browser in 2012, and Adobe helped to add similar capabilities to Firefox and Internet Explorer later that same year.

Not that these systems have been invulnerable to attack. Shortly after Adobe implemented its sandbox for Firefox, the security layer was attacked by hackers to escalate access permissions, forcing Adobe, Mozilla, Google, and Microsoft to issue additional patches.

Still, by adding similar sandbox protections to Safari, Apple at last has given OS X users similar protections when viewing Flash content as those already enjoyed by users on other platforms, including Windows and Linux.

The catch? The new sandboxing feature is only available on Safari 7.0, and for that you’ll need to be running Mavericks. Users of OS X 10.8 “Mountain Lion” and earlier are stuck on Safari 6.1, which takes a far more liberal attitude toward the Flash Player plugin. ®

ioControl – hybrid storage performance leadership

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/24/safari_flash_player_sandbox/

Email delivery: 4 steps to get more email to the inbox

The European Parliament has voted to halt the Terrorist Finance Tracking Program (TFTP), an agreement to share data on financial transactions in the Continent with the US – after documents leaked by Edward Snowden showed the NSA was hacking the system anyway.

“Parliament stresses that any data-sharing agreement with the US must be based on a consistent legal data protection framework, offering legally-binding standards on purpose limitation, data minimisation, information, access, correction, erasure and redress,” the resolution reads.

The TFTP was set up in the wake of the September 11 terrorist attacks to give US investigators access to data from the Society for Worldwide Interbank Financial Telecommunication (SWIFT). According to prolific whistleblower Snowden, Uncle Sam’s spies pwned the SWIFT system, as well as those of other financial providers including Visa, and is busy slurping up credit card records and other information on selected targets.

In the wake of these allegations, the parliament voted by 280 to 254 (with 30 abstentions) to suspend the TFTP until a “full on-site technical investigation” of the hacking claims has been carried out by Europol’s Cybercrime Centre.

The resolution is non-binding, however, since only the European Commission can bind member nations to the decision. But under the terms of the TFTP “the Commission will have to act if Parliament withdraws its support for a particular agreement.”

It’s a measure of the growing anger in Europe over the NSA’s operations that such a vote was even considered. This week’s news that the agency may have hacked the phone and email of the heads of state of Germany and Mexico, as well as spying on more than 70 million phone calls in France, has many politicians up in arms over America’s global surveillance.

According to the US Treasury Department, TFTP has given “thousands of valuable leads to US Government agencies” about possible terrorist activity, and since 2010 the agreement has been codified so that specific rules are laid down on data privacy and deletion. One wonders, therefore, why the NSA bothered hacking it in the first place.

Senator Dianne Feinstein, chairman of the Senate Intelligence committee and NSA cheerleader, offered one possible reason in an op-ed in USA Today on Monday. She argued that the spy agency’s mass data trawls of phone records and other data was necessary because the spooks need to act quickly to catch terrorists and need “the haystack of records in order to find the terrorist needle.”

Perhaps the NSA simply just doesn’t trust its friends in Europe. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/24/european_parliament_votes_to_suspend_datasharing_with_us/

WhiteHat Security has been involved in trying to secure the Web for more than a decade. But earlier this week, the company made a move to come at security from a different angle – through the Web browser itself.

The company pulled the covers off a beta version of its own Web browser, nicknamed Aviator. Available as a free download, the browser’s focus can be summed up in two words – privacy and security.

“Browser security has been a topic that both [WhiteHat Security Director of Product Management] Robert Hansen and I have been discussing publicly for years now,” says WhiteHat CTO Jeremiah Grossman in an email. “Many people ask us what browser we use and our answer has always been ‘my own.’ That browser is Aviator. It is a browser that we feel confident in using not only for our own security and privacy, but one that we can now confidently recommend to family and friends when they ask. So in that sense it has been an internal, personal project for years.”

In announcing Aviator, Hansen argued that the major browser vendors choose not to make changes that could run the risk of hurting their market share or ability to make money, particularly when it comes to online ads.

“Popup blockers used to work wonders, but advertisers have switched to sourcing in JavaScript and actually putting content on the page,” Hansen tells Dark Reading in an email. “They no longer have to physically create a new window because they can take over the entire page. Using Aviator, the user’s browser doesn’t even make the connection to Google’s advertising servers so obnoxious or potentially dangerous ads simply don’t load. Aviator uses an extension called Disconnect, which doesn’t block every ad in the world, but it does block enough that it’s a significant improvement in both speed and safety.”

The browser has been designed by default to run in a ‘private mode’ that purges any cookies being stored when the browser is restarted. The browser has also made plugins like Adobe Flash Player and Java click-to-play to limit their use in the name of tracking and malware attacks.

“A large percentage of malware is distributed through Java or Flash exploits via drive-by attacks,” Hansen explains. “Often sites are compromised and malicious content is sourced in or is sometimes distributed through ad networks. By allowing the content to be load-only when the user wants, as opposed to at the whim of whoever has developed the Web page, it reduces the likelihood of exploitation by a huge amount through those commonly used plugins.”

The browser is built off of Chromium. Right now, Aviator only works on Macs, but support for Windows and other operating systems may come in the future.

“Because WhiteHat is primarily a Mac shop, this initial version is Mac OS X,” explains Grossman. “The feedback so far has been very positive and requests for a Windows, Linux and even open source versions are pouring in so we are definitely determining where to focus our resources on what should come next, but there is no definite timeframe yet of when other versions will be available.”

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/privacy/whitehat-security-releases-web-browser-t/240163114

A US man in West Haven, Connecticut has been arrested for allegedly Tweeting threats to executives, players and coaches of the New York Mets – a professional baseball team based in the borough of Queens in New York City – as well as a specific threat to Citi Field, the stadium in which they play.

NBC Connecticut reports that police on Wednesday arrested Aryn Leroux, 42, on an outstanding warrant. (Another report states that his age is 32.)

Details are scarce. Leroux’s Twitter feed has likely been deleted or suspended, as neither I nor other reporters seem to have been able to find it.

But the New York Post’s Mike Puma did provide some detail on just what Leroux allegedly said, saying on his Twitter feed that Leroux – reportedly a devoted Mets fan – tweeted to one player about a “plan to sneak into the clubhouse and put bombs in everyone’s cleats.”

Another tweet from Puma quoted a second Mets player as saying that the arrested fan had said things that “can’t be said walking through security at the airport.”

Unfortunately, death threats and other forms of harassment coming via Twitter aren’t restricted to this one case, by any means.

As reported by Yahoo Sports, Brandon Jacobs, running back for the US football team the New York Giants, recently tweeted a picture of a death threat sent to him and his family.

The New York Daily News reports that the matter was turned over to National Football League (NFL) Security.

The Twitter account holder who allegedly threatened Jacobs and his family later claimed he was just kidding – at first calling Jacobs a “ho” for retweeting his threats but then doing an about-face to beg for forgiveness.

It was a day late and a dollar short.

After all, nuance doesn’t translate well online – particularly when it comes to death threats posted online in a public space.

Leroux, for his part, has been charged with threatening in the second degree and breach of peace. He’s being held on a $2,500 bond and will be arraigned at Milford Superior Court.

Follow @LisaVaas
Follow @NakedSecurity

Image of Home Run Apple on Mets Plaza in the front of Citi Field courtesy of Leonard Zhukovsky / Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/5zId1WCm9yU/

5 ways to reduce advertising network latency

Google’s Safe Browsing technology is blocking access to PHP.net as a precaution, after apparently detecting that some of its pages were booby-trapped with links to malicious software.

The move put warning blocks in the way of accessing a site that’s widely used by web developers. Google didn’t specify the types of Trojans associated with the apparent attack but it did state the domains they came from.

Of the 1513 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2013-10-23, and the last time suspicious content was found on this site was on 2013-10-23.

Malicious software includes 4 trojan(s). Malicious software is hosted on 4 domain(s), including cobbcountybankruptcylawyer.com/, stephaniemari.com/, northgadui.com/.

3 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including stephaniemari.com/, northgadui.com/, satnavreviewed.co.uk/.

The warning was brought to The Register‘s attention after we received emails from several readers noting the issue.

PHP is an open source web development language used on millions of websites, including those powered by the popular WordPress and Joomla suites.

Users visiting the PHP.net site using Google Chrome, Mozilla’s Firefox and or Apple Safari (Mozilla and Apple both license Safe Browsing from Google) were confronted by a warning firmly instructing them not to proceed any further.

®

ioControl – hybrid storage performance leadership

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/24/php_site_malware_warning_flap/

Information security has become such a booming business that it seems there is a conference somewhere in the world every single week.

Back in the day we saw big hackerish announcements twice a year, during Black Hat and the Chaos Communication Congress. Now it is happening everywhere, all the time.

Last week at the Hack in The Box conference in Malaysia, researcher Vladimir Katalov made some rather bold claims about the security of Apple’s iCloud backups and iCloud document storage.

It must first be noted that more than six months after launch, Apple has still only introduced two-factor authentication in a handful of countries. I was not able to test all of these claims as it is not yet available in Canada.

In his talk, “Cracking and Analyzing Apple’s iCloud Protocols”, Katalov showed how Apple’s optional two-factor authentication is selective in its application, even where it is available.

First, two-factor is optional. This is true for most services, but I would like to see someone begin making it mandatory.

Passwords are just too vulnerable and unfortunately two-factor has become the bare minimum for cloud services if you don’t want others accessing your information.

Second, but more importantly, Apple’s two-factor authentication only applies to three specific applications of your Apple ID:

• Making a purchase in iTunes/App Store.
• Managing or changing your Apple ID.
• Working with Apple’s technical support team.

Notice how it is inclusive, rather than exclusive. These are the only things protected and nothing else is guaranteed or indeed, included.

What Katalov discovered is that iCloud backups and iCloud documents are not protected by the two-factor system and that they are stored on Microsoft Azure and Amazon AWS cloud services.

Additionally, while the files are stored encrypted, the encryption keys are stored with the files. . . rendering the encryption largely worthless. It also means that Apple can disclose the contents of iCloud stored files on request of law enforcement and governments if they are required to.

Katalov demonstrated that by simply acquiring the Apple ID and password of another user, whether they have enabled two-factor authentication or not, he can download their iPhone/iPad/iPod backups and documents from iCloud and see their pictures, music, emails, contacts, documents, presentations, spreadsheets or anything else without the victim being alerted.

Most users likely assume that by enabling two-factor authentication they are protecting their iCloud data from being stolen if their password is guessed, get infected with a keylogger or are phished. That is true for making an App Store purchase, but all bets are off for iCloud.

Furthermore, iPhone backups can be restored to any device with just the password. If I am able to acquire your Apple ID, I can download everything on your phone to mine. You will get a warning email after the fact, but arguably that is too little too late.

Katalov’s research shows that Apple has only half implemented their two-factor technology and has chosen convenience over actual security. Hopefully his shining a light on the problem will prompt some action from Apple to close these holes.

Follow @chetwisniewski

Image of a apple with an arrow through it courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/SYsTGrkkQHg/

Vice.com’s Martin Robbins summed it up well: Wikipedia, he said, is “the world’s go-to resource for information on everything from the Boer War to fifth-season episodes of Buffy.”

Although some internet cognoscenti cast a skeptical eye at Wikipedia, the service still garners a vast amount of trust.

That trust is based on an assumption that, ideally, Wikipedia’s content is edited, vetted, and can be reasonably relied on to be more than a collection of marketing puff pieces.

PR firms willing to make a buck out of paying clients by gaming Wikipedia’s editing processes are now threatening that trust, to the extent that alarmed watchers are predicting that, in a few years, a significant portion of the service’s content could well be spam.

Earlier in October, the Daily Dot detailed one of the most extensive sockpuppet investigations ever to be undertaken at Wikipedia, if not the largest ever.

As Wikipedia itself defines it, a sockpuppet is a false online identity assumed by a member of an internet community in order to praise, defend or support a person or organization, or to circumvent a suspension or ban from a website.

As the Daily Dot reported, nearly all of the hundreds of sock accounts uncovered by Wikipedia’s investigation shared a few traits:

Most of the pages created were about companies and living persons; the pages were generally positive and promotional in nature; they often cited articles that were written on websites that anybody could contribute to.

One of the accounts associated with what turned out to be a vast sockpuppet network was called Morning277 and had been active since November 2008.

Morning277 proved to be one busy Wikipedia beaver, logging more than 6,000 edits by the time it was investigated.

On a talk page detailing the long-term history of Morning277’s abuse of the service, Wikipedia editors say that Morning277 is associated with a group of hired writers who collaborate without ever using the talk pages to communicate with each other – a red flag for sockpuppetry.

As of September, Wikipedia had confirmed 323 sockpuppet accounts identified by the investigation, which dates to 2008, with another 84 suspected.

Wikipedia’s editors have tracked most of the entries to a US company called Wiki-PR, a firm that specializes in editing Wikipedia on behalf of paying clients.

The firm offers “Wikipedia Writers For Hire” and claims to “build, manage, and translate Wikipedia pages for over 12,000 people and companies.”

Robbins, reporting last week, noted that Wiki-PR’s promise on its Twitter profile at the time baldly stated the matter:

“We write it. We manage it. You never worry about Wikipedia again.“

Wiki-PR is unapologetic about its business model of charging for Wikipedia editing.

CEO and co-founder Jordan French said in an emailed statement that Wikipedia most certainly does allow paid editing, pointing to a policy proposal to limit paid editing on Wikipedia that had, in fact, failed to pass, given that consensus wasn’t reached in a reasonable amount of time.

In a Wikipedia entry on Wiki-PR’s editing of its pages, Wikipedia editors say that the practices of the public relations firm have contradicted the encyclopedia’s practices, including those of conflict-of-interest editing.

The firm claims to have administrator access that enables it to manage its clients’ Wikipedia presence.

Part of the duties of Wikipedia administrators are, of course, sockpuppet investigations.

In fact, as the Daily Dot described, the Wikimedia Foundation, a nonprofit that oversees Wikipedia and its sister sites, entrusts only a small team of vetted admins with the responsibility.

If Wiki-PR’s claims to have administrator access are true, the Daily Dot suggested, it would mean that the firm has planted “sleeper agents” among Wikipedia’s most powerful users – “a revelation that would likely send chills down the spine of any devoted Wikipedian.”

The investigation concluded that Morning277 wasn’t behind a sockpuppet network, per se.

Rather, it was “primarily a case of meatpuppetry” – i.e., when individuals promote their causes by bringing like-minded editors into a dispute.

As far as whether Morning277 is connected to Wiki-PR, French said he couldn’t really comment, given that it’s “unclear whether there is private litigation (or forthcoming private litigation) between the admin who blocked Wikipedia user Morning277 and the actual person” behind the Morning277 account.

Are you confused yet? I’m confused. Wikipedia has madly intricate editing and investigative processes, along with nomenclature to match.

Is Morning277 a sockpuppet? A meatpuppet?

The difference, to my outsider’s perspective, doesn’t amount to much. Either term refers to those with an agenda to push in the pages of Wikipedia, and that seems to be an inarguably anti-Wikipedian situation.

And again, from this outsider’s perspective, it does strike me that Wikipedia’s “bright lines” with regard to paid editing are too fuzzy and permeable for the long-term good of the service.

What do you think? Are businesses justified in hiring firms like Wiki-PR to massage their message? Or should Wikipedia firm up its bright line to resolutely disallow paid editing?

Let us know your take in the comments section below.

Follow @LisaVaas

Follow @NakedSecurity

Image of sock puppet courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/2OHl4tcFyaw/

5 ways to reduce advertising network latency

India has the dubious honour of being named as the ransomware capital of Asia Pacific, with online crime costing the country an estimate $4bn (£2.5bn) in 2012, according to Symantec.

Stats released by the security giant as part of its Norton Report 2013 found that India is among the world’s top five countries for identity theft (11 per cent), ransomware (11 per cent) and phishing (9 per cent).

Half of the adults surveyed by Symantec said they had experienced online crime in the past 12 months, with the global average at 41 per cent, although the average cost per victim ($207) was below a worldwide average of $298.

The stats paint a picture of a country with an increasingly tech-hungry populous but one which is guilty of some rather risky behaviour online, especially when it comes to mobile.

Nearly two-thirds said they had experienced mobile cyber crime in the past 12 months, much higher than a global average of 38 per cent, with nearly half not aware that security products for smartphones and tablets exist.

Some 60 per cent said they use public or unsecured Wi-Fi, with large numbers doing so to send personal emails, access social media accounts and even do online banking.

The report also highlighted deficiencies with BYOD, with 52 per cent of respondents saying their company has no policy on the use of personal devices at work.

The study chimes with previous reports which point to cyber criminals enjoying rich pickings in India.

Last July the country came first in Sophos’ global list of top spam-relaying countries, accounting for 11.4 per cent of junk emails despite being home to only 5.3 per cent of the world’s internet users.

Symantec pointed out that advanced targeted attacks have risen in the sub-continent from 77 per day in 2010 to 82 per day by the end of 2011 – and are especially aimed at SMBs with low information security awareness.

It goes right to the top too – in December 2012 it was revealed that over 10,000 email addresses belonging to senior government and military officials had been compromised.

New Delhi’s response to the growing online threat has not always been as focused as it should.

In January it emerged that the government was hoping to improve the country’s cyber security preparedness by including a security awareness brochure with all desktop PCs, mobile phones and USB modems. ®

ioControl – hybrid storage performance leadership

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/24/india_ransomware_security_apac/