STE WILLIAMS

The Australian Broadcasting Corporation (ABC) will stream the new series of Dr Who mere seconds after it finishes airing in the UK, in an effort to stop avid fans downloading the show.

Dr Who previously screened on a one-week delay, but the ABC has told news.com.au that it recognises fans’ urgent need to view new Who will mean many turn to ‘channel BT’ to obtain the new series. To make it unnecessary for them to do so, the ABC will therefore stream the first new episode on its iView service from 5:10 AM Sydney time on Sunday September 2nd.

Sydney is nine hours ahead of London and the first new episode is scheduled to air on BBC One at 19:20 London time. Assuming the new episodes last 50 minutes, as most recent Whos have done, that means Australians will be permitted to see the new episode very soon after the conclusion of British broadcasts.

ABC1 Controller Brendan Dahill’s canned statement about the decision to stream the show said “For Doctor Who fans, it is a fantastic opportunity.” For pirates, presumably not so fantastic (unless they run iView rippers that download videos from the service as .MP4 files).

iView runs in a PC’s browser, iOS, Xbox, PlayStation and several Smart TVs. An Android incarnation is imminent, but flash-friendly tablets can already consume the service. iView is geo-blocked: you’ll need a VPN to access it outside Australia. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/28/dr_who_beats_torrents/

A new browser-based exploit for a Java vulnerability that allows attackers to execute arbitrary code on client systems has been spotted in the wild – and because of Oracle’s Java patch schedule, it may be some time before a fix becomes widely available.

The vulnerability is present in the Java Runtime Environment (JRE) version 1.7 or later, Atif Mushtaq of security firm FireEye reported on Sunday, while PCs with Java versions 1.6 or earlier installed are not at risk.

The vulnerability allows attackers to use a custom web page to force systems to download and run an arbitrary payload – for example, a keylogger or some other type of malware. The payload does not need to be a Java app itself.

In the form in which it was discovered, the exploit only works on Windows machines, because the payload that it downloads is a Windows executable. But the hackers behind the Metasploit penetration testing software say they have studied the exploit and found that it could just as easily be used to attack machines running Linux or Mac OS X, given the appropriate payload.

All browsers running on these systems were found to be vulnerable if they had the Java plugin installed, including Chrome, Firefox, Internet Explorer, Opera, and Safari.

Although the actual source of the exploit is not known, it was originally discovered on a server with a domain name that resolved to an IP address located in China. The malware it installed on compromised systems attempted to connect to a command-and-control server believed to be located in Singapore.

Oracle has yet to comment on the vulnerability or when users should expect a fix, but it might be a while. The database giant ordinarily observes a strict thrice-annual patch schedule for Java, and the next batch of fixes isn’t due until October 16.

Downgrading to an earlier version of Java is not advised, because even though earlier versions aren’t vulnerable to this particular exploit, they may contain other bugs that expose still other vulnerabilities.

In advance of any official patch, and because of the seriousness of the vulnerability, malware researchers at DeepEnd Research have developed an interim fix that they say seems to prevent the rogue Java code from executing its payload, although it has received little testing.

Because the patch could be used to develop new exploits if it fell into the wrong hands, however, DeepEnd Research is only making it available by individual request to systems administrators who manage large numbers of clients for companies that rely on Java.

For individual users, the researchers say, the best solution for now is to disable the Java browser plugin until Oracle issues an official patch. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/27/disable_java_to_block_exploit/

Fans of simpering scantily clad vixens are furious after the online voting system to pick the next Miss Hong Kong was demolished by hackers, allegedly. The winner of the much-hyped beauty pageant, held on Sunday, was instead decided by a panel of judges.

Broadcaster TVB had been stringing the public along for months with endless TV adverts and pre-pageant shows as the sizeable pool of Miss Hong Kong wannabes was whittled down. Anticipation reached fever pitch.

Sadly, TVB’s first ever attempt to institute a democratic online system to decide on the winner was overwhelmed by data traffic in what appeared to be a massive denial-of-service attack. This led to the judges choosing Carat Cheung Ming-nga as Hong Kong’s representative at next year’s Miss World bikini-fest.

Microsoft, whose Azure platform was used to power TVB’s poll, released a statement claiming that although its cloudy product was not affected, there does appear to have been some foul play:

From the findings of the initial investigation, our engineers identified some unusual data traffic targeting the TVB fun application in the operating records of the related voting system. Within the 15-minute voting period, the system already recorded unusual data traffic which was many times higher than the original expectation. This was substantially higher than the total number of people watching the program and also the total population of Hong Kong.

We therefore have grounds to suspect that the application was attacked by malicious hackers, causing abnormal disruption in the operation of the application and thus the subsequent uploading of related data to the cloud system for further processing.

The statement added that personal information stored in the system was not affected by the attack, and that TVB has appointed a third party to investigate further.

The HK Standard suggests Hong Kongers are furious at the judges’ final decision – a certain Tracy Chu Chin-suet was the hot favourite, apparently – and that punters had missed out on the chance to win a Mini Cooper.

You wouldn’t see this sort of thing happening during Strictly. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/28/hong_kong_beauty_ddos/

A Nigerian woman has been jailed for two-and-a-half years in the US after she was found responsible for playing a key role in the infamous $9m WorldPay payment card scam back in 2008.

Sonya Martin, 45, was convicted of managing a team of Chicago money mules who withdrew money from cash cards that had been loaded with looted funds. Cybercrooks had topped-up the payroll debit cards by breaking the encryption used to protect their sensitive financial data. Such cards are used by some firms to pay workers.

Hackers used compromised access to WorldPay’s systems to raise the account balance and withdrawal limits on targeted accounts before forging 44 payment cards associated with these compromised accounts. Funds were then withdrawn from these accounts in an overnight cash-out operation involving 2,100 ATMs in at least 280 cities in the US, Russia, Estonia, Italy, Hong Kong, Japan, and Canada in a coordinated operation on 8 November 2008, the FBI said.

The gang monitored the progress of the cash-out operation in real-time using WorldPay’s own computer systems before attempting (unsuccessfully) to erase their tracks. Infamous hacker Albert Gonzalez masterminded the whole scam as well as other credit card megabucks against TJ Maxx, Heartland Payments Systems and others. Gonzalez was jailed for 20 years in the spring of 2010.

The FBI said Martin managed a cash-out crew in Chicago that used counterfeit debit cards to fraudulently withdraw approximately $80,000 from various Chicago ATMs. She was arrested in March last year when she attempted to board a flight from New York to London. Martin will have to serve five years on probation after her release, as well as paying back $89,000 in restitution for her crimes.

An FBI statement on Martin’s sentencing can be found here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/28/worldpay_money_mule_mangeress_jailed/

Hacker collective Team GhostShell leaked a cache of more than one million user account records from 100 websites over the weekend.

The group, which is affiliated with hacktivists Anonymous, claimed they broke into databases maintained by banks, US government agencies and consultancy firms to leak passwords and documents. Some of the pinched data includes credit histories from banks among other files, many of which were lifted from content management systems. Some of the breached databases each contained more than 30,000 records.

An analysis of the hacks by security biz Imperva reveals that most of the breaches were pulled off using SQL injection attacks – simply tricking the servers into handing over a bit more information than they should. “Looking at the data dumps reveals the use of the tool SQLmap, one of two main SQL injection tools typically deployed by hackers,” the company’s researchers explained in a blog post.

Team GhostShell said the online leaks, which are part of its Project Hellfire campaign, were made in protest against banks and in revenge for the rounding up of hacktivists by cops and government agents.

The team said it worked with other hacking crews, MidasBank and OphiusLab, on the attacks – and claims to have accessed a Chinese technology vendor’s mainframe, a US stock exchange and the Department of Homeland Security. It plans to offer access to these compromised systems to hackers who have the chops to handle them.

In a statement, the group threatened to carry out further attacks, leak more sensitive data and generally unleash hell.

“All aboard the Smoke Flames Train, Last stop, Hell,” Team GhostShell wrote. “Two more projects are still scheduled for this fall and winter. It’s only the beginning.”

Team GhostShell is lead by self-proclaimed black hat hacker DeadMellox. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/28/team_ghostshell_megahack/

A new browser-based exploit for a Java vulnerability that allows attackers to execute arbitrary code on client systems has been spotted in the wild – and because of Oracle’s Java patch schedule, it may be some time before a fix becomes widely available.

The vulnerability is present in the Java Runtime Environment (JRE) version 1.7 or later, Atif Mushtaq of security firm FireEye reported on Sunday, while PCs with Java versions 1.6 or earlier installed are not at risk.

The vulnerability allows attackers to use a custom web page to force systems to download and run an arbitrary payload – for example, a keylogger or some other type of malware. The payload does not need to be a Java app itself.

In the form in which it was discovered, the exploit only works on Windows machines, because the payload that it downloads is a Windows executable. But the hackers behind the Metasploit penetration testing software say they have studied the exploit and found that it could just as easily be used to attack machines running Linux or Mac OS X, given the appropriate payload.

All browsers running on these systems were found to be vulnerable if they had the Java plugin installed, including Chrome, Firefox, Internet Explorer, Opera, and Safari.

Although the actual source of the exploit is not known, it was originally discovered on a server with a domain name that resolved to an IP address located in China. The malware it installed on compromised systems attempted to connect to a command-and-control server believed to be located in Singapore.

Oracle has yet to comment on the vulnerability or when users should expect a fix, but it might be a while. The database giant ordinarily observes a strict thrice-annual patch schedule for Java, and the next batch of fixes isn’t due until October 16.

Downgrading to an earlier version of Java is not advised, because even though earlier versions aren’t vulnerable to this particular exploit, they may contain other bugs that expose still other vulnerabilities.

In advance of any official patch, and because of the seriousness of the vulnerability, malware researchers at DeepEnd Research have developed an interim fix that they say seems to prevent the rogue Java code from executing its payload, although it has received little testing.

Because the patch could be used to develop new exploits if it fell into the wrong hands, however, DeepEnd Research is only making it available by individual request to systems administrators who manage large numbers of clients for companies that rely on Java.

For individual users, the researchers say, the best solution for now is to disable the Java browser plugin until Oracle issues an official patch. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/27/disable_java_to_block_exploit/

VMworld 2012 The US Air Force doesn’t let a single operator of a missile site launch a nuke all by his or her lonesome, and HyTrust, a maker of policy management and access control software for VMware virtual infrastructure, thinks IT shops should adopt the secondary approval rule for a lot of things that go on inside of the ESXi hypervisor and its vCenter management console.

“VMware has a great platform, which enables all kinds of neat stuff, but it can all be controlled by a single system admin who could take down all of the virtual infrastructure at the company either accidentally or maliciously,” says Eric Chui, founder and president of HyTrust.

And don’t think it hasn’t happened. Chui cites the case of a disgruntled former employee at Shionogi Pharmaceuticals, who was laid off from the Japanese company but had left a backdoor into the corporate network. This former employee waited a few weeks, logged in from a hotspot at a local McDonalds, and shut down and deleted 88 virtual machines running at the company. The entire virtual infrastructure had to be rebuilt from tape.

To use another metaphor, most companies typically require a second signature on any checks above $5,000, and adding secondary approval to the VMware vSphere virtualization stack, which the new HyTrust 3.0 compliance appliance does, seems sensible. In fact, it is a wonder that such capability is not already in vCenter and the ESXi hypervisor or that VMware has not already snapped up HyTrust to add its tool to the vSphere stack.

A lot of companies are trying to implement two-person approval on big changes to virtual infrastructure through company policies, but Chui says it is much easier and obviously more effective (knowing the nature of people, who make mistakes or get irrational sometimes) to automate this in software.

The HyTrust appliance itself runs inside of an ESXi virtual machine, often on the same physical box that runs the vCenter management console for ESXi, and it intercepts all inbound and outbound traffic from vCenter and creates audit reports for what people are doing as well as acting as a traffic cop, giving access control to specific VMs as well as hypervisor and console features.

The prior HyTrust 2.5 appliance had object-based and role-based access controls for virty infrastructure, and now with HyTrust 3.0, the appliance is getting secondary approval workflows to make sure no one can go rogue. HyTrust Appliance 3.0 is also getting enhancements that let it secure multi-tenant clouds by beefing up virtual network segmentation.

The update also has a new labeling scheme that wraps around VMs and their applications and resources to keep admins from one part of a cloud from gaining access to another part of a cloud where they don’t belong.

HyTrust Appliance 3.0 was developed against VMware’s new ESXi 5.1 hypervisor, but has not been certified against it yet since that code is not shipping at the moment. A couple of months after the vSphere 5.1 stack has been in the field, HyTrust will roll out official support for ESXi 5.1. At the moment, HyTrust Appliance 3.0 can run against ESX 3.5, 4.0, 4.1, and 5.0 hypervisors in either the ESXi or ESX Server editions. (ESX Server, which embedded a management console inside the hypervisor, was discontinued with the 5.0 release.)

HyTrust no longer sells hardware appliances and only offers its code inside of a VM as a software appliance. The Community Edition is a full-featured compliance and access control freak but it is limited to a maximum of three ESX host systems.

The Enterprise Edition has no host limit and costs $750 per socket for a perpetual license, on top of which you pay for annual maintenance and tech support. The HyTrust console can run independently of vCenter, but there is a plug-in if you want to invoke HyTrust from within vCenter.

Chui tells El Reg that HyTrust is looking at supporting other server virtualization hypervisors as well as public clouds that sport non-VMware hypervisors as well as custom control freakage for future releases, but has made no commitment to offer such support at this time. This stands to reason with VMware providing about half of HyTrust’s customer leads.

And a new partnership with the Virtual Computing Environment partnership between Cisco Systems and EMC similarly makes sense. “About 25 per cent of our pipeline is companies buying Vblocks,” says Chui, “and they are usually large enterprises that are trying to take the build out of plan, build, and run as they stand up clouds.”

Under the partnership with VCE, HyTrust is VCE’s only go-to-market partner for access control and compliance auditing for Vblock clouds running VMware’s ESXi hypervisor.

The HyTrust appliance knows how to integrate with Cisco’s Unified Computing System modular systems and its on-board UCS Manager control freak as well as Nexus switches (physical or virtual), ESXi hypervisors and virtual switches, and MDS switches linking out to EMC storage arrays.

Vblocks are preconfigured stacks of Cisco and EMC hardware sold and supported by the VCE collective. At the moment, HyTrust is certified to work with Vblock Series 300 and Series 700 clouds. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/27/hytrust_appliance_3_vce_partnership/

Dropbox has followed through on an earlier promise and is rolling out two-factor authentication for its Windows, Mac, and Linux users.

In July, the company pledged to the move after a bunch of its customers had their accounts hijacked and used to send vast quantities of spam for gambling websites. Dropbox blamed the security slip on a staffer reusing his work password on a website that had been hacked, and promised to beef up its security systems.

“Two-step verification adds an extra layer of protection to your account by requiring an additional security code that is sent to your phone by text message or generated using a mobile authenticator app,” it said in a Friday forum post. “We’d like to give our loyal forum viewers a chance to try it out first.”

The new setting sends a text message to mobile phones when there’s a new access to an account, or allows the use of mobile applications that support the Time-based One-Time Password (TOTP) protocol. Dropbox recommends Google Authenticator for Android, iOS, and Blackberry, or Authenticator for Windows Phone 7 users.

All this necessitates Dropbox generating a new super-strength 16-digit password string for the inevitable case of someone losing their phone. Losing both phone and the new password, however, is also likely for some clumsy users, and El Reg hopes Dropbox is going to be happy with the additional support calls – but it’s better than another embarrassing attack. Some early users are reporting teething problems on Dropbox’s forums, but overall the service roll-out looks good so far.

Two-factor authentication isn’t perfect, but it’s better than dumb passwords when it comes to locking down accounts. In the last year, Google and Facebook have been leading efforts to try and get more people on two-factor, presumably on the principle of “better late than never.”

There’s nothing new in two-factor – it’s been in use for over a decade – but it’s a source of some considerable annoyance to some in the security community that the practice has been so slow to spread. While some businesses have adopted two-factor, it’s relatively rare in the consumer space and businesses that you’d have thought would be keen – like the banking sector – have been dragging their feet.

The recent spamming attack has pushed DropBox into improving its security, a small cost to it but one which should be repaid with happier and more secure customers. Given the millions of dollars and billions of hours wasted on attacks, you’d think more companies would find a better solution. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/27/dropbox_security_two_factor/

Hacktivist cabal Anonymous has continued its attack on UK government websites in retaliation to the UK’s treatment of Julian Assange, this time hitting former Wales and Northern Ireland Secretary, Peter Hain.

Hain told the BBC he feels Anonymous’ actions resemble those he experienced in the “anti-apartheid and anti-fascist struggles.” The MP participated in South Africa’s anti-apartheid movement in the 1970s. “I have had these attacks for 40 years, mostly from racists and fascists.”

He added that Anonymous had got its targets wrong as he has been a supporter of Assange.

Hain used the attack to urge for cyber security, taking to Twitter where he wrote “after targeting of several sites in recent months latest incident is more evidence that UK needs to wake up to growing cyber security threat.” Anonymous targeted the UK’s Ministry of Justice and the Home Office last week.

Meanwhile, Ecuador’s President Rafael Correa said that the standoff regarding Assange as an “unfortunate incident over, after a grave diplomatic error by the British in which they said they would enter our embassy.”

Ecuadorian officials have been outraged at British government threats of trying to seize Assange should he stray from the Ecuadorian embassy where he has been camped for two months.

The Washington-based Organization of American States also condemned Britain’s threat with South American foreign ministers claiming Britain’s stance is unacceptable.

Correa told the UK’s Sunday Times that the sex crime allegations made against Assange would not be deemed a crime in Latin America. “The crimes that Assange is accused of, they would not be crimes in 90 to 95 per cent of the planet,” he said.

He also played the Pinochet card, questioning the British government’s contradictory approach to extradition, when it did not extradite former Chilean dictator Augusto Pinochet after his 1998 arrest in London.

Pinochet was wanted on an international arrest warrant issued by Spanish judge Baltasar Garzon, who is now featured on Assange’s legal team.

“Britain supported Augusto Pinochet unconditionally. And they let him go, they didn’t extradite him on humanitarian grounds, whereas they want to extradite Julian Assange for not using a condom, for the love of God,” Correa said. reg

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/26/ecuador_pres_slams_uk_gov/

Cybercrooks are attempting to obtain few bucks for a lame piece of Mac malware, dubbed NetWeird.

NetWeird (AKA NetWeirdRC) has been offered for sale for the princely sum of $60 through underground cyber-crime forums, according to Mac security specialist Intego. The cross-platform malware potentially affects OS X (versions 10.6 and higher), Windows, Linux and Solaris.

Like the Crisis superworm, Netweird is a commercial remote access tool. However that’s where the similarities end. Crisis – the first strain of malware capable of infecting virtual machines – is effective in both hiding itself and infecting systems, unlike Netweird.

“While OSX/Crisis is an advanced threat which hides itself reasonably well, OSX/NetWeirdRC has a number of glaring issues. Perhaps the price-tag tells us all we need to know: OSX/Crisis sells for €200,000 [$250,500], and OSX/NetWeirdRC starts at $60,” a write-up on the threat by Mac security specialists Intego explains.

Worse yet (or better yet, if you’re a target), NetWeird simply doesn’t work. “In testing, it was found that this malware is not persistent – perhaps due to a bug, it does not restart after a reboot, and will lie dormant unless it is manually restarted or removed,” Intego researcher Lysa Myers explains. “It does add itself to the login items, but this does not succeed in restarting the malware; it will only open the user’s home folder at login instead.”

Indications are that Netweird hasn’t affected Windows or *Nix machines either and it only came to light because somebody submitted a sample of the malware to VirusTotal.

An assessment of NetWeird by Paul Ducklin, Sophos’s head of technology, Asia Pacific, is even more dismissive.

“It’s not very well-written; it’s not very well-tested; it’s probably not going to catch you unawares (but watch out if you’re in a band!); and so far as we can tell, it’s not in the wild,” Ducklin concludes.

“NetWeird is interesting primarily because it is uninteresting,” he adds, explaining that “it seems that the crooks really are getting into the habit of churning out new Mac malware, not to show how clever they are, but merely to see if they can repeat the trick that’s worked on Windows for years: making money out of next to nothing.”

NetWeird is lame partly because it installs itself into the target’s home directory as an application bundle called WIFIADAPT.app.app, making its presence on compromised systems obvious. And even that functionality is buggy.

“It adds itself to your login items, presumably with the intention of loading up every time you reboot your Mac. But a bug means that it adds itself as a folder, not an application. All that happens when you log back in is that Finder pops up and displays your home directory,” Ducklin writes in a blog post on the malware.

NetWeird is designed to phone home for instructions from a hacker-controlled server, hosted in the Netherlands. It’s unclear how the malware would work, though presumably it would be part of a targeted attack and it would come with a custom dropper designed to get a user into run a file through social engineering (eg, fooling marks into thinking it was a Flash player update needed to view salacious content).

The malware is designed to snatch sensitive data (such as browser and email passwords) from compromised machines, but this is unlikely to happen, especially for users running the latest version of Apple’s operating system software.

Netweird is not from the App Store and isn’t digitally signed by an Apple-endorsed developer, so it won’t run on machines running the default security settings built into Mountain Lion, says Sophos. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/08/26/lame_mac_malware/