Security > More stories

Cartoon of  green skeletal figure reaching out of phone

DARPA-funded team says it can SMELL Android malware

A trio of DARPA-backed Iowa State University researchers have developed a tool to help speed up android malware analysis. The Security Toolbox developed by the DARPA blue team uses features including 'smells' which sport stronger heuristics to flag possible signs of hidden malware badness. Benjamin Holland, Tom Deering, and …
Darren Pauli, 9 Apr 2015

Fsck those new emojis! Install iOS 8.3, OS X 10.10.3 NOW to squash all these security bugs

Apple has released software updates to add features to and fix many bugs in its OS X and iOS operating systems. The iOS 8.3 overhaul will correct dozens of programming blunders, including glitches and dropouts with Wi-Fi and Bluetooth. Users reported problems with establishing and maintaining connections to wireless networks and …
Shaun Nichols, 9 Apr 2015

Blaze it: US drug cops taken to court to ensure all dragnet snooping records are destroyed

Campaign group Human Rights Watch is suing Uncle Sam's anti-drug squads – the US Drug Enforcement Administration and others – after it emerged the g-men were secretly monitoring Americans' international phone calls. The activists claim the collection of telephone conversation records is unconstitutional, and causes "irreparable …

In the time it takes you to watch The Hangover, AT&T will pay a $25m fine for privacy scandal

AT&T will pay a $25m fine after crooked staff leaked subscribers' personal records to criminals flogging stolen cellphones. About 40 of telco's employees in its international call centers leafed through the accounts of 280,000 people without permission, pulling up their names, telephone numbers, and at least the last four digits …
Shaun Nichols, 8 Apr 2015

Using Office 365 at work? It's dangerous to go alone! Take this...

Microsoft is adding some security tools, dubbed Advanced Threat Protection, to Office 365 for its business and government subscribers. The utilities will try to curb malware writers and phishers seeking to exploit vulnerabilities via emailed attachments and links. "As hackers around the globe launch increasingly sophisticated …
Iain Thomson, 8 Apr 2015

Bell Canada pulls U-turn on super-invasive web-stalking operation

Following the Canadian Privacy Commissioner's investigation into "an unprecedented number of complaints" regarding Bell Canada, the telecommuncations giant is suddenly back-pedalling on its customer tracking policy. A report from the Canadian Privacy Commissioner's Office (OPC) has urged telecommunications companies to adopt " …
Pinterest security

Pinterest, Yammer scramble to patch login thievery headaches

Pinterest has patched a vulnerability that meant its iPhone app leaked passwords to other surfers on the same network. An earlier version of the Pinterest iOS app fails to validate the server certificate, potentially allowing a suitably positioned attacker on the same network to steal login credentials related to the photo …
John Leyden, 8 Apr 2015

This will crack you up: US drug squad's phone call megaslurp dates back to 1990s

Further revelations have emerged about the US Drug Enforcement Administration's snooping on Americans' calls to international numbers – including the date it started and the operation that has since replaced it. As The Register reported in January, court documents [PDF] revealed that the drug-busters were engaged in the bulk …

Dell System Detect update vulnerability exposed

Dell System Detect doesn't auto-update automatically, leaving millions of systems vulnerable as a result, according to security software firm F-Secure. Even though Dell disputes the problem with its application which interacts with the Dell Support website, F-Secure's claim is based on real figures regarding queries about older …
John Leyden, 8 Apr 2015
Image of HAL eye from 2001 movie with Chrome logo in eye

A MILLION Chrome users' data was sent to ONE dodgy IP address

A team of security researchers have found malware in a popular Chrome extension which may have sent the browsing data of over 1.2m users to a single IP address. ScrapeSentry credits its researchers with uncovering "a sinister side-effect to a free app [...] which potentially leaks [users'] personal information back to a single …

Google Ads go NUCLEAR, foist exploit kit

Security bod Maarten van Dantzig says a large number of Google ads sold through Bulgarian reseller EngageLab have been pointing users to the dangerous Nuclear exploit kit. The Fox-IT binary basher found the campaign, which may at the time of writing have been subject to the Choc Factory's boot, could result in a "very large" …
Darren Pauli, 8 Apr 2015
WordPress

FBI to WordPress users: patch now before ISIL defaces you

The United States Federal Bureau of Investigation (FBI) has issued a warning to WordPress users: hurry up and patch your content management system before web site is defaced by ISIL sympathisers. The Bureau has issued a notice titled "ISIL defacements exploiting WordPress vulnerabilities" in which it warns that "Continuous Web …
Darren Pauli, 8 Apr 2015

Trustwave's off to Singapore as Singtel slurps security company

Singapore's dominant telco and aspiring services player, Singtel, has acquired Trustwave for about US$810m. Trustwave offers managed security services and the SpiderLabs ethical hacking research outfit, plus a range of network, content and endpoint security products. The company operates in 26 nations and has 1,200 people on the …

Cisco pitches security for SMEs

Small and/or medium businesses and branch offices rejoice: Cisco has joined the ranks of vendors deciding you warrant security you can afford. As incidents like the Target “hack” demonstrated, a small contractor can easily provide a path into an enterprise network, so one of the key chunks of The Borg's latest announcement is to …
heartbroken

Most top corporates still Heartbleeding over the internet

A depressing 76 percent of the top 2000 global organisations have public facing systems still exposed to Heartbleed, researchers say. The exposure means attackers could nab passwords, login cookies, private cryptographic keys and more using the vulnerability first disclosed 12 months ago. Australia is the least-repaired nation …
Darren Pauli, 8 Apr 2015
Screenshot of Chrome's "Aw, snap!" error message

Aw, snap! How huge HTML links can crash Chrome tabs in one click

Behind the bug A bug in the most recent version of the Chrome allows miscreants to crash browser tabs simply by embedding a link with a malformed URL in the HTML of a page. The vulnerability, dubbed "AwSnap" by web developer Jason Blatt, affects Chrome version 41 on Windows, OS X, and Chrome OS, though reports vary as to whether it exists in …

Defiant Labio lawyer spits on black hats after 'med data' theft

Hacker collective Rex Mundi’s Twitter account has yet again been suspended after its latest extortion attempts. The group, which says it has no motivation other than to make money, most recently targeted Labio, a French laboratory company specialising in private patients. Using the now-defunct @RexMundi2015 account, the hackers …

Can't patch this: Mozilla pulls Firefox encryption feature after just a week

Mozilla has pulled Firefox 37's opportunistic encryption feature after less than a week when it learned that tech designed to enhance security actually broke SSL certificate validation. A simple patch wouldn't do the trick, so Mozilla opted to release an update, Firefox 37.0.1, that removed opportunistic encryption. Going into …
John Leyden, 7 Apr 2015

France accused of tabling 'Patriot Act' style surveillance law

Privacy advocates have criticised French plans to expand digital surveillance as badly thought out and rushed. A bill (“Projet de Loi Relatif au Renseignement”) – which was drawn up before the Charlie Hebdo and Hyper Casher supermarket attacks – is due to go before the National Assembly next week under an accelerated legislative …
John Leyden, 7 Apr 2015
management governance3

E-commerce enterprises gently told to update those protocols ... or else

A revamp in payment card industry regulations due out later this month will penalise e-commerce enterprises that rely on outdated crypto protocols. The PCI Security Standards Council updated standard – PCI DSS 3.1 – mandates that businesses move away from SSL onto more modern TLS protocols. The council is introducing the …
John Leyden, 7 Apr 2015
Collection of antique keys

Popular crypto app uses single-byte XOR and nowt else, hacker says

A programmer claims the makers of a popular encryption app have failed to implement its core feature: encryption. The hacker, using the alias NinjaDoge24, analyzed the NQ Vault app, which supposedly encrypts files on smartphones and other gadgets. Ninja claims the software used only XOR (exclusive or) and a single-byte key to …
Darren Pauli, 7 Apr 2015

Supposed spy-busting Anonabox insecure, says Cloak Project

Updated A developer at the Cloak Project is about to reignite the Anonabox controversy with an analysis of the device that finds it still runs unencrypted Wi-Fi and has a poorly-secured network-reachable admin interface. Anonabox has advised The Register that the issues did exist, but have been patched – update in detail at the end of …
Flytrap

Linux Australia hacked, warns personal details exposed

The names, phone numbers and street and email addresses of delegates for Linux Australia conferences and PyCon have been exposed in a server breach. The March attack was detected two weeks ago and is revealed in an email to Linux Australia members. Linux Australia's server held information on delegates to its popular annual …
Darren Pauli, 7 Apr 2015

Feds ponder jamming journo comms in Australian Parliament

Canberra's appetite for security theatre could soon see comms blackouts in Parliament House as a response to terrorist threats. The proposal emerged by way of a briefing with the president of the press gallery, David Speers, who told Fairfax Media it's part of a plan to ramp up parliamentary security. As well as armed …

Don't be stiffed by spies, stand up to Uncle Sam with your proud d**k pics – says Snowden

Vid One of the more unusual interviews with NSA whistleblower Edward Snowden left the fugitive reduced to describing freedom-chilling, globe-spanning spy programs in terms of sexy selfies. Youtube video The face-to-face chat was filmed in Moscow with British comedian John Oliver, host of Last Week Tonight, and focused on the …
Iain Thomson, 6 Apr 2015
Wolves

Big Blue securo-bods warn of dire Dyre Wolf AMONG WOLVES

Infosec experts have spotted a nasty variant of a banking malware – dubbed Dyre Wolf – which involves a sophisticated two-factor authentication workaround that has apparently led to the theft of more than $1m from the biz world. Wrongdoers have demonstrated what IBM Security described as "a brazen twist from the once-simple Dyre …
Kelly Fiveash, 4 Apr 2015
Percentage of mobile malware on Android

Got an Android mobe with a virus? Congrats, you're The One Per Cent

Android has been known to be the mobile malware industry's operating system of choice. Now Google has published a report claiming infection rates on Android devices are much lower than you might expect. While the overwhelming majority of mobile malware is written for Google-powered gadgets, the report claims that in 2014 less …
Iain Thomson, 3 Apr 2015
The chinese characters for China as used in the new .中国  domain

Mozilla piles on China's SSL cert overlord: We don't trust you either

Firefox-maker Mozilla has joined Google in refusing to recognize SSL certificates issued by the China Internet Network Information Centre (CNNIC). This comes after a security biz in Egypt used a CNNIC-issued intermediate certificate to create unauthorized SSL certs that could be used to trick people into connecting to bogus, …

Crack security team finishes TrueCrypt audit – and the results are in

The researchers behind the security audit of the TrueCrypt disk-encryption software have completed their work and say they have found no evidence of any deliberate backdoors or serious design flaws in its code. "Based on this audit, Truecrypt appears to be a relatively well-designed piece of crypto software," crypto boffin …
Lock security

Check Point snaps up mobile security outfit Lacoon

Check Point is buying Lacoon Mobile Security, in a deal that expands the security software firm beyond its core firewall and IDS market while pushing it further into mobile. Terms of the deal, announced Thursday, were undisclosed. Lacoon develops security apps for both iOS and Android, as well as marketing real-time mobile …
John Leyden, 2 Apr 2015
Great Wall of China

RAGING Google SLAPS naughty Chinese root cert kingpins CNNIC

Google has announced it will no longer recognise the Chinese Internet Network Information Centre (CNNIC) as a Root Certificate Authority, following an investigation into unauthorised certificates issued for several Google domains. Adam Langley, a security engineer at the Chocolate Factory, wrote that Google had become aware of …

Cybercrim told to cough up £1m or spend years in chokey

A cybercriminal from Thamesmead has been given six months to turn up £1m, or he'll be spending another four years behind bars. Rilwan Adesegun Oshodi – a 31-year-old Nigerian national, formerly of Greenhaven Drive, Thamesmead, SE28 – is currently enjoying Her Majesty's hospitality for conspiracy to defraud and conspiracy to …
Met Police cockup

Met Police in egg/face blunder as shop-a-crim site's SSL cert expires

The Metropolitan Police has allowed its SSL certificate to expire, possibly exposing users of its website to criminal snooping – and leaving victims and witnesses of crime vulnerable to exploitation. With shocking disregard for the most basic standards of web security, the Met have allowed their SSL certificate for https:// …

This tool detects then ATTACKS evil twin access points

Mohamed Idris has created a tool to help network administrators discover and DoS rogue access points. The EvilAP Defender open source tool published to GitHub can be run by admins at intervals to determine if attackers are attempting to get their users to connect to malicious networks. Those evil twin attack networks are …
Darren Pauli, 2 Apr 2015
Sad cloud

Snowden didn't scare many out of US clouds says Forrester

Analyst outfit Forrester has asked the question “Did PRISM Cause An Exodus From US Clouds?” and found the answer is yes. At least a bit. The firm asked “1,668 non-US technology and business decision-makers” whether “In the past year, has your company explicitly halted or reduced your spending with US-based companies for Internet …
Solar panels

Energy utilities targeted by Office-spawned recon attack tool

Malware writers are targeting international energy utilities with a new trojan that creates beachheads to enable subsequent more advanced attacks. Symantec security boffin Christian Tripputi says the campaign, detected in the first two months of 2015, has a particular focus on creating beachheads on petroleum and gas utilities …
Darren Pauli, 2 Apr 2015
Xbox One

Teen pleads guilty in Microsoft and Valve hacking case

A man from Indiana has pleaded guilty for his role in a hacking ring that targeted major games developers. Austin Alcala, 19, from the town of McCordsville, admitted guilt (PDF) to charges of conspiracy to commit computer intrusion and criminal copyright infringement. Alcala will be sentenced on a July 29 hearing, where he could …
Shaun Nichols, 2 Apr 2015
Costumed pirate

Fake Pirate Bay site pushes banking Trojan to WordPress users

Multiple WordPress sites are being redirected to a Pirate Bay copycat which in turn was being used to sling malware, anti-malware firm Malwarebytes warns. Several WordPress sites were injected with the same iframe over the last few days as part of an attack ultimately geared towards serving content from sites such as …
John Leyden, 1 Apr 2015
Bradley University offer to hackers

Hacked uni's admins hand ID theft prevention reward to data burglars

An Illinois university's sysadmins have seemingly handed data burglars a year-long subscription to LifeLock, an identity alert and credit monitoring system, following a data breach at the US institution which left thousands vulnerable to identity theft. With the best of intentions, Bradley University reacted to being hacked by …
Spying image

Mystery 'Explosive' cyber-spy campaign traced back to Lebanon

A nation-state cyber-attack campaign running since 2012 has been traced back to a somewhat unlikely launchpad in Lebanon. Security researchers at Check Point reckon hackers behind the so-called Volatile Cedar campaign have hit defence contractors, telecommunications and media companies, and educational institutions in multiple …
John Leyden, 1 Apr 2015

Mozilla project spits out threat modelling tool for sysadmins

A trio of university undergraduates have worked with Mozilla to create an online threat modelling tool designed to help system administrators better understand the threats they face. The open source SeaSponge tool, developed under Mozilla's Winter of Security initiative, sports a graphical flow its designers say could be a …
Darren Pauli, 1 Apr 2015

POODLE vuln dogs Australian consumer modems

The persistent awfulness of consumer broadband modems is once again in evidence, with the Poodle and Freak bugs present in a huge number of Australian households. The issue has hit Twitter, with some people reporting that ISPs are notifying them of possible malicious traffic – but without useful information on what to do. TPG …