digest-golf – Page 73

Spanish police bust alleged “ransomware” ring that took in $1.34M annually

Spanish authorities announced Wednesday that they had arrested 10 people who were allegedly involved in a massive “ransomware” ring. The European Cybercrime Centre estimated that the criminal operation “affected tens of thousands of computers worldwide, bringing in profits in excess of €1 million euros ($1.34 million) per year.” The Spanish Ministry of the Interior described (Google Translate) the lead suspect as a “a 27-year-old citizen of Russian origin who was arrested in December in the United Arab Emirates,” and now awaits extradition to Spain. The newly arrested 10 were linked to the financial cell of the ransomware operation, and include six Russians, two Ukrainians, and two Georgians. The Ministry added that the operation remains “open,” suggesting that more arrests could be forthcoming. (Spanish authorities posted a video (RAR) of the new arrests and raid.) Madrid dubbed the ransomware used by the ring a “police virus” because it throws up a notice that appears to come from law enforcement. The malware requires the user to pay €100 ($134) as a “fine” from a false accusation of accessing child pornography or file-sharing websites. When the victims submit their payment details, European authorities added , the “criminals then go on to steal data and information from the victim’s computer.” Read 7 remaining paragraphs | Comments

Read the original:
Spanish police bust alleged “ransomware” ring that took in $1.34M annually

Zero-day attack exploits latest version of Adobe Reader

FireEye A previously undocumented flaw in the latest version of Adobe Systems’ ubiquitous Reader application is being exploited in online hacks that allow attackers to surreptitiously install malware on end-user computers, a security firm said. The attacks, according to researchers from security firm FireEye, work against Reader 11.0.1 and earlier versions and are actively being exploited in the wild. If true, the attacks are notable because they pierce security defenses Adobe engineers designed to make malware attacks harder to carry out. Adobe officials said they’re investigating the report . “Upon successful exploitation, it will drop two DLLs,” FireEye researchers Yichong Lin, Thoufique Haq, and James Bennett wrote of the online attacks they witnessed. “The first DLL shows a fake error message and opens a decoy PDF document, which is usually common in targeted attacks. The second DLL in turn drops the callback component, which talks to a remote domain.” DLL is the researchers’ shorthand for a file that works with the Microsoft Windows dynamic link library. Read 5 remaining paragraphs | Comments

Taken from:
Zero-day attack exploits latest version of Adobe Reader

Apple releases iOS 6.1.1 for iPhone 4S users with 3G issues (Updated)

Update : Apple has now released the iOS 6.1.1 update mentioned in our original writeup. The update is specifically for the iPhone 4S and “fixes an issue that could impact cellular performance and reliability for iPhone 4S.” This is most likely to address the 3G issues experienced by some users, though it doesn’t sound like iOS 6.1.1 does anything to improve battery life as of yet. Original story : iOS 6.1.1 may be making its way into consumers’ hands sooner than we expected. The first beta of iOS 6.1.1 was only released to Apple’s developer network last week, but the update is reportedly being “rushed” out to customers in order to address 3G performance bugs, according to German iPhone site iFun . It is also said to address other problems like reduced battery life. The software is said to have undergone some carrier testing, though it’s still unclear exactly when Apple plans to publish the update. Read 4 remaining paragraphs | Comments

Original post:
Apple releases iOS 6.1.1 for iPhone 4S users with 3G issues (Updated)

At Facebook, zero-day exploits, backdoor code bring war games drill to life

Aurich Lawson Early on Halloween morning, members of Facebook’s Computer Emergency Response Team received an urgent e-mail from an FBI special agent who regularly briefs them on security matters. The e-mail contained a Facebook link to a PHP script that appeared to give anyone who knew its location unfettered access to the site’s front-end system. It also referenced a suspicious IP address that suggested criminal hackers in Beijing were involved. “Sorry for the early e-mail but I am at the airport about to fly home,” the e-mail started. It was 7:01am. “Based on what I know of the group it could be ugly. Not sure if you can see it anywhere or if it’s even yours.” The e-mail reporting a simulated hack into Facebook’s network. It touched off a major drill designed to test the company’s ability to respond to security crises. Facebook Facebook employees immediately dug into the mysterious code. What they found only heightened suspicions that something was terribly wrong. Facebook procedures require all code posted to the site to be handled by two members of its development team, and yet this script somehow evaded those measures. At 10:45am, the incident received a classification known as “unbreak now,” the Facebook equivalent of the US military’s emergency DEFCON 1 rating. At 11:04am, after identifying the account used to publish the code, the team learned the engineer the account belonged to knew nothing about the script. One minute later, they issued a takedown to remove the code from their servers. Read 31 remaining paragraphs | Comments

Link:
At Facebook, zero-day exploits, backdoor code bring war games drill to life

Data siphoned in Fed reserve hack a “bonanza” for spear phishers

Sensitive details on thousands of banking executives lifted from a hacking involving the Federal Reserve represent a potential “bonanza” for spear phishers looking to snare high-value targets in personalized scam e-mails, a security researcher said. The list is no longer readily available online, but according to Chris Wysopal, CTO of security firm Veracode, it contained details from a Federal Reserve-related database that Anonymous-affiliated hackers claimed to breach on Sunday. It included 31 fields, including home addresses, e-mail addresses, login IDs, and cryptographically hashed passwords. “As you can see, this is a spearphishing bonanza and even a password reuse bonanza for whoever can crack the password hashes,” he wrote in a blog post published on Wednesday. “It doesn’t look like any of these are internal Federal Reserve System accounts as those would have FRS AD UIDs associated with each account. Still, this is about the most valuable account dump by quality I have seen in a while.” Read 2 remaining paragraphs | Comments

View article:
Data siphoned in Fed reserve hack a “bonanza” for spear phishers

How Yahoo allowed hackers to hijack my neighbor’s e-mail account

Reflected XSS vulnerabilities in action Aspect Security When my neighbor called early Wednesday morning, she sounded close to tears. Her Yahoo Mail account had been hijacked and used to send spam to addresses in her contact list. Restrictions had then been placed on her account that prevented her from e-mailing her friends to let them know what happened. In a blog post published hours before my neighbor’s call, researchers from security firm Bitdefender said that the hacking campaign that targeted my neighbor’s account had been active for about a month. Even more remarkable, the researchers said the underlying hack worked because Yahoo’s developer blog runs on a version of the WordPress content management system that contained a vulnerability developers addressed more than eight months ago . My neighbor’s only mistake, it seems, was clicking on a link while logged in to her Yahoo account. As someone who received one of the spam e-mails from her compromised account, I know how easy it is to click such links. The subject line of my neighbor’s e-mail mentioned me by name, even though my name isn’t in my address. Over the past few months, she and I regularly sent messages to each other that contained nothing more than a Web address, so I thought nothing of opening the link contained in Wednesday’s e-mail. The page that opened looked harmless enough. It appeared to be an advertorial post on MSNBC.com about working from home, which is something I do all the time. But behind the scenes, according to Bitdefender, something much more nefarious was at work. Read 9 remaining paragraphs | Comments

To prevent hacking, disable Universal Plug and Play now

Security experts are advising that a networking feature known as Universal Plug and Play be disabled on routers, printers, and cameras, after finding it makes tens of millions of Internet-connected devices vulnerable to serious attack. UPnP, as the feature is often abbreviated, is designed to make it easy for computers to connect to Internet gear by providing code that helps devices automatically discover each other over a local network. That often eliminates the hassle of figuring out how to configure devices the first time they’re connected. But UPnP can also make life easier for attackers half a world away who want to compromise a home computer or breach a business network, according to a white paper published Tuesday by researchers from security firm Rapid7. Over a five-and-a-half-month period last year, the researchers scanned every routable IPv4 address about once a week. They identified 81 million unique addresses that responded to standard UPnP discovery requests, even though the standard isn’t supposed to communicate with devices that are outside a local network. Further scans revealed 17 million addresses exposed UPnP services built on the open standard known as SOAP, short for simple object access protocol. By broadcasting the service to the Internet at large, the devices can make it possible for attackers to bypass firewall protections. Read 5 remaining paragraphs | Comments

Review: Microsoft Office 365 Home Premium Edition hopes to be at your service

Office 365 Home Premium Edition’s lineup of software, ready to stream to your PC today. Today, Microsoft releases Office 2013—the first full release of Microsoft’s latest-generation productivity suite for consumers. Office 2013 has already made a partial debut on Microsoft’s Windows RT tablets, though RT users will get a (slight) refresh with the full availability of the suite. The company gave consumers an open preview of Office last summer, which we reviewed in depth at the time of the suite’s announcement. So there aren’t any real surprises in the final versions of the applications being releasing today, at least as far as how they look and work. Today’s release, however, marks the first general availability of Microsoft’s new subscription model under the Office 365 brand the company has used for its hosted mail and collaboration services for businesses. While the applications in Office are being offered in a number of ways, Microsoft is trying hard to steer consumer customers to Office 365 Home Premium Edition, a service-based version of the suite that will sell for $100 a year. And just as Windows 8’s app store started to fill up as the operating system approached release, the same is true of Office’s own app store—an in-app accessible collection of Web-powered functionality add-ons for many of the core Office applications based on the same core technologies (JavaScript and HTML5) that power many of Windows 8’s interface-formerly-known-as-Metro apps. Now, the trick is getting consumers to buy into the idea of Office as a subscription service and embracing Microsoft’s Office “lifestyle,” instead of something they buy once and hold onto until their computers end up in the e-waste pile. Read 28 remaining paragraphs | Comments

Visit site:
Review: Microsoft Office 365 Home Premium Edition hopes to be at your service

Grammar badness makes cracking harder the long password

Comparison of the size of password search space when treating the password as a sequence of characters or words, or as words generated by grammatical structure. Rao,et al. When it comes to long phrases used to defeat recent advances in password cracking, bigger isn’t necessarily better, particularly when the phrases adhere to grammatical rules. A team of Ph.D. and grad students at Carnegie Mellon University and the Massachusetts Institute of Technology have developed an algorithm that targets passcodes with a minimum number of 16 characters and built it into the freely available John the Ripper cracking program. The result: it was much more efficient at cracking passphrases such as “abiggerbetter password” or “thecommunistfairy” because they followed commonly used grammatical rules—in this case, ordering parts of speech in the sequence “determiner, adjective, noun.” When tested against 1,434 passwords containing 16 or more characters, the grammar-aware cracker surpassed other state-of-the-art password crackers when the passcodes had grammatical structures, with 10 percent of the dataset cracked exclusively by the team’s algorithm. The approach is significant because it comes as security experts are revising password policies to combat the growing sophistication of modern cracking techniques which make the average password weaker than ever before . A key strategy in making passwords more resilient is to use phrases that result in longer passcodes. Still, passphrases must remain memorable to the end user, so people often pick phrases or sentences. It turns out that grammatical structures dramatically narrow the possible combinations and sequences of words crackers must guess. One surprising outcome of the research is that the passphrase “Th3r3 can only b3 #1!” (with spaces removed) is one order of magnitude weaker than “Hammered asinine requirements” even though it contains more words. Better still is “My passw0rd is $uper str0ng!” because it requires significantly more tries to correctly guess. Read 9 remaining paragraphs | Comments

View article:
Grammar badness makes cracking harder the long password

MP3 files written as DNA with storage density of 2.2 petabytes per gram

The general approach to storing a binary file as DNA, described in detail below. Goldman et al., Nature It’s easy to get excited about the idea of encoding information in single molecules, which seems to be the ultimate end of the miniaturization that has been driving the electronics industry. But it’s also easy to forget that we’ve been beaten there—by a few billion years. The chemical information present in biomolecules was critical to the origin of life and probably dates back to whatever interesting chemical reactions preceded it. It’s only within the past few decades, however, that humans have learned to speak DNA. Even then, it took a while to develop the technology needed to synthesize and determine the sequence of large populations of molecules. But we’re there now, and people have started experimenting with putting binary data in biological form. Now, a new study has confirmed the flexibility of the approach by encoding everything from an MP3 to the decoding algorithm into fragments of DNA. The cost analysis done by the authors suggest that the technology may soon be suitable for decade-scale storage, provided current trends continue. Trinary encoding Computer data is in binary, while each location in a DNA molecule can hold any one of four bases (A, T, C, and G). Rather than using all that extra information capacity, however, the authors used it to avoid a technical problem. Stretches of a single type of base (say, TTTTT) are often not sequenced properly by current techniques—in fact, this was the biggest source of errors in the previous DNA data storage effort. So for this new encoding, they used one of the bases to break up long runs of any of the other three. Read 9 remaining paragraphs | Comments

Continued here:
MP3 files written as DNA with storage density of 2.2 petabytes per gram

Ken May

Tag: digest-golf