Home Blog Page 406

Disney hacking, a comical hoax

Disney-hacking,-a-comical-hoax

Ransomware has quite become the buzz word of 2017. The amount of attacks is preposterous, and every single day has become a date that lives in infamy. Post the NSA leaked WannaCry attack sporadically crippled the entire world, the studio, Disney received threats of leaking the latest outing from the Pirates of Caribbean franchise ‘Dead Men Tell No Tales’, unless paid a ransom.

Keeping movies and TV series hostage isn’t a new thing in Hollywood. ‘Game of Thrones Season 4’ was affected, and more recently Netflix series, ‘Orange is the New Black’ was stolen and leaked online. This was shortly after six people India were arrested by authorities for holding a major title to ransom. While Disney came under the radar, the name of the movie wasn’t revealed by the hacker group.

Disney immediately went public with the hack but later kept tightlipped and coy. It was the Lost Angeles Times that identified that the movie being held hostage was the latest Pirates of Caribbean, while also speculating that it might be the long due Star Wars movie.

According to news.com, Disney CEO, Bob Iger held meetings with staff, stating that the hackers got in touch with them and threatened to release the film in several parts. At first, they would release the first five minutes of the movie and then 20-minutes rest into the movie, unless the ransom was paid. Disney declined to pay the hackers and resorted to seek help from the FBI.

After the first bells of doubts started ringing, website TorrentFreak conducted its own investigation and came out suggesting the demand was probably a hoax.

“Our conclusion was that the hack almost certainly never happened and, from the beginning, no one had ever spoken about the new Pirates film being the hostage. Everything pointed to a ransom being demanded for a non-existent copy of The Last Jedi and that the whole thing was a grand hoax,” the website TorrentFreak wrote. Which later turned out to be true.

Iger while talking to Yahoo Finance stated, “To our knowledge, we were not hacked. We had a threat of a hack of a movie being stolen. We decided to take it seriously but not react in the manner in which the person who was threatening us had required.”

There is a thing or two that can be learnt from Disney here. You can be hacked at any point of time, nobody is immune. Always treat your threats real, and most of all make sure you seek legal help at the earliest.

Singapore ramps up cyber security by allocating $528 million

cyber-security-singapore

The government of Singapore has earmarked as much as $528 million of its tech budget, representing 22 percent of the total, to cyber security programs. With its aggressive economic development plans in the digital economy sector, Singapore recognizes the need to protect citizens and businesses from the ever-rising tide of cyber attacks and crimes. Improved response times are especially vital.

The budget is a continuation of Prime Minister Lee Hsien Loong cyber security plans that he announced at the Singapore International Cyber Week on October 10, 2016. The four keys to the plan were to strengthen information infrastructure, mobilize efforts to counter cyber threats, develop a cyber security ecosystem that included a skilled workforce and strong research collaborations, and forging international partnerships.

The main recipient of these spending priorities will be the government’s new Security Operation Centre (SOC), which will feature a cutting-edge analytics operation and an artificial intelligence program. With the increasing likelihood that cyber attacks will depend on automated malware, the need for security operations to deploy automated responses is rising.

The new SOC will replace he Cyber-Watch Centre that opened in 2007. It was tasked with monitoring public IT physical infrastructure and the security services company e-Cop held the contract, which will expire in 2019. Following a number of attacks in 2014, including a high-profile one on the prime minister’s webpage, the Cyber-Watch Centre’s duties were expanded to monitor cyber security, but the new SOC will be better designed to carry on this task.

The new fiscal budget, which runs until March 31 of 2018, will include $2.4 billion in spending, with the focus on cyber crime analytics, cyber security, and smart applications to provide a defense network. The new spending is designed to integrate with the infrastructure projects that were part of last year’s Singapore’s Smart Nation program, which focused on network expansion and cabling.

ICERT opens 111 positions for infosec professionals

ICERT

The Government of India has sanctioned 111 posts for cyber security professionals for the Indian Computer Emergency Response Team (ICERT), which falls under the Ministry of Electronics and Information Technology (MEITY).

This might come after the ransomware WannaCry attack that had made a significant impact for the Indian banking sector, as the recruitment for the ICERT has been pending for five years. Currently, ICERT has 20 regular staff and scores of contract employees. The government had made numerous announcements following the release of the National Cybersecurity Policy of 2013, to boost the sector but haven’t reached a ground for implementation. The cabinet had also sanctioned Rs 800 crore in this regard.

Ravi Shankar Prasad, Minister of State for Electronica and Information Technology, had stated that the National Cyber Coordination Centre (NCCC) would be set up in June 2017, and will provide real time information on cyber threats, Other participants would be the research and analysis wing, Intelligence Bureau, Military Intelligence, National Technical Research and Central Bureau of Investigation.

According to an official statement, the recruitments for the first batch of scientists for the NCCC is underway. The ministry has also invited applications for scientists in category B. There are also post set aside for Cyber Swachhta Kendra (Botnet Cleaning Centre) which will serve as a medium to detect and clean infected systems.

The division of the India CERT team carries out wide range of activities from data collection to incidence response, forecasting, mock drills, issuing guidelines, vulnerabilities, among others. It has, so far, organized 41 workshops and 11 mock drills in various nodal agencies, ministries, and offices across the country. All these with a meager staff, if things go as planned, there would be numerous activities and a bigger presence for the department to show.

ITAMCO to develop secure platform for DARPA

ITAMCO-DARPA

Defense Advanced Research Projects Agency (DARPA) has awarded ITAMCO, the developer of Crypto-Chat, the advanced privacy app, with the Phase 1 grant to make a secure, non-hackable messaging platform for the U.S. military. The Phase 1 will run into 10 months.

With an aim to create an efficient, robust secure platform for communications of the U.S. Department of Defense, ITAMCO will develop a secure architecture for the prevailing Cyrpto-Chat with added blockchain technologies. These will also include communication with offsite troops, sharing intelligence information as well as interaction with the Pentagon.

The blockchain technology facilitates secure online transactions and is also the underlying technology of cryptocurrency Bitcoins. It is a decentralized database that records digital transactions in such a way that no single entity has full control over it.

Adding blockchain technology to the privacy architecture will enable ITAMCO to create a hacker-proof platform. It will also differentiate between the way messages are received and transferred. The decentralization will allow anyone from anywhere to send secure messages or even conduct transactions that can be traced via decentralized ledger.

“We are excited to work with DARPA to develop the latest in military-grade encryption software using blockchain technology, and look forward to offering an enterprise solution for secure messaging to industry,” said Joel Neidig, Director of Research and Development, ITAMCO, in a statement.

The grant for Phase 1 was made through the Small Business Innovation Research program. The firm also mulls on collaborating with Center for Research Computing at the University of Notre Dame. In Phase 2, ITAMCO will test and evaluate the prototype of the app. Phase 3 will involve implementation and commercialization of the app.

Vietnamese hackers target Philippines over South China Sea row: FireEye

Philippines-over-South-China-Sea-row-FireEye

Cybersecurity company, FireEye has stated that nation backed Vietnamese hackers are most likely targeting Philippines state agencies to gather maritime related intelligence with regard to the South China Sea dispute.

The Vietnam government hasn’t made a comment about the subject, though the nation has always dismissed similar allegations. The foreign ministry of Philippines has told Reuters that would look into the reports.

According to the report from FireEye, Vietnamese hackers APT32 (Advanced Persistent Threat, a word often used to describe nation-backed hacker group) had attacked a Philippine technology infrastructure firm and a consumer product corporation last year, along with numerous other companies that were doing business in Vietnam.

Bryce Boland, the CTO of FireEye stated that he hackers have been targeting Philippine government bodies as well. “This is presumably in order to gain access to information about military preparation and understanding how the organizations within the government operate in order to be better prepared in case of potentially military conflict,” Boland during a press briefing.

“There are overlapping claims between Vietnam and the Philippines over some islands in the South China Sea and it is quite likely that intelligence gathering is starting around that,” he added. He continued, “We believe all of the activities of APT32 are aligned to the interests of the Vietnamese government.”

Online scammers sentenced to 235 years in prison

e-skimming attacks , Chinese e-commerce scammers

The Mississippi court has sentenced three Nigerian nationals, for running online dating scams that deceived numerous people into shelling of millions of dollars, to a total of 235 years in prison.
The culprits Oladimeji Seun Ayelotan was sentenced to 95 years in prison today, while his associates Rasaq Aderoju Raheem, got 115 years and Femi Alexander Mewase, received 25 years. Oladimeji is 30, while Rasaq and Femi Alexander are 31 and 45, respectively. The jury found the three guilty on charges of identity theft, mail fraud, theft of government property, and credit card fraud. The convicted three were part of a 21-person case brought to the court. Among these 12 have pleaded guilty.

Oladimeji and Rasaq have also been convicted in conspiracies to money laundering and bank fraud, warranting longer sentences.

The gang has been operating for nearly two decades, running numerous scams including romance and dating scams. The gangs would trick the victims into sending money through MoneyGram and Western Union, or even resend goods bought from credit cards and debit cards and sell it in countries for profits. The gang was apprehended during a joint operation by sleuths of South African police, U.S. Immigration, U.S. Postal Inspection Service, and Customs Enforcement’s Homeland Security Investigations.

According to Interpol, the African national have duped people in over $3 billion in the last three years.

BIoT revenues to reach $8.65 billion by 2021

BloT

The world is nearing the desired futuristic connectivity. The Internet of Things in Buildings (BIoT) is paving way to this with numerous innovations and tangible business benefits. A new report on the market for Cyber Security Hardware, Software & Services in Commercial Buildings from 2016 to 2021 has been published which states that the revenues from BIoT will touch $8.65 billion by 2021.

It also states that threats, if not properly managed can in turn run the risk of undermining consumer confidence in the marker.

The proliferation of smart devices combined with the cybersecurity risks and data privacy has increased the vulnerability of the former. This will pull a greater demand for cybersecurity hardware, software and services.

Cybersecurity in Smart Commercial Buildings 2017 to 2021 estimates a 15% representing a healthy CAGR from the estimated $4.26 billion in 2016. According to the research, robust cybersecurity plan is critical for smart buildings. Armed with knowledge from security audits and security risk assessments, organizations can make more informed risk management decisions and proactively identify the steps required to reduce threats. Even after a plan has been developed, an effective defense involves an ongoing iterative process, which must be continuously reviewed against the constantly changing threat environment.

Shifting Cyber Security Priorities in Trump Budget

Cyber-Security-Priorities-in-Trump-Budget

In its budget proposal for fiscal 2018, which begins on October 1st, the administration of Donald Trump claims it will undertake measures that toughen the information security of governmental agencies, even while cutting the cyber security budgets of a number of federal agencies.

The core element of the budget is the $1.5 billion in cyber security outlays at the Department of Homeland Security (DHS), whose overall budget is slated to increase by 7.1 percent. An additional $228 million in funding for information technology modernization efforts across agencies was also announced by Office of Management and Budget Director Mick Mulvaney at a May 23 press conference.

A budget blueprint which accompanies the release of the budget states that the increased spending at DHS would offset any security concerns stemming from the cuts elsewhere in the budget: “DHS would share more cyber security incident information with other federal agencies and the private sector, leading to faster responses to cyber security attacks directed at federal networks and critical infrastructure.”

There is fear that the cyber security spending increases might get lost at the sprawling DHS. The National Protection and Programs Directorate (NPPD), a part of the DHS, is where most the agencies cyber safety initiatives are managed.

The president of Internet Security Alliance, Larry Clinton, worries that the monies being allocated to cyber security at DHS are not enough, especially in comparison to what is spent in the private sector. Given the wide-ranging responsibilities of the DHS — which include securing the nation’s borders, enforcing immigration, counterterrorism programs — the budget increase may not be as focused as necessary.

Michael Daniel, who was cyber security coordinator for President Obama and is now president of the Cyber Threat Alliance, is critical that the budget is lacking in detail. But he is positive about DHS not facing actual cuts in its cyber security budget.

Proposed cyber security spending is not on the upswing at all agencies. Cuts are proposed at the State Department, the National Science Foundation, and National Institute of Standards and Technology. Also seeing cuts are Department of Health and Human Services agencies that deal with health data privacy and security issues.

Law enforcement agencies such as the FBI and Justice Department do see proposed increases in cyber security spending. The budget calls for 36 new positions to be created at the FBI to ramp up its cyber crime fighting efforts. The National Security Division of the Justice Department would see its budget increase to $101 million, a 6.6 percent rise.

Ultimately the budget is a wish list, since it still needs to pass Congress. If Congress again settles for a continuing resolution, spending levels from previous years will be carried forward and individual appropriations bills will give agencies their specific benchmarks on spending.

Microsoft acquires cybersecurity firm Hexadite for $100 mn

microsoft, flaws in SonicWall SRA SMA

Cybersecurity firm Hexadite has been acquired by Microsoft. The financials details of acquisition were not revealed by the firms, but Calcalist, a financial news website from Israel, in May, had reported that the deal would be cracked for a whopping $100 million.

Boston-based Hexadite, with its R&D center in Israel is equipped with technology that provides automated response to cyberattacks. The firm states that the technology increases productivity of business and even reduces costs to the company.

The news comes after Microsoft, earlier this year, stating that it is mulling on investing more than $1 billion in cybersecurity every year. It seems like Israel is already reaping fruits from the announcement. In 2015, Microsoft had acquired the Israeli cybersecurity company Secure Islands, also, earlier this January, it invested in another cybersecurity firm, Team8. It was also reported that Microsoft was bidding to acquire Israeli startup Cloudyn for $60 million.

The startup Hexadite has investors like Hewlett Packard Ventures and other venture capital firms like YL Ventures and TenEleven.

7-year old Linux vulnerability patched

7-year-old-Linux-vulnerability-patched

While WannaCry wreaked havoc across the world, users of Linux and MacOS just kept staring at the confusion and sighed a relief that they weren’t affected. Gladly so, as even the open source Samba server of Linux had a massive vulnerability that could have triggered a mass predicament.

Apparently, the exploitable vulnerability also provided SMB services like WannaCry. But unlike the Microsoft flaw which was discovered by NSA and then stolen by Shadow Brokers, the Samba flaw was noticed and brought to the noticed by a researcher with alias ‘steelo’.

“All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it,” stated Samba project advisory.

Patches have also been released. “Samba 4.6.4, 4.5.10 and 4.4.14 have been issued as security releases to correct the defect. Patches against older Samba versions are available at http://samba.org/samba/patches/. Samba vendors and administrators running affected versions are advised to upgrade or apply the patch as soon as possible,” it added.

Volker Lendecke of SerNet and the Samba Team have provided the fix.

1...405406407...409Page 406 of 409