Tag: security

Researchers Discover Over 100 Tor Nodes Designed To Spy On Hidden Services

An anonymous reader writes from a report via Schneier on Security: Two researchers have discovered over 100 Tor nodes that are spying on hidden services. Cory Doctorow from Boing Boing reports: “These nodes — ordinary nodes, not exit nodes — sorted through all the traffic that passed through them, looking for anything bound for a hidden service, which allowed them to discover hidden services that had not been advertised. These nodes then attacked the hidden services by making connections to them and trying common exploits against the server-software running on them, seeking to compromise and take them over. The researchers used ‘honeypot’ .onion servers to find the spying computers: these honeypots were .onion sites that the researchers set up in their own lab and then connected to repeatedly over the Tor network, thus seeding many Tor nodes with the information of the honions’ existence. They didn’t advertise the honions’ existence in any other way and there was nothing of interest at these sites, and so when the sites logged new connections, the researchers could infer that they were being contacted by a system that had spied on one of their Tor network circuits. No one knows who is running the spying nodes: they could be run by criminals, governments, private suppliers of ‘infowar’ weapons to governments, independent researchers, or other scholars (though scholarly research would not normally include attempts to hack the servers once they were discovered).” The Tor project is aware of the attack and is working to redesign its system to try and block it. Security firm Bitdefender has issued an alert about a malicious app called EasyDoc that hands over control of Macs to criminals via Tor. Read more of this story at Slashdot.

Read this article:
Researchers Discover Over 100 Tor Nodes Designed To Spy On Hidden Services

Wendy’s Says More Than 1,000 Restaurants Affected By Hack

An anonymous reader writes from a report via ABC News: The fast food giant Wendy’s has reported today that hackers were able to steal customers’ credit and debit card information at 1, 025 of its U.S. restaurants. The company said Thursday hackers were able to obtain card numbers, names, expiration dates and codes on the card, beginning in late fall. Some customers’ cards were used to make fraudulent purchases at other stores. Wendy’s first announced it was investigating a possible hack in January. In May, it found malware in fewer than 300 restaurants; two types of malware were found two months later and the number of restaurants affected was “considerably higher.” There are more than 5, 700 Wendy’s restaurants in the U.S. Customers can check to see which locations were affected via Wendy’s website. The company said it is offering free one-year credit monitoring to people who paid with a card at any of those restaurants. In May, Wendy’s announced plans to start automating all of its restaurants with self-service ordering kiosks. Read more of this story at Slashdot.

View post:
Wendy’s Says More Than 1,000 Restaurants Affected By Hack

Password Sharing Is a Federal Crime, Appeals Court Rules

An anonymous reader writes from a report via Motherboard: An appeals court ruled Wednesday that sharing passwords can be a violation of the Computer Fraud and Abuse Act, a catch-all “hacking” law that has been widely used to prosecute behavior that bears no resemblance to hacking. Motherboard reports: “In this particular instance, the conviction of David Nosal, a former employee of Korn/Ferry International research firm, was upheld by the Ninth Circuit Court of Appeals, who said that Nosal’s use of a former coworker’s password to access one of the firm’s databases was an ‘unauthorized’ use of a computer system under the CFAA. In the majority opinion, Judge Margaret McKeown wrote that ‘Nosal and various amici spin hypotheticals about the dire consequences of criminalizing password sharing. But these warnings miss the mark in this case. This appeal is not about password sharing.’ She then went on to describe a thoroughly run-of-the-mill password sharing scenario — her argument focuses on the idea that Nosal wasn’t authorized by the company to access the database anymore, so he got a password from a friend — that happens millions of times daily in the United States, leaving little doubt about the thrust of the case. The argument McKeown made is that the employee who shared the password with Nosal ‘had no authority from Korn/Ferry to provide her password to former employees.’ At issue is language in the CFAA that makes it illegal to access a computer system ‘without authorization.’ McKeown said that ‘without authorization’ is ‘an unambiguous, non-technical term that, given its plain and ordinary meaning, means accessing a protected computer without permission.’ The question that legal scholars, groups such as the Electronic Frontier Foundation, and dissenting judge Stephen Reinhardt ask is an important one: Authorization from who?” Read more of this story at Slashdot.

See the original post:
Password Sharing Is a Federal Crime, Appeals Court Rules

EasyDoc Malware Adds Tor Backdoor To Macs For Botnet Control

An anonymous reader writes: Security firm Bitdefender has issued an alert about a malicious app that hands over control of Macs to criminals via Tor. The software, called EasyDoc Converter.app, is supposed to be a file converter but doesn’t do its advertised functions. Instead it drops complex malware onto the system that subverts the security of the system, allowing it to be used as part of a botnet or to spy on the owner. “This type of malware is particularly dangerous as it’s hard to detect and offers the attacker full control of the compromised system, ” said Tiberius Axinte, Technical Leader, Bitdefender Antimalware Lab. “For instance, someone can lock you out of your laptop, threaten to blackmail you to restore your private files or transform your laptop into a botnet to attack other devices. The possibilities are endless.” The malware, dubbed Backdoor.MAC.Eleanor, sets up a hidden Tor service and PHP-capable web server on the infected computer, generating a .onion domain that the attacker can use to connect to the Mac and control it. Once installed, the malware grants full access to the file system and can run scripts given to it by its masters.A report on AppleInsider says that malware can also control the FaceTime camera on a victim’s computer. But thankfully, Apple’s Gatekeeper security prevents the unsigned app from being installed. Read more of this story at Slashdot.

See the article here:
EasyDoc Malware Adds Tor Backdoor To Macs For Botnet Control

TP-LINK Loses Control of Two Device Configuration Domains

Reader Orome1 writes: Security researcher Amitay Dan warns that tplinklogin.net, a domain through which TP-LINK router owners can configure their devices, is no longer owned by the company, and that this fact could be misused by malware peddlers. TP-LINK has confirmed that they no longer own the domain in question, and will not be trying to buy it from the unknown seller for now. Instead, they intend to change the domain in the manuals to a newer one that’s already in use.ComputerWorld has more details. Read more of this story at Slashdot.

See the original article here:
TP-LINK Loses Control of Two Device Configuration Domains

Millions of Android devices have flawed full disk encryption

Hackers can use brute force to break into tens of millions of Android devices using full disk encryption, thanks to a series of security issues linked specifically to Android kernel flaws and Qualcomm processors, Neowin reports. The vulnerabilities were uncovered by security researcher Gal Beniamini , who is working with Google and Qualcomm to patch the problems — and some of the flaws have already been addressed. However, a few of the issues may not be patchable, instead requiring new hardware, the report says. Any phone using Android 5.0 or later uses full disk encryption, the same security feature at the heart of Apple’s recent fight with the FBI . Full disk encryption makes all data on a device unrecognizable without a unique key. Even though modern Android devices use this security feature, Beniamini’s research found that an attacker can exploit kernel flaws and vulnerabilities in some of Qualcomm’s security measures to get that encryption key. Then, all that stands between the hacker and a device’s information is a password. Since any attack on an Android device would still require brute force and additional hacking methods, this isn’t an immediate security threat for a majority of users. But, it is notable for those who put their complete trust in full disk encryption. We’ve reached out to Qualcomm for comment on the flaw and will update this story as the company responds. Update: A Qualcomm spokesperson gave Engadget the following comment: “Providing technologies that support robust security and privacy is a priority for Qualcomm Technologies, Inc. (QTI). QTI continues to work proactively both internally as well as with security researchers such as Gal Beniamini to identify and address potential security vulnerabilities. The two security vulnerabilities (CVE-2015-6639 and CVE-2016-2431) discussed in Beniamini’s June 30 blog post were also discovered internally and patches were made available to our customers and partners. We have and will continue to work with Google and the Android ecosystem to help address security vulnerabilities and to recommend improvements to the Android ecosystem to enhance security overall.” Source: Gal Beniamini

More here:
Millions of Android devices have flawed full disk encryption

DMCA Notices Remove 8,268 Projects On Github In 2015

An anonymous reader writes: Github’s transparency report for 2015 shows that the site received many DMCA notices that removed more than 8, 200 projects. “In 2015, we received significantly more takedown notices, and took down significantly more content, than we did in 2014, ” Github reports. For comparison, the company received only 258 DMCA notices in 2014, 17 of which responded with a counter-notice or retraction. In 2015, they received 505 takedown notices, 62 of which were the subject of counters or withdrawals. TorrentFreak reports: “Copyright holders are not limited to reporting one URL or location per DMCA notice. In fact, each notice filed can target tens, hundreds, or even thousands of allegedly infringing locations.” September was a particularly active month as it took down nearly 5, 834 projects. “Usually, the DMCA reports we receive are from people or organizations reporting a single potentially infringing repository. However, every now and then we receive a single notice asking us to take down many repositories, ” Github explains. They are called ‘Mass Removals’ when more than 100 repositories are asked to be removed. “In all, fewer than twenty individual notice senders requested removal of over 90% of the content GitHub took down in 2015.” Read more of this story at Slashdot.

View the original here:
DMCA Notices Remove 8,268 Projects On Github In 2015

New and Improved CryptXXX Ransomware Rakes In $45,000 In 3 Weeks

An anonymous reader writes:Whoever said crime doesn’t pay didn’t know about the booming ransomware market. A case in point, the latest version of the scourge known as CryptXXX, which raked in more than $45, 000 in less than three weeks. Over the past few months, CryptXXX developers have gone back and forth with security researchers. The whitehats from Kaspersky Lab provided a free tool that allowed victims to decrypt their precious data without paying the ransom, which typically reaches $500 or more. Then, CryptXXX developers would tweak their code to defeat the get-out-of-jail decryptor. The researchers would regain the upper hand by exploiting another weakness and so on. Earlier this month, the developers released a new CryptXXX variant that to date still has no decryptor available. Between June 4 and June 21, according to a blog post published Monday by security firm SentinelOne, the Bitcoin address associated with the new version had received 70 bitcoins, which at current prices is valued at around $45, 228. The figure doesn’t include revenue generated from previous campaigns. Read more of this story at Slashdot.

View the original here:
New and Improved CryptXXX Ransomware Rakes In $45,000 In 3 Weeks

Google CEO Sundar Pichai’s Quora Account Hacked

Google CEO Sundar Pichai is the latest high-profile victim of a hacking group called OurMine. Earlier today, the group managed to get hold of Pichai’s Quota account, which in turn, gave them access to his Twitter feed as well. In a statement to The Next Web, the group said that their intention is to just test people’s security, and that they never change the victim’s passwords. Looking at the comments they left after hacking Pichai’s account, it is also clear that OurMine is promoting its security services. The same group recently also hacked Facebook CEO Mark Zuckerberg’s Twitter and Pinterest accounts. Read more of this story at Slashdot.

Read more here:
Google CEO Sundar Pichai’s Quora Account Hacked

Clinton’s private e-mail was blocked by spam filters—so State IT turned them off

Part of an e-mail thread discussing workarounds to keep Hillary Clinton’s private e-mail server from being blocked by security filters at the State Department. 2 more images in gallery Documents recently obtained by the conservative advocacy group Judicial Watch show that in December 2010, then-US Secretary of State Hillary Clinton and her staff were having difficulty communicating with State Department officials by e-mail because spam filters were blocking their messages. To fix the problem, State Department IT turned the filters off—potentially exposing State’s employees to phishing attacks and other malicious e-mails. The mail problems prompted Clinton Chief of Staff Huma Abedin to suggest to Clinton, “We should talk about putting you on State e-mail or releasing your e-mail address to the department so you are not going to spam.” Clinton replied, “Let’s get [a] separate address or device but I don’t want any risk of the personal [e-mail] being accessible.” The mail filter system—Trend Micro’s ScanMail for Exchange 8—was apparently causing some messages from Clinton’s private server (Clintonemail.com) to not be delivered. Some were “bounced;” others were accepted by the server but were quarantined and never delivered to the recipient. According to the e-mail thread published yesterday by Judicial Watch, State’s IT team turned off both spam and antivirus filters on two “bridgehead” mail relay servers while waiting for a fix from Trend Micro. Read 4 remaining paragraphs | Comments

Originally posted here:
Clinton’s private e-mail was blocked by spam filters—so State IT turned them off