Hacking, Security & Privacy - Page 16

The Hyatt chain of hotels just yesterday found malware running on their systems that operate the payment processing for their hotels.

In their statement they said that they've launched a full-scale investigation and are cooperating with some of the leading cyber-security experts in order to get the issues resolved. In the meantime, if you happen to have stayed at a Hyatt owned hotel within the past six months, be sure to keep an eye out on your bank accounts just in case something suspicious happens to show up.

How does one get malware onto a payment processing system? It's not terribly hard but there are best practices in place to make sure that it's difficult to do. Segmenting the network used and keeping it separate from other networks used for browsing the web, making sure that a proper IDS is in place to detect weird activity and limiting any IP addresses that actually access those systems processing card data to those on a whitelist. But those don't make it impossible, just harder and more likely to scare away all but the most seasoned and prepared of individuals. You can read all about the Payment Card Industry standards here.

In an effort to bolster account security, tech giant Google has confirmed that it's testing a new login system that doesn't require passwords.

Google is currently testing a new authentication method that could pave the way to password-free accounts in the near future. Google's method is very much like Yahoo's Account Key logins, which uses smartphone push notifications instead of manual passwords to log into Google accounts. The company's new sans password login method with a small batch of users, and one Reddit user has shared a few details on the new system.

According to an early access tester, the new method is pretty simple and is very much like linking a smartphone to a Roku to use a remote, or tethering a phone to an Xbox One to use Smartglass. Once your phone is linked and authorized to login to your Google account, the app sends a code that's shown on both screens, and users must type the same code to link the devices. Once that's done, users are logged in and can freely use their accounts. Basically Google's new method hinges on syncing, meaning you'll be matching digital pairs rather than typing in a per-session password.

The UK government's Home Secretary Theresa May has proposed an Investigatory Powers Bill with the aim of bolstering intelligence agencies and law enforcement in surveillance. But, like the Patriot Act in America and Bill C-51 in Canada, it's being criticized for going too far.

Apple has joined the opposition in an effort to see the bill rewritten, saying in a rare public statement that it makes the "personal data of millions of law abiding citizens [...] less secure". Part of its issue is how vague the bill can be, thereby opening it up to abuse of current privacy rights, not just in the UK, but elsewhere, too.

The bill specifically affects Apple in that it may force them to remove the encryption featured in their iMessage and FaceTime apps, thereby allowing authorities to better spy on iPhone users as they see fit. It notes that while authorities may only be interested in select persons, once the public opens their private messages up, they're open to everyone.

While we wrote that relatively small 'Western Nations' such as Australia are under possible infrastructure hacker threat due to low-security measures, news has come to light that a New York dam was infiltrated by Iranian hackers back in 2013.

With the dam being located no more than 20 miles from New York City, this Iranian hack likely came around thanks to Leon Panetta, ex-Defense Secretary, calling out Iran's hacking prowess in October 2012, putting Governments on high alert for possible hacker threats. With this hack taking place and being kept under the covers until recently, it's just one example of how infrastructure infiltration is a very real threat.

This classified dam is one of the very few public accounts of infrastructure control loss, with all major suppliers of electricity, sewage, water and more all linked to the internet.

Juniper Networks has had quite the week. On Thursday it seems that some unauthorized code was found to have been inserted into their ScreenOS, which forms the basis for their hardware filewalls. This malicious code would allow a backdoor into the firewall, letting potential attackers decrypt VPN traffic with the keys found inside.

The fun doesn't stop there, however. Now the FBI has now gotten involved and will be investigating the possibility of whether foreign governments had been involved with inserting the malicious code for the purposes of intercepting encrypted communications from government employees.

And even in the non-governmental sector, Juniper is a widely used brand of IT security products, so it can't be ruled out that it was a privately funded and conducted attack with motivations not tied to any government.

We've all seen bots spamming phishing links on company social media promotions, trying to make use of the companies social networking promotion budget in order to lure in clicks from unsuspecting victims. Taclking the Instagram side of things is a company called Proofpoint, offering a cybersecurity service that aims to limit the exposure these phishing bots receive - named SocialPatrol.

With there being five million monthly active Instagram users in Australia alone and 400,000,000 'Instagrammers' across the globe, Proofpoint's aim is to ensure company promotions stay safe of hackers and retain legitimacy. Quite often when looking at promoted post on social media, customers will switch off when something is covered in "work from home!" or "buy cheap sunglasses here!" statements, sometimes cheapening the brand and possibly resulting in customers turning away.

In a recently issued press release, Global Customer Relations for General Mills Director, Jeff Hagen, spoke positively of this new technology, stating that it has "Helped us control high levels of spam and inappropriate comments on our Instagram accounts," adding "Without the Proofpoint SocialPatrol technology, our only recourse would have been costly expansion of our manual moderation or risk losing followers." While this will likely have little affect on the tech savvy audience TweakTown normally gathers, this technology should be a great invention for the elderly and youngster population alike, further helping protect them from threats online.

A Twitter account with no profile photo and just over 2,000 followers called 'Cturt' has confirmed a Sony PlayStation 4 jailbreak success recently, telling the public that the "PS4 kernel exploit [is] finally working! Thanks to everyone involved!"

This jailbreak is said to enable a few interesting and helpful features, with CTurt explaining that this new breakthrough will enable users to "successfully dump RAM from other processes (like SceShellUI) using ptrace," further explaining that he will next be working on patching RAM.

While there is no posted guide, links or information as to how users can complete the same process on their consoles, there is a GitHub page of the same name, linked in the Twitter, where this information may surface in the near future. This news is exciting for developers looking at making custom firmware for the PlayStation 4, further opening up many other coding possibilities for community advancement of this device.

A recent hack and theft of Government files sent a US Government department into a frenzy in recent past, with further developments urging a spokesperson to inform the public that not every victim has or will be notified of this data breach just yet.

While the Government is meant to be notifying each victim of this breach from May 2014, around 7 percent of the 1.5 million people in danger are currently unable to be contacted. This is said to be due to them moving house or being without a Government-recorded address. Confirmed by the Office of Personnel Management, being the place that was hacked, this notification system is obviously not flawless.

The original hack was traced back to China but wasn't discovered or announced until one year after its occurrence, with the names, addresses, social security numbers and various other pieces of information about employees, contractors and job applicants being now in the hands of an unverified source.

Appointed as a representative for six major Hollywood studios, The Motion Picture Association of America (The MPAA) has published new anti-piracy guidelines, addressing how they are slightly loosening the noose on cinemas and more.

Set to target those who film movies while at the cinema, The MPAA is now telling these facilities that calling the cops on recorders is now an optional endeavor, previously ordering workers to call law enforcement immediately. While this policy is targeted mostly at handy cam users looking to leak movies on torrent websites, The MPAA has included recording devices of any kind, including Google Glass.

The MPAA previously implemented a $500 'bounty' to workers who caught and apprehended pirates looking to steal content, with this also being removed in the latest update. While a bounty was a good token in the first place, the removal of a 'bonus' will possibly breed a negative culture within the cinema employees.

Kaspersky Lab has reported that a group of approximately 20 Russian hackers has stolen $790 million recently. Around 70 percent of this money has come from individuals and businesses within USA and Europe since 2012, supplementing this income with the further 30 percent coming from Russian bank accounts.

Describing them as a highly organized and sophisticated syndicate, Intel Security's Mike Sentonas told News.com.au that "We've been tracking a lot of these groups for years now and they have such strong architecture it's hard to shut it down."

While hackers can be placed around the globe, Deakin University's Professor Mathew Warren claims that a major concentration of these criminals are located within Russia and the surrounding countries of Ukraine and Bulgaria.

While Dell recently admitted that a dangerous vulnerability was pre-installed on their systems, they refused to believe that it was created by them but still pledged to remove it.

In a great move my Microsoft, its Windows Defender security system has now begun locating and removing the certificate itself, as long as you've updated your Windows OS. Discovered by ZDNet in a routine action just this morning, Windows Defender identified a threat named "Win32/CompromisedCert.D" and removed it from the system.

Dell has reportedly started issuing updates to its maintenance utility to also rid this issue for all concerned, but it doesn't hurt to update Windows Defender to be safe.

"Malicious hackers already know us to be weaker than the rest of the world," the director of Hacklabs, Chris Gatford, told News.com.au in an interview. He believes that without much effort, Australia's water and electricity supply lines could become a complete shambles with a single hacker attack.

Gatford went on to draw the comparison between Australia's national infrastructure and your mothers Microsoft Surface, stating: "It would only take a skilled individual to breach these computer systems, because more often than not they are not patched as frequently as corporate or home systems which have automated updates." While he did comment mainly on security concerns within Australia, Gatford also made mention of other technical mishaps around the world, touching on "historical examples of traffic lights being overtaken, denial-of-service attacks at airports and organisations in Wall Street coming under attack to see its 100 per cent possible."

The whole situation isn't quite as dire as it may initially seem though, the Hacklabs director did reassure us that these necessary utilities would recover quickly from attack, rather than send Australia into a Fallout 4-like existence.

Described as an "unintended security vulnerability," Dell has admitted that a root certificate preinstalled on some of its models exists and promises to remove it.

A Dell spokesperson explained that "to address this, we are providing our customers with instructions to permanently remove the certificate from their systems via direct email, on our support site, and technical support," further commenting that the computer giant does not install malware on user systems pre-delivery.

While Dell claims no responsibility for this flaw, a security blogger by the name of Hanno Bock disagrees. He says that this root certificate is not only shipped within these pre-built machines, but it's under the name 'eDellRoot' and is linked to 'Dell Foundation Services' drivers.

Hacktivist collective Anonymous has reportedly declared war against the terrorist group ISIS, vowing revenge against the Islamic State following the recent terror attacks in Paris.

On the Saturday following the brutal attacks that saw more than 129 people murdered, ISIS took responsibility for the wave of terror that swept over the city of Paris. President François Hollande then confirmed the Islamic State's involvement. The terrorist group boasted that this wast just "the first of the storm" and called Paris a "capital of prostitution and obscenity."

Anonymous has now stood up to promise retribution, and has already begun wreaking havoc across the Islamic State's online network as part of the #OpParis campaign. "These attacks cannot be left unpunished. That's why Anonymous worldwide will track you," a recent Anonymous video proclaimed. "Yes, we are going to track you down, like we have since the Charlie Hebdo attacks. Wait, then, for a massive response from Anonymous. Know that we will find you, and we will hold nothing back."

An anonymous hacker group has remotely jailbroken a new iPhone running iOS 9.1, winning themselves a cool $1 million from startup Zerodium (self-described as a "premium exploit acquisition platform"). The winnings are pending final verification of the exploit, but results at this stage look good.

To put the difficulty of this feat in context: a chain of zero-day bugs needed to be found, the hack needed to be remote (much more difficult -- Chinese hacking team Pangu already hacked the new iPhone, but couldn't do it remotely) and made through Safari, Chrome, or a text or multimedia message, and full system access needed to be obtained. An iPhone has not been remotely jailbroken for over a year, since iOS 7. Zerodium says Apple will likely patch these bugs "in a few weeks to a few months".

The winning team was one of two to take on the challenge. Both found themselves stuck, but eventually one found a way via Chrome and iOS, just a few hours before the challenge was to end.

Researchers have discovered there are 256 apps on the App Store that have found their way around Apple's vetting process and violated privacy rights. All of them use the Chinese-developed Youmi SDK. In total, approximately one million people use the apps in question.

To be clear, the developer of any of these apps is not necessarily to blame at all. It appears Youmi is the one interested in acquiring your data, and has insidiously worked gathering tools into its development kit, thereby attempting to cover its tracks and pass the blame onto developers, should the scheme be uncovered.

Nate Lawson, founder of security analytics startup SourceDNA (which uncovered the violations), says this is "definitely the kind of stuff that Apple should have caught."

It looks like Intel is on a mission, where the chipmaker wants to see facial recognition or fingerprint scanners to replace the traditional, and easily penetrated passwords we all use for countless services, websites, bank accounts, and more.

Intel not only things it's a possibility, but that it's something it can get into motion very quickly. Kirk Skaugen, Senior VP and General Manager of Intel's Client Computer Group said at the Citi Global Technology Conference earlier this week: "We want to eliminate all passwords from computing. I can confidently say today, you can eliminate all your passwords today, if you buy a 6th Generation Core system".

So the company is saying that its Skylake architecture is capable of true facial recognition security thanks to Windows 10, where you can use the entire feature set of Windows Hello. This, mixed with Intel's RealSense 3D camera, we could see true facial recognition security that is much more secure than the traditional password. Skaugen added: "You can do everything from measure blood pressure, blink detection, all these kinds of things... In fact, in Berlin, one of my funniest demos in my 23 years at Intel is when I brought two identical twins out on stage and I mixed them up and only one could log in with the PC, and it actually worked". Now that, is some exciting stuff.

Avid Life Media was unable to find a willing suitor for Ashley Madison, and trying to generate new funds proved extremely difficult.

Avid Life sent a letter to investors that it was interested in purchasing $10 million worth of shares, amid pressure to improve the company's liquidity. Any aspirations for an IPO would be crippled in a "doomsday scenario," according to bankers speaking to Reuters prior to the massive data dump.

"Over the last couple of years, we have not been successful in exploring various alternatives including a sale of the business and seeking debt from third parties," a letter from the board of directors confirmed.

Julian Assange knows a little something about trying to avoid extradition, and urged former NSA contractor Edward Snowden to select Russia over Latin America. Not only was reaching Latin America a difficult journey, but Snowden's personal safety would have been at risk, Assange noted.

Assange urged Snowden to disregard "negative PR consequences" about choosing Russia, where his physical safety has been provided by the Russian government - a guarantee that would have been significantly less likely if he ended up somewhere in Central or South America.

Sarah Harrison, one of Assange's most trusted senior staff members, actually met with Snowden while the American was in Hong Kong - at a time when it was unknown where Snowden would end up.

Before former NSA contractor Edward Snowden fled to Russia, the FBI demanded the immediate arrest - and extradition - of Snowden if he went to any Scandinavian nations. Snowden applied for asylum in Norway, but once FBI officials heard he would try to head to a Scandinavian country, they began pressuring Denmark, Sweden, Norway and Finland. Trying to leave Moscow, however, wouldn't be an easy task:

"The US Department of Justice is prepared to immediately draft the necessary paperwork to request the extradition of Snowden to the US from whichever country he travels to from Moscow," according to the letter. "The FBI expresses its gratitude... for any assistance that can be provided on this important matter."

It's likely the FBI and other government officials sent similar requests to many other European nations, which prevented Snowden from traveling outside of Russia.