‘Very High Level of Confidence’ Russia Used Kaspersky Software For Devastating NSA Leaks

bricko shares a report from Yahoo Finance: Three months after U.S. officials asserted that Russian intelligence used popular antivirus company Kaspersky to steal U.S. classified information, there are indications that the alleged espionage is related to a public campaign of highly damaging NSA leaks by a mysterious group called the Shadow Brokers. In August 2016, the Shadow Brokers began leaking classified NSA exploit code that amounted to hacking manuals. In October 2017, U.S. officials told major U.S. newspapers that Russian intelligence leveraged software sold by Kaspersky to exfiltrate classified documents from certain computers. (Kaspersky software, like all antivirus software, requires access to everything stored on a computer so that it can scan for malicious software.) And last week the Wall Street Journal reported that U.S. investigators “now believe that those manuals [leaked by Shadow Brokers] may have been obtained using Kaspersky to scan computers on which they were stored.” Members of the computer security industry agree with that suspicion. “I think there’s a very high level of confidence that the Shadow Brokers dump was directly related to Kaspersky … and it’s very much attributable, ” David Kennedy, CEO of TrustedSec, told Yahoo Finance. “Unfortunately, we can only hear that from the intelligence side about how they got that information to see if it’s legitimate.” Read more of this story at Slashdot.

See more here:
‘Very High Level of Confidence’ Russia Used Kaspersky Software For Devastating NSA Leaks

Devs Working To Stop Go Math Error Bugging Crypto Software

Richard Chirgwin, writing for The Register: Consider this an item for the watch-list, rather than a reason to hit the panic button: a math error in the Go language could potentially affect cryptographic libraries. Security researcher Guido Vranken (who earlier this year fuzzed up some bugs in OpenVPN) found an exponentiation error in the Go math/big package. Big numbers — particularly big primes — are the foundation of cryptography. Vranken posted to the oss-sec mailing list that he found the potential issue during testing of a fuzzer he wrote that “compares the results of mathematical operations (addition, subtraction, multiplication, …) across multiple bignum libraries.” Vranken and Go developer Russ Cox agreed that the bug needs specific conditions to be manifest: “it only affects the case e = 1 with m != nil and a pre-allocated non-zero receiver.” Read more of this story at Slashdot.

More here:
Devs Working To Stop Go Math Error Bugging Crypto Software

Accenture left four servers of sensitive data completely unprotected

UpGuard has yet again uncovered a trove of corporate data left unprotected, this time from major consulting and management firm Accenture . The data — contained on four cloud-based storage servers — were discovered by UpGuard Director of Cyber Risk Research Chris Vickery in mid-September and weren’t protected by a password. Anyone with the servers’ web addresses could download the stored information, which included decryption keys, passwords and customer info. And Accenture’s client list includes a number of large companies. On its website , Accenture says its clients “span the full range of industries around the world and include 94 of the Fortune Global 100 and more than three-quarters of the Fortune Global 500.” UpGuard says that the information stored on the unprotected servers could have been used to attack Accenture itself as well as a number of its clients and Vickery told ZDNet that the data amounted to the “keys to the kingdom.” In a blog post about the exposure, UpGuard said, “Taken together, the significance of these exposed buckets is hard to overstate. In the hands of competent threat actors, these cloud servers, accessible to anyone stumbling across their URLs, could have exposed both Accenture and its thousands of top-flight corporate customers to malicious attacks that could have done an untold amount of financial damage.” This data exposure is just the latest to be sniffed out by cybersecurity firm UpGuard. Other recent discoveries by the company include Election Systems & Software’s exposure of 1.8 million Chicago residents’ personal information, Deep Root Analytics’ leak of nearly 200 million US citizens’ data, the release of 14 million Verizon customers’ info by Nice Systems and exposure of classified intelligence data by a US defense contractor. In light of these repeated mishandlings of sensitive data, it’s becoming increasing clear that major companies need to take a serious look at their cybersecurity practices. UpGuard quickly notified Accenture after discovering the exposed data and the company secured the servers soon thereafter. Accenture also said that UpGuard was the only non-authorized visitor to access the servers. Accenture told ZDNet , “We closed the exposure when the Amazon Web Services S3 issue was first reported. As we continue our forensic review we may learn more but, the email and password information in the database is more than two and a half years old and for Accenture users of a decommissioned system.” Source: UpGuard

Read the article:
Accenture left four servers of sensitive data completely unprotected

Apple Announces New 10.5-Inch iPad Pro With Narrower Side Bezels, 120Hz Refresh Rate Display

At WWDC 2017 today, Apple unveiled a brand new iPad Pro with a 10.5-inch display and 40% narrower bezels. The new iPad features a 50% brighter True Tone display and “ProMotion” technology which increase refresh rates up to 120hz. 9to5Mac reports: The new iPad Pro includes dynamic refresh rate adjustments, screens move from 24hz to 48hz to 120hz. This maximizes battery life and performance, when you need it. The A10x Fusion chip improves CPU and GPU by at least 40%. Cameras have also been upgraded with the same sensor as the iPhone 7 on the back and the front. Apple demoed a photo app called “Affinity Photo, ” to demonstrate the 120hz refresh rates. Apple says new iPad Pro performance compares favorably with a desktop computer. This includes incredibly fast selections and fluid Apple Pencil interactions. Both iPad models start with 64GB of memory and maxes out to 500GB at the high-end. There are also several new software features for iPad, coming this fall with iOS 11: A new customizable Dock that provides quick access to frequently used apps and documents from any screen; Improved multitasking, including a redesigned app switcher that brings Spaces to iOS, making it easier to move between apps or pairs of active apps, used in Split View and now Slide Over; Multi-Touch Drag and Drop, which is available across the system to move text, photos and files from one app to another, anywhere on the screen; A new document scanner in Notes, which lets users easily scan single or multi-page documents, removes shadows and uses powerful image filters to enhance readability; and Deeper integration with Apple Pencil, with support for inline drawing to write along text in Notes and Mail, Instant Markup to easily sign documents, annotate PDFs or draw on screenshots, and a new Instant Notes feature, which opens Notes from the Lock Screen by simply tapping Apple Pencil on the display. New searchable handwriting makes it easy to search for handwritten text or characters. Read more of this story at Slashdot.

View post:
Apple Announces New 10.5-Inch iPad Pro With Narrower Side Bezels, 120Hz Refresh Rate Display

Trump Signs Executive Order On Cybersecurity

President Trump on Thursday signed a long-delayed executive order on cybersecurity that “makes clear that agency heads will be held accountable for protecting their networks, and calls on government and industry to reduce the threat from automated attacks on the internet, ” reports The Washington Post. From the report: Picking up on themes advanced by the Obama administration, Trump’s order also requires agency heads to use Commerce Department guidelines to manage risk to their systems. It commissions reports to assess the country’s ability to withstand an attack on the electric grid and to spell out the strategic options for deterring adversaries in cyberspace. [Thomas Bossert, Trump’s homeland security adviser] said the order was not, however, prompted by Russia’s targeting of electoral systems last year. In fact, the order is silent on addressing the security of electoral systems or cyber-enabled operations to influence elections, which became a significant area of concern during last year’s presidential campaign. The Department of Homeland Security in January declared election systems “critical infrastructure.” The executive order also does not address offensive cyber operations, which are generally classified. This is an area in which the Trump administration is expected to be more forward-leaning than its predecessor. Nor does it spell out what type of cyberattack would constitute an “act of war” or what response the attack would invite. “We’re not going to draw a red line, ” Bossert said, adding that the White House does not “want to telegraph our punches.” The order places the defense secretary and the head of the intelligence community in charge of protecting “national security” systems that operate classified and military networks. But the secretary of homeland security will continue to be at the center of the national plan for protecting critical infrastructure, such as the electric grid and financial sector. Read more of this story at Slashdot.

Continued here:
Trump Signs Executive Order On Cybersecurity

Trump Signs Executive Order On Cybersecurity

President Trump on Thursday signed a long-delayed executive order on cybersecurity that “makes clear that agency heads will be held accountable for protecting their networks, and calls on government and industry to reduce the threat from automated attacks on the internet, ” reports The Washington Post. From the report: Picking up on themes advanced by the Obama administration, Trump’s order also requires agency heads to use Commerce Department guidelines to manage risk to their systems. It commissions reports to assess the country’s ability to withstand an attack on the electric grid and to spell out the strategic options for deterring adversaries in cyberspace. [Thomas Bossert, Trump’s homeland security adviser] said the order was not, however, prompted by Russia’s targeting of electoral systems last year. In fact, the order is silent on addressing the security of electoral systems or cyber-enabled operations to influence elections, which became a significant area of concern during last year’s presidential campaign. The Department of Homeland Security in January declared election systems “critical infrastructure.” The executive order also does not address offensive cyber operations, which are generally classified. This is an area in which the Trump administration is expected to be more forward-leaning than its predecessor. Nor does it spell out what type of cyberattack would constitute an “act of war” or what response the attack would invite. “We’re not going to draw a red line, ” Bossert said, adding that the White House does not “want to telegraph our punches.” The order places the defense secretary and the head of the intelligence community in charge of protecting “national security” systems that operate classified and military networks. But the secretary of homeland security will continue to be at the center of the national plan for protecting critical infrastructure, such as the electric grid and financial sector. Read more of this story at Slashdot.

More:
Trump Signs Executive Order On Cybersecurity

Trump Signs Executive Order On Cybersecurity

President Trump on Thursday signed a long-delayed executive order on cybersecurity that “makes clear that agency heads will be held accountable for protecting their networks, and calls on government and industry to reduce the threat from automated attacks on the internet, ” reports The Washington Post. From the report: Picking up on themes advanced by the Obama administration, Trump’s order also requires agency heads to use Commerce Department guidelines to manage risk to their systems. It commissions reports to assess the country’s ability to withstand an attack on the electric grid and to spell out the strategic options for deterring adversaries in cyberspace. [Thomas Bossert, Trump’s homeland security adviser] said the order was not, however, prompted by Russia’s targeting of electoral systems last year. In fact, the order is silent on addressing the security of electoral systems or cyber-enabled operations to influence elections, which became a significant area of concern during last year’s presidential campaign. The Department of Homeland Security in January declared election systems “critical infrastructure.” The executive order also does not address offensive cyber operations, which are generally classified. This is an area in which the Trump administration is expected to be more forward-leaning than its predecessor. Nor does it spell out what type of cyberattack would constitute an “act of war” or what response the attack would invite. “We’re not going to draw a red line, ” Bossert said, adding that the White House does not “want to telegraph our punches.” The order places the defense secretary and the head of the intelligence community in charge of protecting “national security” systems that operate classified and military networks. But the secretary of homeland security will continue to be at the center of the national plan for protecting critical infrastructure, such as the electric grid and financial sector. Read more of this story at Slashdot.

Read More:
Trump Signs Executive Order On Cybersecurity

Up To 1.4M More Fake Wells Fargo Accounts Possible

An anonymous reader quotes the Bay Area Newsgroup: Wells Fargo may have opened as many as 3.5 million bogus bank accounts without its customers’ permission, attorneys for customers suing the bank have alleged in a court filing, suggesting the bank may have created far more fake accounts than previously indicated. The plaintiffs’ new estimate of bogus bank accounts is about 1.4 million, or 67%, higher than the original estimate — disclosed last year as part of a settlement with regulators — that up to 2.1 million accounts were opened without customers’ permission… The attorneys covered a period from 2002 to 2017, rather than the previously scrutinized five-year stretch from 2011 to some time in 2016 in which the bank acknowledged setting up unauthorized accounts. Wells Fargo terminated 5, 300 employees for creating fake accounts, and their CEO now acknowledges that “we had an incentive program and a high-pressure sales culture within our community bank that drove behavior that many times was inappropriate and inconsistent with our values.” In a possibly-related story, Wells Fargo plans to shut 450 branches over the next two years. Read more of this story at Slashdot.

Link:
Up To 1.4M More Fake Wells Fargo Accounts Possible

Up To 1.4M More Fake Wells Fargo Accounts Possible

An anonymous reader quotes the Bay Area Newsgroup: Wells Fargo may have opened as many as 3.5 million bogus bank accounts without its customers’ permission, attorneys for customers suing the bank have alleged in a court filing, suggesting the bank may have created far more fake accounts than previously indicated. The plaintiffs’ new estimate of bogus bank accounts is about 1.4 million, or 67%, higher than the original estimate — disclosed last year as part of a settlement with regulators — that up to 2.1 million accounts were opened without customers’ permission… The attorneys covered a period from 2002 to 2017, rather than the previously scrutinized five-year stretch from 2011 to some time in 2016 in which the bank acknowledged setting up unauthorized accounts. Wells Fargo terminated 5, 300 employees for creating fake accounts, and their CEO now acknowledges that “we had an incentive program and a high-pressure sales culture within our community bank that drove behavior that many times was inappropriate and inconsistent with our values.” In a possibly-related story, Wells Fargo plans to shut 450 branches over the next two years. Read more of this story at Slashdot.

See original article:
Up To 1.4M More Fake Wells Fargo Accounts Possible

Up To 1.4M More Fake Wells Fargo Accounts Possible

An anonymous reader quotes the Bay Area Newsgroup: Wells Fargo may have opened as many as 3.5 million bogus bank accounts without its customers’ permission, attorneys for customers suing the bank have alleged in a court filing, suggesting the bank may have created far more fake accounts than previously indicated. The plaintiffs’ new estimate of bogus bank accounts is about 1.4 million, or 67%, higher than the original estimate — disclosed last year as part of a settlement with regulators — that up to 2.1 million accounts were opened without customers’ permission… The attorneys covered a period from 2002 to 2017, rather than the previously scrutinized five-year stretch from 2011 to some time in 2016 in which the bank acknowledged setting up unauthorized accounts. Wells Fargo terminated 5, 300 employees for creating fake accounts, and their CEO now acknowledges that “we had an incentive program and a high-pressure sales culture within our community bank that drove behavior that many times was inappropriate and inconsistent with our values.” In a possibly-related story, Wells Fargo plans to shut 450 branches over the next two years. Read more of this story at Slashdot.

View post:
Up To 1.4M More Fake Wells Fargo Accounts Possible