Samsung Smart TV security hole allows hackers to watch you, change channels or plug in malware

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Did your Samsung Smart TV just switch channel?

Don't blame the dog for stepping on the remote control - there's a remote possibility it could be hackers who've hijacked your smart TV.

Researchers with Malta-based security consultancy and bug seller ReVuln have found a vulnerability in an unspecified model of a Samsung LED 3D TV that they exploited to get root access to the TV and any attached USB drives.

In a video titled "The TV is Watching You", ReVuln shows a Samsung TV screen with which the researchers systematically fiddle.

Here's what the researchers found they could access:

TV settings and channel listsSecureStorage accounts Widgets and their configurationsHistory of USB moviesIDFirmwareWhole partitionsUSB drives attached to the TV

By exploiting the vulnerability, ReVuln also found that they could retrieve the drive image, mount it locally, and check for sensitive documents or material that should remain private, such as usernames, passwords, financial documents, or any other type of material typically kept on USB drives.

If the victim uses a remote controller, ReVuln also found that they could get its configuration and thereby control the TV remotely.

ReVuln also found they could install malware remotely to gain complete root access to the TV, co-founder Luigi Auriemma told IDG News Service:

"If the attacker has full control of the TV...then he can do everything like stealing accounts to the worst scenario of using the integrated webcam and microphone to 'watch' the victim."

The vulnerability extends beyond one specific model tested in the firm's lab, he said:

"The vulnerability affects multiple models and generations of the devices produced by this vendor, so not just a specific model as tested in our lab at ReVuln."

ReVuln is a recent entrant into the market for buying and selling bug and vulnerability information and mostly focuses on vulnerabilities in SCADA and ICS software that run utilities, industrial systems and the like.

Auriemma has played around with TVs before. In April, he stumbled on a vulnerability in all current versions of Samsung TVs and Blu-Ray systems that would allow an attacker to gain remote access.

At the time, he said that the vulnerabilities could be found in all Samsung devices with support for remote controllers.

One hopes that the researchers have acted responsibly and informed Samsung of the vulnerabilities in their consumer devices, and that an over-the-internet firmware update to plug the security holes will be forthcoming.

Follow @LisaVaas
Follow @NakedSecurity

View the original article here

Watch Sophos's James Lyne audition for TED2013

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Have you heard of TED conferences, the nonprofit group with the 'ideas worth spreading' strapline?

Sadly, few people can afford to attend in person, with basic attendee tickets selling for around $7000 bucks a pop. But, in an attempt to spread ideas with the rest of us, TED.com streams what it deems to be its best content for free.

Sophos's James Lyne recently auditioned to present at next year's main conference in Long Beach California: "TED2013: The Young. The Wise. The Undiscovered".

Along with 300 other hopefuls, James auditioned with a rather passionate five-minute presentation entitled "Cryptography and the Power of Randomness".

For those that have seen him on stage at various industry conferences or trade shows, you probably remember his captivating and energetic style. And one could argue that he needs it to compete with that tweed jacket of his!

Take a look and see what you think. Members of the TED community can rate the the content and presentation style. Less than 10% of those auditioning will be invited to present at TED2013, and only the ratings and comments provided before August 31 will be taken into consideration by TED when it makes its selections.

Not a TED member? no problem. You are welcome to leave us your feedback as a comment below.

http://twitter.com/jameslyne
http://twitter.com/caroletheriault

View the original article here

Foursquare Hackers Turn New York City Into a Game of 'Risk' - Search Engine Watch

by Brent Rangen, July 1, 2011

A group of hackers at the Game Hackday event in NYC created a game of Risk using Foursquare's framework and Google Maps API. The two-day event is a non-profit blend of gaming and hacking aimed at creating mentorship for hackers.

Fourteen frameworks, hardware systems, and APIs were made available to this year's participants, including Foursquare, Kinect, FTW, Twilio, and RTMPNODEJS. "World of Fourcraft" was an obvious choice for the People's Choice Award. Taking second, placing above "Twetris" which allows you to expand your Twitter following simply by playing Tetris.

“World of Fourcraft” turns Foursquare into a game of "Risk" based in New York City, with the five Burroughs competing for the ultimate victory. A user can login and swear alligiance to their choice of Burrough. The goal is to get more activity with your Burrough buddies than the rest.

This has to make any social media fan wonder what the possibilities could become with a good Foursquare developer. How can you customize the Facebook platform to encourage clients, fans, followers to become more active?

Think of the possibilities alone with the hospitality industry. Not to mention sporting events, conferences, and other large audience events.

Here several more Foursquare-based games:

Treasure SquareKingpinTapCityPlease Stay Calm

All of these can be found on Foursquare.com/Apps. As more third-party vendors introduce Foursquare applications, the company-specific value Foursquare can bring to the table will continue to grow. Sounds a lot better than launching a forum on a subfolder to attract users, doesn't it?

Save up to $500! Register now for SES San Francisco. In addition to high-level strategy, keynotes, an expo floor with 100+ companies, networking events, and parties, you don't want to miss out on the latest trends and strategies during sessions on SEO, PPC management, social media, keyword research, local advertising, mobile engagement, link building, duplicate content, multiple site issues, online video, site optimization, usability, and more. Early bird rates expire July 22. Foursquare • New York City • Application programming interface • People's Choice Award • Twilio • Kinect • Tetris • Google Maps

Commenting policyEcho.Localization.extend({"Stream.emptyStream": "Be the first to post a comment."});jQuery("#add-comment-link").click(function() { jQuery("#echo-submit-form").toggle(); }); Send us a story tip

Incisive Interactive Marketing LLC.

© 2011 All rights reserved. 55 Broad St, 22nd Floor, New York, NY 10004

View the original article here

Watch out, LulzSec – the CIA is adept at wiping lulz off faces - The Guardian

For the past few weeks, a hacker collective called LulzSec has been leading American and British authorities a merry dance. The group's targets are seemingly random – Sony, the CIA, contestants of a reality TV show, the Serious Organised Crime Agency (Soca) – but their stated motive has remained constant: "we're doing it for laughs", or, to put it in internet parlance, "lulz".

If one is to believe the media coverage – particularly here in the US‚ no one is safe from the ingenious hackers and their devilishly complex attacks. The truth is, there's almost nothing ingenious about what LulzSec is doing: CIA and Soca were not "hacked" in any meaningful sense, rather their public websites were brought down by an avalanche of traffic – a so-called "distributed denial-of-service" (DDoS) attack. Given enough internet-enabled typewriters, a monkey could launch a DDoS attack – except that mentally subnormal monkeys have better things to do with their time.

Even the genuine hacks are barely worthy of the word. Many large organisations use databases with known security holes that can easily be exploited by anyone who has recently completed the first year of a computer science degree: it's no coincidence that so many of these hacker collectives appear towards the end of the academic year.

Still, what LulzSec might lack in technical prowess, it certainly makes up for in its ability to grab attention. Hackers have always boasted of their work – leaving messages on their victims' servers, posting proof of their exploits on bulletin boards‚ so in a world where every criminal and his dog has a YouTube channel and a Facebook fan-page it's hardly surprising that LulzSec is obsessed with online publicity. The group has been particularly smart in their use of Twitter: in less than two months it has amassed over 240,000 followers which, amusingly, means it can launch a DDoS attack simply by tweeting the web address of its next target and waiting for the tsunami of clicks to have the desired effect.

Given the group's modus operandi – boasting on social networks, sticking it to the man – it was entirely unshocking when, on Tuesday morning, the police arrested their first suspect: a teenager who, according to his mum, suffers from agoraphobia and "lives his life online". Ryan Cleary may, of course, be found completely innocent but when the group's leaders are rounded up it's a fairly safe bet that none of them will turn out to be attractive, outgoing 30-year-old women.

It was ever thus, of course: awkward teenagers entering adulthood, convinced that they know better than the stupid old grownups who control their world. In previous generations those kids would organise protest marches or start angry magazines or accidentally blow themselves up trying to make a pipe-bomb from The Anarchist Cookbook. Only a very tiny number, though, had the resources or the opportunity to even slightly inconvenience The Man. Today, however, the internet has lowered the barriers to everything: international protests can be co-ordinated through Facebook groups, blogs have removed the printing and distribution barriers from publishing, and a growing suite of online hacking tools have made it possible for a 19-year-old kid to embarrass the CIA.

Unfortunately the video game-like simplicity with which even serious crimes can be committed online makes it easy to underestimate their real world consequences. Earlier this week, the Obama administration proposed new anti-hacking laws which would provide 20-year prison terms for hackers who "endanger national security" – and, under the Extradition Act, British hackers should be in no doubt that the government will gift-wrap them and deliver them to Washington.

For that reason, the members of LulzSec are either modern-day versions of Arsène Lupin, Maurice Leblanc's fearless gentleman thief for whom the risk of capture was part of the thrill, or they're absolute, grade A imbeciles (spoiler alert: it's the second one). We've all seen enough movies – which is to say, the first 10 minutes of Sneakers – to know what happens when you mess with the UK government. Any day now, in Wales or Warsaw or Wasilla, a spotty kid in a V for Vendetta T-shirt will be dragged from his parents' house at gunpoint and bundled – sobbing and pleading that it was all a joke – into the back of a van.

The CIA: doing it for the lulz since 1947.

• This article was amended at 12:07 on 22 June after complaints about the language used

View the original article here