Feeds
The Register Columnists

Darren Pauli

Contact Mail Follow Twitter RSS feed

NSA man says agency can track you through POWER LINES

Forensics and industry experts have cast doubt on an alleged National Security Agency capability to locate whistle blowers appearing in televised interviews based on how the captured background hum of electrical devices affects energy grids. Divining information from electrified wires is a known technique: Network Frequency …
Darren Pauli, 03 Jul 2014
Fail and You

VSANs choking on VMware's recommended components

VMware has changed the recipe for its virtual storage area networks after some components it recommended were found out as not being up to the job. Virtzilla's notification of the change says it is being made because some “low-end IO controllers” it once recommended “offer very low IO throughput”. So low, in fact, that “the …
Darren Pauli, 03 Jul 2014
Brazil flag

Brazilian baddies bank Boleto billions

Brazilian bad guys appear to have made an astonishing $US3.75 billion by scraping a tonne of tiny transactions from a popular payment system used by locals, RSA researcher Eli Marcus says. The carders operating a single fraud ring may have netted enough over the last two years to foot 80 percent of Brazil's $4.7 billion World …
Darren Pauli, 03 Jul 2014
blogspot

MONSTER COOKIES can nom nom nom ALL THE BLOGS

Giant cookies could be used to create a denial of service (DoS) on blog networks, says infosec researcher Bogdan Calin. Such an attack would work by feeding users cookies with header values so large that they trigger web server errors. Calin created a proof of concept attack against the Google Blog Spot network after a customer …
Darren Pauli, 02 Jul 2014
EMET

Redmond's EMET defense tool disabled by exploit torpedo

Microsoft's Enhanced Mitigation Toolkit (EMET) tool can be deactivated andbypassed according to Offensive Security researchers. The exploit struck dead the latest standard and updated version 4.1 of EMET designed to make attacks more complex and expensive through the use of Address Space Layout Randomisation and Data Execution …
Darren Pauli, 02 Jul 2014

New Russian law punishes online 'extremism'

Foreign non-Government organisations, football hooligans and possibly even hacktivists could be jailed for six years for creating or sharing unpalatable content online under new anti-extremism laws signed off by Russian President Vladimir Putin on Monday. The laws use a loose definition of "extremism" that Russia Today reports …
Darren Pauli, 01 Jul 2014
Canada Day celebration

Redmond reinstates infosec mailing list after Canadian law panic

Microsoft has resurrected its Lazarus security mailing list, following apparent confusion over Canada's Anti-Spam Law (CASL) that came into effect on July 1st. Redmond reversed an announcement Friday that it would shutter the Advanced Notification Service mailing list which would have forced email fans to get their infosec fix …
Darren Pauli, 01 Jul 2014
 Dummy hand grenades are used by the Marines from the 3rd Low Altitude Air Defense Battalion, for practice before throwing the M-67 Fragment Grenades at the firing range.jpg

Dropbox used as command and control for Taiwan time bomb

A remote access trojan (RAT) is using Dropbox for command and control in a targeted attack against the Taiwanese Government, malware analyst Maersk Menrige says. The upgraded PlugX RAT is the first targeted attack to use Dropbox to update command and control settings, Menrige said, as distinct from other malware and ransomware …
Darren Pauli, 30 Jun 2014
Nuclear bomb image

Zero-knowledge proof crypto scheme divines truths from nothing

Princeton University scientists have applied a cryptographic proof to verify if nuclear weapons have been disarmed, in a move that could reduce global nuke stockpiles and even help verify electronic voting. The cryptographic scheme is a form of zero-knowledge proof first developed in the 1980s. Such proofs allow a party to prove …
Darren Pauli, 30 Jun 2014
Sharing image

ENISA, Europol, strike info-sharing deal

Europe's peak information security body will join forces with the continent's criminal intelligence sharing outift in order to beat down on carders and crackers plaguing Europe. Heads of the European Union Agency for Network and Information Security (ENISA) signed a deal with Europol at the Hague last Thursday to give a …
Darren Pauli, 30 Jun 2014
Spam image

Microsoft to shutter security email feed on July 1

Microsoft will suspend a 12 year-old email mailing list that offers news of security updates, in a decision possibly tied to tougher Canadian anti-spam laws. As of July 1st 2014, sysadmins and infosec bods will get their news from a Redmond RSS feed to receive update of new Microsoft security alerts. "As of July 1, 2014, due to …
Darren Pauli, 29 Jun 2014
Curiosity

NASA's Curiosity rover brought Earth BUG to Mars

A 20 year old bug has been discovered in an algorithm so pervasive it's used in the Mars Curiosity rover, cars, aircraft, Android phones and a string of popular open source wares. The bug can be found in the Lempel-Ziv-Oberhumer (LZO) data compression algorithm created by Markus Oberhumer, who on Wednesday posted a new version 2 …
Darren Pauli, 27 Jun 2014
Blackmail image

Send Bitcoin or we'll hate-spam you on Yelp, say crims

Businesses are being served printed 'Notice of Extortion' letters demanding Bitcoins to avoid 'severe and irreparable' damage to their reputation. A handful of US Pizza restaurants have reported the scam to local newspapers, and to Reddit. The letters appear to come from the same extortionist. The letters demanded payment of …
Darren Pauli, 27 Jun 2014
Fraud image

Half a meellion euros stolen in week-long bank smash 'n' grab

Attackers have pulled off a lucrative lightning raid on a single beleaguered bank stealing half a million euros in a week, Kaspersky researchers say. The crims stole between €17,000 and €39,000 from each of 190 Italian and Turkish bank accounts, with a single continuous attack. Man-in-the-middle attackers used stolen bank login …
Darren Pauli, 26 Jun 2014
Paypal vulnerability

PayPal 2FA mobe flaw chills 'warm and fuzzy' security feeling

Duo Labs video PayPal's second factor authentication (2FA) protection can be mitigated through mobile device interfaces that allow fraudsters to steal funds with a victim's username and password, Duo Security researchers say. The bypass, crimped but not eradicated by client side patches, existed because the PayPal iOS and …
Darren Pauli, 26 Jun 2014

Own goal as World Cup Wi-Fi passwords spilled in newspaper snap

The Wi-Fi SSID and password for the football World Cup's security centre were exposed – after a photograph of host nation Brazil's federal police brass inadvertently captured the creds written on a white board. The snap appeared in newspaper Correio Braziliense, and showed the head of international cooperation Luiz Cravo Dorea …
Darren Pauli, 25 Jun 2014
Patching celebration

Sysadmins rejoice! Patch rampage killing off nasty DDoS attack vector

Sysadmins rejoice! NSFOCUS researchers say hundreds of thousands of Network Time Protocol (NTP) servers have been patched, reducing the threat from some devastating and cheap distributed denial of service (DDoS) attacks. The patching rampage saw the number of vulnerable NTP servers drop from 432,120 at the start of the year to …
Darren Pauli, 25 Jun 2014

SHOCK HORROR: Oz's biggest govt agencies to miss infosec deadline

Australia's largest government agencies will miss a July deadline to implement even basic information security controls. The Australian National Audit Office's (ANAO's) annual report says that the country's biggest government agencies won't deploy Defence-issued controls to implement fast patching and organisation-wide …
Darren Pauli, 25 Jun 2014

Hello?! Converged data centre peeps? Dell likes US too, says VMware

On the day that Nutanix and Dell announced their new relationship, VMware chose to remind world+dog that Dell likes it too by releasing a new list of VSAN Ready Nodes, the disk-packed servers signed off as suitable to run its virtual storage area network. The new list (PDF) of VSAN Ready Nodes is notable for a few reasons. One …
Darren Pauli, 25 Jun 2014
xfinity wifi

Comcast Xfinity evil twin steals subscriptions

A senior security research engineer at LogRhythm Labs has demonstrated how to steal Comcast Xfinity subscriptions by masquerading as a wireless access point. Greg Foss (@Heinzarelli) published code that could be deployed on a Wifi Pineapple to replicate one of Comcast's million customer-run hotspots across the US. Comcast …
Darren Pauli, 24 Jun 2014
openwireless.org

EFF wants you to open your Wi-Fi to IMPROVE privacy

The Electronic Frontier Foundation (EFF) wants internet users to go back to the turn of the century and open their wireless networks for anyone to connect, in order to enhance privacy. The EFF wants us all to use the OpenWireless initiative's free router firmware, which allows users to create open guest networks that anyone in …
Darren Pauli, 24 Jun 2014
Wifi grumpy cat

WiFi WarKitteh and DDoS Dog to stalk DEF CON 22

A security boffin has created a 'WarKitteh' capable of sniffing WiFi packets. Tenacity evil genius researcher Gene Bransfield (@gbransfield) combined a series of garden-variety technologies to evolve the humble house cat into a walking, purring WiFi war machine capable of pawing packets while maintaining enough agility to fight …
Darren Pauli, 23 Jun 2014
Money image

Hackers steal trade secrets from major US hedge firm

Criminals have successfully attacked a hedge fund, delaying trades and stealing profitable secrets in a rare direct raid on the financial services sector, according to BAE Systems Applied Intelligence. The clever hack cost the unnamed US-based hedge fund millions of dollars over two months, the firm alleges. Attackers apparently …
Darren Pauli, 23 Jun 2014
Popvote DDoS

'Most sophisticated DDoS' ever strikes Hong Kong democracy poll

One of the largest and most sophisticated distributed denial of service (DDOS) attacks has hit a controversial online democracy poll canvassing opinion on future Hong Kong elections. Over the weekend some 680,000 people cast votes in the unofficial poll that offered residents of special administrative region to highlight their …
Darren Pauli, 23 Jun 2014
The guts of a Unitrends hardware appliance

32,000 motherboards spit passwords in CLEARTEXT!

Thousands of Supermicro baseboard management controllers (BMCs) continue to spit administrator passwords in cleartext after a patch described as unsuitable was not applied by admins. Accessing the machines could be dead simple for the tech savvy; vulnerable boxes would pop during a net or Shodan scan for port 49152. Any of the …
Darren Pauli, 20 Jun 2014
linkedin logo

LinkedIn ignored SIX WARNINGS about account-hijacking bug

LinkedIn accounts can be hijacked through simple man in the middle (MITM) attacks due to a failure to promptly fix a SSL stripping vulnerability . The flaw described ambitiously as a zero-day vulnerability allowed attackers to gain full control of a user's account after they had logged in via SSL. Attackers could jump between …
Darren Pauli, 20 Jun 2014
Dogecoin

Crooks use Synology NAS boxen to mine Dogecoin, yells Dell

Dell says skilled attackers have made a staggering $620,000 in the Dogecoin crypto-currency by exploiting vulnerable Synology network attached storage (NAS) boxes. The clever hackers pulled off the largest heist of its kind by planting mining gear on the NAS boxes to borrow their computational might - many NAS now boast grunty …
Darren Pauli, 19 Jun 2014
Bitcoin system would kill mammoth mining pools

PoW! Academics KO Bitcoin mining mammoths

Researchers have scuttled Bitcoin mining mammoths such as GHash with a proposed system alteration that would end the money-making collectives and return fairness and stability to the crypto currency. Cornell University academics (@IttalyEyal) Ittay Eyal and Emin Gün Sirer (@el33th4xor) say their "Two Phase Proof of Work (2P-PoW …
Darren Pauli, 19 Jun 2014
Windows XP boot screen

Victorian Police say Redmond's wrong! XP doesn't 'heighten risk'

Victoria Police has defended its continued use of Windows XP until the dying days of 2014, claiming it does not elevate risk. The use of the almost 13 year-old now defunct operating system was revealed in a blue paper which found many officers could not open files in new applications and resorted to printing documents to take …
Darren Pauli, 19 Jun 2014

People will happily run malware if paid ONE CENT – new study

Security white hats, despair: users will run dodgy executables if they are paid as little as one cent. Even more would allow their computers to become infected by botnet software nasties if the price was increased to five or 10 cents. Offer a whole dollar and you'll secure a herd of willing internet slaves. The demoralising …
Darren Pauli, 18 Jun 2014
Lock security

Student promises Java key to unlock Simplocker ransomware

A university student claims he is set to release a Java application to decrypt the first ransomware to hit Android devices. The Simplelocker ransomware was revealed 7 June by malware analysts at Eset targeting devices in Eastern Europe. It encrypted via AES large swathes of files on Android device SD cards demanding users pay a …
Darren Pauli, 17 Jun 2014
NSW automatic number plate recognition

Unregistered car drivers rejoice! Cops kill buggy auto plate recognition

Western Australian police are switching off automatic licence plate recognition scanners because they are detecting too many unregistered vehicles. The scanners were deluging officers with false-positive alerts for unregistered vehicles driven within the 15 day grace period the state offers to allow tardy residents to make late …
Darren Pauli, 17 Jun 2014
slice of pizza

Give us a slice or we BLURT all your users' topping preferences to the WORLD

Web mongrels have hacked Dominos France and Belgium and then demanded €30,000 to prevent the public disclosure today of passwords and pizza preferences of 648,000 consumers. The raid forced the pizza palace to issue an apology on Twitter and suggest users change their passwords passwords which were blended with a unsavoury mix …
Darren Pauli, 16 Jun 2014
IE8 patch

TIME TRAVELLERS needed to secure Windows 7

Microsoft has forced Windows 7 users to apply an April update in order to receive June's patches for its Internet Explorer 11 browser. The demand does not affect users of earlier versions of its flagship browser or operating system. Microsoft did not provide reasons for the move but it appeared to have simplified its patching …
Darren Pauli, 16 Jun 2014
Pandemia

Entirely new trojan quietly wheeled into black hat forums

An RSA researcher claims to have found an entirely new trojan during his trawls of the criminal underground. RSA researcher Eli Marcus says the "Pandemiya" trojan comprises about 25,000 lines of fresh code. With most malware based on proven platforms, entirely new code is a rarity. Pandemiya is nasty: it infects Windows PCs, …
Darren Pauli, 13 Jun 2014
australian credit cards fraud contactless

Hacker claims PayPal loophole generates FREE MONEY

A PayPal loophole can be exploited to earn free cash according to a convicted former NASA hacker turned white hat. Fraudsters can double their money, says Razvan Cernaianu, by funnelling cash into a mule account before filing for a transaction refund. To pull off the rort* a fraudster needs three PayPal accounts. One is a …
Darren Pauli, 13 Jun 2014
Cyber friends - Kiwicon 7

Australia and USA strike closer cyber defence alliance

Australia and the United States will forge tighter bonds in information security defence and incident response on the back of a White House meeting between the nation's leaders. The announcement contained scant detail on the arrangement and came as Prime Minister Tony Abbott and President Barack Obama agreed to new defence deals …
Darren Pauli, 13 Jun 2014
School kids

Kids hack Canadian ATM during LUNCH HOUR

Two Canadian kids have made a mockery of bank security by hacking into an automatic teller machine during a break between classes. The 14 year old duo Caleb Turon and Matthew Hewlett broke into a Bank of Montreal ATM during school lunch by following an online manual for accessing the machine's administrator functions. The …
Darren Pauli, 12 Jun 2014
Ben Gurion University professor Yuval Elovici

Israel develops wireless-malware-injection-by-smartmobe tool

It's not the next Daniel Suarez plot; Israeli academics have developed software they say can use your mobile phone to detect electrical impulses, and foist malware to computers physically disconnected from any internet facing network. Ben Gurion University professor Yuval Elovici told The Times of Israel that his team …
Darren Pauli, 12 Jun 2014

Poison PDF pusher released to public

Attacking enterprises just got easier with the development of an idiot-friendly tool that spits out booby-trapped PDFs with a few clicks. The tool weaves existing exploits into PDFs, allowing attacks against Adobe Reader and Acrobat versions 8.x prior to 8.2.1 and 9.x before 9.3.1. Users can insert their own URL pointers into …
Darren Pauli, 12 Jun 2014
Lights out image

207 thousand lights-out boxes are STILL hackable

Researchers have found 207,000 publicly-accessible Baseboard Management Controllers (BMCs) can be hacked with a "handful" of basic command and config flaws, despite previous warnings about the problem. The exposed devices were found during a global trawl of UDP 623 that netted 230,000 public BMCs, half of which ran holey 13-year …
Darren Pauli, 11 Jun 2014
Cloud security image

AWS breaks silence over Truecrypt's role in data import/export

Amazon Web Services (AWS) has issued some advice on how it uses the kept mum on whether it will dump the troubled TrueCrypt platform used to encrypt data imported and exported to its Simple Storage Service, Amazon EBS snapshots and Glacier cold storage offerings. . The popular crypto platform recently became a pariah after its …
Darren Pauli, 11 Jun 2014
Samsung's 1cm-thick LCD TV

Boob Tube BOFFINS finger Red Button, trigger TELLY MAYHEM

The standards body behind a broadband-powered television system has downplayed talk of dramatic attacks on the security of tens of thousands of smart TVs. Top boffins at Columbia University's Network Security Lab say the "Red Button" exploit could involve drones and roof-mounted aerials deployed to silently target tellies, …
Darren Pauli, 10 Jun 2014
Lehel Marcel Lazar

Four years in chokey for Haxxor behind George W Bush NUDE SELFIES

The Romanian taxi-driver-by-day-hacker-by-night who offended the world by publishing stolen nude self portraits of former US president George W Bush has been sentenced to four years jail. Marcel Lazar Lehel, 42, was arrested in January in Bucharest and sentenced for hacking the email accounts of Romania’s intelligence service …
Darren Pauli, 10 Jun 2014
Cryptowall sucks kid

Bitcoin ransomware racket makes bank

Criminals appear to be pocketing hundreds of thousands of dollars with upgraded Cryptowall ransomware that has encrypted scores of hard drives across Britain, America and Australia demanding victims pay hefty Bitcoin ransoms. The ransomware was foisted on victims through sneaky malvertising through unsuspecting big ticket sites …
Darren Pauli, 10 Jun 2014
windows 7 image

Redmond is patching Windows 8 but NOT Windows 7, say security bods

Microsoft has left Windows 7 exposed by only applying patches to its newest operating systems. Researchers found the gaps after they scanned 900 Windows libraries and uncovered a variety of security functions that were updated in Windows 8 but not in 7. They said the shortcoming could lead to the discovery of zero day …
Darren Pauli, 06 Jun 2014
Data breach image

US Army loses 16,000 personnel records in South Korea

Sensitive information of more than 16,000 US Army personnel stationed in South Korea, plus data on local employees and job applicants, appears to have been compromised after databases loaded with names, identification numbers and addresses were accessed by unauthorised and unknown parties. Specific details of how the 28 May raid …
Darren Pauli, 06 Jun 2014
Left out.

Thanks for nothing, OpenSSL, grumbles stonewalled De Raadt

OpenBSD founder Theo De Raadt said OpenSSL maintainers appeared to have intentionally not informed it about dangerous vulnerabilities found in the platform and patched today. The apparent feud stems from the April break away LibreSSL which was forked after developers found the OpenSSL code base to be unacceptably insecure in the …
Darren Pauli, 06 Jun 2014
Protonet win

German server lockbox scores MEELLION dollar seed-smashing record

Cheers and laughter could be heard late last night through the walls of a small Hamburg office as staff celebrated an unlikely win; their punt to build a NSA-subverting server that encrypts everything a small business might do in the office had made bank with a record-breaking $US1 million in crowdfunding sourced in 89 mins. The …
Darren Pauli, 05 Jun 2014
bitcoin honeypot

Deploy a fake Bitcoin wallet to save your own

Bitcoin con artists have a new enemy with the launch of a managed fake wallet system that baits malware lurking on machines into striking too early. BitcoinVigil was a free pre-fab or custom honeypot that users could deploy onto a machine before using it for Bitcoin transactions. It functioned as a would-be Bitcoin wallet in a …
Darren Pauli, 05 Jun 2014