Feeds

Security > More stories

Patch Windows boxes NOW – unless you want to be owned by a web page or network packet

"Remote code execution if an attacker sends specially crafted packets" is not what many of you want to hear today – nor "remote code execution if a user views a specially crafted webpage using Internet Explorer" – but it's Patch Tuesday, so what do you expect? Microsoft has issued a batch of security fixes for Internet Explorer …
Shaun Nichols, 11 Nov 2014

Most convincing PHISHING pages hoodwink nearly half of you – Google

Nearly half (45 per cent) of those who visit the most convincing phishing pages are tricked into handing over personal information, according to Google. This effectiveness drops to just three per cent in the case of the most obviously scummy phishing sites, while the online giant reports that the account hijackers work quickly, …
John Leyden, 11 Nov 2014

German spies want millions of Euros to buy zero-day code holes

Germany's spooks have come under fire for reportedly seeking funds to find bugs – not to fix them, but to hoard them. According to The Süddeutsche Zeitung, the country's BND – its federal intelligence service – wants €300 million in funding for what it calls the Strategic Technical Initiative. The Local says €4.5 million of that …
The MQ-9 Reaper drone in flight

British drones target ISIS for the first time

The RAF has launched its first drone strikes against Islamic fundamentalists ISIS, marking an escalation of Blighty's air war in Iraq. A British Reaper drone attacked a terrorist encampment near Bayji, north of Baghdad, where militants were planting improvised explosive devices. It then circled the area, providing real-time …
Jasper Hamill, 11 Nov 2014

EMET 5.0 crashes Patch Tuesday party

Microsoft has issued a new version of its Enhanced Mitigation Toolkit (EMET) to address a variety of compatibility issues in the system-hardening environment. Version 5.1 fixed compatibility and Export Address Table Filtering Plus (EAF+) issues with security updates for 64-bit Internet Explorer version 11, Adobe Reader, Adobe …
Darren Pauli, 11 Nov 2014

Hacker Hammond's laptop protected by pet password

Former LulzSec member Jeremy Hammond - once the FBI's most wanted and charged with hacking security firm Stratfor - seems to have failed to prevent police accessing his laptop due to a poor password. During a police raid in March 2012 he raced through a friend's Chicago home to shut and lock his laptop. But the effort appeared …
Darren Pauli, 11 Nov 2014

Mozilla makeover to boost Tor torque, capacity

Mozilla will tweak its flagship Firefox browser and host relays to speed up and boost the capacity of Tor under the Polaris project launched today. The browser baron joined the Tor Project and the Centre for Democracy and Technology, under the Polaris initiative, to create warmer, fuzzier relationships between the organisations …
Darren Pauli, 11 Nov 2014
Beware of the dog

Names, ages, addresses, SSNs of US postal staff slurped in 'mega-hack'

The US Postal Service has called in the FBI after hackers apparently grabbed names, addresses, social security numbers and other sensitive records from its staff database. It's feared miscreants got into USPS corporate servers, and swiped data that will be a lucrative haul for identity thieves and other fraudsters. USPS employs …
Iain Thomson, 10 Nov 2014
Eve in the Garden of Eden talking to a rather angry God on Snapchat

Got an iPhone or iPad? LOOK OUT for MASQUE-D INTRUDERS

Security experts have now probed further into the vuln in non-jailbroken iOS 7 and iOS 8 devices which was exploited by the previously revealed WireLurker USB-hopping malware. Dubbed a “Masque Attack”, the tactic allows hackers to install iOS apps on iPhone or iPad via email or text message. The attack takes advantage of a …
John Leyden, 10 Nov 2014
Artist's rendering of the concave Vdara hotel

Feeling safe in your executive hotel suite, Mr CEO? Well, DON'T

Corporate bosses are coming under attack from a shadowy new group that spreads malware by hijacking the networks of luxury hotels. Kaspersky Labs' Global Research & Analysis Team has issued a warning about an advanced persistent threat designed by a crew called Darkhotel, who target top execs as they relax in plush hotel rooms …
Jasper Hamill, 10 Nov 2014

BrowserStack HACK ATTACK: Service still suspended after rogue email

Browser testing service BrowserStack has temporarily suspended its services while it recovers from a "hack attack" by someone apparently bent on discrediting the security of the widely used tool. "We did get hacked. Currently sanitising entire BrowserStack, so service will be down for a while. We're on top of it and will keep …
John Leyden, 10 Nov 2014
Hacked sarcasm

Someone has broken into your systems. Now what?

So, you've been hacked. Compromised. Breached and violated. Some criminal Goldilocks has been inside your network and found that your data was neither too hot nor too cold but just right. What are you going to do about it? This could happen to any organisation and what you do to mitigate the problem could define your public …
Danny Bradbury, 10 Nov 2014
Tommy lee image

Aussie feds consider job offer to 'LulzSec leader' who wasn't

Shackled hacker and supposed "leader of Lulzsec" Matthew Flannery is welcome to apply for a job with the Australian Federal Police (AFP_, the force says. Flannery was arrested last April as one of two crackers behind the defacement of the then-unpatched Narrabri shire council. He's since been sentenced to, and is serving, 15 …
Darren Pauli, 10 Nov 2014

Emoticons blast three security holes in Pidgin :-(

Cisco researchers have reported a trio of vulnerabilities in popular instant messaging client Pidgin that allow for denial of service by way of emoticon abuse and remote arbitrary file creation. Researchers Yves Younan and Richard Johnson say the flaws have since been quietly patched, but rated a maximum CVSS score of 6.4 but …
Darren Pauli, 10 Nov 2014
Toilet

Sysadmins disposed of Heartbleed certs, but forgot to flush

Sysadmins' need for sleep and attempts to stop working at weekends have slowed down the response to Heartbleed, according to University of Maryland researchers – but more seriously, it's possible that a bunch of half-fixed websites retain some vulnerability to the bug. The problem, the researchers told the 2014 Internet …
NHS Files on a desk

TORpedo'd dev dumps Doxbin files after police raids

An administrator of Tor hidden service site Doxbin taken down by the FBI last week has released log files in a bid to crowd-source an analysis of how the sites were captured. Former Doxbin admin NaChash (@loldoxbin) released the website files in hopes users would discover how it was discovered and shut down. His site was …
Darren Pauli, 9 Nov 2014

Crooks are using proxy servers to build more convincing phishing sites – new claim

Crooks using phishing pages to grab victims' passwords have apparently upped their game – by using proxy servers rather than static pages to craft legit-looking websites. Normally, thieves recreate a web page – such as a login page for an online shop or webmail – and stick it on a compromised server, then direct marks towards …
John Leyden, 7 Nov 2014

EU cyber-cop: Dark-net crooks think they're beyond reach (until now)

Hundreds of website domains seized, 17 arrested and $1m in Bitcoin confiscated – Thursday was, apparently, a busy day for the West's cyber-cops. Operation Onymous, in which police and g-men in more than a dozen European countries as well as the US, has claimed some big scalps including the Silk Road 2.0, Hydra and Cannabis Road …
Routers

Belkin flings out patch after Metasploit module turns guests to admins

Belkin has patched a vulnerability in a dual band router that allowed attackers on guest networks to gain root access using an automated tool. The flaw reported overnight targeted the Belkin N750 dual-band router – which was launched in 2011 and is still sold by the company and other commerce sites. IntegrityPT consultant Marco …
Darren Pauli, 7 Nov 2014

Home Depot: Someone's WEAK-ASS password SECURITY led to breach

Hackers gained access to Home Depot's network via a third-party vendor system, according to preliminary results of an investigation into the September mega-breach. Cybercrooks used access to the US retail giants' network gained via ineffective password security at an unnamed third party vendor's system to run a stepping-stone …
John Leyden, 7 Nov 2014
apple mac malware vxer

'Older' WireLurker previously tried, failed to leap from Windows to iThings

An older version of WireLurker, the newly discovered malware capable of spreading onto Apple iOS devices from infected Mac OS X systems, once targeted Microsoft Windows, it has emerged. WireLurker is the first malware capable of attacking non-jailbroken iPhones and iPads, smashing the conventional wisdom that such devices are …
John Leyden, 7 Nov 2014

Security products: Best of breed or create your own monster?

IT security is not just about antivirus or firewall products anymore. There is a whole layer cake of different product types designed to protect your organisation in different ways. It is a stack, in much the same way as TCP-IP networking or web server functionality has stacks of functionality. The question is, what's the best …
US Military hacking team

Spyware-for-cops Hacking Team faces off against privacy critics

Controversial spyware-for-cops outfit Hacking Team has defended its snooping and come out on the offensive against security research critics. Last week Glenn Greenwald’s The Intercept published what it asserted were secret manuals illustrating how Hacking Team sold its spyware sold to authoritarian regimes around the world. The …
John Leyden, 7 Nov 2014
The tag in question

Shove over, 2FA: Authentication upstart pushes quirky login tech

Security upstart LiveEnsure is trying to shake up the authentication market with technologies that verify users by device type, location and user behaviour, as an alternative to established authentication systems. The firm is pushing its smartphone-based services as an alternative to security tokens, biometrics, one-time- …
John Leyden, 7 Nov 2014

By the way, Home Depot hackers also grabbed 53 million email addresses

Hackers made off with a whopping 53 million email addresses as part of the high profile April breach of Home Depot in which 56 million credit cards were compromised, the company says. The haul bagged enough email addresses to contact everyone in England, but it was unknown if the information had been implicated in further …
Darren Pauli, 7 Nov 2014
Windows 7

Microsoft warns of super-sized Patch Tuesday next week

It's getting close to security update time in Redmond yet again, and Microsoft has given notice that Windows and Office users can expect another nice, big pile of fixes on November's Patch Tuesday. The software giant gave advance notice of no less than 16 security bulletins to be addressed on November 11, five of which have been …

If you're suing the UK govt, Brit spies will snoop on your briefs

British agents spy on lawyers and their clients who are suing the UK government – and then pass their confidential conversations onto the government's legal team, it's claimed. Evidence of dirty tricks surfaced amid a court case brought against the British government by two Libyan families, who were kidnapped and sent back to …
Iain Thomson, 7 Nov 2014
frustration_anger_irritation_annoyance pain

Ex-NSA lawyer warns Google, Apple: IMPENETRABLE RIM ruined BlackBerry

An ex-NSA lawyer believes BlackBerry's ongoing downfall stems from the company's use of strong encryption – and Apple and Google are next to wither on the vine. Nope, it makes no sense to us, either. Speaking at the Dublin Web Summit this week, Stewart Baker, a former NSA lawyer and assistant secretary for the Department of …
Shaun Nichols, 7 Nov 2014

Aussie spooks warn of state-sponsored online attacks during G20

Australia's top spy agency has warned of 'real and persistent' threats to organisations, agencies and individuals linked to the G20 leaders conference in to be held down under next week. The advice issued by the Australian Signals Directorate (ASD) warns that large diplomatic and defence conferences attract attacks such as …
Darren Pauli, 7 Nov 2014
apple mac malware vxer

Apple blats WireLurker OS X, iOS malware – but fanbois aren't safe yet

It appears the WireLurker malware threatening Macs, iPads and iPhones has, for now, been partially neutralized. Apple told The Reg it has revoked a previously legit cryptographic certificate the malware was using to sign itself: this certificate tricked iOS devices into trusting and installing WireLurker's malicious apps. Now …
Shaun Nichols, 7 Nov 2014

Bloke, 26, accused of running drug souk Silk Road 2.0 cuffed by Feds

A California man accused of running Silk Road 2.0 – a copycat drugs market hidden within the Tor network – has been arrested by the FBI. The website has since been torn down by Uncle Sam's agents. The Feds and the US Department of Justice claim 26-year-old Blake Benthall of San Francisco used the alias "Defcon" when operating …
Shaun Nichols, 6 Nov 2014
Hacker baseball cap

Hackers use DRAFT emails as dead-drops for running malware

Sneaky hackers are using Gmail and Yahoo! drafts to control compromised devices, with the tactic designed to make detection of malware-related communications more difficult to pick up in enterprise environments. Attacks occur in two phases. Hackers first infect a targeted machine via simple malware that installs Python onto the …
John Leyden, 6 Nov 2014
Pandemia

Rovnix Trojan infection outbreak infects 130,000 machines in Blighty

A new cluster of infections by the Rovnix Trojan has infected more than 130,000 Windows computers in the UK alone. The data-stealing malware is also affecting Germany, Italy, the US and Iran to a far lesser extent - 87 per cent of the computers infected are actually in the UK, according to anti-virus firm Bitdefender. Rovnix is …
John Leyden, 6 Nov 2014

Hide your Macs, iPhones and iPads: WireLurker nasty 'heralds new era'

The largest-scale attack of its kind on Apple Macs, phones and tablets – and believed the first to maliciously target non-jailbroken iPhones – has been detected. And it's hit thousands and thousands of devices in the wild. WireLurker infects OS X computers, and lies in wait for USB connections to Apple iPads and iPhones. It then …
Darren Pauli, 6 Nov 2014

NSA director: We share most of the [crap] bugs we find!

The National Security Agency (NSA) is only holding back a teeny, tiny number of code secrets, with director Admiral Mike Rogers promising the world the spook collective shares 'most' of the vulnerabilities it finds. The agency head made the remarks on his second visit to Silicon Valley since his appointment in April this year. …
Darren Pauli, 6 Nov 2014
Azure Index

Microsoft releases free anti-malware for Azure VMs

Free anti-malware software is not hard to find: even reputable vendors offer product at the low, low, price of $0.00 for client devices/ Microsoft is now doing the same for servers – or at least for virtual machines in its Azure cloud with a new offering called (deep breath now) Microsoft Antimalware for Azure Cloud Services and …
cookies_eyes_privacy evercookies flash cookies

EFF: VPNs will crumble Verizon's creepy supercookie stalkers

The Electronic Frontier Foundation says Verizon's silent supercookies, which always follow subscribers around the internet, are being abused by creepy advertisers to push targeted ads. The EFF says people should start using encrypted VPNs by default to claw back their privacy, because opting out of the system is not enough. Two …
Iain Thomson, 6 Nov 2014
Malware

158 new malware created EVERY MINUTE

Malware monitors PandaLabs says 227,747 new malware samples are released every day. The findings from its recent survey found 20 million samples were created in the third quarter of 2014. Three quarters of infections were trojans while only 9 percent were viruses and 4 percent worms. The number of trojans rose 13 percent over …
Darren Pauli, 6 Nov 2014
John Brennan protests TSA security by going starkers

Feds investigate Homeland Security background checker security breach

A contractor running background checks for the US Department of Homeland Security has suffered a potentially embarrassing security breach. The security snafu at USIS reportedly led to the theft of some DHS employees’ personal information. The recently discovered breach prompted DHS to suspend all work with USIS, pending the …
John Leyden, 5 Nov 2014
Fawlty Towers

Watchdog bites hotel booking site: Over 3k card details slurped

Hotel booking website Worldview Limited has been fined £7,500 over a security breach involving its website that allowed hackers to swipe the full payment card details of some 3,814 customers. Sensitive data was accessed after the unidentified attacker exploited a SQL injection flaw in Worldview website to access the firm's …
John Leyden, 5 Nov 2014
President Putin doing judo

Russia to ban iCloud.. to PROTECT iPhone fiddlers' pics 'n' sh*t

The Kremlin is set to ban Apple's iCloud as part of plans to throw up a new iron curtain around Russia's digital communications. Anti-data-offshoring laws will come into force on New Year's Day 2015 that require all data generated within Russia to be stored within its borders. Apple's iCloud service has been in the news …
Jasper Hamill, 5 Nov 2014

Crypto collision used to hijack Windows Update goes mainstream

The cryptographic hash collision attack used by cyberspies to subvert Microsoft's Windows Update has gone mainstream, revealing that MD5 is hopelessly broken. Security researcher Nat McHugh created two images of different rock 'n' roll icons - James Brown and Barry White - with the same MD5 hash. "The images were just two I …
John Leyden, 5 Nov 2014