NSA-Leaking Shadow Brokers Just Dumped Its Most Damaging Release Yet

An anonymous reader quotes a report from Ars Technica: The Shadow Brokers — the mysterious person or group that over the past eight months has leaked a gigabyte worth of the National Security Agency’s weaponized software exploits — just published its most significant release yet. Friday’s dump contains potent exploits and hacking tools that target most versions of Microsoft Windows and evidence of sophisticated hacks on the SWIFT banking system of several banks across the world. Friday’s release — which came as much of the computing world was planning a long weekend to observe the Easter holiday — contains close to 300 megabytes of materials the leakers said were stolen from the NSA. The contents (a convenient overview is here) included compiled binaries for exploits that targeted vulnerabilities in a long line of Windows operating systems, including Windows 8 and Windows 2012. It also included a framework dubbed Fuzzbunch, a tool that resembles the Metasploit hacking framework that loads the binaries into targeted networks. Independent security experts who reviewed the contents said it was without question the most damaging Shadow Brokers release to date. One of the Windows zero-days flagged by Hickey is dubbed Eternalblue. It exploits a remote code-execution bug in the latest version of Windows 2008 R2 using the server message block and NetBT protocols. Another hacking tool known as Eternalromance contains an easy-to-use interface and “slick” code. Hickey said it exploits Windows systems over TCP ports 445 and 139. The exact cause of the bug is still being identified. Friday’s release contains several tools with the word “eternal” in their name that exploit previously unknown flaws in Windows desktops and servers. Read more of this story at Slashdot.

Read this article:
NSA-Leaking Shadow Brokers Just Dumped Its Most Damaging Release Yet

Former Sysadmin Accused of Planting ‘Time Bomb’ In Company’s Database

An anonymous reader writes: Allegro MicroSystems LLC is suing a former IT employee for sabotaging its database using a “time bomb” that deleted crucial financial data in the first week of the new fiscal year. According to court documents, after resigning from his job, a former sysadmin kept one of two laptops. On January 31, Patel entered the grounds of the Allegro headquarters in Worcester, Massachusetts, just enough to be in range of the factory’s Wi-Fi network. Allegro says that Patel used the second business-use laptop to connect to the company’s network using the credentials of another employee. While connected to the factory’s network on January 31, Allegro claims Patel, who was one of the two people in charge of Oracle programming, uploaded a “time bomb” to the company’s Oracle finance module. The code was designed to execute a few months later, on April 1, 2016, the first week of the new fiscal year, and was meant to “copy certain headers or pointers to data into a separate database table and then to purge those headers from the finance module, thereby rendering the data in the module worthless.” The company says that “defendant Patel knew that his sabotage of the finance module on the first week of the new fiscal year had the maximum potential to cause Allegro to suffer damages because it would prevent Allegro from completing the prior year’s fiscal year-end accounting reconciliation and financial reports.” Read more of this story at Slashdot.

Continue reading here:
Former Sysadmin Accused of Planting ‘Time Bomb’ In Company’s Database

The iPhone 7 Has Arbitrary Software Locks That Prevent Repair

Jason Koebler, reporting for Motherboard: Apple has taken new and extreme measures to make the iPhone unrepairable. The company is now using software locks to prevent independent repair of specific parts of the phone. Specifically, the home buttons of the iPhone 7 and iPhone 7 Plus are not user replaceable, raising questions about both the future repairability of Apple products and the future of the thriving independent repair industry. The iPhone 7 home button will only work with the original home button that it was shipped with; if it breaks and needs to be replaced, a new one will only work if it is “recalibrated” in an Apple Store. Read more of this story at Slashdot.

Continue reading here:
The iPhone 7 Has Arbitrary Software Locks That Prevent Repair

The Biggest Misconceptions About VPNs

Have you heard? Internet service providers want to sell your data and a virtual private network (VPN) is the best way to tell them to shove off . There’s a problem though. VPNs are notoriously shady, are more complicated than they look, they’re unregulated, and can be more of a security risk than they’re worth if you… Read more…

See the original post:
The Biggest Misconceptions About VPNs

Companies Start Implanting Microchips Into Workers’ Bodies

A Swedish start-up called Epicenter is offering to implant its employees and start-up members with microchips that function as swipe cards, allowing them to open doors, operate equipment or buy food and drinks with a wave of the hand. While these microchips have been available for decades, the technology has never been implanted in humans on such a broad scale. “Epicenter and a handful of other companies are the first to make chip implants broadly available, ” reports Associated Press. From the report: [A]s with most new technologies, it raises security and privacy issues. Although the chips are biologically safe, the data they generate can show how often employees come to work or what they buy. Unlike company swipe cards or smartphones, which can generate the same data, people cannot easily separate themselves from the chips. Epicenter, which is home to more than 100 companies and roughly 2, 000 workers, began implanting workers in January 2015. Now, about 150 workers have the chips. A company based in Belgium also offers its employees such implants, and there are isolated cases around the world in which tech enthusiasts have tried them out in recent years. The small implants use near-field communication technology, or NFC, the same as in contactless credit cards or mobile payments. When activated by a reader a few inches away, a small amount of data flows between the two devices via electromagnetic waves. The implants are “passive, ” meaning they contain information that other devices can read, but cannot read information themselves. Ben Libberton, a microbiologist at Stockholm’s Karolinska Institute, says hackers could conceivably gain huge swaths of information from embedded microchips. The ethical dilemmas will become bigger the more sophisticated the microchips become. Epicenter workers stage monthly events where attendees can receive the implant. Read more of this story at Slashdot.

Read the original:
Companies Start Implanting Microchips Into Workers’ Bodies

Hackers Claim Access To 300 Million iCloud Accounts, Demand $75,000 From Apple To Delete the Cache of Data

A hacker or group of hackers calling themselves the “Turkish Crime Family” claim they have access to at least 300 million iCloud accounts, and will delete the alleged cache of data if Apple pays a ransom by early next month. Motherboard is reporting that the hackers are demanding “$75, 000 in Bitcoin or Ethereum, another increasingly popular crypto-currency, or $100, 000 worth of iTunes gift cards in exchange for deleting the alleged cache of data.” From the report: The hackers provided screenshots of alleged emails between the group and members of Apple’s security team. One also gave Motherboard access to an email account allegedly used to communicate with Apple. “Are you willing to share a sample of the data set?” an unnamed member of Apple’s security team wrote to the hackers a week ago, according to one of the emails stored in the account. (According to the email headers, the return-path of the email is to an address with the @apple.com domain). The hackers also uploaded a YouTube video of them allegedly logging into some of the stolen accounts. The hacker appears to access an elderly woman’s iCloud account, which includes backed-up photos, and the ability to remotely wipe the device. Now, the hackers are threatening to reset a number of the iCloud accounts and remotely wipe victim’s Apple devices on April 7, unless Apple pays the requested amount. According to one of the emails in the accessed account, the hackers claim to have access to over 300 million Apple email accounts, including those use @icloud and @me domains. However, the hackers appear to be inconsistent in their story; one of the hackers then claimed they had 559 million accounts in all. The hackers did not provide Motherboard with any of the supposedly stolen iCloud accounts to verify this claim, except those shown in the video. Read more of this story at Slashdot.

Originally posted here:
Hackers Claim Access To 300 Million iCloud Accounts, Demand $75,000 From Apple To Delete the Cache of Data

This Nest Security Flaw Is Remarkably Dumb

The internet has made it supremely easy to install connected security cameras wherever you want. Unfortunately for Nest, that easy connectivity makes it simple for hackers to disable its cameras with just a few keystrokes. And that’s a very bad feature for a security camera. Read more…

View post:
This Nest Security Flaw Is Remarkably Dumb

Email scheme stole $100 million from two US tech companies

It’s tempting to assume that technology workers are intelligent enough to avoid email fraud , but that’s not always the case. Both the FBI and the state of New York have charged a Lithuanian man, Evaldas Rimasauskas, with perpetrating a phishing campaign that siphoned $100 million away from two US tech companies companies. They’re both choosing to remain unnamed, although one is a “multinational online social media company” — you can probably whip up a short list of candidates based on that description. The scheme wasn’t particularly complicated, either, and mostly relied on less-than-attentive employees. Between 2013 and 2015 (possibly earlier), Rimasauskas allegedly ran a fake company in Latvia that had the same name as an “Asian-based computer hardware manufacturer.” He used this bogus firm to fool victims into responding to phishing emails, getting them to wire millions of dollars to his bank accounts in Latvia and Cyprus. The fraudster quickly spread the money to accounts elsewhere in the world (including Lithuania, Hong Kong, Hungary and Slovakia), and even sent forged documents to the banks to convince them that the large sums of money were legitimate. If the charges (which include wire fraud, identity theft and money laundering) hold up, Rimasaukas faces stiff punishment. He’s looking at a minimum of 2 years in prison if he’s found guilty of identity theft, and each of the remaining charges could get him up to 20 years behind bars. However, it’s also safe to say that his targets are learning a hard lesson, too. Even the most tech-savvy companies can fall prey to online fraud, and they may need to step up their security measures (including staff education) to prevent similar incidents. Source: Department of Justice

Original post:
Email scheme stole $100 million from two US tech companies

Edge, VMWare, Safari, And Ubuntu Linux Hacked at Pwn2Own 2017

The 10th annual Pwn2Own hacking competition ended Friday in Vancouver. Some of the highlights: Ars Technica reports one team “compromised Microsoft’s heavily fortified Edge browser in a way that escapes a VMware Workstation virtual machine it runs in… by exploiting a heap overflow bug in Edge, a type confusion flaw in the Windows kernel and an uninitialized buffer vulnerability in VMware.” Digital Trends reports “Samuel Grob and Niklas Baumstark used a number of logic bugs to exploit the Safari browser and eventually take root control of the MacOS on a MacBook Pro, [and] impressed onlookers even more by adding a custom message to the Touch Bar which read: “pwned by niklasb and saelo.”Ubuntu 16.10 Linux was also successfully attacked by exploiting a flaw in the Linux 4.8 kernel, “triggered by a researcher who only had basic user access but was able to elevate privileges with the vulnerability to become the root administrative account user…” reports eWeek. “Chaitin Security Research Lab didn’t stop after successfully exploiting Ubuntu. It was also able to successfully demonstrate a chain of six bugs in Apple Safari, gaining root access on macOS.”Another attacker “leveraged two separate use-after-free bugs in Microsoft Edge and then escalated to SYSTEM using a buffer overflow in the Windows kernel.” None of the attendees registered to attempt an attack on the Apache Web Server on Ubuntu 16.10 Linux, according to eWeek, but the contest’s blog reports that “We saw a record 51 bugs come through the program. We paid contestants $833, 000 USD in addition to the dozen laptops we handed out to winners. And, we awarded a total of 196 Master of Pwn points.” Read more of this story at Slashdot.

Read more here:
Edge, VMWare, Safari, And Ubuntu Linux Hacked at Pwn2Own 2017

Some Hackers Figured Out How to Take Control of Any WhatsApp Account

Security researchers just announced the discovery of major vulnerabilities in WhatsApp and Telegram, two popular messaging apps with end-to-end encryption, when used in an internet browser. In related news, you can use WhatsApp and Telegram in an internet browser. Read more…

See more here:
Some Hackers Figured Out How to Take Control of Any WhatsApp Account