Security > More stories

A ginger tabby cat is walked on a leash over cobblestones. Photo by Shutterstock
102

'Moore's Revenge' is upon us and will make the world weird

Earlier this year I lamented the inevitable death of Moore's Law - crushed between process node failures and exploits attacking execution efficiencies. Yet that top line failure of Moore's Law hides the fact that chips in general are now cheap. So cheap that the cost of making a device "smart" – whether that means, aware, …
Mark Pesce, 04 Jun 2018
Finger touches email icons floating away into space
21

G Suite admins need to RTFM – thousands expose internal emails

If you're sysadmin of an organisation using Google Groups and G Suite, you need to revisit your configuration to make sure you aren't leaking internal information. That advice comes from Kenna Security, which on June 1 said it found 31 per cent of a sample of 9,600 organisations leaking sensitive e-mail information. The …
Spectre logo jazzed up

A Spectre flaw solution, Cloudflare blips, a bank cyber-heist in Canada, and more in infosec land

Roundup While we were busy chasing SpamCannibals, jailing Yahoo hackers, and blaming North Korea for everything else, there was some interesting security news going on. Let's have a look at some of the stories that didn't quite make Reg headlines. Boffins float a (sort of) fix for Spectre bug A group of researchers from TU Dresden in …
Shaun Nichols, 02 Jun 2018
A stingray
33

Stingray phone stalker tech used near White House, SS7 abused to steal US citizens' data – just Friday things

Someone may have spied on smartphones in or near the White House using a fake cellphone tower – and miscreants are said to have abused SS7 weaknesses to swipe US citizens' private information, it emerged this week. On Friday, Senator Ron Wyden (D-OR) revealed a letter he received from the US government's Department of Homeland …
Shaun Nichols, 01 Jun 2018
botnet

OMG, that's downright Wicked: Botnet authors twist corpse of Mirai into new threats

Cybercrooks are using the infamous Mirai IoT botnet as a framework to quickly add in new exploits and functionalities, it has emerged. The tactic is dramatically decreasing the development time for new botnets, according to research from Netscout's Arbor Security Engineering and Response Team (ASERT). The work looks at four …
John Leyden, 01 Jun 2018
Young guy facepalms while holding a laptop
63

TSB meltdown latest: Facepalming reaches critical mass as Brits get strangers' bank letters

TSB customers have reported receiving letters from the British bank containing other people's details in the embattled firm's latest cock-up. The bank went into meltdown at the end of April when a long-planned migration off its former parent Lloyds Banking Group's infrastructure went badly wrong. Customers were unable to …
Rebecca Hill, 01 Jun 2018
F-35Bs fly past HMS Queen Elizabeth at Rosyth dockyard, Scotland. Crown copyright
107

Your F-35s need spare bits? Computer says we'll have you sorted in... a couple of years

Delayed upgrades to F-35 fighter jets along with bespoke logistics software that displays spare part lead times in years are keeping some aircraft grounded, according to a report from the US air force station where the core of Britain's future F-35 operators are being trained. Lockheed Martin's Autonomous Logistics Information …
Gareth Corfield, 01 Jun 2018
Kaspersky
17

Court says 'nyet' to Kaspersky's US govt computer ban appeal

A US district court has upheld the American government's ban of Kaspersky Lab software from computers of federal agencies. Judge Colleen Kollar-Kotelly, sitting in Washington, DC, issued a ruling Wednesday to dismiss the two lawsuits Kaspersky had filed against Uncle Sam and the Department of Homeland Security challenging both …
Shaun Nichols, 30 May 2018
Soldier with a gun
27

Law forcing Feds to get warrants for email slurping is sneaked into US military budget

The US House of Representatives has once again advanced a law bill that would always require the FBI and cops to obtain a warrant from a judge before forcing email providers to hand over people's messages. The latest incarnation of what was the Email Privacy Act comes in the form of an amendment to the National Defense …
Shaun Nichols, 30 May 2018
Yahoo

Yahoo! merc! hacker! Karim! Baratov! gets! five! years! in! the! clink!

The Canadian mercenary hacker who helped Russian agents break into thousands of Yahoo! webmail accounts will be spending up to the next five years behind bars in America. A US district court judge, sitting in northern California, handed the 60-month sentence to Karim Baratov, who last year eventually pleaded guilty to nine …
Shaun Nichols, 30 May 2018
10

SpamCannibal blacklist service reanimated by squatters, claims every IP address is spammy

Updated SpamCannibal – a defunct service that issued blacklists of known spam servers – was hijacked early on Wednesday morning, spewing its own unwanted crap in the process. El Reg was tipped off by a reader who told us that SpamCannibal is "pumping out Blacklist notifications for some of our servers and then when you go to …
John Leyden, 30 May 2018
Bug detected dialog

Git security vulnerability could lead to an attack of the (repo) clones

A new version of Git has been emitted to ward off attempts to exploit a potential arbitrary code execution vulnerability – which can be triggered by merely cloning a malicious repository. The security hole, CVE-2018-11235, reported by Etienne Stalmans, stems from a flaw in Git whereby sub-module names supplied by the . …
Richard Speed, 30 May 2018
Pushy young salesman business man advertising his best product on a phone
23

Have you heard about ransomware? Now's the time to ask: Are you covered?

Every industry has its collection of shocking stories, but Britain's cyber-insurance sector can always be relied on to top the lot. Take the unnamed British medium-sized enterprise that recently found itself staring at a ludicrous £1m ransom demand after attackers sneaked off with some very important data. This was a straight …
John E Dunn, 30 May 2018
12

FBI fingers North Korea for two malware strains

US CERT has issued a Technical Alert that says two strains of malware are tools of the North Korean government. The Alert says that the United States’ Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI) “identified IP addresses and other indicators of compromise (IOCs) associated with two families …
Simon Sharwood, 30 May 2018
backdoor_648. Pic via Shutterstock
37

GCHQ bod tells privacy advocates: Most of our work is making sure we operate within the law

Privacy advocates, journalists and a representative from GCHQ squared off in a debate on surveillance in Cambridge today. The heavyweight exchange of ideas between Cambridge security engineering professor Ross Anderson and Ian Levy, technical director of the National Cyber Security Centre, the assurance arm of GCHQ, took place …
John Leyden, 29 May 2018
A hipster man with shades claps, saying bravo
50

BCC is hard, OK? Quite a lot of orgs blurted your email addresses in GDPR mailouts

Amid the chaos of new European data protection rules coming into force at the end of last week, organisations are apparently struggling to grasp even the most basic of technical challenges, sending out non-blinded emails to their users. Topping the irony charts is ad-blocker Ghostery, which sent users an email with more than …
Rebecca Hill, 29 May 2018
Facepalm, photo via Shutterstock
45

Ex-staffer of UK.gov dept bags payout after boss blabbed medical info to colleagues

A Manchester man has won his case against former employer the Department for Work and Pensions, after a superior shared “highly private” medical information with his colleagues. Aftab Marchant, who worked in the DWP’s Stockport office, has reportedly received a substantial payout in the case – for which he was claiming damages …
Rebecca Hill, 29 May 2018
Tripping over
28

ISP popped router ports, saving customers the trouble of making themselves hackable

Singaporean broadband subscribers were left vulnerable to attackers after their ISP opened remote access ports on their gigabit modems and forgot to close them. The discovery was made by NewSky Security researcher Ankit Anubhav, who used Shodan to scan for SingTel routers open on port 10,000 – the default Network Data …
Pepper robot, Shutterstock
62

Softbank's 'Pepper' robot is a security joke

Softbank's popular anthropomorphic robot, Pepper, has myriad security holes according to research published by Scandinavian researchers earlier this month. The 'bot allows unauthenticated root-level access, runs a Meltdown/Spectre-vulnerable processor, can be administered over unencrypted HTTP and has a default root password …
IT Crowd's Roy:on the phone
31

FBI to World+Dog: Please, try turning it off and turning it back on

The FBI has reminded the world it wants us to reboot our routers to try and help it identify VPNFilter-affected routers. It first asked for reboots last Wednesday, May 23, in the Department of Justice VPNFilter media release, but on Friday added a stand-alone public service announcement emphasising its "IT Crowd" strategy. …
10

Starbucks site slurped, Z-Wave locks clocked, mad Mac Monero mining malware and much more

Roundup While this week was dominated by news of a new Spectre variant, the VPNFilter botnet, and TalkTalk's badbad routersrouters, plenty of other stories popped up. Here are a handful of security happenings that you may have missed. Wireless Z-Wave smart-locks, home IoT devices menaced Wireless gadgets, such as home smart locks, …
Shaun Nichols, 26 May 2018
50

Epyc fail? We can defeat AMD's virtual machine encryption, say boffins

Updated German researchers reckon they have devised a method to thwart the security mechanisms AMD's Epyc server chips use to automatically encrypt virtual machines in memory. So much so, they said they can exfiltrate plaintext data from an encrypted guest via a hijacked hypervisor and simple HTTP or HTTPS requests. AMD's data-center …
Shaun Nichols, 25 May 2018
Hammer, spanner and screw
10

Electron patches patch after security researcher bypassed said patch

In an update last week, the developers of Electron – the toolkit used to craft widely used apps from Skype and Slack to Atom – shipped a patch to their January patch, and now, an infosec researcher has explained why. A remote-code execution vulnerability, CVE-2018-1000006, was found in Windows applications developed using …
20

Zimmerman and friends: 'Are you listening? PGP is not broken'

ProtonMail has weighed into 2018's worst branded-bug PR disaster, EFAIL, with a simple statement: “PGP is not broken”. The discoverers of the bug in e-mail client encryption implementations started the ball rolling ahead of their disclosure in the middle of this month. Münster University professor Sebastian Schinzel started …
File photo of Police in Seattle, Washington
59

Trio indicted after police SWAT prank call leads to cops killing bloke

Three men were this week indicted for their alleged roles in a fatal police "swatting" of a home in Kansas, USA. Tyler Barriss, Casey Viner, and Shane Gaskill will all face charges after a district court grand jury ruled (PDF) to indict them on multiple counts related to the December 28, 2017 death of Andrew Finch – who was …
Shaun Nichols, 24 May 2018
FBI
14

FBI agents take aim at VPNFilter botnet, point finger at Russia, yell 'national security threat'

The FBI says it is taking steps to stop the spread of the VPNFilter malware and botnet, warning that it's a national security issue. The bureau's offensive includes seizing a domain believed to have been used as part of the command and control structure for VPNFilter's 500,000-strong network of infected routers and storage …
Shaun Nichols, 24 May 2018
Parade of dancers in costume at  London's Notting Hill carnival.
45

London's Met Police: We won't use facial recognition at Notting Hill Carnival

London cops will not use controversial and inaccurate facial recognition technology at this year's Notting Hill Carnival – in a departure from the trend over the previous two years. The Metropolitan Police have been using the technology since the 2016 carnival, which takes place on the August bank holiday weekend, despite …
Rebecca Hill, 24 May 2018
Putin
33

Advanced VPNFilter malware menacing routers worldwide

A newly-disclosed malware infection has compromised more than 500,000 home and small office routers and NAS boxes. Researchers with Cisco Talos say the malware, dubbed VPNFilter, has been spreading around the globe, but appears to primarily be largely targeting machines in the Ukraine. Wish you could log into someone's …
Shaun Nichols, 23 May 2018
Image by gyn9037 http://www.shutterstock.com/gallery-691846p1.html
22

Brit Attorney General: Nation state cyber attack is an act of war

Hostile states targeting essential infrastructure and services in Britain should be dealt with in the same way as any other attack against the nation, the UK Attorney General said today. Speaking at the Chatham House think-tank on the topic of international law in cyber space, Jeremy Wright QC MP, said: The targeting of …
Kat Hall, 23 May 2018
47

Big bimmer bummer: Bavaria's BMW buggies battered by bad bugs

A security audit conducted by Tencent's Keen Security Lab on BMW cars has given the luxury automaker a handy crop of bugs to fix – including a backdoor in infotainment units fitted since 2012. Now that the patches are gradually being distributed to owners, the Chinese infosec team has gone public with its security audit, …
31

ISP TalkTalk's Wi-Fi passwords Walk Walk thanks to Awks Awks router security hole

A years-old vulnerability continues to menace the security of some home Wi-Fi networks in the UK. The WPS feature in TalkTalk's Super Router can be compromised to steal the gateway's wireless network password, according to folks at software development house IndigoFuzz. The British ISP and telco was warned of the shortcoming …
Shaun Nichols, 22 May 2018
bouncer
41

Brit water firms, power plants with crap cyber security will pay up to £17m, peers told

Plans to fine Britain's national utilities and infrastructure providers £17m for shoddy cyber security will be at the forefront of industry's mind once everyone "gets over" GDPR, peers heard at a House of Lords committee. Speaking on a panel on cyber security for critical national infrastructure (CNI) yesterday, Elliot Rose, …
Kat Hall, 22 May 2018
39

You've got to be kitten: Vet recruiter told to pay £1k after pinching info from ex-employer

A vet recruitment consultant who squirrelled away the personal details of almost 300 people from his former employer was today slapped on the wrists by the UK's information watchdog. Daniel Short, a recruiter from Devon, left VetPro Recruitment in October 2017, but set up a new company called VetSelect shortly afterwards. …
Rebecca Hill, 22 May 2018
DDOS
16

Summoners of web tsunamis have moved to layer 7, says Cloudflare

Attackers have noticed that the world is getting better at fending off massive distributed denial-of-service attacks, and are trying to overwhelm application processes instead. So says DDoS-deflector Cloudflare, which reckons it's seen a spike in cyber-assaults trying to exhaust high-level server resources, such as per-process …
Dunce

Victoria's educational apps-for-students let creeps contact kids

Updated Google and the Victorian Department of Education have set parents, students, teachers, and the Office of the Australian Information Commissioner a poser: at what point does a feature become a vulnerability? Or just too creepy to put in front of kids? Victoria's teachers and students have adopted a system based on Google Apps …
A blowtorch burning a computer board
93

Microsoft, Google: We've found a fourth data-leaking Meltdown-Spectre CPU hole

A fourth variant of the data-leaking Meltdown-Spectre security flaws in modern processors has been found by Microsoft and Google researchers. These speculative-execution design blunders can be potentially exploited by malicious software running on a vulnerable device or computer, or a miscreant logged into the system, to …
Chris Williams, 21 May 2018

Biting the hand that feeds IT © 1998–2018