68934589
submission
chicksdaddy writes:
It's always interesting to listen to what politicians say on their way out of office — after the pressure to get re-elected and say "on message" has been lifted. Eisenhower's historic farewell address in 1961 warned Americans about the influence of the Military-Industrial Complex. (http://en.wikipedia.org/wiki/Military%E2%80%93industrial_complex). Twenty years later, Jimmy Carter warned of the distorting influence of "single-issue groups and special interest organizations" on the political process. (http://www.jimmycarterlibrary.gov/documents/speeches/farewell.phtml)
And, this week, outgoing Sen. Tom Coburn (R-OK) used his final days in office to issue a blistering report on the Department of Homeland Security. Coburn argued that DHS was failing on each of its five, critical missions, among them: cyber security. (https://securityledger.com/2015/01/senator-warns-of-dhs-struggle-with-cyber-security/)
The report, “A Review of the Department of Homeland Security’s Missions and Performance,” (http://www.coburn.senate.gov/public/index.cfm?a=Files.Serve&File_id=23ce3547-adf7-4798-b9d8-56ea2a486e95) was released on Saturday. In it, the outgoing Senator said that DHS’s strategy and programs “are unlikely to protect us from the adversaries that pose the greatest cybersecurity threat.”
Despite spending $700 million annually on a range of cybersecurity programs, Coburn said it is hard to know whether the Department’s efforts to assist the private sector in identifying, mitigating or remediating cyber incidents provide “significant value” or are worth the expense. DHS programs are still heavily weighted towards software vulnerability mitigation, Coburn says, an activity that “will not protect the nation from the most sophisticated attacks and cybersecurity threats.”
68594907
submission
chicksdaddy writes:
Alternative theories of who is responsible for the hack of Sony Pictures Entertainment have come fast and furious (http://it.slashdot.org/story/14/12/24/1757224/did-north-korea-really-attack-sony)in recent weeks- especially since the FBI pointed a finger at the government of North Korea last week. (http://news.slashdot.org/story/14/12/18/0249222/us-links-north-korea-to-sony-hacking) But Norse Security is taking the debate up a notch: saying that they have conclusive evidence pointing to group of disgruntled former employees as the source of the attack and data theft.
The Security Ledger quotes Norse Vice President Kurt Stammberger saying that Norse has identified a group of six individuals — in the U.S., Canada, Singapore and Thailand — that it believes carried out the attack, including at least one 10 year employee of SPE who worked in a technical capacity before being laid off in May.(https://securityledger.com/2014/12/new-clues-in-sony-hack-point-to-insiders-away-from-dprk/)
Rather than starting from the premise that the Sony hack was a state sponsored attack, Norse researchers worked their investigation like any other criminal matter: starting by looking for individuals with the "means and motive" to do the attack. HR files leaked in the hack provided the motive part: a massive restructuring in Spring, 2014, in which many longtime SPE employees were laid off.
After researching the online footprint of a list of all the individuals who were fired and had the means to be able to access sensitive data on Sony's network, Norse said it identified a handful who expressed anger in social media posts following their firing. They included one former employee — a 10 year SPE veteran who he described as having a “very technical background.” Researchers from the company followed that individual online, noting participation in IRC (Internet Relay Chat) forums where they observed communications with other individuals affiliated with underground hacking and hacktivist groups in Europe and Asia.
According to Stammberger, the Norse investigation was eventually able to connect an individual directly involved in conversations with the Sony employee with a server on which the earliest known version of the malware used in the attack was compiled, in July, 2014.
While Stammberger admits that some clues in the investigation seemed to point to attackers in one of the Koreas, he says those paths all turned into dead ends, and that Norse investigators found no convincing evidence of North Korean involvement in the incident.
According to Stammberger, the company is briefing the FBI on its investigation on Monday. I'd love to be a fly on the wall in that room!
68106255
submission
chicksdaddy writes:
Researchers from the firm Trend Micro are warning that the Automated Identification System (or AIS) — a monitoring system that is used on over 400,000 ocean-going vessels — is profoundly insecure and vulnerable to both software and radio-based hacks, The Security Ledger reports. (https://securityledger.com/2014/12/research-finds-cyber-physical-attacks-against-vessel-tracking-system/)
AIS is a global system for tracking the movement of vessels. It is intended to supplement marine radar and relies on ship, land and satellite-based systems to exchange data on ships’ position, course and speed and is used for everything from collision avoidance to security, ship-to-ship communications and weather forecasting.
AIS is required to be deployed on all passenger vessels and on international-voyaging ships with gross tonnage of 300 or more. However, researchers Marco Balduzzi and Kyle Wilhoit found that AIS is rife with exploitable software- and protocol vulnerabilities. Chief among them are flaws in the AIS protocol which was developed in a “hardware epoch” and lacks even basic security features such as authentication and message integrity checks. While hacks of radio-based systems like AIS would have been expensive and difficult to conduct 10 or 15 years ago, the advent of tools like Software Defined Radio make it possible to craft sophisticated attacks with just a small investment, the researchers discovered.
In their work, Balduzzi and Wilhoit – working with an independent security researcher – were able to use software-defined radio based attacks to trigger a range of phony messages, from false SOS and “man in the water” distress beacons to fake CPA (or Closest Point of Approach) alert and collision warnings on an AIS system set up in a lab environment. A copy of their ACSAC presentation slides can be found here: http://blog.trendmicro.com/tre...
The two have written about AIS vulnerabilities before, including susceptibility of AIS to man-in-the-middle attacks (http://blog.trendmicro.com/trendlabs-security-intelligence/captain-where-is-your-ship-compromising-vessel-tracking-systems/). Their latest work expands the list of attacks and vulnerabilities found in AIS to include both software and RF-based hacks, SQL injection, buffer overflow and so on.
67484171
submission
chicksdaddy writes:
The story about the disastrous hack of Sony is the gift that keeps on giving. There's been a wealth of revelations about Sony Pictures Entertainment's internal culture: its tendency to pay male executives more than their female counterparts (http://fusion.net/story/30838/does-a-powerful-sony-pictures-partnership-have-a-gender-pay-gap/), tepid enthusiasm of employees about SPE's output (http://gawker.com/sony-hack-reveals-25-page-list-of-reasons-it-sucks-to-w-1666264634) and a kind of compulsive transparency within its IT operations (http://gawker.com/sonys-top-secret-password-lists-have-names-like-master_-1666775151). There have also been revelations about the attacks themselves, including analysis that shows both that the malware used was tailored specifically to Sony's network (http://logfile.packetninjas.net/malware-created-specifically-for-sony/) and that the attackers apparently took a page from the 2012 attack on Saudi Aramco known as "Shamoon." Specifically: both the Sony malware and “Disstrack” (the malware used in the “Shamoon” attack on Saudi Aramco) relied on the same commercial tool to access and erase the hard drive, a program called RawDisk by the company Eldos, according to a source with knowledge of the attack, the Christian Science Monitor reported today.
67383369
submission
chicksdaddy writes:
A copy of the FBI's recent five page FLASH alert reveals that the malware alleged to have wiped out systems at Sony Pictures Entertainment deployed a number of malicious modules, including a version of a commercial disk wiping tool on target systems. Samples of the malware obtained by the FBI were also found to contained configuration files created on systems configured with Korean language packs.
The use of Korean could strengthen theories that the destructive cyber attacks have links to North Korea, though it is hardly conclusive. It does appear that the attack was targeted at a specific organization. The malware analyzed by the FBI contained a hard coded list of IP addresses and computer host names.
Media reports have linked the malware to the destructive attack on Sony Pictures Entertainment, though the FBI FLASH alert does not name Sony or any other organization. A group calling itself #GOP – for Guardians of Peace – took responsibility for that attack last week.
Theories about the purpose of the attack on Sony abound. One of the more colorful explanations has the destructive cyber attack as retribution for The Interview, a new Sony film due out at Christmas starring Seth Rogen and James Franco. (http://www.independent.co.uk/arts-entertainment/films/news/did-north-korea-hackers-leak-sony-films-in-revenge-for-comedy-the-interview-9896716.html)The two play western journalists who score an interview with North Korean dictator Kim Jong Un, and are then instructed by the U.S. Central Intelligence Agency to assassinate him. The government of the Democratic Peoples Republic of Korea (DPRK) publicly criticized Sony for plans to release the film and lodged a complaint with the United Nations.(http://www.telegraph.co.uk/news/worldnews/asia/northkorea/10914088/North-Korea-slams-US-film-The-Interview-about-Kim-Jong-un.html)
67332777
submission
chicksdaddy writes:
Reuters has the scoop this morning on a new report out from the folks at FireEye about a cyber espionage ring that targets financial services firms. (http://www.reuters.com/article/2014/12/01/cybersecurity-wall-street-idUSL2N0TK0SE20141201)
The campaign, dubbed FIN4 by FireEye, stole corporate secrets for the purpose of gaming the stock market. FireEye believes that the extensive cyber operation compromised sensitive data about dozens of publicly held companies. According to the report FireEye the victims include financial services firms and those in related sectors, including investment bankers, attorneys and investor relations firms.
Rather than attempting to break into networks overtly, the attackers targeted employees within each organization. Phishing e-mail messages led victims to bogus web sites controlled by the hackers, who harvested login credentials to e-mail and social media accounts. Those accounts were then used to expand the hackers reach within the target organization: sending phishing email messages to other employees.
66400455
submission
chicksdaddy writes:
How bad is the gridlock in Washington D.C.? So bad that the nation's retailers are calling for federal legislation on cyber security and data protection to protect consumer information — this even though they would bear the brunt of whatever legislation is passed.
The Security Ledger notes (https://securityledger.com/2014/11/retailers-demanding-federal-action-on-data-breach/) that groups representing many of the nation's retailers sent a letter to Congressional leaders last week urging them to pass federal data protection legislation that sets clear rules for businesses serving consumers. The letter, dated November 6, was addressed to the majority and minority party leaders of the U.S. Senate and the House of Representatives and signed by 44 state and national organizations representing retailers, including the National Retail Federation, the National Grocers Association, the National Restaurant Association and the National Association of Chain Drug Stores, among others.
“The recent spate of news stories about data security incidents raises concerns for all American consumers and for the businesses with which they frequently interact,” the letter reads. “A single federal law applying to all breached entities would ensure clear, concise and consistent notices to all affected consumers regardless of where they live or where the breach occurs.”
Retailers would likely bare the brunt of a new federal data protection law. The motivation for pushng for one anyway may be simplicity. Currently, there are 47 different state-based security breach notification laws, as well as laws in the District of Columbia and Guam. (http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx) There is broad, bi-partisan agreement on the need for a data breach and consumer protection law. However, small differences of opinion on its scope and provisions, exacerbated by political gridlock in Congress since 2010 have combined to stay the federal government’s hand.
66061393
submission
chicksdaddy writes:
The technology revolution that is “fracking” has created billions in wealth for states like Pennsylvania, Texas, Ohio and Wyoming. But all that oil and all those dollars have attracted the attention of sophisticated spies from near and far to steal valuable trade secrets. (https://digitalguardian.com/blog/industry-spies-do-mess-texas)
Digital Guardian's blog notes this report (http://www.news4sanantonio.com/news/features/top-stories/stories/oil-field-espionage-eagle-ford-shale-16921.shtml) from News 4 San Antonio in Texas which quotes local FBI officials saying they are “very concerned” about theft of trade secrets from companies engaged in “fracking” in the Eagle Ford Shale in Texas.
“It's corporate espionage, there’s no question about it," said Christopher Combs of the San Antonio FBI. “Foreign governments or foreign companies are looking for any competitive advantage. Whether it's the widget that you use to drill, or it's a process that you use to track inventory better. They're really looking at the company as a whole to find out every little thing that you do that makes you a better company on the world market."
Combs declined to name specific firms, but said that Chinese firms are “aggressively” engaged in industrial espionage. However, the problem isn’t limited to China. Companies with ties to governments that are U.S. allies are believed to be conducting espionage against innovative US firms as well.
Hydraulic fracturing – or “fracking” is a method used to extract oil or gas deposits from porous rock like sandstone and shale. The technique was developed in the United States with financial support from the U.S. government and is now used commercially in shale deposits in the U.S., Canada and China. However, the specific technology and methods associated with fracking are closely guarded and highly valuable to drilling outfits.
Recent history suggests that oil and gas exploration is an area of intense activity for cyber spying. In July, the Department of Homeland Security warned of targeted attacks against energy firms in the U.S. and Europe linked to the "Havex" malware, a kind of remote access tool. (https://securityledger.com/2014/07/dhs-warns-energy-firms-of-malware-used-in-targeted-attacks/). That same month, the American Petroleum Institute launched an Oil and Natural Gas Information Sharing and Analysis Center (ONG-ISAC) designed to help protect companies in the industry from attacks and evaluate risks through information sharing.(http://ongisac.org/)
65908273
submission
chicksdaddy writes:
Headline grabbing data breaches are such a fixture of our modern business environment (https://corporate.homedepot.com/mediacenter/pages/statement1.aspx) that they’ve spawned a knock-off market: phony data breaches designed to look like the real thing, the Security Ledger reports.(https://securityledger.com/2014/10/wanna-breach-counterfeit-data-breaches-are-a-thing/)
A research note from the firm Deloitte & Touche is warning companies about the threat of counterfeit breaches, in which malicious actors use false claims about massive data breaches to bedevil established firms – inflicting real economic and reputation damage.
Bogus breach claims are becoming more common — with gullible or hair trigger 24/7 media coverage a leading contributor to the phenomenon. In October, for example, an individual posted what were purported to be stolen Dropbox account credentials on the site Pastebin. The message claimed the leaked credentials were part of a larger trove of 7 million accounts that were compromised — a claim that was widely reported. Dropbox, however, maintained that it was not hacked and that the leaked credentials – user names and passwords – were stolen from other online services.
Deloitte researcher Allison Nixon said companies need to develop strategies to quickly assess data breach claims: from automated analysis of user names against known customer accounts to statistical analysis of user name and password entropy. And, companies should feel free to use the "sniff test": asking them how likely a real cyber criminal is to behave in the way they are observing.
The public and media should also view claims of data theft and hacks with a more skeptical eye, Nixon says.
65299895
submission
chicksdaddy writes:
The Security Ledger reports on a survey from consulting firm McKinsey & Co. (https://securityledger.com/2014/10/mckinsey-consumers-want-connected-cars-and-fear-them-too/#.VDa0dyldXWI) that has some sobering data for car makers: concerns about privacy and the possibility of car hacking are major concerns that could dampen enthusiasm for smart vehicles.
The report, “What’s Driving the Connected Car?” (http://www.mckinsey.com/insights/manufacturing/whats_driving_the_connected_car) finds that connectivity features will be a major driver of car sales in the coming years. The survey of 2,000 new car buyers in Brazil, China, Germany and the U.S. found that a quarter of respondents considered connectivity a more important feature than engine power or even fuel efficiency.
Connected (or "smart") car features will become ubiquitous and expected, McKinsey predicts, but won't demand a premium from buyers as they do today.
However, car makers also face a considerable hurdle in convincing the buying public to accept connected car technologies. According to McKinsey, 37 percent of respondents to their survey said they “would not even consider a connected car.”At the root of resistance to connected vehicle technology were ubiquitous fears about vehicles being hacked – which were evident in each country that McKinsey surveyed.
In Germany and Brazil, 59 percent of those surveyed strongly agreed with the statement “I am afraid that people can hack into my car and manipulate it (eg, the braking system) if the car is connected to the Internet.” 53 percent of respondents agreed with that statement in China and 43% in the U.S.
That leaves car makers in a tricky position: trying to satisfy customers who "demand connectivity, have security concerns regarding it, and are only marginally willing to pay for it." Hmm...where have we heard that before??
65110471
submission
chicksdaddy writes:
The Security Ledger reports (https://securityledger.com/2014/10/fda-issues-guidance-on-security-of-medical-devices) that the U.S. Food and Drug Administration (FDA) has issued final guidance on Wednesday that calls on medical device manufacturers to consider cyber security risks as part of the design and development of devices.(http://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm416809.htm)
The document, “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices,” (http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM356190.pdf) asks device makers seeking FDA approval of medical devices to disclose any “risks identified and controls in place to mitigate those risks” in medical devices. The guidance also recommends that manufacturers submit documentation of plans for patching and updating the operating systems and medical software that devices run.
While the guidance does not have the force of a mandate, it does put medical device makers on notice that FDA approval of their device will hinge on a consideration of cyber risks alongside other kinds of issues that may affect the functioning of the device. Among other things, medical device makers are asked to avoid worst-practices like 'hardcoded' passwords and use strong (multi-factor) authentication to restrict access to devices. Device makers are also urged to restrict software and firmware updates to authenticated (signed) code and to secure inbound and outbound communications and data transfers.
64594869
submission
chicksdaddy writes:
The Security Ledger reports (https://securityledger.com/2014/09/senate-report-warns-of-attacks-on-military-transport-contractors/#.VBrO4C5dXWI) on a Senate Armed Services Committee investigation that found evidence that hackers associated with the Chinese government compromised the computer systems of U.S. Transportation Command contractors at least 20 times in a single year. The attacks pose a serious risk to the system that moves military troops and equipment.
U.S. Transportation Command – a joint military/civilian program – was targeted by hackers believed to be affiliated with the Chinese government, a Senate Intelligence Committee investigation found.
The Committee released the report on Wednesday. (http://www.armed-services.senate.gov/imo/media/doc/SASC_Cyberreport_091714.pdf) It found a serious gap in awareness and reporting requirements. TRANSCOM was only aware of two of the 20 intrusions, while U.S. Transportation Command remained mostly unaware of the computer compromises of contractors during and after the attacks.
The incidents include an attack that spanned two years – from 2008 to 2010 – and that captured emails, documents, passwords and computer code. A 2012 attack gained access to “multiple systems” onboard a commercial ship contracted by TRANSCOM, the Committee found.
Information sharing about cyber attacks was woeful. An audit of a subset of TRANSCOM contractors uncovered 11 cyber intrusions believed to be linked to China. The Committee said the FBI or DoD had already identified another 9 linked to TRANSCOM contractors. Of those 20, however, information on just two was relayed back to TRANSCOM.
63780211
submission
chicksdaddy writes:
The Security Ledger reports (https://securityledger.com/2014/08/facebook-awards-internet-defense-prize-for-work-on-securing-web-apps/) on Facebook awarding its first ever monetary prize for groundbreaking work on cyber defense.
In a blog post on Wednesday, the company announced its first ever, $50,000 Internet Defense Prize was awarded to Johannes Dahse and Thorsten Holz, both of Ruhr-Universität Bochum in Germany for their work on a method for making software less prone to being hacked.(https://www.facebook.com/notes/protect-the-graph/internet-defense-prize-awarded-at-23rd-usenix-security-symposium/1491475121092634)
Dahse and Holz developed a method for detecting so-called “second-order” vulnerabilities in Web applications using automated static code analysis. Their paper (https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-dahse.pdf) was presented at the 23rd USENIX Security Symposium in San Diego.(https://www.usenix.org/conference/usenixsecurity14/technical-sessions)
In a blog post announcing the prize, John Flynn, a security engineering manager at Facebook, said the Internet Defense Prize recognizes “superior quality research that combines a working prototype with significant contributions to the security of the Internet—particularly in the areas of protection and defense.”
Second order vulnerabilities are distinct from ‘first order’ security holes like SQL injection and cross site scripting. They allow an attacker to use one of those first-order flaws to manipulate a web application and store a malicious payload on a web server. That payload, which may be stored as a shared resource on the application server, can later be used to target all users of the application.
Dahse and Holz’s work was chosen by a panel to receive the prize both on its technical merit and because panelists could “could see a clear path for applying the award funds to push the research to the next level,” Flynn wrote.
63551139
submission
chicksdaddy writes:
The Security Ledger reports (https://securityledger.com/2014/08/study-finds-unrelenting-cyber-attacks-against-chinas-uyghurs/) on a new study of China's persecuted Uyghur minority that describes a community besieged by cyber attacks and with little protection from punchless antivirus software.
The study, “A Look at Targeted Attacks Through the Lense of an NGO” (http://www.mpi-sws.org/~stevens/pubs/sec14.pdf) is being presented at the USENIX Security Conference in San Diego on August 21. In it, researchers at Northeastern University and The Max Plank Institute studied a trove of more than 1,400 suspicious email messages sent to 724 individuals at 108 separate organizations affiliated with the Uyghur World Congress, an umbrella group representing Uyghur interests.
The study found that the "APT" style targeted attack weren't so "advanced" after all. The individuals or groups behind the attacks relied heavily on malicious e-mail attachments to gain a foothold on computers with malicious Microsoft Office or Adobe PDF attachments the favorite bait. The groups behind the attacks did not rely on – or need – previously unknown (or “zero day” ) software vulnerabilities to carry out attacks. Known (but recent and unpatched) software vulnerabilities were enough to compromise victim systems.
NGO groups are depicted as having few defenses against the attacks: anti virus software was largely ineffective at stopping malicious programs used in the attacks.“No single tool detected all of the attacks, and some attacks evaded detection from all of the antivirus scanners,” wrote Engin Kirda, a researcher at Northeastern University in a blog post.(http://labs.lastline.com/a-look-at-advanced-targeted-attacks-through-the-lense-of-a-human-rights-ngo-world-uyghur-congress) Even months after the malware was used against the WUC, “standard anti-virus (AV) detection software was insufficient in detecting these targeted attacks,” Kirda wrote.
63548089
submission
chicksdaddy writes:
The security community has been aware of the danger posed by open redirect vulnerabilities (http://cwe.mitre.org/data/definitions/601.html) for years, but that hasn't added any urgency to calls to fix them.
Now data from Akamai shows that open redirects are a leading culprit in SEO attacks, in which scammers use redirects from legitimate web sites to plant malicious software on the computers of unsuspecting visitors. "Open redirect vulnerabilities are frequently left un-patched on major sites across the Internet, and these vulnerabilities are being exploited extensively by malicious actors and organizations," writes Akamai researcher Or Katz in a post on The Security Ledger.
In just one example, Akamai observed an SEO attack in which 4,000 compromised web servers at legitimate web sites were used to redirect visitors to more than 10,000 malicious domains. The activity also served to boost the search engine ranking of the malicious sites, Akamai said.
