Tokyo airport employee loses handwritten passcodes ahead of Obama visit

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The dangers associated with writing passwords down were expertly demonstrated by a Japanese airport worker over the weekend as the country prepared for the first visit by a US president in almost 20 years.

Rubbish bins and luggage lockers have been sealed and over 16,000 police officers have been mobilised in the capital city of Tokyo ahead of President Barack Obama's visit Wednesday night - but it may be the loss of several passcodes that has caused the biggest security headache so far.

Speaking on Tuesday, a transport ministry official said that an employee of Skymark Airlines at Tokyo's Haneda International Airport mislaid a printout containing key passcodes on Sunday.

The document was found just thirty minutes later on the floor of the departure lobby but the Japanese government were not prepared to take any chances.

Whilst there is no word on which areas of the airport would have been accessible with the lost codes, the ministry instructed the company that manages Haneda International to change them immediately in order to avoid even the slightest chance of a security breach.

The security faux pas comes at an awkward time for the airport, as it is just one month since the Metropolitan Police Department created a dedicated counter-terrorism unit tasked with securing the facility after the number of international flights was increased by almost fifty percent.

The same airport is also set to become a key destination when the Olympic games are hosted in the city in 2020.

It also comes at a time when airport security in general is under the spotlight following the news that a 16-year-old boy had survived a five-hour flight in an aircraft's wheel well. The lad had jumped a fence at San Jose airport and was able to gain access to the plane's undercarriage without alerting security.

But the Tokyo airport isn't alone in having a problem with remembering security codes or passwords without the need to write them down – other organisations have had a good go at embarrassing themselves recently too.

Two years ago a televised ESPN interview took place in front of a wall which proudly displayed two passwords, and in February a CBS Super Bowl report clearly displayed the TV station's WiFi username and password in the background.

You may also remember the Polish television broadcast that featured a woman being interviewed in front of a whiteboard that displayed the company's login credentials and Prince William's RAF photos that showed off an incredibly lame password choice.

So how can you choose a password that is both strong and easy enough to remember without having to write it down?

This video from Sophos gives some great practical advice on doing just that.

As said in the video, it would be foolish to then reuse that same password across the entire web because, should it be compromised in any way, the bad guys will then have access to ALL of your accounts.

Therefore, it would be wise to also use a password manager, such as KeePass or LastPass, which will allow you to store many complex passwords whilst only needing to remember one - and, whatever you do, don't write it down!

Follow @Security_FAQs

Follow @NakedSecurity

Image of Tokyo Airport and password courtesy of Shutterstock.

View the original article here

Apple iMessage "censors" mention of Obama: international conspiracy...or software bug?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

If you like conspiracy theories, you'll love the latest stories going around about Apple iMessage.

The conspiracy, sorry, issue actually first hit the techies' airwaves late last year.

It's recently been revived in a politically intriguing form.

It goes like this: try sending the message I could be the next Obama via the iMessage service from your iPhone or your iPad.

The last word will be cut off!

And not just any last word: the George Bushes, for example, survive the privations of iMessage; so do Clinton, Reagan, and even William Henry Harrison.

Old Tippecanoe, as Harrison was known, was the shortest serving US president, cut down by pneumonia after just 32 days at the helm, but he doesn't get cut short by iMessage.

Apparently, even natural born Americans can't be the next Obama, or at least can't tell anyone that they could be, at least while they're iOS users.

Here's natural born earthling and intrepid Naked Security researcher Graham Cluley trying it out:

You'll have to take my word for it. He really was trying to say that he could be the next Obama, but couldn't.

It's not censorship, of course, nor anything conspiratorial, nor even an Easter Egg, as some people have speculated.

Software Easter Eggs are unexpected messages or features, intended to amuse, that turn up under unlikely conditions.

Although many Easter Eggs might be reasonably be considered "mostly harmless," and some are indeed both fascinating and witty, they're certainly best avoided in messaging software, or at least in the parts of messaging software that actually speak on your behalf.

Actually, and I hate to be the killjoy who brings you this news, Easter Eggs are probably best avoided altogether these days, especially if they are complex. (Microsoft's Excel 97 included a hidden flight simulator!)

That's because Easter Eggs are, pretty much by definition, little tested and under-scrutinised.

Those are two characteristics that modern software can do without now that vulnerabilities and exploits have commercial value and are actively sought by Good Guys and Bad Guys alike.

Anyway, you may stand down from puce alert.

The missing Obamas are caused by a good, old-fashioned bug.

Keen observers have noticed that if you cut-and-paste from the offending message bubble, you get your Obama back.

The most credible explanation I've seen is that is that the code that presents the message reckons that it will just fit on one line, and prepares a one-line bubble for the purpose.

But the code that actually formats the message reckons that it won't quite fit on one line, and thus renders it with the last word on a second line.

In short, the word Obama is there; you just can't see it.

You can imagine how this might happen: a bug that's a relative of what's called an off-by-one or fencepost error, because a fence that is X sections long actually needs X+1 fenceposts to finish it off.

Here's a visual example of this sort of programming mistake:

/* Is this a one-line case? */if (pixelsize(msg) <= pixelsononeline) { specialonelinemessage(msg);}. . ./* Later, processing the message */if (pixelsize(msg) >= pixelsononeline) { multilinerender(msg);}

The two comparisons have a nasty discrepancy.

The first considers it a single-line message if it's no longer than number of pixels available on one line.

The second test looks very similar, but expressed the other way around: it's checking that the message won't fit on one line instead of that it does.

But the opposite of "less than or equal to" is "greater than," not "greater than or equal to."

In our synthetic example, only a message that is exactly the same pixel length as a line will be treated differently by the two code fragments and trigger the bug; all other messages will be handled correctly.

By the way, that's one reason why software testing is hard.

In this case, for example, it isn't enough just to test lots of different messages of randomly-varying length; you also need a structured test where you generate and test messages at all possible pixel lengths.

It may not seem important here, but in code that manages memory, off-by-one errors often lead to buffer overflows, and those sometimes lead to exploits.

So, if you're a software engineering manager and you do get to be the next Obama, consider trying to persuade Congress to offer some sort of tax relief to the QA guys!

Follow @duckblog

View the original article here

Hackers falsely claim Obama dead on Fox Twitter feed

WASHINGTON (Reuters) - Hackers took control of a FoxNews.com Twitter account on Monday and sent six false tweets saying that U.S. President Barack Obama had been shot dead, prompting an investigation by the Secret Service.

"Hackers sent out several malicious and false tweets that President Obama had been assassinated," Foxnews.com said in a statement about the latest in a wave of high-profile cyber security breaches around the world.

"Those reports are incorrect, of course, and the president is spending the July 4 holiday with his family."

The media outlet, owned by Rupert Murdoch's News Corp, said the incident was being checked.

"The hacking is being investigated, and FoxNews.com regrets any distress the false tweets may have created," it said.

Obama is celebrating the July 4 Independence holiday with his family at the White House and was due to host military families to watch Fourth of July fireworks in the evening.

The White House declined to comment. The Secret Service, which is charged with protecting the president, said it was looking into the incident.

"The Secret Service is investigating the matter and will conduct the appropriate follow-up," spokesman George Ogilvie said.

The first hacked tweet appeared around 2 a.m. and said: "@BarackObama has just passed. The President is dead. A sad 4th of July, indeed. President Barack Obama is dead."

The next one, "@BarackObama has just passed. Nearly 45 minutes ago, he was shot twice in the lower pelvic area and in the neck; shooter unknown. Bled out."

The false tweets were removed around noon today, a Fox News spokeswoman said, after Twitter suspended the account.

Fox News Digital Vice President and General Manager Jeff Misenti said FoxNews.com was working with Twitter to address the situation as quickly as possible.

"We will be requesting a detailed investigation from Twitter about how this occurred, and measures to prevent future unauthorized access into FoxNews.com accounts," Misenti said.

In an email statement to Reuters, a spokesman for Twitter said, "while Twitter does monitor accounts for brute-force log-in attempts and similar methods of attack, we're unable to anticipate compromises that take place due to off-site behavior."

The Twitter spokesman also said that Fox News indicated its account had been compromised.

CYBER BREACHES

A group calling itself The ScriptKiddies claimed responsibility for sending the tweets -- including "#ObamaDead, it's a sad 4th of July" -- from the "FoxNewspolitics" news feed before Twitter suspended its access.

In all some six false tweets were issued, saying Obama had been shot at a restaurant in Iowa while campaigning.

Obama was not in Iowa this weekend. He returned on Sunday to the White House from a brief trip to Camp David in neighboring Maryland.

The Foxnews.com account hacking followed a wave of highly publicized cyber security breaches, including attacks on the bank Citigroup, Sony Corp., Apple and the U.S. Senate and Brazilian presidential websites.

The FoxNews.com hacking came two days before Obama's first "Twitter town hall" where he will field tweeted questions about the economy and jobs.

Twitter's co-founder and executive chairman, Jack Dorsey, is due to moderate that Wednesday session at the White House.

Fox.com, another Fox Entertainment Group website, was the target of an attack by hacker group Lulz Security in May.

LulzSec has also made assaults on Sony, the U.S. Central Intelligence Agency (CIA) and other targets. The attacks have mostly resulted in temporary disruptions to websites and the release of user credentials.

(Additional reporting by Ilaina Jonas, Tom Doggett, Jeff Mason and Nadia Damouni; Editing by Sandra Maler and Steve Orlofsky)

View the original article here

Hackers falsely claim Obama dead on Fox Twitter feed

WASHINGTON (Reuters) - Hackers took control of a FoxNews.com Twitter account on Monday and sent six false tweets saying that U.S. President Barack Obama had been shot dead, prompting an investigation by the Secret Service.

"Hackers sent out several malicious and false tweets that President Obama had been assassinated," Foxnews.com said in a statement about the latest in a wave of high-profile cyber security breaches around the world.

"Those reports are incorrect, of course, and the president is spending the July 4 holiday with his family."

The media outlet, owned by Rupert Murdoch's News Corp, said the incident was being checked.

"The hacking is being investigated, and FoxNews.com regrets any distress the false tweets may have created," it said.

Obama is celebrating the July 4 Independence holiday with his family at the White House and was due to host military families to watch Fourth of July fireworks in the evening.

The White House declined to comment. The Secret Service, which is charged with protecting the president, said it was looking into the incident.

"The Secret Service is investigating the matter and will conduct the appropriate follow-up," spokesman George Ogilvie said.

The first hacked tweet appeared around 2 a.m. and said: "@BarackObama has just passed. The President is dead. A sad 4th of July, indeed. President Barack Obama is dead."

The next one, "@BarackObama has just passed. Nearly 45 minutes ago, he was shot twice in the lower pelvic area and in the neck; shooter unknown. Bled out."

The false tweets were removed around noon today, a Fox News spokeswoman said, after Twitter suspended the account.

Fox News Digital Vice President and General Manager Jeff Misenti said FoxNews.com was working with Twitter to address the situation as quickly as possible.

"We will be requesting a detailed investigation from Twitter about how this occurred, and measures to prevent future unauthorized access into FoxNews.com accounts," Misenti said.

In an email statement to Reuters, a spokesman for Twitter said, "while Twitter does monitor accounts for brute-force log-in attempts and similar methods of attack, we're unable to anticipate compromises that take place due to off-site behavior."

The Twitter spokesman also said that Fox News indicated its account had been compromised.

CYBER BREACHES

A group calling itself The ScriptKiddies claimed responsibility for sending the tweets -- including "#ObamaDead, it's a sad 4th of July" -- from the "FoxNewspolitics" news feed before Twitter suspended its access.

In all some six false tweets were issued, saying Obama had been shot at a restaurant in Iowa while campaigning.

Obama was not in Iowa this weekend. He returned on Sunday to the White House from a brief trip to Camp David in neighboring Maryland.

The Foxnews.com account hacking followed a wave of highly publicized cyber security breaches, including attacks on the bank Citigroup, Sony Corp., Apple and the U.S. Senate and Brazilian presidential websites.

The FoxNews.com hacking came two days before Obama's first "Twitter town hall" where he will field tweeted questions about the economy and jobs.

Twitter's co-founder and executive chairman, Jack Dorsey, is due to moderate that Wednesday session at the White House.

Fox.com, another Fox Entertainment Group website, was the target of an attack by hacker group Lulz Security in May.

LulzSec has also made assaults on Sony, the U.S. Central Intelligence Agency (CIA) and other targets. The attacks have mostly resulted in temporary disruptions to websites and the release of user credentials.

(Additional reporting by Ilaina Jonas, Tom Doggett, Jeff Mason and Nadia Damouni; Editing by Sandra Maler and Steve Orlofsky)

View the original article here

Fake reports: Hackers claim Obama shot in the QC - Quad City Times

Hackers used a Fox News Twitter account, @foxnewspolitics, to post a series of messages Monday, claiming the president was shot and killed at Ross’ Restaurant in Bettendorf, the New York Times reported.

President Barack Obama visited the restaurant during his June 28 visit to the Quad-Cities for a tour and speech at Alcoa Davenport Works.

FoxNews.com later posted a brief statement saying that the reports were incorrect, and that it regretted “any distress the false Tweets may have created,” the Times reported.

Melissa Freidhof-Rodgers, manager of Ross’ Restaurant and daughter of owners Cynthia and Ron Freidhof, said Monday that she had no comment about the Twitter posts and added that she wants to maintain the positive experience of having the president visit the restaurant.

After the president’s visit, Freidhof-Rodgers appeared on MSNBC’s “Rachel Maddow Show,” to show viewers the two meals the president ordered during his stop — the Magic Mountain and Volcano.

The six messages posted on the Fox New Twitter account were removed about noon Monday, about 10 hours after they were first posted, the Times reported.

The paper also reported that senior Secret Service officials gathered Monday morning to discuss the Twitter posts. A spokesman for the Secret Service, George Ogilvie, told the paper, “We are investigating the matter and will be conducting appropriate follow-up.”

Jeff Misenti, the vice president and general manager of Fox News Digital, said in a later statement Monday that the news organization would be requesting “a detailed investigation from Twitter about how this occurred, and measures to prevent future unauthorized access into FoxNews.com accounts,” the Times reported.

Obama stopped at the restaurant to follow up on a pledge he made to Cynthia Freidhof at a 2007 campaign event in the Quad-Cities. Friedhof asked Obama from the audience how he could help small businesses. Her husband, Ron, is “on the fence,” she said.

Obama said to get him on the phone, and she dialed her cell phone. As she was calling, Obama told the crowd that he advocates tax cuts that would help small businesses. She handed him the phone and he spoke briefly to her husband. Obama acknowledged that his call was coming during the busy lunch rush. “How’s lunch hour?” Obama asked. “I’ve got to try one of the Magic Mountains. I’ll talk to you soon.”

View the original article here

Hackers tweet ‘Obama assassinated’ on Fox News account

A group of hackers targeted a Fox News Twitter account early Monday morning and posted a series of false updates declaring that President Barack Obama had been assassinated.

It is reported that the hackers behind the Twitter attack have now claimed responsibility.

‘Scriptkiddies’ took control of @foxnewspolitics - a bona fide account of the US news service with 33,000 people following it - at the beginning of 4 July, which is a public holiday in the US for Independence Day.

People following Fox’s politics feed account would have seen the shocking hoax posts that claimed the President was dead appearing from 2.43am EDT (Eastern Daylight Time), with hundreds of them forwarding this on to their followers.

Twitter

Fox News politics’ account had been inactive for three days before the group initiated the hijack posting “regained full access to our Twitter account”.

The hackers then continued: “Barack Obama has just passed. The President is dead. A sad 4th of July, indeed. President Barack Obama is dead.”

View the original article here

Hackers hijack Fox News Twitter account, post Obama was assassinated

Hackers broke into Fox News' politics Twitter account and posted several messages that President Obama had been shot and killed

Red-faced Fox News editors were scrambling early Monday to figure out how hackers broke into one of their Twitter accounts and posted several messages that President Obama had been assassinated.

The hackers broke into the broadcaster's Fox News Politics account at around 2 a.m. and posted several messages that President Obama had been shot and killed while campaigning in Iowa.

"@BarackObama has just passed. The President is dead. A sad 4th of July, indeed. President Barack Obama is dead," the first post said.

Moments later, the hackers wrote that Obama had been "shot twice in the lower pelvic area and in the neck; shooter unknown. Bled out."

After three more rapid-fire tweets, including one that said Obama had been killed at "Ross' Restaurant in Iowa," the hackers signed off by wishing Vice President Joe Biden luck as the country's new president.

"In such a time of madness, there's light at the end of tunnel," the hoaxsters wrote.

The seven phony tweets were still visible on the account, which carries Twitter's baby blue "verified account" badge, for most of Monday morning. They were deleted at around noon.

Fox's politics account has nearly 35,000 followers.

A group of hackers called The Script Kiddies appeared to claim responsibility for the Independence Day hoax, BBC News reported.

At one point, the account's picture was replaced with the group's logo, and a description said, ""H4CK3D BY TH3 5CR1PT K1DD3S."

In an interview with Stony Brook Magazine's Think magazine, a person claiming to be a part of the organization said the group had close ties to the infamous hacking clan Anonymous.

The Script Kiddies allegedly broke into the account sometime around midnight Sunday and posted a few tweets that linked back to their own account before beginning the Obama ruse, Think reported.

Twitter accounts that appeared to belong to the group, including @TheScriptKiddie and @ScriptKiddi3s, were suspended Monday morning.

Think's website was also shut down at around noon on Monday, but came back online a short time later.

Jeff Misenti, vice president and general manager of Fox News Digital, said Fox was working with Twitter to address the situation.

"We will be requesting a detailed investigation from Twitter about how this occurred, and measures to prevent future unauthorized access into FoxNews.com accounts," Misenti said in a statement.

The Secret Service said the law enforcement agency whose job it is to protect the president will conduct a probe of the nasty cyber swindle. 

Obama was spending the day with his family and scheduled to speak on the South Lawn of the White House at 6:30 p.m.

The break-in was the second time in recent months that Fox has been hacked.

In May, the hacking group Lulz Security leaked computer passwords of Fox employees online, changed several employees' LinkedIn accounts and posted the personal information of more than 70,000 contestants from talent show, The X Factor.

With News Wire Services

pcaulfield@nydailynews.com

View the original article here

Hackers claim Obama dead on Fox Twitter feed

Published: 6:53AM Tuesday July 05, 2011 Source: Reuters

Barack Obama - Source: Reuters

Hackers took control of a FoxNews.com Twitter account on Monday and sent six false tweets saying that US President Barack Obama had been shot dead.
   
"Those reports are incorrect, of course, and the president is spending the July 4 holiday with his family," Foxnews.com said in a statement about the latest in a wave of high-profile cyber security breaches around the world.
   
"Hackers sent out several malicious and false tweets that President Obama had been assassinated," said the conservative media outlet owned by Rupert Murdoch's News Corp.
   
"The hacking is being investigated, and FoxNews.com regrets any distress the false tweets may have created," it said.
   
Obama is celebrating the July 4 Independence holiday with his family at the White House and was due to host military families to watch Fourth of July fireworks in the evening.
   
The White House and Secret Service both declined to comment on the incident.
   
The first hacked tweet appeared around 2 a.m. and said: "BarackObama has just passed. The President is dead. A sad 4th of July, indeed. President Barack Obama is dead."
   
The next one, "BarackObama has just passed. Nearly 45 minutes ago, he was shot twice in the lower pelvic area and in the neck; shooter unknown. Bled out."
   
Fox News Digital Vice President and General Manager Jeff Misenti said FoxNews.com was working with Twitter to address the situation as quickly as possible.
   
"We will be requesting a detailed investigation from Twitter about how this occurred, and measures to prevent future unauthorized access into FoxNews.com accounts," Misenti said.
   
Cyber breaches
  
A group calling itself The ScriptKiddies claimed responsibility for sending the tweets - including "?ObamaDead, it's a sad 4th of July" - from the "FoxNewspolitics" news feed before Twitter suspended its access.
   
In all some six false tweets were issued, saying Obama had been shot at a restaurant in Iowa while campaigning.
   
Obama was not in Iowa this weekend. He returned on Sunday to the White House from a brief trip to Camp David in neighboring Maryland.
   
The Foxnews.com account hacking followed a wave of highly publicized cyber security breaches, including attacks on the bank Citigroup, Sony Corp., Apple and the US Senate and Brazilian presidential websites.
   
Monday's breach raised questions about the integrity of news feeds on Twitter, which is increasingly used by news outlets as well as government officials as a way to reach readers and supporters.
   
Twitter spokeswoman Jodi Olson declined to say whether the company would add more security as a result of the attack, but stressed it was important for users to shield their profiles.
   
"We don't comment on specific accounts. In general, though, it's always good to remind people of the importance of actively protecting their account credentials," Olson said, recommending that all users have a strong password as a "starting point."
   
The FoxNews.com hacking came two days before Obama's first "Twitter town hall" where he will field tweeted questions about the economy and jobs.
   
Twitter's co-founder and executive chairman Jack Dorsey is due to moderate that Wednesday session at the White House.
   
Fox.com, another Fox Entertainment Group website, was the target of an attack by hacker group Lulz Security in May.
   
LulzSec has also made assaults on Sony, the U.S. Central Intelligence Agency (CIA) and other targets. The attacks have mostly resulted in temporary disruptions to websites and the release of user credentials.

Technology News VideoEmail

Choose the news you want when you want it, all in one personalised daily e-mail.

Mobile Devices

TVNZ is available on mobile phones: Text TVNZ to 8869.

Social Media

TVNZ on Facebook and Twitter.

News Feeds

See when TVNZ have added new content. You can get the latest headlines anywhere.

Podcasts

Enjoy TVNZ on the move - a wide range of programmes and highlights are available.

View the original article here