Italian cryptocurrency exchange BitGrail loses $170 million

One of the biggest problems with cryptocurrency exchanges is that they’re a juicy, enticing target for high-tech criminals. Case in point, Italian exchange BitGrail, which lost $170 million worth of Nano tokens, a little-known digital coin previously called RaiBlocks. BitGrail is the second exchange that lost of massive amount of money this year — and it’s only February — following Tokyo-based Coincheck, which lost between $400 and $534 million worth of coins in a cyberattack on its internet-connected wallet back in January. BitGrail announced on its website that it lost $170 million to fraudulent transactions and that it has already reported them to authorities. It has suspended all withdrawals and deposits “in order to conduct further verifications.” However, unlike Coincheck, which promised to give users their money back, BitGrail founder Francesco “The Bomber” Firano announced on Twitter that there’s no way to refund 100 percent of what users lost. While BitGrail’s loss is in no way as massive as Mt. Gox’s , it’s still steeped in controversy. The Nano team said that they have no “reason to believe the loss was due to an issue in the Nano protocol” and that the “problems appear to be related to BitGrail’s software.” They also published a copy of their conversation with the exchange’s founder and said that Franceso suggested they modify the ledger to cover his losses. It doesn’t help that BitGrail recently required users to verify their accounts to be able to withdraw their coins beyond a certain amount, and some people have reportedly been waiting for verification since December. More recently, the exchange announced that it would no longer serve non-EU users due to what it said are legal complications. Team Nano wrote in their latest statement: “We now have sufficient reason to believe that Firano has been misleading the Nano Core Team and the community regarding the solvency of the BitGrail exchange for a significant period of time.” On Twitter, Francesco said Nano’s claims are nothing but “unfounded allegations.” He added that he told the police that the Nano team published their private convo, which could compromise the investigation. In the wake of the unfounded accusations made against me by the dev team and of the dissemination of private conversations that compromise police investigations, Bitgrail s.r.l. is forced to contact the police in order to protect its rights and users — Francesco The Bomber (@bomberfrancy) February 10, 2018 NANO on BitGrail have been stolen. Unfortunately there is no way to give it back to you at 100% (we only got 4 MLN XRN right now). The devs, as you have guessed, dont want to collaborate — Francesco The Bomber (@bomberfrancy) February 9, 2018 Source: The Wall Street Journal

See more here:
Italian cryptocurrency exchange BitGrail loses $170 million

What happened to Las Vegas shooter’s hard drive? It’s a mystery

Enlarge / Vehicles drive past a Las Vegas billboard featuring a Federal Bureau of Investigation tip line number on Interstate 515. On October 1, Stephen Paddock killed 58 people and injured more than 450 after he opened fire on a large crowd at the Route 91 Harvest country music festival. (credit: Drew Angerer/Getty Images) Local and federal investigators still have not come up with a motive that sparked a Nevada man to commit one of the deadliest mass shootings in American history. More than three weeks after Stephen Paddock opened fire and killed 58 people and wounded hundreds of others attending a country music festival below his Las Vegas hotel room, authorities appear stumped about uncovering a critical piece of information—Paddock’s hard drive—that could potentially lead them to other suspects. Stephen Paddock. (credit: Facebook ) Some madmen leave behind manifestos of sorts, like the one from Theodore Kaczynski, the Unabomber. His 35,000-word manifesto railing against technology  paved the way for his 1996 arrest after his brother, David, realized it was written by his sibling. Paddock, who killed himself in his Mandalay Bay hotel room after the October 1 shooting rampage, hasn’t left any hint of a motive to explain his murders. The FBI is currently examining computers and cellphones in the FBI’s lab in Quantico tied to the Paddock case. However, a hard drive in a laptop found in the shooter’s hotel room is now missing, according to The Associated Press . Read 8 remaining paragraphs | Comments

See the original post:
What happened to Las Vegas shooter’s hard drive? It’s a mystery

Equifax may have been hacked again (updated)

When Equifax’s interim CEO penned a letter of apology on The Wall Street Journal , he admitted that it will take a lot of effort to regain people’s trust. Unfortunately, the company still seems to be lacking when it comes to security, because according to Ars Technica , it’s been hacked yet again. Independent security analyst Randy Abrams told Ars that he was redirected to hxxp:centerbluray.info and was met with a Flash download when he went to equifax.com to contest a false info on his credit report. The fake Flash installer apparently tricks people into downloading what Symantec identifies as Adware.Eorezo , an adware that inundates Internet Explorer with advertisements. Unfortunately, we can’t replicate the problem, but Abrams said he encountered the issue on three separate visits and captured one of them on video: We reached out to Equifax to ask whether the company has already cleaned up the adware downloader. To be safe, though, don’t click on any random Flash installer that pops up when you visit the agency’s website in the near future. Update: Equifax says its IT and security teams are looking into the issue, but while the investigation is in progress, the page has been taken offline. The company plans to share more information as it becomes available. Source: Ars Technica

More:
Equifax may have been hacked again (updated)

Yahoo’s 2013 hack impacted all 3 billion accounts

Last year Yahoo (now part of Oath along with AOL after its acquisition by Verizon) announced that back in 2013, hackers had stolen info covering over one billion of its accounts . Today, the combined company announced that further investigation reveals the 2013 hack affected all of its accounts that existed at the time — about three billion. The information taken “may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers.” For users being notified of the hack now, the notification is that their information is included. At the time the breach was first announced, Yahoo required everyone who had not reset their passwords since the breach to do so. According to the FAQ posted, it doesn’t appear there’s any new action being taken. The announcement isn’t very specific about why or how it determined the breach was so much larger — or how it was missed in the original forensic analysis, or how this happened in the first place — likely due to pending lawsuits over the issue. Subsequent to Yahoo’s acquisition by Verizon, and during integration, the company recently obtained new intelligence and now believes, following an investigation with the assistance of outside forensic experts, that all Yahoo user accounts were affected by the August 2013 theft. While this is not a new security issue, Yahoo is sending email notifications to the additional affected user accounts. The investigation indicates that the user account information that was stolen did not include passwords in clear text, payment card data, or bank account information. The company is continuing to work closely with law enforcement. Source: Oath , Yahoo FAQ

See the original article here:
Yahoo’s 2013 hack impacted all 3 billion accounts

Pakistan’s Prime Minister resigns following Fontgate scandal

Fontgate strikes again. Pakistan’s prime minister Nawaz Sharif has stepped down following a Supreme Court order disqualifying him from holding office. The ruling also called for anti-corruption cases against Sharif and his family. After proving pivotal to the probe that led to today’s decision, Microsoft’s Calibri font could also make an appearance in the next stage of proceedings. The innocent typeset was dragged into the turmoil in Pakistan last month. Back then, Sharif’s daughter (and heir apparent) Maryam Nawaz was accused of submitting forged documents to the Supreme Court-instituted panel probing her family’s financial assets. In its report, the investigation team said the documents from 2006 were deemed fake because they were in the Calibri font — which wasn’t publicly available until 2007. Moments after the panel’s findings were released, the internet (being the internet) blew up with jokes about #Fontgate. The Pakistani Twitterverse latched on to the term, using it to lampoon Sharif and his aides. The media also got in on the act, even going so far as to interview Calibri’s creator Lucas De Groot. And, arguably, the best result to come from it all: a reference to the investigation made it on to the font’s Wikipedia page . Fast-forward to today’s historic decision. Alongside the PM’s dismissal, Pakistan’s Supreme Court has ordered the country’s anti-corruption body to file references against Sharif and others. The evidence collected by the original investigative panel (including that document) will be used in the subsequent cases in accountability courts. As it currently stands, Pakistan is left without a PM, and is also set to lose its finance minister (who was also disqualified in today’s order). Sharif’s ruling party, which holds the majority in parliament, will now choose his successor. Whoever takes over won’t be in for an easy ride. Not a single PM in Pakistan’s history has served a full term in office.

Excerpt from:
Pakistan’s Prime Minister resigns following Fontgate scandal

Acer penalized $115k for leaving credit card info unprotected

It wasn’t nearly as bad as Yahoo leaking 500 million users’ data, but Acer had its own hacking scare last year. Back in June, the Taiwanese computer manufacturer admitted that somebody stole credit card information for nearly 35, 000 individuals who bought from the company’s online store. The electronics giant finally settled with the New York Attorney General’s office to the tune of $115, 000 in penalties along with an assurance to shore up their digital security. During their investigation, the attorney general’s office discovered that Acer’s technical support had made serious security errors. First, they left Acer’s e-commerce platform in debugging mode from July 2015 until April 2016. This setting stores all data transferred through the website in an unencrypted, plain-text log file. Then they misconfigured the company website to allow directory browsing by any unauthorized user. At least one hacking group noticed and stole data between November 2015 and April 2016. This amounted to leaked legal names, usernames and passwords, physical addresses and credit card numbers with verification codes for over 35, 000 individuals in the US, Canada and Puerto Rico. Thankfully, the haul didn’t include social security numbers, but it’s still a painful security snafu from a known computer brand. Source: New York Attorney General’s office

Read More:
Acer penalized $115k for leaving credit card info unprotected

Obama pardons Stuxnet leak source James Cartwright

Chelsea Manning isn’t the only source of online leaks to get a new lease on life. President Obama has pardoned General James Cartwright, who pleaded guilty to lying to the FBI when it investigated leaks that revealed details of Stuxnet , the US-backed malware that sabotaged Iran’s nuclear program . He had denied slipping out classified details to two New York Times reporters (including book author David Sanger) in a 2012 interview with the Bureau, only to be caught out later on. He had been facing up to 5 years in prison and was due to be sentenced the same day as the pardon. At the moment, it’s not certain why Cartwright is receiving the pardon. He was the Vice Chairman of the Joint Chiefs of Staff from his nomination in 2007 through to his retirement from Marine Corps service in 2011, but he wasn’t Obama’s golden boy. Cartwright was denied the top Chairman spot in 2011 in part because of questions surrounding his staff management practices, including an alleged (though never punished) “unduly familiar relationship” with a female Captain. One theory is that the outgoing White House administration wants to put a lid on discussion of Stuxnet. The Washington Post claimed that the investigation into Cartwright ran aground when officials realized they might have to confirm details of the malware in order to secure a conviction. That would have been particularly problematic at the time, when the US was negotiating the eventual Iranian nuclear shutdown agreement — did it really want to admit to a cyberattack at such a critical moment? We wouldn’t rule out any motivations at this point, but the guilty plea and pardon might spare the government from disclosing secrets. Via: Charlie Savage (Twitter) Source: White House

More:
Obama pardons Stuxnet leak source James Cartwright

FBI says DNC wouldn’t give it direct access to hacked servers

The FBI has spent months trying to persuade people that Russia was behind the DNC hack , but we’re now learning that it didn’t get much help from the DNC itself. The bureau tells Buzzfeed News that the Democrats’ organization reportedly “rebuffed” multiple requests for physical access to the hacked servers, forcing investigators to depend on the findings of the third-party security firm CrowdStrike (which the DNC contacted after the hack). The FBI would have tackled the breach earlier if the DNC hadn’t “inhibited” the investigation, according to its statement. The claims directly contradict earlier claims from the DNC, which maintained that the FBI had never asked for access. The DNC says it handed over CrowdStrike info “without any limits, ” but that’s not very reassuring when the Committee wouldn’t let FBI agents skip the middleman. It doesn’t look good even if there were innocuous reasons. Does the FBI need direct access to the servers to scrutinize the information? Not necessarily. As The Verge observes after consulting with security firms, this arrangement is still business as usual for interactions with law enforcement: private firms conduct the initial study and clear the security threat, while official investigators focus on the actions they should take as a result. And so long as CrowdStrike can supply the raw server data, the FBI doesn’t need in-person access to double-check conclusions. Moreover, the FBI was already suspicious of Russian involvement well before CrowdStrike got involved, and had access to information that a private company wouldn’t see. This isn’t to let the FBI off the hook. It still has to trust that CrowdStrike is both accurate and divulging everything it can. Also, the bureau’s most recent report on the hack include mistakes (such as listing “malicious” internet addresses that include Tor exit nodes, which doesn’t really say anything). And while multiple intelligence agencies are pointing the finger at Russia , there’s no publicly available smoking gun that will sway you if you’re skeptical. One thing’s for sure: the he-said-she-said between the FBI and DNC will have to be addressed if both sides are going to remove doubt that Russia was to blame. LATEST: FBI says they asked DNC for servers, and DNC refused, “inhibited” the investigation. pic.twitter.com/AfkAPlJsYZ — Ali Watkins (@AliWatkins) January 5, 2017 Source: BuzzFeed News , The Verge , Ali Watkins (Twitter)

View the original here:
FBI says DNC wouldn’t give it direct access to hacked servers

EU Commission: Apple must repay its $14.5b Irish tax break

The European Commission has ruled that Apple was given up to €13 billion ($14.5 billion) in an illegal sweetheart tax deal with the Irish government. The amount of money involved here dwarfs the EU antitrust penalties handed out to Google, Microsoft and others, but this is effectively a backdated tax bill, rather than a fine. Officials opened the investigation into Apple’s tax affairs back in 2013 and soon found that the agreement that it had signed with Ireland was illegal . The Commission says that because the deal gave Apple a “significant advantage” over its competition, the iPhone maker must now be prepared to pay back “illegal state aid” over the ten-year period before it began investigating its tax practices. Officials say that amount totals around €13 billion (from between 2003 and 2014) and that interest must also be accounted for. That could mean an additional €1-2 billion could be bolted onto that figure. “Member States cannot give tax benefits to selected companies – this is illegal under EU state aid rules. The Commission’s investigation concluded that Ireland granted illegal tax benefits to Apple, which enabled it to pay substantially less tax than other businesses over many years, ” says Commissioner Margrethe Vestager. “In fact, this selective treatment allowed Apple to pay an effective corporate tax rate of 1 per cent on its European profits in 2003 down to 0.005 per cent in 2014.” The story began way back in 1991 when Apple signed a deal with the Irish government that enabled it to use a very specific type of tax loophole. This loophole was called a ” double Irish ” and, very simply, allowed Apple to split profits, paying almost nothing in the process. It’s quite a successful system, and in 2014, Apple was able to stash two-thirds of its global income in this tax haven. It’s not just Europe that feels that Apple’s corporate tax affairs are too shady, with Senator Carl Levin criticizing the company back in 2013. He wrote a lengthy report ( .PDF ) saying that Apple had negotiated an effective tax rate of less than two percent in Ireland. In the US, by comparison, it would have been expected to at least pay 15 percent. But sweetheart deals are in violation with the principles of the free market, which the European Union has sought to uphold. Countries are barred from offering secret handouts to give local players an unfair advantage over the competition. This is classified as “state aid, ” and is illegal in the eyes of the commission. The US won’t agree with the ruling, given that it feels that any tax Apple owes should go to the treasury. Tim Cook himself has said that he feels that where you ” create value is the place where you are taxed .” The implication being that the only place Apple should be on the hook for tax is in the US, even though much of that value is created in Foxconn’s Chinese factories. But, then again, it’s not as if the US currently benefits from Apple’s largesse, either. The company has been very open about the fact that it has roughly $230 billion stashed in overseas bank accounts that it refuses to repatriate. Cook justifies this by saying that the cost of returning money to the US is too high — shaking out to a tax rate of almost 40 percent, or $92 billion. An investigation over at Forbes revealed that Apple recently hired a Washington lobby firm to push for a corporate tax holiday, even though such a program has been proven not to work. Apple and the Irish government are likely to appeal the ruling. Daniel Cooper contributed to this report. Source: Europa

Read the original post:
EU Commission: Apple must repay its $14.5b Irish tax break

Feds Charged With Stealing Money During Silk Road Investigation

Two former federal agents have been charged for stealing money while working on the investigation into the Silk Road, the infamous online drug marketplace that was seized in 2013. Read more…

More:
Feds Charged With Stealing Money During Silk Road Investigation