As tax identity theft and fraud continue to spiral upwards, the IRS and key industry players are trying to develop new technolgies and techniques to slow the swindle juggernaught down.The IRS this week updated the community about what work has been done by its collarborative group of chief executive officers and private sector firms such as H&R Block and Intuit since March when it formed the group to bolster protections against identity theft refund fraud for the 2016 tax season.To read this article in full or to leave a comment, please click here
Well that was crazy fast.A browser-based version of Popcorn Time, which is often referred to as a 'Netflix for pirates,' was recently launched and picking up steam. BrowserPopcorn was created by a 15-year-old and didn't require anything to be downloaded or for users to login before streaming movies or TV shows. If you had visited browserpopcorn.xyz this morning to partake in an illegal movie streaming fest, you would have seen this: BrowserPopcorn
But now you see this:To read this article in full or to leave a comment, please click here
Google's plan to encrypt user data on Android devices by default will get a new push with Android 6.0, also known as Marshmallow.The company requires Android devices capable of decent cryptographic performance to have full-disk encryption enabled in order to be declared compatible with the latest version of the mobile OS.Google's first attempt to make default full-disk encryption mandatory for phone manufacturers was with Android 5.0 (Lollipop), but it had to abandon that plan because of performance issues on some devices.To read this article in full or to leave a comment, please click here
The Irish Data Protection Commissioner has agreed to investigate allegations that Facebook exposes its users' personal data to mass snooping by U.S. intelligence services, following a ruling of the High Court of Ireland on Tuesday.Austrian Facebook user Maximilian Schrems filed a complaint with the DPC in 2013, in the wake of Edward Snowden's revelations about the U.S. National Security Agency's PRISM surveillance system.The DPC initially dismissed the complaint as "frivolous," a decision Schrems went on to challenge in the Irish high court.To read this article in full or to leave a comment, please click here
In the 1960s and 70s, technically savvy enthusiasts sought to game telecommunications systems to make free calls, keeping telecom engineers on their toes.That practice, known as phreaking, involved such luminaries as Steve Jobs, Steve Wozniak and John Draper, known as Cap'n Crunch, who used a whistle from a cereal box to meddle with AT&T's long-distance trunk lines.These days, mobile operators have fully embraced the Internet and are increasingly moving voice calls over fast, packet-switched networks, known as Voice over LTE (Long Term Evolution). The advantage is higher-quality voice calls for subscribers and lower costs for operators.To read this article in full or to leave a comment, please click here
Cyber insurance premiums could prove a big driver of Internet of Things standards.
Machine-to-machine communication has grown up in separate silos for every industry, but as it expands in the coming years as part of the broader Internet of Things wave, standards could save a lot of cost and effort, speakers at a networking conference said Monday.
Having a common approach that works can save IoT vendors from having to reinvent the wheel, said Jim Zerbe, head of IoT product at Neustar, a real-time information services and analytics company.
Security is one place that's needed, he said. For a long time, machine-to-machine security has relied on industry-specific technologies and "security through obscurity," resulting in easily hackable systems. Standard, open technologies across industries can attract armies of developers to build strong defenses.To read this article in full or to leave a comment, please click here
It’s actually possible for entities with vast computing resources – such as the NSA and major national governments - to compromise commonly used Diffie-Hellman key exchange groups, so it’s time for businesses to switch to something else like elliptic curve cryptography, researchers say.“It’s been recommended to move from 1024-bit [encryption] for a long time, and now there are very concrete risks of not doing that,” says Nadia Heninger, an assistant professor of computer and information science at the University of Pennsylvania who is an author of a paper titled “Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice”.To read this article in full or to leave a comment, please click here
Security researchers have discovered a fiendish form of browser malware that stands in for your copy of Google Chrome and hopes you won’t notice the difference.As reported by PCRisk, the “eFast Browser” works by installing and running itself in place of Chrome. It’s based on Google’s Chromium open-source software, so it maintains the look and feel of Chrome at first glance, but its behavior is much worse.First, makes itself the default and takes over several system file associations, including HTML, JPG, PDF, and GIF, according to MalwareBytes. It also hijacks URL associations such as HTTP, HTTPS, and MAILTO, and replaces any Chrome desktop website shortcuts with its own versions. Essentially, eFast Browser makes sure to open itself at any opportunity.To read this article in full or to leave a comment, please click here
Back in September, Brian Krebs reported on a confidential Verizon security assessment of Target’s network done shortly after the company was breached in 2013; Verizon consultants found Target was using weak or default passwords, had failed to deploy critical security patches, were running outdated services and other basic security problems. Target is having trouble again, but this time it’s with pranksters “exploiting holes” in Target’s PA system. It could have been done as an early Halloween prank, except this wasn’t the first time X-rated audio has blasted from a Target store’s PA system.To read this article in full or to leave a comment, please click here
European data protection authorities have given the European Commission and national governments three months to come up with an alternative to the Safe Harbor agreement swept away two weeks ago by a ruling of the Court of Justice of the European Union.But any new agreement must protect the personal data of European citizens from massive and indiscriminate surveillance, which is incompatible with EU law, the data protection authorities making up the Article 29 Working Party said late Friday.Since the CJEU ruled on Oct. 6 that the Safe Harbor agreement between the Commission and U.S. authorities did not offer necessary legal guarantees, businesses that relied on it for the transfer of their customers' or employees' private personal information from the EU to the U.S. have been doing so in something of a legal vacuum.To read this article in full or to leave a comment, please click here
Chinese hackers have gone after seven U.S. tech and pharmaceutical companies since the presidents of both countries agreed not to knowingly carry out corporate espionage, according to security firm CrowdStrike.The company says in a blog post that it has identified a known hacking group in China as intruding into the seven U.S. companies starting the day after Presidents Xi and Obama announced the pact.“It is important to note that this is not an exhaustive list of all the intrusions from Chinese-government affiliated actors we have detected during this time period; it is limited only to commercial entities that fit squarely within the hacking prohibitions covered under the Cyber agreement,” says CrowStrike CTO Dmitri Alperovitch.To read this article in full or to leave a comment, please click here
While last week’s Dell/EMC merger was certainly a blockbuster, nothing specific was mentioned about future plans for RSA Security. Michael Dell did say that there were a “number of discussions about security” during the negotiations but apparently, no concrete plans. Infosec reporters have lobbed phone calls into Round Rock Texas as well as Bedford and Hopkinton, MA looking for more details but Dell and EMC officials haven’t responded.Based upon a week of vague retorts, it’s safe to assume that there is no master plan for RSA at this time. While we in the cybersecurity world have a nostalgic bond with RSA, it really is small potatoes as part of this mega-deal in the IT space. Nevertheless, RSA is marquis $1b+ brand named company in the red hot cybersecurity space so there is certainly value to be had.To read this article in full or to leave a comment, please click here
Adobe released a patch for a critical vulnerability in Flash Player faster than it originally anticipated in response to high-profile cyberespionage attacks against governmental targets.The latest Flash Player updates released Friday address a flaw that's already exploited by a Russian espionage group known as Pawn Storm, as well as two other critical vulnerabilities reported privately to Adobe.The CVE-2015-7645 vulnerability is actively exploited by the Pawn Storm group in attacks targeting several foreign affairs ministries from around the globe, security researchers from Trend Micro reported Tuesday.To read this article in full or to leave a comment, please click here
New products of the weekOur roundup of intriguing new products. Read how to submit an entry to Network World's products of the week slideshow.Attunity CloudBeamKey features: Attunity’s cloud data transfer solution now transfers data between enterprise data centers and Hadoop running on the AWS Cloud, enabling companies to leverage Big Data analytics with Amazon Elastic Map Reduce (EMR). More info.To read this article in full or to leave a comment, please click here
How does a company operationalize its risk and security programs? More specifically, with all of the talk about big data, how does a company operationalize its threat intelligence process?
Many companies think they know what the keys are to their kingdom and where the entry points are located. Unfortunately, they soon find out that the most serious breaches often take place somewhere else.
+ ALSO ON NETWORK WORLD: 5 tips for better enterprise security +To read this article in full or to leave a comment, please click here(Insider Story)
Some websites running the e-commerce platform Magento appear to have been infected with code that directs victims to the Neutrino exploit kit.
It's not exactly clear how the Magento sites were infected, wrote Denis Sinegubko, a senior malware researcher with Sucuri, a Delware-based security company.
"At this point, we can suspect that it was some vulnerability in Magento or one of the third-party extensions that allowed it to infect thousands of sites within a short time," he wrote.
The Magento sites are rigged to pull content into an iframe from a domain which has been blacklisted by Google, Sinegubko wrote.To read this article in full or to leave a comment, please click here
Facebook will now warn people if it has a strong suspicion an account is being targeted by a nation-state.
The social networking service already takes steps to secure accounts that may have been compromised but has decided to directly alert users of the type of attack that's under way, wrote Alex Stamos, Facebook's chief security officer.
Since state-sponsored attacks can be more sophisticated "having an account compromised in this manner may indicate that your computer or mobile device has been infected with malware," he wrote.To read this article in full or to leave a comment, please click here
The Computer Emergency Response Team (CERT) at Carnegie Mellon University posted a vulnerability note about multiple vulnerabilities in voice over LTE implementations that could potentially compromise the security and privacy of Android users on LTE networks of major U.S. wireless carriers. All Android versions—reportedly even Marshmallow, Google’s newest Android 6.0 – are vulnerable when being used on Verizon Wireless and AT&T; T-Mobile claimed to have “resolved” the issue.To read this article in full or to leave a comment, please click here
The Computer Emergency Response Team (CERT) at Carnegie Mellon University posted a vulnerability note about multiple vulnerabilities in voice-over-LTE implementations that could potentially compromise the security and privacy of Android users on LTE networks of major U.S. wireless carriers. All Android versions—reportedly even Marshmallow, Google’s newest Android 6.0 – are vulnerable when being used on Verizon Wireless and AT&T; T-Mobile claimed to have “resolved” the issue.To read this article in full or to leave a comment, please click here
Car owners could face more danger from hackers if a draft bill (pdf) by the House Energy and Commerce Committee (HECC) becomes law. The law would make independent oversight of the electronic safety of motor vehicles a crime subjecting well intentioned security researchers to a $100,000 fine per instance. Today’s cars have 200 – 400 microcontrollers and microprocessors in them making the access of each an individual offense subject to fines that could add up to millions.The security flaws of the Jeep Grand Cherokee were exposed this summer by security researchers Charlie Miller and Chris Valasek who were able to shut down the vehicle during operation by cracking the Wi-Fi password. The risks of huge fines would stop researchers from exposing critical motor vehicle vulnerabilities but it would not stop hackers with malicious intentions from invading vehicle control systems.To read this article in full or to leave a comment, please click here