The online advertising industry is marshaling a fresh effort to fight click fraud, which steals money from advertisers and undermines faith in online campaigns.The latest effort is focused on automated traffic caused by bots from within data centers that is intended to trigger ad impressions, according to the Trustworthy Accountability Group (TAG), an industry body.TAG is going to initially use a blacklist maintained by Google that lists suspicious IP addresses of computers in data centers that may be trying to replicate human clicks on advertisements. Ad-focused technology companies, including Facebook and Yahoo, will also contribute.To read this article in full or to leave a comment, please click here
A New York judge ruled Tuesday that Facebook has no legal standing to challenge the constitutionality of search warrants served on its users, highlighting the limits to online companies’ abilities to protect user privacy.Last year, Facebook appealed a court decision requiring it to hand over data, including photos and private messages, relating to 381 user accounts. The data was sought as part of an investigation by the New York County District Attorney’s office into a disability fraud case.Other companies including Google and Microsoft filed briefs supporting Facebook’s move, as well as the American Civil Liberties Union.To read this article in full or to leave a comment, please click here
U.S law enforcement officials have arrested five individuals who reportedly were involved in the high-profile 2014 computer hacking of JPMorgan.Three of the individuals were arrested for stock manipulation while the other two were arrested for running an illegal Bitcoin exchange, according to the FBI.To read this article in full or to leave a comment, please click here
Many people criticize the federal government for myriad problems, but there is at least one program in recent years that has been a success – the use of competitions or crowdsourcing to address sometimes complex problems. And because of those accomplishments you can expect many more such contests in the future.+More on Network World: DARPA’s $4M cyber-threat clash down to seven challengers+The White House Office of Science and Technology notes that in January 2015 the government will celebrate the fifth anniversary of the America Competes Act which in combination with Challenge.gov has prompted more than 400 public-sector prize competitions which have doled out some $72 million in prizes. Some agencies like NASA and the Defense Advanced Research Projects Agency as well as private entities like the X Prize Foundation have used competitions to address high-tech challenges for years with great success.To read this article in full or to leave a comment, please click here
Cars will have to be much better protected against hacking and new privacy standards will govern data collected from vehicles under proposed legislation introduced in the U.S. Senate on Tuesday.The Security and Privacy in Your Car Act of 2015 seeks to get a step ahead of what is seen by some as one of the next fronts in hacking: connected vehicles, which are always on the Internet and rely on sophisticated computer control systems.Proposed by Senators Edward J. Markey, a Democrat from Massachusetts, and Richard Blumenthal, a Democrat from Connecticut, the act would mandate that critical software systems in cars be isolated and the entire vehicle be safeguarded against hacking by using “reasonable measures.” The proposed bill doesn’t define those measures.To read this article in full or to leave a comment, please click here
Italian surveillance software maker Hacking Team recently claimed that it hasn’t lost any customers after the massive leak of its internal data two weeks ago. But it has lost at least one business partner: U.S.-based penetration testing specialist and zero-day exploit broker Netragard.Over the weekend, Netragard announced that it is terminating its long-time running Exploit Acquisition Program (EAP), citing revelations about Hacking Team’s customers as one of the reasons.Set up in 1999, EAP allowed Netragard to broker the sale of exploits for unpatched vulnerabilities—also known as zero-day exploits—between private researchers and select organizations interested in such computer intrusion tools.To read this article in full or to leave a comment, please click here
A hacker duo pretty much just made the case for going old school and steering clear of “smart” and “connected” vehicles as they remotely attacked one. Charlie Miller and Chris Valasek revealed 20 of the “most hackable” vehicles last year, but this year at Black Hat they will blow people’s mind when they present “Remote Exploitation of an Unaltered Passenger Vehicle.”It’s not the first remote hack; when DARPA’s Dan Kaufman remotely hacked a car for 60 Minutes, he triggered the windshield wipers, blasted the car’s horn and then disabled the brakes. That and a report (pdf) claiming that nearly all new cars can be hacked led to a lawsuit against GM, Ford and Toyota for "dangerous defects in their hackable cars."To read this article in full or to leave a comment, please click here
One brave Wired journalist agreed to drive a Jeep on a St. Louis highway while two hackers hacked it remotely, taking control of everything from the air conditioning to the transmission.The entire ordeal was captured on video, which you can view with the article at Wired. The hackers, Charlie Miller and Chris Valasek, had just two years earlier performed a similar hack while the same journalist drove a car slowly in a parking lot. The bigger difference that time was that the hack was performed through a laptop that was hardwired to the car's onboard diagnostic port, and which the hackers controlled from the backseat. In that case, they limited their exploits to toying with the seatbelt and honking the horn.To read this article in full or to leave a comment, please click here
One brave Wired journalist agreed to drive a Jeep on a St. Louis highway while two hackers hacked it remotely, taking control of everything from the air conditioning to the transmission.
The entire ordeal was captured on video, which you can view with the article at Wired.
The hackers, Charlie Miller and Chris Valasek, had just two years earlier performed a similar hack while the same journalist drove a car slowly in a parking lot. The bigger difference that time was that the hack was performed through a laptop that was hardwired to the car's onboard diagnostic port, and which the hackers controlled from the backseat. In that case, they limited their exploits to toying with the seatbelt and honking the horn.To read this article in full or to leave a comment, please click here
If you're familiar with Gigamon, you likely know them as the market-leading vendor in the emerging "visibility fabric" space. The company's products provide businesses with pervasive and intelligent network data across physical and virtual environments. The GigaVUE portfolio delivers the appropriate network traffic to management tools and platforms. I've often said that "you can't manage what you can't see," and Gigamon provides the necessary visibility data so organizations can improve the management of their IT infrastructure.However, Gigamon's information can also be used to help businesses improve their security posture. If you can't manage what you can't see, then it stands to reason that you can't secure what you can't see. One of the challenges with traditional security approaches is that it primarily focuses on preventing breaches, but once the perimeter has been penetrated, there's no way to detect it or remediate against it.To read this article in full or to leave a comment, please click here
New mainframe slows sales decline at IBMSales fell 13 percent in the second quarter at IBM, and profit dropped 16 percent—but things could have been worse if it weren’t for sales of the recently launched Z13 mainframe. IBM blamed much of the decline on a strong dollar and the sale to Lenovo of its low-end server business.Tech companies go on a spending spree in WashingtonIBM could have boosted its results by $1.8 million in the second quarter by eliminating its spending on lobbyists. Instead, it increased its spend by 7 percent. Other companies spent more, however: Amazon doubled its lobbying budget to $2.15 billion, while Facebook’s expenditure on lobbying rose by a quarter to $2.7 billion in the quarter. Apple and Intel each spent about $1.25 million, both up from the year-earlier quarter. Alone among the big tech companies, Google cut spending to $4.62 million—but at that level, it’s hard to tell whether peer pressure or thrifty new CFO Ruth Porat were behind the reduction.To read this article in full or to leave a comment, please click here
According to a new survey of Black Hat attendees released last week, InfoSec professionals are spending the biggest amount of their time and budgets on security problems created within the organization itself.
Security vulnerabilities introduced by their own application development teams consumed the most amount of time for 35 percent of respondents. Purchased software and systems were in second place with 33 percent of respondents.
Dealing with sophisticated targeted attacks was sixth on the list, with 20 percent of respondents choosing it as one of the three areas where they spent the most time.
Meanwhile, 57 percent said that their biggest concerns were sophisticated attacks directed at their organization.To read this article in full or to leave a comment, please click here
Microsoft today issued one of its sporadic emergency, or "out-of-band," security updates to patch a vulnerability in Windows -- including the yet-to-be-released Windows 10 -- that was uncovered by researchers sifting through the massive cache of emails leaked after a breach of Italian surveillance vendor Hacking Team.
The Milan-based vendor sells surveillance software to governments and corporations, and markets zero-day vulnerabilities that its clients can use to silently infect targets with the firm's software. Researchers have found several zero-days -- flaws that were not fixed before they went public -- in the gigabytes of pilfered documents and messages, including three in Adobe's Flash Player, since July 5.To read this article in full or to leave a comment, please click here
A proposed set of software export controls, including controls on selling hacking software outside the U.S., are “dangerously broad and vague,” Google said Monday.Google, commenting on rules proposed by the U.S. Department of Commerce (DOC), said the proposed export controls would hurt the security research community.A DOC Bureau of Industry and Security (BIS) proposal, published in May would require companies planning to export intrusion software, Internet surveillance systems and related technologies to obtain a license before doing so. Exports to Canada would be exempt from the licensing requirement.To read this article in full or to leave a comment, please click here
A proposed set of software export controls, including controls on selling hacking software outside the U.S., are "dangerously broad and vague," Google said Monday.Google, commenting on rules proposed by the U.S. Department of Commerce (DOC), said the proposed export controls would hurt the security research community.A DOC Bureau of Industry and Security (BIS) proposal, published in May would require companies planning to export intrusion software, Internet surveillance systems and related technologies to obtain a license before doing so. Exports to Canada would be exempt from the licensing requirement.To read this article in full or to leave a comment, please click here
Microsoft is said to be paying $320 million to acquire Adallom, a cloud security provider whose services might help Microsoft in its new push toward becoming a “cloud-first” company.Adallom provides back-end security tools that gather usage data and detect suspicious activity. Its services are used by Netflix, SAP and Hewlett-Packard, according to the company’s website. The acquisition was reported Monday by the Calcalist financial newspaper.A spokesman for Adallom declined to comment, and Microsoft did not immediately respond to a request for comment.Adallom could help boost the defenses of Microsoft products including Office 365 and Yammer. Adallom’s tools can give businesses more granular control over who has access to Office 365, or identify anomalies in usage patterns for the cloud suite, according to Adallom’s website. An acquisition would bring those tools under Microsoft’s umbrella.To read this article in full or to leave a comment, please click here
A South Korean intelligence officer who used a controversial surveillance system from Italy’s Hacking Team was found dead over the weekend in an apparent suicide as controversy swirls in the country over use of the software.The officer, identified by local media only as Lim, was a 20-year cyber-security veteran of the country’s National Intelligence Service (NIS) and ran the department that used the software, according to reports.He was found dead on Saturday in a car south east of Seoul. Burnt coal was found in the car and an autopsy conducted a day after his death on Saturday found he died of asphyxiation, according to reports. Burning charcoal in a confined space is a relatively common method of committing suicide in South Korea and Japan.To read this article in full or to leave a comment, please click here
Rather than looking for signatures of known malware as traditional anti-virus software does, next-generation endpoint protection platforms analyze processes, changes and connections in order to spot activity that indicates foul play and while that approach is better at catching zero-day exploits, issues remain.For instance, intelligence about what devices are doing can be gathered with or without client software. So businesses are faced with the choice of either going without a client and gathering less detailed threat information or collecting a wealth of detail but facing the deployment, management and updating issues that comes with installing agents.To read this article in full or to leave a comment, please click here
Happy Monday, IT folks. Ready to patch and then restart your machines? I hope so as Microsoft released an out-of-band patch for a remote, critical flaw in the way Windows Adobe Type Manager Library handles OpenType fonts; all supported versions of Windows are affected. It's being exploited in the wild and Microsoft admitted some of its customers could be attacked. It's not every day Microsoft releases an out-of-band patch, so when it does so instead of deploying the fix on Patch Tuesday, then it means patch now.This morning Microsoft Premier Support customers received notification that Microsoft would release an out-of-band patch for a critical remote code execution (RCE) vulnerability that affects all versions of Windows. There was no more information, other than that a reboot would be required after the patch was installed. Everyone else was notified when Microsoft made the out-of-band patch announcement at 10 am PST.To read this article in full or to leave a comment, please click here
The old days of straightforward antivirus software packages are gone -- victim of a changing threat scene in which the dangers are more complex than ever and come from multiple sources.
No longer are viruses and Trojans the only risks. Today you can also be victimized by phishing attacks, spyware, privacy invasions, social media scams and the possibility of losing your mobile device.
To complicate matters even further, most of us commonly use multiple devices, frequently with different operating systems. I'm a perfect case of that: My computing arsenal includes a Windows desktop PC, a MacBook Air, two Windows-based Surface tablets, two iPads, an iPhone and a Google Nexus 7 Android tablet.To read this article in full or to leave a comment, please click here