STE WILLIAMS

The Hi Tech Crime Investigation Unit* of Queensland’s ever-vigilant Police force will shortly spend some of its valuable time driving around Brisbane, the fair tropical state’s Capital, looking for open WiFi connections, the better to inform citizens about the terrible dangers that may flow from signal slurping.

Detective Superintendent Brian Hay said, in a statement, that the force has already spotted lots of open connections and that users who leave WiFi open “may as well put their bank account details, passwords and personal details on a billboard on the side of the highway.”

cop_speak “Unprotected or unsecured wireless networks are easy to infiltrate and hack. Criminals can then either take over the connection and commit fraud online or steal the personal details of the owner. This is definitely the next step in identity fraud,”/cop_speak he added.

If the Unit finds an open connection it will then ruthlessly insert pamphlets into letterboxes near the affected areas. Those pamphlets point readers to an online source of sensible advice on WEP versus WPA WPA2, changing administrator passwords and MAC address filtering. ®

*Queensland Police spell it “Hi” not “High”.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/03/21/queensland_war_driving/

Consumers are prepared to pay more for goods in exchange for more privacy but the difference comes down to pennies rather than pounds.

A lab study sponsored by ENISA, the European Union security agency, confronted participants with a choice of whether to buy identical goods from two online vendors, one of which offered a lower price but wanted personal details such as government-issued ID number and mobile phone number that the other more expensive vendor didn’t request.

Where the prices on offer were the same, the lab rats stayed away from the privacy-violating online retailer. However the aversion wasn’t strong and a price discount of just €0.50 (£0.42) was enough to tempt consumers into choosing the privacy-invading provider.

The experiment involved 443 people and a choice between two online cinema vendors. The cheaper chain asked users for their mobile number and permission to send them marketing messages via email. Both requested the name, email address and date of birth of prospective buyers. The study was run by researchers at the German Institute for Economic Research (DIW Berlin) and the University of Cambridge.

When prices were the same, the privacy-friendly chain established a market share of 83 per cent. Even when the privacy-busting chain offered bargain prices, a sizeable minority (29 per cent) willingly paid extra to avoid handing over their mobile phone number. This share drops to 9 per cent for those prepared to pay extra to avoid marketing emails.

The survey is one of the few of its type to date. Sören Preibusch, a member of the University of Cambridge team, said the experiment showed that privacy-friendly services were capable of attracting a healthy niche market.

“A sizeable proportion of consumers are willing to pay a higher price for privacy,” he writes. “Online businesses can capitalise these concerns. Privacy-friendliness is a win-win for online retailers and their customers.”

The lab tests were supplemented by field surveys of 2,300 participants that broadly confirmed the earlier findings.

More details on the study, entitled Monetizing Privacy: An Economic Model for Pricing Personal Information can be found here.

Consumer privacy has hit the headlines over recent weeks with concerns over the lack of transparency over privacy practices employed by many mobile application developers, but the issue is wider than that and also affects web-based services. A post on the Cambridge University’s Light Blue Touchpaper blog discussing the experiment in greater depth and discussing the concept of privacy as a currency for web-based services can be found here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/03/21/privacy_economics/

Enterprise spam filters are blocking less junk mail, according to independent tests from Virus Bulletin.

During a comparative of 20 corporate email filtering products, several missed more than twice as much spam as in previous editions of the VBSpam tests. Virus Bulletin reckons the drop in performance might be down to improved tactics by spammers rather than a dip in the capabilities in the filtering products it put through their paces.

“This is a worrying trend,” says VB’s anti-spam test director Martijn Grooten. “There have been many news stories highlighting a global decline in spam in recent months, but if spam filter performances decline too, the situation for the end-user doesn’t improve at all.”

“It is hard to say what exactly caused filters to miss more spam, but it looks like spammers are doing a better job at avoiding IP- and domain-based blacklists. It may be a sign that they are increasingly using compromised legitimate systems to send their messages,” he added.

The best performance in the March 2012 anti-spam comparative review came from Libra Esva, which blocked 99.97 per cent of all spam messages without blocking any legitimate mail, making it the only product to obtain the new ‘VBSpam+’ award.

Other products with a good spam capture rate of better than 99 per cent included Kaspersky Anti-Spam, GFI, McAfee, Symantec, Sophos and others. BitDefender caught 98.94 per cent of spam but it avoided any false positives. McAfee SaaS caught 99.93 per cent of junk mail but it binned a significant proportion of legitimate messages, 0.21 per cent (the worst performance among the tested products).

Most products still blocked more than 99 out of 100 spam emails, and no product incorrectly marked more than 1 in 470 legitimate emails as spam.

Taken in isolation such figures might be seen as pretty good, however, since both the spam-catching rates and false detection rates both got worse this month Virus Bulletin is in no mood to pop any champagne corks.

“More spam means more time wasted dealing with it, a greater chance of falling for scams, and a greater chance of accidentally deleting legitimate emails,” it notes.

Virus Bulletin has put together a chart that shows spam-catch rate against false positive mistakes. The best-performing products are those that hit the top-right quadrant of the Virus Bulletin’s graph. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/03/20/spam_filters_performance_dip/

Symantec has bought privately held mobile application management firm Nukona. Terms of the deal, announced Tuesday, were undisclosed.

The purchase, along with the earlier acquisition of mobile device management firm Odyssey Software, will allow Symantec to develop and market products that support the growing trend of allowing workers to bring their own devices to work.

Nukona’s technology offers the ability to natively protect and control iOS, Android and HTML5 apps. The software offers the ability to “protect and isolate corporate data and applications across both corporate owned and personally owned devices”, according to Symantec. ®

Bootnote

Plenty of enterprise security managers we’ve spoken to think that while synchronising calendaring and (preferably over a VPN) email access to smartphones is all fine and dandy, the idea of allowing anyone and everyone to bring tablets or home computers into worker is bonkers. But once senior execs start wanted to access corporate resources using their iPads, such concerns become secondary.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/03/20/symantec_nukona/

University College London research student Shah Mahmood and Chair of Information Communication Technology Yvo Desmedt have told a conference of what they call a “zero day privacy loophole” in Facebook.

Details of the loophole, which the pair name “Deactivated Friend Attack” was presented at the IEEE International Workshop on Security and Social Networking SESOC 2012 in Lugano, Switzerland on March 19th.

The pair say the attack works like this:

“Our deactivated friend attack occurs when an attacker adds their victim on Facebook and then deactivates her own account. As deactivation is temporary in Facebook, the attacker can reactivate her account as she pleases and repeat the process of activating and deactivating for unlimited number of times. While a friend is deactivated on Facebook, she becomes invisible. She could not be unfriended (removed from friend’s list) or added to any specific list.”

Complicating mattters is the fact that, the pair say, Facebook users aren’t told when friends de-activate or re-activate accounts.

That means trouble if the account is re-activated, as the newly-re-activated friend regains access to anything their connections have posted. Once they’ve rummaged around, they can de-activate the account again and their friends will almost certainly not know what has happened or that they’ve shared information.

The pair label this behaviour “cloaking” and cannot resist explaining it with a Star Trek metaphor, writing “Badass Blink or Jem’Hadar has to uncloak (be visible), even if only for a moment, to open fire.”

The extended abstract of the talk asserts cloaking is a problem because many Facebook users aren’t very discriminating about whom they befriend on the service. Some could therefore Friend members whose only intention is to “cloak” their accounts and then “… activate her account at the moment least likely to be detected and crawl her victims profile for information, keeping an updated record.”

That’s bad because, the pair say, “Various groups of information aggregators including marketers, background checking agencies, governments, hackers, spammers, stalkers and criminals would find this attractive as a permanent back door to the private information of a Facebook user.”

The user would never know of that information-gathering effort, unless they happened to be paying attention to the temporarily uncloaked account.

To prove the approach works, the pair say the conducted a lengthy experiment in which a dummy account acquired many friends and conducted frequent cloaking and uncloaking without attracting much attention.

The fix, the pair say, is for Facebook to notify users of de-activations and re-activations, so that odd behaviour can be spotted. Flagging of accounts that cloak is another option, as is removing re-activation features altogether. ®.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/03/20/facebook_deactivated_friend_zero_day/

China is claiming attacks on public and private organisations from outside of its borders have rocketed in the past year – from five million computers affected in 2010 to 8.9m in 2011.

State-run newspaper China Daily reported the figures from (deep breath) the government’s National Computer Network Emergency Response Technical Team and Coordination Center.

They revealed that machines behind 11,851 IP addresses from overseas took control of 10,593 Chinese websites during 2011. Other attacks involved the destruction of servers and stealing of personal data from web users in the People’s Republic.

Some 1,116 sites were defaced by overseas attackers, and just under half of those government sites, Wang Minghua, deputy director at the centre, told a news conference on Monday.

“This shows that Chinese websites still face a serious problem from being maliciously attacked by foreign hackers or IP addresses,” he is quoted as saying.

Surprisingly, Japan is alleged to be the source of most attacks on China, supposedly landing 22.8 per cent, followed by the US with 20.4 per cent and then the Republic of Korea with 7.1 per cent.

The attacks were both financially motivated and targeted at stealing sensitive information from government departments, according to the report, although tellingly there is no breakdown for each.

China has swung from being a country frequently accused of launching cyber-attacks on Western nations to one finding itself on the business end of hackers’ keyboards. Although it has been frustratingly difficult for investigators and politicians to prove, everyone from Hillary Clinton to William Hague and Google’s Eric Schmidt has pointed accusing fingers at the Asian nation as a source of malicious net traffic.

Most recently, a detailed report from US defence contractor Northrop Grumman revealed that the People’s Liberation Army is tooling up with advanced information warfare capabilities, and warned that academia and commercial technology firms are helping to provide it with significant RD resources.

However, despite the threat that Western governments believe Chinese hackers pose, it’s also likely that as China increasingly becomes an affluent web-connected nation, international cyber-criminals will look to target its web users. There are after all more than 500m users online in the People’s Republic, and almost one billion mobile subscribers, while a growing middle class is spending increasing amounts of cash online – China’s internet GDP will grow at a CAGR of over 17 per cent through to 2016, according to new research.

It would be naïve to think that the US, UK and other nations are snoozing while China-sponsored attackers target their data. The UK’s Cyber Security Strategy announced in November explained that a Cyber Defence Operations Group will be installed at the Ministry of Defence next month, for example.

Overseen by Air Marshal Sir Stuart Peach, the group will have a mission to develop “new tactics, techniques and plans to develop military cyber capabilities”.

The latest stats from the Chinese government may be slightly exaggerated but shouldn’t be dismissed out of hand. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/03/20/china_complains_hack/

US security researchers have unearthed flaws in the single sign-on (SSO) services operated by a number of portals, including Google and PayPal.

Idiosyncratic methods of integrating the APIs, SDKs and sample code supplied by identity providers are creating exploitable security shortcomings, according to a study by two researchers at Indiana University and one Microsoft researcher. In particular, the researchers said, the process of token exchange is often mangled, which creates the possibility for attackers to sign into targeted accounts without having to crack an intended victim’s password.

The study (PDF) – touted as the first field trial of popular web SSO systems – focused on implementation problems rather than fundamental flaws in the cryptographic techniques at play, which are fundamentally fine.

The exercise uncovered eight serious logic flaws in high-profile ID providers and relying party websites (which rely on authentication cookies to establish a user session). ID providers affected included OpenID (including Google ID and PayPal Access); Facebook; the JanRain platform; Freelancer; FarmVille; and Sears.com. Every one of the eight flaws allows an attacker to sign in as a targeted user.

The researchers – Shuo Chen of Microsoft Research and Rui Wang and XiaoFeng Wang, both of Indiana University, Bloomington – have contacted the sites involved, which have largely deployed a fix.

In a statement, the Open ID Foundation said it was investigating whether other less high profile websites suffered from similar security shortcomings and said it was working with these ID providers to help them get patched up.

OpenID Foundation board members have worked to identify other websites that were impacted and similarly have them deploy a fix. There are no known examples of attacks using this technique. If your website does not use an OpenID RP implementation from one of the OpenID Foundation vendors, we suggest reading the report.

OpenID and other web-based single sign-on schemes offer the promise of reducing password headaches by allowing a user who is already signed in to Google, for example, to sign into other websites. This involves exchanging identity information (tokens), a process that is often badly applied in commercial systems, as the researchers conclude.

The study shows that security-critical logic flaws pervasively exist in these systems, which can be discovered from browser-relayed messages and practically exploited by a party without access to source code or other insider knowledge of these systems.

The Microsoft/Indiana team warn that they are only scratching the surface of a problem that needs wider community support to address. To push this effort the researchers are establishing a site – http://sso-analysis.org – that will allow developers and security analysts to run checks on SSO implementations.

The researchers are due to present a paper on their research at the upcoming IEEE Symposium on Security and Privacy, which takes place between 20 and 23 May in San Francisco. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/03/20/sso_security_shortcomings/

Russian police have arrested a group of eight men suspected of making millions in electronic banking fraud using the Carberp Trojan and other strains of malware.

The men are suspected of being part of a Moscow-based gang that is targeting Russian nationals, and which has raked in 60m rubles (£1.3m) since October 2011. The scheme uses malware to steal login credentials for victims’ online banking accounts. Funds from an estimated 90 compromised accounts have been transferred to accounts under the control of the gang, prior to the withdrawal of funds from various Moscow ATMs, according to a statement by the Russian Interior Ministry (Google translation here).

The arrested suspects include two unnamed brothers, aged 29 and 32, whom Russian cops believe to be the ringleaders of the gang.

The group’s stock in trade involved planting malicious scripts on the websites of Russian newspaper and other popular sites. The scripts were used to run drive-by download attacks ultimately designed to create a credential stealing botnet.

The suspects rented an office from which they allegedly ran the scam under the guise of operating a legitimate computer firm. This office and the home of the suspects were raided by armed officers from the Russian Interior Ministry and FSB, the Russian security service. The police service said the raids had recovered computer equipment, a large number of bank cards, 7.5m rubles (£162,000) and a number of forged documents.

Suspects in the case have been charged with various offences under the Russian criminal code covering theft, computer hacking and malware distribution. The majority have been placed under house arrest pending trials, where they face charges punishable by up to 10 years behind bars if they are convicted.

Russia and the Ukraine, in particular, are seen from the outside as safe havens for cybercrime. It’s tempting to think that the suspects in the case would have been far less likely to get caught if they had not targeted Russian citizens. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/03/20/russia_carberp_suspects_arrested/

The Victorian Taxi Directorate has earned the ire of people it was trying to placate, after it put more than 400 email addresses in the “To:” field of an email it sent to ask about its complaints resolution process.

The email, sent yesterday, said “The Victorian Taxi Directorate (VTD) is committed to continually improving its customer service and complaints handling processes,” and went on to say recipients should “… be assured that your personal details have been collected and used consistent with Privacy Act 2000.”

Except for their email addresses, that is, as 432 by The Register‘s count were included in the “To:” field for all recipients to see. Some have hit “Reply All”, creating a merry little email storm that is pleasing nobody.

Angry recipients, including Register readers, have pointed out the situation and its absurdity.

The Directorate has quickly apologised for the mess, with Assistant Manager of Communications Bob Nelson saying it is “absolutely not” the organisation’s policy to share email addresses in this way.

“It was a genuine piece of human error,” he said. “They put the addresses into the wrong field instead of cc or bcc. The person who did it is feeling very regretful.”

“We sent another email getting in touch with everyone once we knew what had happened,” Nelson added. The organisation has also ‘fessed up to the Privacy Commissioner about the mess.

Emails forwarded to The Register reveal the Privacy Commissioner is already chatting to the Directorate about the incident.®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/03/20/taxi_directorate_email_mistake/

University College London research student Shah Mahmood and Chair of Information Communication Technology Yvo Desmedt have told a conference of what they call a “zero day privacy loophole” in Facebook.

Details of the loophole, which the pair name “Deactivated Friend Attack” was presented at the IEEE International Workshop on Security and Social Networking SESOC 2012 in Lugano, Switzerland on March 19th.

The pair say the attack works like this:

“Our deactivated friend attack occurs when an attacker adds their victim on Facebook and then deactivates her own account. As deactivation is temporary in Facebook, the attacker can reactivate her account as she pleases and repeat the process of activating and deactivating for unlimited number of times. While a friend is deactivated on Facebook, she becomes invisible. She could not be unfriended (removed from friend’s list) or added to any specific list.”

Complicating mattters is the fact that, the pair say, Facebook users aren’t told when friends de-activate or re-activate accounts.

That means trouble if the account is re-activated, as the newly-re-activated friend regains access to anything their connections have posted. Once they’ve rummaged around, they can de-activate the account again and their friends will almost certainly not know what has happened or that they’ve shared information.

The pair label this behaviour “cloaking” and cannot resist explaining it with a Star Trek metaphor, writing “Badass Blink or Jem’Hadar has to uncloak (be visible), even if only for a moment, to open fire.”

The extended abstract of the talk asserts cloaking is a problem because many Facebook users aren’t very discriminating about whom they befriend on the service. Some could therefore Friend members whose only intention is to “cloak” their accounts and then “… activate her account at the moment least likely to be detected and crawl her victims profile for information, keeping an updated record.”

That’s bad because, the pair say, “Various groups of information aggregators including marketers, background checking agencies, governments, hackers, spammers, stalkers and criminals would find this attractive as a permanent back door to the private information of a Facebook user.”

The user would never know of that information-gathering effort, unless they happened to be paying attention to the temporarily uncloaked account.

To prove the approach works, the pair say the conducted a lengthy experiment in which a dummy account acquired many friends and conducted frequent cloaking and uncloaking without attracting much attention.

The fix, the pair say, is for Facebook to notify users of de-activations and re-activations, so that odd behaviour can be spotted. Flagging of accounts that cloak is another option, as is removing re-activation features altogether. ®.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/03/20/facebook_deactivated_friend_zero_day/