STE WILLIAMS

Well, this was late in coming: a former Reddit mogul has joined the internet’s walk of shame.

Dan McComas, the former senior vice-president for product of Reddit and the founder and CEO of Imzy, a community-focused platform, is not feeling very good about his tenure at the platform where people go to share their fondness for everything from “Things that make you go AWW!” and “made me smile” to Nazism and “hurting animals” …among so many other fondnesses, in both the witty flow and the feculent spillage of subreddits on so, so many subjects.

New York Magazine recently interviewed McComas for a project called “The Internet Apologizes.” That project has involved interviews with more than a dozen prominent technology figures about “what has gone wrong with the contemporary internet.”

Wrong, as in, this ain’t exactly the “networked utopia” envisioned by Silicon Valley’s starry-eyed founders. Rather, as NY Mag puts it, we’ve got an advertising-dollar-craving, eyeballs-frantic beast, “a globalized strip-mall casino overrun by pop-up ads and cyberbullies and Vladimir Putin.”

Reddit is a corner store in that strip-mall. Along with 4chan, it’s the breeding ground for fake news. But no matter what new outrage drags Reddit into the headlines – be it r/jailbait, a subreddit featuring sexualized images of underage girls; the illegal sharing of nude photos stolen from celebrities; the various incarnations of the racist subreddit r/Coontown; or the more recent Deep Fakes, featuring artificial-intelligence generated fake porn that stitched people’s likenesses onto porn stars’ bodies – Reddit has had a myopic drive to amass growth, McComas says.

A drive has pushed aside nearly all concern for what actually happens within Reddit’s many communities:

From the inside, I can tell you that the board is never asking about revenue. They honestly don’t care, and they said as much. They’re only asking about growth. They believe that if they have a billion unique visitors a month, that they have a property that is going to be worth a ton of money in some way eventually. They really do look at it in that abstract way.

Anybody who’s followed Reddit’s growth will know that its rationale for permitting stomach-churning content – content that’s often veered into encouraging violence – is based on its policies about free speech.

Reddit admins say that they don’t ban communities solely for featuring controversial content. Reddit general manager Erik Martin, as quoted by the Daily Dot in 2015:

Having to stomach occasional troll [sub]reddits like /r/picsofdeadkids or morally questionable [sub]reddits like /r/jailbait are part of the price of free speech on a site like this.

Similarly, former CEO Yishan Wong has said that “distasteful” subreddits won’t be banned because Reddit as a platform should serve the ideals of free speech. The BBC quoted Wong in 2012:

If someday, in the far future, we do become a universal platform for human discourse, it would not do if in our youth, we decided to censor things simply because they were distasteful.

In internet years, we’ve arguably reached Wong’s “far future.” In the 5.5 years since he said those words, Reddit has angered some users with what they perceive as its hypocritical betrayal of its commitment to free expression – particularly with perceived censorship in the GamerGate controversy.

McComas says that behind the scenes, Reddit has refrained from banning subreddits not so much because of its commitment to free expression, but because they don’t want to freak out “volatile” users – a leeriness melted by headlines blowing up:

There are a bunch of animal-cruelty subreddits, specifically with a sexual nature, that they would always refuse to ban. The arguments were usually, ‘We don’t want to touch this because these are our most volatile users and they’ll just make things a nightmare,’ and then, ultimately, these things will bubble up, make it into the press, and then we would make a decision to change things. We would deal with the immediate impact, which was painful, would last a week or two, and then it would go away.

McComas worked at Reddit until 2015. He says that “for the most part,” Reddit is still following this pattern.

McComas says that he was privy to the discussions that made Reddit what it is today, but he was in no position to affect any of the decisions that went into that evolution.

I fundamentally believe that my time at Reddit made the world a worse place. And that sucks, and it sucks to have to say that about myself.

With that, we can put McComas into the category of the remorseful when it comes to those who’ve been instrumental in forming today’s internet. It’s getting to be quite a lengthy parade.

Facebook CEO Mark Zuckerberg, while testifying for Congress, recently listed everything his company has screwed up, from fake news, foreign meddling in the 2016 US presidential election, hate speech and data privacy.

We’ve seen ex-president of Facebook Sean Parker admit that from the get-go, the main goal has been to get and keep people’s attention, by hook, by crook or by dopamine addiction. Former vice president of Facebook user growth Chamath Palihapitiya has expressed remorse for his part.

Facebook has admitted that social media can be bad for you, Zuckerberg has said that his platform needs fixing, Apple’s Tim Cook is keeping his nephew off social media, and in February, a group of “what kind of mind-gobbling social media monster have we created?” repentants came together to form the nonprofit Center for Humane Technology (CHT). It launched a campaign to protect young minds from what they said is “the potential of digital manipulation and addiction.”

Members include former employees and advisors to Google, Facebook, and Mozilla.

McComas says that all these platforms, whose problems are causing soul-searching in the hearts of all these Silicon Valley billionaires, are in the same boat.

I think that the biggest problem that Reddit had and continues to have, and that all of the platforms, Facebook and Twitter, and Discord, now continue to have is that they’re not making decisions, is that there is absolutely no active thought going into their problems – problems that are going to exist in coming months or years – and what they can do to combat them.

Perhaps surprisingly, McComas suggests that Facebook is doing a better job of prioritizing user safety, and putting processes in place for managing content, than its peers. Twitter, however, is a mess, he says:

I think, ultimately, the problem that Reddit has is the same as Twitter and Discord. By focusing on growth and growth only and ignoring the problems, they amassed a large set of cultural norms on their platforms. Their cultural norms are different for every community, but they tend to stem from harassment or abuse or bad behavior, and they have worked themselves into a position where they’re completely defensive and they can just never catch up on the problem.

In fact, McComas doesn’t see how Twitter, or Reddit, can fix themselves. The best they can do, he said, is to “figure out how to hide this behavior from an average user.” The problems are just too ingrained, he said, both on the site, in its communities, in its users, and the public’s expectations.

I think that if you ask pretty much anybody about Reddit, they’re either not going to know what Reddit is, which is the large majority of people, or they’re going to be like, “Oh, it’s that place where there’s jailbait or something like that.” I don’t think that they’re going to be able to turn these things around.

There’s no hope for existing platforms, to McComas’s mind. As far as new platforms go, they could create better infrastructure and platforms for the public at large, but that’s not going to happen until venture capitalists rethink how companies should look as they start up and grow.

Startups have to think about the monetization, he said, as in, how can it work with users, instead of against them? They’ll need to have a product team, or community, or service team, in place that focuses on users from day one. And it’s not something that can be created in the typical 12- to 18-month horizon, McComas said. Creating a platform like Reddit, or Twitter, takes a ton of engineering, human power, marketing, PR, money and time.

It’s really hard to get a network effect going. It would take years. It’s just a really hard process that somebody needs to be in for that ride… I tried, and it just totally didn’t work… I would love to take a crack at it, but it’s ****ing hard to put these resources together.

If he could sit down with startup people right now, this is what he’d tell them, McComas said:

These things can be foreseen. Don’t be idiots about it. You’re people, you see what’s going on, you see trends that are forming, just ****ing do something. It’s not that hard. That’s my advice to founders of start-ups, just be mindful of it. Or put somebody in charge of being mindful of it.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/lZyF7Yp9SeE/

It must have seemed worth a try: within the window of time where it’s still possible to unlock a phone with a fingerprint, go to the funeral home and make use of the deceased’s finger. It’s a lot cheaper than paying some forensics outfit to crack it open, and likely quicker too. However, this most recent case was just as successful as previous attempts: as in, not at all.

According to the Tampa Bay Times, Florida police attempted to unlock the phone after they shot and killed 30-year-old Linus F. Phillip, whom they wanted to question in a drug investigation, on 23 March.

Phillip was detained at a gas station in Largo, Florida. An officer tried to search him. Phillip didn’t cooperate. Rather, he tried to drive away, which is when the officer shot him.

Lt. Randall Chaney told the Tampa Bay Times that investigators had a 48- to 72-hour window in which to unlock the phone’s fingerprint sensor. They had the phone, and once the state released the body to a funeral home, they got the chance to try out the dead man’s fingers, so that’s where they paid a visit.

It didn’t work.

That’s not surprising. Police have repeatedly tried to unlock phones with dead fingers, but if it’s ever worked, we haven’t heard about it.

It’s perhaps not surprising. We don’t know what type of phone Phillip had, but fingerprint sensors such as Apple’s Touch ID use capacitive touch, picking up on the slight electrical charge that runs through living skin in order to read a fingerprint at a sub-dermal level.

Even if the capacitance sensor was artificially triggered, Touch ID’s radio frequency only responds to living tissue.

Still and all, police have tried this before.

There are alternatives: multiple outfits that promise they can hack phones, but it doesn’t come cheap.

The most prominent name is that of Cellebrite, widely believed to be the firm that broke into the iPhone 5C belonging to dead San Bernadino terrorist and mass murderer Syed Rizwan Farook.

As The Intercept has reported, a US Drug Enforcement Administration procurement record shows that as of September 2016, Cellebrite’s premium unlocking subscription service cost $250,000 a year in the US. As of 2016, one-off hacks were selling for about $1,500 per phone.

Then too, there’s US startup GrayShift, which sells a $15,000 device called GrayKey that promises to unlock the iPhone 8 and X.

Cost isn’t the only incentive pushing police towards the use of dead people’s fingerprints. Warrants aren’t required to get a dead person’s prints, given that after death, people lose privacy interest in their own body. In other words, they have no standing in court to assert privacy rights.

The first known case of using a dead man’s fingers to try to unlock an iPhone was that of Abdul Razak Ali Artan, an 18-year-old Somali immigrant who plowed his car into a group of people on the Ohio State University campus, attacked victims with a butcher’s knife, and was shot dead by police in November 2016.

Police failed in that case: not only was Artan dead, but they were swiping his finger after the window of opportunity had closed, when the phone goes into sleep mode and requires a passcode to unlock.

Sources have told Forbes that it’s now a “relatively common” procedure to press dead people’s fingers to their phones. It’s been used in overdose cases, for example, as police have sought drug dealers.

In another case, from July 2016, police sought to make a cast from a dead man’s prints, but not from his actual fingers. They asked for 3D prints to be made from fingerprints they already had on file.

Phillip’s fiancée, Victoria Armstrong, was at the funeral home when Florida investigators swiped his fingerprints. She said she felt “disrespected and violated.”

Courts may have no problem with police swiping dead people’s fingers, but there are experts who want them to rethink the ghoulish practice. The Tampa Bay Times spoke to one, Greg Nojeim, director of the Freedom, Security and Technology Project at the Washington-base Center for Democracy and Technology, who said that the Largo detectives’ actions were “ethically unjustifiable.”

There should be some dignity in death. If I was writing the rules on this, it would be that the police would need a warrant in order to use a dead person’s finger to open up a phone, and I’d require notice to the family.

In the meantime, if you want to ensure that you can’t be compelled to use your fingerprints to unlock your phone – be you deceased or not – use a passcode instead of biometrics for authentication.

Courts have generally held that you can’t be compelled to give up your passcode because of Fifth Amendment protection against giving testimony (i.e., something you know) that could be used against you, whereas your biometrics (i.e., something you are) are pretty much up for grabs.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/BFL7zq6AHlM/

It must have seemed worth a try: within the window of time where it’s still possible to unlock a phone with a fingerprint, go to the funeral home and make use of the deceased’s finger. It’s a lot cheaper than paying some forensics outfit to crack it open, and likely quicker too. However, this most recent case was just as successful as previous attempts: as in, not at all.

According to the Tampa Bay Times, Florida police attempted to unlock the phone after they shot and killed 30-year-old Linus F. Phillip, whom they wanted to question in a drug investigation, on 23 March.

Phillip was detained at a gas station in Largo, Florida. An officer tried to search him. Phillip didn’t cooperate. Rather, he tried to drive away, which is when the officer shot him.

Lt. Randall Chaney told the Tampa Bay Times that investigators had a 48- to 72-hour window in which to unlock the phone’s fingerprint sensor. They had the phone, and once the state released the body to a funeral home, they got the chance to try out the dead man’s fingers, so that’s where they paid a visit.

It didn’t work.

That’s not surprising. Police have repeatedly tried to unlock phones with dead fingers, but if it’s ever worked, we haven’t heard about it.

It’s perhaps not surprising. We don’t know what type of phone Phillip had, but fingerprint sensors such as Apple’s Touch ID use capacitive touch, picking up on the slight electrical charge that runs through living skin in order to read a fingerprint at a sub-dermal level.

Even if the capacitance sensor was artificially triggered, Touch ID’s radio frequency only responds to living tissue.

Still and all, police have tried this before.

There are alternatives: multiple outfits that promise they can hack phones, but it doesn’t come cheap.

The most prominent name is that of Cellebrite, widely believed to be the firm that broke into the iPhone 5C belonging to dead San Bernadino terrorist and mass murderer Syed Rizwan Farook.

As The Intercept has reported, a US Drug Enforcement Administration procurement record shows that as of September 2016, Cellebrite’s premium unlocking subscription service cost $250,000 a year in the US. As of 2016, one-off hacks were selling for about $1,500 per phone.

Then too, there’s US startup GrayShift, which sells a $15,000 device called GrayKey that promises to unlock the iPhone 8 and X.

Cost isn’t the only incentive pushing police towards the use of dead people’s fingerprints. Warrants aren’t required to get a dead person’s prints, given that after death, people lose privacy interest in their own body. In other words, they have no standing in court to assert privacy rights.

The first known case of using a dead man’s fingers to try to unlock an iPhone was that of Abdul Razak Ali Artan, an 18-year-old Somali immigrant who plowed his car into a group of people on the Ohio State University campus, attacked victims with a butcher’s knife, and was shot dead by police in November 2016.

Police failed in that case: not only was Artan dead, but they were swiping his finger after the window of opportunity had closed, when the phone goes into sleep mode and requires a passcode to unlock.

Sources have told Forbes that it’s now a “relatively common” procedure to press dead people’s fingers to their phones. It’s been used in overdose cases, for example, as police have sought drug dealers.

In another case, from July 2016, police sought to make a cast from a dead man’s prints, but not from his actual fingers. They asked for 3D prints to be made from fingerprints they already had on file.

Phillip’s fiancée, Victoria Armstrong, was at the funeral home when Florida investigators swiped his fingerprints. She said she felt “disrespected and violated.”

Courts may have no problem with police swiping dead people’s fingers, but there are experts who want them to rethink the ghoulish practice. The Tampa Bay Times spoke to one, Greg Nojeim, director of the Freedom, Security and Technology Project at the Washington-base Center for Democracy and Technology, who said that the Largo detectives’ actions were “ethically unjustifiable.”

There should be some dignity in death. If I was writing the rules on this, it would be that the police would need a warrant in order to use a dead person’s finger to open up a phone, and I’d require notice to the family.

In the meantime, if you want to ensure that you can’t be compelled to use your fingerprints to unlock your phone – be you deceased or not – use a passcode instead of biometrics for authentication.

Courts have generally held that you can’t be compelled to give up your passcode because of Fifth Amendment protection against giving testimony (i.e., something you know) that could be used against you, whereas your biometrics (i.e., something you are) are pretty much up for grabs.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/BFL7zq6AHlM/

If there’s one thing security vendors love it’s a catchilly-named piece of malware to whip up fervor over, and boy is it a good day to be Symantec.

The company on Monday introduced the world to Orangeworm, a particularly nasty hacking operation that has been mainly attacking companies in the healthcare field. The operation is said to rely largely on the Kwampirs malware, a back-door trojan allowing the attackers to remotely access a machine and then spread over a local network.

The attack is believed to have been operational since at least January, 2015 and claims most of its victims (17 per cent) in the US, with additional infections spotted throughout Europe and Asia.

Researchers believe the malware is looking to get into sensitive medical information in carefully selected-targets, though they aren’t sure exactly what the ultimate aim of Orangeworm is.

Hospital injects $60,000 into crims’ coffers to cure malware infection

READ MORE

In addition to healthcare companies, Orangeworm’s Kwampirs malware has been found running on manufacturing systems and IT provider machines, though Symantec believes those infections are intended as a way to gain access to healthcare companies that would contract with health providers.

“According to Symantec telemetry, almost 40 percent of Orangeworm’s confirmed victim organizations operate within the healthcare industry,” Symantec notes.

“The Kwampirs malware was found on machines which had software installed for the use and control of high-tech imaging devices such as X-Ray and MRI machines. Additionally, Orangeworm was observed to have an interest in machines used to assist patients in completing consent forms for required procedures.”

If there is one bit of good news, it’s that Orangeworm and its Kwampirs trojan are not particularly discreet. The malware tends to perform easy-to-detect activities, such as pinging a long list of command and control systems and trying to copy itself over network shares, once infected.

This, Symantec says, could simply be a reflection on the state of IT in healthcare.

“While this method is considered somewhat old, it may still be viable for environments that run older operating systems such as Windows XP,” the company explains.

“This method has likely proved effective within the healthcare industry, which may run legacy systems on older platforms designed for the medical community. Older systems like Windows XP are much more likely to be prevalent within this industry.” ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/04/24/orangeworm_medical_malware/

If there’s one thing security vendors love it’s a catchilly-named piece of malware to whip up fervor over, and boy is it a good day to be Symantec.

The company on Monday introduced the world to Orangeworm, a particularly nasty hacking operation that has been mainly attacking companies in the healthcare field. The operation is said to rely largely on the Kwampirs malware, a back-door trojan allowing the attackers to remotely access a machine and then spread over a local network.

The attack is believed to have been operational since at least January, 2015 and claims most of its victims (17 per cent) in the US, with additional infections spotted throughout Europe and Asia.

Researchers believe the malware is looking to get into sensitive medical information in carefully selected-targets, though they aren’t sure exactly what the ultimate aim of Orangeworm is.

Hospital injects $60,000 into crims’ coffers to cure malware infection

READ MORE

In addition to healthcare companies, Orangeworm’s Kwampirs malware has been found running on manufacturing systems and IT provider machines, though Symantec believes those infections are intended as a way to gain access to healthcare companies that would contract with health providers.

“According to Symantec telemetry, almost 40 percent of Orangeworm’s confirmed victim organizations operate within the healthcare industry,” Symantec notes.

“The Kwampirs malware was found on machines which had software installed for the use and control of high-tech imaging devices such as X-Ray and MRI machines. Additionally, Orangeworm was observed to have an interest in machines used to assist patients in completing consent forms for required procedures.”

If there is one bit of good news, it’s that Orangeworm and its Kwampirs trojan are not particularly discreet. The malware tends to perform easy-to-detect activities, such as pinging a long list of command and control systems and trying to copy itself over network shares, once infected.

This, Symantec says, could simply be a reflection on the state of IT in healthcare.

“While this method is considered somewhat old, it may still be viable for environments that run older operating systems such as Windows XP,” the company explains.

“This method has likely proved effective within the healthcare industry, which may run legacy systems on older platforms designed for the medical community. Older systems like Windows XP are much more likely to be prevalent within this industry.” ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/04/24/orangeworm_medical_malware/

Banks could plug their security vulnerabilities by simply improving password protections, the deputy CEO of the Prudential Regulation Authority has told the House of Lords.

Asked by the Joint Committee for the National Security Strategy what kept him awake at night, Lyndon Nelson named shared infrastructure and software systems as his number-one concern. He said if those systems were attacked, it could affect numerous companies.

“In reality, however, and our testing [has shown this]: basic systems and controls are to a large extent the source of many of the vulnerabilities. So if firms were to improve their password controls… we would see a large proportion of these vulnerabilities reduced quite significantly.”

Nelson identified large banks, payments systems and the Bank of England as coming under the definition of critical national infrastructure.

He said during the “Cyber Security: Critical National Infrastructure” session: “They are very much subject to higher levels of scrutiny, they are the ones where we have carried out the first phase of penetration testing.”

Under a government crackdown, national critical infrastructure companies could be liable for a £17m fine if they are found to have inadequately protected themselves from cyber attacks.

In addition, last week the National Cyber Security Centre (NCSC) and the Federal Bureau of Investigation warned that Russian state-sponsored cyber actors are targeting network infrastructure.

The joint Technical Alert (put out by the US’s Dept of Homeland Security, the FBI and UK’s NCSC) described a global assault on routers, switches, firewalls, and network intrusion detection hardware.

Steve Ungar, chief technology officer at regulator Ofcom, told peers the two main areas of risk facing telecoms suppliers emanated from China and Russia.

“The first is about the supply chain risk, the concern that UK networks may contain components that are supplied by companies that may not be trusted. That concern is a long-standing concern particularly in relation to China.

“Historically, the main concern is in relation to Huawei, more recently it’s been around ZTE as a potentially untrusted supplier.

“The other set of concerns … is the risk that some unfriendly state might use existing known vulnerabilities in networks to attack our infrastructure with the aim of taking out elements of critical national infrastructure, particularly in relation to Russia.”

He said Huawei was regarded as a potential risk by the NCSC because of the possibility of Chinese government control. Although he added that in Huawei’s case mitigations have been put in place such as the cybersecurity evaluation centre.

For ZTE the ownership is more direct by the Chinese government, he said. “But it’s also about [the] supply chain … the fact the US government is not allowing ZTE to use US components. And that creates a concern of how [ZTE] systems can be maintained.” ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/04/24/national_security_strategy_committee_on_critical_infrastructure/

Banks could plug their security vulnerabilities by simply improving password protections, the deputy CEO of the Prudential Regulation Authority has told the House of Lords.

Asked by the Joint Committee for the National Security Strategy what kept him awake at night, Lyndon Nelson named shared infrastructure and software systems as his number-one concern. He said if those systems were attacked, it could affect numerous companies.

“In reality, however, and our testing [has shown this]: basic systems and controls are to a large extent the source of many of the vulnerabilities. So if firms were to improve their password controls… we would see a large proportion of these vulnerabilities reduced quite significantly.”

Nelson identified large banks, payments systems and the Bank of England as coming under the definition of critical national infrastructure.

He said during the “Cyber Security: Critical National Infrastructure” session: “They are very much subject to higher levels of scrutiny, they are the ones where we have carried out the first phase of penetration testing.”

Under a government crackdown, national critical infrastructure companies could be liable for a £17m fine if they are found to have inadequately protected themselves from cyber attacks.

In addition, last week the National Cyber Security Centre (NCSC) and the Federal Bureau of Investigation warned that Russian state-sponsored cyber actors are targeting network infrastructure.

The joint Technical Alert (put out by the US’s Dept of Homeland Security, the FBI and UK’s NCSC) described a global assault on routers, switches, firewalls, and network intrusion detection hardware.

Steve Ungar, chief technology officer at regulator Ofcom, told peers the two main areas of risk facing telecoms suppliers emanated from China and Russia.

“The first is about the supply chain risk, the concern that UK networks may contain components that are supplied by companies that may not be trusted. That concern is a long-standing concern particularly in relation to China.

“Historically, the main concern is in relation to Huawei, more recently it’s been around ZTE as a potentially untrusted supplier.

“The other set of concerns … is the risk that some unfriendly state might use existing known vulnerabilities in networks to attack our infrastructure with the aim of taking out elements of critical national infrastructure, particularly in relation to Russia.”

He said Huawei was regarded as a potential risk by the NCSC because of the possibility of Chinese government control. Although he added that in Huawei’s case mitigations have been put in place such as the cybersecurity evaluation centre.

For ZTE the ownership is more direct by the Chinese government, he said. “But it’s also about [the] supply chain … the fact the US government is not allowing ZTE to use US components. And that creates a concern of how [ZTE] systems can be maintained.” ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/04/24/national_security_strategy_committee_on_critical_infrastructure/

There’s a good chance your company has projects on the source code management system, but the casual way many developers use GitHub creates security issues.

Security operations teams are plenty busy dealing with malware, phishing, and distributed denial-of-service attacks. But there’s an area of IT that many SecOps teams haven’t been able to sufficiently monitor, despite the risk of data breaches, loss of competitive advantage, and loss of reputation.

What’s this unnoticed vulnerability?

It’s GitHub, the hugely popular source code management system. Companies and individuals use GitHub to store and manage source code and to keep software development projects running on time. Packed with useful features and featuring a user-friendly interface, GitHub has become the largest source code repository in the world. It now stores over 80 million source code repositories. It’s used by Facebook, Google, and Microsoft for some of those companies’ most important software projects.

GitHub is clearly a success story. Why should SecOps teams care?

That’s because, given GitHub’s popularity, there’s a good chance their company’s development team has at least some projects stored in GitHub. And they should care because it’s become obvious in the past couple of years that the casual way some developers use GitHub creates serious security risks. These risks exist even if developers are following best practices such as running source code analysis tools like Fortify to identify any security vulnerabilities in the source code being checked in.

Casual security practices are risky enough. They become riskier when hackers have a strong incentive to target the casually managed system.

Why Hackers Target GitHub
Hackers like GitHub for several reasons.

1. Source code. The software stored in GitHub is valuable intellectual property. Copying the code may enable other companies or even nation-states to quickly develop derivative applications, saving years or even decades of development time and leveraging trade secrets without paying licensing fees. Hackers might also steal code to resell it on the Dark Web.
2. Attack vectors. The source code might provide hackers with insights into how to attack software running in production. Stealing source code gives them time to search for vulnerabilities that might be much more difficult to discover through penetrations. They can even run code in production and test attacks against it, refining attacks for speed, stealth, and effectiveness.
3. Login credentials. Code and supporting files checked into GitHub sometimes inadvertently contain login credentials for other services, such as Amazon Web Services. When hackers gain access to the code, they can gain access to related services, giving them the opportunity to steal more data and disrupt operations.
4. Unauthorized access. Often, developers are granted access to company repositories from their personal email accounts. These accounts are left vulnerable, especially after developers leave. Additionally, often developers are granted access to all of the company’s repositories instead of just what they need, creating a wide-open attack surface.
5. Insider threats. A lack of proactive monitoring can allow malicious insiders to easily hide abnormal activities. A single developer accessing tens of repositories could be an early indicator of insider threat, and such behavior should be detected and flagged. 

Login credentials were part of the haul in a 2016 data breach when hackers penetrated Uber’s source code repository on GitHub. Attackers not only gained access to cutting-edge intellectual property; they also came across AWS credentials that yielded personal data of about 7 million Uber drivers and 50 million customers. That personal data included names, addresses, driver’s license numbers, and more. 

Threat Monitoring for Github
Fortunately, there are some practical steps that SecOps teams can follow to tighten the security of their organization’s GitHub repositories. Here’s a list:

1. Clean up login credentials. Remind developers that they should be careful with their GitHub login credentials. Limit access only to those developers who need to be involved in a project. When developers leave a project, their credentials should be revoked.
2. Double-check repository settings. The software behind GitHub, the software version control program Git, was originally developed for managing development of the Linux kernel. Both Git and GitHub are widely used in open source projects. Some developers, particularly those used to contribute to open source projects, treat all GitHub repositories as public, whether they’re open source projects or not. Double-check your organization’s GitHub configuration to ensure that access isn’t any broader than it needed.
3. Don’t mix secrets with public code. Remind developers to be careful about including login credentials and other highly sensitive information in code, GitHub wikis, or other GitHub content accessible to outsiders. Since the Uber breach, GitHub has urged developers to be careful about this, but a periodic reminder from the SecOps team never hurts.
4. Monitor GitHub for suspicious activity. What sort of activity merits suspicion? A sudden spike in source code check-ins, enabling someone to check out an unusually large amount of source code. Also watch for logins from unusual locations or logins or requests from users outside the organization.
5. Collect GitHub logs. The best way to continuously monitor GitHub is to collect logs of GitHub data for your organization’s repositories. If you’re not collecting GitHub logs now, start.
6. Perform a baseline security assessment of GitHub activity. Tools are available for analyzing activity reported in GitHub logs, so that you can define a baseline of normal activity that will make it easier for you to spot anomalies in the future.
7. Automate the monitoring of GitHub logs. You’ll want to monitor GitHub activity routinely to ensure that your organization’s source code is secure and that outsiders aren’t trying to infiltrate your repositories. You may be able to write scripts to perform this automation, or you can seek out a pre-built automated solution.

Software code is likely one of your organization’s most valuable assets. Make GitHub part of your SecOps team’s routine threat-hunting work, and you’ll safeguard not only that valuable asset but also your organization’s reputation and competitive edge.

Related Content:

• 8 Nation-State Hacking Groups to Watch in 2018
• GitHub Among Victims of Massive DDoS Attack Wave
• Uber’s Security Slip-ups: What Went Wrong

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop ITX 2018 agenda here. Register with Promo Code DR200 and save $200.

Kumar Saurabh is the CEO and co-founder of security intelligence automation platform LogicHub. Kumar has 15 years of experience in the enterprise security and log management space leading product development efforts at ArcSight and SumoLogic, which he left to co-found LogicHub. View Full Bio

Article source: https://www.darkreading.com/application-security/its-time-to-take-github-threats-seriously/a/d-id/1331577?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

There’s a good chance your company has projects on the source code management system, but the casual way many developers use GitHub creates security issues.

Security operations teams are plenty busy dealing with malware, phishing, and distributed denial-of-service attacks. But there’s an area of IT that many SecOps teams haven’t been able to sufficiently monitor, despite the risk of data breaches, loss of competitive advantage, and loss of reputation.

What’s this unnoticed vulnerability?

It’s GitHub, the hugely popular source code management system. Companies and individuals use GitHub to store and manage source code and to keep software development projects running on time. Packed with useful features and featuring a user-friendly interface, GitHub has become the largest source code repository in the world. It now stores over 80 million source code repositories. It’s used by Facebook, Google, and Microsoft for some of those companies’ most important software projects.

GitHub is clearly a success story. Why should SecOps teams care?

That’s because, given GitHub’s popularity, there’s a good chance their company’s development team has at least some projects stored in GitHub. And they should care because it’s become obvious in the past couple of years that the casual way some developers use GitHub creates serious security risks. These risks exist even if developers are following best practices such as running source code analysis tools like Fortify to identify any security vulnerabilities in the source code being checked in.

Casual security practices are risky enough. They become riskier when hackers have a strong incentive to target the casually managed system.

Why Hackers Target GitHub
Hackers like GitHub for several reasons.

1. Source code. The software stored in GitHub is valuable intellectual property. Copying the code may enable other companies or even nation-states to quickly develop derivative applications, saving years or even decades of development time and leveraging trade secrets without paying licensing fees. Hackers might also steal code to resell it on the Dark Web.
2. Attack vectors. The source code might provide hackers with insights into how to attack software running in production. Stealing source code gives them time to search for vulnerabilities that might be much more difficult to discover through penetrations. They can even run code in production and test attacks against it, refining attacks for speed, stealth, and effectiveness.
3. Login credentials. Code and supporting files checked into GitHub sometimes inadvertently contain login credentials for other services, such as Amazon Web Services. When hackers gain access to the code, they can gain access to related services, giving them the opportunity to steal more data and disrupt operations.
4. Unauthorized access. Often, developers are granted access to company repositories from their personal email accounts. These accounts are left vulnerable, especially after developers leave. Additionally, often developers are granted access to all of the company’s repositories instead of just what they need, creating a wide-open attack surface.
5. Insider threats. A lack of proactive monitoring can allow malicious insiders to easily hide abnormal activities. A single developer accessing tens of repositories could be an early indicator of insider threat, and such behavior should be detected and flagged. 

Login credentials were part of the haul in a 2016 data breach when hackers penetrated Uber’s source code repository on GitHub. Attackers not only gained access to cutting-edge intellectual property; they also came across AWS credentials that yielded personal data of about 7 million Uber drivers and 50 million customers. That personal data included names, addresses, driver’s license numbers, and more. 

Threat Monitoring for Github
Fortunately, there are some practical steps that SecOps teams can follow to tighten the security of their organization’s GitHub repositories. Here’s a list:

1. Clean up login credentials. Remind developers that they should be careful with their GitHub login credentials. Limit access only to those developers who need to be involved in a project. When developers leave a project, their credentials should be revoked.
2. Double-check repository settings. The software behind GitHub, the software version control program Git, was originally developed for managing development of the Linux kernel. Both Git and GitHub are widely used in open source projects. Some developers, particularly those used to contribute to open source projects, treat all GitHub repositories as public, whether they’re open source projects or not. Double-check your organization’s GitHub configuration to ensure that access isn’t any broader than it needed.
3. Don’t mix secrets with public code. Remind developers to be careful about including login credentials and other highly sensitive information in code, GitHub wikis, or other GitHub content accessible to outsiders. Since the Uber breach, GitHub has urged developers to be careful about this, but a periodic reminder from the SecOps team never hurts.
4. Monitor GitHub for suspicious activity. What sort of activity merits suspicion? A sudden spike in source code check-ins, enabling someone to check out an unusually large amount of source code. Also watch for logins from unusual locations or logins or requests from users outside the organization.
5. Collect GitHub logs. The best way to continuously monitor GitHub is to collect logs of GitHub data for your organization’s repositories. If you’re not collecting GitHub logs now, start.
6. Perform a baseline security assessment of GitHub activity. Tools are available for analyzing activity reported in GitHub logs, so that you can define a baseline of normal activity that will make it easier for you to spot anomalies in the future.
7. Automate the monitoring of GitHub logs. You’ll want to monitor GitHub activity routinely to ensure that your organization’s source code is secure and that outsiders aren’t trying to infiltrate your repositories. You may be able to write scripts to perform this automation, or you can seek out a pre-built automated solution.

Software code is likely one of your organization’s most valuable assets. Make GitHub part of your SecOps team’s routine threat-hunting work, and you’ll safeguard not only that valuable asset but also your organization’s reputation and competitive edge.

Related Content:

• 8 Nation-State Hacking Groups to Watch in 2018
• GitHub Among Victims of Massive DDoS Attack Wave
• Uber’s Security Slip-ups: What Went Wrong

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop ITX 2018 agenda here. Register with Promo Code DR200 and save $200.

Kumar Saurabh is the CEO and co-founder of security intelligence automation platform LogicHub. Kumar has 15 years of experience in the enterprise security and log management space leading product development efforts at ArcSight and SumoLogic, which he left to co-found LogicHub. View Full Bio

Article source: https://www.darkreading.com/application-security/its-time-to-take-github-threats-seriously/a/d-id/1331577?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

New malware variant goes after login credentials for popular Facebook pages.

Malware posing as a stress-relieving application has added to the stress of tens of thousands of Facebook users. And while this campaign appears to now have gone dormant, signs point to the possibility of more of this stress-related malware to come in the future.

Researchers at Radware found the malware, called Stresspaint, targeting the user credentials of Facebook users.

“We saw some indicators of information being stolen from a machine and while doing that we found an interesting command and control mechanism,” says Adi Raff, security research team lead at Radware.

The threat actors weren’t looking for just any Facebook users, either. “They were generally looking for Facebook accounts controlling a Facebook page or that had a payment method associated with them,” says Raff. They also were looking for “pages with a lot of followers,” he says.

Stresspoint gets delivered either via email or Facebook message. The link portends to be for a legitimate stress-relieving art program called “Relieve Stress Paint” to be downloaded from a legitimate website, AOL.com. In reality, the link is to a Unicode site that appears to be AOL, but in actuality leads to user to a malicious app store.

Once downloaded, a paint program runs on the user machine. While it is running, though, malware is sorting through the user’s data looking for saved Facebook credentials or login cookies. Once found, the data is exfiltrated to the CC server, which is based on an open source Chinese CMS named Layuicms2.0.

Since the malware doesn’t look for general user credentials or other data, there are many security programs that won’t trigger on its behavior, allowing it to fly under the radar on some user systems. During the initial infection period, approximately 10,000 systems per day were infected, a number that puts this on par with successful botnet campaigns. 

Raff says that there are indications that the group responsible for the Stresspaint malware is more than a collection of script kiddies. “Just a few hours before we pushed the information we saw a variant, [so] it could be a work in progress,” Raff says. “Being able to infect so many machines in a short time takes skill — this was not the first time these people did it. They knew what they were doing.” 

Once Radware published initial results of their research, the attackers took notice. “When we released the blog about it, [the threat actors] saw it and the infection rate went down. A few hours later, the CC server went down,” Raff says.

Even so, Raff says the server could easily be re-established. That, and a section in the CC CMS dedicated to Amazon, leads Raff and the research team to believe that the group has more plans for both the network and the malware.

Nothing in the Stresspaint campaign is so novel as to require new technology or methods to avoid infection. The researchers counsel user training, link awareness (including Unicode visibility) and two-factor authentication as basic web hygiene steps that will significantly reduce the chance of additional stress from Stresspaint infection.

Related Content:

• Cybercrime Economy Generates $1.5 Trillion a Year
• Researchers Discover Second rTorrent Vulnerability Campaign
• New Malware Adds RAT to a Persistent Loader
• New Email Campaign Employs Malicious URLs

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/stresspaint-targets-facebook-credentials/d/d-id/1331626?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple