The same Russian state-sponsored hackers that allegedly breached the Democratic National Committee may have also targeted the World Anti-Doping Agency.On Tuesday, the sports drug-testing agency blamed a recent breach of its network on a Russian hacking group known as APT 28 or Fancy Bear.The hackers gained access to the agency’s database and stole information about athletes including confidential medical data. Some of that data has already been publicly released, and the hackers have threatened to release more, the agency said in a statement.To read this article in full or to leave a comment, please click here
Corporate mergers and acquisitions (M&A) can be fraught with risks related to financial matters, company culture, personnel, IT systems integration and other areas.Security risks, both cyber and physical, certainly belong on the list of concerns. And with the ongoing shortage of professionals who are expert in various aspects of data protection—coupled with the seemingly endless stream of reports about data breaches and other security threats—this has become an even bigger concern for companies that are considering or in the midst of M&A deals.“Any M&A activity involves an assumption of risk,” says Ariel Silverstone, vice president of security strategy, privacy and trust at GoDaddy, a provider of domain name registrations.To read this article in full or to leave a comment, please click here
Many would like to see famed whistleblower Edward Snowden face the music for releasing classified information from the NSA a few years back, but who knew his actions would wind up having an impact on the music world itself?A slew of Snowden-inspired songs emerged from the DIY set in the immediate wake of the leaks back in 2013. But 2016 is shaping up to be another big year with fresh material.The latest Snowden song comes courtesy of Peter Gabriel for the new Oliver Stone biopic featuring Joseph Gordon-Leveitt called "Snowden." Gabriel's song, "The Veil," plays during the end credits of the film, and basically tells the Snowden story, as the former Genesis band member sings about Snowden being a hero to some and a traitor to others.To read this article in full or to leave a comment, please click here
Microsoft released 14 security bulletins for September, seven of which are rated critical due to remote code execution flaws. Microsoft in all its wisdom didn’t regard all RCEs as critical. There’s also an “important rated” patch for a publicly disclosed flaw which Microsoft claims isn’t a zero-day being exploited. But at least a 10-year-old hole is finally being plugged.Next month marks a significant change as Microsoft says it intends roll out "servicing changes" that include bundled patches. Unless things change, not all Windows users will be able to pick and choose specific security updates starting in October.To read this article in full or to leave a comment, please click here
Smart door locks, padlocks, thermostats, refrigerators, wheelchairs and even solar panel arrays were among the internet-of-things devices that fell to hackers during the IoT Village held at the DEF CON security conference in August.A month after the conference ended, the results are in: 47 new vulnerabilities affecting 23 devices from 21 manufacturers were disclosed during the IoT security talks, workshops and onsite hacking contests.The types of vulnerabilities found ranged from poor design decisions like the use of plaintext and hard-coded passwords to coding flaws like buffer overflows and command injection.Door locks and padlocks from vendors like Quicklock, iBlulock, Plantraco, Ceomate, Elecycle, Vians, Lagute, Okidokeys, Danalock were found to be vulnerable to password sniffing and replay attacks, where a captured command can be replayed later to open the locks.To read this article in full or to leave a comment, please click here
Ransomware, where a hacker commandeers a user's computer files and threatens to permanently delete them unless an extortion payment is made, is on a sharp uptick and now ranks "among the most troubling cyberthreats," the head of the Federal Trade Commission is warning.[ Related: The history of ransomware ]FTC Chair Edith Ramirez addressed the issue at a recent forum that the agency convened to examine the spread of ransomware and explore strategies to combat the crime."The spate of ransomware incidents are escalating at an alarming rate," Ramirez says, citing an estimate from the Department of Justice that incidents of ransomware, now averaging some 4,000 a day, have increased 300 percent in the past year.To read this article in full or to leave a comment, please click here
A publicly disclosed vulnerability in the MySQL database could allow attackers to completely compromise some servers.The vulnerability affects "all MySQL servers in default configuration in all version branches (5.7, 5.6, and 5.5) including the latest versions," as well as the MySQL-derived databases MariaDB and Percona DB, according to Dawid Golunski, the researcher who found it.The flaw, tracked as CVE-2016-6662, can be exploited to modify the MySQL configuration file (my.cnf) and cause an attacker-controlled library to be executed with root privileges if the MySQL process is started with the mysqld_safe wrapper script.The exploit can be executed if the attacker has an authenticated connection to the MySQL service, which is common in shared hosting environments, or through an SQL injection flaw, a common type of vulnerability in websites.To read this article in full or to leave a comment, please click here
To say the National Security Agency (NSA) prefers to lay low and shuns the limelight is an understatement. One joke said about the secretive group, widely regarded as the most skilled state-sponsored hackers in the world, is NSA actually stands for “No Such Agency.”But now a recent leak has put the group right where it loathes to be—squarely in the headlines. Last month, a group called “The Shadow Brokers” published what it claimed were a set of NSA “cyber weapons,” a combination of exploits, both zero day and long past, designed to target routers and firewalls from American manufacturers, including Cisco, Juniper and Fortinet.To read this article in full or to leave a comment, please click here
In somewhat of a kick in the teeth for law enforcement and spy agencies, a science institute says smartphones will soon be able to take advantage of some of the most spectacular encryption ever known.The Institute of Photonic Sciences (ICFO) says random number generators (RNGs) will soon be able to function without ever repeating the random number and that the quantum-based chips will soon be small enough to fit in a smartphone’s form factor. It would create the fastest and smallest encryption functionality ever.+ Also on Network World: Why smartphone encryption has law enforcement feathers ruffled +To read this article in full or to leave a comment, please click here
Thousands of publicly accessible FTP servers, including many from Seagate network-attached storage devices, are being used by criminals to host cryptocurrency mining malware.Researchers from security vendor Sophos made the discovery when they investigated a malicious program dubbed Mal/Miner-C, which infects Windows computers and hijacks their CPUs and GPUs to generate Monero, a bitcoin-inspired cryptocurrency.With most cryptocurrencies, users can generate new units by devoting their computing resources to solving complex math problems needed to validate transactions in the network. This process, known as "mining," provides an incentive for attackers to hijack other people's computers and use them for their own gain.To read this article in full or to leave a comment, please click here
Economical and flexibleOpen source software offers an economical and flexible option for deploying basic home, SMB or even enterprise networking. These open source products deliver simple routing and networking features, plus they are combined with security functionality, starting with a basic firewall and possibly including antivirus, antispam and Web filtering. These products can be downloaded and deployed on your own hardware, on a virtual platform, or in the cloud. Many of them sell pre-configured appliances as well. We reviewed five products: ClearOS, DD-WRT, pfSense, Untangle and ZeroShell. We found that ClearOS, pfSense, and Untangle could be appropriate for home use all the way up to the enterprise environment.To read this article in full or to leave a comment, please click here
Open source software offers an economical and flexible option for deploying basic home, SMB or even enterprise networking. These open source products deliver simple routing and networking features, like DHCP and DNS. Plus, they are combined with security functionality, starting with a basic firewall and possibly including antivirus, antispam and Web filtering.These products can be downloaded and deployed on your own hardware, on a virtual platform, or in the cloud. Many of them sell pre-configured appliances as well if you like their feature-set or support, but don’t want to build your own machine.We reviewed five products: ClearOS, DD-WRT, pfSense, Untangle and ZeroShell. We found that ClearOS, pfSense, and Untangle could be appropriate for home use all the way up to the enterprise environment.To read this article in full or to leave a comment, please click here(Insider Story)
Economical and flexibleOpen source software offers an economical and flexible option for deploying basic home, SMB or even enterprise networking. These open source products deliver simple routing and networking features, plus they are combined with security functionality, starting with a basic firewall and possibly including antivirus, antispam and Web filtering. These products can be downloaded and deployed on your own hardware, on a virtual platform, or in the cloud. Many of them sell pre-configured appliances as well. We reviewed five products: ClearOS, DD-WRT, pfSense, Untangle and ZeroShell. We found that ClearOS, pfSense, and Untangle could be appropriate for home use all the way up to the enterprise environment.To read this article in full or to leave a comment, please click here
After security journalist Brian Krebs exposed the DDoS-for-hire service, vDOS, and the alleged owners of the service were arrested, a massive attack was launched against the Krebs on Security site.Last Thursday, Krebs wrote about vDOS and the two 18-year-old Israeli hackers running the DDoS attack service. In the past two years, the duo launched over 150,000 attacks and made at least $618,000. vDOS had been hacked and Krebs had obtained a copy of the vDOS database.vDOS had paying subscribers with the cost depending upon how many seconds the DDoS attack lasted. Krebs reported, “In just four months between April and July 2016, vDOS was responsible for launching more than 277 million seconds of attack time, or approximately 8.81 years’ worth of attack traffic.”To read this article in full or to leave a comment, please click here
A tough-to-detect malware that attacks government and corporate computers has been upgraded, making it more aggressive in its mission to steal sensitive files, according to security firm InfoArmor.Last November, InfoArmor published details on GovRAT, a sophisticated piece of malware that’s designed to bypass antivirus tools. It does this by using stolen digital certificates to avoid detection.Through GovRAT, hackers can potentially steal files from a victim’s computer, remotely execute commands, or upload other malware to the system.To read this article in full or to leave a comment, please click here
Texas-born Christian Hascheck teaches computer science in Vienna, Austria when not working on his own projects, which include a novel grading system. In 2012, he won $500 worth of Apple gift cards for a funny sysadmin story about ferreting out a not terribly sophisticated rogue Wi-Fi operation.Then the move aboard. He tells the story on his blog:
Since then I have repeatedly tried to use or sell (the cards) but since I'm not currently living in the US it wasn't possible for me.My last attempt to sell them was via reddit. I know there are a lot of scammers out there, so I thought Bitcoin would be the right choice since the scammer can't just reclaim their money after I gave them the card codes.To read this article in full or to leave a comment, please click here
The Department of Energy says the $40 million it is investing in nearly two dozen multi-year projects will result in exascale computing systems that perform calculations on data 50 to 100 times faster than today's most powerful supercomputers.The DoE Exascale Computing Project says such high-performance computing systems can make at least a billion billion calculations per second, and will be used to process data for applications such as energy security, economic security, scientific discovery, healthcare and climate/environmental science. The U.S. is shooting to attain such powerful systems by the mid-2020s and China is aiming for 2020.To read this article in full or to leave a comment, please click here
The U.K. government has published a report on the staggering scale of surveillance in the country last year.The report, compiled by the Interception of Communications Commissioner's Office (IOCCO), covers the surveillance activities of the U.K.'s three main intelligence agencies (MI5, the Secret Intelligence Service, and GCHQ, the Government Communications Headquarters), the tax authority, and a number of police forces.It shows that warrants for the interception of communications rose 9 percent and that authorities continue to collect communications metadata -- information about who called or connected to whom, when, how often -- with abandon. To read this article in full or to leave a comment, please click here
The Xen Project has fixed four vulnerabilities in its widely used virtualization software, two of which could allow malicious virtual machine administrators to take over host servers.Flaws that break the isolation layer between virtual machines are the most serious kind for a hypervisor like Xen, which allows users to run multiple VMs on the same underlying hardware in a secure manner.The Xen hypervisor is widely used by cloud computing providers and virtual private server hosting companies like Linode, which had to reboot some of its servers over the past few days to apply the new patches.To read this article in full or to leave a comment, please click here