STE WILLIAMS

Flash flaw potentially makes every webcam or laptop a PEEPHOLE

Customer Success Testimonial: Recovery is Everything

A security flaw thought to have been fixed by Adobe in October 2011 has reappeared thanks to a new vulnerability involving Flash Player browser plug-ins.

The as yet unpatched vulnerability creates a means to seize control of webcams without permission before siphoning off video and audio from victims’ PCs. The clickjack-style flaw was uncovered by security consultant Egor Homakov, who developed a harmless proof-of-concept exploit to underline his concerns and push for an early fix.


“This works precisely like regular clickjacking – you click on a transparent flash object, it allows access to Camera/Audio channel. Voila, attacker sees and hears you,” Homakov explains in a blog post.

Adobe security team spokeswoman Heather Edell confirmed there was an issue but said it was limited to Flash Player for Google Chrome.

“This vulnerability affects users on Flash Player installed with Google Chrome,” Edell told El Reg in an email. “Google is working to resolve the issue and plans to provide a fix this week,” she added.

The vulnerability would be potentially handy for both perverts and NSA-style spies. Tinfoil hatters who tape over webcams when they aren’t in use have been vindicated by the discovery of the problem.

Robert Hansen, director of product management for WhiteHat Security, said the security model adopted by Adobe Flash has contributed to the problem.

“The basic problem with Flash is that it doesn’t have modal dialogues that pop up outside of the browser, which can alert the user to what’s about to happen,” Hansen explained. “Because the dialogues are on the same page as the adversary’s code, they can overlay things, make it opaque, and so on, to effectively hide the dialogue warning.”

Google recently imposed a seven day deadline for vendors to respond to security bug reports. Homakov’s discovery represents the first chance to see whether Google itself can stick to such tight deadlines. ®

Ensure Ease of Recovery with Asigra’s Agentless Software

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/18/flash_webcam_flaw/

NSA PRISM snoop-gate: Won’t someone think of the children, wails Apple

Cloud based data management

Apple has joined Facebook and Microsoft by revealing it has received thousands of requests for sensitive user data from US investigators in less than a year.

And like the two other giants, the fruity computer company is remaining vague about the details.


Cupertino’s statement marks another attempt to diffuse the ongoing row over PRISM – the NSA’s controversial project that taps up Apple and other internet giants for personal information on foreigners. The reveal tries to put a positive spin the iPhone-maker’s close cooperation with cops and spies.

The cloud-powered iPad-slinger said it had dealt with between 4,000 and 5,000 surveillance requests from the US government since December 2012. These requests covered between 9,000 and 10,000 accounts or devices and came from federal, state and local authorities – the cases concerned had to do with both criminal investigations and national security matters.

“The most common form of request comes from police investigating robberies and other crimes, searching for missing children, trying to locate a patient with Alzheimer’s disease, or hoping to prevent a suicide,” Apple said in a public statement. “Regardless of the circumstances, our Legal team conducts an evaluation of each request and, only if appropriate, we retrieve and deliver the narrowest possible set of information to the authorities.”

Apple stated that iMessage, FaceTime, map searches, location details and Siri requests remain private. In the case of Facetime and iMessage, this is because of end-to-end encryption, and data from the latter three is not retained by the company, Cupertino insists.

‘We have never heard of PRISM’

Apple, Facebook and Google were among nine tech firms named as having participated (wittingly or unwittingly) in the controversial NSA PRISM we surveillance programme. The 41-page presentation was given in April this year and made public by the Washington Post.

The Apple statement, although it reveals the number of requests Cupertino complied with, it continues to deny allowing gov bods to access its servers, stating: “We first heard of the government’s ‘Prism’ program when news organizations asked us about it on June 6.”

Since the exposure of the programme through the actions of former CIA contractor Edward Snowden, US tech firms have been lobbying the government to allow them to provide more details to their customers on the extent to which they have helped the authorities with their inquiries. Spy chiefs were against this disclosure but politicians appear to have overruled them and allowed tech giants to provide more details on wiretap requests than had been permitted with previous transparency reports from the likes of Google and Microsoft.

This move is clearly designed, at least in part, to reassure businesses and consumers that data held by US technology firms is not subject to dragnet surveillance, a concern that might prompt enterprises and international consumers to look for alternatives to US-based services.

Facebook released a similar set of data to Apple on Friday, saying it received 9,000 to 10,000 requests for user data from US authorities (local, state and federal) in the second half of 2012. These requests covered 18,000 to 19,000 of its users’ accounts. “These requests run the gamut – from things like a local sheriff trying to find a missing child, to a federal marshal tracking a fugitive, to a police department investigating an assault, to a national security official investigating a terrorist threat,” Facebook said in a statement.

The social network claimed that its lawyers guarded users’ privacy jealously against these requests. “We’ve reiterated in recent days that we scrutinize every government data request that we receive – whether from state, local, federal, or foreign governments. We’ve also made clear that we aggressively protect our users’ data when confronted with such requests: we frequently reject such requests outright, or require the government to substantially scale down its requests, or simply give the government much less data than it has requested. And we respond only as required by law,” it said.

Microsoft, meanwhile, said it had handled 6,000 to 7,000 criminal and national security requests from US authorities affecting 31,000 to 32,000 accounts over the last six months of 2012. Redmond said the figures were an amalgamation of statistics from requests from US local, state and federal authorities. It said the figures included more on national security requests than previously provided while stating that the government has still not allowed it to be completely candid.

“For the first time, we are permitted to include the total volume of national security orders, which may include FISA orders, in this reporting. We are still not permitted to confirm whether we have received any FISA orders, but if we were to have received any they would now be included in our aggregate volumes,” Microsoft said in a statement.

“We are permitted to publish data on national security orders received (including, if any, FISA Orders and FISA Directives), but only if aggregated with law enforcement requests from all other US local, state and federal law enforcement agencies; only for the six-month period of July 1, 2012 thru December 31, 2012; only if the totals are presented in bands of 1,000; and [only if] all Microsoft consumer services had to be reported together.” ®

Cloud based data management

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/17/surveillance_request_figures/

Rally supports Snowden amid claims GCHQ tapped G20 summit

Ensure Ease of Recovery with Asigra’s Agentless Software

Over 900 Hong Kong-ers braved torrential rain on Saturday to march on the US Consulate and HK government in support of infamous PRISM whistle-blower Edward Snowden, as the man himself released yet more classified info on US intelligence operations.

The supportsnowden.org movement is positioning Snowden’s case and how the authorities respond to any potential extradition demands from the US as marking “a crossroads in Hong Kong’s future”.


With backing from several pan-democratic political parties in the SAR, its aim is as follows:

We call on Hong Kong to respect international legal standards and procedures relating to the protection of Snowden; we condemn the US government for violating our rights and privacy; and we call on the US not to prosecute Snowden.

The rally took place as Snowden reportedly made new information available to The Observer, which on Sunday reported that US operatives in the UK intercepted the communications of then-Russian president Dmitry Medvedev during the 2009 G20 summit staged in London.

Such revelations are problematic for Snowden because although they promote him as a more valuable asset for China to hang on to, they would also seem to strengthen the case for his extradition – as he is now exposing large chunks of classified intelligence on US operations abroad.

The former IT security administrator at US defence contractor Booz Allen Hamilton is still thought to be holed up in the former British colony despite hinting at plans to seek asylum in Iceland. ®

Customer Success Testimonial: Recovery is Everything

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/17/snowden_rally_hong_kong_extradition/

Panda-peddlers cuffed for chess gambling gambit

Cloud based data management

Two Chinese virus writers jailed in 2007 for spreading the info-stealing Panda (Fujacks) malware have been nabbed again after setting up an illegal online gambling site on their release from prison.

After getting out of the slammer, Zhang Shun and Li Jun decided to go straight and launch an online gaming company, however things didn’t work out as planned and users stayed away from their chess games in their droves.


At that point Li and Zhang decided to go for broke, and set up the Gold Ingot Chess gambling platform which began to make them millions of renminbi, according to IDG (via TechWeb).

Gambling is illegal in mainland China and when the police launched one of their periodic crackdowns in 2012, Li and Zhang abandoned ship, destroying incriminating equipment as they left.

However, they weren’t quick enough and the cops swooped on the two, along with 17 others, last January.Up to 10 years in the slammer now awaits.

The Fujacks worm made headlines back in 2007 after infecting an estimated one million PCs in China, making Li 100,000 yuan (£10,380) in the process.

The worm got its alternative name because it would turn icons of any infected programs into an image of a panda burning three sticks of incense, while in the background covertly stealing user online game credentials.

After getting out of jail Li tried to make amends for sullying the image of one of China’s most revered animals by apparently donating 50,000 yuan to a Panda breeding centre. ®

SaaS data loss: The problem you didn’t know you had

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/17/panda_hackers_cuffed_online_gambling/

‘BadNews is malware’ says outfit that found it

Ensure Ease of Recovery with Asigra’s Agentless Software

The BadNews malware debate continues to be batted back and forth, with Lookout, the company that first raised the alarm, maintaining that it is malware in the face of Google’s assertion last week that it had seen no malicious activity associated with apps carrying the malware.

In conversation with The Register, Lookout’s security product manager Jeremy Linden said the company not only remains confident that BadNews is malware, but that the security vendor is seeing “evolution of the code base”.


When BadNews was discovered, Lookout said it was present in 32 apps on Google Play which, combined, had been downloaded millions of times.

Last week, Google told a security conference “it had no evidence that BadNews was playing a part in the distribution of SMS-borne frauds”, adding that “we haven’t seen a single instance of abusive SMS applications being downloaded as a result of BadNews”.

Linden has now told The Register that “Our analysis confirms that BadNews does prompt the user to install a malware application,” but that it was written “to avoid detection”. It remains quiet most of the time, he said, only becoming active for a few minutes at a time.

“There’s a high possibility that Google hasn’t seen it sending malware,” Linden told The Register. “We have systems that act like they’re infected clients, so they can sit on the malware networks and log malicious traffic.

“We are still seeing traffic from BadNews and we’re seeing an evolution of the code base.”

He said that BadNews’ operators are “adding features” to increase the malicious activity of the malware, and said Lookout believes “the same developers are behind other explicitly malicious code.”

The Register invited Google to provide comment for this story, but has received no response. ®

Customer Success Testimonial: Recovery is Everything

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/17/lookout_badnews_iisi_malware/

Anon posts Filipino president’s phone numbers

Ensure Ease of Recovery with Asigra’s Agentless Software

An Anonymous hacktivist has published what he claims to be three telephone numbers belonging to the Philippine president Benigno Simeon Cojuangco Aquino III, including his private mobile number, in a bid to urge voters to confront their leader directly.

Going by the pseudonym “#pR.is0n3r”, the hacker posted the numbers to his 10,000+ followers on Facebook on Friday night alongside the president’s home address and the address of Aquino’s office in the House of Representatives Batasan building.


Beneath the numbers is the message “This is now the chance for your voice to be heard”, alongside an Anonymous logo.

There was no confirmation as to the veracity of the phone numbers but an Aquino spokesman, Ricky Carandang, didn’t sound too happy.

“It’s cyber vandalism plain and simple,” he told AFP. “We’re dealing with it. That’s all I can say for now.”

When the news wire tried to contact the numbers on Saturday morning they had apparently stopped working.

There was no further info on the Facebook page of #pR.is0n3r as to exactly how he obtained the numbers but in a message sent to local paper The Star, the hacktivist claimed he was “100 per cent” sure they were Aquino’s.

He also complained that the president was “very silent when it comes to national issues”, adding, “We want to hear him.”

Anonymous has had run-ins with the Acquino administration in the past, most notably in January when it defaced several government web sites in response to the Cybercrime Prevention Act 2012.

Local hacktivists claiming to be affiliated with the group have also been involved in a bitter online battle between Filipino and Malaysian hackers which erupted after bloody clashes in the northern Borneo region of Sabah, and in tit-for-tat exchanges with patriotic Chinese over the disputed group of rocks known as Scarborough Shoal. ®

Customer Success Testimonial: Recovery is Everything

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/17/philippine_anonymous_nabs_president_mobile/

Critical Java SE update due Tuesday fixes 40 flaws

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Thought your Java security woes were behind you? Think again. Oracle is planning to release a Critical Patch Update on Tuesday that affects multiple versions of Java, and it’s another doozy.

According to Oracle’s security announcement, the patch pack addresses 40 different vulnerabilities. All update levels of Java SE 5, 6, and 7 are affected by the flaws, as are all versions of JavaFX.


Of the 40 bugs, all but three are remotely exploitable over a network without the need for a username or password.

Yes, that’s bad. Oracle ranks the severity of its flaws using the Common Vulnerability Scoring System (CVSS), and the top-ranked bug in this particular update rates a 10.0 – the highest possible score.

“Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible,” the database giant helpfully suggests.

Oracle ordinarily releases Critical Patch Updates four times a year on a set schedule, but this will already be the fourth such update issued in 2013. The first shipped on February 1, but Oracle reissued it later in the month with additional fixes. It also scheduled another, previously unplanned update for April.

Each of those earlier updates contained upward of 40 fixes, and each similarly addressed flaws that rated 10.0 on the CVSS severity scale.

Oracle has not yet disclosed which vulnerabilities will be patched by the June update, but previous Critical Patch Updates have patched vulnerabilities in a wide range of Java APIs and subsystems. These flaws could potentially affect a whole host of Java software and were not limited to programs running via the Java browser plugin, as has been the case with some previous Java exploits.

Oracle plans to release its latest Java SE Critical Patch Update on June 18, 2013. After that, the next update is currently scheduled for October 15. ®

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/14/java_june_critical_patch_update/

We want to put a KILL SWITCH into your PHONE, say Feds

Magic Quadrant for Enterprise Backup/Recovery

US law enforcement is calling for a mandatory kill switch on all mobiles, enabling the shut down of stolen phones in the hope of rendering them worthless.

Mobile phone theft keeps rising, with one in three US robberies involving mobile kit, apparently. A coalition of US law enforcement agencies calling itself “Secure our Smartphones” is therefore calling for manufacturers to take responsibility for their products – to the point of reaching out and locking them down if they get nicked.


This plays nicely into the hands of Apple, whose latest mobile OS (announced last week) coincidentally has exactly that feature. Samsung has promised something similar, and both Google and Microsoft came along to the Smartphone Summit to talk about the idea.

And it’s not a bad idea. Yet, like all “not-so-bad” ideas, the devil is in the detail.

To reach out to a stolen phone it has to be identifiable, beyond the easily-changed mobile number. All (GSM) phones have an International Mobile Equipment Identifier (IMEI – press *#06# to see it) number, and the majority of mobile networks subscribe to a system which blocks stolen IMEI numbers from their networks.

That system, known as the Central Equipment Identity Register or CEIR, theoretically makes stolen phones useless, but this is assuming that the IMEI hasn’t been changed, the handset isn’t shipped to a developing market which hasn’t coughed up the CEIR fee, and (perhaps most importantly) that the thief knows all this.

Most UK muggings, for example, include the theft of a mobile phone, but it’s rarely the phone the thieves want. They’ve read about tracking and hidden camera apps, and few of them have the technical nous to spot such a thing.

The purpose of stealing the handset and then discarding it is to delay pursuers, thus providing more time during which stolen credit cards and other spoils can be turned into cash.

But that can skew the crime figures, making it look as though mobile theft is reaching the epidemic proportions described by New York Attorney General Eric Schneiderman.

That’s not to say stolen phones are without value. Changing the IMEI of a phone is illegal in the UK (even advertising one’s ability to perform the act is against the law) but on most handsets it remains possible.

Once it has been changed, the phone can be used anywhere. Failing that, there’s always a market in the dwindling number of countries who’ve not yet implemented CEIR, despite international pressure.

Manufacturers could make it all but impossible to change the IMEI. That would address many of the issues, but it wouldn’t give them greater control over their customers and an excuse to stay in touch throughout the life of the product (“send in your warranty documents or we’ll kill the phone, and be sure to tell us if you decide to sell it on”).

For Apple this is perfect, and the timing couldn’t have been better – though the consortium is reserving judgment on iOS7 until it has been seen in action.

The surprise absentee from the list of firms considering implementing a killswitch function is BlackBerry, whose infrastructure and customer relationships makes this eminently practical and already available.

But if one discovered that thefts of BlackBerry devices were just as high as the rest, that would make this whole “Save our Smartphones” consortium look like a pointless political exercise. Perish the thought. ®

Customer Success Testimonial: Recovery is Everything

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/14/us_government_wants_mobile_kill_switch/

Japan proposes NSA-style agency and new snooping laws

Free whitepaper – Ensure Ease of Recovery with Asigra’s Agentless Software

In a masterpiece of timing, the Japanese government is considering a new NSA-style agency to monitor internet communications in the country.

Top government security advisory panel the National Information Security Centre (NISC), which is chaired by prime minister Shinzo Abe, is currently seeking public consultation on its Cyber Security 2013 draft report (Japanese), published on Monday.


The report, which sees the government refer for the first time to “cyber security” rather than “information security” to encompass sabotage attacks on critical infrastructure and other threats, proposes some radical steps to help keep the country safe from escalating risk.

It’s summarised briefly in English by Hitachi here, and includes a proposal to set up a Cyber Defence Unit within the country’s Self Defence Forces (SDF) which will be focused not just on protecting the SDF but also civilian infrastructure.

The government may also be allowed to monitor internet communications – currently forbidden under Article 21 of the Japanese Constitution and Article 4 of Japan’s Telecommunications Business Law, according to Defence News.

The military news site spoke to NISC panel member Motohiro Tsuchiya, who revealed that in all likelihood a new NSA-or-GCHQ-style agency, provisionally called the Cyber Security Centre, would be required to conduct the network monitoring.

“We might start monitoring communications. Japan is an island nation, and connected through submarine cables via landing stations,” he added.

“We can tap into these to watch malicious communications. We are not proposing deep packet inspection, for example. The ability to monitor headers and to use lists to stop distributed denial of service attacks might be sufficient.”

While the proposed internet snooping appears not to include messages’ content, the plans come at time when an almost unprecedented amount of scrutiny and public anger is being directed at the NSA after whistle-blower Edward Snowden’s revelations.

In fact, it could hardly have come at a worse time and it will be interesting to see whether NISC waters down any of its proposals come July when the final report is due.

Given that it could take years after that before any plans are actually implemented – as negotiation will be needed between several agencies and ministries – the whole PRISM saga may even have blown over by then. ®

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/14/japan_nsa_internet_snooping_bad_timing/

You dirty RAT: Trend Micro spots new Asia-wide attack

Free whitepaper – Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Security researchers are warning of yet another advanced, large-scale attack campaign using sophisticated techniques to hide itself from its targets – organisations across Asia.

Trend Micro has dubbed the campaign Naikon, based on the HTTP user-agent string “NOKIAN95/WEB” found in various targeted attacks across the region in India, Malaysia, Singapore, and Vietnam and elsewhere.


The attacks begin in time-honoured fashion with a spear-phishing email “using messages related to diplomatic discussions in the Asia Pacific region”, according to Trend Micro threat analyst Maharlito Aquino.

Targets range from governments to media, oil and gas, telecommunications and other organisations.

The malicious email attachment exploits CVE-2012-0158 – a vulnerability in Windows Common Controls which was also used in the “Safe” campaign discovered by researchers last month and thought to be connected to the “cyber criminal underground in China”.

When the attachment is opened all the victim sees is a “decoy document”, however in the background the BKDR_RARSTONE Remote Access Tool (RAT) is being dropped onto the user’s machine.

First discovered back in February and used subsequently in email attacks using the Boston Marathon Bombings as a subject line lure, RARSTONE uses several techniques to evade detection by traditional security tools, Aquino said.

The RAT loads its backdoor component from a CC server directly into memory, hiding it from traditional file-based scanners, for example.

Aquino continued:

What makes RARSTONE unique from PlugX – and other RATs – is its ability to get installer properties from Uninstall Registry Keys. This is so that it knows what applications are installed in the system and how to uninstall them, in the case that these applications inhibit RARSTONE’s functions. It also uses SSL to encrypt its communication with its CC server, which not only protects that connection but also making it blend in with normal traffic.

The attackers also aimed to hide their efforts from the likes of Trend Micro by using either dynamic DNS domains or registrars with privacy protection, he said.

There’s no info on exactly what the attackers were looking for in their campaign, although BKDR_RARSTONE is apparently capable of all the usual backdoor tricks, including “enumerating files and directories, downloading, executing, and uploading files, and updating itself and its configuration”.

Trend Micro urged organisations to bolster their defences against such attacks by supplementing blacklisting and perimeter-based controls with file integrity monitoring and other tools which can offer greater insight into network traffic to identify suspect behaviour. ®

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/06/14/trend_micro_naikon_rarstone_attack/