Wednesday, November 23, 2011

Hackers attack Norway's oil, gas and defence businesses - BBC News

18 November 2011 Last updated at 06:24 ET Industrial drawing Contracts, industrial drawings and logins were all stolen in the attacks Oil, gas and defence firms in Norway have been hit by a series of sophisticated hack attacks.

Industrial secrets and information about contract negotiations had been stolen, said Norway's National Security Agency (NSM).

It said 10 firms, and perhaps many more, had been targeted in the biggest wave of attacks to hit the country.

Norway is the latest in a growing list of nations that have lost secrets and intellectual property to cyber thieves.

The attackers won access to corporate networks using customised emails with viruses attached which did not trigger anti-malware detection systems.

Targeted attacks

The NSM said the email messages had been sent to specific named individuals in the target firms and had been carefully crafted to look like they had come from legitimate sources.

Many of the virus-laden emails were sent while the companies were in the middle of negotiations over big contracts.

It said user names, passwords, industrial drawings, contracts and documents had been stolen and taken out of the country.

The NSM believes the attacks are the work of one group, based on its analysis of the methods used to target individuals, code inside the viruses and how the data was extracted.

The agency said it was publishing information about the attacks to serve as a warning and to encourage other targeted firms to come forward.

"This is the first time Norway has revealed extensive and wide computer espionage attacks," the NSM said in a statement.

Singled out

It said it found out about the attacks when "vigilant users" told internal IT security staff, who then informed the agency.

However, the NSM said, it was likely that many of the companies that had been hit did not know that hackers had penetrated their systems and stolen documents.

Security firms report that many other nations and industrial sectors have been targeted by data thieves in recent months.

The chemical industry, hi-tech firms and utilities appear to have been singled out.


View the original article here

Hacking threats that lurk within the Web - The National

Tony Glover

$(document).ready(function() {$.get('/national/overrides/ajax/article_detail_date.jsp', {'vcmid':'b80ae98dafbb3310VgnVCM200000e66411acRCRD'}, function(data) { $("#article_date").html(data);});});

Companies around the world are facing a rapidly mounting assault in the form of industrial espionage conducted over the internet. UAE companies are identified as being particularly at risk.

Industry Insights e-newsletter Stay ahead of the pack and get the pick of the premium Business content straight to your inbox. Sign up

The problem has gained new attention after a US national counterintelligence executive (NCE) report warning of the growing risk of corporate computer hacking emanating from Russia and China. The report went beyond previous US official assessments of the scale of the problem to assert that hackers and illicit programmers in China and Russia are pursuing US technology and industrial secrets, jeopardising an estimated US$398 billion (Dh1.46 trillion) of US research. The most heavily targeted areas include pharmaceuticals, information technology, military equipment and advanced materials and manufacturing processes.

But security analysts believe that the problem could be even more widespread in the UAE, where hacking is over four times more common than in the US. According to the cyber security firm Sophos, hackers targeting the UAE are using a broad selection of tools to attack local organisations. These range from the casual insertion of a USB memory stick into any unattended PC or laptop to sophisticated computer worms and viruses transmitted via the internet.

According to research carried out by Sophos on a 10,000-strong test group in the UAE, hacking software, known as malware, was detected on 31 per cent of systems. This contrasts with only 7 per cent in the US and 6 per cent in the UK.

"The most common threats blocked in UAE is Autoinf - 10.42 per cent of detections - and this is usually associated with malware spreading via USB keys," says Mark Harris, the vice president of SophosLabs.

He adds that the computer worm Conflicker accounts for 8.9 per cent of UAE hacks and that commonplace viruses such as Sality (3.65 per cent of detections) and Palevo (3.62 per cent) are also a threat.

The risk consultancy firm Kroll also believes that the threat may be far wider than that identified by the US NCE report.

"The report indicated that there were a number of nations who had the capability to conduct large-scale cyberattacks," says Alan Brill, the senior managing director of Kroll's cyber security and information assurance practice. "In addition, there have been cases of hacking groups with similar capabilities to infiltrate networks and steal important information over extended time periods.

"The technology that they use has become more commonly available with time, increasing the population of potential adversaries. We've seen individuals - such as disgruntled employees with access to intellectual property - steal it where no government or hacker group is involved. So you protect the property against all forms of threat, regardless of the source of the threat."

Organisations in the UAE must therefore take steps not only to safeguard their IT systems from hackers based in other countries, but also from disloyal or discontented staff carrying USB sticks.

The introduction of corporate information technologies such as remote computing, known as the "cloud", whereby company information is stored by third parties, and the increasing use of smartphones also present a growing threat.

"Both cloud computing and the advent of mobile devices like smartphones and tablets have complicated the issue … It isn't always clear where services in the cloud actually store and process your data," Mr Brill says. "The use of smartphones, tablets and mobile devices of all kinds has also become a real issue. How do you secure these devices? Who controls them? Can you limit the devices to those provided by the company, which have the security features and software selected by the company, or can employees utilise a personal device?"

Security experts also believe that the speed of innovation is a danger for companies when employees use IT extensively not only in their work lives but also for personal reasons.

"Companies need to view security as a whole, and it is only as strong as its weakest link," Mr Harris says. "So, for example, if a user decides to share a company confidential document in the cloud, but uses the same password as for their gmail account, and that password gets compromised, they've effectively lost the data."

But although companies must be aware of the scale of the cyberhacking threat, it is also important to avoid developing a culture of paranoiain which access to IT is guarded to such an extent that efficiency is threatened.

"For a UAE-based company, I think they have to do a careful assessment of their intellectual property to see how important and desirable to others it is, and then take appropriate steps to safeguard it," Mr Brill says. "Not everything has to be locked away in a vault. It has to be reasonably usable, but you need to identify and implement the right level of control to both safeguard the information and have a way to know if it is being attacked."

business@thenational.ae


View the original article here

Foreign hackers targeted US water plant in apparent malicious cyber attack ... - Washington Post (blog)

Foreign hackers caused a pump at an Illinois water plant to fail last week, according to a preliminary state report. Experts said the cyber-attack, if confirmed, would be the first known to have damaged one of the systems that supply Americans with water, electricity and other essentials of modern life.

Companies and government agencies that rely on the Internet have for years been routine targets of hackers, but most incidents have resulted from attempts to steal information or interrupt the functioning of Web sites. The incident in Springfield, Ill., would mark a departure because it apparently caused physical destruction.

Federal officials confirmed that the FBI and the Department of Homeland Security were investigating damage to the water plant but cautioned against concluding that it was necessarily a cyber-attack before all the facts could be learned. “At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety,” said DHS spokesman Peter Boogaard.

News of the incident became public after Joe Weiss, an industry security expert, obtained a report dated Nov. 10 and collected by an Illinois state intelligence center that monitors security threats. The original source of the information was unknown and impossible to immediately verify.

The report, which Weiss read to The Washington Post, describes how a series of minor glitches with a water pump gradually escalated to the point where the pump motor was being turned on and off frequently. It soon burned out, according to the report.

The report blamed the damage on the actions of somebody using a computer registered to an Internet address in Russia. “It is believed that hackers had acquired unauthorized access to the software company’s database” and used this information to penetrate the control system for the water pump.

Experts cautioned that it is difficult to trace the origin of a cyber-attack, and that false addresses often are used to confuse investigations. Yet they also agreed that the incident was a major new development in cyber-security.

“This is a big deal,” said Weiss. “It was tracked to Russia. It has been in the system for at least two to three months. It has caused damage. We don’t know how many other utilities are currently compromised.”

Dave Marcus, director of security research for McAfee Labs, said that the computers that control critical systems in the United States are vulnerable to attacks that come through the Internet, and few operators of these systems know how to detect or defeat these threats. “So many are ill-prepared for cyber-attacks,” Marcus said.

The Illinois report said that hackers broke into a software company’s database and retrieved user names and passwords of control systems that run water plant computer equipment. Using that data, they were able to hack into the plant in Illinois, Weiss said.

Senior U.S. officials have recently raised warnings about the risk of destructive cyber-attacks on critical infrastructure. One of the few documented cases of such an attack resulted from a virus, Stuxnet, that caused centrifuges in an Iranian uranium enrichment facility to spin out of control last year. Many computer security experts have speculated that Stuxnet was created by Israel — perhaps with U.S. help — as a way to check Iran’s nuclear program.

More cybersecurity coverage

- Proactive steps against cyberattacks

- Pentagon: Offensive cyber attacks fair game

- Cyberspying report names China, Russia

- In cyberspace, growing calls for clarity on what U.S. can do to deter against attacks


View the original article here

Hackers modify iPhone 4S to run on T-Mobile - msnbc.com

If you want an iPhone 4S but don't want to give up your T-Mobile contract and switch to Verizon, AT&T or Sprint, you're not entirely out of luck. All you have to do is follow two hackers' directions.

On Pastebin and in a YouTube video, hackers Michael Capozzi and Daniel Scaleb posted step-by-step instructions showing how to hack an iPhone 4S and make it compatible with T-Mobile, the major U.S. carrier that doesn't support the Apple smartphone.

The modification requires a user to insert the original AT&T SIM card, dial 611 for customer service and then drop the call. The next step involves turning on "Airplane" mode, removing the legitimate SIM card and inserting a T-Mobile SIM card.

Scaleb writes on Pastebin that the next step is to switch off "Airplane" mode, which will cause the iPhone to search for a network. The EDGE network will activate automatically, after which the user should turn off the phone after 20 to 30 seconds, turn it on again, and tap "Use Cellular Connection" when the "Activation Required" screen pops up.

From there, ejecting the SIM card and reinserting it should unlock the phone and make it compatible with T-Mobile's network.

The modification seems simple enough, but tech site Gizmodo, which was among the first sites to report it, said it has received conflicting reports about whether or not the unlocking trick works.

If you want to avoid the hack and get a T-Mobile-compatible iPhone 4S, there's another way: as of last week, unlocked GSM iPhone 4S smartphones are available for $650.

© 2011 SecurityNewsDaily. All rights reserved


View the original article here

Chinese hackers took control of NASA satellite for 11 minutes - Geek.com

Chinese hackers took control of NASA satellite for 11 minutes | Geek.com .wp-polls .pollbar {margin: 1px;font-size: 6px;line-height: 8px;height: 8px;background-image: url('http://www.geek.com/wp-content/plugins/wp-polls/images/default/pollbg.gif');border: 1px solid #c8c8c8;}  HomeGeek.com Home AppleApple Reviews GadgetsGadget Reviews MobileMobile Phone Reviews GamesVideo Game Reviews ChipsComputer Processors Technology ForumsForumsTechnology Forums Technology ShopShopTechnology Shop Tech Support Chips Apple Mobile Games Gadgets Software The Lounge Geek.com Stuff Cameras Cell Phones Computers Electronics Laptops Memory Monitors PDAs Software Storage Devices Video Games All Products Search: All Articles Products Glossary Forums Username: Password: Cancel Forgot Username / Password? Back to Geek-Cetera Print Chinese hackers took control of NASA satellite for 11 minutes Nov. 19, 2011 (11:05 am) By: Matthew Humphries


Landsat-7 and Terra EOS satellites

Hacking is becoming a growing problem on Earth. It may seem strange to mention Earth, as there’s not much to hack outside of our planet’s atmosphere unless you count satellites. Even then, how feasible would it be to gain access to the systems running such devices?

Well, China not only has people working on such things, it has been discovered they actually managed to take control of two NASA satellites for more than 11 minutes.

The successful attacks occurred in 2007 and 2008. The more serious of the two happened in ’08 when NASA had control of the Terra EOS earth observation system satellite disrupted for 2 minutes in June, and then a further 9 minutes in October. During that time, whoever took control had full access to the satellites’ systems, but chose to do nothing with it.

The second hack affected the Landsat-7 satellite on two occasions, one in October of ’07, the other in July of ’08. Unlike the Terra OS incident, this hack did not see control taken away, but access was gained.


Washington D.C. captured by Landsat-7 in 2005

We only know about these hacks because of a report becoming available this month. It is entitled the 2011 Report to Congress of the U.S.-China Economic and Security Review Commission and made available online at the USCC website (link below). The specific details can be found on page 216 of the document, which is actually page 224 of the PDF.

It is suggested such malicious cyber activity in relation to satellites can be carried out to either destroy the system rendering it useless, or to exploit it to see what the “enemy” sees and gain intelligence on “ground-based infrastructure.”

Interestingly, the report points to the use of ground stations outside of the U.S. to control satellites as weak points. The reason being they use the Internet for data access and communication, not a closed link. We don’t know if that is still the case, but we’d hope not, or at least hope that the communication link is using better encryption and security checks.

Read the report online at the USCC website (PDF), via ITWorld

Tags: 2007, 2008, 2011 Report to Congress of the U.S.-China Economic and Security Review Commission, China, control, hack, hacking, internet, Landsat-7, NASA, satellite, Terra EOS DiggDigg redditReddit FacebookFacebook StumbleUponStumble TwitterTwitter Email To Email Address:
To Name:
Your Name:
Your Email Address

Popular Geek Pick Articles Chinese hackers took control of NASA satellite for 11 minutes Pure Google? Verizon sneaks two bloatware apps onto the Galaxy Nexus Analyst predicts Amazon smartphone in 2012 Kindle Fire hacked to access Android Market Google and Facebook, it’s time to take the kid gloves off about SOPA Geek Pick Archives November 2011October 2011September 2011August 2011July 2011June 2011May 2011April 2011March 2011February 2011January 2011December 2010November 2010October 2010September 2010August 2010July 2010June 2010 Search: All Articles Products Glossary Forums Previous
World’s first Galaxy Nexus owner finds developer ROM on his phone
Is George Clooney being considered for the role of Steve Jobs?
Kindle Fire hacked to access Android Market
Google’s Nyan cat obsession spills onto Google+
Analyst predicts Amazon smartphone in 2012
Google Music exits beta, Music Store coming to Android Market
Google and Facebook, it’s time to take the kid gloves off about SOPA
Chinese hackers took control of NASA satellite for 11 minutes
FXI Cotton Candy is an ARM PC in a USB stick
Pure Google? Verizon sneaks two bloatware apps onto the Galaxy Nexus Next Recent Geek Pick Activity Popular Article CommentsForum Talk artyiom

there are many ideas a man can think but if he thinks it twice he thought about another idea which makes his idea non...

Posted In: Geek.com Stuff Read More » ExpertOnCoolers

The break in the case came when investigators focused on a grainy surveillance video that showed the boy, wearing his...

Posted In: Geek.com Stuff Read More » davidross

One of the most attracting features of Mac OSX Lion is auto save for documents. And Autosave would not save the modi...

Posted In: Apple Read More » View All Forum Talk » Prachi Desai

I am a big fab of Windows. Windows 8 Developer Edition is now available for download, I have installed it on PC. I must ...

Posted In: Download a preview build of Windows 8 tonight Prachi Desai

I am a big fab of Windows. Windows 8 Developer Edition is now available for download, I have installed it on PC. I must ...

Posted In: Download a preview build of Windows 8 tonight Georgecarlinjr

Apparently that also takes away the neat new task manager and explorer, which is a shame.Of course you can have the bes...

Posted In: How to get a Windows 7 start menu in Windows 8 Chinese hackers took control of NASA satellite for 11 minutes

Pure Google? Verizon sneaks two bloatware apps onto the Galaxy Nexus

Analyst predicts Amazon smartphone in 2012

Kindle Fire hacked to access Android Market

Google and Facebook, it’s time to take the kid gloves off about SOPA

.contentBox { clear: both; } @import url(http://www.geek.com/wp-content/themes/geek5a/styles/price-grabber.css); Geek Shop Categories Cameras Cell Phones Computers Electronics Laptops Memory Monitors PDAs Software Storage Devices Video Games All Products Geek.com Buyer's Guides Desktop Computer Buyer's GuideDigital Camera Buyer's GuideHDTV Buyer's GuideLaptop Buyer's GuideNetbook Buyer's GuideSmartphone Buyer's Guide Geek Feeds Geek Feeds Apple Gadgets Mobile Games Chips More Geek Goes Social Geek on Facebook Geek on Youtube Geek on Twitter Geek.com Archives This Month Last Month All Archives Reviews Newsletters Features Glossary © 1996-2011 Ziff Davis, Inc. AdChoices (function(){var e=document,b,a=(e.location.protocol=="https:"?"https":"http"),c=(a=="https"?"https://info.betteradvertising.com/c/betrad/pub/":"http://cdn.betrad.com/pub/");e.getElementById("_bapw-icon").src=c+"icon1.png";e.getElementById("_bapw-link").onclick=function(){var f=this;function d(i,l){var j=e.getElementsByTagName("head")[0]||e.documentElement,h=false,g=e.createElement("script");function k(){g.onload=g.onreadystatechange=null;j.removeChild(g);l()}g.src=i;g.onreadystatechange=function(){if(!h&&(this.readyState=="loaded"||this.readyState=="complete")){h=true;k()}};g.onload=k;j.insertBefore(g,j.firstChild)}this.onclick="return false";d(a+"://ajax.googleapis.com/ajax/libs/jquery/1.4.4/jquery.min.js",function(){d(c+"pub1.js",function(){BAPW.i(f,{pid:8,ocid:660},false)})});return false};b=e.createElement("img");b.src=a+"://l.betrad.com/pub/p.gif?pid=8&ocid=660&ii=1&r="+Math.random();b.height="1";b.width="1";e.body.appendChild(b)}()); About Contact Us Advertise Posting Guidelines Privacy Statement Terms of Use Glossary document.write(unescape("%3Cscript src='" + (document.location.protocol == "https:" ? "https://sb" : "http://b") + ".scorecardresearch.com/beacon.js' %3E%3C/script%3E")); COMSCORE.beacon({ c1:2, c2:6035546, c3:"", c4:"", c5:"", c6:"", c15:"" });

View the original article here

Tuesday, November 22, 2011

Report: Russian hackers targeted Springfield water pump - WJBC News

SPRINGFIELD – Federal officials are investigating a report that Russian hackers shut down a water pump near Springfield last week.

The Springfield Journal-Register reports the Curran-Gardner Public Water District may have been targeted by the alleged cyberattack. The U.S. Department of Homeland Security is investigating, but no major service disruption was reported.

The Nov. 8 water-pump burnout was first reported by a cybersecurity blog, based on a one-page report from the Illinois Statewide Terrorism and Intelligence Center.

A water district trustee says there’s some indication of an attempt to breach the system’s Supervisory Control and Data Acquisition computer system, but no confirmation yet.

No word on why the tiny water district was targeted.

jQuery.fbInit({fb_options:{appId: '190997570932575',channelUrl: 'http://wjbc.com/wp-content/plugins/facebook/library/channel.html'}});

View the original article here

Another Romanian Accused of Hacking into NASA - Wall Street Journal (blog)

Gaining access to N.A.S.A. servers is beginning to look as if it is almost a rite of passage for some hackers, especially from Romania. It may not yet quite be a regular occurrence, but it is not totally uncommon, as Information Week reports on the latest arrest:

According to Romania’s Directorate for Investigating Organized Crime and Terrorism (DIICOT), the man, Robert Butyka, hacked into several NASA servers on Dec. 12, 2010, modified and damaged data on the servers and restricted access to them.

He apparently goes by the online handle, “Iceman”, and he follows in others’ footsteps.

Victor Faur was charged in 2006 with 10 criminal counts for hacking into more than 150 government computers, including computers used for deep space research, and causing them to display messages indicating that they’d been hacked. He’s now appealing the verdict against him. Earlier this year, a hacker with the online pseudonym TinKode exposed a security flaw in NASA Goddard Space Center’s FTP site.

IT security company Sophos’ blog Naked Security adds:

This isn’t the first time NASA has been hacked, as many of our readers will recall this is what originally got British hacker Gary McKinnon in touch with the long arm of the law.

If NASA is repeatedly being hacked to the tune of half a million dollars plus each time, shouldn’t we be asking serious questions about the security of their systems?

Information Week: Romanian Accused Of NASA Hacks

Naked Security: NASA hacker arrested, perhaps it is time for some defense?


View the original article here

Android under assault as hacker attacks on phones go up 472 per cent in four ... - Daily Mail

By Daniel Bates

'Rogue' apps in market conceal malicious softwareDownloading can allow hackers to spy on your emailsApps 'steal' by sending texts to premium numbersAndroids at risk because apps aren't vetted before they join Android Market - unlike iPhone apps

Last updated at 3:17 PM on 18th November 2011


The success of phones running Google's Android software has meant cyber-attacks have risen 472 per cent in just three months - from cyber-spying apps to apps that add to your phone bill The success of phones running Google's Android software has meant cyber-attacks have risen 472 per cent in just three months - from cyber-spying apps to apps that add to your phone bill

Google's Android operating system is far, far ahead of Apple's iPhone - analysts Gartner said that phones running the operating system accounted for 52.5 per cent of the smartphone market this year, compared to 15.6 per cent for iOS devices.

But in computing, success always comes at a price.

Hackers target the most successful operating systems with their most virulent and hi-tech attacks, simply because there are more victims.

Malware infection rates amongst Android users are going up at their highest rate ever, putting huge pressure on Google to improve its security.

Since July the number of attacks has increased by 472 per cent with most of those coming in the past few weeks

The rise comes off the back of a report in May which said that over the previous year malware incidents had gone up 400 per cent.

The studies were carried out by IT security firm Juniper Networks which blamed Google’s poor security for allowing so many users to be affected.

It said that once installed malicious programmes could either send personal information to a third party, or send text messages to a premium rate number without the person’s knowledge, costing them money that is not recoverable.

Google is particularly vulnerable because it doesn't 'vet' apps in its marketplace, unlike Apple - making it open season for hackers.


HTC's Evo 4G handset runs Google's popular Android software: But the internet giant's anything-goes approach to its app store has led to an increase in cyber attacks on users HTC's Evo 4G handset runs Google's popular Android software: But the internet giant's anything-goes approach to its app store has led to an increase in cyber attacks on users

Google’s Android is now the most popular platform for downloading apps, beating the iPhone and the iPad combined.

The operating system accounted for 44 per cent of all app downloads in the second quarter of this year. Apple only got 31 per cent across all of its platforms.

Android has become a target for hackers and others with malicious intent partly because it is the market leader.

But according to Juniper Networks, Google must also take some of the blame because there is no review process before an app is placed in the App Store.

Adding to the problem is that Android is open source, meaning it is far easier to create and App for free and redesign their own hardware.

October showed a 110 per cent increase in malware sample collection over the previous month and a 171 per cent increase from what had been collected up to July 2011.

Not only are the numbers going up, but the malicious programmes are getting more sophisticated too.

In its reporter Juniper Networks said: ‘We have since seen exponential grow in Android malware over the last several months.

‘The months of October and November are shaping up to see the fastest growth in Android malware discovery in the history of the platform.

‘The majority of malicious applications target communications, location, or other personal identifying information. 

‘Of the known Android malware samples, 55%, acts in one way or another as spyware.

‘The other major type of attack, which make up 44%, are SMS Trojans, which send SMS messages to premium rate numbers owned by the attacker in the background of a legitimate application, without the person’s knowledge.

‘Once these messages are sent, the money is not recoverable, and the owners of these premium rate numbers are generally anonymous.’

The report adds that the main suspects behind such programmes are the same people who targeted other phones but have shifted because Android is now the most popular operating system.


View the original article here

Hackers eye Canada business: study

(Reuters) - Hackers attacking Canadian organizations are determined to make money in targeted campaigns while government insiders stole more data than ever before, a security study released on Tuesday showed.

The number of breaches in Canada and the cost of dealing with them have spiked since the 2008 financial crisis, according to a joint study from telecom company Telus and the University of Toronto's Rotman School of Management.

The study, its fourth annual report, said the crisis had both pressured budgets for information security and created a darker "threat environment."

The average Canadian public company suffered 18 breaches in 2011, up from less than 12 breaches a year earlier, the study found. Government bodies were able to reverse the trend of increasing breaches; there were just over 17 this year after a spike above 22 last year.

But insider breaches, where an employee deliberately accesses confidential information, spiked in the government sector despite falling in public and private companies.

Forty-two percent of breaches in government were perpetuated by insiders, which the researchers called "the most startling finding from the research."

Sophisticated attacks are focused on individuals and their data and often seek a continuing information stream for financial or political gain, the study said.

"These attacks are reported less frequently as they are much harder to detect and often involve much longer timeframes," the study's authors wrote.

The most popular weapons of choice for hackers remain a motley collection of viruses, worms, spyware, malware and spam, though phishing and pharming are also popular.

The direct costs associated with security breaches fell for all organization types, to an average of almost C$83,000. In 2010, breaches cost more than C$179,000 per organization, while in 2009 it was C$834,000.

(Reporting by Alastair Sharp; Editing by Phil Berlowitz)


View the original article here

Exclusive: Lax security at Nasdaq helped hackers

WASHINGTON (Reuters) - A federal investigation into last year's cyber attack on Nasdaq OMX Group found surprisingly lax security practices that made the exchange operator an easy target for hackers, people with knowledge of the probe said. The sources did not want to be identified because the matter is classified.

The ongoing probe by the Federal Bureau of Investigation is focused on Nasdaq's Directors Desk collaboration software for corporate boards, where the breach occurred. The Web-based software is used by directors to share confidential information and to collaborate on projects.

The investigators found that Nasdaq's basic computer architecture was sound, which kept its trading systems safe from the hackers, according to four people who were briefed on the FBI probe or had knowledge of Nasdaq's efforts to improve its security with the help of external consultants.

The sources, however, said the investigators were surprised to find some computers with out-of-date software, misconfigured firewalls and uninstalled security patches that could have fixed known "bugs" that hackers could exploit. Versions of Microsoft Corp's Windows 2003 Server operating system, for example, had not been properly updated.

While Nasdaq is not the first company to allow software updates to lapse inadvertently, investigators were surprised that the exchange operator was not more vigilant about what the industry calls "cyber hygiene" given its importance to financial systems.

"This was easy pickings," said one person familiar with Nasdaq's security practices. "You would have thought they would be like a cyber Fort Knox, but that wasn't the case at all."

Nasdaq defended its security practices and said no data was compromised by the cyber attack, which was detected in October 2010.

Carl-Magnus Hallberg, senior vice president of information technology services for Nasdaq OMX, told Reuters it was unfair to conclude that security practices were lax simply because the Directors Desk program was breached. He said it would have been virtually impossible to defend against the hackers who used malware that had not been disclosed.

"This was a sophisticated attack," Hallberg said. He declined to comment further on the specifics of the investigation, saying his company does not publicly discuss details of its security practices.

BROADER CONCERNS

The Nasdaq attack has sparked concerns about the severity of the threat facing the financial industry and the need for enhanced security at many companies.

Computer security is uneven across industry and many companies, even in the defense sector, are unaware of malware lurking in their networks, cyber experts say.

Sources said the malware found in Nasdaq's network was complex and insidious, but tougher security measures and more vigilance could have helped the company detect the intrusion more quickly.

While declining to comment on that claim, Nasdaq said it invests heavily in network security and has about 1,000 people working on information technology issues worldwide.

Officials at the FBI and the National Security Agency, which is also involved in the investigation, declined comment.

It was not clear how long the malicious software was present on Nasdaq's network before it was found.

Hallberg said Nasdaq detected the breach, took action to mitigate it and notified federal authorities, who are still investigating. Nasdaq also shared the electronic signatures it identified from the attack with other companies to help them avert similar attacks, Hallberg said.

Nasdaq has about 10 companies advising it on security issues, including a major U.S. defense contractor, he added.

Nasdaq disclosed in February the cyber attack on Directors Desk, a service the company sells to corporate boards. Nasdaq bought the privately held Washington-based company in 2007.

Thomson Reuters Corp, the parent of Reuters News, sells a product known as BoardLink that competes with Directors Desk.

Hallberg said Nasdaq was working closely with other companies and government agencies around the world to increase data-sharing on security threats.

He said the company's security systems were heavily regulated in every country where it operates, and especially in the United States, where the Securities and Exchange Commission conducts four audits per year. Any concerns identified through such audits were dealt with immediately, he said.

(Additional reporting by Jonathan Spicer and Basil Katz in New York. Editing by Tiffany Wu)


View the original article here

Int'l hackers blamed in water pump attack

Published: Nov. 18, 2011 at 7:19 PM

WASHINGTON, Nov. 18 (UPI) -- Hackers outside the United States were responsible for damaging the municipal water system in Springfield, Ill., an expert says.

Joe Weiss provided information from a report on the Illinois attack to The Washington Post. A Department of Homeland Security spokesman confirmed the damaged water pump in Springfield and said federal agents were trying to determine if it was the result of a computer attack, the newspaper said.

The report said the pump burned out after the system powered up and down unpredictably. Weiss said a municipal water district employee noticed the problems Nov. 8, and a technician determined the system had been hacked into from a computer in Russia.

Computer hackers made a two-stage attack, Weiss said. The first was hacking into a software company data base to obtain the passwords needed for later attacks.

The report said investigators do not know if the hackers succeeded in getting into other systems.

"This is a big deal," Weiss said.

The computer used by the hackers is believed to be physically located in Russia.


View the original article here

Monday, November 21, 2011

Foreign hackers attack Springfield water plant system

Foreign hackers broke into a water plant control system in Springfield last week and damaged a water pump in what may be the first reported case of a malicious cyber attack on a critical computer system in the United States, according to an industry expert.

On Nov. 8, a municipal water district employee noticed problems with the Curran-Gardener Township Public Water District's water pump control system, and a technician determined the system had been remotely hacked into from a computer located in Russia, said Joe Weiss, an industry security expert who obtained a copy of an Illinois state fusion center report describing the incident.

Problems with the system had been observed for two to three months and recently the system “would power on and off, resulting in the burnout of a water pump,” the Nov. 10 report from the U.S. Department of Homeland Security, according to Weiss, who read the report to The Washington Post.

“This is a big deal,” said Weiss. The report stated it is unknown how many other systems might be affected.

According to the report, hackers apparently broke into a software company's database and retrieved user names and passwords of various control systems that run water plant computer equipment. Using that data, they were able to hack into the plant in Illinois, Weiss said.

It's not the first time that two-step technique — hack a security firm to gain the keys to enter other companies or entities — has been used.

Earlier this year, hackers believed to be working from China stole sensitive data from RSA, a division of EMC that provides secure remote computer access to government agencies, defense contractors and other commercial companies around the world. Armed with that data, they breached the computer networks of companies, including Lockheed Martin, whose employees used RSA “tokens” to log in to the corporate system from outside the office. Lockheed said that no sensitive data were taken.

“RSA is the gold standard” for remote access security in industry, said Gen. Keith Alexander, head of U.S. Cyber Command and director of the National Security Agency, at a conference in Omaha this week. “If they got hacked, where does that leave the rest?”

Alexander noted his concern about “destructive” attacks on critical systems in the United States.

The Department of Homeland Security, whose job is to oversee the protection of critical infrastructure such as water utility computer systems in the United States, said that DHS and the FBI are investigating the Illinois incident. “At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety,” DHS spokesman Peter Boogaard said in an emailed statement.

According to the fusion center report obtained by Weiss, the network intrusion of the software company “is the same method of attack recently used against a Massachusetts Institute of Technology server” used to “aid and initiate an attack on other websites.”

For Weiss, though, the incident has significance. “It was tracked to Russia. It has been in the system for at least two to three months. It has caused damage. We don't know how many other utilities are currently compromised.”

Senior U.S. officials, including Alexander, have recently raised warnings about the risk of cyber attacks on critical infrastructure. Questions persist about the readiness and capabilities of DHS to respond to a major attack, and the scope of authority of the U.S. military, which has the greatest cyber operational capabilities, to respond.


View the original article here

Hackers targeting 'Twilight' movie fans

Hackers are targeting fans of the popular ?Twilight" movie series, poisoning links in Twilight-related searches with malware.

Security firm Norton said some infected results include ?Nude pictures of Taylor Lautner," ?Robert and Kristin kissing" and ?Twilight true love."

"Clicking on some of the links resulting from these searches might get your PC, tablet or smartphone infected with viruses or keyloggers, so be extra careful when searching for Twilight-related material," tech site Mashable said.

The next movie in the ?Twilight" series, ?The Twilight Saga: Breaking Dawn (Part 1)," is expected to open November 18, Mashable noted.

It added Norton?s experts expect to see even more Twilight-related malware, scams and spam as the excitement around the movie grows.

Mashable pointed out ?Twilight Saga" fans are a common target for malicious hackers.

Last April, it noted a ?Twilight" game scam spread virally on Facebook, and similar scams have accompanied every movie in the series.

A separate article on PRNewsWire.com said Norton experts shared tips on how users can protect themselves:

Stay away from sensational strangers: Cybercriminals use sensational wording to get you to click on their poisoned links. Don?t leave your neck exposed: Get reputable online security software that will identify malicious links and protect against other unseen threats. Watch out for (were)wolves in sheep?s clothing: check search term results to make sure sites aren?t poisoned before clicking on them. ? RSJ, GMA News

View the original article here

Exclusive: Lax Nasdaq security helped hackers

WASHINGTON — A federal investigation into last year's cyber attack on Nasdaq OMX Group found surprisingly lax security practices that made the exchange operator an easy target for hackers, people with knowledge of the probe said. The sources did not want to be identified because the matter is classified.

The ongoing probe by the Federal Bureau of Investigation is focused on Nasdaq's Directors Desk collaboration software for corporate boards, where the breach occurred. The Web-based software is used by directors to share confidential information and to collaborate on projects.

The investigators found that Nasdaq's basic computer architecture was sound, which kept its trading systems safe from the hackers, according to four people who were briefed on the FBI probe or had knowledge of Nasdaq's efforts to improve its security with the help of external consultants.

The sources, however, said the investigators were surprised to find some computers with out-of-date software, misconfigured firewalls and uninstalled security patches that could have fixed known "bugs" that hackers could exploit. Versions of Microsoft Corp's Windows 2003 Server operating system, for example, had not been properly updated.

While Nasdaq is not the first company to allow software updates to lapse inadvertently, investigators were surprised that the exchange operator was not more vigilant about what the industry calls "cyber hygiene" given its importance to financial systems.

"This was easy pickings," said one person familiar with Nasdaq's security practices. "You would have thought they would be like a cyber Fort Knox, but that wasn't the case at all."

Nasdaq defended its security practices and said no data was compromised by the cyber attack, which was detected in October 2010.

Carl-Magnus Hallberg, senior vice president of information technology services for Nasdaq OMX, told Reuters it was unfair to conclude that security practices were lax simply because the Directors Desk program was breached. He said it would have been virtually impossible to defend against the hackers who used malware that had not been disclosed.

"This was a sophisticated attack," Hallberg said. He declined to comment further on the specifics of the investigation, saying his company does not publicly discuss details of its security practices.

Broader concerns
The Nasdaq attack has sparked concerns about the severity of the threat facing the financial industry and the need for enhanced security at many companies.

Computer security is uneven across industry and many companies, even in the defense sector, are unaware of malware lurking in their networks, cyber experts say.

Sources said the malware found in Nasdaq's network was complex and insidious, but tougher security measures and more vigilance could have helped the company detect the intrusion more quickly.

While declining to comment on that claim, Nasdaq said it invests heavily in network security and has about 1,000 people working on information technology issues worldwide.

Officials at the FBI and the National Security Agency, which is also involved in the investigation, declined comment.

It was not clear how long the malicious software was present on Nasdaq's network before it was found.

Hallberg said Nasdaq detected the breach, took action to mitigate it and notified federal authorities, who are still investigating. Nasdaq also shared the electronic signatures it identified from the attack with other companies to help them avert similar attacks, Hallberg said.

Nasdaq has about 10 companies advising it on security issues, including a major U.S. defense contractor, he added.

Nasdaq disclosed in February the cyber attack on Directors Desk, a service the company sells to corporate boards. Nasdaq bought the privately held Washington-based company in 2007.

Hallberg said Nasdaq was working closely with other companies and government agencies around the world to increase data-sharing on security threats.

He said the company's security systems were heavily regulated in every country where it operates, and especially in the United States, where the Securities and Exchange Commission conducts four audits per year. Any concerns identified through such audits were dealt with immediately, he said.

Copyright 2011 Thomson Reuters. Click for restrictions.


View the original article here

Hackers modify iPhone 4S to run on T-Mobile

If you want an iPhone 4S but don't want to give up your T-Mobile contract and switch to Verizon, AT&T or Sprint, you're not entirely out of luck. All you have to do is follow two hackers' directions.

On Pastebin and in a YouTube video, hackers Michael Capozzi and Daniel Scaleb posted step-by-step instructions showing how to hack an iPhone 4S and make it compatible with T-Mobile, the major U.S. carrier that doesn't support the Apple smartphone.

The modification requires a user to insert the original AT&T SIM card, dial 611 for customer service and then drop the call. The next step involves turning on "Airplane" mode, removing the legitimate SIM card and inserting a T-Mobile SIM card.

Scaleb writes on Pastebin that the next step is to switch off "Airplane" mode, which will cause the iPhone to search for a network. The EDGE network will activate automatically, after which the user should turn off the phone after 20 to 30 seconds, turn it on again, and tap "Use Cellular Connection" when the "Activation Required" screen pops up.

From there, ejecting the SIM card and reinserting it should unlock the phone and make it compatible with T-Mobile's network.

The modification seems simple enough, but tech site Gizmodo, which was among the first sites to report it, said it has received conflicting reports about whether or not the unlocking trick works.

If you want to avoid the hack and get a T-Mobile-compatible iPhone 4S, there's another way: as of last week, unlocked GSM iPhone 4S smartphones are available for $650.

© 2011 SecurityNewsDaily. All rights reserved


View the original article here

Hackers Flood Facebook Accounts With Porn

(c) Sky News 2011, 13:25, Wednesday 16 November 2011

Hackers have flooded the news feeds of thousands of Facebook users around the world with pornographic and violent images.

Users reported logging in to find themselves confronted by images and videos that had been doctored to show celebrities, including teen star Justin Bieber and singer Rihanna, in indecent poses, as well as other sexually explicit content.

Some users were tricked into sharing offensive content with others, after pasting "malicious" content into their browser URL bar.

The source of the attacks, which have been occurring over recent days, is not yet known, Facebook has said.

Initially, there was speculation that Anonymous, a loose global affiliation of hackers which has targeted other major companies in the past, could be behind the attack.

A group claiming allegiance to Anonymous claimed in a YouTube video that it had created the "Fawkes virus" to attack Facebook.

An automated voice in the video said: "Using a simple Facebook account, the worm can be carried into other accounts with little or no interaction.

"We did not expect the intensity with which this would spread."

However, Sky News understands Facebook's own investigations have now concluded that the so-called "hacktivist" group was not behind the attack.

A spokesman said in a statement: "We experienced a co-ordinated spam attack that exploited a browser vulnerability.

"Our team responded quickly and we have eliminated most of the spam caused by this attack. 

£We are now working to improve our systems to better defend against similar attacks in the future.

"During this spam attack users were tricked into pasting and executing malicious javascript in their browser URL bar causing them to unknowingly share this offensive content. 

£No user data or accounts were compromised."


View the original article here

Anatomy of an Attack comes to Melbourne, Australia

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Are you sceptical of "technical" and "educational" sessions promised by software vendors? You should be. They're often run by sales guys. No disrespect intended, but technical sessions should be led by technical people, don't you think?

Sophos's Anatomy of an Attack seminars are different.

They're not about products; they're about the threat.

They're not about showing off Sophos's technology; they're about teaching you to think like the Bad Guys.

The Australian Anatomy of an Attack series is an extensive live demonstration, led by well-known and experienced Sophos researcher and presenter Paul Ducklin.

The Anatomy of an Attack is followed by luncheon and an optional demo and Q&A session with Sophos product specialist Aaron Bugal. (Aaron's a techie, too, not a sales guy :-)

You will actually see - live, but off-line and in safety - how a range of cybercriminal technologies work:

* Ransomware
* Advanced Persistent Threats
* Search engine poisoning
* Command injection
* Advanced JavaScript trickery
* Fake anti-virus, aka Scareware

Know how your enemy thinks and operates and you will be much better placed to defend both yourself and others.

The next Anatomy of an Attack session in Australia takes place in Melbourne, Victoria, on Tuesday 22 November 2011. It runs from 09:00 to 13:30, includes morning tea and luncheon, and it's free.

The venue is the City Convention Centre, 300 Flinders Street, Melbourne 3000.

We'd love to have you along, but places are strictly limited so you must register if you want to come.

(Don't worry if you register too late to get into this one - we'll put you first on the list for next time!)

This event is eye-opening, entertaining and educational - and we promise not to subject you to any Death By Powerpoint.

If you're not from Melbourne but would like to get a feel for what the sessions are about, please check out our Anatomy of an Attack videos online.

Follow @duckblog

View the original article here

Sunday, November 20, 2011

Google controversially forces users to opt-out of Wi-Fi snooping

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Wi-FiGoogle is offering to stop mapping wireless access point location data, granting network owners worldwide the choice to opt out from its Wi-Fi geolocation mapping. This move follows a decision by the Dutch Data Protection Authority (DPA) that the process is in violation of laws in the Netherlands.

Google feeds this data into its location database, the Google Location Server, from the smorgasbord of input it got in the past from its Street View cars, and now collects from Android phones and tablets.

With that data set, it's built a global database of wireless access points and their geographic locations, which it uses in services and Android applications to approximate individuals' locations based on the Wi-Fi networks detected by their handsets.

Google's Peter Fleischer, writing from the halls of the Google Global Privacy Counsel, explained that users will have to opt out if they don't wish to have their Wi-Fi hotspot mapped:

We're introducing a method that lets you opt out of having your wireless access point included in the Google Location Server. To opt out, visit your access point's settings and change the wireless network name (or SSID) so that it ends with "_nomap." For example, if your SSID is "Network" you'd need to change it to "Network_nomap"

Fleischer's blog posting went to explain why Google is foisting responsibility for opt-out onto users, requiring them to fiddle with their router SSID instead of, say, Google providing an online opt-out tool. It has to do, he says, with "the right balance of simplicity."

"As we explored different approaches for opting-out access points from the Google Location Server, we found that a method based on wireless network names provides the right balance of simplicity as well as protection against abuse. Specifically, this approach helps protect against others opting out your access point without your permission."

Google _nomap

Gosh, thanks, Google! You’re protecting our access points from being booted off your location server! Heaven knows we were losing sleep, worried that hackers would opt out our access points without our permission. After all, we profit so greatly from your location-based services, and from enabling your users to tag posts with their locations, and to enabling your users to check in to restaurants, and to just simply helping your users to know where the heck they are.

Without recompense. And without our permission being required or desired.

Really, thank goodness. It would be awful if a hacker kicked us out of this Wi-Fi Fun Fest. After all, we know these location-based services are, in Google’s own words, “Some of the most popular features of today’s Internet,” off of which you are profiting so greatly, while we, of course, are profiting in ways that do not exactly equate to financial matters, per se, but rather to, well, actually, come to think of it, a big, fat, hen's-egg of nothing.

What Google probably means by "balance of simplicity" is that it will be hard for users to do. That would be simpler for Google to handle, because having a bunch of users opt out would create big holes in its location mapping abilities.

eWEEK’s Wayne Rash pinpoints why this approach has absolutely nothing to do with simplicity. In a nutshell, there’s nothing simple for most people when it comes to tangling with their routers.

Belkin router"The method seems simple, but it is fraught with problems," writes Mr. Rash. "Not the least of these problems … is that a lot of people have no idea how to change the SSID on their router. How many people? Well, if you're in a populated area, look for access points on your laptop. Note how many SSIDs are named ?linksys’ or ?belkin.’ Those are all people who bought their router at the store, plugged it in and started using it. These people likely don't know what an SSID is, much less how to change it."

Granted, the change should be fairly easy if people can figure out how to do it: just search for a new SSID on your computer (assuming you know how) and connect to the new one with the "_nomap" suffix.

But as Mr. Rash points out, there will be a boatload of nontechnical users on the support lines with people who make wireless access points and routers when all of a sudden those nontechnical users can’t connect. "I can only imagine what the folks at Cisco and Netgear will be thinking about Google after their first week of such calls," he writes.

It only gets more grisly from there. We have wireless routers sold for 802.11n that are also simultaneous dual-band routers, meaning they have two radios: one set for 2.4GHz and another for 5GHz.

"On most routers these two radios have different SSIDs that are set in different places," writes Mr. Rash. "How many users who already don't know how to manage their devices will realize this and also realize that they have to change both of them to say "_nomap" at the end to prevent automatic Wi-Fi data collection?"

And, he continues, what about Wi-Fi-enabled HDTVs using 5GHz that need to have the new name setup? Or the Wi-Fi-enabled consumer electronics? Will most users remember what frequency their gadgets are using and that they need to have a new name?

Google thinks highly enough of this fiddle-yourself-into-opt-out policy that it’s fluttering its eyelashes at other location providers, hoping that, over time, the "_nomap" string will be adopted universally. "This would help benefit all users by providing everyone with a unified opt-out process regardless of location provider," Google says.

TrikeBut, asks Sophos’s Graham Cluley, "What happens if another net firm wants to produce its own rival to Google Street View, and sends their camera-equipped tricycle down the country lanes of Oxfordshire?"

"It's quite possible that folks might wish to opt out of Google knowing their Wi-Fi router, but don't care if another company does. Should we have a different way then of people marking their router name? Imagine if company A said use the "_nomap" suffix and company B said use "_nosnoop" instead. You can't have both!"

Of course, we know why Google is opting for "_nomap" opt-out as opposed to "_yesmap" opt-in. The company would collect, as Cluley notes, "a heck of a lot less data" that way.

Every day, our information gets pummeled into novel uses by companies who don’t ask us if it's OK.

When will the day come when access to our data is considered to be an assault unless it's a consensual act? Not today, not the way Google’s envisioning opt-out.

Follow @LisaVaas


View the original article here

Mystery flaw crashing DNS servers across the internet

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Internet globeA zero-day vulnerability is causing BIND 9 DNS servers to crash across the internet. The flaw, described as an "as-yet unidentified network event", appears to be a denial of service vulnerability being exploited in-the-wild. The flaw affects all supported versions of BIND.

The internet Systems Consortium (ISC) have described the problem as follows:

An as-yet unidentified network event caused BIND 9 resolvers to cache an invalid record, subsequent queries for which could crash the resolvers with an assertion failure...

Affected servers crashed after logging an error in query.c with the following message: "INSIST(! dns_rdataset_isassociated(sigrdataset))

More details are available in their advisory.

The cause of the crash is still under investigation but the ISC have reacted swiftly with a set of temporary patches that will prevent servers from crashing. There is no known workaround for the problem and BIND users are encouraged to upgrade.

The Domain Name System (DNS) is a critical part of the internet's infrastructure and most of the DNS servers on the Internet run BIND 9.

We will keep you updated as we discover more information.

http://twitter.com/markstockley

View the original article here

Facebook will no longer tell you everything it knows about you

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Facebook CDIn the face of an ocean of users demanding their personal data as required by European Union law, Facebook has sharply constricted the amount of data it's handing over.

Instead of sending CDs, Facebook is now directing users to a page where they can download a personal archive, but that archive is now covering only 22 categories — less than half of the 57 categories received by early requesters in the Europe vs. Facebook campaign, according to a report from ITworld.

The new stinginess comes in the midst of an audit by Ireland's Data Protection Commissioner. The audit is the result of 22 privacy-based complaints (to view the list of complaints, go to Kim Cameron's Identity Weblog) lodged by Europe vs. Facebook.

That campaign is led by Max Schrems, a 24-year-old law student from Vienna who secured 1,200 pages of personal data on a CD months ago by using a European requirement that entities with data about individuals make it available to those individuals if they request it.

The Irish agency is auditing Facebook for compliance with the country's Data Protection Acts of 1988 and 2003, which transpose the E.U.'s Data Protection Directive, known as 95/46/EC.

Europe vs. Facebook contends that Facebook is withholding personal data in violation of these laws, which require companies to disclose data to users on request.

Lisa McGann, a senior investigations officer, on Tuesday told IDG News Service that the agency has received an additional 150 complaints about Facebook’s inadequate response to data requests and 10 complaints over data protection, according to ITworld.

Stack of emailMr. Schrems told ITworld that he’s exchanged e-mails with Richard Allan, Facebook's director of European public policy, who’s indicated that Facebook is contemplating a system modification that would allow a more in-depth batch of information if the agency finds fault in the company's current strategy.

In the meantime, Facebook is throttling back the data volume it releases. While Facebook is defending its actions, claiming that it is "fully compliant with E.U. data protection laws," the categories of data it’s releasing has nosedived.

Mr. Schrems told ITworld that the CDs Facebook initially sent out when he and others first requested their personal Facebook dossiers contained 57 categories of data. Now, Mr. Schrems said, Facebook is excerpting between 19 and 24 categories of data.

In addition to cutting back on the data it releases, Facebook has turned to a do-it-yourself model. Facebook recently created an email address, datarequests@fb.com, for people to request data. An autoreply from that account directs users to an archive download tool.

Facebook Download Archive site

The autoreply also curtly snips off further conversation, stating that “We will not enter into further correspondence about your specific data through this email address.”

The latest move by Facebook is just "a way of getting rid of people," Mr. Schrems told ITworld, since more transparency would "freak people out," he said.

Facebook, if what Mr. Schrems believes is correct, I’d like to propose that you’re wrong. More transparency would have the opposite effect to freaking us out.

As it is, we’re already freaked out. Hundreds of legal complaints are a visible symptom of freak-out.
What’s going to continue to freak us out is if you keep tightening your sphincter.

The more tight-fisted you are with our personal data, the more you will cause your users to suspect that you plan to do things with it that we would rather you didn't.

If you're on Facebook and want to keep informed about privacy issues, scams and internet attacks, join the Sophos page on Facebook, where over 150,000 people regularly share information on threats and discuss the latest security news.

Follow @lisavaas

View the original article here

US SCADA infrastructure woefully unprotected

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Creative Commons photo of water tower courtesy of christinejwarner's Flickr photostreamIt has been reported that a SCADA systems failure at a municipal water processing plant may have been caused by hackers infiltrating their network.

The attackers were repeatedly turning a pump on and off until it caused the pump to fail, raising an alert to the operators.

Upon investigation they determined that attackers may have infiltrated the system starting in September 2011, although the attack wasn't discovered until November 8th, 2011.

The notice about the attack noted that it was similar to an attack against the Massachusetts Institute of Technology earlier this year which exploited bugs in the open source software phpMyAdmin.

Reading about this my spidey-sense was tingling... What? They have SCADA control systems hooked up to the public internet? And they are running phpMyAdmin!?!?

I run a reasonably low profile, small website for myself and some friends and at one point had installed phpMyAdmin to assist them with daily SQL management chores.

I removed it four years ago after a never ending stream of severe vulnerabilities made it too risky for my *play* site.

According the the National Vulnerability Database phpMyAdmin has at least 105 reported security vulnerabilities.

It would appear it is common practice these days to connect these sensitive critical infrastructure systems to the public internet and use COTS (Common Off The Shelf) software to manage them.

Convenience and price are always desirable to those responsible for managing these systems, but this is bordering on criminally negligent when you are responsible for our water, power, gas and other sensitive utilities.

The Department of Homeland Security needs to do a top-down audit of these systems and mandate that these insecure practices come to an end.

Within hours of the news breaking on this story a hacker known as pr0f posted images of internal SCADA control systems from the City of South Houston, Nevada.

City of South Houston SCADA system

He insists he hasn't interfered with their operations and is just releasing the information to draw attention to the problem.

Of course that doesn't change the fact that accessing these systems is still a criminal act under the Computer Fraud and Abuse Act.

We may already be at a crisis point with regards to our infrastructure security, but perhaps these stories will be a wake up call for those managing similar systems around the world.

Creative Commons photo of a water tower courtesy of christinejwarner's Flickr photostream.

http://twitter.com/chetwisniewski

View the original article here

UK police foiled attack on royal wedding website

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Creative Commons photo of Will and Kate courtesy of anonlinegreenworld's Flickr photostreamPolice detained a 16-year-old on Oct. 10 in relation to "a suspected attempt to encourage others to commit a distributed denial-of-service attack," according to a spokesman from the cybercrime unit who was quoted in a report from the Associated Press. The spokesman also said that the teenager is out on bail and has not yet been charged.

The unit’s chief, Det. Supt. Charlie McMurdie, mentioned the coup in an address to attendees of the Royal United Services Institute, a defense think tank.

A DDoS would have kicked Britain in the knees. Some providers at the time have said the April 29 wedding may have been the most heavily live-streamed event ever, though the death of Osama bin Laden is said to have since surpassed it.

The official royal wedding website said that, at its peak, it was handling more than 2,000 requests per second.

The popularity of the event did, in fact, crash the BBC’s site, which went down for 17 minutes of prime nuptial time. The Guardian at the time noted that Twitter feeds from users complained of being unable to watch live streaming from Westminster Abbey.

ABC put the record-breaking Internet burden into perspective with these statistics, all as of the date of the wedding:

In the seven days preceding, 2.1 million tweets concerning the event were sent.In the United States alone, more than 1.75 million Facebook comments mentioning the term “royal wedding” were made over the preceding month.More than 800,000 people watched "Royal Wedding Invitation," an official wedding video, as of April 29.The name of Kate’s hair piece—“fascinator”—saw a 70 percent increase in Google searches worldwide over the preceding month.The search term "What Is Prince Williams Last Name" saw a 1,199 percent increase in Yahoo searches in the preceding week.YouTube users uploaded 5,000 videos tagged "royal wedding" over the preceding week.

McMurdie told the conference attendees that action was taken to safeguard the royal wedding’s official site, which received 15 million hits on the wedding date. When the the AP asked for more details, she said her unit had "been called in" to deal with an attack.

LOICIt’s not hard to find a teenager who knows how to launch a DDoS nowadays. As Sophos’s Graham Cluley has written, many Internet users have been urged to voluntarily join a botnet by downloading a DDoS attack tool called LOIC (Low Orbit Ion Cannon, described in this detailed analysis by Sophos's Vanja Svajcer).

But just because it’s easy doesn’t mean it won’t send you to jail if you get caught. Messing around with DDoS has sent multiple U.S. citizens to the klink, for example.

One such, Mitchell L. Frost, was given a 30-month prison sentence at the tender age of 23 for a series of DDoS attacks he launched against the websites of Bill O'Reilly, Ann Coulter and Rudy Giuliani.

Will this 16-year-old get just a slap on the wrist because of his even more tender age?

Maybe. But it’s sure not worth the risk. Teenagers with cyber skills would be far better off spending their early years doing something constructive with their talent.

Creative Commons photo of Will and Kate courtesy of anonlinegreenworld's Flickr photostream.

Follow @LISAVAAS Be the first to like this post.

View the original article here

Will Do Not Track make a difference to web privacy?

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Filed Under: Featured, Privacy

Private signEarlier this week the World Wide Web Consortium (W3C) released the first drafts of two new privacy standards aimed at simplifying and standardising how websites read and comply with web users’ privacy settings.

The Tracking Preference Expression and Tracking Compliance and Scope standards define a ‘Do Not Track’ (DNT) mechanism that will allow users to opt out of the sort of tracking increasingly used for web analytics and behavioural advertising.

The W3C working group who produced the draft included representatives from some of the web’s biggest companies including Apple, Google and Facebook.

It's not unusual for these organisations to take part in drafting W3C standards but I wonder if some of them are feeling a slight conflict of interest. Agreeing to a Do Not Track standard could obviously have a negative impact on organisations like Google and Facebook who rely on targeted advertising.

Perhaps they feel it's better to be inside the tent or perhaps, as the draft suggests, DNT is in the interests of advertisers because annoying their users is counter-productive.

Or perhaps, as some cynics suggests, an answer can be found in the timing of the release of the finished version of the DNT standard.

European CommissionBack in June the European Commission told the technology industry in no uncertain terms that if it didn’t agree a Do Not Track standard by the midde of 2012, it would be forced to act.

Coincidentally the final recommendation of the DNT standard is scheduled for 2012.

A slew of controversies across Europe and the US may also have convinced the industry that it is better off regulating itself than being policed or dictated to by law makers.

So will the advent of DNT-enabled browsers usher in an age of web browsing without being tracked and targeted?

The new standard says that if a browser is incapable of issuing Do No Track instructions then it should be handled as if it has opted-out of Do Not Track rather than opted-in. So users will need to upgrade to a new generation of DNT compliant browsers to get the ball rolling.

Of course just because a browser can do something it doesn't mean it will. I don't know yet if the browser vendors are intending to switch DNT on by default but Firefox, which already implements its own version of DNT, currently has it off by default.

Firefox do not track option - off by default

And then finally, once we have a generation of DNT browsers in-the-wild we'll need a generation of DNT compliant websites and applications to go with them. Perhaps once there is final recommendation in place the law makers will do us all a favour and rattle their sabres again.

You can probably tell that I'm not holding my breath on this one.

When DNT does become commonplace there will surely be a lot of money to be made in successfully working around it.

We've already seen some very inventive tactics from advertising and analytics companies looking to work around users who who delete their cookies.

CookiesSince tracking tends to rely on cookies you might think that deleting them would be enough to prevent it. Sadly it's not. Researchers have shown that advertisers can work around users who delete their cookies by using Flash cookies or HTML 5 storage for the same purpose. Most creepily they can even resurrect delete cookies zombie-like using ETags.

However rocky the road to adoption is though the W3C and the organisations in the working group deserve praise for delivering a simple standard.

At its heart DNT is a simple on/off toggle. Hopefully this will make it easy for privacy concious web-users to define the information they want to share with advertisers and online business. As Lisa Vaas explained earlier this month current privacy tools fail users not because they don't work, but because they are incredibly difficult to use.

Follow @MarkStockley

View the original article here