Security > More stories

17

Insurers hurl sueball at Trustwave over 2008 Heartland megabreach

Security services firm Trustwave has been sued by insurers in America over the 2008 hacking of US payment processing biz Heartland. Lexington Insurance Company and Beazley Insurance Company allege Trustwave was "negligent" in failing to detect a SQLi attack, suspicious network activity, and malware associated with Heartland's …
John Leyden, 10 Jul 2018
Open barn door
16

It's mid-year report time, let's see how secure corporate networks are. Spoiler alert: Not at all

Companies are still leaving basic security flaws and points of entry wide open for hackers to exploit. This according to research from security house Positive Technologies, which says that its penetration testers found that enterprises were rife with things like months-old unpatched vulnerabilities and unsecured access points …
Shaun Nichols, 10 Jul 2018
spying
16

Evil third-party screens on smartphones are able to see all that you poke

Smartphone hackers can glean secrets by analysing touchscreen user interactions, according to new research. Boffins from Ben-Gurion University in Israel have shown it's possible to impersonate a user by tracking touch movements on smartphones with compromised third-party touchscreens, whether they're sending emails, conducting …
John Leyden, 10 Jul 2018

Brown pants moment for BlueJeans: Dozens of AV tools scream its vid chat code is malware

Programmers at videoconferencing software house BlueJeans have been living through a developer's nightmare the past month or so – antivirus packages falsely labeling their code as malware. A Register reader, who works in corporate IT administration, tipped us off over the weekend that the software had triggered virus alerts on …
Shaun Nichols, 10 Jul 2018

Malware-slinging scum copied D-Link's code-signing certificates to dress up PC nasties

Security researchers have warned that someone's obtained copies of code-signing certificates from two Taiwanese companies – and is using them to sign malware. Abusing code-signing certificates in this way is an attempt to present software nasties as the legitimate product of the vendor whose key signed it. Security vendor …
Yellow land crab
36

Microsoft might not support Windows XP any more, but GandCrab v4.1 ransomware does

Miscreants have developed the first strain of ransomware worm capable of infecting legacy systems, such as Windows XP and 2003. The infamous WannaCry outbreak, which severely affected the UK's NHS, showed just how much damage ransomware can do. 74 countries hit by NSA-powered WannaCrypt ransomware backdoor: Emergency fixes …
John Leyden, 09 Jul 2018
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock
128

Cops suspect Detroit fuel station was hacked before 10 drivers made off with 2.3k 'free' litres

Updated Police suspect that high-tech thieves may have hacked into a Detroit petrol station before stealing about 600 US gallons (+-2,300 litres) of fuel. Fox News affiliate WJBK reported that the clerk was unable to shut off a pump that dispensed free fuel for 90 minutes. Ten vehicles took advantage of the security hole to fuel up …
John Leyden, 09 Jul 2018
A coffee cup and hand writing in notebook
117

Leatherbound analogue password manager: For the hipster who doesn't mind losing everything

News reaches us that will leave password management outfits quaking in their boots. The Conran Shop has a solution for forgetful users, and it is a snip at a mere £22. Users need to remember a bewildering array of passwords just to get through an average day, which can lead to some pretty shoddy practices as revealed in the …
Richard Speed, 09 Jul 2018
Hacker with face obscured, wearing a hoodie,  works in front of a bank of monitors. photo by Shutterstock

Web biz DomainFactory confirms: We were hacked in January 2018

Updated German hosting company DomainFactory has taken down its forums after someone posted messages alleging to have compromised the company's computers. Acknowledging the attack, the GoDaddy-owned (via Host Europe, acquired in 2016) company has advised customers to change their passwords and detailed the extent of the data breach …
Data breach
11

Nostalgic social network 'Timehop' loses data from 21 million users

A service named “Timehop” that claims it is “reinventing reminiscing” – in part by linking posts from other social networks – probably wishes it could go back in time and reinvent its own security, because it has just confessed to losing data describing 21 million members and can’t guarantee that the perps didn’t slurp private …
Simon Sharwood, 09 Jul 2018
No running sign
34

Fitness app Polar even better at revealing secrets than Strava

+Comment Online investigations outfit Bellingcat has found that fitness tracking kit-maker Polar reveals both the identity and daily activity of its users - including soldiers and spies. Many users of Polar's devices and app appear not to have paid attention to their privacy settings, as a result a Bellingcat writer found 6,460 …
Drowning in a smartphone
73

Snooping passwords from literally hot keys, China's AK-47 laser, malware, and more

Roundup The week surrounding America's "Huzzah, we kicked out the Brits, and will now spell color any way we like" Day, on July 4, is traditionally one of the slowest periods in the annual business tech news cycle. IT security, on the other hand, never rests. We've covered Google cracking down on non-HTTPS sites, Fortnite cheats …
Iain Thomson, 07 Jul 2018
Coal miners
11

Japanese cryptominer slapped with suspended sentence

A Japanese man has received a suspended sentence for using a cryptominer in a failed attempt to turn an illicit profit. Masato Yasuda, 24, was told he'd be jailed for a year if he reoffended in the next three years over a scam that earned him just £34. The case is thought be the first criminal prosecution over so-called …
John Leyden, 06 Jul 2018
27

Welsh firm fined £60k for pummelling phones with 270k pay-day loan texts

A Welsh firm has been handed a £60,000 fine for spamming more than 270,000 pay-day loan texts around Christmas 2016. The UK's data protection watchdog doled out the penalty to STS Commercial Limited – which is registered as an IT service provider – after finding that the biz didn't have consent to send the messages, which …
Rebecca Hill, 06 Jul 2018
shutterstock_mobile_theft_648

NSO Group bloke charged with $50m theft of government malware

A former worker at NSO Group – the Israeli biz infamous for selling zero-day exploits to governments nice and nasty – has been charged with stealing his employer's spyware, and trying to sell it for $50m on the black market. The 38-year-old former bod was reportedly told he was going to be fired by his bosses at NSO, and …
Iain Thomson, 06 Jul 2018
coders

Don't fear 1337 exploits. Sloppy mobile, phishing defenses a much bigger corp IT security threat

AppSec EU IT admins should focus on the fundamentals of network security, rather than worry about sophisticated state-sponsored zero-day attacks, mobile security expert Georgia Weidman told London's AppSec EU conference on Thursday. Weidman, founder and CTO of mobile security testing firm Shevirah, cut her teeth in the industry six …
John Leyden, 05 Jul 2018
Image by Maksim Kabakouhttp://www.shutterstock.com/pic-362745248/stock-photo-privacy-concept-broken-shield-on-wall-background.html
20

Windows 10's defences are pretty robust these days, so of course folk are trying to break them

Hackers have been experimenting with a newly discovered technique to commandeer Windows 10 boxes. The approach, revealed at the start of June, relies on abusing Windows Settings files (.SettingContent-ms), an XML file type introduced in Windows 10. The technology allows users to create "shortcuts" to various Windows settings …
John Leyden, 05 Jul 2018
IDF
23

Cyber boffins drill into World Cup cyber honeypot used to cyber lure Israeli soldiers

Security researchers have unpicked mobile apps and spyware that infected the mobile devices of Israeli military personnel in a targeted campaign which the state has claimed Hamas was behind. Earlier this week, Israeli military security officials revealed that hackers whom they claim were Hamas-affiliated* had installed spyware …
John Leyden, 05 Jul 2018
The City of London Magistrates' Court. Pic: Chris Dorney/Shutterstock
17

UK.gov: New London courthouse will focus on crimes of a cyber nature

London is to get a new court building, billed as a legal centre for tackling cyber and online economic crimes. The courthouse, to be built on the site of Fleetbank House, just off the capital's Fleet Street, will have 18 courtrooms and house the Business and Property Court list of the High Court's Chancery Division. In …
Gareth Corfield, 05 Jul 2018
Nerd thinking, image via Shutterstock
54

Things that make you go hmmm: Do crypto key servers violate GDPR?

Cryptographic key servers are in "direct violation" of the EU's General Data Protection Regulation, a software developer has claimed. Michael Drahony (AKA yakamok) has written a program (on GitHub) designed to highlight the potential compliance issues posed by use of PGP as an email encryption utility. "Currently you cannot …
John Leyden, 05 Jul 2018
Young guy facepalms while holding a laptop
27

Gentoo GitHub repo hack made possible by these 3 rookie mistakes

The developers of Gentoo Linux have revealed how it was possible for its GitHub organization account to be hacked: someone deduced an admin’s password – and perhaps that admin ought not to have had access to the repos anyway. The distro’s wiki has added a page describing the SNAFU. It describes the root cause of the cockup as …
Simon Sharwood, 05 Jul 2018
15

Thunderbird gets its EFAIL patch

Thunderbird has pushed code with fixes for a dozen security vulnerabilities – including the EFAIL encryption mess that emerged in May. The EFAIL-specific fixes address two errors in Thunderbird's handling of encrypted messages: CVE-2018-12372, in which an attacker can build S/MIME and PGP decryption oracles in HTML messages; …
spy_eye_648
38

Chrome, Firefox pull very unstylish Stylish invasive browser plugin

Firefox and Chrome have removed a browser extension from their stores following revelations it was phoning home with users' web-surfing histories. The "Stylish" plug-in gained popularity because it let users configure sites' appearance, rather than accepting the designers' decisions. However – stop us if you've heard this one …
Clinton/Gore 1992 Buscapade campaign tour in Athens, Texas. Pic by Joseph Sohm/Shutterstock
47

Bill Clinton's cyber-attack novel: The airport haxploit-blockbuster you knew it would be

Book review The Register has read the The President Is Missing by Bill Clinton and James Patterson so you don't have to. Don't say we never do anything for you... Bill Clinton’s foray into co-authoring a novel is an awkward hybrid of cyber thriller and reflections on the loneliness and responsibility of high political office. The …
John Leyden, 04 Jul 2018
Chris Roberts at Cyber Week (photo: John Leyden)
140

'Plane Hacker' Roberts: I put a network sniffer on my truck to see what it was sharing. Holy crap!

Interview "Plane Hacker" Chris Roberts has called for countries to pressure manufacturers into improving the lamentable state of transportation security. Cars are turning into computers on wheels and airplanes have become flying data centres, but this increase in power and connectivity has largely happened without designing in adequate …
John Leyden, 04 Jul 2018
plasters cover arm. photo by shutterstock

Huawei enterprise comms kit has a TLS crypto bug

Huawei has rolled patches to various enterprise and broadcast products to fix a cryptography bug. In late 2017 (inferred from the bug's Common Vulnerabilities and Exposures entry, CVE-2017-17174, which was reserved in December), the company discovered some products had an insecure encryption algorithm. The flaw could allow a …
A hand outstretched from the water - asking for help...
18

Hands up if you didn't lose data in the Typeform breach

The list of organisations notifying customers that they're affected by the Typeform data breach continues to grow – and at least one victim has publicly claimed the breached backup data was unencrypted. Australian bakery chain Bakers Delight, “beyond banking” outfit Revolut, the Australian Republican Movement, data platform …
Facebook CEO Mark Zuckerberg
30

Four US govt agencies poke probe in Facebook following more 'oops, we spilled your data' shocks

No less than four federal agencies in the US are now investigating Facebook following yet more revelations over how it gave vast quantities of personal data to developers. As well as the Department of Justice, the Federal Trade Commission (FTC), the FBI, and America's financial watchdog the Securities and Exchange Commission ( …
Kieren McCarthy, 03 Jul 2018
Oh no, photo via Shutterstock
121

Google Chrome update to label HTTP-only sites insecure within WEEKS

A looming deadline – now less than three weeks away – means that Google Chrome users who visit unencrypted websites will be confronted with warnings. From July, Chrome will name and shame insecure HTTP websites READ MORE The changes will come for surfers once Chrome 68 stable updates go live on 23 July. After then, any web …
John Leyden, 03 Jul 2018
Woman in hospital (in hospital gown) covers face with hands
71

'Coding' cockup blamed for NHS cough-up of confidential info against patients' wishes

Confidential information on 150,000 NHS patients has been distributed against their wishes for years due to a "coding error" by healthcare software supplier TPP. NHS Digital, the body that oversees the healthcare service's use of data, fessed up to the bungle – which saw data on the affected patients used in ways they had …
Rebecca Hill, 03 Jul 2018
Leak
36

Budget hotel chain, UK political party, Monzo Bank, Patreon caught in Typeform database hack

More entities affected by the computer security breach at web form and survey company Typeform have come forward, including budget hotel chain Travelodge and UK political party the Liberal Democrats. The survey-as-a-service biz discovered on 27 June that an intruder had accessed files from a "partial backup" dated 3 May …
Paul Kunert, 03 Jul 2018
fortnite
37

Smash-hit game Fortnite is dangerous... for cheaters: Tools found laced with malware

Free third-person slaughter-fest Fortnite has attracted more than 100 million players – but many of them are falling foul to malware infections as they try to beat other players. Since last week, game streaming shop Rainway noticed an increasing number of alarms popping up on its security logs, and was at first rather puzzled …
Iain Thomson, 03 Jul 2018
Hand pulls on a latex rubber glove (disposable). Photo by shutterstock

Dr Symantec offers quick and painless checkup for VPNFilter menace on routers

Clean-up efforts to respond to the VPNFilter malware have accelerated with the release of a free check-up tool. Even though the utility from Symantec only looks to see if traffic has been manipulated, rather than confirming an infection, third-party experts have nonetheless welcomed its release. VPNFilter, discovered by …
John Leyden, 02 Jul 2018
Doctor Who, season 9, Episode 1 – The Magician's Apprentice. Pic credit: BBC
64

Boffins want to stop Network Time Protocol's time-travelling exploits

Among the many problems that exist in the venerable Network Time Protocol is its vulnerability to timing attacks: turning servers into time-travellers can play all kinds of havoc with important systems. Complicating the problem is that timing attacks are enabled by the protocol itself, which makes it hard to change. Now a …
Face Palm D'oh from Shutterstock
12

Surveys-as-a-service outfit Typeform spilled a backup from May

Spanish Web form and survey company Typeform has announced a data breach in June, affecting data dated May, after someone gained access to one of the company's backup files. The company said the intruder accessed files “from a partial backup dated May 3rd, 2018”, and said it will contact all affected customers. “We identified …
Hammer and Nails
19

Rowhammer returns, Spectre fix unfixed, Wireguard makes a new friend, and much more

Roundup This week we dealt with buggered bookies, trouble at Ticketmaster, and a compromised Linux build from Gentoo. Here's what else went down during the week. Trustwave sued Some breaking news as we were typing away: two insurance companies, Lexington Insurance Co and Beazley Insurance Co in the US, are suing infosec biz Trustwave …
Shaun Nichols, 30 Jun 2018

Biting the hand that feeds IT © 1998–2018