Air passengers entering or leaving the European Union will have their movements kept on file by police authorities from 2018 under draft legislation approved by the European Parliament.Critics, however, say a lack of provisions to share the data severely limits the plan's usefulness.Airlines running flights into or out of the EU must hand over the data to national Passenger Information Units (PIUs) that will hold the data for law enforcers. Member states may choose to gather data from travel agencies and to retain information about passengers on flights within the EU too.However, there will be no centralized EU database of arriving and departing passengers, and no automatic sharing of data between the various national PIUs. With open land borders between countries in the Schengen Area, and no mandatory collection of information on intra-EU flights, it will be difficult for investigators to use the data to determine whether a person of interest is in the EU.To read this article in full or to leave a comment, please click here
The first draft of long awaited federal encryption legislation that would govern to what lengths vendors and service providers have to go in order to comply with court decryption orders has finally been released.It takes a stab at defining how to give law enforcement the authority to access encrypted information and under what circumstances that is OK. It also tells vendors and service providers to what lengths they would have to go to help out.The proposal has not been filed formally as a bill in Congress, but its release will generate discussion.To read this article in full or to leave a comment, please click here
Blockchain technology backs up Bitcoin to this day, but there’s been a recent groundswell of interest from a variety of industries in making distributed ledger technology work.A blockchain is the structure of data that represents a financial ledger entry, or a record of a transaction. Each transaction is digitally signed to ensure its authenticity and that no one tampers with it, so the ledger itself and the existing transactions within it are assumed to be of high integrity.The real magic comes, however, from these digital ledger entries being distributed among a deployment or infrastructure. These additional nodes and layers in the infrastructure serve the purpose of providing a consensus about the state of a transaction at any given second; they all have copies of the existing authenticated ledger distributed amongst them.To read this article in full or to leave a comment, please click here
Alongside its batch of mandatory security patches released Tuesday, Microsoft also issued an optional update aimed at protecting Windows computers against an attack that could hijack wireless mice to execute malicious commands.The attack, dubbed MouseJack, affects wireless mice and keyboards from many manufacturers, including Microsoft. It was discovered and presented earlier this year by security researchers from IoT security firm Bastille Networks.MouseJack exploits several vulnerabilities in the communications protocols between the USB dongles plugged into computers and the wireless mice and keyboards that are paired with them. These flaws allow attackers to spoof a wireless mouse from up to 100 meters away and send rogue keystrokes instead of clicks to a computer.To read this article in full or to leave a comment, please click here
The first proposed federal encryption legislation has been released, and had it been established law earlier this year Apple would have had to provide the help the FBI asked for in accessing encrypted data on the iPhone used by a terrorist in San Bernardino.The draft published by Sen. Richard Burr of North Carolina and Sen. Dianne Feinstein of California calls for encryption vendors and others to obey court orders that command them to deliver intelligible versions of encrypted data or to provide technical assistance to make it intelligible.To read this article in full or to leave a comment, please click here
The burden of Microsoft's efforts to secure Windows 10 is now falling on PC, tablet, and smartphone makers.
Microsoft is making a hardware-based security feature called TPM (Trusted Platform Module) 2.0 a minimum requirement on most Windows 10 devices. Starting July 28, the company will require device manufacturers shipping PCs, tablets and smartphones to include TPM 2.0.
TPM has been available for years, mostly on business PCs. TPM 2.0 provides a hardware layer to safeguard user data by managing and storing cryptographic keys in a trusted container.
The TPM requirement "will be enforced through our Windows Hardware Certification program," Microsoft said in a blog post.To read this article in full or to leave a comment, please click here
The FBI reportedly paid professional hackers a one-time fee for a previously unknown vulnerability that allowed the agency to unlock the iPhone of San Bernardino shooter.The exploit allowed the FBI to build a device capable of brute-forcing the iPhone's PIN without triggering a security measure that would have wiped all of its data, the Washington Post reported Tuesday, citing unnamed sources familiar with the matter.The hackers who provided the exploit to the FBI find software vulnerabilities and sometimes sell them to the U.S. government, the newspaper reported.To read this article in full or to leave a comment, please click here
The Internal Revenue Service said today with the approaching tax filing April 18th deadline scammers are becoming even more desperate that ever to steal your money and identity.The IRS said there has been a 400% surge in phishing and malware incidents in this tax season alone and that scam artists are more frequently masquerade as being from the IRS, a tax company and sometimes even a state revenue department.+More on Network World: IRS warns of nasty W-2 phishing scheme+To read this article in full or to leave a comment, please click here
In this edition of the Irari Report, Ira Winkler and Araceli Treu Gomes continue their interview of Chris Inglis, former Deputy Director of NSA. In this segment, they focus on how an organization that is so aware of the insider threat can be compromised by a person like Edward Snowden.
Inglis highlights how trust is critical to function, but verification must be implemented. This relies upon a stringent screening process, as you have to extend to trust to the people you hire. While Snowden was one traitor among 250,000, the damage one person can cause is clear, and it must be accepted as an eventuality.
Watch the first part of this series.To read this article in full or to leave a comment, please click here
A U.S. House of Representatives committee has advanced a bill to give email and cloud-stored data new privacy protections from law enforcement searches.
The House Judiciary Committee on Wednesday voted 28-0 to approve an amended version of the Email Privacy Act, which would require law enforcement agencies to get court-ordered warrants to search email and other cloud-stored data that's more than six months old.
Some privacy advocates and tech companies have been pushing Congress to update a 30-year-old law called the Electronic Communications Privacy Act (ECPA) for the last six years.To read this article in full or to leave a comment, please click here
Microsoft and the Samba project fixed a vulnerability in their implementation of the SMB/CIFS protocol after the flaw was initially announced three weeks ago under the name Badlock.
The vulnerability, covered by Microsoft in its MS16-047 security bulletin published Tuesday, was also fixed in Samba 4.4.2, 4.3.8 and 4.2.11. It could allow a man-in-the-middle attacker to impersonate an authenticated user and execute arbitrary network calls to the server, possibly with administrative privileges.
Badlock's existence was announced on March 22 by a company called SerNet, which offers Samba consulting, support and development services. It employs the person who found the flaw: a Samba development team member named Stefan Metzmacher.To read this article in full or to leave a comment, please click here
PowerShell used as a tool in compound malware attacks is becoming more common, with 38% of all attacks seen by IT security vendor CarbonBlack and its partners involving the native Windows scripting language.
Ben Johnson
Its use is so common in enterprises for legitimate purposes that most security devices and personnel don’t regard it as a threat, says Ben Johnson, the chief security strategist at CarbonBlack.That makes it all the more effective as a component of attacks. Its scripts can run in memory only so it never creates a file on disk, Johnson says. “It creates less noise on the system,” so it’s less likely to draw attention to itself, he adds.To read this article in full or to leave a comment, please click here
Got privacy? You may think you do, but a recent experiment by a Russian photographer suggests otherwise.In a project entitled, "Your face is big data," Rodchenko Art School student Egor Tsvetkov began by photographing about 100 people who happened to sit across from him on the subway at some point. He then used FindFace, a facial-recognition app that taps neural-network technology, to try to track them down on Russian social media site VK.It was ridiculously easy to find 60 to 70 percent of the subjects aged between 18 and 35 or so, he found, although for older people it was more difficult.To read this article in full or to leave a comment, please click here
The FBI today said it was offering a reward of up to $25,000 for information leading to the recovery of seven Andy Warhol paintings stolen from the Springfield Art Museum in Springfield, Missouri.+More on Network World: Want a meteorite? Christie’s set to auction unique space rocks+The collection, which has been owned by the Springfield Art Museum since 1985, is set number 31 of the Campbell’s Soup I collection and is valued at approximately $500,000. Each painting in the screen print collection measures 37 inches high by 24.5 inches wide and framed in white frames, the FBI stated. The FBI says that seven of 10 Andy Warhol paintings Campbell’s Soup I collection, made in 1968, were taken.To read this article in full or to leave a comment, please click here
For April 2016 Patch Tuesday, Microsoft released 13 security bulletins, with six being rated as critical for remote code execution flaws and the patch for Badlock being among those rated only as important.CriticalMS16-037 is the cumulative fix for Internet Explorer. While most of the vulnerabilities being patched have not been publicly disclosed, the DLL loading RCE bug has been.MS16-038 is the monthly cumulative security update for Microsoft’s Edge browser to stop attackers from achieving RCE when a user visits a specially crafted webpage via Edge. The patch modifies how Edge handles objects in memory, as well as ensures cross-domain policies are properly enforced.To read this article in full or to leave a comment, please click here
Countries around the world from Estonian and Ukraine to China, Russia, and the US have been the target of DDoS attacks, many of which are politically motivated. Criminals aren't necessarily looking to steal data or other assets as much as they are intending to make a very powerful statement.According to Nexusguard’s Q4 2015 threat report, attacks on Turkey skyrocketed ten-fold to more than 30,000 events per day, surpassing the thousands of attacks on other popular targets like China and the U.S. The attacks, targeting Turkish IP addresses, contributed to a big increase in DNS attacks, outweighing other popular NTP and CHARGEN methods by 183 percent.To read this article in full or to leave a comment, please click here
Verizon Ventures says that while consumer Internet of Things startups were all the rage in 2014 and continue to be popular among investors, enterprise IoT newcomers have become even hotter properties among venture capitalists over the past two years, with enterprise IoT investment expected to double or triple that of consumer IoT in 2016.Verizon’s investment arm has been among those outfits targeting enterprise IoT, with investments in startups such as Filament and Veniam, which focus on industrial networks and connected vehicles, respectively.To read this article in full or to leave a comment, please click here
The U.S. Internal Revenue Service, the Congress, and private electronic tax-filing vendors aren't doing enough to protect the personal information of taxpayers, senators said Tuesday.The IRS needs to step up its cyberecurity efforts, said members of the Senate Finance Committee, citing two recent data breaches at the agency, along with 94 open cybersecurity recommendations from the Government Accountability Office."Hackers and crooks, including many working for foreign crime syndicates, are jumping at every opportunity they have to steal hard-earned money and sensitive personal data from U.S. taxpayers," Senator Ron Wyden, an Oregon Democrat, said during a hearing. "In my view, taxpayers have been failed by the agencies, the companies, and the policymakers here in Congress they rely on to protect them."To read this article in full or to leave a comment, please click here
Startup Seceon has joined a growing number of firms focused on quickly analyzing behaviors on corporate networks to identify and prioritize threats that ought to be dealt with, cutting down on the manual work required to spot and stop attacks.In addition to identifying intrusions, the company’s Open Threat Management (OTM) platform can also automatically block suspect behaviors using scripts to other devices on the network.The company competes against a number of others including Damballa, LightCyber and Vectra as well as vendors with broader portfolios such as Carbon Black, Black Ensilo, Fireeye, Guidance, Promisec, Resolution1 Security, and Tanium.To read this article in full or to leave a comment, please click here
Fifty-four zero-day vulnerabilities were discovered last year, according to a report released this morning by Symantec, more than double that of 2014, and the number of mega-breaches of more than 10 million records also hit a record high.In fact, the number of newly-discovered vulnerabilities stayed between eight and 15 a year since 2006, then jumped to 23 in 2013 and 24 in 2014, leading researchers to hope that it had reached a new plateau.Instead, last year's 125 percent increase in zero-days was a sign of the increasing professionalization of the industry.INSIDER: Traditional anti-virus is dead: Long live the new and improved AV
"People figured out that they could make money by finding zero-day vulnerabilities and selling them to attackers," said Kevin Haley, director of security response at Symantec. "So there became a marketplace, and these things started to have value, and people started to hunt for them."To read this article in full or to leave a comment, please click here