Dangers On The Internet

2022-12-28T12:12:00.001+00:00

It is now ILLEGAL to share your Netflix, Disney+, other passwords with friends and relatives

The UK government body overseeing intellectual property rights in the UK, the Intellectual Property Office (IPO), released new guidance on piracy and online counterfeit goods, a joint campaign with Meta, owner of Facebook.

The issue of piracy is generally about the use of illegal streaming boxes and apps and how these 1) expose children to inappropriate content and 2) risk putting sensitive personal information in the hands of criminals. UK legislation now also flags password sharing as piracy, as TorrentFreak pointed out. It is therefore illegal, and a potential crime, to share your Netflix and/or Disney+ login details with your friends and relatives.

A section of the new piracy guidance from the UK government’s Intellectual Property Office (IPO) (Source: GOV.UK)

TorrentFreak was told by the IPO: "There are a range of provisions in criminal and civil law which may be applicable in the case of password sharing where the intent is to allow a user to access copyright-protected works without payment.

These provisions may include breach of contractual terms, fraud or secondary copyright infringement depending on the circumstances."

Section 11 of the Fraud Act of 2006 in the UK considers it a fraud if someone uses "services of a members' club without paying and without being a member".

It is not very likely that streaming services will to start dragging to court those who are sharing passwords, or "moochers" (individuals borrowing a subscriber's credentials). Still, the guidance could well serve as a deterrent for people who are sharing their subscription details with friends or relatives.

Risky business

Sharing one’s streaming service login details with others is risky business (security wise) for subscribers and usually yields negative results for the service provider. These providers lose money as long as they let this password sharing go on. According to a survey from Beyond Identity, streaming service providers lose, on average, some $640 per 'moocher' annually. In some cases they could lose as much as $700 a year!

The cost of piracy, as estimated by Parks Associates, in US alone, was $9.1B in 2019. The amount is estimated to increase to $12.5B by 2024.

No wonder they are cracking down on password sharing!

In October, Netflix announced its intention to start doing just that soon. The company has already introduced features to members in certain Latin American countries where they can share their account details with others safely and legally: a new profile can be added to their account for an added cost. Netflix may well roll out this provision in other countries.

"[Streaming services] don’t necessarily want people to go elsewhere," Paul Erickson, the Research Director of Entertainment and Consumer Technology at Parks Associates, said in an interview. "We'll see them navigate that difficult middle ground where they’re not trying to give the service away, but they’re also not trying to drive people away either."

So be prepared!

It looks like it is going to be more difficult to share you password. Or, at the very least, you may have to pay for doing so.

There is, off course, the risk of getting a criminal record...

Gone phishing...

2022-01-24T19:32:00.000+00:00

Like me, you probably receive loads of 'dodgy' emails purporting to be from a genuine source.

How do you spot a scam, a 'phishing' email?

Phishing emails are designed to appear as real companies or individuals to defraud you by stealing your personal information or enticing you to download attachments that contain viruses or other malware.

How to spot a phishing email:

Do you have an account with this company or know the individual?
If so, are you expecting this email?
Check the email sender address to see if it is legitimate.
Be wary of attachments, especially if they are oddly named.
Is the email generic?
Are the grammar and spelling correct?
When you hover on any links, it will show the URL. Is this URL linking to a site that you expect and trust?

If you believe that you have received a phishing email, please report the email (in the UK it is as simple as forwarding it to report@phishing.gov.uk), block the sender and delete the email if it has not been removed.Many trusted companies, especially financial institutions, offer what is called "two factor authentication".

This is a two-step process that provides an extra layer of security for you when accessing your account. When set up, you will be required to enter an additional password that will be sent to your mobile/cell phone to log into your account.

It is strongly recommended that you enable this two factor authentication, if offered, to ensure that your account can only be accessed by authorized persons, even if your information has been stolen.

A bug is about to confuse a lot of computers!

2021-11-24T18:59:00.003+00:00

Turning back the time some 20 years

Remember the fuss about the Y2K bug?

The US Cybersecurity & Infrastructure Security Agency (CISA) has issued a warning to users who get the time from GPS, about a “GPS Daemon” (GPSD) bug in GPSD versions 3.20 through 3.22.

The “Y2K” bug

Prior to year 2000, lots of computer programs kept track of the year by remembering just the last two digits of the year (“99”, instead of “1999”). These programs would work correctly until the first day of the new millennium, and then revert back to 1900!

Though some computer programs don’t care what time it is, there was genuine fears that things would go horribly wrong - the power grids would shut down, planes would fall from the sky, the banking system would grind to a halt, and so on.

In the end, none of that happened because everyone received warnings well in advance and there was enough time to take action.

What’s the bug now?

In addition to telling you where you are in space, the Global Positioning System (GPS) can also tell you where you are in time. To do this, it keeps a count of the number of weeks since January 5, 1980. The main civil GPS signal broadcasts the GPS week number using a 10-bit code with a maximum value of 1,023 weeks. This means every 19.7 years, the GPS week number in the code rolls over to zero.

GPSD is a GPS service daemon for Linux, OpenBSD, Mac OS X, and Windows. It collects data from GPS receivers and makes that data accessible to computers, which can query it on TCP port 2947. It can be found on Android phones, drones, robot submarines, driverless cars, manned military equipment, and all sorts of other embedded systems.

But now a flaw in some versions of GPSD could cause time to roll back after October 23, 2021. The vulnerable versions of the code seem to subtract 1024 from the week number on October 24, 2021. This would mean Network Time Protocol (NTP) servers using the faulty GPSD versions would think it’s March 2002 instead of October 2021!

Is it going to be really bad?

For computer systems that have no other time reference this could cause a number of security issues. From the perspective of incident handling and incident response, well-synchronized time across systems facilitates log analysis, forensic activities and correlation of events. Losing track of what happened when, can lead to missed incidents.

Even worse: NTP servers using the faulty GPSD version could get thrown back almost 20 years. Many businesses and organizations rely on NTP’s. Some authentication mechanisms also rely heavily on time. Users might therefore not be able to authenticate and gain access to systems.

This could also happen where authentication relies on cookies. Websites and services relying on expiring cookies do not respond well to cookies from twenty years in the future.

What to do

Since the affected GPSD versions are 3.20 through 3.22 users should upgrade to version 3.23.1. Organizations that use GPS appliances or rely on GPSD are urged to check if GPSD is being utilized anywhere in the infrastructure and check its corresponding version. An upgrade to GPSD may be required.

If you are a system administrators you’d do well to make a note of the date October 24, 2021. If systems start to have authentication issues after that, it could be due to a mismatch in date and time.

Are your children safe online?

2021-02-15T19:38:00.001+00:00

Is your child safe when they're online alone?

How would you know?

The Internet is an haven for child molesters, sexual offenders and pedophiles.

Right now, these sexual predators are trolling the net looking for a child just like yours!

But there is a software program that can help keep our kids safe when they go online.

Watch the video below.

With PC Tattletale, it has never been easier to see every click and keystroke pressed.

PC Tattletale makes it easy to see every click from their computer, social media, email, the web, and more..

Watch everything your kids do on the computer.

To learn more, click here

Did you know that...

About 1 in 5 children were solicited for sex in the past year while online?

Or that the FBI estimates that there are over 1 million sex offenders online?

Or that by the time they reach 15 the average teen has been exposed to hundreds hard core images

Protect your kids when they go online:

PC Tattletale

Beware of The "Secret Sister Scam"

2018-11-28T20:38:00.002+00:00

The festive season is imminent and with it many scammers and fraudsters that want your hard earned money.

It’s a Facebook Secret Sister (not Santa) you especially have to watch out for. Secret Sister has been a mainstay of Yuletide scams since at least 2015, and has come back around once more. But what is it?

How the scam works

Chain letters of the Secret Sister variety land in your digital mailbox as opposed your real one. You could in theory receive one of these anywhere, and people have reported receiving them on everywhere from Reddit and Facebook to various social portals and forums. For whatever reason, Facebook seems to be the scammer’s favourite place to get the ball rolling. The possibility of being able to send it pinging around large social connection chains is too good to resist.

Secret Sister sample

The messages can vary wildly, but one of the most popular ones going back a year or so reads as follows:

Anyone interested in a Holiday Gift exchange? I don’t care where you live – you are welcome to join. I need 6 (or more) ladies of any age to participate in a secret sister gift exchange. You only have to buy ONE gift valued at $10 or more and send it to one secret sister and you will receive 6-36 in return!

Let me know if you are interested and I will send you the information!

Please don’t ask to participate if you are not willing to spend the $10.

'TIS THE SEASON! and its getting closer. COMMENT if You’re IN and I will send you a private message. Please don’t comment if you are not interested and aren’t willing to send the gift!

It might sound promising to many people reading it, but it really won’t do you much good.

From chains to pyramids

Chain letters are essentially pyramid schemes. Pyramid schemes involve funneling money from bottom to top of the pyramid, benefiting those at the top and not many others. If you’re there from the get-go, your chances of making a good return increase somewhat. For everyone else, you’re probably going to lose out.

Where this becomes complicated is in the US is these schemes tend to resemble gambling. This means you could easily end up breaking the law. From the US Postal Inspectors website:

They’re illegal if they request money or other items of value and promise a substantial return to the participants. Chain letters are a form of gambling, and sending them through the mail (or delivering them in person or by computer, but mailing money to participate) violates Title 18, United States Code, Section 1302, the Postal Lottery Statute

Secret Sister data harvesting

You definitely won’t receive a pile of free gifts. However, you could be dragged into some sort of dubious postal scam with mail fraud penalties instead. There’s also the risk of identity theft to consider. Mail fraud scammers typically ask for various pieces of personal information. You could end up handing them your name, address, phone number, alongside a variety of online profiles to tie them to. This could be all an enterprising criminal needs to do some additional damage, especially if they persist in branching out from your profile to those of your friends.

No matter how appealing the prospect of easy free gifts sounds as 2018 slowly draws to a close, don’t fall for it. These types of antics have been around for a long time, and moving into the digital realm doesn’t make them any safer. If you’re not based in the US, you may not have the legal worry to deal with as a result but that’s scant consolation.

Our advice is to give his sister nothing more than a Return to Sender.

Source: https://blog.malwarebytes.com

Meltdown and Spectre - How to protect against these CPU security flaws

2018-01-07T15:00:00.001+00:00

Metldown and Spectre CPU security flaws are currently making headlines around the world. How do you protect your device from these issues?

What are Spectre and Meltdown?

Spectre and Meltdown are flaws found in processors from Intel, ARM and AMD that could allow hackers to access passwords, encryption keys and other private information from open applications.

These flaws are sending shock waves through the IT world. Actually, it was revealed that they had been present in chip designs for the past 2 decades! It was also revealed that they affect a number of companies’ processors, therefore the flaws could be found on a massive number of devices, from PCs to web servers and even smartphones.

Should Spectre and Meltdown worry me?

You shouldn’t need to panic, because so far it doesn’t look like Spectre or Meltdown have been used in an attack, and device manufacturers are working with Intel, ARM and AMD to fix these flaws.

Intel has claimed that the exploits can't corrupt, modify or delete data. Though, it has emerged that Spectre may need a processor redesign to fix.

However, this does mean that future processors will be free from the Spectre and Meltdown security flaws. So, don’t worry too much! Still, be aware of any updates for your devices and protect yourself against the Meltdown and Spectre CPU security flaws following the advice here.

Protect yourself against the Meltdown and Spectre CPU security flaws...

... on Android phones:

Google will release a new security update on January 5 that will help protect your Android Phone against Meltdown and Spectre.

If you have a Google-branded phone, such as the Nexus 5X or the Pixel 2 or Pixel 2 XL, then you should get the update promptly, and on Google’s newer devices the update should download and install automatically.

Open the settings app on your Android device, go to ‘System’ and see if you can find new updates waiting for you. It may also be worth following your phone manufacturer on Twitter to keep up with news about the update.

...on iPhones:

Apple has has admitted taht Meltdown and Spectre are affecting all iPhones.

Apple also revealed that it had already released ‘mitigations’ for Meltdown in iOS 11.2, so make sure you keep an eye out for any new updates made available for iOS on your iPhone or iPad, and go into 'Settings' to check what version of iOS you are running.

Apple didn't say it had a fix for Spectre just yet, but it mentioned that “We continue to develop and test further mitigations for these issues and will release them in upcoming updates of iOS, macOS, tvOS, and watchOS.”

... on Windows PCs:

Windows PCs are likely to be hit hardest by Meltdown and Spectre, regardless if they run on Intel or AMD processors. The good news is that Microsoft seems to be on the case and has said that it has already released a security update on Wednesday for Windows 10, as well as previous versions of Windows.

Windows 10 should download the update automatically, but to be sure, type ‘windows update’ in the search bar of the taskbar, and select ‘Check for updates.’ Download and install any new updates it finds.

... on Macs:

Macs have also been affected by Meltdown and Spectre, and Apple has released a statement admitting the fact that all Macs have been affected.

While this is worrying, Apple also added that it has already released a series of fixes in macOS 10.13.2, so keep an eye out in the Mac App Store for any updates to OS X or macOS, and make sure you’re running the latest version of the operating system.

... on Chromebooks:

Recent Chromebooks should be automatically protected from Meltdown and Spectre, as Google released Chrome OS version 63 in December, which has features included to avoid these flaws.

If you want to know if your Chromebook is updated to version 63, or if an update is coming, check out Google’s list of Chrome OS devices, and check that it says ‘yes’ in the last column.

Following the advice above should help you to stay protected against Meltdown and Spectre.

This blog also has links to several world class Anti Virus software programs (like Zone Alarm) that can help you stay protected against future attacks.

Traditional Antivirus fails to protect 40 percent of users!

2018-01-01T18:45:00.001+00:00

Conventional antivirus solutions are failing to protect users from attacks according to a Malwarebytes report.

The study is based on real-world clean up scans performed by Malwarebytes. Nearly 40 percent (39.18percent) of all malware attacks cleaned on endpoints with an AV installed occurred on endpoints that had two or more traditional AV solutions registered.

In addition 39.16 percent of attacks on endpoints with a non-OS bundled AV installed occurred on an endpoint running one of the four leading traditional AV solutions.

"The results of these scans clearly indicate the ineffectiveness of today's traditional AV solutions and, more importantly, the unknown risks to users that depend only on these AV platforms to stay safe," says Marcin Kleczynski, CEO of Malwarebytes. "Antiquated AV technology is no longer enough to protect from sophisticated cyberthreats. It's crucial that consumers and businesses understand this now before they become a victim of the next attack."

The findings also show the top ransomware types detected on compromised machines are Hidden Tear (41.65 percent) and Cerber (18.26 percent). Botnets most often detected include IRCBot (61.56 percent) and Kelihos (26.95 percent). The most prevalent Trojan types bypassing traditional AV detections are Fileless (17.76 percent) and DNSChangermalware (17.51 percent).

Of ransomware attacks 48.59 percent of Hidden Tear and 26.78 percent of Cerber events were found on a compromised endpoint that had at least one of the four leading traditional AV brands installed.

To show how widespread the problem is, Malwarebytes has produced a real-time heatmap that shows each time Malwarebytes remediates instances of malware on endpoints that have a traditional AV registered. It also shows the numbers of attacks missed by leading antivirus programs.

Source: betanews.com

2018-01-01T18:02:00.000+00:00

2018-01-01T17:51:00.003+00:00

Click Here and get award winning roses and chocolate for your special someone!

"Can You Hear Me?"

2017-01-29T15:43:00.000+00:00

Police Warn: New "Can You Hear Me?" Phone Scam Could Cost You A Lot

Now this is scary!

Police are warning cellphone users of a terrifying new scam, multiple news agencies report. The scam is brilliantly simple: all it consists of is a scammer calling from an unfamiliar number (but often one with a familiar area code) and asking, "Can you hear me?" It seems like a simple question, and most people would just answer, "Yes." In this case, however, the hacker records you saying "Yes" and then uses the response to authorize credit card or bill charges.

View image on Twitter

Follow

CBS News

✔@CBSNews

ALERT: New "can you hear me" scam circulating around the U.S. http://cbsn.ws/2juqjiT

7:30 PM - 26 Jan 2017

140 Retweets

60 likes

GETTY

"You say 'yes,' it gets recorded and they say that you have agreed to something," Susan Grant, director of consumer protection for the Consumer Federation of America, told CBS News. "I know that people think it's impolite to hang up, but it's a good strategy."

While "Can you hear me?" seems to be the most popular question, scammers are using other questions that would prompt a "Yes" response, like "Are you the homeowner?" and "Do you pay the bills."

Fox News provided the following tips to avoid this scam:

Do not answer the phone from numbers you do not recognize.
Do not give out personal information.
Do not confirm your number over the phone.
Do not answer questions over the phone.

If you do receive a suspicious call, authorities are advising people to hang up right away and call 911. And if you've already received a call like this, make sure to carefully monitor your credit activity!

Source: Good Housekeeping

Hate your job?

2016-12-14T19:55:00.000+00:00

DDoS attacks so powerful entire countries can be cut from the internet

2016-11-04T15:12:00.000+00:00

Liberia has become the latest victim of the Mirai botnet

There has been another worrying development when it comes to massive-scale DDoS attacks, with the latest victim being an entire country – Liberia over in Africa, to be precise.

And as you won’t be surprised to hear if you’ve been following these stories, this is another assault which leverages the Mirai botnet to fire tons of traffic at the victim – that’s been the source of all these big attacks since the first massive volley against security researcher Brian Krebs (which reached some 620Gbps).

As ZDNet spotted, apparently the Mirai botnet employed in the attacks against Liberia is known as Botnet #14, and security expert Kevin Beaumont observesthis is the largest such botnet – consistently capable of producing over 500Gbps – which appears to also be the source of the recent massive attack on Dyn.

The hit on Dyn, which is a DNS provider, caused a massive web outage a fortnight ago, knocking out all manner of sites including Twitter, Netflix and Spotify.

Liberia has apparently suffered at the hands of a number of DDoS attacks which are short by nature, but worrying because they’re pretty much taking the entire country offline.

Glaring weakness

As Beaumont observes, that’s because Liberia relies on a single pipe for its internet access, and so has a single point of failure (and it’s not the only country like this). Websites hosted in Liberia were downed, and a journalist Beaumont spoke to said that internet connectivity was going offline at times matching the DDoS blasts.

Beaumont noted: “The attacks are extremely worrying because they suggest a Mirai operator who has enough capacity to seriously impact systems in a nation state.”

The truth is that few people are on the internet in Liberia anyway – only around one in 20 of the population – but ZDNet also managed to get some confirmation from a person returning to the country, who said they experienced ‘minor interruptions’ to their internet usage on Wednesday evening.

But given the low-profile target country and the very short nature of the attacks, it seems that this is just the botnet’s owner(s) testing out firepower against a nation. It’s what might come next that’s worrying, of course, when the DDoS cannons are aimed and let loose with a sustained barrage.

As we saw with the Dyn affair, the sort of damage these large-scale attacks can now muster is quite frightening. And worse still, there’s the prospect of Mirai being cranked up in terms of its potential power as more easily compromised IoT devices (security cameras, DVRs, routers and so on) are hacked and join the massing botnet ranks.

The other major concern is the use of possible DDoS amplification techniques, such as the one we reported on last month, which could potentially be used to inflict assaults of 35Tbps or even more by seriously powering up these botnet-based attacks.

Source: http://www.techradar.com/

Cyber Threats Hit Record Levels

2014-01-25T21:00:00.000+00:00

Cyber threats and vulnerabilities have reached their highest level for more than a decade, networking equipment specialist Cisco's latest security study reveals.

According to the Cisco 2014 Annual Security Report, which became available this week, cumulative annual alert totals rose by 14% on the year in October 2013. The IT major says that the malicious activity witnessed is at its highest level since the firm began tracking it back in 2000 as the targets of such attacks are failing to address the challenges of the quickly evolving threat landscape.

According to the report, there is a dire need for security professionals worldwide. This, coupled with the lack of adequate systems at most enterprises, leaves organisations without the necessary resources to address cyber attacks. Cisco has estimated that the global shortage of security experts will exceed one million this year.

A startling finding of the study is that all 30 of a sample of the biggest multinational company networks generated visitor traffic to websites with malware, with 96% reviewing communicated traffic to hijacked servers and 92% transmitting traffic to empty web pages, which is also usually associated with exposure to malicious activity, Cisco noted.

And it seems that malicious attacks are widening their scope among verticals. In the past two years, sectors that had remained relatively unscathed by malicious breaches, such as agriculture and mining, witnessed a substantial rise in malware encounters, the IT company said.

The research found that Multipurpose Trojans prevailed in web-delivered malware last year, accounting for 27% of all encounters, and, among programming languages, Java is still the primary target of online criminals.

In addition, Android turned out to be by far the most targeted mobile platform, accounting for 99% of all mobile malware.

Source: www.misco.co.uk

Pirate Bay Co-Founder’s Sentence Cut In Half

2013-09-28T13:11:00.002+00:00

Pirate Bay co-founder Gottfrid Svartholm Warg's prison sentence for hacking and fraud has been reduced from two years to one. (Photo: Reuters)

Pirate Bay co-founder, Gottfrid Svartholm Warg had his prison sentence for hacking and fraud reduced from two years to one. A Swedish appellate court made the decision on Wednesday after finding that one of the hacking charges against Svartholm Warg lacked sufficient evidence, the Associated Press reported. Namely, charges relating to the hacking of Nordea Bank AB were dismissed, while other hacking charges were upheld.

The Pirate Bay co-founder's sentence was cut in half because the Svea Court of Appeal said it could not rule out Svartholm Warg's claim that others could have remotely accessed his computer to hack into the Nordea Bank AB's servers. While the court dismissed the bank hacking charges, it upheld the conviction against Svartholm Warg of hacking into the servers of two other companies, Applicate and Logica, which handle sensitive information for Sweden's police force and tax authority. The Wall Street Journal reported that Svartholm Warg was originally convicted of hacking into all three companies' servers in June, resulting in the two-year sentence.

The Pirate Bay is one of the world's biggest free file-sharing websites, giving millions of users a way to illegally download music, movies and software. Since launching the site in 2003, Svartholm Warg and fellow co-founder Fredrik Neij have been embroiled in controversy. In 2009, the co-founders, along with company spokesman Peter Sunde and businessman Carl Lundstrom, were given one-year sentences for copyright violation by a Swedish court and ordered to pay 46 million kronor ($6.5 million) in damages to the entertainment industry.

Svartholm Warg left the country while appealing that ruling. He was arrested in Cambodia in 2012 and deported back to Sweden after an international arrest warrant was issued against the Pirate Bay co-founder, per the AP. He served out his first sentence for copyright violation while under detention over his hacking charges.

But while the Pirate Bay co-founder might have had his sentence reduced in Sweden, he might not be out of hot water yet. Decrypted Tech reported that Svartholm Warg is facing extradition to Denmark, as he is a suspect in a breach that resulted in the theft of driving records and social security numbers. The Danish authorities expect to have Svartholm Warg in custody in a few days.

Source: idigitaltimes.com

61% Of Malware Attack Victims Lose Some Data Forever

2013-09-14T12:45:00.001+00:00

Most IT users know that malware is dangerous but few are fully aware of the havoc it can wreak. A new survey from B2B International and Kaspersky Lab reveals the true scale of the malware problem: just 39% of victims manage to fully restore the data lost as a result of a breach.

As Kaspersky Lab points out, a quarter of malware attacks succeed in stealing or corrupting confidential information. In the case of 17% of victims all data is lost forever, while 44% manage a partial retrieval. This is cause for concern, considering the importance we attach to our data, Kaspersky Lab said. Among the survey respondents, 56% declared that they deemed their information more valuable than the machine storing it. The poll also showed that 10% of affected users have resorted to the services of outside experts in the effort to restore their lost data.

But a data recovery specialist may not always achieve complete success and sometimes nothing can be done. Even an expert will be helpless if the attackers have used a file encryptor. This malicious program encrypts the files on the user's computers and requires a unique key for decryption. This is the type of program known as ransomware because the attackers typically demand payment in return for the decryption key.

Computers and mobile devices have become an integral part of daily life so it would be virtually impossible not to store confidential information on digital devices. However, users can minimise the risk of data loss through regular back-ups and reliable anti-malware protection, Kaspersky Lab said.

'BadNews' Android malware in approved apps may have been downloaded 9 million times!

2013-04-21T15:49:00.000+00:00

A new breed malware has been discovered within at least 32 Android apps, which may have been downloaded up to nine million times!

The so-called 'BadNews' malware was outed by security firm Lookout Mobile Security in a blog post on Friday and the affected apps have now been removed by Google.

All of the apps found to contain the malicious code had been approved by Google, but it appears that the harmful elements had been added after the fact, disguised as updates.

Apps containing the BadNews code have been reporting back to a server and revealing sensitive information like the phone number and handset serial number.

'Bad guys are smart'

The affected apps include English and Russian-language games, dictionaries, wallpapers and were able to make it past the Google Bouncer software that scans the Play store for harmful apps.

Marc Rogers, principal security researcher for Lookout, told Ars Technica: "You can't even say Google was at fault in this because Google very clearly scrutinized all these apps when they want in.

"But these guys were cunning enough to sit there for a couple of months doing absolutely nothing and then they pushed out the malware.

"This is a wakeup call for us in the industry to say: 'Bad guys are smart as well and they'll take a look at the security models we put in place and they'll find weaknesses in them. That's exactly what they've done here."

Source: http://www.techradar.com

Facebook site infiltrated!

2013-02-16T15:23:00.001+00:00

The Facebook security teams has confirmed that the social networking site was targeted in a "sophisticated attack" last month.

The digital intrusion apparently occurred when a small number of Facebook personnel visited a compromised mobile developer website.

"The site hosted an exploit which then allowed malware to be installed on these employee laptops. The laptops were fully-patched and running up-to-date anti-virus software. As soon as we discovered the presence of the malware, we remediated all infected machines," a Facebook rep explained.

"After analyzing the compromised website where the attack originated, we found it was using a 'zero-day' (previously unseen) exploit to bypass the Java sandbox (built-in protections) to install the malware. We immediately reported the exploit to Oracle, and they confirmed our findings and provided a patch on February 1, 2013, that addresses this vulnerability."

Interestingly, Facebook says it wasn't not alone in the above-mentioned attack, as other sites were infiltrated as well.

However, the rep was also quick to point out that the social networking site had found "no evidence" of compromised user data.

"As part of our ongoing investigation, we are working continuously and closely with our own internal engineering teams, with security teams at other companies, and with law enforcement authorities to learn everything we can about the attack, and how to prevent similar incidents in the future," the rep added.

Source: www.tgdaily.com/

Ransomware - A Major Threat To Internet Security

2012-11-17T21:55:00.001+00:00

Ransomware is emerging as a major cybercrime strategy, threatening to oust fake anti-virus software as the most popular cyber-attack next year, new research by IT security firm Symantec shows.

A total of 2.8% of victims of ransomware pay a "ransom" of up to £280 to regain access to their computers which have been blocked by cryptoviruses. Victims are tricked into making the payments after receiving fake messages that look like they have been issued by police authorities. Such messages often tell users they must pay a penalty for browsing illegal content.

Cybercriminals pocket £3 million annually from blackmailing users to pay to free their PCs from the malicious software, with one criminal group having tried to plague 495,000 computers in just 18 days, Symantec said, as quoted by IT Pro.

The first cases of ransomware were found in 2009 and were mainly limited to Eastern Europe and Russia.

However, this type of cybercrime is spreading to Western Europe, the USA and Canada, Symantec said. Criminal gangs have been traced back to a single unidentified person who apparently creates ransomware on request.

As consumer demand shifts to mobile devices and the cloud, cyber-attacks will increasingly focus on Secure Sockets Layer (SSL) certificates used by mobile apps, Symantec believes. Meanwhile, according to an earlier report by IT Pro, security experts have identified a new malware strand that steals image files from PCs and dispatches them to a remote server.

Have You Been Called From 002538020308?

2012-05-02T12:15:00.000+00:00

Many people report having been called from the international number 002538020308.

The scenario is like this:

Always an english speaking foreigner (Indian sounding). Different name used on each call - Jess, Smith, Stephen, Wayne, & others.

Different Company names have included: Windows security center, Creative Solutions, MPC Help, Windows Service Center, Windows Security Maintenance, 24/7 PC Help, etc.

Sometimes they say they are calling "on behalf of Microsoft", or offer to do a free PC health check, or even directly tell you that your system has been compromised and it has got viruses.

Is this a SCAM?

The New Zealand Internal Affairs Anti-Spam Compliance unit is reiterating it’s warning about a cold caller who offers to fix a problem with home computers. It has received several calls and emails from people who have received similar calls.

Senior investigator Toni Demetriou says a Dunedin computer company had received an infected PC for repairs from a customer who had been taken in by the scamster and police were investigating.

“We now believe the calls are being made from overseas, not from New Zealand as originally suspected, and quite a lot of people are receiving them,” Mr Demetriou said. “The caller can be quite convincing. On one occasion he handed the conversation across to a ‘supervisor’ in an attempt to make the call sound more professional and convincing.

“He also gives various explanations for the calls such as phoning from a reputable and well-known international company, maybe a security and anti-virus vendor, suggesting the PC has been infected by a virus and needs repairs.

“The sole purpose of the call is to convince someone to login to a website. They are given a website name and once they are at the website home page they are then given a six digit code to log into that website.

“Essentially what then happens is that the person is handing over control of their computer to the person they are talking with. If you follow the instructions you will be allowing and authorising remote access to your computer. Just about anything could then happen.

“Viruses, malware, key logging software could be installed onto the computer. Any information on the PC could be taken and any sensitive usernames or login credentials and passwords may also be logged and obtained as you continue to use your computer in the future. If you log into your bank the information could be captured and your account compromised. The computer may also become part of a botnet and used for spamming activities.”

Mr Demetriou said unauthorised access to a computer system is an offence under the Crimes Act. Similarly, if the computer is infected through that unauthorised access and used for spamming activities, the Department of Internal Affairs, which enforces the Unsolicited Electronic Messages Act, would investigate.

If anyone believes their PC has been infected and compromised the Department recommends that it is inspected and repaired by a computer servicing company.

Facebook Blames ‘Coordinated Spam Attack’ for Surge in Porn Imagery

2011-11-16T08:38:00.000+00:00

By Tom Loftus

Facebook said today that a “coordinated spam attack” was to blame for the posting of pornographic and violent images on the news feeds of unsuspecting Facebook users.

The issue, which first started appearing on Facebook pages a couple days ago according to ZDNet, has generated a growing wave of revulsion online as some users took to Twitter to complain of graphic and lurid imagery that goes far beyond ordinary porn.

“I noticed Facebook porn in my friend feed. New feature? No. A Facebook ‘virus’ shows hardcore porn and violent,” tweeted Christopher Justice, a CEO of an Austin-based online design firm. Justice later told Digits that he has asked employees at his firm, who use Facebook “like a telephone,” to proceed with caution.

In a statement this afternoon Facebook said that some Facebook users were tricked into pasting and executing “malicious javascript” in their browser URL bar, causing them to share offensive content without knowing it. Facebook said that it is working on addressing browser vulnerability exposed by the bad code and that it has built “enforcement mechanisms” to shut down malicious Facebook pages and accounts.
“We’ve put in place backend measures to reduce the rate of these attacks and will continue to iterate on our defenses to find new ways to protect people,” a Facebook spokesman said.

Writing on the blog for Internet security firm Sophos earlier today, senior technology consultant Graham Curley said while the while the exact nature of the problem was not known, “What’s clear, however, is that mischief-makers are upsetting many Facebook users and making the social networking site far from a family-friendly place,” Curley wrote.

Facebook has a no-nudity policy and requires that members be at least 13 years old. Users are encouraged to report questionable content via links on Facebook pages. The social network also removes pornography on its own initiative.

Digits contacted Curley for more guidance on what users can do. Because details remain sketchy, he said, it’s hard to give advice. “However, we would continue to recommend that users tighten their privacy settings, lock down as much as possible their friends’ ability to tag them in posts and picture, and run up-to-date anti-virus software on their computers.”

He suggested that firms wishing to protect their staff from offensive content might consider blocking Facebook access until the problem is solved.

The problem comes as Facebook gears up to unveil a massive profile page redesign to its 800 million users. The redesign, called Timeline, will take each and every action a user has made on Facebook, and organize them chronologically. As one can imagine, no one is going to want their online diary soiled by a speck of violent imagery.

Whoever or whatever is to blame, the damage needs to be contained and fast, wrote Curley. “It’s precisely this kind of problem which is likely to drive people away from the site.”

Symantec: Hackers Hit Chemical Companies

2011-11-01T07:55:00.000+00:00

Cyber attacks traced to China targeted at least 48 chemical and military-related companies in an effort to steal technical secrets, a U.S. computer security company said Tuesday, adding to complaints about pervasive Internet crime linked to this country.

The targets included 29 chemical companies and 19 others that make advanced materials used by the military, California-based Symantec Corp. said in a report. It said the group included multiple Fortune 100 companies but did not identify them or say where they were located.

"The purpose of the attacks appears to be industrial espionage, collecting intellectual property for competitive advantage," said the report.

Security experts say China is a center for Internet crime. Attacks against governments, companies and human rights groups have been traced to this country, though finding the precise source is nearly impossible. China's military is a leader in cyberwarfare research but the government has rejected allegations of cyberspying and says it also is a target.

The latest attacks occurred between late July and September and used e-mails sent to companies to plant software dubbed "PoisonIvy" in their computers, Symantec said. It said the same hackers also were involved in attacks earlier this year on human rights groups and auto companies.

Symantec said it traced the attacks to a computer system owned by a Chinese man in his 20s in the central province of Hebei. It said that when contacted, the man provided a contact who would perform "hacking for hire."

Symantec said it could not determine whether the Chinese man was a lone attacker, whether he had a direct or indirect role or whether he hacked the targets for someone else. It called him Covert Grove based on a translation of his Chinese name.

The U.S. and Chinese governments have accused each other of being involved in industrial espionage.

Security consultants say the high skill level of earlier attacks traced to China suggests its military or other government agencies might be stealing technology and trade secrets to help state companies.

The chairman of the U.S. House of Representatives Intelligence Committee, Rep. Mike Rogers, said last month that Chinese efforts to steal U.S. technology over the Internet had reached an "intolerable level." He called on the U.S. and other governments to pressure Beijing to stop.

Another security firm, McAfee Inc., said in August it had found a five-year-long hacking campaign that it called Operation Shady Rat against more than 70 governments, international institutions, corporations and think tanks.

In February, McAfee said hackers operating from China stole information from oil companies in the United States, Taiwan, Greece and Kazakhstan about operations, financing and bidding for oil fields.

Thousands of Chinese computer enthusiasts belong to hacker clubs and experts say some are supported by the military to develop a pool of possible recruits. Experts say military-trained civilians also might work as contractors for companies that want to steal technology or business secrets from rivals.

China has the world's biggest population of Internet users, with more than 450 million people online, and the government promotes Web use for business and education. But experts say security for many computers in China is so poor that they are vulnerable to being taken over and used to hide the source of attacks from elsewhere.

Last year, Google Inc. closed its China-based search engine after complaining of cyber attacks from China against its e-mail service.

That case highlighted the difficulty of tracking hackers. Experts said that even if the Google attacks were traced to a computer in China, it would have to be examined in person to be sure it wasn't hijacked by an attacker abroad.

By JOE McDONALD AP Business Writer

Hackers Threaten To Destroy Facebook!

2011-08-10T05:36:00.000+00:00

Notorious hacker collective Anonymous on Tuesday threatened to “kill” Facebook on Nov. 5, according to a YouTube video spotlighted on official channels used by the group.

“Your medium of communication you all so dearly adore will be destroyed,” the group wrote in a transcript of its YouTube video. “If you are a willing hacktivist or a guy who just wants to protect the freedom of information then join the cause and kill facebook [sic] for the sake of your own privacy.”

Facebook did not immediately respond with an official comment about the threat.

Anonymous claims it is doing Facebook users a service because the company is “selling information to government agencies.” It also asserts that Facebook’s privacy controls are a joke and that users cannot actually delete their accounts.

“Everything you do on Facebook stays on Facebook regardless of your ‘privacy’ settings, and deleting your account is impossible, even if you ‘delete’ your account, all your personal info stays on Facebook and can be recovered at any time,” the group wrote. “Changing the privacy settings to make your Facebook account more ‘private’ is also a delusion. Facebook knows more about you than your family.”

Nov. 5 is Guy Fawkes Day, which commemorates when Fawkes and others placed explosives under the British House of Lords in 1605. The Guy Fawkes mask and story was popularized in the ten-issue comic series V for Vendetta and the movie based upon it.

The @YourAnonNews Twitter account appeared to confirm the video was actually issued by Anonymous, with a tweet on Tuesday night stating: “Remember remember the fifth of November the FaceBook treason and plot…”

The threat to destroy Facebook comes only a day after the group successfully hacked and defaced the Syrian Ministry of Defense’s website. Anonymous has gained much exposure in the last year with attacks on PayPal, Visa, Amazon, Bank of America, and various world governments. The group was blamed for the massive attack on Sony’s PlayStation Network but it denied involvement.

Even though Anonymous has had success in hacking some major websites in the past, it’s questionable that it would be successful against Facebook. When you consider that the hacking group has given Facebook several months to prepare for an attack, it’s extremely unlikely Facebook would be brought down. But when you’re talking about a group of hackers with an aim to sow dischord, you can never be certain.

The roughly made YouTube video issued by Anonymous can be watched below:

DefCon Kid Hacker Uncovers Zero-Day Exploit

2011-08-09T13:42:00.000+00:00

A number of media sources have made light of DefCon's "Kids Village", but a 10-year old hacker discovered an entire class of vulnerabilities and presented her findings as well or better than most of the conference's attendees.

The hacker goes by the handle CyFi, and she co-founded "DefCon Kids Village" -- a series of presentations for 60-odd aspiring hackers aged 8-16 who attended the conference in Las Vegas. The theme for the first year of the Kids Village was responsible hacking...although admittedly, some of the "white hat" skills demonstrated included lock picking and various Google hacks.

CyFi's own presentation was called "Apps—A Traveler of Both Time and Space, And What I Learned About Zero-Days and Responsible Disclosure." In it, she demonstrated how she could manipulate the clock on her cell phone to fool apps into thinking that more time had passed -- but there are a few other steps that CyFi, in the spirit of "responsible disclosure", did not spell out for the listeners.

"I'll show a new class of vulnerabilities I call TimeTraveler," CyFi's summary read. "By controlling time, you can do many things, such as grow pumpkins instantly. This technique enables endless possibilities. I'll show you how...Thank you AT&T, DEFCON, EFF and Lookout!!!!! :)"

The pumpkins were part of a social farming game that can be found on iOS and Android devices. Their slow growth (and CyFi's impatience) was the catalyst for the hacker's coding experiments. CyFi discovered that the code and clock alterations enable any number of changes to occur instantly within the framework of the game -- thus, the "new class of vulnerabilities".

In the true spirit of DefCon, CyFi di not divulge her 'real' name. Nor did she mention the names of the games that she'd hacked (i.e., "responsible disclosure"). However, she did proudly admit to being a "a ten-year-old hacker, artist and athlete living in California" who "really likes coffee, but her mom doesn’t let her drink it."

By James Lee Phillips, who is a Senior Writer & Research Analyst for IBG.com. With offices in Dallas, Las Vegas, and New York, & London, IBG is quickly becoming the leading expert in Internet Marketing, Local Search, SEO, Website Development and Reputation Management.

Sega says 1.3 million affected by data breach

2011-06-20T15:01:00.000+00:00

The hack that took down Sega's online gaming service late last week has affected 1.3 million customers.

That was one of the details confirmed by the publisher on Sunday.

A cyber attack on the publisher's Sega Pass service - a subscription-based feature that allows gamers to play unlimited Sega games online - forced the service to be shut down.

"We have identified that a subset of SEGA Pass members emails addresses, dates of birth and encrypted passwords were obtained. To stress, none of the passwords obtained were stored in plain text. Please note that no personal payment information was stored by SEGA as we use external payment providers, meaning your payment details were not at risk from this intrusion," Sega wrote in an e-mail to its customers.

On Sunday, Sega confirmed 1.3 million people were affected but did not have an estimate for when Sega Pass would be back online. The company said it is working on increasing its security.

The Sega Pass website has been replaced with a terse message that reads, "SEGA Pass is going through some improvements so is currently unavailable for new members to join or existing members to modify their details including resetting passwords. We hope to be back up and running very soon. Thank you for your paitence." (sic)

This of course comes just off the heels of Sony's massive data breach which forced the Playstation Network offline for over a month, resulting in what is estimated to be billions of dollars in damages.

Unlike Sony's service, Sega Pass is not an e-commerce platform for other publishers, so the damage is limited only to Sega itself. But with such a large number of users affected, it isn't a small attack by any means.

Source: www.tgdaily.com

Sony hit again with two hacks

2011-05-20T20:43:00.000+00:00

Japanese ISP subsidiary is broken into, while phishers use Sony server in Thailand

An intruder has apparently broken into So-net, an internet service provider subsidiary of Sony, and stolen about $1,200 worth of virtual tokens.

So-net disclosed the compromise in an alert (written in Japanese) on its homepage on Thursday.

Meanwhile, security firm F-Secure today disclosed that it has also discovered a phishing site that's hosted on a Sony server in Thailand.

"Basically this means that Sony has been hacked, again," Mikko Hypponen, F-Secure's chief research officer, noted in the blog post. "Although in this case the server is probably not very important," he added.

News of the latest breaches come barely a month after Sony disclosed intrusions at its PlayStation Network and Sony Entertainment Online sites that compromised data on close to 100 million account holders.

A So-net spokesman told the Wall Street Journal, which broke the story, that the breach of the ISP is unlikely connected to the previous compromises.

The Sony-owned So-net ISP lets consumers accumulate reward points that can be redeemed for Sony merchandize and services. The intruders illegally redeemed points belonging to about 130 consumers. Another 73 accounts were compromised, but their points were not redeemed, the Journal noted.

In addition, about 90 email accounts are also believed to have been compromised in the breach

According to the Journal, an intruder using one IP address, tried to access So-net's point service close to 10,000 times before finally gaining access. So-net itself appears to believe that the intruder had usernames of account holders and used an automated program to generate possible passwords, the Journal said.

It's not immediately clear why the company apparently doesn't have a mechanism for flagging multiple failed attempts to access its systems.

The intrusions are believed to have taken place on May 16 and May 17. So-net discovered the breach on May 18, after receiving consumer complaints. So-net stopped the point redemption service following the discovery of the breach.

he latest breaches are relatively minor in scale compared to the massive breach at PSN and Sony Entertainment Online. Even so, it only adds to the company's embarrassment.

The earlier intrusions forced Sony to take its PSN service offline for several weeks while it struggled to identify the scope of the problems and how to fix them.

The company started re-launching the service this week but isn struggling to keep it running smoothly.

For instance, earlier this week Sony was forced to once again take a portion of its PlayStation network offline because of a programming error that could provide hackers a way to break into its networks.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com.