Hackers Steal Payment Card Data From Over 1,150 InterContinental Hotels

Wednesday, April 19, 2017 Swati Khandelwal



InterContinental Hotels Group (IHG) is notifying its customers that credit card numbers and other sensitive information may have been stolen after it found malware on payment card systems at 1,174 franchise hotels in the United States.

It's the second data breach that U.K.-based IHG, which owns Holiday Inn and Crowne Plaza, has disclosed this year. The multinational hotel conglomerate confirmed a credit card breach in February which affected 12 of its hotels and restaurants.

What happened?
IHG identified malware accessing payment data from cards used at front desk systems between September 29 and December 29, 2016, but the malware was erased after the investigation got completed in March 2017.

"Many IHG-branded locations are independently owned and operated franchises and certain of these franchisee operated locations in the Americas were made aware by payment card networks of patterns of unauthorized charges occurring on payment cards after they were legitimately used at their locations," read the notice published to IHG’s site on Friday.What type of information?
The malware obtained credit card data, such as cardholders' names, credit card numbers, expiration dates and internal verification codes, from the card's magnetic stripe, although the company said there is no evidence of any unauthorized access to payment card data after late December.



However, the company can not confirm that the malware was removed until February and March 2017, when it began its investigation around the data breach.

How many victims?
The total number of affected customers is not revealed by the company, although customers can use a lookup tool IHG has posted on its website to search for hotels by city and state.

The company says this most recent breach mostly affects guests from U.S-based hotels, who stayed between September 29 and December 29, 2016. The 1,174 hotels breached in the US include, 163 in Texas, 64 in California, 61 in Florida, 53 in Indiana, 50 in Ohio, 45 in New York, 42 in Michigan, 39 in Illinois, among others.

Only one hotel in Puerto Rico, a Holiday Inn Express in San Juan, is the non-U.S. hotel that was hit by malware.

Who are not affected by the breach?
Those franchise hotel locations that had implemented IHG's Secure Payment Solution (SPS) – a point-to-point encryption payment acceptance solution – before 29th September 2016 were not affected by this data breach.

IHG is advising all franchise hotels to implement SPS in order to protect themselves from such malware attacks, though the company also said, many more properties implemented SPS after September 29, 2016, which ended the malware’s ability to find payment card data.



What is the IHG doing?
IHG has already notified law enforcement of the recent data breach.

Moreover, on behalf of franchisees, the company has been working closely with the payment card networks and the cyber security firm to confirm that the malware has been removed and evaluate ways for franchisees to enhance security measures.

What should IHG customers do?
Users are advised to review their payment card statements carefully and to report any unauthorized bank transactions.

You should also consider requesting a replacement card if you visited any of the affected properties during that three months duration when the breach was active.

"The phone number to call is usually on the back of your payment card. Please see the section that follows this notice for additional steps you may take," the company says.IHG became the latest hotel chain to report a potential customer data breach in past few years, following the data breach in Hyatt, Hilton, Mandarin Oriental, Starwood, White Lodging and the Trump Collection that acknowledged finding malware in their payment systems.

Hackers Can Steal Your Passwords Just by Monitoring SmartPhone Sensors

Tuesday, April 11, 2017 Swati Khandelwal





Do you know how many kinds of sensors your smartphone has inbuilt? And what data they gather about your physical and digital activities?

An average smartphone these days is packed with a wide array of sensors such as GPS, Camera, microphone, accelerometer, magnetometer, proximity, gyroscope, pedometer, and NFC, to name a few.

Now, according to a team of scientists from Newcastle University in the UK, hackers can potentially guess PINs and passwords – that you enter either on a bank website, app, your lock screen – to a surprising degree of accuracy by monitoring your phone's sensors, like the angle and motion of your phone while you are typing.



The danger comes due to the way malicious websites and apps access most of a smartphone's internal sensors without requesting any permission to access them – doesn't matter even if you are accessing a secure website over HTTPS to enter your password.


Your Phone doesn't Restrict Apps from Accessing Sensors' Data
Your smartphone apps usually ask your permissions to grant them access to sensors like GPS, camera, and microphone.

But due to the boom in mobile gaming and health and fitness apps over the last few years, the mobile operating systems do not restrict installed apps from accessing data from the plethora of motion sensors like accelerometer, gyroscope, NFC, motion and proximity.

Any malicious app can then use these data for nefarious purposes. The same is also true for malformed websites.

"Most smartphones, tablets and other wearables are now equipped with a multitude of sensors, from the well-known GPS, camera, and microphone to instruments such as the gyroscope, proximity, NFC, and rotation sensors and accelerometer," Dr. Maryam Mehrnezhad, the paper's lead researcher, said describing the research.

"But because mobile apps and websites don't need to ask permission to access most of them, malicious programs can covertly 'listen in' on your sensor data and use it to discover a wide range of sensitive information about you such as phone call timing, physical activities and even your touch actions, PINs and passwords."

Video Demonstration of the Attack
Scientists have even demonstrated an attack that can record data from around 25 sensors in a smartphone. They have also provided a video demonstration of their attack, showing how their malicious script is collecting sensor data from an iOS device.

The team wrote a malicious Javascript file with the ability to access these sensors and log their usage data. This malicious script can be embedded in a mobile app or loaded on a website without your knowledge.



Now all an attacker need is to trick victims into either installing the malicious app or visiting the rogue website.

Once this is done, whatever the victim types on his/her device while the malicious app or website running in the background of his phone, the malicious script will continue to access data from various sensors and record information needed to guess the PIN or passwords and then send it to an attacker's server.


Guessing PINs and Passwords with a High Degree of Accuracy
Researchers were able to guess four-digit PINs on the first try with 74% accuracy and on the fifth try with 100% accuracy based on the data logged from 50 devices by using data collected from just motion and orientation sensors, which do not require any special permission to access.

The scientists were even able to use the collected data to determine where users were tapping and scrolling, what they were typing on a mobile web page and what part of the page they were clicking on.

Researchers said their research was nothing but to raise awareness to those several sensors in a smartphone which apps can access without any permission, and for which vendors have not yet included any restrictions in their standard built-in permissions model.

"Despite the very real risks, when we asked people which sensors they were most concerned about we found a direct correlation between perceived risk and understanding," Mehrnezhad said. "So people were far more concerned about the camera and GPS than they were about the silent sensors."Mehrnezhad says the team had alerted leading browser providers such as Google and Apple of the risks, and while some, including Mozilla and Safari, have partially fixed the issue, the team is still working with the industry to find an ideal solution.

More technical details can be found in the full research paper, titled "Stealing PINs via mobile sensors: actual risk versus user perception," published Tuesday in the International Journal of Information Security.

Hackers Escape VMware Virtual Machine Isolation at Pwn2Own 2017

By: Sean Michael Kerner | March 20, 2017


Hackers find 51 vulnerabilities, including a series of virtualization hypervisor exploits, earning themselves $823,000 in prizes at Pwn2Own 2017.

Virtualization hypervisor technology is supposed to isolate virtual machines from the underlying operating system. Yet on the final day of the 10th anniversary Pwn2Own hacking challenge on March 17, two teams of security researchers—360 Security and Tencent Security Team Sniper—were each able to escape the security isolation that virtualization is supposed to provide.

The three-day Pwn2Own 2017 event, which was once again held at the CanSecWest Conference in Vancouver, was run by Trend Micro's Zero Day Initiative (ZDI), which pays security researchers for responsibly disclosing zero-day vulnerabilities. In total, Trend Micro awarded researchers $823,000 in prize money, with $233,000 awarded on the first day, $340,000 on the second day, and $250,000 on the third and final day of the event.

As was the case with most of the high-level exploits demonstrated at Pwn2Own 2017, the hypervisor exploit put together by 360 Security was not a single vulnerability. Rather, the researchers chained together three different vulnerabilities to exploit their target.

The first flaw used by 360 Security in the hypervisor escape was a memory heap overflow vulnerability in Microsoft's Edge web browser. The browser flaw was accompanied by a type confusion vulnerability in the Microsoft Windows kernel. The Edge and Windows vulnerabilities alone, however, weren't enough to escape the confines of the VMware Workstation hypervisor isolation. The 360 Security researchers also had to include a zero-day uninitialized buffer vulnerability in VMware Workstation to successfully execute the virtual machine escape.

Further reading
How Taxpayers Can Keep Themselves Safe
Indictments Confirm Fears of Massive Russian Hacking

"They won't say exactly how long the research took them, but the code demonstration needed only 90 seconds," ZDI wrote in a blog post explaining the exploit.

The 360 Security researchers were not the only team that was able to escape the virtualization hypervisor. Tencent Security Team Sniper took direct aim at VMware Workstation and was also able to successfully escape a guest virtual machine to attack the underlying host operating system with an entirely different set of vulnerabilities than what 360 Security demonstrated.

Tencent Security Team Sniper also had three vulnerabilities in its virtualization hypervisor exploit chain. The first vulnerability was a use-after-fee memory vulnerability in the Windows operating system kernel. The second vulnerability in the exploit chain was a VMware Workstation information leakage flaw. Tying them together was an uninitialized buffer vulnerability in VMware Workstation that enabled the Team Sniper researchers to escape from the guest virtual machine to attach the host system. For its efforts, Team Sniper was awarded $100,000.

A Microsoft Edge web browser exploit was the only other flaw successfully demonstrated on the final day of Pwn2Own 2017. Researcher Richard Zhu was able to chain together three vulnerabilities, including a pair of use-after-free flaws in Edge and a buffer overflow in Windows, to earn himself a $55,000 award.

Overall at the three-day event, 51 different security bugs were reported to ZDI across Microsoft Windows, Microsoft Edge, Adobe Reader, Apple Safari, Apple macOS, Ubuntu Linux, Mozilla Firefox and VMware Workstation applications. In contrast, at the Pwn2Own 2016 event (which was only two days), there were 21 vulnerabilities reported to ZDI, with a grand total of $460,000 in prize money awarded.

What Pwn2Own 2017 has demonstrated as an event is that once again, despite the best efforts and intentions of software vendors, zero-day vulnerabilities remain an issue.

NSA fears talent drain as low morale and worries about Trump’s leadership take toll

  01 Mar 2017 , 19:21

The National Security Agency (NSA) risks a brain-drain of hackers and cyber spies due to a tumultuous reorganization and worries about the acrimonious relationship between the intelligence community and President Donald Trump, according to current and former NSA officials and cybersecurity industry sources. Half-a-dozen cybersecurity executives told Reuters they had witnessed a marked increase in the number of U.S. intelligence officers and government contractors seeking employment in the private sector since Trump took office on January 20.

One of the executives, who would speak only on condition of anonymity, said he was stunned by the caliber of the would-be recruits. They are coming from a variety of government intelligence and law enforcement agencies, multiple executives said, and their interest stems in part from concerns about the direction of U.S intelligence agencies under Trump.

Retaining and recruiting talented technical personnel has become a top national security priority in recent years as Russia, China, Iran and other nation states and criminal groups have sharpened their cyber offensive abilities. NSA and other intelligence agencies have long struggled to deter some of their best employees from leaving for higher-paying jobs in Silicon Valley and elsewhere. The problem is especially acute at NSA, current and former officials said, due to a reorganization known as NSA21 that began last year and aims to merge the agency’s electronic eavesdropping and domestic cyber-security operations.

The two-year overhaul includes expanding parts of NSA that deal with business management and human resources and putting them on par with research and engineering. The aim is to “ensure that we’re using all of our resources to maximum effect to accomplish our mission,” NSA Director Mike Rogers said. The changes include new management structures that have left some career employees uncertain about their missions and prospects. Former employees say the reorganization has failed to address widespread concerns that the agency is falling behind in exploiting private-sector technological breakthroughs.

A former top NSA official said he had been told by three current officials that budget problems meant there was too little money for promotions. That is especially important for younger employees, who sometimes need two jobs to make ends meet in the expensive Washington D.C. area, the official said. “Morale is as low as I’ve ever seen it,” said another former senior NSA official, who maintains close contact with current employees.

Asked about the risk of losing talent from NSA and other agencies, White House spokesman Michael Anton said Trump had sought to reassure the intelligence community by visiting the CIA headquarters on his first full day in office. Anton also pointed to the military spending increase in Trump’s budget proposal released on Monday.

It will likely take more than a visit to the CIA to patch up relations with the intelligence community, the current and former officials said. Trump has attacked findings from intelligence agencies that Russia hacked emails belonging to Democratic Party operatives during the 2016 presidential campaign to help him win, though he did eventually accept the findings. In January, Trump accused intelligence agencies of leaking false information and said it was reminiscent of tactics used in Nazi Germany.

How many?

The breadth of any exodus from the NSA and other intelligence agencies is difficult to quantify. The NSA has “seen a steady rise” in the attrition rate among its roughly 36,000 employees since 2009, and it now sits at a “little less than six percent,” according to an NSA spokesman. NSA director Michael Rogers said last year that the attrition rate was 3.3 percent in 2015, suggesting a sharp jump in departures since then.

Several senior NSA officials who have left or plan to leave, including deputy director Richard Ledgett and the head of cyber defence, Curtis Dukes, have said their departures were unrelated to Trump or the reorganization. Some turnover is normal with any new administration, government and industry officials noted, and a stronger economy has also improved pay and prospects in the private sector.

“During this time the economy has been recovering from the recession, unemployment rates have been falling and the demand for highly skilled technical talent has been increasing,” an NSA spokesman said, when asked to comment on the reports of employee departures. In a statement, Kathy Hutson, NSA’s chief of human resources, said the agency continues “to attract amazing talent necessary to conduct the security mission the nation needs.”

Controversial Boss

Some NSA veterans attribute the morale issues and staff departures to the leadership style of Rogers, who took over the spy agency in 2014 with the task of dousing an international furore caused by leaks from former contractor Edward Snowden. Concern about Rogers reached an apex last October, when former Defense Secretary Ash Carter and former Director of National Intelligence James Clapper recommended to then-President Barack Obama that Rogers be removed.

The NSA did not respond to a request for comment on the recommendation last fall that Rogers be replaced. Rogers is now expected to retain his job at NSA for at least another year, according to former officials. Rogers acknowledged concerns about potential morale problems last month, telling a congressional committee that Trump’s broadsides against the intelligence community could create “a situation where our workforce decides to walk.”

Trump’s criticism of the intelligence community has exacerbated the stress caused by the reorganization at the NSA, said Susan Hennessey, a former NSA lawyer now with Brookings Institution. The “tone coming from the White House makes an already difficult situation worse, by eroding the sense of common purpose and service,” she said. A wave of departures of career personnel, Hennessey added, “would represent an incalculable loss to national security.”

Reuters

US files a lawsuit against D-Link for failing to secure its routers and security cams from hackers

Image Credit: D-Link

  06 Jan 2017 , 11:14

The U.S. Federal Trade Commission filed a lawsuit against D-Link Corp on Thursday, accusing the Taiwan-based manufacturer of failing to take reasonable steps to protect its routers and internet-linked security cameras from hackers.

The FTC brought the charges as part of a broader effort to improve security of internet-connected devices, including routers, webcams, digital video recorders and other widely used consumer electronics devices. The company said the claim is without merit.

“D-Link denies the allegations outlined in the complaint and is taking steps to defend the action,” it said in a statement. “The security of our products and protection of our customers private data is always our top priority.”

Concerns about security of internet-connected devices, which are sometimes referred to collectively as the internet of things, or IoT, have surged since last year when hackers used armies of compromised routers, webcams and other electronic devices to launch a series of increasingly powerful attacks that severed access to some of the world’s biggest websites.

Security experts blamed those attacks on lax security in large numbers of IoT devices from dozens of manufacturers. They have called on the industry to better secure their equipment, removing easy-to-exploit vulnerabilities such as the use of default passwords that give hackers the keys to remotely access machines over the web.

Allison Nixon, director of security research with cyber intelligence firm Flashpoint, said the FTC’s action could encourage IoT manufacturers to beef up security. “I think vendors are going to take it seriously,” she said. “The IoT world needs to shape up quickly because this is a big problem.”

The FTC’s complaint alleged that D-Link neglected to protect the devices from “widely known and reasonably foreseeable risks of unauthorised access,” even as it highlighted security features in communications with consumers.

The FTC asked the U.S. District Court for the Northern District of California to order D-Link to improve its security practices and to pay the agency’s legal costs. The agency filed the case after issuing guidelines on securing IoT devices in 2015. FTC commissioners voted 2-1 to approve the filing of the lawsuit. The Democratic chairwoman Edith Ramirez and commissioner Terrell McSweeny voted yes, but the lone Republican commissioner, Maureen Ohlhausen, opposed the filing of the lawsuit.

Reuters

Hackers took control of a unclassified email system in Pentagon in 2015

Representational Image

  16 Dec 2016 , 08:54

Russian hackers seized control last year of the unclassified email system used by the U.S. military’s Joint Chiefs of Staff, CBS News reported on Thursday, citing an interview with then-Joint Chiefs of Staff Chairman Martin Dempsey.

Dempsey, who did not appear on camera, said he was alerted to the August 2015 attack by an early morning phone call from the director of the National Security Agency, Admiral Mike Rogers, according to CBS. The email system is used by the Pentagon’s Joint Staff, an organization of some 3,500 military officers and civilians who work for the chairman.

The hackers seized the passwords and electronic signatures used by Dempsey, an Army general who retired in September 2015, and hundreds of other senior officers to sign on to the network, according to CBS. The only way to stop the attack was to take the network down, CBS said.

The attack, which U.S. officials now blame on Russia, was not spying, but a full-on assault whose only apparent purpose was to cause damage and force the Pentagon to replace both hardware and software, which took about two weeks to accomplish, according to CBS.

The motive for the attack was believed to be Russian anger at economic sanctions orchestrated by the Obama administration in response to Russian President Vladimir Putin’s annexation of Crimea and interference in Ukraine, CBS said.

The Pentagon declined to comment. U.S. officials have accused Putin of supervising his intelligence agencies’ hacking of the U.S. presidential election in an effort to help Republican Donald Trump. Russian officials have denied accusations of interference in the Nov. 8 election won by Trump.

Reuters

Legion hacker group set eyes on sansad.nic.in; seem to be cyberdacoits, bring them down

By R Swaminathan /  13 Dec 2016 , 10:54

The Indian State has been threatened. Make no mistake. Banks, hospitals and Parliament are our institutions and a fitting response has to be given.

Attacker: Legion
Targets: Rahul Gandhi. Vijay Mallya. Barkha Dutt. Ravish Kumar.
Next Target-Wannabe: Lalit Modi.
New Targets: Banks, Hospitals & sansad.nic.in aka BIG FISH

One can be tempted to bracket the hacking done by Legion as a sign of the dystopian times that we live in. There are enough straws to indicate that: a group of renegades dabbling in weed, smoke and mirrors, security codes and a naïve sense of superiority.

One can also be equally tempted to decipher deep meanings from the hacking about the nature of hidden angst and its manifestations. Again, there are enough crumbs leading that trail: a group of Robin Hood style do-gooders disillusioned with the ways of world boldly taking the battle to the rich and the powerful.

Powder puff and romanticism aside, the reality is as cold as steel. Legion is a group of people with uncommon hacking skills that’s not the plain vanilla variety that India has encountered till now. In short, Legion is bringing into India, for the first, international standard hacking. Ask security experts. It’s not easy to hack into Google and Twitter servers. Nor is it a walk in the park to design a tool to sift through terabytes of data.

Let’s not kid ourselves. Legion is clear and presents danger. Forget their ‘g33ky’ lingo and snigger-worth references to “balloons filled with Zykon B” (which, by the way, is cyanide-based pesticide). Forget them being fanboys (and fangirls) of ‘progressive house music, Brian Eno, Aphex Twins and Global Communications’. Wipe out that Rastafarian story of languid pace and peaceful contentment that you are building about them in your head.

Legion is a wake-up call for a transforming (read digital) India. The alarm bells are ringing loud and clear in three domains.  The first bell is clearly meant for our law enforcement institutions. This is not the first time that our cops and sleuths have been caught deer-like. The sorry figure cut by intelligence agencies on the @shamiwitness aka Mehdi Biswas case was filled with lessons. They should have been learnt. Yet, we are again seeing the same story.

On paper, India by now is supposed to have a National Cyber Coordination Centre and a National Critical Information Infrastructure Protection Centre. At least that’s what the National Cyber Security Policy of 2013 recommends. Yes, the policy also promises “to create a secure cyber ecosystem in the country, generate adequate trust and confidence in IT system and transactions… and create a workforce of 5,00,000 professionals skilled in next five years through capacity building skill development and training”. Good words, nicely written. What now?

The second bell is meant for organisations and institutions using digital payment gateways.  The focus has always been on either using the digital medium for greater reach, efficiency and effectiveness or for creating new product and service lines that can be sold directly to the consumer. Of course, the logic of the business model demands that the transactions take place in the simplest possible manner: from Point A to Point B. But lost in this logic of making everything simple is the question of security of personal and financial information. The government institutions have a greater responsibility, at least a couple of notches above any private organisation and institution.  After all, in a democratic India, the government with all its warts and pimples is still representative of our collective will.

Like it or not, cybersecurity of critical institutions and organisation is a matter of national security. And, there are solutions. Every single piece of data, every bit and byte, passing Indian internet and telecommunication pipes can be intercepted, stored, analysed and workable intelligence generated out of it. Germany, France and United States of America are quite good at it. India has had similar ambitions in the form of developing and deploying a central monitoring system (CMS). Maybe, it’s time?

The third bell is for us: as a collective and as an emerging community of digital natives. It gives us vicarious pleasure to see other people’s accounts hacked and their personal information coming out into the public domain. It could happen to you too. Of course, some of the injustices are stark and cannot ever be ignored: how can Vijay Mallya live it up when he hasn’t paid the salaries of Kingfisher employees? Sure, good question, but a different debate. Classic, contemporary and post-modernist arguments of freedom, privacy, democracy, rights and entitlements aside, isn’t it time for us to start pointing out the elephants and unicorns of all shades in the room? Where does freedom begin and privacy end?

The hackers of Legion are not Julian Assange or Wikileaks. They are also not old style investigative journalists who brought down tobacco companies and mining barons. They are cyberdacoits. They need to be brought down.

Attacker: India
Target: Legion Hacker
Wannabe Target: Copycat Hackers
New Targets: Loading…

Hackers can hack any Visa credit card or debit card in six seconds

Visa credit hacked

02 Dec 2016 , 14:50


It can take hackers just six seconds, a laptop and an internet connection to hack any Visa credit or debit card, new research has revealed. The research, published in the journal “IEEE Security and Privacy”, said that the “distributed guessing attack” circumvents all the security features put in place to protect online payments from fraud. Neither the network, nor the banks are able to detect attackers making multiple, invalid attempts to get payment card data.

The current online payment system does not detect multiple invalid payment requests from different websites. This allows unlimited guesses on each card data field, using up to the allowed number of attempts – typically 10 or 20 guesses – on each website, explained Mohammed Ali, a PhD student in Newcastle University.

“Different websites ask for different variations in the card data fields to validate an online purchase. “This means it’s quite easy to build up the information and piece it together like a jigsaw,” Ali added. The combination of these two factors — unlimited guesses and variation in the payment data fields — makes it easy for attackers to hack all the card details.

Each generated card field can be used in succession to generate the next field and so on. “If the hits are spread across enough websites then a positive response to each question can be received within two seconds – just like any online payment,” Ali warned.

The researchers explained that even starting with no details at all other than the first six digits — which tell you the bank and card type — a hacker can obtain essential pieces of information. These are — card number, expiry date and security code — to make an online purchase within as little as six seconds. Researchers believe this ‘guessing attack’ method could have been used in the recent Tesco cyber attack where the hackers defrauded customers of 2.5 million pounds.

The risk is higher at this time of the year as many people are making online purchases ahead of Christmas. However, researchers found that unlike Visa cards, MasterCard’s centralised network was able to detect the guessing attack after less than 10 attempts – even when those payments were distributed across multiple networks.

The researchers suggested that to minimise the chances of hacking, card-holders should use just one card for online payments and keep the spending limit on that account as low as possible. “If it’s a bank card then keep ready funds to a minimum and transfer over money as you need it,” said Martin Emms, co-author of the research.

IANS

Congress Party and Rahul Gandhi’s Twitter account hack come as no surprise for cyber experts

Rahul Gandhi

01 Dec 2016 , 17:02


As the news of Congress Party and its Vice President Rahul Gandhi’s Twitter accounts being hacked spread like wildfire on Thursday, cyber experts were not surprised as the phenomenon is quite common across the globe where hackers are always a step ahead when it comes to data breach — be it a social media platform or your financial information. When it comes to celebrities, Facebook CEO Mark Zuckerberg, Twitter CEO Jack Dorsey, Google CEO Sundar Pichai, Twitter co-founder and former CEO Evan Williams, US actor-singer Jack Black — even the deceased Beatle George Harrison — have seen their social media accounts being hacked in recent times.

Even social networking websites with two-step verification procedures are not secure any more as hackers have evolved various strategies to steal personal information from computers, laptops or smartphones. “There may be a possibility that Rahul Gandhi’s Twitter account was logged into from an unsecured computer or a device that did not have next-generation firewall, an updated anti-virus software or from a compromised IP address. This situation is a boon for hackers who are constantly searching for security flaws and hack into the social media accounts of celebrities and political leaders,” Anoop Mishra, one of the nation’s leading social media experts, told IANS.

According to Saket Modi, Co-founder and CEO of IT risk assessment and digital security services provider Lucideus, the social media hack of both Congress Party and its Vice President’s Twitter accounts can be a result of any one of two possibilities. “It can either be a potential backdoor (malware) being present on a computer system on which both the accounts might have been simultaneously accessed, or this can be a long, persistent and targeted attack (spear phishing in most cases) on the political party. In either case, I am certain there is more data in the hands of the hackers than just account access that might be released in due course of time,” Modi told IANS.

“The only two parties responsible for the security of a social media account are the social media provider (in this case Twitter) and the owner of the account. As these are just two accounts that have been compromised and misused, it is safe to assume that the exploited vulnerability was not present on the side of Twitter,” Modi added. There are several infamous groups busy working day and night to hack into social media accounts — be it Legion, that claimed to have hacked into Rahul Gandhi’s Twitter account, or OurMine, that compromised the Twitter accounts of Zuckerberg, Dorsey, Pichai and others.

The most popular website among hackers is LeakedSource.com which compiles the databases for publicly available hacks of usernames, passwords and email addresses from every major website security breach over the last few years, say media reports. For a country like India that is transitioning to a digital era, experts feel there is a need for stronger cyber laws to minimise such cyber-bullying risks.

“India still does not have a dedicated legislation on cyber security or bullying when it comes to social media platforms. The country, given its vision of becoming an IT super-power, needs to have a dedicated cyber security law on this at the earliest,” Pavan Duggal, one of the nation’s top cyber law experts and a senior Supreme Court advocate, told IANS. The Information Technology Act, 2000, was amended in 2008. By virtue of the 2008 amendments, certain cosmetic changes concerning cyber security were made to the Information Technology Act, 2000.

“These amendments are not sufficient and adequate in today’s scenario. Further, the cyber security breach ecosystem ground realities are distinctly different in 2016 as compared to 2008. As such, there is a distinct need for India to beef up its legal frameworks on cyber security and cyber bullying,” Duggal added. People need to adopt various cyber hygiene methodologies in order to avoid online data stealing.

“Having in place an updated anti-virus software on your computer system is a critical component. There are several encrypted data services available which can be used abroad. Company executives should only access HTTPs sites — being secure sites,” Duggal suggested. “If you’re accessing something sensitive on public Wi-Fi, try to do it on an SSL (Secure Socket Layer) encrypted websites. The HTTPs browser extension can reduce the risk by redirecting you to an encrypted page when available,” Mishra explained.

Turn off file/computer/network sharing and avoid using specific websites where there’s a chance that cyber criminals could capture your identity, passwords or personal information. “Make all new PIN and account passwords different and difficult to guess. Include upper and lower case letters, numbers and symbols to make passwords harder to crack online,” suggested Sunil Sharma, Vice President-Sales and Operations (India & SAARC), Sophos, a global leader in network and endpoint security.

IANS

Tor: The smart person's guide

By Dan Patterson | October 31, 2016, 12:15 PM PST

This comprehensive guide covers everything you need to know about Tor, the onion router web browser that allows users to access the Dark Web and other encrypted websites.

When privacy is outlawed, only outlaws will have privacy. And digital outlawswill probably use Tor. An acronym for 'the onion router', Tor is a free web browser and suite of open source software that enhances user privacy by encrypting web packets and browsing activity.

Tor is complex, yet easy to install and operate. The tool is widely used by reporters, political dissidents, hackers, and Dark Web profiteers to communicate anonymously. Tor enabled the Arab Spring, is used by millions of Chinese users to skirt the Great Firewall, and helps sources and whistleblowers safely share vital information with reporters. Conversely, the encrypted browser also allows hackers to snoop safely, and has helped illicit Dark Web markets flourish.


TechRepublic's smart person's guide is a routinely updated "living" precis loaded with contemporary information about about how the onion router works, who Tor affects, and why privacy-enhancing software is important.
Executive summary
What is it: Though Tor is built on the Firefox open source protocol, it's actually actually a number of integrated technologies. The browser itself carefully mitigates common web tracking tools like cookies and analytics systems. The Tor network is composed of thousands of servers around the world. When a user browses with Tor, web activity and packets are bounced through each server, obfuscating the originating and destination IP address.
Why it matters: As web privacy erodes the Tor foundation argues that the platform helps preserve free speech free thought.
Who it affects: From activists to hackers to Dark Web surfers, many users depend on Tor to protect their identity, and often their lives. Companies and consumers may need Tor to protect sensitive web actions.
When it's happening: The tech powering the onion router was

OurMine hacks Buzzfeed in retaliation for publishing details of alleged member

By Rob Thubron on October 6, 2016, 12:30 PM




You may be familiar with the name OurMine. The group has been responsible for several high-profile hacks of celebrities and some of the most famous CEOs in the tech industry, including Facebook’s Mark Zuckerberg, Google’s Sundar Pichai, and Uber’s Travis Kalanick. Now, the hackers have hit BuzzFeed in retaliation for an article that exposed one of its alleged members.

Joseph Bernstein’s investigation identified Saudi teenager Ahmed Makki as a member of OurMine. The group denied this, claiming he was “just a fan,” but the story appears to have touched a nerve – BuzFeed was hacked the morning after the report, with the titles of several articles changed to “Hacked by OurMine.”

The body of several stories, including Bernstein’s, had the following text added: “Don’t share fake news about us again, we have your database. Next time it will be public. Don’t f**k with OurMine again.”

It’s unclear precisely what database the group is referring to, or what information it contains, though an email to The Guardian from an account associated with the hackers claims it was “Emails, Password Hashes, Usernames.”

There has been no comment from Makki, but OurMine’s website states: “Yesterday Buzzfeed Created a post that we are only 1 member called Ahmed Makki, and we can confirm that we don’t Have a member called ‘Ahmed Makki’ and we are now 4 we were 3 but someone joined, and we hacked it because they are reporting fake news about us.”

“We have a member known as ‘Makki’ But not ahmad makki, and he is not from Saudi Arabia.”

BuzzFeed quickly restored the affected articles, including the original OurMine exposé, back to their original state.

OurMine said the only reason it infiltrates accounts is to show that nobody is secure, using the exposure to advertise its services so people can stay “safe from other hackers.”

Yahoo built software to scan all its customers' emails for US spy agencies

By Rob Thubron on October 5, 2016, 6:15 AM


It seems there’s no end to Yahoo’s problems. Last month, the troubled company admittedthat at least 500 million user accounts had been compromised in a breach that took place in 2014. It claimed “state-sponsored actors” were responsible for the attack, though a security firm disputes this. Now, it’s been revealed that Yahoo secretly built custom software last year that scanned all of its customers’ incoming emails for information provided by US intelligence officials.

The report comes from Reuters’ Joseph Menn, citing three people familiar with the matter.

Yahoo was complying with a classified US government request when it created the scanning tool that searched hundreds of millions of user emails at the behest of the National Security Agency or FBI. The software was searching for a specific string of characters, though it’s unclear exactly what words or phrases it was looking for and what data, if any, Yahoo handed over to the authorities.

When Yahoo’s internal security team discovered the software, they initial thought it was the work of hackers. Company CEO Marissa Mayer’s decision to comply with the demand led to Chief Security Officer Alex Stamos leaving his position to join Facebook in June 2015. Stamos said a programming flaw could have allowed hackers to access the stored emails.

The incident is the first known case of a company agreeing to an agency’s request to scan all arriving emails, rather than probing stored messages or a small number of accounts in real time. "Yahoo is a law-abiding company, and complies with the laws of the United States," the firm said

Smart device malware behind record DDoS attack is now available to all hackers

Credit: Stephen Lawson

Lucian Constantin
IDG News Service
Oct 3, 2016 7:48 AM
The Mirai trojan enslaved over 380,000 IoT devices, its creator claims.

The source code for a trojan program that infected hundreds of thousands of internet-of-things devices and used them to launch distributed denial-of-service attacks has been published online, paving the way for more such botnets.

The code for the trojan, which its creator calls Mirai, was released Friday on an English-language hackers’ forum, cybersecurity blogger Brian Krebs reported over the weekend. Krebs’ website was the target of a record DDoS attack two weeks ago that was launched from the Mirai botnet.

The trojan’s creator, who uses the online handle Anna-senpai, said that the decision to release the source code was taken because there’s a lot of attention now on IoT-powered DDoS attacks and he wants to get out of this business.

Mirai used to enslave around 380,000 IoT devices every day using brute-force Telnet attacks, according to Anna-senpai. However, after the DDoS attack against krebsonsecurity.com, ISPs have started to take action and block compromised devices, so the daily rate of Mirai infections has dropped to 300,000 and is likely to go down even further, the malware writer said.

It’s worth noting that unlike malware infections on desktop computers, infections on IoT and embedded devices are usually temporary and disappear when those devices are rebooted because they use volatile storage. In order to maintain their size, IoT botnets need to find and reinfect devices every single day.

The hijacking of home routers, DSL modems, digital video recorders, network-attached storage systems and other such devices to launch DDoS attacks is not new. For example, in October 2015, security firm Incapsula mitigated a DDoS attack launched from around 900 closed-circuit television (CCTV) cameras.

However, the IoT DDoS botnets seem to have reached their full potential over the past few months. After the unprecedented 620Gbps DDoS attack against Krebs’ website two weeks ago, French server hosting firm OVH was hit with a 799Gbps DDoS attack launched from a botnet of over 140,000 hacked digital video recorders and IP cameras.

Such a large botnet is capable of launching crippling attacks that could easily exceed 1Tbps, the OVH’s CTO warned at the time.

There are very few DDoS mitigation providers in the world who are capable of protecting customers against 1Tbps attacks. Content delivery network Akamai, which also offers DDoS protection services, dropped Krebs as a customer when his website was recently attacked because the attack was too costly to mitigate.

And things are only going to get worse because the market of IoT devices is rapidly expanding and many of these devices come with basic security holes, such as remote administrative interfaces exposed to the Internet and protected with weak credentials that users never change.

The release of Mirai’s source code is very likely to lead to the creation of more IoT botnets, and it wouldn’t be the first time. In early 2015 the source code for LizardStresser, a DDoS bot for Linux systems written by the infamous Lizard Squad attacker group, was released online. As of June this year, security researchers had identified over 100 botnets built using malware based on LizardStresser.

Anyone? Anyone? Hackers find little demand for their stolen NSA hacking tools

Hackers claim to have stolen files that may belong to the NSA. Credit: National Security Agency


Michael Kan
IDG News Service
Oct 3, 2016 12:18 PM
The ShadowBrokers' auction for the hacking tools has so far generated little interest.

The hackers who are auctioning off cyberweapons allegedly stolen from the National Security Agency are growing annoyed and want cash.

The ShadowBrokers' sale of the stolen tools has so far generated little interest, and over the weekend, the hackers complained in a message posted online, using broken English.


"TheShadowBrokers is not being interested in fame. TheShadowBrokers is selling to be making money," the hackers said.

As of Monday, their auction only had one substantial bid at 1.5 bitcoins, or US $918. Many of the other bids were valued at less than $1.

The hackers originally dumped a sample of the stolen hacking tools back in mid-August, and independent security experts later found the tools to actually work. The tools include exploits designed to compromise firewall and router products from Cisco, Juniper Networks, and Fortinet and are probably worth a fortune.

The hackers claim they have more cyber weapons to sell. However, they've taken the unusual step of offering them up through an open online auction relying on bitcoin.

Although anyone can participate, the hackers haven't said when they'll accept the final bid. The hackers also hoped to receive 1 million bitcoins, or $611 million, in exchange for leaking all they stole for free to the public.

The unusual conditions have led some security researchers to suspect the auction is a publicity stunt. But the ShadowBrokers claim in their latest posting that the auction is real, despite "sounding crazy."

"Expert peoples is saying Equation Group Firewall Tool Kit worth $1 million," the group said