Sysadmin day? *SYSADMIN DAY*? Angry techie takes against Naked Security...

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Not everyone is pleased that we've been asked to recognise the efforts of our IT staffers today. No sooner had we launched our Worst things to ask a sysdmin poll than we received an anonymous email from a disgruntled sysadmin called Simon Oliver Meone. He questioned the sincerity of, well, the whole world, really. Having binned his mail to start with, we suddenly thought you might benefit from his jaundice. So we extracted his email from the virtual wastebasket, smoothed it flat and published it here.

\sarcasm{on}

Dear Naked Security,

\sarcasm{off}

Just saw your smug little piece about being nice to sysadmins today.

SYSADMIN APPRECIATION DAY?

Did I read that correctly? I'll tell you what I think of that! Read my lips...on second thoughts, you never bothered to learn how to do that, did you? Did you never stop to wonder how it is I seem to know what you want before you reach my desk? Apart from reading your email and your instant messages, of course, which is actually the easiest way to do that trick, if I'm honest.

Because *I* learned to lip read, that's why, so I know what you're saying from a distance. You're probably wondering why I bothered, but then most things to do with technology probably make you wonder, so that was hardly worth saying.

The reason should be obvious - it's so I don't need audio while I'm watching all those old episodes of Star Trek that I stashed in the hidden P2P directory on your laptop. That means I am able to be attentive and get in a good couple of pertinent and toadying observations during those interminable monthly corporate conference calls, because I can *listen* to the call while *watching* Kirk and Spock do exciting intergalactic stuff.

You, on the other hand, have to *watch* the conference call while *listening* to Nigella Lawson do something culinary with a root vegetable that appears to fill you with wonder, so you never get to show appreciation to your office overlords at just the right time.

And why is that you lot are so star-struck by those celebrity chefs?

There's one of them that goes around pouring liquid nitrogen on things to make these amazing desserts, and you're like, "Wow! Check that chemical reaction!' Firstly, nitrogen is inert. Cooking with liquid nitrogen isn't CHEMISTRY, it's PHYSICS. Secondly, who do you think invented the use of cryogenics in the kitchen? OK, in our case, in the server room.

How do you think sysadmins make ice cream? We *pioneered* the use of industrial-grade processes to prepare individual meal portions!

Actually, I have to say that I met a Navy noncom once who was way, way ahead of our tribe in the sledgehammer-to-crack-nuts school of gastronomy. Did you know that if you lash one of those single-cup stove-top espresso makers to the breech of a 5"/54 Mark 45, the exothermic violence when the weapon fires gives you a perfect shot with every shot?

Anyway, you've got this poll going on where you are trying to teach people not to say things that you think sysadmins don't like to hear, such as "You don't look very busy" and "We're out of coffee."

And that is why I am writing to you to complain.

I LIKE to hear that you think I don't look very busy, because I AIM not to look very busy, and I do that by NOT being very busy.

Think about it.

I spent years - at school, at home, at college, in my first job, in my second job, in between home-made ice creams (try pouring chocolate milk into liguid N2 and tell me it's not superb), in my (m..n)th jobs for 2 < m <= n - learning how to program.

I can program in Bash, Python, C, D, Haskell, ocaml, Lua, Befunge, Erlang - any language at all except Java, in fact, which I refuse to learn on doctrinal grounds - so I don't NEED to be busy.

I've BEEN busy, writing code to do everything for me.

I've even written some Perl modules that watch those Star Trek episodes for me while I'm listening to conference calls, using advanced image processing to detect when the USS Enterprise reaches a new planet. Then it sends me an IM, so I can stop working on the other code I'm writing and watch only the good bits.

(The new code will respond automatically to the IMs about the new planets, and start watching for me to make sure it's not a new planet I already know about, and then I won't need to be distracted as much by Star Trek, leaving me free to catch up on Dr Who while I'm watching Star Trek while I'm on the conference calls.)

And the other thing I want to complain about is that bit about not saying, "We're out of coffee."

I LIKE it when you tell me *you're* out of coffee. Why would *I* be out of coffee just because *you* are?

The question you really need to ask is, "Why are *we* out of coffee, while *you* are not?"

See what I'm saying?

Yours sincerely,

S. O. Meone

System Administrator (Smartest Amidst Irony)

Follow @duckblog

PS. Sysadmins do love their users really. Especially users bearing pizza. Even if it's made using conventional convection cooking techniques. So please enter, and get your colleagues to enter, the Sophos Win-A-Pizza-Party competition, and make some sysadmin's day! Click here to enter. (Only residents of the UK or the USA are eligible to win. Sorry about that.)

View the original article here

Gun-wielding penguin takes over Ubuntu Forums, waves AK-47 at Linux users everywhere

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Mark Shuttleworth is famous for two things: for being the first African in space, and for founding Canonical, the company behind Ubuntu Linux.

? I know it't not really Ubuntu Linux. It's Ubuntu, a computing platform based on GNU/Linux and including lots more besides. But we shall call it "Ubuntu Linux" as a sort of handy abbreviation.

Ubuntu was arguably the first Linux distro to attract the attention of ungeeks, to provide an installer that tended to "just work" without any jargon, and to gain a foothold of any sort amongst the type of user that would otherwise perfectly happily have paid for Windows or OS X.

As a result, it spawned a range of online forums dedicated to supporting and nurturing its large fan base, handily collated into the Ubuntu Forums portal.

Ubuntu Forums is bankrolled by Canonical, and should look something like this:

Over the weekend, however, it looked like this:

(That's supposed to be Tux, the penguin mascot of Linux, waving an AK-like assault weapon in his flippers.)

By now, the day after the attack, there's just a breach alert holding page put up by Canonical:

It's hard to imagine what the hackers hoped to achieve by taking out a bunch of free forums for a free distro of a free operating system.

Some commenters in the Twittersphere can't find rhyme or reason either, and have let rip with opprobrious tweets to make their displeasure known:

Of course, one perfectly likely explanation for the hack is clear from Canonical's mea culpa letter: for the personally identifiable information (PII) that it yielded.

Unfortunately the attackers have gotten every user's local username, password, and email address from the Ubuntu Forums database.

With close to 2 million signed-up members, that could mean a lot more spam for a lot of people.

And for those who have chosen poor passwords, the stolen password database could mean worse than that.

Canonical stated that:

The passwords are not stored in plain text, they are stored as salted hashes.

It might have been handy if Canonical had said what sort of salting-and-hashing was used, to give some idea of how quickly an attacker could try a dictionary of passwords against the stolen data.

On the other hand, if you change your password as soon as the Forums come back on line (and it's likely Canonical will force everybody to do so anyway, for safety's sake), and you haven't used the same password anywhere else, you ought to be OK.

Here's our advice:

When you choose a password, don't pick anything obvious. Attackers put the most likely passwords at the top of their dictionary lists, so the tougher your password, the later it will fall, if at all.Don't use the same password on multiple sites. Doing so means that your login details on the most important site are at risk from an attack on the least secure one.If you store password databases, use a strong salt-and-hash system (e.g. bcrypt, scrypt or PBKDF2) that makes it much harder and slower for attackers to go through their password dictionary, but not so slow that it's impracticable to verify individual passwords when your users login.

Follow @duckblog

View the original article here

Apple takes Dev Center down for days, finally admits, “We got owned!”

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

What a weekend!

First Ubuntu and now Apple have admitted to large-scale breaches of their user databases.

The Ubuntu Forums hackers called attention to themselves by changing the main screen to a cartoon of an AK-47-wielding penguin, and Canonical owned up as soon as it could.

But Apple's breach was less obvious at first, with the Developer Center simply going offline with the most generic sort of explanation:

We apologize that maintenance is taking longer than expected.

Apple told developers whose membership would expire during the outage not to worry, giving them a free extension and reassuring them that their apps wouldn't be ejected from the App Store:

If your program membership was set to expire during this period, it has been extended and your app will remain on the App Store.

But as the outage dragged on from last Thursday into the weekend, some observers began to ask if there were more sinister reasons than merely a maintenance window gone wrong.

After all, Apple is one of the massive success stories of the modern cloud economy (iTunes, QED), which makes maintenance alone a decreasingly likely explanation the longer it takes.

It turns out the cynics were right.

Apple's Developer Centre was penetrated, with Cupertino admitting that the attackers seemed to be after personally identifiable information (PII).

The main developer page looks OK at first sight:

But if you try to click through to any of the developer-specific locations, such as the iOS Dev Center or the Mac Dev Center, you don't get very far:

The notice, which was also sent by email to registered developers, now admits the reason for the extended maintenance:

Last Thursday, an intruder attempted to secure personal information of our registered developers from our developer website. Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers’ names, mailing addresses, and/or email addresses may have been accessed. In the spirit of transparency, we want to inform you of the issue. We took the site down immediately on Thursday and have been working around the clock since then.

Investigating a breach of this sort requires considerable circumspection, not least because you need to make sure that such evidence as you have available for law enforcement is safe and sound before you say too much.

That might explain Apple's delay in telling it like it is, but I'm still not quite sure how many friends in the developer community Apple will win by invoking "the spirit of transparency" some two-and-a-half days late.

The next part of Apple's admission, which seems to be intended to explain why actually fixing things is taking longer than might have been expected, says:

In order to prevent a security threat like this from happening again, we're completely overhauling our developer systems, updating our server software, and rebuilding our entire database.

It sounds slightly worrying to hear that Apple is updating its server software after the incident.

With all of this in mind, here's what we recommend:

Patch early, patch often.Proactive security isn't just for Windows users.If you suffer a breach, remember that honesty is the best policy, and time is of the essence.

What now?

Well, let's hope that operating system data breach notifictions aren't like buses, where you wait a while and then three come at once.

Ubuntu/Linux, then Apple/OS X...who/what, do you think, would be next?

Follow @duckblog

View the original article here

IBM takes a big new step in cryptography: practical homomorphic encryption

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

IBM just released an open source software package called HELib.

The HE stands for homomorphic encryption.

Although it doesn't sound terribly sexy or impressive, HELib is actually an interesting and important milestone in cryptography.

HE is also a surprisingly relevant topic right now, with our ever-increasing attraction to cloud computing.

Bear with me, and I'll try to explain.

Imagine that I am your cloud provider, and I keep databases online for you.

Imagine also that I am a security-conscious vendor, so I keep all your data encrypted, both when I serve it up to you, and when I save it to disk.

That's about as good as it gets these days from a cloud security perspective.

? It doesn't matter whether I'm a pure-play over-the-internet cloud provider, or just the manager of the server farm team in your own IT department. The situations are similar, though they may differ in degree: I've got your data, and you have no alternative but to trust me to do the right thing with it.

Now imagine that you want me to search through your data, for example to see how many ACME-WIDGETS were bought by customers called DUCKLIN in the last year.

Traditionally, the process would go something like this:

You encrypt the search terms and upload them to me.I decrypt the search terms so I know what to look for.I decrypt your data (perhaps only record by record, not all at once - that's a detail that doesn't matter here) so I have somewhere to search.I perform the search using the decrypted data.I encrypt the search results, if there are any, and return them to you.

Additionally, you hope that:

I get rid of all remnants, on disk and in memory, of both the search terms and the decrypted data once the search is complete.I don't take advantage of you, since I'm decrypting your data for this search, to sneak in other searches at the same time, whether for my own benefit, or for my government, or for one of your competitors.

There's a lot that could go wrong - for you, at any rate.

Imagine, however, if I could simply take your encrypted search terms, leave them encrypted, search for them directly in the still-encrypted database, and get the same results.

If I can perform calulations directly on your encrypted data, yet get the same results that you get from the unencrypted data, we both win enormously from a security and privacy point of view.

You don't need to give me any decryption keys at all, so you no longer have to trust me not to lose, steal or sell your data. (You still have to trust me to tell you the truth about any results I work out for you, but that is a completely different issue.)

And I no longer need your decryption keys, so I can't lose or abuse your data even if I wanted to.

That's the promise of homomorphic encryption, which we mentioned at the start.

Until 2009, no-one was sure whether homomorphic encryption was even possible.

Then, a Stanford student and IBM researcher called Craig Gentry showed that it could be done, in a PhD thesis entitled simply, "A fully homomorphic encryption scheme."

We weren't home and dry yet, though.

Gentry had what amounted to an existence proof, showing that homomorphic encryption could no longer be considered impossible, but he didn't have a practicable real-world implementation of the concept.

At the time, back in July 2009, well-known cryptographic personality Bruce Schneier praised Gentry's efforts, but pointed out that:

Gentry's scheme is completely impractical... Gentry estimates that performing a Google search with encrypted keywords - a perfectly reasonable simple application of this algorithm - would increase the amount of computing time by about a trillion.

Well, we're now a few steps further forwards, with IBM's release of the abovementioned software package HELib:

HElib is a software library that implements homomorphic encryption (HE). Currently available is an implementation of the Brakerski-Gentry-Vaikuntanathan (BGV) scheme, along with many optimizations to make homomorphic evaluation runs faster, focusing mostly on effective use of the Smart-Vercauteren ciphertext packing techniques and the Gentry-Halevi-Smart optimizations.

With a package description like that, it's obvious that consumer-facing homomorphic encryption tools aren't going to be a click away at the Play Store or the App Store for a while yet.

On the other hand, four years ago we didn't even know whether it would be possible to have homomorphic encryption at all.

So, watch this space!

Follow @duckblog

View the original article here

Kim Dotcom's Megaupload saga takes another turn - FBI wins appeal in extradition case

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The Kim Dotcom saga took yet another turn today.

The New Zealand Court of Appeal knocked back one of the big fella's earlier minivictories again US law enforcers.

You probably don't need reminding, but the sequence goes something like this:

Kim Dotcom is arrested in a large-style raid by NZ Police over his Megaupload file sharing service. Dotcom is remanded in custody, pending extradition to the USA on charges including racketeering (organised criminality) and money laundering. Dotcom, to the surprise of many, gets bail. (He's ordered to keep within 80km of his house, and to stay away from helicopters.) Dotcom wins a court action forcing the FBI to expose much more detail about its proposed case than it had so far given out in the extradition procedings.

Now add to that:

US authorities appeal the earlier judgment and succeed, with the court taking the FBI's side and agreeing that the extradition hearing needs only to establish that there is a case to answer, not to examine the same details that a full trial would.

This appeal now looks set to lead to an appeal against the appeal, with the next step to be along these lines:

Dotcom goes to the Supreme Court to try to win back the right to see all the evidence against him before, rather than after, his extradition.

Who knows where all this will lead?

Dotcom's Megaupload service was killed off, seemingly for ever, by the original arrests.

There doesn't seem to be any doubt that Megaupload was a hotbed of piracy, just doubt over the criminal liability of Dotcom and his fellow corporate officers for the content they enabled their users to share by means of the service.

On the anniversary of his arrest, the media-savvy Dotcom launched a son-of-Megaupload service known as Mega.

Mega uses public key cryptography in your browser so that Dotcom and his colleagues don't, and in theory can't, know what you're uploading.

The cryptographic system in the new Mega service also means that, since only the original uploader knows what's what, any sharing must be the fault (or the intent) of that user, who would need to pass on the decryption key of his own accord.

Indeed, Mega now brands itself as "the privacy company."

Will the effort put into making Mega lawsuit-safe against the owners make them look better in the Megaupload court action? ("See, we really do care about intellectual property after all.")

Or will they look worse? ("See, we clearly didn't care before or we'd have done this earlier.")

What do you think?

Follow @duckblog

Tags: appeal, arrest, Cryptography, dotcom, extradiition, FBI, Kim Dotcom, mega, megaupload, new zealand, piracy

View the original article here

But did she STEAL the iPhone? App takes photo of woman trying to unlock it

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A woman who tried to unlock a stolen iPhone unwittingly took her own photo. An app on the phone then automatically sent the photo to the owner, who called the police.

The app, identified by some media outlets as iGotYa, can only be installed on jailbroken iPhones.

iGotYa takes a picture of anyone who tries to unlock it, maps their location and then sends the information to the owner in an email.

That's exactly what happened in this particular case, Sussex Police said, with an iPhone that had been stolen from the Coalition nightclub in Brighton, East Sussex, earlier this month.

Police have released the picture of the woman who might have stolen the phone.

The Huffington Post quoted Pc Gavin Crute, of Sussex Police, as saying that they're eager to talk to the woman or anyone who might recognise her:

"We know where and when the photo was taken, and it appears to be in a vehicle with quite a large sunroof."

"We don't know that the woman is the person who stole the camera, but she obviously has had some connection with it in the meantime, and I'd like to speak to her about it."

Of course, not everyone wants to jailbreak their iPhones.

Fortunately, there are other ways to protect either an iPhone or an Android, as Naked Security outlines here.

Switching on a smartphone's GPS tracking function can help, and you can do that with either Apple's Find my iPhone app or, for Androids, Sophos's free Mobile Security app.

The cost of the phone is only one thing to worry about when it comes to losing a pricey smartphone, of course. Loss of data is another thing entirely.

Which is another reason to use one of these or similar applications: Either Find my iPhone or Sophos Mobile Security will remotely wipe data in case of theft or loss.

Many such applications include additional features such as protection from malware.

An enterprise edition of Sophos's free app, called Sophos Mobile Control, also allows you to:

Enforce your security policies to ensure complianceTurn on the built-in security features of iOS (iPhone/iPad), Android, BlackBerry and Windows Mobile devices, including password protection or any iOS encryption.Ensure that only registered devices that meet your policies - i.e., not rooted (Android) or jailbroken (iOS) - have full access to corporate data and that the users of non-compliant devices are blocked or face other consequences until the situation is rectified.Help locate, lock or wipe lost devices, from the admin web console or the self-service portal.Have an immediate overview of your company's device status from the security dashboard.Prove your corporate compliance with easy inventory and reporting tools.

You do need an app like iGotYa to take an automatic snapshot of people trying to unlock your device, though.

Whichever route you pick - free app, paid app that lets you snap photos of people trying to unlock your phone, or enterprise app with more features - is better than leaving that precious gadget stark naked, unprotected and untrackable.

In the meantime, if you recognise the woman in the photo, Sussex Police ask that you call it in. In England, dial your local police on their non-emergency number: 101.

Follow @LisaVaas
Follow @NakedSecurity

View the original article here

SSCC 98 - RSA keys, Blackhole exploits, Nitol botnets and Apache takes potshots at Microsoft

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

This week Paul Ducklin is in the guest seat as he and Chester look at the latest security news.

This week's topics include: Patch Tuesday, weak RSA certificates, how you might manage to lose $250,000 worth of Bitcoins, a new version of the Blackhole exploit kit, and the takedown of the Nitol botnet.

To finish off, Chet and Duck take a look at Apache's recent spat with Microsoft.

That's where Microsoft tried to do what it thought was the right thing about Do Not Track in its new browser, only to suffer a smackdown by the Apache open-source web server crew.

Neither Chet nor Duck mince their words in this segment, so make sure you listen to the end!

(17 Sep 2012, duration 14'48", size 10.7MBytes)

Follow @duckblog
-

Tags: Apache, bitcoin, bitfloor, BlackHole, botnet, buffoonery, chet chat, Cryptography, digital certificate, DNT, Do Not Track, Exploit, Exploit Kit, IE, Microsoft, nitol, Patch Tuesday, RSA, takedown, update, zombie

View the original article here

Anonymous Takes Down Massive Child Pornography Server, Leaks User Names - Geekosystem

In a move that we can all get behind, hacker group Anonymous has announced that they have taken down a huge cache of child pornography and released 1,589 usernames of the website’s patrons. The action came as part of Operation Darknet, which targets illicit websites that are part of an unindexed and therefore unsearchable corner of the Internet.

The server in question is owned by Freedom Hosting, and apparently services over 40 child pornography websites. The largest of these, disturbingly called Lolita City, was said to contain over 100gb of child pornography.

Interestingly, the Anonymous hack is extremely well documented. In two separate Pastebin posts, the hackers involved provide a timeline of events, as well as some of the methodologies they used in tracking and taking down the servers.

According to their timeline, the hackers first became aware of Lolita City while leading a related campaign against a portion of the Hidden Wiki which included links to child pornography. While working to suppress the Hidden Wiki for linking to child pornography, the group turned their attentions to the websites linked on the Wiki. Through their investigations, they discovered that many of the sites shared a similar “fingerprint” in that they were supported and hosted by a company called Freedom Hosting.

The group then issued an ultimatum to Freedom Hosting to remove the content, or be shut down through their attacks. Freedom Hosting refused, and has since been the target of the hacker’s ire.

While attacks by the hacker group have often been divisive, going after the supporters of child pornography is something that is hard to criticize. In fact, this might be the best application of the groups’ talents; an intersection of Internet knowledge and the ability to carry out electronic attacks. Of course, preventing child pornography from being moved around the Internet doesn’t stop the predators that created the materials. Hopefully, law enforcement will take up the information gleaned by the group and start making some arrests.

(via Security News Daily, Examiner)

Relevant to your interests

View the original article here

FBI Takes Down Servers in Quest for LulzSec Hackers - Storage (blog)

Thank you for recommending "Windows IT Pro is the leading independent community for IT professionals deploying Microsoft Windows server and client applications and technologies.".
Your recommendation has been successfully processed.

by Jeff James

The New York Times broke the story yesterday that the FBI had seized a number of servers from a datacenter located in Reston, VA owned by web hosting provider DigitalOne (offline at press time). According to the New York Times story, the FBI reportedly had information that some of the servers at DigitalOne were used by the hacker group LulzSec, so the agency raided the facility in the early morning hours of Tuesday, June 21st.

I find this news interesting for three reasons: To begin with, this raid signifies that LulzSec has managed to finally draw the ire of the likes of the FBI, CIA, Britain's Serious Organized Crime Agency (SOCA), and a number of other government agencies throughout Europe. All the aforementioned groups are reportedly working together to bring down LulzSec.

Secondly, initial reports surfacing about the DigitalOne raid raises some disturbing questions about the apparently destructive methods used by the FBI to confiscate servers used by LulzSec. While the data and information the FBI sought was located on a specific server, the agents involved reportedly pulled three entire enclosures of hardware from the data center, impacting dozens of DigitalOne clients who are unaffiliated with LulzSec and innocent of any wrongdoing.

Finally, that overly aggressive seizure of datacenter hardware by the FBI begins to cast further doubt on companies that are considering moving parts of their IT infrastructure into the cloud. What happens if you have critical business information co-located at a hosting provider, and the FBI or other government agency decides to seize the hardware? Windows IT Pro contributor David Chernicoff has a excellent post on this topic over at ZDNet, and any IT administrator considering the cloud for their IT resources would be wise to read it.

So what are your thoughts on the FBI raid of DigitalOne? Does the FBI's desire to stop LulzSec trump the rights of innocent parties who suffered due to their seizure of DigitalOne hardware? And what does this mean for cloud computing adoption? Let me know what you think by adding a comment to this blog post or by starting up a conversation on Twitter.

Follow Jeff James on Twitter at @jeffjames3
Follow Windows IT Pro on Twitter at @windowsitpro

Related Content:

View the original article here