Microsoft tells all Windows 7 users to uninstall security patch, after some PCs fail to restart

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Microsoft has advised all users of Windows 7 (and the server version, Windows Server 2008) who installed a security update on Tuesday to uninstall it, after some customers found their computers would not restart or applications would not load.

Users who experienced problems described how they saw fatal system errors like the following:

STOP: c000021a {Fatal System Error}
The Session Manager Initialization system process terminated unexpectedly with a status of 0xC000003a (0x00000000 0x00000000).
The system has shutdown.

The problem appears to be connected with Update 2823324 in Microsoft Security Bulletin MS13-036, a security update for the Windows file system kernel-mode driver (ntfs.sys).

In a blog post on the Microsoft Security Response Center, the company blamed the problem on conflicts with third-party software:

We are aware that some of our customers may be experiencing difficulties after applying security update 2823324, which we provided in security bulletin MS13-036 on Tuesday, April 9. We’ve determined that the update, when paired with certain third-party software, can cause system errors. As a precaution, we stopped pushing 2823324 as an update when we began investigating the error reports, and have since removed it from the download center.

Contrary to some reports, the system errors do not result in any data loss nor affect all Windows customers. However, all customers should follow the guidance that we have provided in KB2839011 to uninstall security update 2823324 if it is already installed.

According to media reports, computers in Brazil have been particularly badly hit - with machines continually rebooting.

Microsoft's knowledgebase article on this issue, explains that one symptom of the bug can be that Kaspersky Anti-Virus for Windows may display a message claiming its license is invalid, and that as a consquence it may no longer provide anti-malware protection.

Microsoft has already acknowledged the issue and said that it’s working on a fix. Yes, that's right. Some people had problems with the Patch Tuesday update, so there will be an update. But in the meantime, don't update the bit that's broken.

Users are recommended to block the 2823324 security update or uninstall it if its already present. More information on how to do this is detailed in this Microsoft knowledgebase article.

Follow @gcluley

View the original article here

US Treasury's Lew presses China over hacking allegations, asks for more help on North Korea

BEIJING, China - U.S. Treasury Secretary Jacob Lew pressed Chinese leaders over computer hacking and for help with North Korea during two days of talks that ended Wednesday.

Lew's visit to Beijing was the first high-level contact between the two governments in six months as they re-engage following a hiatus during the Chinese leadership transition.

The White House has called for Beijing to take action to stop computer attacks aimed at stealing company secrets. Hundreds of cyberattacks have been traced to China, and a security firm said last month that it found a wave of attacks on 140 companies that originated in a building in Shanghai housing a military unit.

"This is a very serious threat to our economic interests. There was no mistaking how seriously we take this issue," Lew told reporters.

Chinese officials have denied their government is involved and say China also is a victim of cyberattacks.

In talks with Chinese leaders, Lew emphasized that Washington sees a distinction between criminal cyberattacks, which are a common threat, and spying by state-sponsored enterprises, said a senior American official who spoke on condition of anonymity in order to brief reporters. The official declined to say how Chinese officials responded.

On North Korea, Washington wants Beijing to use its status as the North's main source of trade and aid to press Pyongyang to discard its nuclear program.

"We made clear that the U.S. views the provocative actions of North Korea as very serious and we will continue to pursue methods available to change the policy perspective in Pyongyang," Lew said. "We share a common objective of a denuclearized Korean Peninsula and we will continue to discuss it."

However, asked whether Washington was considering sanctions that might affect Chinese banks, Lew said U.S. leaders want to avoid imposing burdens on the Chinese economy.

This week's talks were the start of a series of meetings that will test the potential for co-operation between the world's largest- and second-largest economies. Lew is the U.S. economic envoy to an annual high-level strategic and economic dialogue between Washington and Beijing that is due to hold its next round this summer.

Although the relationship is colored by mutual suspicion, the two sides now discuss an ever-broadening agenda, from military co-operation to food safety. Last year, they swiftly resolved a diplomatic standoff when Beijing agreed to allow a Chinese legal activist, Chen Guangcheng, to leave for the United States after he sought refuge in the American Embassy.

Despite frictions over North Korea, computer hacking and human rights, both sides sounded positive notes during Lew's visit and stressed their wide array of mutual interests.

China's new president, Xi Jinping, said Tuesday that the two sides have "some differences" but "enormous shared interests."

Xi has visited the United States a half-dozen times but also is seen as a nationalist who is willing to defend what he considers China's core interests regardless of the cost to its reputation. Beijing is locked in territorial feuds with Japan and several Southeast Asian nations that threaten to draw in the United States.

On Wednesday, Lew stressed their common interests in a meeting with China's new top economic official, Premier Li Keqiang.

"We have a shared interest in making sure global growth continues," Lew told Li at Beijing's Zhongnanhai compound, where Chinese leaders live and work.

Li said Lew's visit would further "understanding, communication and trust" between the two sides.

Lew also met with his new Chinese counterpart, Lou Jiwei, and the head of China's main economic planning agency. He also spoke with Wang Qishan, a member of the country's ruling seven-member Standing Committee with extensive experience in finance and trade issues who dealt regularly with Lew's predecessors, Henry Paulson and Timothy Geithner.

View the original article here

Google announces brand new web browser core, so does Mozilla

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

When you wait ages for a bus, and then three come along at once, it's not a coincidence: it's a side-effect of queuing and traffic lights.

But what about when three browser vendors make announcements on the same day?

Robust competition? Serendipity? Coincidence? Or a bit of all of them?

Google announced Blink, a fork of the Webkit browser that aims to build a smaller and safer rendering platform based on what Google is unashamedly referring to as a "healthier codebase."

Opera, which is retiring its own rendering engine Presto and replacing its browser core with Chromium, the open-source flavour of Google Chrome, indirectly announced its commitment to the Blink-based flavour of Chromium.

And Mozilla announced Servo, or, more accurately, announced an ARM port of its experimental browser engine Servo, written in its new and experimental programming language Rust.

? The ARM processor is the CPU in most Android devices in the marketplace. Samsung, which sells a wide range of Android offerings, including phones, tablets, and phablets (giant phones or tiny tablets depending on whether they're against your ear or on your lap) is partnering with Mozilla in the Servo-on-ARM project.

A new rendering engine has at least one similarity with marriage, namely that it is not an undertaking to be entered into lightly.

A web browser is not just an HTML parser but also a CSS handler, a JavaScript interpreter, a DOM manager, a page layout engine, and an image processor, as well as a programming platform in its own right.

Modern browsers support all manner of third-party add-ons, extensions and plugins that typically let you customise almost everything to do with the browser's look, feel, and feature set. (Java applets, anyone? Flash videos? Audio playback? 3D modelling? Interactive games?)

Both projects, Blink and Servo, are forward-looking, by which I mean they aren't finished products that you can download and install right now.

Google talks about "the next 12 months" in its Developer FAQ, and talks about the "next generation" of web apps.

Mozilla's posting refers to "the coming year", and admits that both Rust and Servo are "early stage projects."

Sceptics, therefore, may very well write off both announcements as little more than positioning statements.

Indeed, their coincidental arrival on the same day will probably convince the real cynics that the announcements had more to do with the browser makers' marketing departments than with engineering.

Don't be too judgmental, though.

Mozilla's post comes from Brendan Eich, Mozilla CTO and well-respected inventor of JavaScript.

Google's was written by Adam Barth, who's a software engineer and security researcher.

And both companies talk prominently about security and simplicity as a motivator for the projects:

Chromium uses a different multi-process architecture than other WebKit-based browsers, and supporting multiple architectures over the years has led to increasing complexity for both the WebKit and Chromium projects...

[Rust] is *safe by default*, preventing entire classes of memory management errors that lead to crashes and security vulnerabilities.

It's pleasing to see this sort of language prominent in new project announcements.

Google's writeup, indeed, explicitly talks about how many lines of code Mountain View expects to be able to remove from the Webkit codebase, which is a refreshing change from product announcements that talk up all the features that have been added since the last release.

Web developers might not feel quite as enthusiastic as I do, of course, because a brand new rendering engine means a brand new list of browser-specific pecadillos, a need for yet more special-case code tweaks, and a whole new environment to test.

Nevertheless, the principle of hybrid vigour suggests that breeding the next decade's browsers from a broader range of genetic starting material is unlikely to do any harm.

I think we should welcome these announcements as evidence that at least part of the battle in today's browser wars isn't vendor against vendor, but instead a collective fight against cybercriminality.

What do you think? Have your say in the comments below...

Follow @duckblog

Tags: barth, blink, browser, browser war, eich, Google, JavaScript, Mozilla, rust, Security, servo

View the original article here

WordPress.com boosts security for bloggers with two-factor authentication

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Automattic, the company behind the wildly-popular blog hosting platform WordPress.com, has announced the immediate availability of 2FA (two-factor authentication) for WordPress.com account holders.

Like Apple, which recently did something similar but chose to call it two step verification, WordPress has gone for its own name, referring to the feature as two step authentication.

Whether you call it 2FA, 2SV or 2SA doesn't really matter, because the underlying idea is the same: introduce single-use passwords that are unique to each login.

As a result, attackers can't get anywhere simply by stealing your regular username and password combination.

? There are many ways that a long-term password can fall into the hands of the bad guys. If you use the same password on multiple websites, you risk losing it if any of those sites get hacked. If you are infected with malware, you risk having your password keylogged every time you enter it. If you share your password with someone else, for example when you are in a hurry to get a time-critical business blog posted, you run the risk that they might lose it for you.

One-time passwords aren't perfect - no security system is - but they raise the bar steeply for cybercrooks.

That's because the crooks can't just beg, steal or borrow your password today and use it at their leisure tomorrow.

They need to interpose themselves every time you login, in order to recover the one-time code.

And if the one-time code is generated by, or delivered to, a device that is separate from the computer or device on which you actually do your work, then the job is even harder for the crooks. (Not impossible, of course. But much harder.)

For WordPress, Automattic has introduced two options.

You can download and use the Google Authenticator software and use it to generate one-time login codes on iOS, Android or BlackBerry devices.

Or you can choose to have your login codes delivered to a mobile phone via SMS.

With Wikipedia estimating that WordPress powers more than 60 million websites worldwide, anything that might improve the safety and security of WordPress users is to be welcomed.

After all, if malcontents get hold of your WordPress login, they can use it to attack you, your reputation, your brand, and, by uploading malware or malicious links, to attack your users.

It doesn't really matter if you have a high-traffic server or a boutique website, since both represent a free ride to the crooks.

And that brings us to the $64,000 question: if you're a WordPress user, should you enable this feature, and does it get in the way?

As you may know: Naked Security itself is hosted by WordPress.com VIP; I'm a keen supporter of 2FA; and I like the guys at Automattic...so who better to answer those questions than Yours Truly?

For what it's worth, I decided to use the SMS-based version, thus ensuring that my login codes are delivered neither to my laptop nor my tablet, but to a vanilla mobile phone.

This turns what might otherwise be merely two step authentication (where I login on the same device to which the code was sent) into something I consider to be two factor authentication.

It was easy to set up.

I headed to the Security tab of my WordPress Settings page:

I chose the link offering Two Step Authentication via SMS:

Within about five seconds I received a one-time, digits-only, setup code.

(Judging by the list of countries in the configuration dialog, the SMS service is available everywhere.)

WordPress emailed me to confirm that someone had enabled this new feature:

And then I clicked through to the Printing out some backup codes option to get hold of ten codes that I can use in emergencies:

NB. Do not store the backup codes on your computer, phone or tablet. Copy them down onto a piece of paper and lock them up at home. If a crook stole them from your PC, he'd be able to bypass 2FA, and then to reconfigure it.

Obviously, I haven't been using the service for very long - less than a day! - so I can't promise you that the system is going to perform flawlessly for ever, but my immediate impression is that it is working very well.

I login as usual, with my username and password, and then wait for a verification code, which I enter as the second authentication step:

So far, the SMSes have been appearing on my phone within a second of the verification dialog popping up, so the inconvenience has been negligible.

Should you enable the feature, and does it get in the way?

Yes. No. Recommended.

Follow @duckblog

View the original article here

A QQ-loving US soldier in Iraq is offering $120 to every reader of Naked Security

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Sgt Jack Lenz, a member of the US military stationed in Iraq, sent me the following email:

> I need a Loyal and trusting
> person

I'm your man! In return, I hope you can also be trusted, and aren't trying to steal my identity or con me out of paying "administration fees" before riches can be transferred into my bank account.

> Dear Friend,

Slightly presumptuous, but maybe he doesn't realise I'm English and not used to such early familiarity. He'll be giving me "high fives" next...

> I am one of US Military forces,
> and one of the few thousands
> still stationed in Iraq, I
> need to discuss some personal
> matter with you.

Uh-oh. This could be awkward...

> I know that it would be difficult
> to trust someone you hardly know
> because of the numerous scams
> transmitted via the Internet,

Tell me about it! I'm still waiting for Bill Gates to give me three million Euros, so I can clear my desk at Naked Security, tell HR where they can shove it, and drive off into the sunset...

But yes, thanks for the timely warning.

> but I am willing to send to you
> adequate proof of my identity as
> soon as we agree to work
> together,

You sound like an honest chap...

> and of course if I can be assured
> that you will not use that and
> any other information I would
> be sharing with you against me
> in anyway,

... and a sensible one. After all, you don't know me from Adam.

Who knows what ghastly mischief I might get up to if you were to carelessly share your personal information with me!? I've heard there are bad folks out there on the net, so you are right to be cautious.

> if my intentions are genuine, and
> for our mutual benefit.

> As you may be aware, the US
> government, the Treasury
> department, and the Federal
> reserve Board have concluded
> plans to change the face of the
> US $ bills because of
> counterfeiting as they claim,
> and the 100 $ bill made
> its debut since Wednesday,
> April 21st, 2010.kindly go
> through the below link to see
> what am trying to explain
> to you;

> http://news.bbc.co.uk/2/hi/7444083.stm
> http://www.cnn.com/2006/WORLD/meast/10/11/iraq.deaths/

I didn't know that, so thanks for the links.

> I will be in some kind of mess
> if I cannot find a solution
> to take care of some very
> large amount of money in US$
> bills that I have concealed
> here for 9 months.

Hang on a minute. It sounds like you have been hiding stolen money. Was it really wise for you to email me out of the blue, using your real name and email address?

> I will require someone outside
> Iraq to take care of the pick
> up, and that is what I want us
> to discuss. I am willing to offer
> you $6M (six million Dollars as
> your share for the role you will
> play if we agree to work
> together.

Six million dollars? SIX MILLION DOLLARS? You may be a very fine soldier, but your business sense is diabolical. Why would you start the negotiation by offering me - a complete stranger - so much money?

I would have been happy with $600, and a "Breaking Bad" DVD box set.

How am I going to explain six million dollars to the tax man?

And now you've left breadcrumbs across the internet, linking my email address to yours - if we go ahead with this business arrangement, haven't we just left clues lying around for the authorities to pick up? You sir, are an amateur!!!

> Please contact me so we can
> discuss the details, and
> should you have any reasons
> to reject this offer,
> please delete this mail and
> I will never bother you
> again. I appreciate your
> understanding.

> Respectfully,
> Sgt. Jack Lenz
> Sgt.jacklenz@qq.com

Well, at least you've given a different email address there from the one you emailed me from. QQ.com - isn't that a Chinese instant messaging wotsit?

A crafty way to throw people off our scent, and make them believe that you're a Chinese advance fee fraud scammer rather than a real member of the US military in Iraq. You may be a genius after all!

Although the tax man might get suspicious if I suddenly land a six million dollar windfall, don't worry! I think I have a solution.

The good readers of Naked Security can help you.

We get between 40,000-50,000 different people visiting Naked Security each day. If each one of them contacts you, maybe you could give each of them their share of the $6,000,000.

That comes to - let me think - something like $120 each!

Readers? What do you think? Are you up for it? Let us know if Sgt Jack Lenz honours the deal.

But maybe be careful not to give him any money in advance, or share any personal information. Just in case..

Follow @gcluley

Soldier in desert uniform image from Shutterstock.

View the original article here

Powerful new personal data disclosure bill proposed by California lawmaker

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Stop me if you've heard this one:

A consumer goes into a bar and walks up to a data broker.

"So tell me, where do you get data on me and 500 million other consumers?" she asks.

"Drop dead," the data broker says.

It's not a good punchline, but it is, more or less, the punchline given by nine data brokers (Acxiom, Epsilon, Equifax, Experian, Harte-Hanks, Intelius, FICO, Merkle and Meredith Corp.) when the US Congress asked them, last fall, to name their data sources and to explain what they're doing with the privacy-obliviating data they collect and compile.

The dossiers, as ZDNet's Violet Blue describes, are secret.

The data brokers' responses to Congress amounted to fluffy PR. They are listed on Massachusetts Congressman Ed Markey's website here.

Their coyness has irked the Californian legislature, which is poised to put its heavy foot down in the form of The Right to Know Act (AB 1291).

That legislation would require companies to give users access to the personal data stored on them, along with a list of all the other companies a given company has shared users' personal data with, whenever a user requests it.

The bill, supported by a coalition that includes the Electronic Frontier Foundation (EFF) and the American Civil Liberties Union (ACLU) of California, would cover California residents and would apply to both offline and online companies.

According to the EFF, under current California law, customers can ask what companies are doing with data and what companies have your personal data for marketing purposes, plus general facts about the type of data.

The EFF gives this example:

If you went to PetSilly and bought dog bones, and then PetSilly sold your data to 17 companies that were using it for direct marketing, you could ask PetSilly for an accounting of disclosures. PetSilly would have to provide you with the names of those 17 companies as well as what categories of information were disclosed (name, address, phone number, etc).

The proposed act would expand what the EFF calls an outdated transparency law, making it possible for consumers to find out all the myriad ways companies are profiting from the trafficking of their personal information, and updating the existing law to include digital-era data types such as location data.

One thing the law would specifically not do is limit data sharing or restrict its sale. Nor would it require additional security measures for data storage or anonymization.

In fact, the EFF says, The Right to Know Act is "written specifically to ensure that companies big and small will be able to tell Californians how they’re collecting and sharing your personal data," and it includes these three safeguards to ensure that even small companies with limited resources won't find it onerous to comply:

Companies can choose to not store unnecessary data. Or, if they must retain information, they could take protective measures to de-identify user data before retaining or disclosing it. Taking such measures would mean companies would not have to respond to data disclosure requests.If a company doesn't want to respond to individual requests for data disclosures, it can provide you with a notice about what data will be disclosed and to whom—just before or after it happens.Companies only have to provide each user an accounting once every 12 months. This safeguards against any repetitive requests.

The act would allow the US to begin to catch up with Europeans' superior consumer rights to data access.

One need look no further for examples of Europe's superiority in this regard than to the tale of Max Schrems, the Viennese man who squeezed 1,200 pages worth of his personal-data dossier from Facebook and who then filed 22 complaints with the Irish Data Protection Commissioner based on what he found.

Where is the US's Irish Data Protection Commissioner?

If the act passes in California and is emulated by other states (California is, in fact, a leader in consumer privacy rights), perhaps the USA's own DPC will have a chance to emerge.

The EFF has provided this site for Californians to register support for the act.

If you don't live in California, please pass the link on to those in your network who do.

It's high time for the US to emulate Europe's example.

Follow @LisaVaas
Follow @NakedSecurity

Binary eye image from Shutterstock.

View the original article here

Is security really dead? Perhaps it's your lack of depth

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

I attend a lot of conferences. I mean a LOT of conferences. There has been a growing theme at all of these events among practitioners...

Firewalls are dead. Anti-virus is dead. IDS/IPS is dead. [insert security product X here] is dead.

Meanwhile, all of the presentations at these conferences tell us why product Y is garbage and company Z is incompetent and how to break SSL into tiny pieces.

Where have all the defenders gone? Is it a lost cause? Are we well and truly hopeless and defeated?

Absolutely not. In fact it is one of my favourite reasons to attend a Security BSides event. Real local IT people sharing actual techniques that are helping them defend their organizations.

That is the real story to be learned if you want a more effective defense. No one tool or technique is going to save your bacon.

If you want to present at a conference and prove how you can break any given tool, you won't have too much difficulty.

If you want to present at a conference about effectively combining technologies to increase attack complexity, you may have a tougher fight.

Therein lies the truth. There are many different approaches to breaking into an organization, which unfortunately means we need to combine just as many techniques for an effective defense.

This is one of the things Sophos recognized early on about endpoint security.

Why sell web protection, firewall, anti-virus, HIPS, DLP and device control as separate SKUs when you need all of them to properly defend your endpoints?

Don't have every application patched on every workstation? Gateway web protection can help stop Blackhole exploit kit and its ilk from weaseling its way in through that hole.

Think your firewall is there to keep things out? Perhaps it is time for a new approach. Not only should it be used to keep things in, but the logs it generates may be one of your most valuable assets.

Finally completed that project to encrypt your laptops? USB sticks? What about the cloud?

Most organizations already have these tools, the question to be asked is whether they are deployed in a complementary manner.

All of these tools have weaknesses, but the whole is greater than the sum of its parts. You don't always need to buy a new widget, sometimes it is simply how you use what you have.

If you are interested in learning more about defense in depth in the 21st century you may want to join me for a webcast explaining this in more detail.

It's called "Breaking the chain of criminality: Fighting malware one link at a time" and will be live on GoToWebinar at 2pm EDT, 10am PDT, 6pm UTC on Thursday 11 April 2013.

The harder we make it on the attackers, the more likely we are to defend our asse(t)s. I hope you can join me and bring your questions for a lively Q&A at the end of the webinar.

Follow @chetwisniewski

Webinar and toe tag images courtesy of Shutterstock, photo of me speaking at BSides from Rob Slade's Twitter feed.

View the original article here

Ransomware scares victims with child sex abuse images

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

SophosLabs has received a number of disturbing reports from German computer users about a ransomware malware attack that is locking computer screens, and demanding payment of a fine.

Like other ransomware attacks, a message appears claiming to come from the police that says that evidence gathered proves that the computer has been used to view pornography involving minors.

Unlike most attacks, however, the warning message also includes images of the purported sexual abuse of children, along with the minors' names, dates of birth and location.

Some of the images claim to be of girls as young as 13 years old. Obviously, we are unable to confirm if the people pictured in the images are as young as the bogus police warning message claims.

However old the people in the pictures really are (and some of them *do* look under-age), it's easy to imagine how people who see what appears to be an official police warning, alleging that child porn websites have been accessed, and finding that their computer has been locked, could easily be scared into paying a fine to the cybercriminals behind this attack.

Naturally we have informed the authorities - including our colleagues at the Internet Watch Foundation - so they can work with their partners worldwide, and we have censored the images used in this article.

SophosLabs hasn't received any reports of sightings of the ransomware from UK computer users, but if the webpage is visited from a UK IP address the message adjusts itself to pretend to come from the Metropolitan Police rather than the Bundeskriminalamt:

Your Personal Computer has been blocked

The work of your computer has been suspended on the grounds of unauthorised cyberactivity

All the illegal actions that you performed on this computer were recorded and classified in the Police Database. This also includes photos and videos that were taken by your web camera for further identification. You've been charged with viewing pornography that involves minors.

The computer's IP address and internet service provider is also displayed, and in the corner of the screen can be seen a live video image from the computer's webcam.

There have been a spate of attacks in the last year, where computer users have discovered their computers frozen by messages purporting to come from the police, and claiming to have gathered webcam evidence of who was using the computer at the time of the alleged offence.

Perhaps the most famous example of ransomware malware is Reveton, described by Paul Ducklin in the following great video:

Spanish police arrested more than a dozen members of a multi-national Reveton gang earlier this year.

Whether the latest ransomware impacting German computer users is related to Reveton is currently unclear, and malware experts at SophosLabs are continuing to investigate the attack. Sophos products have already been updated to block access to the offending website where the messages are displayed.

How to report online child abuse
If you have information about online child abuse that you wish to report to the authorities, visit the websites of the Virtual Global Taskforce, CEOP (the Child Exploitation and Online Protection Centre) and the IWF (Internet Watch Foundation) which provide a reporting mechanism.

Follow @gcluley

Thanks to Dirk Kollberg and Paul Baccas of SophosLabs for their assistance with this article.

Tags: BKA, Bundeskriminalamt, child abuse, Germany, Internet Watch Foundation, iwf, Malware, Metropolitan Police, ransomware, reveton, sexual abuse, UK

View the original article here

Scribd, "world's largest online library," admits to network intrusion, password breach

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

San Francisco-based document sharing site Scribd has admitted to a network intrusion.

Scribd bills itself as The World's Largest Online Library, and with a suggested 50 million users or more, it's hardly surprising that the site has attracted the attention of cybercriminals.

Details are scant, but a notification published on the company's online Support Desk states:

Earlier this week, Scribd's Operations team discovered and blocked suspicious activity on Scribd's network that appears to have been a deliberate attempt to access the email addresses and passwords of registered Scribd users.

Because of the way Scribd securely stores passwords, we believe that the passwords of less than 1% of our users were potentially compromised by this attack.

We have now emailed every user whose password was potentially compromised with details of the situation and instructions for resetting their password.

Therefore, if you did not receive an email from us, you are most likely unaffected.

The comment that less than 1% of users were potentially compromised "because of the way Scribd stores passwords" could probably have been made more clearly.

At first blush, I was inclined to interpret this to mean that 99% of passwords were stored securely, presumably by salting and hashing, leaving only a small proportion open to the scrutiny of intruders.

? We've seen cases before where websites have upgraded their password handling systems to make them safer, but seem to have failed to migrate all users to the new system in a timely fashion, leaving some users in an insecure limbo.

The good news, if you read on, is that it looks as though none of Scribd's passwords are stored in cleartext, as the company goes on to say that:

Our investigation indicates that no content, payment and sales-related data, or other information were accessed or compromised. We believe the information accessed was limited to general user information, which includes usernames, emails, and encrypted passwords.

Scribd isn't claiming any certainty in what was taken (the verb believe implies acceptance without proof), but that's not unexpected.

Determining precisely what was stolen after an electronic break-in is tricky, and pedantic readers will be quick to point out that, technically, nothing was stolen because the original copies of the data remained behind.

Scribd also isn't clarifying how the passwords were encrypted, and the company probably doesn't actually mean encrypted, either.

Salting and hashing passwords is supposed to be a one-way process that allows the passwords to be verified, but not decrypted to reveal the original cleartext.

Assuming they were hashed and salted, then, stealing the password database doesn't directly reveal anyone's password.

But it does let the crooks mount an offline attack on the database, hashing a dictionary of passwords one-by-one and noticing when a guessed password is verified against the database of hashes.

And since Scribd isn't saying what password security algorithm it used, you have little choice but to assume it was a hashing process that doesn't slow down determined attackers much.

That's why the following behaviours are important:

When you choose a password, don't pick anything obvious. Attackers put the most likely passwords at the top of their dictionary lists, so the tougher your password, the later it will fall, if at all.Don't use the same password on multiple sites. Doing so means that your login details on the most important site are at risk from an attack on the least secure one.If you store password databases, use a strong salt-and-hash system (e.g. bcrypt, scrypt or PBKDF2) that makes it much harder and slower for attackers to go through their password dictionary, but not so slow that it's impracticable to verify individual passwords when your users login.

Scribd has put up an online "breach checker" which lets you check individual email addresses against the list of probably-pwned accounts:

It would have been a nice touch if the company had used HTTPS for this particular page, rather than sending your email address, and the notification of whether it was on the at-risk list, via unencrypted HTTP:

On the other hand, since anyone can check anyone's email address anyway, and since you probably received an email advising you to change your password already if your account was potentially pwned, it probably doesn't matter.

To learn more about managing, choosing and policing passwords in your organisation, why not listen to our popular Techknow podcast on this very topic?

(If you prefer to listen offline, you can download the podcast for later.)

Follow @duckblog

View the original article here

Bill Gates offers $5000 for Facebook sharing? It's just not that funny

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Bill Gates may be a billionaire, but if he's going to splash his cash around he's got better things to do with it than give it to people who simply share a photo of him on Facebook.

That hasn't, however, stopped almost 400,000 people on Facebook from sharing an image of the Microsoft founder, holding an (obviously Photoshopped) message:

Hey Facebook,

As some of you may know, I'm Bill Gates. If you click that share link, I will give you $5,000. I always deliver, I mean, I brought you Windows XP, right?

Clearly, no-one is going to receive any money for sharing the image. And chances are that the picture was meant as a joke (although it would have been funnier if the message hadn said Windows Vista rather than Windows XP, or referenced Microsoft Bob, or reminded people of Bill Gates's claim that spam would be killed off by 2006).

On this occasion, the message being spread across is harmless. It doesn't trick users into clicking on a dangerous link, or fool them into installing a rogue application. It is, of course, adding to the general "noise" on Facebook and some might consider it unwanted spam.

But the more you share "jokes" like this, and the more used your friends and family become to you spreading such material, the more likely it is that you're fostering an atmosphere where forwarding chain letters, hoaxes and jokes is considered the norm.

And the more you share material like the picture above, the *less* out of place a *real* scam or malicious link will appear to your friends and family when your Facebook account gets compromised.

So, call me a kill-joy if you like, but jokes like this aren't necessarily going to end up with everyone amused.

Don't forget you should join the Naked Security from Sophos Facebook page, where we keep you up-to-date on the latest hoaxes, scams, security and privacy issues affecting Facebook users.

Follow @gcluley

View the original article here

Microsoft to issue 9 security updates on Tuesday, critical for all IE versions, reboot required

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Microsoft has issued its routine advance notification for the coming week's Patch Tuesday.

As usual, the "pre-announcement" is a bit like a bikini: interesting more for what it conceals than what it reveals.

Nevertheless, there's enough to make sure you're ready for Tuesday 09 April 2013 (or Wednesday, of course, if you live at the longitude of about Thailand or further east).

This month's nine updates don't sound too onerous, with just two at critical level and the remaining seven important, but the critical ones affect Internet Explorer (IE) and Windows itself, and the IE fix will require a reboot.

Just so you know.

Importantly, the IE update applies to all supported versions of the browser, from IE 6 to IE 10, on all supported version of Windows, from XP and Server 2003 to Eight and Server 2012, in both 32-bit and 64-bit flavours.

Server Core installs, happily, aren't affected by either of the two critical flaws.

? Internet Explorer isn't part of a Core install, which doesn't support GUI applications for safety's sake. This reduces your attack surface area tremendously and you should go for a Server Core installation whenever you can.

As you may have seen, there has been plenty of speculation that the critical updates will include patches for the IE vulnerabilities exploited in the recent PWN2OWN competition.

Mozilla and Google triumphantly rushed out patches to the holes in Firefox and Chrome that were found at PWN2OWN, closing down the vulnerabilities within 24 hours.

As we remarked at the time, this certainly threw down the patching gauntlet to Microsoft, though we also pointed out that:

Redmond, to be fair, has many more products with much more complex inter-relationships to juggle than Mozilla, and even Google.

With the PWN2OWN rules this year requiring responsible disclosure, meaning that winners had to reveal their attacks to the affected vendors and allow time for a considered and tested fix, it wasn't actually necessary for Microsoft to rush.

If Redmond's security team does fix IE's PWN2OWN bugs on its offical April patch day, it will in my opinion have done a timely job, but until Tuesday, Microsoft is keeping the details up its sleeve.

Note that five of the non-critical patches fix what's known as elevation of privilege, a trick that allows untrusted software to do things beyond its official authority.

Usually, that means a program running as a regular user can complete operations that would normally require administrator privileges, such as modifying system settings or altering critical files,

As you can imagine, attackers often combine RCE, or remote code execution, with EoP, or elevation of privilege.

They use the RCE to escape from the strictures of your browser, or some other interactive application, and then the EoP to escape from the limitations of your regular login account.

Either sort of exploit is dangerous on its own, but together they are much more harmful.

So plan to patch all the holes, not just the critical ones, and watch out on Naked Security and the SophosLabs Vulnerabilities page for our analysis and assessment of the updates once we're clear to publish.

(We have to wait until Microsoft has made the updates live before we give away any details.)

Bonne chance!

Follow @duckblog

View the original article here

Rohypnol, rape and other disturbing content. Isn't it about time Facebook cleaned up its act?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

"People use Facebook to stay connected with friends and family, to discover what’s going on in the world, and to share and express what matters to them."

Those are the words of Facebook itself. And there's nothing wrong with that.

But, unfortunately, it doesn't tell the whole story.

There are also people who use Facebook to bully others, to spread hate speech, to defraud, spam, and commit online crimes.

In October 2012, when Facebook reached one billion active monthly users, CEO Mark Zuckerberg said he was "committed to working every day to make Facebook better for you".

If compared to the populations of countries, Facebook's more than a billion users dwarfs the likes of the United States, Indonesia and Brazil and is only outranked by China and India. In short, Facebook is colossal.

But what marks out Facebook for special attention is how it polices those many many millions of people.

A quick search on Facebook, using the most obvious of search terms, finds plenty of ghastly content that many good-minded people would find disturbing.

I'm not talking about Facebook pages like "Embarrassing Nightclub Photos", whose whole raison d'être appears to be to humiliate "tired-and-emotional" party-goers - many of whom probably wouldn't have given permission for a photograph of them to be shared on Facebook, if anyone had bothered to ask.

"Embarrassing Nightclub Photos" isn't my cup of tea, but clearly there's an audience for this kind of material (the page has over 160,000 Likes) who have no qualms about checking out and sharing images of people unconscious through over-drinking, who are so drunk they've become incontinent, or have been snapped midway through a vomit.

What is more disturbing to me are pages which take things a sinister step further.

For instance, there are pages extolling the virtues of the date-rape drug Rohypnol which use images of young women in either a drunken or comatose state.

In the following, and other examples used in this article, we have pixellated out the faces of individuals - something which the original posters on Facebook seemingly didn't care enough to do.

ROHYPHNOL

When traditional dating methods just aren't cutting it!

Is that a funny joke to you? An ill-conceived bad taste joke about rape? Or something more sinister? No doubt, you have your own point of view, and whether Facebook should do more to prevent this kind of content from being shared.

In case you forgot, here's how Facebook describes what it is used for:

"People use Facebook to stay connected with friends and family, to discover what’s going on in the world, and to share and express what matters to them."

One wonders how that sentiment sits alongside the "Roofies" page on Facebook, which has over 650 Likes, and a motto which appears to condone use of the Rohypnol date rape drug.

"Roofies", for the uninitiated, is slang for Rohypnol and other sedative pills that can be used to facilitiate sexual abuse.

ROHYPNOL ROOFIES When "Nooosshh..zzzzz means "Yes"

Pretty unsavoury stuff, I'm sure many of you'll agree. And there are plenty of other posts on the page which can only be described as pro-rape and against a woman's right to decide if she wants to have sex or not.

And there's more. A simple search of Facebook using offensive phrases can bring up no end of unpleasantness.

If you were a Facebook advertiser, how would you feel about your advertisement appearing on Facebook pages containing that kind of content? Is it something your brand would like to be associated with?

If it only took me a few seconds of searching to find content like this on Facebook, why can't Facebook search for similarly offensive phrases and take action against unsavoury content.

It's not as though only the only users of Facebook are broad-minded, unoffendable, adults.

Although young people under the age of 13 years old aren't allowed to log into Facebook, it's estimated that millions of pre-teens do go onto the social network every day. They, like the rest of us, can easily come into contact with this kind of offensive material on Facebook. They may even end up the victims of some of it.

Sadly, the onus is on Facebook users themselves to report abuse - which (might) then be followed-up by Facebook's four different abuse teams.

According to Facebook, abuse complaints are normally handled within 72 hours, and the teams are capable of providing support in up to 24 different languages.

If posts are determined by Facebook staff to be in conflict with the site's community standards then action can be taken to remove content and - in the most serious cases - inform law enforcement agencies.

Facebook has produced an infographic which shows how the process works, and gives some indication of the wide variety of abusive content that can appear on such a popular site.

The graphic is, unfortunately, too wide to show easily on Naked Security - but click on the image below to view or download a larger version.

Of course, you shouldn't forget that just because there's content that you might feel is abusive or offensive that Facebook's team will agree with you.

As Facebook explains:

Because of the diversity of our community, it's possible that something could be disagreeable or disturbing to you without meeting the criteria for being removed or blocked. For this reason, we also offer personal controls over what you see, such as the ability to hide or quietly cut ties with people, Pages, or applications that offend you.

My own experience from a few years back (when my wife's life was threatened, I was labelled a paedophile, and Facebook users warned that they would burn my house), was that Facebook chose to take no action until the press got wind of the story.

I would like to think things have got better since then - but the emails we receive at Naked Security from Facebook users suggest many still feel they aren't being properly protected from Facebook abuse.

The sheer amount of offensive material residing on Facebook says to me that leaving it up to the community to report offending content isn't working.

In my opinion, Facebook needs to invest resources and technology into pro-actively cleaning up its community, rather than relying on the community to police itself.

We would be interested in hearing about your experiences when you report abusive content to Facebook. Were you happy with Facebook's reponse? Join the discussion on our Facebook page

Follow @gcluley

View the original article here

Anatomy of a bug - misplaced parenthesis threatens NetBSD's random numbers

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Oh, frailty, thy name (with apologies to [William {The Bard}] Shakespeare) is parenthesis.

What a difference a misplaced bracket makes!

As our friends at The Register reported last week, the NetBSD coders recently patched a programming bug in their kernel that affected the sanctity of the operating system's random numbers.

And, as we have explored before on Naked Security, good quality random numbers are a vital aspect of modern computing.

In particular, cryptography requires random numbers that are not only random (meaning that there is no bias towards ones or zeros in the bits that appear), but also unpredictable (meaning that you can't guess what comes next even if you have an extensive collection of previous output).

Modern Unix and Unix-like operating system kernels typically provide two commonly-used sources of randomness, named /dev/random and /dev/urandom.

Both mix in input that isn't entirely dependent on software, such as mouse movements, disk latency measurements, network traffic, keyboard activity, and more.

? Mouse and keyboard movements are not a terribly good source of entropy, as "lack of order and predictability" is called in the field of random numbers. Indeed, user interaction never happens on headless servers. But mixing in at least some data extracted from the real-time behaviour of the underlying hardware, especially measurements that are affected by external factors such as temperature or load imposed by other devices on the network, helps to reduce the predictability of algorithmically generated output.

In practice, the difference between urandom and random is that the former continues unabated even if the external entropy feed runs dry, falling back on purely software-based output, while the latter stream of data may block, meaning that a program reading it will freeze until the entropy pool acquires some new input.

You can demonstrate this on a Unix-like system by running the command od -Ax -t x1 /dev/random and letting it run:

Every now and then, you should see the output pause for a while as the system's hardware-derived entropy pool dries up; wait a while (or wiggle the mouse to provide some external input to the pool) and the flow of random bytes should resume.

So, part of the promise of /dev/random is that it tries really hard to be random.

In NetBSD, which uses an AES-128-based random number generator keyed independently for each process that uses /dev/random, fulfilling that "promise" was done with code in C similar to this:

Turned into pseudocode, this is supposed to achieve the following result (the variable key is an AES-128 cipher key, 128 bits or 16 bytes in length):

read up to 16 bytes of high-quality random dataif we got fewer that 16 bytes then: produce a warning about entropy top up the 16 bytes with lower-quality data

Even if there is a shortage of high-quality entropy data, your random number stream will nevertheless consist of AES output keyed by a full 16 bytes of at-worst-pseudorandom data that is unique to your use of /dev/random.

Except that the C code above doesn't actually do what was intended. It was supposed to be:

Notice the subtle-yet-critical difference between sizeof(key-r) and sizeof(key)-r.

Due to the pecadilloes of C, sizeof(key) works out to be the size of the memory buffer key, which is defined in the NetBSD code similarly to this:

unsigned char key[16]; /* 128-bit AES */

Since r is the number of high-entropy bytes read in so far, sizeof(key)-r, which is what the programmer meant to write, works out to be the number of bytes by which r fell short of 16.

So, topping up the original r bytes of random data with a further sizeof(key)-r bytes of pseudorandom data ensures that a full 16 bytes of random data (whether of GOOD or ANY quality) are always used to seed the random generator.

This is so because, perhaps rather obviously, r plus sizeof(key)-r is equal to sizeof(key), i.e. 16.

But the programmer wrote sizeof(key-r) by mistake.

That doesn't really make sense, at least to a human, since sizeof() in C usually produces a constant determined at compile time, while r is the variable amount of data read in at runtime.

Sadly for NetBSD, however, a fixed memory address (in this case, the address of key) plus or minus a variable integer (in this case, r) is considered by the C compiler to be an address with an offset: in other words, just another memory address.

And so sizeof(key-r), computed at compile time, is equivalent to sizeof(the space needed to store any memory address), i.e. the sie of a pointer variable.

That is not the same thing as sizeof(memory actually dedicated to the array variable key).

Indeed, on a 64-bit system, sizeof(key-r) is 8; on a 32-bit system, with 32-bit memory addresses, it's only 4.

So, in the worst case, the erroneous code might perform as follows:

read up to 16 bytes of high-quality random dataoh dear, no high-quality data at all, so: produce a warning about entropy rely on just 4 bytes of lower-quality data

The bug was easily fixed, although it has been fixed again since The Register's article last week, following a decision that the original fix wasn't entirely satisfactory:

The good news is that in fixing the fix, the coder reviewing the original error came to the conclusion that even an ineptly-keyed random stream would probably not be predictable.

That's because the random generator continues mixing in additional input between the initial "keying" stage and the point at which the user starts getting data from it, adding entropy over and above the minimum four starting bytes.

Nevertheless, there are two lessons here that every C programmer needs to remember:

Watch those brackets.The sizeof() operator isn't a function.

Follow @duckblog

View the original article here

"We apologise for the previous apology" - NZ gov dept in email CC: double-blunder

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

When you send an email to a group of recipients who don't already know each other, you use BCC:.

Don't you?

Let us quickly revise why.

The users in the To: field (primary recipients) and the CC: field (secondary recipients) of an email get a copy of the message, including the headers To: and CC: themselves.

(CC means "carbon copy", by analogy with old-school carbon paper.)

That means they can each see the names of all the other primary and secondary recipients.

For an email such as the minutes of a meeting, it's often desirable to CC: all those who were present, since it means that everyone can see that everyone else got a copy of minutes.

The BCC: list (blind carbon copy), however, is not included in the email, so that:

The primary and secondary recipients don't know that the BCC: recipients saw the email.The BCC: recipients don't know who else was BCCed.

For this, reason, BCCing emails that already have a small, closed circulation list is often considered slightly devious or underhand: the sort of thing you might do to curry secret favour with your boss, or to leak the minutes of an internal communication to an outsider.

On the other hand, CCing a mailing list where each user has signed up independently is considered unsatisfactory.

That's because the mailing list database is supposed to be private, yet CCing everyone on the list publicises the whole list to everyone on it.

And CCing one customer's email address to another, or a list of customers to a competitor, isn't likely to make any of those customers very happy.

Even worse, of course, is that inappropriately CCing emails to an entire mailing list publicises the whole list to any spammer or scammer who gets hold of any of those emails.

And since emails frequently get forwarded, or saved on hard disks that later get scoured for email addresses by spam-sending malware, or uploaded onto online forums with all their content intact, CCed lists of email addresses aren't just a security irrelevancy.

? It might not sound too serious to CC an email to 20, 50 or 100 people who don't already know one another, but even if nothing deleterious happens as a direct result, it's a bad look for the sender.

So we had to smile (wryly, of course) when Naked Security reader hotdoge3 pointed us at a story from New Zealand in which a government department made a carbon-copy blunder by sending a "thanks for submitting your comment" email via CC to everyone who had submitted a comment via its website.

Assuming that the submissions were supposed to be anonymous, or at least private and individual, that's a mistake that really ought to have been avoided.

Thankfully, with only 150 people allegedly on the CC: list in the first place, the scale of the leakage was small.

But the story took an amusing twist when the Ministry for the Environment followed up with an "our fault, really sorry about that" email that was itself CCed to everyone.

And this, in turn, prompted a third email (apparently avoiding yet another round of recursion by correctly using BCC:, not CC:) to apologise, in a way that would have made Monty Python proud, for the previous apology.

The lessons to be learned are:

The To: and CC: headers are revealed to every recipient.The BCC: header is not.Don't put multiple recipients in CC: unless you intend them to see each others' addresses.Leaking email address lists via CC: helps spammers and scammers, even if only slightly.CCing customers' email addresses to other customers is unlikely to make a good security impression.Think before you send, and if in doubt, use BCC: .

Follow @duckblog

View the original article here

"Rude password - login denied": the AT&T April Fool that wasn't

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Earlier today, fellow Naked Security writer Graham Cluley pointed me at a fantastic April Fool's story.

AT&T, the tall tale told, had introduced a policy that prohibited passwords that "contain obscene language."

There was even a handy screenshot to add some vernal veracity (or autumnal authenticity in the Southern Hemisphere):

"Very droll," I thought.

After all, it surely wasn't true, since:

How would they tell? (Computers aren't yet that smart at understanding the nuances of human language.)Why would they care? (Passwords aren't for other people to know.)Who would ever see it? (Passwords aren't stored in plaintext. They're salted and hashed.)

In short, unless a human, fluent in dozens of languages, were to review your choice, there wouldn't be much hope of reliably and usefully detecting a password couched in obscene terms.

Anyway, no human except you is ever going to see your password in cleartext, and even you will probably only ever see it as a series of **** characters in a password entry dialog.

But it looks as though this is a true-but-wacky story rather than an April Fool.

Some of AT&T's other limitations make sense, such as preventing your username and password from being the same, and checking against a list of commonly-used bad choices to urge you in the right direction when picking a new password.

For web-based logins, much of that sort of validation can be done in client-side JavaScript, so that poorly-chosen passwords never leave your browser but are rejected (presumably with some helpful explanation) straight off the bat.

But how, and for that matter why, would you go about weeding out every password that might contain obscene language?

Would you back yourself to write computer software that could sensibly detect text that "offends against moral principles" or is "repugnant", in the no-nonsense terminology of the New Oxford American Dictionary?

Or would place names like Scunth0rp3 and M1dd13s3x fall feebly foul of the regulations, as they used to in the early days of naive obscenity filters?

? Those are poor choices for passwords, if only because they're words from a dictionary, or at least from a gazeteer. But they should fail on those grounds, not because they fall foul of some kind of substring or regular expression match against swear-words.

The problem is, of course, that a "no obscene language" rule introduces more concerns that it will ever solve, including the following:

The more extensive the server-side obscenity checking, the more likely it is that the plaintext of your password will needlessly be written to disk or sent off to other run-time verification scripts.The desire to have visually inoffensive passwords raises the concern that the intention is to store them reversibly, accessible to support staff for password recovery purposes, rather than salted and hashed for safety.Many strong and randomly generated passwords will be rejected because they contain some sort of potential "obscenity", thus needlessly reducing the available password entropy and assisting password crackers to skip over known-prohibited combinations.

In fact, a Twitter network engineer claims to have spotted this AT&T limitation when a randomly-generated password was rejected:

In short, it's good to prevent your users from choosing obviously-risky passwords such as letmein and pa$$word.

But rules that illogically reject a potentially large swathe of letter and number combinations serve only to reduce the range of otherwise-excellent passwords available for use, and to simplify the task of password crackers in pre-filtering their own lists of password candidates.

And there's that nagging suspicion that the requirement for "obscenity-free" passwords implies that someone else might see them some day and be outraged, or that they might end up mailed to you in plaintext and blocked by a naive spam filter somewhere on the way.

And that shouldn't be possible, since your password shouldn't be stored reversibly in the first place.

Follow @duckblog

View the original article here

TDoS attacks target US emergency call centers

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Emergency call centers in the US are suffering a rise in TDoS (telephony denial of service) attacks, according to an alert issued recently by the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI).

According to the alert, reposted [PDF] on security journalist Brian Krebs's site, dozens of attacks have targeted PSAP administrative lines (not the 911 emergency line), tying up the system from receiving legitimate calls.

Air ambulance, ambulance and hospital communication lines have been targeted, in addition to various businesses and public entities, the alert goes on, including the financial sector.

The recent attacks are aimed at extortion. Here's how they work, according to DHS and the FBI:

An individual calls, claiming to represent a payday loan collections company.The caller typically has a strong accent and asks to speak with a current or former employee about an outstanding debt.The caller demands payment of $5,000 because an employee (who no longer works for the company or never did) defaulted on a loan. When the target fails to cough up the money, the attacker launches a TDoS.The organization is then inundated with a continuous stream of calls for an unspecified but lengthy period of time.Phone service is disrupted, preventing incoming and/or outgoing calls.

The agencies are speculating that these businesses and emergency services in particular are being targeted because phone lines are crucial to their operations.

The current TDoS attacks are, at this point, skipping over emergency service 911 lines.

Emergency hotlines aren't always spared in TDoS attacks, of course.

UK police last year arrested two teenage boys following a series of prank calls and TDoS attacks launched against the Anti-Terrorist Hotline.

More recently, as CSO's Antone Gonsalves notes, last month, the Louisiana State Analytical and Fusion Exchange, a center for distributing information across law enforcement offices, reported a similar extortion scheme against two public sector entities, including a 911 call center.

The current attacks against US emergency services, which last for intermittent time periods over several hours, are creating a deluge of calls large enough to force roll-over to alternate facilities, the FBI and DHS reported.

The attacks are sporadically re-starting over weeks or months.

While these attacks are clearly profit-motivated, past TDoS attacks have been, apparently, pranks, albeit on the malicious side.

In 2008, it was the Gladys Porter Zoo in Houston, Texas that suffered a barrage of calls after cryptic SMS text message spam was sent to thousands of people, saying things like:

Call now someone is looking for you.Call now and we will settle this.Somebody talking down on you, look for themHey y is someone calln me and lookn for u n askn me where r u at n where u live heres tha # tell then to stop calln me

...and telling them to call the zoo's number. The phone-clogging continued on into May, when the zoo eventually threw in the towel and called in the FBI to help.

Dublin Zoo suffered a similar fate around the same time, with at least 5,000 people receiving SMS text message spam that prodded them to urgently ring the zoo's phone number and ask for a fictitious person (Rory Lion, Anna Conda, C Lion or G Raffe according to news reports such as this one from the Irish Independent).

Whether TDoS attacks are launched as pranks, as vendettas, or as extortion schemes, they serve to cripple their targets.

Zoos don't deserve that any more than ambulance services or the like.

The stakes, however, are potentially higher when you're talking about crippling life-saving businesses. Even if these attacks aren't targeting 911 emergency lines, they still reflect a blatant disregard for humanity.

Please, if you can help the DHS or FBI pull the plug on these malicious schemes, fill them in on the details of any attacks that have targeted your business, and encourage your peers to do the same.

The agencies have offered these recommendations for targeted organizations:

Don't pay the blackmail. Report all attacks to the FBI by logging onto the website http://www.ic3.gov/default.aspx. Use the keyword "TDoS" in your report title. Identify your organizations as a public safety answering point (PSAP) or Public Safety organization. List as many details as possible, including: Calls logs from the “collection” call and TDoS Time, date, originating phone number and traffic characteristicsCall-back number to the “collections” company or requesting organizationMethod of payment and account number where the “collection” company requests the debt to be paidAny information that you can obtain about the caller, or his/her organization Contact your telephone service provider; they may be able to assist by blocking portions of the attack.

Follow @LisaVaas
Follow @NakedSecurity

Red telephone, call center operators and text message images from Shutterstock

View the original article here