Official describes rampant computer hacking at VA

WASHINGTON (AP) -- At least eight foreign-sponsored organizations, mostly connected to the Chinese military, have hacked into computer networks at the Veterans Affairs Department in recent years or were actively trying to do so, a former VA computer security chief told Congress on Tuesday.

Jerry Davis, who served as the VA's chief information security officer until February 2013, testified at a House subcommittee hearing that the VA became aware of the computer hacking in March 2010 and that attacks continue "to this very day."

Davis said the hacking "successfully compromised VA networks and data," but he did not indicate to lawmakers how the information may have been used. The intrusions raise the potential for identity theft and could complicate efforts to share data with the Pentagon, long viewed as key to quicker processing of disability claims.

"The entire veteran database in VA, containing personally identifiable information on roughly 20 million veterans, is not encrypted, and evidence suggests that it has repeatedly been compromised since 2010 by foreign actors, including in China and possibly in Russia," said Rep. Mike Coffman, R-Colo., chairman of the House Veterans' Affairs oversight and investigations subcommittee.

Officials with the VA's inspector general's office said the main threat to veterans would appear to be credit card theft. They could not point to any specific instances in which such fraud has occurred because of foreign agents. While foreign hackers had obtained access to the emails of senior VA managers, investigators did not know what had been done with the emails.

Davis, who now works at NASA, singled out China's military as responsible for hackings at the VA. In talking to a reporter after the hearing, he said six of the eight foreign-sponsored organizations he spoke of during the hearing were connected in some way to the People's Liberation Army. Davis said the data the foreign hackers accessed included such things as Social Security numbers and dates of birth. He said officials know that some information was encrypted and removed from the VA's computers. Officials should assume that if such information was accessed, then it went out as well.

When asked by a reporter if the information removed included such things as Social Security numbers, he replied "it's the safe bet."

Linda Halliday, an assistant inspector general, said investigators were seeing fewer weaknesses with the VA's computer security, but she told lawmakers that 4,000 weaknesses and vulnerabilities have not been addressed. She cited weak passwords and user accounts with inappropriate access as among the most common problems.

Stephen Warren, acting assistant secretary for information and technology at the VA, said the state of computer security at the VA was something he wrestled with continually, but the inspector general's citation of security threats dealt with what could go wrong. He said that's not the same as the removal of information from the VA's computers.

"We're talking about potential. We're not talking about actuals," Warren said in describing the computer security problem at the VA.

Warren told lawmakers he disagreed with Coffman's assessment that the VA's computer systems had been compromised repeatedly by foreign entities. He said he knew of only one such instance. He declined to cite which country that involved, saying he would prefer to discuss it in a closed session.

At another point in the hearing, Warren said he was aware of more than one foreign entity that had attempted to hack into the VA's systems. He said such attacks go beyond foreign governments, but through crime syndicates seeking financial gain.

View the original article here

Cyber experts say calling out China may be working

SINGAPORE (AP) -- After years of quiet and largely unsuccessful diplomacy, the U.S. has brought its persistent computer-hacking problems with China into the open, delivering a steady drumbeat of reports accusing Beijing's government and military of computer-based attacks against America.

Officials say the new strategy may be having some impact.

In recent private meetings with U.S. officials, Chinese leaders have moved past their once-intractable denials of cyber espionage and are acknowledging there is a problem. And while there have been no actual admissions of guilt, officials say the Chinese seem more open to trying to work with the U.S. to address the problems.

"By going public the administration has made a lot of progress," said James Lewis, a cybersecurity expert at the Center for Strategic and International Studies who has met with Chinese leaders on cyber issues.

But it will likely be a long and bumpy road, as any number of regional disputes and tensions could suddenly stir dissent and stall progress.

On Wednesday, China's Internet security chief told state media that Beijing has amassed large amounts of data about U.S.-based hacking attacks against China but refrains from blaming the White House or the Pentagon because it would be irresponsible.

The state-run English-language China Daily reported that Huang Chengqing, director of the government's Internet emergency response agency, said Beijing and Washington should cooperate rather than confront each other in the fight against cyberattacks. Huang also called for mutual trust.

President Barack Obama is expected to bring up the issue when he meets with China's new president, Xi Jinping, in Southern California later this week. The officials from the two nations have agreed to meet and discuss the issue in a new working group that Secretary of State John Kerry announced in April. Obama's Cabinet members and staff have been laying the groundwork for those discussions.

Standing on the stage at the Shangri-La Dialogue security conference last weekend, Defense Secretary Chuck Hagel became the latest U.S. official to openly accuse the Chinese government of cyber espionage — as members of Beijing's delegation sat in the audience in front of him. The U.S., he said, "has expressed our concerns about the growing threat of cyber intrusions, some of which appear to be tied to the Chinese government and military."

But speaking to reporters traveling with him to the meeting in this island nation in China's backyard, Hagel said it's important to use both public diplomacy and private engagements when dealing with other nations such as China on cyber problems.

"I've rarely seen that public engagement resolves a problem, but it's important," he said, adding that governments have the responsibility to keep their people informed about such issues.

The hacking issue also featured prominently over two days of meetings between the U.S. Chamber of Commerce and a leading Chinese trade think tank in Beijing.

"This is arguably the single most consequential issue that is serving to erode trust in the relationship," said Jeremie Waterman, the chamber's executive director for greater China. "Over time, it could undermine business support for U.S.-China relations."

According to Lewis and other defense officials familiar with the issue, China's willingness to engage in talks with the U.S. about the problem — even without admitting to some of the breaches — is a step in the right direction.

Cybersecurity experts say China-based instances of cyber intrusions into U.S. agencies and programs — including defense contractors and military weapons systems — have been going on since the late 1990s. And they went along largely unfettered for as much as a decade.

A recent Pentagon report compiled by the Defense Science Board laid out what it called a partial list of 37 programs that were breached in computer-based attacks, including the Terminal High Altitude Area Defense weapon, a land-based missile defense system that was recently deployed to Guam to help counter the North Korean threat. Other programs whose systems were breached include the F-35 Joint Strike Fighter, the F-22 Raptor fighter jet and the hybrid MV-22 Osprey, which can take off and land like a helicopter and fly like an airplane.

The report also listed 29 broader defense technologies that have been compromised, including drone video systems and high-tech avionics. The information was gathered more than two years ago, so some of the data are dated and a few of the breaches — such as the F-35 — had already become public.

According to U.S. officials and cyber experts, China hackers use gaps in software or scams that target users' email systems to infiltrate government and corporate networks. They are then often able to view or steal files or use those computers to move through the network accessing other data.

Chinese officials have long denied any role in cyberattacks and insisted that the law forbids hacking and that their military has no role in it. They have also asserted that they, too, are often the victim.

Cyber experts say some of the breaches that emanate from Internet locations in China may be the product of patriotic hackers who are not working at the behest of Beijing's government or military but in independent support of it.

The Chinese government's control of the Internet, however, suggests that those hackers are likely operating with at least the knowledge of authorities who may choose to look the other way.

U.S. officials have quietly grumbled about the problem for several years but steadfastly refused to speak publicly about it. As the intrusions grew in number and sophistication, affecting an increasing number of government agencies, private companies and citizens, alarmed authorities began to rethink that strategy.

They were pressed on by cybersecurity experts — including prominent former government officials — who argued that using cyberattacks to steal intellectual property, weapons and financial data and other corporate secrets brought great gain at very little cost to the hackers. The U.S. government, they said, had to make it clear to the Chinese that continued bad behavior would trigger consequences.

In November 2011, U.S. intelligence officials for the first time publicly accused China and Russia of systematically stealing American high-tech data for economic gain.

That was followed by specific warnings about Chinese cyberattacks in the last two annual Pentagon reports on China's military power. And in February, the Virginia-based cybersecurity firm Mandiant laid out a detailed report directly linking a secret Chinese military unit in Shanghai to years of cyberattacks against U.S. companies. After analyzing breaches that compromised more than 140 companies, Mandiant concluded that they can be linked to a unit that experts believe is part of the People's Liberation Army's cyber command.

The change in tone from the Chinese leaders came through during recent meetings with Gen. Martin Dempsey, chairman of the Joint Chiefs of Staff, and has continued, according to officials and experts familiar with more recent discussions with Chinese leaders.

Still, experts say that progress with the Chinese will still be slow and that it's naive to think the cyberattacks will stop.

"This will take continuous pressure for a number of years," said Lewis. "We will need both carrots and sticks, and the question is when do you use them."

View the original article here

Computer hacking for grade changes results in arrests

Three students have been involved in hacking into a professor's computer and changing the grades they had received, which has resulted in two arrests and a lengthy investigation.  

Two current engineering students, Sujay Sharma and Mitsutoshi Shirasaki, have been arrested by the Purdue University Police Department (PUPD) on a lengthy list of charges from burglary, to computer tampering, to forgery. Former student, Roy Sun, is also involved in the case. Sun, now a graduate student at Boston University. He is currently in his home country of Japan and his future has yet to be determined. 

The case arose in January when a Purdue professor alerted to Information Technology at Purdue (ITaP) that his University account password had been changed, along with the security question he had set. This is when he noticed that grades had been changed from previous semesters. 

The three students somehow switched the keyboards in an ITaP computer lab that professors used  and received information from there to change the grades. 

John Cox, police chief for PUPD, said the police have been working with ITaP, the FBI, Boston University Police Department and Pat Harrington, the prosecutor for the case, to investigate the situation since January. Cox said that this case was the first of this magnitude. 

"This was no outside attack," Cox said. "This was some students who were very smart and used their knowledge and wisdom to do something they shouldn't have."

Sharma and Shirasaki are no longer enrolled at Purdue and their grades have been changed back to reflect what each student had originally received. They also face local and state charges for the grade changes. 

According to Jeff Stefancic, associate dean for the Office of Rights and Responsibilities, the University is still looking at Roy's status as he is no longer a Purdue student. 

"We can examine a student's graduation status and potentially revoke a degree that was granted if the situation warrants it. That's currently under our administrative review right now," Stefancic said. 

View the original article here

Hacking the World Economy with a 3-D Printer

NEW YORK (MainStreet)—It's called a printer but really is a manufacturing plant in a box. 3-D printers can build an object, layer upon layer, from plastic, metal, glass, ceramics – even chocolate. By now, we have seen that these amazing desktop devices can create guns, human tissue, DNA -- and drugs. As with most emerging technologies, for years 3-D printers were institutional and educational devices priced far beyond the reach of the typical consumer. Now you can buy one on Amazon. Creating your own plastic toy is one thing, but as the technology evolves, the world economy might face a physical hack from the same particle print-on-demand technology.

Also see: 'Curbed' and Enthusiasm: Lockhart Steele on What's wURKEN?

As cyber security expert Marc Goodman said in his presentation of "A Vision of Crimes in the Future" at the TEDGlobal 2012 conference, "Today most 3-D printers can print more than 50% of the parts required to make another 3-D printer -- a percentage that is increasing rapidly. Once 3-D devices cannot only produce weapons but also replicate themselves, the security and economic ramifications will escalate."

What are the risks to the global financial markets when mobile manufacturing can replicate the physical and the biological -- for illegal profit?

Robert Herjavec is best known as one of the millionaire investors on television's Shark Tank. He is the well-groomed, smiling Canadian – and usually the calmest -- shark on the panel. The program's introduction mentions The Herjavec Group, but offers few details on its function. Turns out Herjavec's firm is a 150 person operation in Toronto claiming to be the country's largest IT security provider. The company consults clients in 50 countries on cyber crime and terrorism, prevention and solutions. So when it comes to next-tech threats, Herjavec naturally has an opinion or two. His first thought when it comes to 3-D printers: he wants one.

Also see: The Underbanked and the Unbanked

"Firstly, I would like approval to order one of these for 'research purposes,'" Herjavec says. "Secondly, if I was to use it for no good; making copies of badges, such a police officer, detective, fireman, and the like, come to mind. Making copies of keys or thumbprints would be simple. Combining these two techniques with social engineering skills, would likely grant me access to banks and other financial institutions that historically would not have been accessible."

But Herjavec sees more of a threat from the technology than just breaking and entering and simple robbery.

"At a more global markets level, the fact that it becomes easy to copy any physical object, share its blueprints online, and then recreate it at home at manufacturing cost, with no shipping charges, would very quickly knock out the widget market right up to the automotive industry," he says. "But why stop there? As industrial sized 3-D printers become available, and blueprints for everything become accessible online, the public will gain access to aerospace technologies, missile designs, robotics, drones, spy gear and more. The era of 'Spy versus Spy' will be born and accessible to the 13-year-old living in his mother's basement."

Now that is scary.

"Many of our SCADA (supervisory control and data acquisition) systems that control everything from power, water, traffic, heating, cooling, and various other building or city controls utilize proprietary connectors and technologies that are relatively simple but inaccessible to hackers because of interfacing limitations," Herjavec continues. "3-D printers can instantly solve that problem by creating adaptors that would allow hackers to access previously unreachable systems. By creating these new attack vectors, many businesses and infrastructure systems will face a new era of threats they may not be prepared for."

Also see: Believe No Falsehood: Old Dog, New Blog

Herjavec notes that up until recently, only large corporations had the resources and technology to genetically modify organisms. 3-D printers can eventually put this power in the hands of the public -- meaning anyone could create and release a deadly biological attack.

"If you targeted a particular ethnic group, global financial markets could easily be swayed as manufacturing shuts down in one area and moves to another," he says. Transformative tech, like 3-D printing -- also known as "additive manufacturing" --perennially gets into as many hands of the bad guys as the guys in white hats.

Always have, always will.

"There have been technological advances that have shaken the world in a relatively short amount of time, changing it forever -- these included the discovery of electricity, the telephone, the computer, the Internet and now the 3-D printer will join these coveted ranks," Herjavec says. "What can we do to reduce the threat? Adapt. As the bad guys figure out how to use this technology for evil, the good guys will figure out a way to stop them."

--Written by Hal M. Bundrick for MainStreet

EXCLUSIVE OFFER: See inside Jim Cramer’s multi-million dollar charitable trust portfolio to see the stocks he thinks could be potentially HUGE winners. Click here to see his holdings for FREE.

View the original article here

Students under arrest after hacking into computer system to change grades

Friday 3:45 p.m. – Update

Court records outline details of three students accused of changing grades in an elaborate case. 

With a total of 58 charges between the three students, Roy Sun received 13 counts of charges, Mitsutoshi Shirasaki received 20 and Sujay Sharma received 13. 

The charges were a combination of Class C and D felonies and Class A misdemeanors.

It is alleged that Shirasaki's girlfriend Xiaonan Jing, an undergraduate in the College of Science, may have been involved in the case. Jing's grades were also changed as one of her classes, a Japanese class from Fall 2012, from an A to an A+, by Shirasaki, according to court records. 

The students are of accused breaking into a number of classrooms and computer labs from October 2009 to March 2013, but they also purchased locks from Wal-Mart and practiced picking them.

Court documents indicate, the students took turns practicing picking locks, standing as lookouts, breaking into the computer labs, placing keyloggers into keyboards and cutting wires in keyboards. They then are accused of accessing keystroke information from the keyboards and use this to enter professors' login information into computer systems. 

In March of 2013, Sun and Shirasaki exchanged telephone calls expressing the possibility of the police tracing the crimes back to them and the need to get rid of evidence, which is believed they did around Tippecanoe County. Sun was also concerned the Sharma had too much information and "coudn't keep his mouth shut." 

Sun graduated in 2010 with a Bachelor's of Science in Electrical Engineering and is currently at Boston University as a graduate student.  

A number of professors were involved in the grade changes from several colleges in the University: Liberal Arts, Engineering and Science. 

--

Three students have been involved in hacking into a professor’s computer and changing the grades they had received, which has resulted in two arrests and a lengthy investigation.

Two current engineering students, Sujay Sharma and Mitsutoshi Shirasaki, have been arrested by the Purdue University Police Department (PUPD) on a lengthy list of charges from burglary, to computer tampering, to forgery. Former student, Roy Sun, is also involved in the case. Sun is now a graduate student at Boston University. He is currently in his home country of Japan and his future has yet to be determined.

The case arose in January when a Purdue professor alerted Information Technology at Purdue (ITaP) that his University account password had been changed, along with the security question he had set. This is when he also noticed that grades had been changed from previous semesters.

The three students somehow switched the keyboards in an ITaP computer lab that a professor used received information from there to change the grades. The exact methods the student used to hack into the system and change the grades is still under investigation.

Grade changes were as subtle as A to A+ and as drastic as D’s to A’s, yet the motives behind these actions are unclear.

John Cox, police chief for PUPD, said the police have been working with ITaP, the FBI, Boston University Police Department and the case prosecutor Pat Harrington to investigate the situation since January. Cox said that this case was the first of this magnitude.

“This was no outside attack,” Cox said. “This was (done by) some students who were very smart and used their knowledge and wisdom to do something they shouldn’t have.”

Cox said there has been an internal audit to check for “anomalies” to make sure this was an isolated event over the last few years.

“There are thousands of grade changes every year in the system,” Cox said. “To see there were 30-something grades that were changed that’s unfortunate, you don’t want one grade changed like that ... It was the biggest case like that, that we’ve ever seen so far.”

Sharma and Shirasaki are no longer enrolled at Purdue and their grades have been changed back to reflect what each student had originally received. They also face local and state charges for the grade changes.

According to Jeff Stefancic, associate dean for the Office of Rights and Responsibilities, the University is still looking at Roy’s status as he is no longer a Purdue student.

“We can examine a student’s graduation status and potentially revoke a degree that was granted if the situation warrants it. That’s currently under our administrative review right now,” Stefancic said.

Cox said that ITaP is working to increase security and make it more challenging to get into the system, but that work is done every day by ITaP, not in response to this case.

“It gets a little tougher when you start having things like iPads and laptops floating around out there ... working wirelessly. We’ve done an awful lot with ITaP and ITaP has done a really nice job of working with that,” Cox said.

View the original article here

#Facebook gets #hashtags, which does #WTF to your #privacy?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

For those Facebook users who are allergic to any notion of privacy whatsoever and would prefer that the entire world be privy to contents of their #dinner or antics of their adorable #children, Wednesday was a high and holy day indeed, for that was the day that Facebook embraced the hashtag.

The company announced that starting on Wednesday, users would be able to add clickable hashtags to posts, similar to Twitter (for whom user Chris Messina invented the hashtag back in 2007), Instagram, Tumblr, or Pinterest.

Clicking on a hashtag will lead you to a feed that shows what other people and pages are saying about the hashtagged subject.

As Messina said about his hashtag rationale, he wasn't interested in other people's talk about creating official groups on Twitter.

Rather, he was more interested in enabling eavesdropping:

I’m more interested in simply having a better eavesdropping experience on Twitter.

To that end, I focused my thinking on contextualization, content filtering and exploratory serendipity within the Twittosphere.

With hashtags, Facebook is also interested in eavesdropping, aka encouraging users to open up conversations to strangers. Likely, as pointed out by The Register's Kelly Fiveash, the aim is to "juice up more ad revenue."

As it is, Facebook is happy to point out, "roughly a Super Bowl-sized audience" engages with the social network every night, during "primetime television alone."

Take Game of Thrones, for example, for which the recent, remarkably gory episode "Red Wedding" got over 1.5 million mentions on Facebook. That's not too shabby, given that 5.2 million people watched it.

How will this impact your privacy? It shouldn't, if you avoid using hashtags to get Facebook Nation to follow your conversations.

Currently, users control the audience for their posts, including those with hashtags.

Unfortunately, there have been far too many users who don't control who sees their posts, even in the pre-hashtag world.

As Consumer Reports reported a year ago, 13 million US Facebook users weren't using, or were oblivious to, privacy controls.

At the time, Consumer Reports found that in the prior 12 months, Facebook users "liked", updated their profiles, and posted status updates to produce these data points at these rates:

39.3 million identified a family member in a profile20.4 million included their birth date and year in their profile7.7 million "liked" a Facebook page pertaining to a religious affiliation4.6 million discussed their love life on their wall2.6 million discussed their recreational use of alcohol on their wall2.3 million "liked" a page regarding sexual orientation

If you want to ensure that hashtags don't get the privacy-oblivious into even hotter water, do them a favor and educate them on how to work Facebook privacy controls.

There's a great video from Consumer Reports here on how to do just that.

Oh, and if you want to hear the security latest news about Facebook, give the Naked Security Facebook page a 'like'.

Follow @LisaVaas
Follow @NakedSecurity

View the original article here

Internet giants call for transparency in government surveillance requests

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Facebook and Microsoft - two companies tagged as giving the Federal Bureau of Investigation (FBI) and National Security Agency (NSA) direct access to their servers for surveillance purposes - are echoing Google's call for transparency in government surveillance requests.

Google on Tuesday sent a letter to US Attorney General Eric Holder and the FBI and published this copy on its Public Policy blog.

In the letter, Google's chief legal officer, David Drummond, wrote to Holder seeking permission to publish "aggregate numbers of national security requests, including Foreign Intelligence Surveillance Act [FISA] disclosures".

Facebook's General Counsel Ted Ullyot chimed in with a post saying that the company would love to give a transparency report, which both Google and Twitter now do, but Facebook does not.

But such a report would by necessity be misleading, Ullyot wrote, given that government restrictions on disclosure would poke so many holes in it:

"In the past, we have questioned the value of releasing a transparency report that, because of exactly these types of government restrictions on disclosure, is necessarily incomplete and therefore potentially misleading to users.

We would welcome the opportunity to provide a transparency report that allows us to share with those who use Facebook around the world a complete picture of the government requests we receive, and how we respond."

Such nondisclosure obligations regarding how many FISA requests Google receives and the number of user accounts they cover just fuel speculation that "our compliance with these requests gives the U.S. government unfettered access to [Google] users' data," which is false, Drummond wrote in his letter.

According to the BBC, Microsoft has also said that greater transparency on government requests for information "would help the community understand and debate these important issues''.

For whatever reason, Twitter was absent from the initial list of nine major internet companies specified as giving the government direct access to servers in information leaked to the Washington Post and the Guardian by (likely soon to be "former") Booz Allen Hamilton employee Edward Snowden.

Regardless, on Tuesday, Twitter threw its support behind those who've demanded more transparency around national security letters (NSLs), such as Google, Senator Jeff Merkley (who, along with 7 other senators of both parties, is pushing a bill to declassify FISA court rulings), and others.

Twitter General Counsel Alex Macgillivray's Twitter message to that effect:

Completely agree with @Google, @SenJeffMerkley & others - we'd like more NSL transparency and @Twitter supports efforts to make that happen

Outrage over the surveillance program, known as PRISM*, continues to ignite, regardless of the Obama administration's strenuous efforts to poo-poo the media attention and public reaction sparked by what many interpret as the we-eavesdrop-on-everything program.

For its part, the American Civil Liberties Union (ACLU) has filed a lawsuit against the government over its "dragnet" collection of domestic phone call logs, saying that it's illegal and asking a judge to order that the program be stopped and its records purged.

Beyond calling for more transparency, the idea of a back door into their servers has seemingly outraged the nine internet companies.

Facebook founder and CEO Mark Zuckerberg, for one, crafted a personal post on Friday to both ask for more transparency and to address what he called "outrageous press reports about PRISM."*

From his post:

"We have never received a blanket request or court order from any government agency asking for information or metadata in bulk, like the one Verizon reportedly received. And if we did, we would fight it aggressively. We hadn't even heard of PRISM before yesterday."

At this point, much of the vehement denial over having a back door to servers could well be attributed to how, exactly, one defines "back door".

The New York Times, among others, has sketched out how the information hand-off takes place:

Instead of adding a back door to their servers, the companies were essentially asked to erect a locked mailbox and give the government the key....The data shared in these ways, the people said, is shared after company lawyers have reviewed the FISA request according to company practice. It is not sent automatically or in bulk, and the government does not have full access to company servers. Instead, they said, it is a more secure and efficient way to hand over the data.

....FISA orders can range from inquiries about specific people to a broad sweep for intelligence, like logs of certain search terms, lawyers who work with the orders said. There were 1,856 such requests last year, an increase of 6 percent from the year before.

*In light of director of national intelligence James R. Clapper's
of the Foreign Intelligence Surveillance Act" href="http://www.dni.gov/files/documents/Facts%20on%20the%20Collection%20of%20Intelligence%20Pursuant%20to%20Section%20702.pdf" rel="nofollow">corrections [PDF] about the project, we know that PRISM is just the name of the computer system that makes the data-Hoover-machine run and not the name of the project itself.

But given that the acronym for the program's real name - CIPS702FISA, or the Collection of Intelligence Pursuant to Section 702 of the Foreign Intelligence Surveillance Act - is unpronounceable, I think I'll just pretend, until somebody thinks up a more elegant name, that this whole thing is still called PRISM.

Follow @LisaVaas
Follow @NakedSecurity

View the original article here

Get ready! Oracle to fix 40 holes in Java on Tuesday, 18 June 2013

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Oracle's official patch frequency for Java is rather unusual: once every four months.

There's no succinct adjective for that, as there is for monthly or quarterly updates: the easiest way to work out Oracle's official dates is simply to remember, "Around the middle of February, June and October."

? Oracle increasingly frequently issues security patches between regular updates, so those aren't the only fixes you'll need each year. But they're the ones that are going to come out no matter what, so you may as well diarise them.

There's definitely an update coming next Tuesday, 18 June 2013, and you might as well get ready for it now if you haven't already.

The details of what will be fixed aren't a matter of public record yet, so we can't spell them out for you in detail.

Nevertheless, Oracle has published a very brief pre-announcement to remind us of the importance of this month's fixes.

(Yes! I know! It's a misnomer - what is a "pre-announcement" if not merely an "announcement" - but don't shoot the messenger!)

The good news is that lots of security vulnerabilities have been repaired - 40 in total, of which all but three are RCEs, or remote code execution holes.

That's where untrusted content sent over the network might be able to trick Java into performing operations that really ought to be limited to already-installed, trusted code.

In short, an RCE means that you could get infected by malware simply by looking around online, without explicitly downloading, authorising or even noticing the malware being installed.

There are two handy ways to reduce this RCE risk:

Apply Oracle's patches as soon as practicable. You can turn on fully-automatic updating if you like.Turn off Java in your browser, so that web-based Java applets can't run at all.

In the future, Oracle expects to switch Java onto a quarterly update cycle, keeping it aligned with other Oracle products.

For the time being, just keep your eyes open on Tuesday 18 June 2013, or engage auto-updating before then: this update sounds important.

We'll spell out the detail of what's changed once Oracle's updates have gone public.

Sophos vulnerability assessments can be found on the official SophosLabs Vulnerabilties page.

Follow @duckblog

View the original article here

“Nej till Google!” – Sweden tells a local council that Google’s cloud is a no-go area

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Swedish bureaucrats have instructed a town in the Scandinavian country to say "No" to Google.

Salem, a municipality approximately 30km south-west of Stockholm, wanted to ink a deal to use Google Apps, but the Information Commission thought otherwise.

When I first spotted this story, my immediate thought was that it would have something to do with PRISM.

If you haven't been following computer security news lately, that's the USA's controversial programme to conduct widespread network surveillance of foreigners.

You can see why overseas jurisdictions might want to discourage their residents from using cloud services offered by companies which are themselves regulated by US law.

But Sweden's broadside against Google has nothing to do with whether the US government does or doesn't have its digital eyes on the cloud storage of non-US residents.

This is an argument directly with Google over its own privacy provisions.

The Swedish data protection mandarins already disagreed with the Municipality of Salem back in 2011, arguing that Google's contractual land-grab over its customers' data "for the purposes of providing, maintaining and improving the services" was a step too far.

The municipality apparently felt that this was reasonable because it would help to improve Google's IT-related services to everyone - in other words, that the people of Salem could tolerate this clause for the greater good of all.

But the Swedish Datainspektionen ordered Salem to renegotiate with Google, on the grounds that the clause was too open-ended to be safe.

The decision noted, amongst other things, that the contract was too loose about how the data might be handled by subcontractors, or by Google after the contract ended.

Salem did go back to the negotiating table, and came up with a revised deal last month, but it still wasn't enough for the regulators, whose decision is that the earlier shortcomings have not been addressed.

So Salem must negotiate again with Google, or find another way to deliver its IT services.

On the surface, this may sound like Nordic bureaucratic pettiness, but I think we should applaud the Swedish privacy experts here.

It's one thing to outsource your own IT services - personal email, blogging, web site, and so forth - to save time and money. That's your own choice to make.

And it's fair enough if you're a company whose customers can vote with their chequebooks (yes, they still exist, at least in Australia!) if they don't like the service provider you've chosen.

But as a "customer" of a local government, you don't have that liberty, so you are stuck with the privacy-related decisions made by your council.

I suppose, as Google's own Eric Schmidt once famously joked, "you can just move, right?"

But that's the same Eric Schmidt who's on the record as having said that "Google policy is to get right up to the creepy line and not cross it."

Let's see if Salem can win the battle to get Google to back off a bit in the next round of negotiations...

Follow @duckblog

View the original article here

Dozing bank clerk turns €64 into €22 million – and teaches us all a security lesson!

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The London Evening Standard recently ran a story about a German bank clerk who is supposed to have "nodded off at his keyboard during a transaction."

Apparently, the clerk was typing in an amount of 64 Euros and 20 cents when he fell asleep and his keyboard's auto-repeat took over.

A transaction of €22,222,222.22 (about $30m) was processed instead and inadvertently approved by his supervisor.

The supervisor's supervisor spotted the double-blunder and headed it off at the pass, but the intermediate supervisor was sacked for letting the transaction go through in the first place.

? The story claims that this all came to light because an industrial tribunal in Germany decreed the supervisor's punishment to be too harsh, considering that she had already been expected to vet 812 documents that day, spending "just over a second" on each one. She was reinstated.

There are lots of unanswered questions in the story, which makes you wonder how much of it is urban legend, extrapolated somehow from details that were lost or altered in translation.

So, who knows what really happened in this case?

Nevertheless, it's a great story, and (I bet you're wondering if I'll manage to squeeze a generic computer security lesson out of it) contains a generic computer security lesson for us all.

We know that there are some tasks that we simply oughtn't to attempt when our judgements are impaired, say through tiredness or alcohol.

Driving cars, shooting firearms and performing orthopaedic surgery, for example, are activities that are best avoided under such circumstances.

Yet many of us insist on living our digital lives logged in semi-permanently to sites such as Facebook, Twitter, webmail and more, thus actively and unashamedly inviting upon ourselves exactly this sort of 22-million-Euro-blunder moment.

It's not just that we're more likely to initiate an unwanted bank transaction (or send an unintentionally ruinous email) while we're tired or lit.

It's that by leaving ourselves logged in unnecessarily, we make it easier for our computer to do just such a thing if it becomes impaired, for example through misconfiguration or malware infection.

It's a lot less convenient to have to keep logging into and out of your email account, your blog site or your favourite social media account every time you want to tell the world something new.

But do you really have so much to say, at such short notice, that this is an inconvenience you can't tolerate?

If you are the sort of user who likes to log in and stay logged in, especially to on-line services, why not give yourself a week's trial of logging out whenever you can, especially from on-line services?

Try it: you may thank yourself one day.

Follow @duckblog

View the original article here

Australia’s National Consumer Fraud Week starts today – the motto is, “Outsmart the scammers!”

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Do you know someone who's been scammed online?

Chances are that you do - or you may have been scammed yourself.

Sadly, if you have been scammed, you may find some of your friends or family strangely unsympathetic.

There's still a widely-held belief that anyone who falls for an online scam must be both greedy and gullible.

? In some cases, it's true that the venality of the victim is a factor. If you send money to someone who has openly requested it as a bribe to persuade a corrupt official to pay out $22,000,000 for an oil pipeline that was never built, you have been both greedy and gullible. (You've also been a crook yourself. Don't expect sympathy.)

But there are dozens of popular online scams these days that don't require any risky character traits in the victim except a trusting nature.

Here are some examples:

Skimming. Crooks fit a duplicate card reader to an ATM so your card gets read twice when you use it.Phishing. Crooks trick you into logging in on a site that looks like your bank, but isn't.Fake competitions. Crooks persuade you to hand over personal information for geeky "prizes" that don't exist.Fake anti-virus. Crooks trick you into paying $50 for anti-virus software to "clean" malware that was never there.Fake support. Crooks pretend to be from Microsoft and offer a remote "cleanup" session for malware you don't have.

The reason I'm mentioning all of this at this particular moment is that the Australian National Consumer Fraud Week 2013 starts today.

At Sophos we enthusiatically support this sort of event, because every time anyone gets scammed - even if they lose only a modest amount, such as $10 - it hurts our society and economy as a whole.

That means that helping other people to avoid scams can be considered an important civic and economic duty for all of us.

Here are five handy "outsmart the scammers" advice points from the Australasian Consumer Fraud Taskforce:

Think twice - if a deal looks too good to be true, it probably is.Find out what other shoppers say - make sure the person that you are dealing with, and their offer, is the real deal.Protect your identity - your personal details are private and invaluable; keep them that way and away from scammers.Keep your computer secure - install software that protects your computer from viruses and unwanted programs and make sure it is kept up-to-date.Only pay via secure payment methods - look for a web address starting with ‘https’ and a closed padlock symbol. Never use a wire transfer to send money to anyone you do not know and trust, and do not share your financial details with anyone.

There's also a very handy taxonomy of scams on the Aussie government's SCAMwatch site.

Why not support National Consumer Fraud Week yourself?

Tell your less security-conscious friends and family about the SCAMwatch website, and get them to take a look at some of the many scams that are explained there.

Let's all learn to outsmart the scammers!

Follow @duckblog

If you're interested, Sophos provides a range of free security tools to help you stay safe online. Choose from Sophos Mobile Security for Android, Sophos Anti-Virus for Mac Home Edition, our Virus Removal Tool and the Sophos UTM Home Edition.

View the original article here

UK political bigwigs demand return of snoopers’ charter. Seriously? Today?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A cluster of top political figures in the UK, including several former Home Secretaries, has issued a public letter insisting on the revival of the so-called "snoopers' charter" - legislation to give British police and intelligence services more access to personal data.

In a stirring display of bad timing, the letter, co-signed by big names from both sides of the political divide and sent to the Times newspaper, aims to break opposition to the bill from the Liberal Democrats.

The proposed £1.8 billion "Communications Data Bill", promising massive-scale harvesting of web and phone data, has always been controversial. It was pushed onto the back burner in April when Lib Dem leader Nick Clegg came out against it.

But it seems that, despite the current heavily anti-snooping mood, some people are not ready to let it lie.

A lot of these guys are getting on a bit - their job titles mostly include a "former", several reports refer to them as "senior" and even "grandees" - so maybe they have an excuse for not keeping up with current events. They're probably spending a lot of time pottering around the garden, playing bingo or watching Quincy.

They seem not to have even noticed the massive, non-stop political and social hurricane surrounding the so-(mis-)called "PRISM" leak rumpus, dominating all headlines for the last week or so.

For the moment we'll ignore the justification they give for their demands; they reference the horrific attack in London a few weeks ago, whose perpetrators were well known to MI5. This seems to indicate, if anything, that UK spies already have more information than they can possibly process and act upon, but that's by the by.

If there's anything the whole PRISM circus shows, it's that intelligence services are really bad at privacy. The NSA, famously the most top-secret of secret organisations, is actually not able to keep its own top-secret secrets especially secret.

In essence, they hired a temp (OK, "consultant", I've never been clear on where one stops and the other starts), and let him, what? Dump a load of highly-classified documents to a personal USB stick or a CD? Or send stuff out to his personal Gmail account?

C'mon guys, where was the data security?

We're not talking about beefy armed guards running high-tech body-scanners over everyone leaving the secure facility in the back of a fake launderette, or beagles that can sniff a microdot at 20 paces. This should be covered by basic data handling policies, DLP and maybe a bit of device control.

And this is their OWN secrets. How much less careful are they with other people's?

I try to be fairly careful with my personal data, not obsessively so but taking reasonable precautions. What's the point of making the effort though?

Clearly, the cops and the secret agent men are going to compile a detailed and comprehensive dossier on everything they can find out about me, then just pop the data on a laptop or USB stick (unencrypted, of course), and leave it lying around the nearest train/taxi/rail station/airport/nightclub. Or better yet, simply put the whole database on eBay because the hard drives seem a bit old.

So, no thanks. Until "the man" proves he can look after it better, I'd rather not give him any more data than he already has. For the first time in a while, I agree with Nick.

Follow @VirusBtn
Follow @NakedSecurity

Image of UK face courtesy of Shutterstock.

View the original article here

PRISM, UK Surveillance, Sweden vs. Google, Blackberry Z10 – 60 Sec Security [VIDEO]

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Here's the latest in our 60 Second Security video series, bringing you a fast, incisive and entertaining angle on recent computer security issues.

Watch the latest security news in just 60 seconds! (Higher resolution available directly from YouTube. Click the captions button for closed captions.)

(If you enjoyed this video, you'll find plenty more on the SophosLabs YouTube channel.)

http://twitter.com/duckblog

Tags: 60 Sec Security, 60 Second Security, 60 Seconds, 60SS, BlackBerry, cloud, flash, Google Apps, law, Patch, PRISM, Privacy, salem, surveillance, Sweden, vulnerability, z10

View the original article here

Biostamps - freedom from password tyranny, or Hollywood science?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Last week Motorola execs showed off experimental biostamps - digital "tattoos" capable of authenticating you to your phone.

Could this be the ultimate solution to the problem of authentication, or is it just a sci-fi pipe dream?

The biostamps are basically flexible electronic circuits attached to the skin, which theoretically can communicate wirelessly with any device which needs to check who you are.

The concept evolved from medical research, and was picked up by Google subsidiary Motorola Mobility, who are looking into making it a reality.

An alternative option, also presented by their bosses at the recent Wall Street Journal D11 conference, is a pill which emits identifying signals from the stomach.

The problem of identity is the biggest headache in computer security. Verifying you are who you say you are is at the heart of most security issues, and being able to pose as someone else - to their bank, say, or to their email or social networking provider - is the main aim of the vast bulk of malware and cybercrime.

What's needed is an end to the weak, clunky and decrepit authentication system on which we base most of our security - passwords.

With the speed modern computers can process guesses, and humanity's apparently incurable lack of originality, their usefulness has reached an end.

So what should we do instead?

Two-factor authentication is much in the headlines lately.

Most of us carry some sort of mobile device, so why not use it to prove who we are? In combination with a traditional password, that should make things much more secure.

Nice idea, as far as it goes. But still clunky and awkward.

It relies on you having your device handy, and requires you to faff around consulting it and feeding in complicated codes between devices. Also, not all that secure, as man-in-the-middle attacks have proven.

So a way of uniquely identifying a person, simply and automatically with minimal mental effort, could be a great step forward.

Fingerprints seem like the obvious option, but the laptop I'm typing on has an alleged fingerprint reader, and I seem to be able to pass its test with my elbow, while my finger is completely ignored. Effective contact-less authentication without moving a muscle seems far better.

But are these "electronic tattoos" or swallowable dongles really viable? And if they are, are they really the right way to go?

They sound like something from a sci-fi movie, but in the past reality has caught up with some pretty wild ideas from the sci-fi world.

The first problem with Motorola's ideas as they are is that they are temporary.

These biostamps apparently last only a couple of weeks, while the pill version might last longer but would eventually be, ahem, ejected.

So they'd need to be replaced. You wouldn't want to go too long without your ID, so you'd maybe keep a stash of pills/stamps handy, in your wallet say, or beside the bed.

Bad move. Get your wallet stolen or your house burgled, suddenly your 100% verifiable identity's been shared with the whole black market.

An alternative would be to have the things built on-the-fly and dispensed by a dependable source. Maybe a machine in the street, which you would authenticate yourself to using the last dregs of power in your previous patch or pill.

The dispenser and the process of creating the dingus would have to be pretty hack-proof though, which has proven to be beyond humanity's abilities so far.

Longer term you might think it would be good just to have a permanent implant, put in at birth. Now we're really hitting sci-fi territory - Hollywood loves a nice implant.

As things develop you could maybe include some storage in there too, at first just a handy flash drive for moving your files around but further ahead perhaps backing up your memories to save space in your brain.

Beyond the obvious civil liberties problems, there are religious issues with such body modifications.

And of course there will always be slow adopters. In any decent dystopia there has to be an underground resistance movement of course, but they can usually be overcome with a tough regime of drugs and brutally enforced compliance.

Next up, you'd need the thing to know you were alive, and ideally awake. The pills are powered by stomach acid, so should die when they leave the body.

Hopefully they would have some controls to prevent them being rinsed off and rebooted.

With the stamps though, you wouldn't want a bad guy tearing it off or, even worse, removing whatever body part it's attached to and taking that to the nearest ATM.

The biostamps are based on a design meant for health monitoring anyway, so that shouldn't be a problem. Where it gets difficult is if the health monitoring goes too far and starts trying to guess when you're going to die.

From there it's only a short step to controlling how long you deserve to live.

Knowing you're awake is important so that you couldn't be doped or knocked out and used as a snoozy key to your house/phone/bank account etc. Detecting consciousness is likely to be fairly viable, but really you'd want the thing to know that you actually want to be identified, to avoid brush-past ID theft.

This issue exists with current contact-less bank cards, but there it can be overcome with simple signal-blocking wallets.

To do it with built-in kit we're looking at mind-reading, which I'm sure the big search providers and social network sites would love a piece of.

It wouldn't take long to start seeing adverts beamed straight into the brain.

Things look pretty bleak for the biostamp then. A fun idea, but probably not a viable solution to the authentication problem.

It looks like we're going to be stuck with passwords for a while at least, so make sure you practice safe password management.

And keep watching the skies!

Follow @virusbtn
Follow @NakedSecurity

Image of hand bar code and vital signs courtesy of Shutterstock.
Image of biostamp courtesy of MC10.

View the original article here

US child porn suspect doesn't have to decrypt hard drives - yet

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

In a case that could have far-reaching implications for compelling criminal suspects to decrypt digital storage devices, a judge on Tuesday stayed [PDF, posted courtesy of Wired] - temporarily suspended - a previous order that would have forced him to decrypt hard drives suspected of containing child pornography.

The hard drives were seized from computer scientist Jeffrey Feldman, from the US state of Wisconsin.

The government has previously said in court papers that even without forcing Feldman to decrypt storage devices found in his house, they have managed to glean incriminating data from unencrypted portions of the storage.

The government says it found a large number of user-created links that "strongly suggest, often in graphic terms," the presence of encrypted abuse images on Feldman's hardware.

The investigators also found a peer-to-peer sharing utility that contained logs of 1,009 videos that Feldman had allegedly received, distributed and stored - most of the filenames being "unambiguously indicative" of child porn.

At question is Feldman's right, under the Fifth Amendment, to be shielded from self-incrimination.

Magistrate William Callahan Jr. of Wisconsin wrote in April that this is "a close call," but that if Feldman used a password to decrypt a storage device, it would be, more or less, the same as telling the government "something it does not already know" and would be tantamount to self-incrimination.

Callahan subsequently viewed new evidence that caused him to reconsider.

According to the order [PDF], the Federal Bureau of Investigations (FBI) had managed, given "substantial resources," to decrypt and access one single hard drive.

On that decrypted segment of Feldman's far more extensive storage system, the FBI says it found "an intricate electronic folder structure comprised of approximately 6,712 folders and subfolders," in which agents found 707,307 files, including "numerous files which constitute child pornography."

Writing [PDF] in late May, Callahan ordered Feldman to either enter the passwords without being observed by law enforcement or government counsel, or provide an unencrypted copy of the data.

However, a new federal judge, Rudolph Randa, has stayed that decision. Ars Technica's Cyrus Farivar writes that Callahan was taken off the case, not being an "Article III Judge" and lacking the authority to grant the order in the first place.

The latest wrinkle in Feldman's case doesn't do much but postpone the question of whether compelling somebody to decrypt their electronic storage device is a violation of Fifth Amendment rights.

But if the government already has enough evidence to convict Feldman of possessing child abuse images, is it necessary to compel decryption?

We'll keep watching this space. Regardless of this case or others like it, it's important to fight the erosion of rights such as those granted by the Fifth Amendment.

Follow @LisaVaas
Follow @NakedSecurity

Image of child and hard drive courtesy of Shutterstock.

View the original article here

Botnet smackdown, Oracle on Java, Passwords you can eat - 60 Sec Security [VIDEO]

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Watch our 60 Second Security videos for a fast, incisive and entertaining angle on what's been going on recently in computer security.

Here you go: the latest security news in just 60 seconds.

(If you enjoyed this video, you'll find plenty more on the SophosLabs YouTube channel.)

http://twitter.com/duckblog

Tags: 2FA, 60 Sec Security, 60 Second Security, 60 Seconds, 60SS, botnet, citadel, FBI, java. patch, linkedin, Malware, Microsoft, Motorola, Oracle, pill, stomach, takedown, token, update, vulnerability

View the original article here

EU to vote on harsher penalties for hackers

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The EU has drafted a new directive that includes harsher penalties for those convicted of hacking.

The European Parliament last week approved a draft of the proposal and will vote on it in July.

Those found guilty of the following types of illegal hacking will face at least two years in prison, if they do so with criminal intent and cause serious harm, if they breach a security measure while doing so, and if they neglect to tell a system operator all about the vulnerability in a timely manner:

Illegal, intentional access to an information system. Illegally interfering with data.Illegally intercepting communications. This includes recording communications and covers the time spanning data transfer from the sender to the receiver, by cable or wireless, and the devices and technologies that record, including software, passwords and codes. Intentionally producing and selling tools used to commit these offenses.

The proposal calls for a minimum of five years imprisonment for attacks against critical infrastructure and also applies if an attack is carried out by a criminal organisation or if it causes serious damage.

Botnet creators and herders will face at least three years in prison under the new directive.

The directive, approved by the European Parliament's Committee on Civil Liberties, Justice and Home Affairs, also stipulates that EU member states respond within 8 hours, maximum, 24 hours a day, 7 days a week, to urgent security requests from other member states experiencing cyber attacks, to at least let somebody know how and when they plan to answer the request for help.

The directive also calls for penalties for actions such as hiring hackers to disrupt the competition, in which case companies could lose their public benefits or even get shut down.

The directive is clear about distinguishing attacks that lack criminal intent, which would cover testing or protection of information systems and thereby shield whistleblowers.

That's reassuring. Pen testing and whistleblowing are essential activities that deserve legal protection.

Follow @LisaVaas
Follow @NakedSecurity

Image of EU and gavel and Euro attack courtesy of Shutterstock.

View the original article here

FBI and Microsoft in massive takedown of "Citadel" crimeware

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Microsoft just announced the successful disruption of 1462 Citadel botnets, thanks to a co-ordinated effort between numerous organisations in the private sector and the US Federal Bureau of Investigation (FBI).

You read that correctly: 1462 botnets.

? A botnet is a collection of malware-infected computers known as bots or zombies. The zombies in a botnet can simultaneously and remotely be commanded by a cybercriminal, known as the botmaster, to do bad stuff. This includes sending out spam, logging everything typed in order to steal passwords, or attacking other people's websites.

Not a botnet of 1462 computers, but 1462 separate botnets.

The reason that one malware family, Citadel, could end up responsible for so many distinct cybercrime operations is that Citadel isn't just malware.

Citadel is what's called a crimeware kit, which you can lease or buy to build your own crooked province in the cybercriminal underworld.

You don't need to know how to write your own malware, or even how to host it, because cybercrooks are keen proponents of the cloud, providing Malware-as-a-Service to other budding crooks who want their own piece of botnet action.

Microsoft's writeup of how the botnets were nobbled is understandably lacking in detail, not least because this is just the start of the counterstrike against the crooks.

Generally speaking, however, botnets rely on one or more command-and-control (C&C) servers from which infected computers download instructions on what to do next.

So identifying some or all of the C&C servers in a botnet operation and getting a court order to force them out of action can seriously cramp a cybercriminal operation.

If the crooks can't distribute the next course on their "menu" to the zombies in their botnet, then the botnet is essentially emasculated.

And that's what happened here: a co-ordinated takedown of C&C servers at two hosting companies in New Jersey and Pennsylvania.

Of course, this doesn't deal with the C&C servers outside the USA.

To help knock those on the head, Microsoft has distributed intelligence to Computer Emergency Response Teams (CERTs) in other countries.

The hope is that the CERTs will be able to act against Citadel C&C servers in their own jurisdictions.

As you will see in the SophosLabs analysis of Citadel, one of its features is programmable DNS redirection.

This means that infected computers can be fed a false map of the internet.

Not only might you be redirected to a fake copy of your usual banking website in place of the real thing, you might also be diverted away from security updates (and from security-related websites).

This makes it much more difficult to clean up your infection, thus giving the crooks even longer in covert control of your PC.

So, while we congratulate Microsoft, its many private-sector partners, and the FBI for taking on the cybercriminals, let's not forget the role that the rest of us can play here.

After all, there are two sides to dismantling a botnet: you can remove the "net" part (in other words, take down the C&C servers), and you can remove the "bot" part (in other words, clean up infected computers).

If we all do our bit to ensure that we aren't helping the crooks by allowing ourselves to be co-opted into a botnet in the first place, we'll cut off the source of their of ill-gotten gains.

Follow @duckblog

View the original article here

PRISM - not as bad as you thought? (And don't call it PRISM!)

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

You've almost certainly heard about PRISM, an abbreviation that has come to mean "US surveillance of everything."

Since Naked Security first wrote about this unfolding drama last week, a raft of new information has come to light.

The whistleblower who leaked the information has come forward; his employer has responded; and the US Department of National Intelligence itself has spoken on the record.

The conspiracy theories probably haven't been shaken, but they've certainly been stirred.

A chap by the name of Edward Snowden, who's 29 years old and works for a defence contractor, has outed himself as the source of the PRISM leak.

According to The Guardian, he slipped out of the US, flew to Hong Kong and holed up in a hotel.

Apparently, he's been out of his room only three times in the past three weeks.

From Hong Kong, he blew the whistle, purportedly claiming that:

I don't want to live in a society that does these sort of things.

He also seems to have come up with a very quotable quote that will probably end up being seen as selfless by his fans, but as mildly messianic by his detractors:

I understand that I will be made to suffer for my actions, but I will be satisfied if the federation of secret law, unequal pardon and irresistible executive powers that rule the world that I love are revealed even for an instant

His employer, the redolently-named Booz Allen Hamilton, has reacted with undisguised outrage:

Booz Allen can confirm that Edward Snowden, 29, has been an employee of our firm for less than 3 months, assigned to a team in Hawaii. News reports that this individual has claimed to have leaked classified information are shocking, and if accurate, this action represents a grave violation of the code of conduct and core values of our firm. We will work closely with our clients and authorities in their investigation of this matter.

The US Office of the Director of National Intelligence has gone public, too.

The Director himself, James R. Clapper, has opened up a list of previously-classified nuggets about the PRISM project.

(You can download the official version from the DNI's website. [PDF, 3 pages.])

Here's a very brief summary of the DNI's brief summary:

It's not called PRISM; that's just the name of the computer system that makes it work.It's really called the Collection of Intelligence Pursuant to Section 702 of the Foreign Intelligence Surveillance Act, or Section 702 for short.Section 702 doesn't operate outside the oversight of Congress and the courts.It doesn't collect information without court approval or without informing service providers.It isn't allowed to target anyone inside the US, or any US citizen anywhere.It isn't allowed to target foreigners in order to target people inside the US.It's actually been jolly useful and has mitigated potential computer network attacks.

There you have it.

The DNI followed up its declassification by passing the buck to the Department of Justice, pretty much ruling out any further comment from the intelligence community:

Because the matter has been referred to the Department of Justice, we refer you to the Department of Justice for comment on any further specifics of the unauthorized disclosure of classified information by a person with authorized access. The Intelligence Community is currently reviewing the damage that has been done by these recent disclosures. Any person who has a security clearance knows that he or she has an obligation to protect classified information and abide by the law.

And that's that.

All I can say is that I can't see the DNI persuading people to stop using PRISM as a collective noun for the entire schemozzle, and I can't see the schemozzle abating for quite some time.

What do you think? What will happen next?

Let us know in the comments below!

Follow @duckblog

View the original article here

US upholds the right to search your laptop at the border without warrant

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Here's a riddle: Why did the US customs agents search your laptop at the airport?

Answer: Oh, well, it's hard to say. They just kind of had a hunch that you were suspicious, you know?

It sounds like a hyperbolically offhand rationale to justify disregarding travelers' constitutional rights against unreasonable searches (at least, the rights of US citizens, supposedly guaranteed by the Fourth Amendment), but the glibness is barely exaggerated.

Here's the actual wording used by the Department of Homeland Security (DHS) to explain why it can't change its electronic device search policies:

...we have been presented with some noteworthy [Customs and Border Protection (CBP)] and [Immigration and Customs Enforcement (ICE)] success stories based on hard-to-articulate intuitions or hunches based on officer experience and judgment.

Under a reasonable suspicion requirement, officers might hesitate to search an individual's device without the presence of articulable factors capable of being formally defended, despite having an intuition or hunch based on experience that justified a search.

The quote comes from a statement [PDF] released by DHS on Wednesday.

The statement is in response to a Freedom of Information Act filed by the American Civil Liberties Union (ACLU). It includes a so-called complete version of its justification of warrantless border searches of laptops, of which it released an executive summary in February.

The executive summary [PDF] put out in February barely addressed questions of if and how warrantless searches violate First and Fourth Amendment rights.

Basically, DHS's rationale for warrantless searches being Constitutionally OK amounted to "because we said so."

An example of the executive summary's "we don't have to explain ourselves to you" style with regards to the First Amendment:

First Amendment

Some critics argue that a heightened level of suspicion should be required before officers search laptop computers in order to avoid chilling First Amendment rights. However, we conclude that the laptop border searches allowed under the ICE and CBP Directives do not violate travelers’ First Amendment rights.

The statement released on Wednesday has constitutional analysis, but it's largely redacted.

In some of its non-redacted reasoning, however, DHS says that border agents have to act fast. If the legal threshold to search device content were to be raised, resulting litigation would muck thinks up:

... commonplace decisions to search electronic devices might be opened to litigation challenging the reasons for the search...

The litigation could directly undermine national security by requiring the government to produce sensitive investigative and national security information to justify some of the most critical searches...

Although this Office does not advocate arbitrary decision-making, we understand that there may be occasions where officers have only a few seconds to make important decisions about admissions and searches, and where they lack the opportunity to use routine criminal investigative techniques to develop reasonable suspicion or probable cause to justify the inspection of containers.

Officers must therefore frequently make important choices based on inadequate and imperfect information.

The ACLU takes issue with this notion.

ACLU legal fellow Brian Hauss wrote in a blog posting on Wednesday that the government has plenty of ways to keep sensitive information from leaking out in court:

The government has numerous resources at its disposal to prevent the disclosure of sensitive information.

The "state secrets privilege," to take just one example that is used in court cases, has been criticized on many grounds, but no one has ever seriously suggested that its protections are too anemic.

Although DHS might fear the prospect of being called into open court to explain its actions, executive accountability before the law is the bedrock on which our system of constitutional self-government is built.

The Feds also nixed suggestions that ICE and CBP revert to a 1986 policy that allowed agents to “briefly peruse” a traveler’s possessions to determine if there was probable cause or a reasonable suspicion for a further seizure.

Such a policy is "not tenable" given the capacity of modern devices, DHS wrote:

Gigabytes of information may be stored in password-protected files, encrypted portions of hard drives, or in a manner intended to obscure information from observation.

An on-the-spot perusal of electronic devices following the procedures established in 1986 could well result in a delay of days or weeks; even a cursory examination of the contents of a laptop might require a team of officers to spend days or weeks skimming the voluminous contents of the device.

At the same time, a firm time limit for completing a search risks allowing a wrongdoer to "run out the clock" by encrypting and password-protecting his device, or traveling with voluminous amounts of documents, or other measures to make the search very time consuming.

None of this is surprising.

Civil liberties advocates have long referred to US ports of entry as "Constitution-free zones".

The heavy black ink of redacted Constitutional analysis, to my mind, symbolizes the black hole where travelers' Constitutional rights go to die.

Follow @LisaVaas
Follow @NakedSecurity

Image of customs and border patrol courtesy of Shutterstock.

Tags: ACLU, CBP, Constitution, Customs and Border Protection, DHS, first amendment, Fourth Amendment, fourth amendment rights, ICE, Immigration and Customs Enforcement, laptops, Privacy, seizure

View the original article here

US uses NSA-FBI PRISM program to snoop on everything and everybody

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

"Nobody is listening to your telephone calls," President Obama said on Friday, defending a broad government surveillance program that was leaked to the press in the preceding week.

Obama defended the program, code-named "PRISM," at an event on the West coast that was initially supposed to be devoted to the health care law.

According to the New York Times, the president sought to reassure the public that the information collected from nine of the biggest internet companies about phone calls and internet traffic helps to prevent terrorist attacks and is controlled by rigorous judicial and Congressional oversight.

News about the secret surveillance program was broken on Wednesday by the Guardian, which revealed that the National Security Agency (NSA) is collecting telephone records of millions of Verizon's US customers under a top-secret order issued on April 25 by the secret Foreign Intelligence Surveillance Court (FISA) to the Federal Bureau of Investigation (FBI).

The order, obtained by the Guardian, directs Verizon to hand over information on all telephone calls in its systems, both within the US and between the US and other countries, on an "ongoing, daily basis."

The court order contains a gag provision that prohibits Verizon from disclosing to the public either the FBI's request for customer records or the court order itself.

It covers a nearly three-month period ending July 19 (although Senator Dianne Feinstein on Thursday said that the order has been renewed every three months for the last seven years) and requires the numbers of both parties on a call to be handed over, as well as location data, call duration, unique identifiers, and the time of all calls.

The order doesn't cover call content.

As the Guardian reports, the document is the first demonstration that the current US administration is collecting, indiscriminately and in bulk, communications records of millions of US citizens, whether or not they're suspected of wrongdoing.

Why is this such a big deal?

The slides explicitly state that collection is being done "directly" from the servers of these US service providers:The American Civil Liberties Union (ACLU) answers that question in a posting of the court order that it's annotated with comments.

A few examples from the ACLU's annotations:

The court order likely refers to an earlier, longer opinion on the legality of using Section 215 of the Patriot Act to track all Americans’ phone calls that was never made public but should have been. The FBI and the military are focusing on purely domestic calls, "sweeping up the phone records of countless innocent Americans," the ACLU says.Even if the NSA doesn't record call content, it's collecting metadata that can be as sensitive as content: e.g., information about whom you’re calling, who calls you, how long you talk, and maybe even where you’re talking from. This allows the government to build a profile that can reveal political and religious affiliations, medical conditions, infidelities, and more.

But PRISM is larger than Verizon.

For its part, the Washington Post also obtained a top-secret document that showed that the NSA and the FBI are "tapping directly into the central servers" of the nine largest internet companies to extract audio and video chats, photographs, e-mails, documents, and connection logs that enable analysts to track foreign targets.

The Guardian on Friday reported that it has obtained documents that further show that the United Kingdom's electronic eavesdropping and security agency, Government Communications Headquarters (GCHQ), has been piggybacking on PRISM, secretly gathering intelligence.

According to The Guardian, PRISM allows GCHQ to bypass the formal legal process required in the UK to obtain content such as emails, photos and videos from internet companies based outside the country's borders.

US director of national intelligence James R. Clapper on Thursday confirmed in a statement that coverage from both newspapers pertains to collection of communications pursuant to Section 702 of the Foreign Intelligence Surveillance Act (FISA).

Clapper claimed that the two newspapers' coverage contains "numerous inaccuracies" but failed to elaborate.

The Washington Post obtained a set of 41 partially redacted briefing slides that describe the operation, intended for senior analysts in the NSA's Signals Intelligence Directorate.

The list of companies allegedly providing access to the NSA includes:

Google (Gmail, YouTube, etc)FacebookMicrosoft (Hotmail, Skype, etc.)AppleYahoo PalTalkAOL

Yet spokespeople at these companies have denied allowing the US government direct access to their servers, The Guardian reports.

Here's what spokespeople had to say, courtesy of the Guardian:

Apple: "We have never heard of PRISM. We do not provide any government agency with direct access to our servers and any agency requesting customer data must get a court order."Facebook: "When Facebook is asked for data or information about specific individuals, we carefully scrutinise any such request for compliance with all applicable laws, and provide information only to the extent required by law."Google: "Google cares deeply about the security of our users' data. We disclose user data to government in accordance with the law, and we review all such requests carefully. From time to time, people allege that we have created a government 'backdoor' into our systems, but Google does not have a 'back door' for the government to access private user data."Microsoft: "We provide customer data only when we receive a legally binding order or subpoena to do so, and never on a voluntary basis. In addition we only ever comply with orders for requests about specific accounts or identifiers. If the government has a broader voluntary national security program to gather customer data we don't participate in it."Yahoo: "Yahoo! takes users' privacy very seriously. We do not provide the government with direct access to our servers, systems, or network."Regarding executives speaking off the record, the Guardian writes: "Executives said they had never even heard of PRISM until contacted by the Guardian."

While that's a bit of what we do know about PRISM, there's plenty we don't know.

One of the main things we don't know, of course, is the identity of the whistleblower who leaked details of the program.

Whoever it is has risked getting him-, her- or themselves in deep trouble with this administration, which has proved zealous in pursuing whistleblowers.

Obama denounced this particular leak by saying it only helps terrorists when the media publicizes surveillance operations:

"If every step that we're taking to try to prevent a terrorist act is on the front page of the newspapers or on television, then presumably the people who are trying to do us harm are going to be able to get around our preventive measures."

The Atlantic pulled together some of the other remaining question marks in this article.

Just a small sample of the unknowns:

The slides show that PRISM supposedly supplies one-seventh of the intelligence that goes into Obama's daily briefings, yet only cost $20 million. How can it be so cheap?Why are Twitter and Amazon missing from the list? Does Twitter's fierce protection of user data have anything to do with it?Apple didn't join the list until October 2012, five years after Microsoft. Why? Are the tech companies lying about the access to their servers, forbidden from acknowledging the program or their participation, or is it being done surreptitiously, via an API or an intermediary, such as a government vendor?

CNN's Michael Pearson has put together an FAQ about how US data collection affects each of us.

But after we learn how it affects us, many of us will want to know how to protect ourselves from government spying on our email, online searches, Skype calls and other electronic communications.

To that end, PC World on Friday put out this list of tips on protecting your PC from PRISM.

These aren't guaranteed to make your PC surveillance-proof, mind you, but they're a start, at the very least. Just remember that, given enough resources, an attacker can ferret out most anything about us.

Some of PC World's tips:

Avoid using popular Web services. Rather than Google search, for example, try a lesser known search engine such as DuckDuckGo, which promises not to track or store your search history.Ditch your smartphone. If you go with a dumb phone, you're likely still trackable, but it can capture a whole lot less information about you.Encrypt your hard drive, files and email. Subscribe to a VPN.

Of course, these protective measures beg the question: If you're a serious criminal, wouldn't you already be using secure communications anyway, covering your tracks with strong encryption and using throwaway phones?

Follow @LisaVaas
Follow @NakedSecurity

Image of President Obama, surveillance cameras, and American flag courtesy of Shutterstock.

View the original article here