Website hackers hijack Google webmaster tools to prolong infections

Found on IT World on Sunday, 13 September 2015
Browse Internet

Hackers who compromise websites are also increasingly verifying themselves as the owners of those properties in Google's Search Console. Under certain circumstances this could allow them to remain undetected longer than they otherwise would be, researchers warn.

If the legitimate owners don't read the notifications and take immediate action, the attackers can actually remove them from the Search Console verification list by deleting their HTML verification files from the server. This will trigger no notifications to the real owners, according to Sucuri senior malware researcher Denis Sinegubko.

Most of those exploited websites exist because people just use standard CMS systems like Wordpress or Joomla and do not bother to keep the system (and all its plugins) updated. Especially plugins give a wrong impression of security if the original author abandoned the project and no more updates are released, despite exploitable bugs.

Vulnerabilities in WhatsApp Web affect 200 million users globally

Found on Net Security on Tuesday, 08 September 2015
Browse Internet

Check Point security researcher Kasif Dekel found that to exploit the vulnerability, an attacker simply needs to send a WhatsApp user a seemingly innocent vCard contact card, containing malicious code. Once opened in WhatsApp Web, the executable file in the contact card can run, further compromising computers by distributing malware including ransomware, bots, remote access tools (RATs), and other types of malicious code.

Starting executables from unknown and random sources should have stopped a decade ago already.

Google ordered to remove links to ‘right to be forgotten’ removal stories

Found on The Guardian on Friday, 21 August 2015
Browse Internet

Google has been ordered by the Information Commissioner’s office to remove nine links to current news stories about older reports which themselves were removed from search results under the ‘right to be forgotten’ ruling.

Deputy commissioner David Smith said: “The European court ruling last year was clear that links prompted by searching on an individual’s name are subject to data protection rules. That means they shouldn’t include personal information that is no longer relevant.”

Maybe someone should tell them that their efforts are pointless because you simply need to run your Google search outside of Europe, eg via a proxy and get full, unfiltered results.

Ashley Madison hack is not only real, it’s worse than we thought

Found on Ars Technica on Wednesday, 19 August 2015
Browse Internet

Researchers are still poring over the unusually large dump, but already they say it includes user names, first and last names, and hashed passwords for 33 million accounts, partial credit card data, street names, and phone numbers for huge numbers of users, records documenting 9.6 million transactions, and 36 million e-mail addresses.

Already, websites are popping up that allow anyone to enter an e-mail address and find out if it was included in the dump. It wouldn't be surprising for the same thing to be done for phone numbers and other data fields. This massive leak isn't likely to end well for huge numbers of people.

That makes you wonder how in the days before the Internet people had affairs. Maybe it was not as easy, but it sure was more secret.

Web users at risk as 600,000 machines continue to run Windows Server 2003

Found on The Inquirer on Saturday, 15 August 2015
Browse Internet

Netcraft, which collated the figures, reckons that 175 million websites are directly served from a Server 2003 computer.

Microsoft's out-of-range support costs a rumoured $600 a machine, so the potential cost for those who ignored the opportunity to get on a migration path in good time is getting huge, whatever they decide to do. µ

The biggest issue is to actually get people to migrate. Many run decade-old quick&dirty scripts, fiddled together by aspiring webmasters back then who started with ASP, or even compiled their own binaries.

Twitter faces lingering doubts about its future

Found on CNet News on Monday, 03 August 2015
Browse Internet

The number of people who log into Twitter at least once a month rose less than 3 percent from the previous quarter.

Shares plunged to a record low of $28.69 in the middle of the trading hours. At the end of day, shares had fallen 5.6 percent to $29.30 -- the lowest since May of last year.

"The bottom line for Twitter is that after nine years of its existence, my mother still doesn't understand what it means to 'hashtag' something," wrote Ben Schachter, an analyst at Macquarie Capital, in a note to investors. "But she does understand what it means to 'like' something," he added, referring to Facebook's ubiquitous feature.

Both mean nothing. Your hashtags and likes are as pointless as your thousands of "followers" or "friends".

Online Cheating Site AshleyMadison Hacked

Found on Krebs On Security on Monday, 20 July 2015
Browse Internet

ALM Chief Executive Noel Biderman confirmed the hack, and said the company was “working diligently and feverishly” to take down ALM’s intellectual property. Indeed, in the short span of 30 minutes between that brief interview and the publication of this story, several of the Impact Team’s Web links were no longer responding.

“Avid Life Media has been instructed to take Ashley Madison and Established Men offline permanently in all forms, or we will release all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails. The other websites may stay online.”

Why people would sign up with their real names makes one wonder. Better come up with a fake name and address, plus a throw-away email account instead because the promised privacy never existed in the first place.

JPEG Looking To Add DRM To Images... Supposedly To Protect Images From Gov't Surveillance

Found on Techdirt on Wednesday, 15 July 2015
Browse Internet

"The JPEG committee investigates solutions to assure privacy and security when sharing photos on social networks, (stock) photography databases, etc. JPEG Privacy & Security will provide new functionality to JPEG encoded images such as ensuring privacy, maintaining data integrity, and protecting intellectual rights, while maintaining backwards and forward compatibility to existing JPEG legacy solutions."

What's interesting is that some are claiming this is based on this research paper that pitches such DRM for the purpose of protecting images from surveillance and such.

Sure future keyboards will come without the PrtScr button to stop image piracy.

Giving Users Extra-Firewall Access For Sites Normally Blocked?

Found on Slashdot on Sunday, 12 July 2015
Browse Internet

My boss and I were having a discussion about our users accessing the internet. He wants the users to be able to log in to the firewall to be able to access external websites that they are normally blocked from accessing. They would get a 45-minute window to do this, and then if they need more time, they need to re-login.

This will seriously annoy users and have a negative impact on the workflow. If the systems require such a protection, the best solution would be to have one (of more) systems specifically for Internet access, isolated from the rest of the network (and with USB disabled so users cannot transfer files they have downloaded).

The Massive OPM Hack Actually Hit 21 Million People

Found on Wired on Friday, 10 July 2015
Browse Internet

“The team has now concluded with high confidence that sensitive information, including the Social Security Numbers (SSNs) of 21.5 million individuals, was stolen from the background investigation databases,” OPM wrote in the statement.

In June, after the hack was first publicly acknowledged, the government said the breach exposed the personal information of approximately four million people—and the information stolen only included data such as Social Security numbers, birth dates and addresses of current and former federal workers.

By now it should be pretty obvious that any sensitive data never should be on an Internet-facing system. If it needs to be stored electronically, use at least air-gapped systems.