If you scan my Barclays debit card, the data that you get from the contactless interface is not sufficient to create a cloned EMV card (contact or contactless) because it's a DDA (dynamic data authentication) card and you need the private key to forge it. The data isn't sufficient to create a cloned magnetic stripe card because it gives up the ICVV and not the CVV. The data isn't sufficient to use the card online because it doesn't give up the CV2. So all you can get, even if I don't notice you waving a POS terminal an inch from my arse, is the name, card number and expiry date (none of which are secret).]]>
The success of the scam – it had infected an estimated 250,000 PCs between September and December last year – has encouraged copycats, with CryptoDefense appearing in February and demanding $500 for a key to unlock files.
According to security firm Symantec, the latest iteration is earning its creators $34,000 a month, but while previous versions have been uncrackable without payment, CryptoDefense includes flaws that could allow victims to escape with payment. Oops, but in a good way.]]>
My goal with these configuration changes is to get Chrome to expose less attack surface to potentially malicious web pages, and to be less chatty on the network. Palmer works at Google on Chrome security.]]>
For its part, Microsoft has been trumpeting for months that Windows XP is six times more likely than Windows 8.1 to contract malware. Some InformationWeek readers labeled the statistics as a scare tactic, pointing out that Microsoft has newer products it wants to sell. This cynicism isn't without merit-- but don't be too quick to label Microsoft a fearmonger. Security experts agree: You stick with XP at your own peril.]]>
No credit card data of any kind was accessed by hackers. There is no evidence of unauthorized activity of any kind on all but two Kickstarter user accounts.
While no credit card data was accessed, some information about our customers was. Accessed information included usernames, email addresses, mailing addresses, phone numbers, and encrypted passwords. Actual passwords were not revealed, however it is possible for a malicious person with enough computing power to guess and crack an encrypted password, particularly a weak or obvious one. Change your Kickstarter password if you have one. Facebook logins not compromised.]]>
What’s wrong with this? And will WebCrypto fix it? I don’t think so. Let’s look at the good, the bad, and the ugly of in-browser cryptography and the WebCrypto API. Most of the ugly is the fact that it's in a browser. He specifically has a go at Kim Dotcom's MEGA and its promises of security.]]>
“Knox symbolizes state-of-the-art in terms of secure mobile architectures, and I was surprised to find that such a big ’hole‘ exists and was left untouched,” said Mordechai Guri, a Ph.D. student in the Cyber Security Labs at Israel’s Ben-Gurion University of the Negev, who discovered the vulnerability. “This weakness has to be addressed immediately, before it falls into the wrong hands.”
Knox creates a secure, password-protected virtual space within Samsung devices that’s supposed to allow the devices to connect to similarly secured corporate and government computers and access sensitive files without fear that those files might leak out to the outside world.
But thanks to the security hole, a user could install an app in the regular, non-secure area of the phone that could compromise all the phone’s communications, including those made within the Knox container, according to Cyber Security Labs researchers. In addition to exposing sensitive data, the hole could potentially be used to upload malicious files from a compromised phone to corporate or government servers, according to the Wall Street Journal. Odd that the Pentagon didn't discover this during its testing of Knox before giving it certification.]]>
The problem here is clear: these baseband processors and the proprietary, closed software they run are poorly understood, as there's no proper peer review. This is actually kind of weird, considering just how important these little bits of software are to the functioning of a modern communication device. You may think these baseband RTOS' [real time operating systems] are safe and secure, but that's not exactly the case. You may have the most secure mobile operating system in the world, but you're still running a second operating system that is poorly understood, poorly documented, proprietary, and all you have to go on are Qualcomm's Infineon's, and others' blue eyes. What's the betting that the NSA and GCHQ are very, very familiar with these RTOSs - and their bugs?]]>
In a blog post in late August, vBulletin maker Internet Brands Inc. warned users that failing to remove the “/install” and “/core/install” directories on sites running 4.x and 5.x versions of the forum software could render them easily hackable. But apparently many vBulletin-based sites didn’t get that memo: According to security firm Imperva, more than 35,000 sites were recently hacked via this vulnerability. People don't change defaults - even people who are setting up websites and so might be thought of as specialist. ]]>
Windows 8.1, which was released to manufacturing a month before iOS 7 but won’t hit shelves until October, has similar technology. A fingerprint identification framework designed for use with the same type of reader as is found in the new iPhone (a big improvement over older swipe-based fingerprint readers) is built into Windows 8.1. It can be combined with the Trusted Platform Module (TPM) in a Windows 8.1 device to create a virtual smartcard that makes spoofing of enterprise network credentials very difficult. The Chaos Computer Club's hack is probably going to make zero difference to the number of people who actually use the fingerprint unlock system on the iPhone 5s. ]]>
The attack against the Ivy Bridge processors sabotages random number generator (RNG) instructions Intel engineers added to the processor. The exploit works by severely reducing the amount of entropy the RNG normally uses, from 128 bits to 32 bits.]]>
It's crazy that a feature like this hasn't been put into place already, right? Even just with the passcode? So much effort has gone into features like Find My iPhone and Windows Phone's Find My Phone and Android Device Manager, and yet you skirt around them just by turning off the damn phone. Yes. Why hasn't anyone implemented this?]]>
The ease-of-use features in the Moto X, designed and built by Google-owned Motorola, are likely to tickle consumers while haunting IT security pros. First is the always-on microphone, which a person can use to activate the device using trigger words, such as "OK Google Now," to make phone calls or access services and features. The feature is possible through a special, low-power chip developed by Motorola that keeps the microphone on without draining the battery.
The always-ready microphone, coupled with the massive amount of data collection, makes the Moto X a valuable target for cybercriminals and cyberspies, who are already heavily focused on developing malware to take control of Android devices. No need for plastic cups or laser microphones.]]>
When Twitter receives a new login request with a username and password, the server sends a challenge based on a 190-bit, 32 character random nonce, to the mobile app — along with a notification that gives the user the time, location, and browser information associated with the login request. The user can then opt to approve or deny this login request. If approved, the app replies to a challenge with its private key, relays that information back to the server. The server compares that challenge with a request ID, and if it authenticates, the user is automatically logged in. Think that's clever? Wait until you read the solution for how it does it when you don't have your phone.]]>
Many Korean websites depend on Internet Explorer’s cumbersome “ActiveX” platform, posing another risk factor. KAIST professor Lee Min-hwa said, “ActiveX is a program that momentarily disarms the computer to download codes from an outside source, which can be abused by hackers seeking to plant malicious codes.”
Lee, one of the key patrons of President Park Geun-hye’s signature science and technology-based “creative economy,” said that Korea’s dependence on the ActiveX-based public key certificate system created a “black hole” in cyber security. Between 18.6m and 105m user details have been leaked since January 2008 (it's impossible to know if there's overlap between the largest, Auction in January 2008, and the others). South Korea has a population of 50m - so probably plenty of overlap.]]>
You could implement this the same way Chrome's sync feature is implemented, with two options:
* Encrypt synced passwords with your Google credentials
* Encrypt all synced data with your own sync passphrase
…While using Android requires a certain amount of trusting Google, I don't think it's rational to expect users to trust Google with their plaintext passwords when Google can be compelled to give this data to the US government when they request it.]]>
OEMs are being painfully slow about releasing the Bluebox Security patch, but Bluebox itself has released a scanner app for it.
Worse still, there's now a proof of concept for the security hole. This proof of concept means that as surely as the sun will rise in the east in the morning we'll soon see real malware using it. The Samsung Galaxy S4 and HTC One have been updated; no worries there. Actually carrying out the attack would almost certainly only be feasible through sideloaded apps.]]>
Using a single computer, it took a maximum of 49 minutes to crack a password, but using an array of just four powerful processors would enable 100% success in just 50 seconds. They called on Apple to switch to true randomly-generated passwords to boost security. You might get hacked, but at least you'll have a 272-point score.]]>
The creators of Backdoor.AndroidOS.Obad.a also used yet another previously unknown error in the Android operating system. By exploiting this vulnerability, malicious applications can enjoy extended Device Administrator privileges without appearing on the list of applications which have such privileges. As a result of this, it is impossible to delete the malicious program from the smartphone after it gains extended privileges. And with that the fun is only just beginning. This is reckoned to be one of the worst pieces of Android malware yet identified.]]>
Two-Step Verification
Access History
Authorized Applications
Which big services now don't have two-step authentication?]]>
The Trojan, which was first detected in 2007, is only getting more active. According to researchers at the security firm Trend Micro, incidents of Zeus have risen steadily this year and peaked in May. And malicious links to it are now appearing on Facebook. Beware: it seems the "Russian Business Network" is back in, well, business.]]>
"It was my world, but it was a very limited world. You can see and hear it, but you can't touch the internet. It's a world devoid of empathy - and that shows on Twitter, and the mob mentality against politicians and public figures. There is no empathy.
"So it was my world, and it was a very cynical world and I became a very cynical person." Davis was, and is, witty and insightful. He has to serve 12 months in a youth offenders' facility; let's hope it passes quickly.]]>
Say you’re a cyberspy for the NSA and you want sensitive inside information on companies in South Africa. What do you do?
Search for confidential Excel spreadsheets the company inadvertently posted online by typing “filetype:xls site:za confidential” into Google, the book notes.
Want to find spreadsheets full of passwords in Russia? Type “filetype:xls site:ru login.” Even on websites written in non-English languages the terms “login,” “userid,” and “password” are generally written in English, the authors helpfully point out. And plenty more, err, helpful advice. (Thanks @ClarkeViper for the link.)]]>
At this point the editorial staff began publishing articles inspired by the attack. The second article, Syrian Electronic Army Has A Little Fun Before Inevitable Upcoming Deaths At Hands Of Rebels, angered the attacker who then began posting editorial emails on their Twitter account. Once we discovered this, we decided that we could not know for sure which accounts had been compromised and forced a password reset on every staff member’s Google Apps account. ]]>
In a 16-page complaint filed with the FTC, we argue that the major wireless carriers have engaged in “unfair and deceptive business practices” by failing to warn their customers about known, unpatched security flaws in the mobile devices sold by the companies. ]]>
I hope that's not the case, because 2FA adds real value if you use it as a matter of routine, not if you use it only in special cases.
Sure, you can argue that an oft-used and cherished laptop is less likely to get you into trouble with a keylogger than, say, a PC in an internet cafe or a kiosk at the airport.
But if you care about security, you won't read your email, personal or business, on kiosks or in internet cafes at all.
And if you genuinely cherish that oft-used laptop, and your oft-used accounts, you'll want only the best levels of security every time you use them.]]>
Previously, after providing a victim’s Apple ID and date of birth, an attacker could send a URL to Apple that would change the password for that account, without needing to answer any security questions. In response, Apple blocked access to the password reset page, and a short while later took the entire site down in light of another loophole that still allowed the attack to be performed.
This vulnerability came at an interesting time, just a day after Apple began to roll out its two-step verification system. Users who had already enrolled in the new system seem to have been immune from the password reset vulnerability.
Unfortunately some users were held in a three-day waiting period for enabling two-step verification, while others live in countries where two-step verification is not currently available. About six hours from publicity to fix (though there's no way of knowing how long it might have been exploited before that (although the page which detailed it was dated 22 March, the same day. Basically, it shows how risky GET is in URLs used for logins.]]>
The team froze phones for an hour as a way to get around the encryption system that protects the data on a phone by scrambling it.
Google introduced the data scrambling system with the version of Android known as Ice Cream Sandwich.
The attack allowed the researchers to get at contact lists, browsing histories and photos. There's something delicious about using a freezer to attack Ice Cream Sandwich. (Thanks @challengingviews for the link.)]]>
There - we've said it, do you feel better?
Industry protagonists, commentators, analysts, evangelists and (god forbid) even bloggers cum technical journalists (scum of the Earth of course) have been advocating the wider "robustness" (cringes at industry marketing-speak term) of Linux and open platforms for a long time now.
Let's look at the facts... And carry on to the next one..]]>
…this attack is of limited value. That's one of the reasons why I've disclosed it.
Making a call relies on the phone having a direct dial widget on the home screen.
Running the apps is also of limited use - they go into the background immediately. If the app performs an action on launch (like recording from the microphone, switching on the flash, playing music, interacting with a server) that action will occur. Also tested by us on a Samsung Galaxy S3; it's real. The home screen is there, but you have to be very quick to hit the home screen before the lock screen is reasserted. This seems to arise from Samsung's TouchWiz tweak of having "In Case of Emergency" (ICE) contacts; stock Android doesn't offer that.]]>
In our security investigation, we have found no evidence that any of the content you store in Evernote was accessed, changed or lost. We also have no evidence that any payment information for Evernote Premium or Evernote Business customers was accessed.
The investigation has shown, however, that the individual(s) responsible were able to gain access to Evernote user information, which includes usernames, email addresses associated with Evernote accounts and encrypted passwords. Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.)
While our password encryption measures are robust, we are taking additional steps to ensure that your personal data remains secure. Evernote? Why?]]>
The lock screen bug does in fact exist, and it works as advertised, bypassing the lock and bringing you to a blank black screen with just the status bar. But it allows you no access to anything, not pictures, not contacts and certainly not the file system. Two ways to bypass the lock screen? ]]>
The protocol, abbreviated UPnP, lets computers, printers, and other devices make themselves easily discoverable to a network router. But new research by the security firm Rapid7 shows that it could also let hackers easily discover and exploit those routers, too. And the problem is “universal,” indeed: A wide-ranging scan of the Internet show that it affects as many as 50 million unique devices. Rapid7 has released a scanning tool (Windows only, so far) to let you find out whether your devices are vulnerable.]]>
I don't mean to pick on Prezi; it's just an example. How many other of these Trojan horses are hiding in commonly used cloud provider agreements: both from providers that companies decide to use as a matter of policy, and providers that company employees use in violation of policy, for reasons of convenience? (Thanks @rquick for the link.)]]>
This is a nearly complete reversal from just five years ago…
Another strong indicator of iOS security is that digital forensics firms, those who produce the software used by law enforcement to recover data from mobile phones and computers, are as yet unable to crack data protected by the highest level of iOS encryption enabled by default (for email and participating apps) when you set a good passcode. He reckons Apple security generally is better now than at any time he's been examining it.]]>
The latter problem, described by the telco as a "customer convenience", can be exploited using just a property's postcode and phone number to cause mischief and inconvenience.
However, the other flaw, which revealed the full name of the landline account holder, has been fixed. Ouch.]]>
As a precaution, the MoD has been forced to reset the user names and passwords of some RAF staff on its internal system. Moral: don't pin usernames and passwords to the wall. ]]>