Activision Blizzard attacks hidden market in game “cheats” | foodonia

Activision Blizzard – makers of game hits such as Call of Duty and World of Warcraft – have taken “aggressive” legal moves against gamers who use illegal software to cheat in games – in particular, the hit strategy title Starcraft 2.

“Cheat” software, such as the Starcraft 2 cheats that are commonly available, circulates freely or is sold illegally, and often carries a payload of malware. Some reports have claimed that up to 90% of such “add-on” software carries malware.

Silicon Republic reports that the move – a highly unusual one – targets one of the many Starcraft 2 cheats, ValiantChaos MapHack, which allows gamers to issue commands to characters faster in the strategy game. It clearly works – gamers pay a $62 “donation” to use it.

“The hacks and cheats made available by Defendants, including a product known as the ‘ValiantChaos MapHack’, modify the StarCraft 2 online game experience, to the detriment of legitimate StarCraft 2 users, and thus to Blizzard itself,” reported Torrentfreak.

The site noted that while the wording of the complaint focused on the “experience”, the actual charges related to copyright infringement. The group who make the popular “hack” is not known.

“Defendants create and sell their unlawful software products with the knowledge that they are facilitating and promoting users to infringe Blizzard’s copyrights, to breach their contracts with Blizzard, and to otherwise violate Blizzard’s rights,” the company said. The suit also alleges that, the hack “cause serious and irreparable harm to Blizzard and its products.”

The case is highly unusual: use of hacks in gaming is often punished by a temporary or permanent ban from the game for that user account, or other in-game penalties such as loss of game currency. Starcraft is a major player in competitive gaming, and fills football stadiums in Korea.

Speaking to the BBC, analysts described the move as “aggressive”.

“The only reason that cheats like this exist is because there is demand for them,” said Ed Barton, an analyst at game consultancy Ovum. “But the competitive scene for Starcraft is very important, especially in Korea, and Blizzard needs to preserve the fantasy of the core experience.”

The suit alleges, “The competitive aspect of Starcraft 2′s multiplayer environment is one of the driving forces behind sales of the game. In fact, the Starcraft game are played as a competitive sport around the world, with professional or semi-professional players competing for national and international titles.”

In recent months, following the raft of available Starcraft 2 cheats, competitive gamers have switched allegiance to rival products such as League of Legends. Game site VG247 reported that the organization Major League Gaming had switched to the similar strategy game League of Legends, in addition to reducing prize money from $75,000 to $25,000.

The post Activision Blizzard attacks hidden market in game “cheats” appeared first on We Live Security.

Brought by: http://foodonia.com

Malicious advertising is growing threat, warns Senate report | foodonia

Technology giants such as Yahoo and Google need to do more to protect consumers from hackers infiltrating their advertising networks to deliver malicious adverts – or even point users to sites that serve malware, the U.S. Senate has warned, according to CNBC’s report.

The Senate Permanent Subcomittee on Investigations said that punishments needed to be targeted not merely at hackers, but also at advertising networks that failed to prevent them taking advantage of their online promotions.

“Consumers can incur malware attacks [through online ads] without having taken any action other than visiting a mainstream website,” the subcommittee said, according to PC World’s report.

The subcommittee referred to two incidents in which Yahoo and Google’s advertising networks were used to deliver malicious adverts, according to Network World’s report. The report said that some advertising networks scanned for malicious advertising, but “malvertisers” scanned for this and refrained from serving ads when in danger of detection, according to Network World.

“We successfully block the vast majority of malicious or deceptive advertisements with which bad actors attack our network, and we always strive to defeat those who would compromise our customers’ security,” a representative from Yahoo said, according to Phys.org.

The panel said that Yahoo or Google were not singled out as vulnerable – and that the industry as a whole was vulnerable to attacks.

The use of malware to misdirect users means that the economics of such scams can be quite complex – with ESET’s Joan Calvet analyzing the techniques by which the Win32/Boaxxe BE malware family drive traffic to the “wrong” advertising networks in a post here.

“Boaxxe.BE, is an impressive malware family with numerous sub modules, which takes lots of precautions to stay stealthy,” says Calvet, “For example, it won’t redirect users to ads when the user clicks on common websites (Wikipedia, Facebook…), or the maintenance of its own DNS cache in order to avoid relying on the too-noisy Windows cache.”

A We Live Security guide to how to detect if your PC is infected, and avoid infection with “adware” and “badware” can be found here.

The post Malicious advertising is growing threat, warns Senate report appeared first on We Live Security.

Brought by: http://foodonia.com

FBI plans worldwide crackdown on cybercrime | foodonia

The FBI is gearing up for a major crackdown on cybercrime, and says that arrests of major criminals will follow in weeks.

Speaking at the Reuters Cybersecurity Summit, the FBI’s executive assistant director of cyber enforcement Robert Anderson said, “There is a philosophy change. If you are going to attack Americans, we are going to hold you responsible.”

Anderson’s speech said that the FBI’s dealings with cybercrime would now show “a much more offensive side,” and made it clear that this involved extraditions, referring to a foreign national detained at an airport in Spain for running a botnet that targeted Americans, according to Deep Dot Web’s report.

Prior to working in cyber enforcement, Anderson worked in espionage and counter-intelligence.

Anderson said, “If we can reach out and touch you, we are going to reach out and touch you.” Previously, the FBI has held back from pursuiing extradition in certain cases.

“There’s a lot of countries that will not extradite. That will not stop us from pressing forward and charging those individuals and making it public,” he said, according to Russia Today’s report.

He also said that arrested hackers could expect long jail sentences, rather than reduced terms for cooperating or becoming informants, according to the Voice of Russia.

He said that the only circumstances in which reduced sentences would be considered would be those affecting “national security”, according to Reuters.

Politico.com reported that the FBI was also setting up “online and in-person” cyber training courses for America’s 17,000 police forces.

The post FBI plans worldwide crackdown on cybercrime appeared first on We Live Security.

Brought by: http://foodonia.com

Former Royal reporter: “I hacked Kate Middleton’s phone 155 times” | foodonia

The former Royal Editor of the now-defunct News of the World tabloid newspaper has admitted that he hacked into Kate Middleton’s mobile phone voicemail a staggering 155 times in order to snoop upon private messages.

And Clive Goodman didn’t stop there. He has also told a court in London that aside from intercepting the future Duchess of Cambridge’s private messages, he also hacked Prince William on 35 occasions and Prince Harry nine times.

It can’t have been a barrel of laughs and festive fun at Goodman’s house over Christmas 2005, as the News of the World‘s Royal Editor first accessed Kate Middleton’s voicemail on 21st December, and then continued to do so on Christmas Eve, Christmas Day and Boxing Day in his search for tabloid stories.

The first hack by Goodman against Prince William’s voicemail, meanwhile, took place at the end of January 2006.

Presumably driven by the tabloid’s thirst for news about Prince William’s then girlfriend, Goodman continued to regularly hack Miss Middleton’s mobile phone voicemail until the day before his arrest in August 2006.

How phone hacking works

Unlawful access to voicemail messages was made possible by many mobile phones using well-known default PINs as their solitary defence.

Chances are that you don’t even realise that your mobile phone voicemail has a PIN, because most mobile phone networks recognise that it is your phone ringing the voicemail service, and therefore skirts around the request for a PIN to make life more convenient for you.

However, many phone operators provide a number that you can ring to access your voicemail remotely. If your voicemail was protected by an easy-to-determine default PIN, or if operators could be tricked into resetting a PIN, then the voicemail messages could be unlocked.

Thankfully, default PINs for mobile phone voicemail systems are no longer used in the United Kingdom, making life that little more difficult for journeys hungry for a celebrity scoop.

But that doesn’t mean the problem has completely disappeared.

Another way of breaking into a mobile phone’s voicemail system might be to fake the phone number you are ringing from, tricking the voicemail system into believing it was the genuine handset collecting the messages.

As recently as last month, a journalist with The Register showed that at least two UK mobile networks remained vulnerable to having their customers’ voicemail inboxes hacked, without the attacker needing to guess a PIN.

For the highest level of security, set your voicemail up to always ask for PIN whenever you access it. Yes, it’s a pain – but it’s only four digits worth of nuisance for a greater level of privacy.

Royal revelations

Clive Goodman, of course, was jailed in 2007 on charges of hacking royal aides. But up until now he has never claimed that the snooping was also being conducted against the Duchess of Cambridge and the royal princes.

When Goodman was asked why he had not previously told police or prosecutors about the true extent of the hacks, he said that he was simply never asked about it:

“I’ve never been asked before. The Metropolitan police, Crown Prosecution Service did not ask me these questions in 2006 and 2007. I’ve never been asked by any inquiry any time about this”

Which makes me think, maybe someone should now ask him about other Royals, and individuals romantically associated with the Royal Family.

Chelsy? Cressida? Are you confident your mobile phones’ voicemail systems are properly secured?

The post Former Royal reporter: “I hacked Kate Middleton’s phone 155 times” appeared first on We Live Security.

Brought by: http://foodonia.com

Snapchat “lied to users” about privacy of vanishing photos | foodonia

The photo-sharing app Snapchat, popular with youngsters for its photos which would exist briefly then “disappear forever” has admitted that the photos did not, in fact, disappear, in a settlement with the U.S. government’s FTC.

As reported by Yahoo News, the company is to be monitored for privacy for the next 20 years by independent privacy professionals. Violations could lead to fines for the company.

Time Magazine pointed out that the app’s 4.6 million users had been misled into thinking that videos sent via the app could not easily be captured – whereas they could be seen simply by plugging a smartphone into a PC. Snapchat also violated its own privacy policies by tracking geolocation information for Android users.

In a blog post, the company said, “While we were focused on building, some things didn’t get the attention they could have. One of those was being more precise with how we communicated with the Snapchat community.”

Technology sites were quick to point out just how imprecise Snapchat had been about the privacy offered to its users. CNET pointed out that there were “numerous” ways to capture the supposedly “private” files.

The site wrote, “The most obvious is an easy two-button screen capture on a smartphone. The most discrete involves third-party apps that let users record onscreen behavior or log directly into the app to work around its limited privacy protections. There are also ways to dig up files in a device’s directory when the device is plugged into a computer.”

The FTC said in a statement, “Such third-party apps have been downloaded millions of times. Despite a security researcher warning the company about this possibility, the complaint alleges, Snapchat continued to misrepresent that the sender controls how long a recipient can view a snap.”

The post Snapchat “lied to users” about privacy of vanishing photos appeared first on We Live Security.

Brought by: http://foodonia.com

Torrent site Demonoid blocked by Google for serving malware | foodonia

The torrent site Demonoid was blocked by Google after tests by the search giant found that pages within the site – often used to trade music and films – contained banner adverts which were installing malware on users’ PCs.

On Google searches, potential visitors were warned, “This site may harm your computer,” and were redirected to a malware warning page for several days, rather than the site itself, The Guardian reports.

Digital Trends reports that the site blamed banner adverts for the infections – which affected a few pages within the site, according to Google. Demonoid has strict rules on torrents – and pornography, malware and exploit kits are banned.

SC Magazine reported that the torrent tracker immediately removed all advertising until it tracked down the culprit. Mozilla also issued a similar malware warning.

The ban has now been lifted. In a statement, the site said, “We run content from a lot of ad networks in our ad banners, and a lot of banners from each. One of those banners started serving malware, so we disabled all ads until we are 100% sure of the culprit and get it removed. We are also taking the proper steps to get us out of all the blacklists.”

Google said, “Of the 75 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed user consent.”

After what Demonoid described as a “vacation”, the site is now back online. The site said, “Sorry for the hassle. One of those banners started serving malware, so we disabled all ads until we are 100% sure of the culprit and get it removed. We are also taking the proper steps to get us out of all the blacklists.”

A We Live Security guide to how to rid your PC of adware and “badware” can be found here.

The post Torrent site Demonoid blocked by Google for serving malware appeared first on We Live Security.

Brought by: http://foodonia.com

Smart TVs can be infected with spyware – just like smartphones | foodonia

‘Smart’ televisions with built-in microphones could be used as bugging devices by corrupting the devices with malware, according to software specialists NCC Group, as reported by The Register.

An attacker would not even need physical access to the television to launch an attack, security experts from the group warned.

Fooling a user into installing a malicious app is one way to gain control of the microphone – but models of television with built-in storage and microphones can be set to auto-update, so an attacker could feasibly create an app, then release an update containing it.

Software escrow specialists NCC recently released a white paper examining potential solutions for the problems posed by so-called “Internet of Things” devices.

‘Smart TVs’ seem to have been particularly soft targets. LG admitted that one of its models had been sending information shows watched by their owners without informing them. After a successful hack of a Samsung Smart TV, Senator Charles E Schumer, a Democrat from New York addressed a letter to television manufacturers urging them to improve security.

“Many of these smart televisions are vulnerable to hackers who can spy on you while you’re watchingTV in your living room. You expect to watch TV, but you don’t want the TV watching you.”

The latest hack was demonstrated by NCC near the Infosec conference in London last week, with journalists from The Register shown how Smart TVs can be hacked in much the same way as using a malicious app against an Android phone.

“Malicious apps could be downloaded from the manufacturer’s app store. The TV does have the option for auto-updating, so releasing a legitimate app, then releasing a malicious update, is another attack vector,” a researcher said.

“The devices contain microphones and cameras that can be utilised by applications, Skype and similar apps being good examples.”

“The TV has a fairly large amount of storage, so would be able to hold more than 30 seconds of audio – we only captured short snippets for demonstrations purposes. A more sophisticated attack could store more audio locally and only upload it at certain times, or could even stream it directly to a server, bypassing the need to use any of the device’s storage.”

The post Smart TVs can be infected with spyware – just like smartphones appeared first on We Live Security.

Brought by: http://foodonia.com

Bitly hackers stole user credentials from offsite database backup | foodonia

Bitly has shed a little more light on the serious security breach it suffered last week.

As you may recall, the URL-shortening service announced last week that it believed the account credentials of Bitly users could have fallen into the hands of hackers, but it fell short of answering how it determined customer privacy had been breached, how securely passwords had been stored, or – indeed – what had actually gone wrong.

Now some of those questions are being answered.

In a follow-up post entitled “More detail”, Bitly explains that it believes the hackers did *not* manage to access its production network or servers, but instead accessed the customer database from an offsite backup.

Over the course of the next few hours, the Security Team determined with a high degree of confidence that there had been no external connections to our production user database or any unauthorized access of our production network or servers. They observed that we had an unusually high amount of traffic originating from our offsite database backup storage that was not initiated by Bitly. At this point, it was clear that the best path forward was to assume the user database was compromised and immediately initiate our response plan, which included steps to protect our users’ connected Facebook and Twitter accounts.

And how did the hackers manage to access that offsite backup? They broke into an employee’s account at an unnamed hosted source code repository where they stole the login credentials for the backup of Bitly’s database.

We audited the security history for our hosted source code repository that contains the credentials for access to the offsite database backup storage and discovered an unauthorized access on an employee’s account. We immediately enabled two-factor authentication for all Bitly accounts on the source code repository and began the process of securing the system against any additional vulnerabilities.

What’s worrying about this is that – for a while at least – not only did the hackers have access to a backup of Bitly’s customer database, but they also could have compromised the company’s source code.

Bitly says it is sending an email to “all users from the domain bitlysupport.com outlining the steps to secure your account”. The fact that they have named the domain they are planning to send the warning email from underlines their concern that the hackers might attempt their own malicious campaigns, targeting customers who have had their accounts exposed through the hack.

Ironically, Bitly’s announcement of the domain name they intend to use may not actually make it trickier for any attackers to exploit the situation – as it will be child’s play for them to forge email headers and pretend the messages are coming from bitlysupport.com.

My advice? Be very careful about *any* messages that you receive which claim to come from Bitly, and be wary of clicking on any links in the emails. Much better to visit the Bitly website directly, and access your account that way.

According to Bitly, the passwords stored in the exposed database were salted and hashed. Unfortunately, users who have not changed their passwords in the last few months may be at greater risk of having had their passwords cracked as Bitly strengthened the way it stored passwords in January:

If you registered, logged in or changed your password after January 8th, 2014, your password was converted to be hashed with BCrypt and HMAC using a unique salt. Before that, it was salted MD5.

No wonder then that the firm is recommending that users change their passwords as a precaution.

In case you’re worried about your own account, here is what Bitly says you need to do:

Following are step-by-step instructions to reset your API key and OAuth token:

1) Log in to your account and click on ‘Your Settings,’ then the ‘Advanced’ tab.

2) At the bottom of the ‘Advanced’ tab, select ‘Reset’ next to ‘Legacy API key.’

3) Copy down your new API key and change it in all applications. These can include social publishers, share buttons and mobile apps.

4) Go to the ‘Profile’ tab and reset your password.

5) Disconnect and reconnect any applications that use Bitly. You can check which accounts are connected under the ‘Connected Accounts’ tab in ‘Your Settings.’

Many Bitly users are believed to have connected their accounts to their social media presences on the likes of Facebook and Twitter, but users will not be able to publish via Bitly to those sites until their profiles have been reconnected following the advice above.

Two factor authentication – are you using it?

It’s good to hear that Bitly has now enabled two factor authentication for all of its employees using the source code repository, but an organisation serious about protecting its crown jewels like its source code, would have done that long ago.

I’ve explained the perils with passwords in the past, including the problems with users re-using the same password in multiple places, choosing easy to guess passwords, falling victim to spyware which hoovers up passwords as they are typed on infected computers, or having their login credentials phished from them via convincing emails.

Two-factor authentication (2FA) helps reduce these risks, requiring users to enter a unique one-time-password alongside their regular credentials.

Everytime you login, a new one-time-password is required.

Even if your regular password is guessed, cracked or stolen by hackers, it won’t be any use to the bad guys because they won’t know what your one-time-password is.

Furthermore, if something like a mobile phone app is generating your one-time password for you then it’s extremely unlikely it will be in the clutches of the hackers trying to break into your account.

So, I strongly recommend that whenever an online service or website offers you the option of hardening your account using two-factor authentication you should turn it on.

Furthermore, if you are an organisation running an online service or providing mechanisms for your staff to access company information remotely, it also makes sense for you to consider offering two-factor authentication to reduce the risks.

Two-factor authentication isn’t a magical solution which will stop all online criminal activity, but it certainly makes life harder for the hackers who want to break into your accounts.

Oh, and in case you were wondering, Bitly says it is “accelerating” its efforts to provide two-factor authentication for its customers account as well. That means, if users’ passwords fall into the wrong hands in future – they will be an awful lot harder for the bad guys to exploit.

The post Bitly hackers stole user credentials from offsite database backup appeared first on We Live Security.

Brought by: http://foodonia.com

Rolling Stones 14 On Fire Free Tickets Giveaway? It’s a Facebook scam | foodonia

Are you a fan of the Rolling Stones? Or do you know someone who might be interested in receiving free tickets for the veteran rockers’ sold-out “14 on Fire” world tour?

If so, be very careful if you see a message like the following being shared on Facebook.

Rolling Stones 14 on Fire Free Tickets Giveaway

Get a free ticket and see the Rolling Stones live in your country!

[LINK]

You’d be making a big mistake if you clicked on the link, as you will be taken to a third-party website which strongly encourages you to share the link via social media, and then coerce others into clicking on it.

Because, the website claims, if you manage to get ten people to click on the link you have just shared – you will be in the running for a free ticket to see the Rolling Stones in concert.

Once the system has detected at least 10 clicks through your link code you will get access to the locked area which gives you the possibility to request your free ticket.

It feels to me very unlikely that Mick Jagger, Ronnie Wood, Keith Richards and Charlie Watts would be keen to give away free tickets to concerts around the world via Facebook. I mean, it’s not as if they would have any trouble *selling* them, right?

Furthermore, the Stones’ own official Facebook page has mysteriously no mention of the free ticket giveaway taking place on the social network.

I think what is happening here is that someone has grabbed some images and video content from the official Stones website, has bought a Rolling Stones tour-related domain name via GoDaddy, and is playing upon fans’ desire to see the wrinkly rockers before they finally fade away and cark it.

As usual, you should never re-share a link on the *promise* of getting something. Normally the scammers are trying to trick you into taking money-earning surveys to prove your age with the promise of showing you a sexy video at the end, but on this occasion they’ve simply used the name of one of the most famous rock groups of all time.

And, what’s crafty in this particular case, is that you cannot see what hoops you are going to have to jump through to earn a ticket (my guess is that some surveys will be involved) before you have had ten people click on your link. And that encourages you to feverishly share it and twist the arms of online friends to click on the link on your behalf.

You should always be wary of offers that seem too good to be true, and think extremely carefully before sharing links on Facebook. There are just too many scams running riot up there.

The post Rolling Stones 14 On Fire Free Tickets Giveaway? It’s a Facebook scam appeared first on We Live Security.

Brought by: http://foodonia.com

Mystery surrounds Bitly’s urgent security warning following security breach | foodonia

If you have an account with the URL-shortening service Bitly you should read the “urgent security update” they have just published.

Bitly says it has reason to believe that its systems have been compromised, and account credentials could have fallen into the hands of hackers. However, the company says it doesn’t presently have any evidence that accounts have been accessed without proper authorisation.

We have reason to believe that Bitly account credentials have been compromised. We have no indication at this time that any accounts have been accessed without permission. For our users’ protection, we have taken proactive steps to ensure the security of all accounts, including disconnecting all users’ Facebook and Twitter accounts. All users can safely reconnect these accounts at their next login.

Something of a mystery remains about what happened. Bitly is currently declining to explain how it determined that the privacy of customer accounts had been breached, or what went wrong.

Furthermore, no details are shared regarding precisely what information the hackers might have got their hands on. For instance, if passwords were compromised were they in plaintext or hashed? If they were hashed, was it done securely with salting and other techniques to make it trickier for hackers to crack them?

Access to Bitly accounts might be attractive to criminals, because many are connected with users’ Facebook and Twitter profiles, opening the potential door for sending spam links and scam campaigns via the service. However, Bitly hasn’t confirmed if this has occurred and – in fairness to the service – it normally does a good job of blocking access to malicious links once they are reported to them.

What Bitly is happy to share, however, are instructions on what users should do next: reset your OAuth tokens, API key and password and then reauthorise any connected applications (such as Facebook and Twitter).

Following are step-by-step instructions to reset your API key and OAuth token:

1) Log in to your account and click on ‘Your Settings,’ then the ‘Advanced’ tab.

2) At the bottom of the ‘Advanced’ tab, select ‘Reset’ next to ‘Legacy API key.’

3) Copy down your new API key and change it in all applications. These can include social publishers, share buttons and mobile apps.

4) Go to the ‘Profile’ tab and reset your password.

5) Disconnect and reconnect any applications that use Bitly. You can check which accounts are connected under the ‘Connected Accounts’ tab in ‘Your Settings.’

Many Bitly users are believed to have connected their accounts to their social media presences on the likes of Facebook and Twitter, but users will not be able to publish via Bitly to those sites until their profiles have been reconnected following the advice above.

It goes without saying that if you were using the same password for Bitly as any other website, you are playing a dangerous game. Change your password on Bitly, and choose new, different passwords for any other website or service where there is a risk that the same password could be used to open other parts of your online life.

Bitly’s CEO, Mark Josephson, signs off the advisory with an apology and a claim that the service takes security seriously:

We take your security and trust in us seriously. The team has been working hard to ensure all accounts are secure. We apologize for any inconvenience and we will continue to update our Twitter feed, @Bitly, as we have any further updates.

My hope is that Bitly will update its advisory in the near future with clearer information which will either put users’ minds at rest, or galvanise them into taking swifter action to protect themselves online.

The post Mystery surrounds Bitly’s urgent security warning following security breach appeared first on We Live Security.

Brought by: http://foodonia.com

Smartphones pose “biggest cyber risk” to businesses, report warns | foodonia

The biggest IT security risk to businesses is the use of smartphones in the workplace, a report based on the habits of 5,000 users worldwide has found.

Offices which permit employees to “Bring Their Own Devices” face a doubled threat – the second-biggest threat to IT security is third-party apps on smartphones, as reported by PC Advisor.

The information comes from the Q1 2014 Good Mobility Index report, which reports on smartphone usage by tracking the habits of volunteers as they use their mobile devices in the workplace.

Good Mobility’s John Dasher said that data was put at risk because smartphones were so powerful it was often easier for employees to use mobile devices for work tasks, rather than PCs, according to ArmNet’s report.

This could result, for instance, in sensitive data being stored on mobile devices, rather than machines within an office.

IT departments are taking notice however – and insisting that employees use “managed” smartphones in the workplace, with a 57% increase in such devices in the last quarter. Such devices allow IT managers to, for instance, wipe corporate data remotely, according to Market Watch’s report.

Other business-oriented apps such as customized, secured mobile printing apps saw an increase of more than 100% in adoption in the past quarter. Good Mobility sells its own secure solutions for workforces – and credits the fast adoption rate with an increasingly mobile workforcrce, which require secure ways to work outside the office.

Secured hnndsets, while an ideal solution, may not always be practical, some experts have warned. In a speech reported by We Live Security, Rolf von Roessing, ex-head of security trade body ISACA said that it was difficult to ‘police’ this isssue – and many unsecured devices can ‘sneak in’.

“For effective protection, security professionals need access to mobile operating systems, but this is not always possible and consequently 30% to 40% of devices are under the radar,” said von Roessing.

“In the light of bring your own device (BYOD) programmes, it is more important than ever for end users to be aware of the risks involved,” Roessing said. “Organizations need to set aside adequate budgets to deal with these challenges comprehensively, otherwise all efforts will simply be a waste of money because of all the security gaps,” he said.

The post Smartphones pose “biggest cyber risk” to businesses, report warns appeared first on We Live Security.

Brought by: http://foodonia.com

Miami teenager charged with hacking school computers in “crazy” grade-changing scheme | foodonia

A Miami high school student who hacked into his school’s website to change grades is facing “years” in custody, after Jose Bautista, 18, handed a written confession to police, according to ABC News’s report.

Bautista is facing eight felony charges, and is being held under house arrest with a GPS monitor, according to Darknet’s report. Facing Miami-Dade Circuit Judge Thomas J. Rebull, the teenager was told, “You’ve been arrested on four counts of offenses against intellectual property, public records exemption and four counts of offenses against computer users.”

A local TV station quoted Bautista’s classmates as describing his plan to raise grade averages as “pretty crazy”, according to SCI Magazine’s report. He is accused of hacking into a school network via a website, and changing both his own grades and those of four other students at the school, and is being held on $20,000 bond, according to SCI Magazine’s report.

Miami-Dade school district issued a statement saying, “In addition to the arrest and ongoing criminal investigation, the Code of Student Conduct provides for corrective strategies – including recommendation for expulsion.”

ABC News interviewed a variety of Bautista’s classmates: :”I think the lengths he went to change grades was pretty crazy,” sais Susan Bean, who also attended Bautista’s school, the Dr. Michael M. Krop Senior High School in Miami

Rumors had circulated that a hacker was altering grades in the week before Bautista’s arrest, according to local TV station WFOR-TV. The station quoted classmate Brett Curtis who said , “There have been whispers going around for the last week or so. More and more information started to come out and then we saw that he was arrested.”

Speaking to ABC News, internet privacy lawyer Parry Aftab said that he thought it was likely that Bautista would spend a “number of years” in custody. On WFOR-TV, the teenager fidgeted and looked nervous wearing an inmate’s orange jumpsuit while being interviewed.

The post Miami teenager charged with hacking school computers in “crazy” grade-changing scheme appeared first on We Live Security.

Brought by: http://foodonia.com

Don’t forget flash: memory cards can be a data loss and infection vector | foodonia

Can flash memory cards spread malicious code? Yes they can, and a lot of people fail to scan them for viruses and other malware. Malicious software spread via removable storage remains a serious problem for companies and consumers, even though it’s an infection vector as old as Elk Cloner, a computer virus seen on early Apple computers in 1982. Like most viruses in the eighties, Elk Cloner spread via diskettes, those flexible pieces of magnetic storage which now seem like artifacts of ancient history. In recent years, the USB flash drive, that ubiquitous high-capacity successor to the floppy disk, has gained notoriety as a means of spreading computer viruses and Trojan code, not to mention a handy way to exfiltrate data. Back in 2012 I wrote about the careless use of unecrypted USB drives and their role in malware infection.

But what about memory cards, those tiny slices of removable, flash memory storage that show up as a drive on your computer but are not USB (unless you attach them via a USB flash card reader)? I sometimes see these cards being overlooked when organizations talk about their anti-malware and data loss prevention programs. For example, a security policy might state “all USB ports must be monitored for malware”, but it may not mention memory card reader slots, even though these normally have drive letters assigned to them when media is inserted.

Recently, I observed a corporate-wide data encryption program rolled out with the intent of forcing encryption on “all removable media” in the company. However, the policies somehow failed to address card slots on laptops and the cards that so easily slip in and out of them.

Yet these increasingly tiny pieces of storage — like SD cards that can pack tens of gigabytes of data into something that could fit under a postage stamp — are widely deployed, notably in that other emerging attack surface: mobile devices, like tablets and smartphones. While Stuxnet may be to blame for a lot of the notoriety of USB flash drives, both USB and slot-based storage media has done damage in a wide range of countries and industries, beyond the infamous impairing of enrichment centrifuges in Iran. A quick Google of the phrase data breach flash drive turns up plenty of hits.

As for flash drive malware distribution, consider this photo-sharing scenario: a friend has taken a bunch of pictures of a group activity and you would like copies. No problem, says your friend as he opens his camera and pulls out an SD card. You insert it into your tablet and copy the photo files. If the antivirus program on your tablet — you do have AV on your tablet, right? — is not properly configured, it will not scan the card when you insert it, and may not scan the files as you copy them. So you may not realize that your friend’s card was carrying a virus, possibly from his infected laptop. Now your tablet is an infectious malware delivery system:

1. If you connect your infected tablet to a network that is not scanning endpoints, you may infect that network.

2. If you put another SD card into your tablet while the tablet is still infected, that card could be infected and you could share it with someone, infecting them.

These things can and do happen, with both SD cards and USB flash drives. Here’s a link to a report that includes a good case study on how sharing conference presentation files on flash storage infected over 100 hosts on the enterprise network of someone in the U.S. nuclear power industry: ICS-CERT Incident Summary Report, June 28, 2012 (PDF file).

Fortunately, the spread of malicious code via flash memory cards can be blocked if you combine endpoint protection strategies like this:

• On Windows devices disable Autorun and Autoplay (see Solution B in this Knowledgebase article).


• Turn on automatic scanning of removable media in your AV software.


• Run good AV software on mobile devices.


• Block access to media reader slots using device controls in your security software (do this for systems that operate in untrusted environments).


• Require encryption of all media cards used on your systems (here’s one product for that).


• Install antivirus software on removable flash storage that is used in untrusted environments (here’s an example).


• Regularly run scans for malware on your servers to make sure nothing has slipped past your endpoint protection and you are not serving up malicious code.


• Consider gateway protection for all HTTP and FTP connections in and out of your network (see the diagram on this page).

Hopefully, these tips will help you close any holes in your digital defenses that flash memory cards have created. Remember, it’s not just USB flash drives you have to worry about. I’m just as guilty as the next security expert when it comes to talking about the threat from flash drives as though USB ports were the only flash-storage infection vector. Those tiny flash cards also need watching, as do those media reader slots.

The post Don’t forget flash: memory cards can be a data loss and infection vector appeared first on We Live Security.

Brought by: http://foodonia.com

Target’s CEO gets the chop, after retailer suffers massive data breach | foodonia

This morning US retail giant Target announced that it was parting ways with Gregg Steinhafel, its chairman, president and CEO.

It is less than five months since Target revealed that it had suffered a devastating data breach, which saw the personal information of up to 70 million customers’ stolen, and 40 million credit card details exposed.

In the wake of the massive security breach, customer trust in shopping at the store was hit, and the company’s sales, profit and stock price all suffered. Just two months ago Target’s executive vice president of technology services and chief information officer, Beth Jacob, resigned her position.

It seems Target’s board realised that a further clear and loud statement had to be made that the company had changed its ways – and Steinhafel’s position became more of an obstacle to changing the retailer’s troubled security image than an asset.

Most recently, Gregg led the response to Target’s 2013 data breach. He held himself personally accountable and pledged that Target would emerge a better company. We are grateful to him for his tireless leadership and will always consider him a member of the Target family.

Ironically, with all of the attention that Target has received since its disclosure last December, it probably now has more executives keeping at the front of their mind the critical issues of how to protect its customers’ data than many of its competitors.

It’s just a shame that such a devastating breach had to happen for that shift in thinking to occur.

If there’s any silver lining on this entirely ghastly episode, it’s that other companies might have seen the horrible mess that Target got itself and its customers into, and will be taking measures to ensure that they are not the next corporation to make the headlines for all the wrong reasons.

If you work in an IT department, and think that your board isn’t taking information security seriously enough, then perhaps reminding your executive team about just how badly Target has been affected by their data breach will help focus their minds.

The security incident at Target affected a huge number of people, and has cost the company a great deal of money, but ultimately the bosses recognised they had to hold themselves personally accountable for what went wrong, and have lost their jobs as a result.

The data breach at Target wasn’t the first incident of a major retailer being hacked, and it wasn’t the last either. What’s essential is that all of us, whether responsible for protecting our home or work computers, takes steps to reduce the chances of a hack being successful.

If you’re not sure where to start when it comes to better securing the business you are working at, check out Stephen Cobb’s cyber security road map for smaller businesses.

Further reading:

• Target breach optioned as Sony feature film


• Target attackers ‘broke in using log-in from air-con contractor’


• Myths of the Target breach


• Attention Shoppers! Top tips for defending your accounts against card fraud


• Target breached: 5 defensive steps shoppers should take now


• Target down? “Biggest data breach ever” leaks 40 million credit and debit cards from retailer at height of shopping season

The post Target’s CEO gets the chop, after retailer suffers massive data breach appeared first on We Live Security.

Brought by: http://foodonia.com

No credit card required – Swedish shops let you pay in blood | foodonia

At 15 payment machines dotted around the Swedish city of Lund, people can buy items without needing a card – or a phone equipped with a “Near Field” chip. All that’s required are the correct veins.

Engineering graduate Frederik Leifland says, “I got the idea when I was in line at the supermarket and I saw how complex a process paying is. It takes a lot of time so I thought there must be an easier and quicker way to pay and that was the start of Quixter.”

In a new interview with science website Humans Invent, Leifland explains how he hopes that his start-up may lead to payments without any authentication device. The pattern of veins in a human hand is unique – Leifland’s system uses infrared scans to identify the unique pattern in a finger.

BioMetrics sales site FindBiometrics says that the technology is new, and currently used in high security institutions, saying, “Vein recognition is a fairly recent technological advance in the field of biometrics. It is used in hospitals, law enforcement, military facilities and other applications that require very high levels of security.”

TechCrunch points out that vein recognition technology is already used to secure high-value banking transactions in countries such as Japan, but only as a secondary “layer” of security where other methods of authentication are also used.

Leifland claims that his company, Quixter, is not the only start-up researching the technology – but is the first to market with it. He aims to create a payment system which requires neither physical money, nor phones, nor mobile devices.

There are currently around 1,600 testers of the system, Tech Times reports.

Leifland says that in a retail environment, transactions can be completed in around five seconds.

“When you go to pay in the supermarket you enter the last four digits of your phone number and then you hold your hand above the sensor. The transaction takes less than 5 seconds,” he says.

Leifland says the reason for entering the last four digits of your phone number is done in order to make you look at the terminal and confirm you are paying the correct amount.

Biometric payment systems are a hot topic at the moment, with Samsung’s Galaxy S5 shipping with a PayPal system, and other start-ups are investigating systems using iris scans and other biometric techniques.

A poll of 10,000 iPhone and Android users by network giant Ericsson found that consumer appetite for biometrics was high – and Ericsson predicted that fingerprints would “just be the start.”

“Consumers would rather get rid of passwords completely, and for this reason are showing interest in biometric alternatives,” a spokesman said.

Stephen Cobb, Senior Security Researcher with ESET, we may be on the verge of widespread deployment of biometrics. Cobb says, “Successful implementation of biometrics in a segment leading product could bode well for consumer acceptance.” He adds, “I have been a fan of biometrics as an added authentication factor ever since I first researched multi-factor and 2FA systems 20 years ago, however, user adoption is very sensitive to performance; in other words devices such as the iPhone 5S could advance biometrics, or put a whole lot of people off biometrics.”

The post No credit card required – Swedish shops let you pay in blood appeared first on We Live Security.

Brought by: http://foodonia.com