Password Manager LastPass Got Breached Hard

Found on Wired on Monday, 15 June 2015
Browse Internet

On Monday password manager service LastPass admitted it had been the target of a hack that accessed its users’ email addresses, encrypted master passwords, and the reminder words and phrases that the service asks users to create for those master passwords.

“We are confident that our encryption measures are sufficient to protect the vast majority of users,” LastPass CEO Joe Siegrist wrote in a note to customers. “Nonetheless, we are taking additional measures to ensure that your data remains secure, and users will be notified via email.”

Trust us they say. Store your passwords online they say.

Officials: Second hack exposed military and intel data

Found on The Big Story on Saturday, 13 June 2015
Browse Internet

Hackers linked to China have gained access to the sensitive background information submitted by intelligence and military personnel for security clearances, U.S. officials said Friday, describing a cyberbreach of federal records dramatically worse than first acknowledged.

The forms authorities believed may have been stolen en masse, known as Standard Form 86, require applicants to fill out deeply personal information about mental illnesses, drug and alcohol use, past arrests and bankruptcies. They also require the listing of contacts and relatives, potentially exposing any foreign relatives of U.S. intelligence employees to coercion. Both the applicant's Social Security number and that of his or her cohabitant is required.

They cannot even protect critical information like this and they yet even more monitoring and data collection is wanted?

Report: Hack of government employee records discovered by product demo

Found on Ars Technica on Friday, 12 June 2015
Browse Internet

As officials of the Obama administration announced that millions of sensitive records associated with current and past federal employees and contractors had been exposed by a long-running infiltration of the networks and systems of the Office of Personnel Management on June 4, they claimed the breach had been found during a government effort to correct problems with OPM's security.

According to a Wall Street Journal report, the breach was indeed discovered in April. But according to sources who spoke to the WSJ's Damian Paletta and Siobhan Hughes, it was in fact discovered during a sales demonstration of a network forensics software package.

Of course officials need to say that they discovered this long-running attack because they would look pretty clueless when they admit that a simple test scan of a security software found it.

German parliament cyber-attack still 'live'

Found on BBC News on Thursday, 11 June 2015
Browse Internet

It involved attackers using malicious programs to infect many of the 20,000 machines used by politicians, support staff and civil servants that sit on the Parlakom network.

German newspaper Der Spiegel quoted a parliamentary source who said the malware was still "active" and stealing data from infected machines.

One report suggested that the federal office for computer security (BSI) had said that cleaning up the infection could cost millions of euros and involve replacing all the computers.

How hard can it be to just pull the cable out until everything is cleaned up? Sure, politicians will not be happy but that is completely unimportant if the infection continues to siphon the data to the outside. Furthermore, just replacing all computers won't really help much: some clueless politician finds another USB stick that got "lost" by someone and plugs it in without thinking just to look around a bit, hoping to find something interesting. Voila, re-infected.

Belgium Arrests Two in Probe Over Returning Syria Fighter

Found on Bloomberg on Tuesday, 09 June 2015
Browse Internet

Belgian arrested two suspects and issued arrest warrants against three others following anti-terror raids Monday.

Investigators said earlier they had detained 16 people in the anti-terror raids after working with U.S. authorities to monitor suspects’ communications on WhatsApp Inc.’s messaging service.

So much for WhatsApp's supposedly secure end to end encryption. Obviously it is pretty much useless.

Virty servers' independence promise has been betrayed

Found on The Register on Monday, 08 June 2015
Browse Internet

One of the killer selling points of virtualisation is that when a physical cluster node needed fixing, upgrading or taking out of service it is a trivial matter to just migrate the hosts virtual machines onto another cluster node.

In big business, where everything is change controlled to the smallest degree, changes that require host outages can cost several hundreds of pounds by the time all the work is completed. Failing a piece of work because there was a faux cluster node on the host is seen as a big issue.

There always will be failures. Either your hardware goes down, or the cluster; and even the big players in the business had their outages.

After FBI domain expires, seized Megaupload.com serves up porn

Found on Ars technica on Friday, 29 May 2015
Browse Internet

Based on evidence collected by Ars, it appears someone at the FBI's Cyber Division failed to renew the domain registration for CIRFU.NET, the domain which in turn hosted Web and name servers used to redirect traffic headed to seized domains.

It was over a week before anyone at the FBI contacted GoDaddy. Early on May 24, Gerlach said, "We got a notice of an ongoing criminal investigation regarding malware distribution, which lead to a Terms of Service violation and domain suspension."

Earl Grey was, to say the least, not a very happy GoDaddy customer when he found out about the domain suspension—especially as the suspension also revoked his Domains By Proxy coverage and revealed his registration information through the Whois service.

Not that serving up malware should not be stopped, but GoDaddy has a lot of unhappy customers. Best thing is to avoid them as much as possible.

AdBlock Plus secures another court victory in Germany

Found on BBC News on Wednesday, 27 May 2015
Browse Internet

German broadcasters RTL and ProSiebenSat.1 had argued that browser plug-in was anti-competitive and threatened their ability to offer users content for "free".

A spokeswoman for RTL responded: "We are weighing a possible course of action against the ruling and assessing the prospects of an appeal."

Last month Eyeo successfully defended itself against similar claims by two other German publishers - Die Zeit and Handelsblatt - at a court in Hamburg.

They are just angry because the user has the option to block their annoying popups and ads, something you cannot do when watching TV where you get a 10 minute commercial break for every 20 minutes of a movie, along with in-movie ads that cover a third of the screen. Instead of going to court and try to force users who visit their websites to be buried under ads, the media industry should think ahead. There has to be a reason why people flee to e.g. Netflix; and no, the solution is not to allow even more commercials.

Moose – the router worm with an appetite for social networks

Found on Welivesecurity on Tuesday, 26 May 2015
Browse Internet

ESET researchers have issued a technical paper today, analysing a new worm that is infecting routers in order to commit social networking fraud, hijacking victims’ internet connections in order to “like” posts and pages, “view” videos and “follow” other accounts.

The sad truth is that there are many individuals and companies out there who are keen to manipulate their social media standing, and have no qualms about hiring third-parties who claim to have methods to bump up the number of views of a corporate video, boost the followers on a Twitter feed or get you more Facebook fans.

Even more sad is that there are many individuals and companies who care about something as pointless as likes. Instead of pushing "social media" accounts through the roof, concentrate on what's important: your real friends and your customers.

HTTPS-crippling attack threatens tens of thousands of Web and mail servers

Found on Ars Technica on Wednesday, 20 May 2015
Browse Internet

The weakness is the result of export restrictions the US government mandated in the 1990s on US developers who wanted their software to be used abroad. The regime was established by the Clinton administration so the FBI and other agencies could break the encryption used by foreign entities.

"Logjam shows us once again why it's a terrible idea to deliberately weaken cryptography, as the FBI and some in law enforcement are now calling for," J. Alex Halderman, one of the scientists behind the research, wrote in an e-mail to Ars. "That's exactly what the US did in the 1990s with crypto export restrictions, and today that backdoor is wide open, threatening the security of a large part of the Web."

Thank you America.