Hacking, Security & Privacy - Page 19

WikiLeaks has published "Target Tokyo," listing 35 "Top Secret NSA targets" located in Japan, including intercepts from US-Japan relations, trade negotiations and sensitive climate change strategy.

The United States spied on companies such as Mitsubishi and Matsui, Japanese government officials, ministries and senior advisers to Prime Minister Shinzo Abe's administration. Other targets included the Japanese Cabinet Office switchboard, Japanese Central Bank officials, governors, and other high-ranking officials.

"In these documents we see the Japanese government worrying in private about how much or how little to tell the United States, in order to prevent undermining of its climate change proposal or its diplomatic relationship," said Julian Assange, Editor-in-Chief of WikiLeaks. "And yet we now know that the United States heard everything and read everything, and was passing around the deliberations of Japanese leadership to Australia, Canada, New Zealand and the UK."

Cybercriminals known as "ratters," responsible for hijacking webcams and other electronic devices to spy on unsuspecting users, are finding new ways to launch attacks. Specifically, the groups use remote access tools (RATs) to steal images and photos from webcams, and have lately started charging others for this stolen data.

"Ratters are disturbingly comfortable with spreading misery and fear," said Adam Benson, deputy executive director for the Digital Citizens Alliance. "It's like a game for them. We saw them chat about it on Hack Forums and then share videos showing off how they scare young people, spy on people in private moments, and steal pictures from victims' accounts."

It's not uncommon to find RATs available for download on Internet forums and through file-sharing services. One such forum offered access to compromised devices for $1 for guys and $5 for women - showing there a modest financial incentive.

White hat hacker Samy Kamkar recently posted a video discussing how he found a way to "locate, unlock and remote-start" General Motors vehicles by compromising the OnStar vehicle communications system.

Using the gadget, which cost around $100 to make, the system makes it possible to locate, unlock, and start the engine. Once a small wireless device has been placed near a GM car with OnStar, Kamkar was able to gain unauthorized access to the vehicle.

Dubbed the "OwnStar" system, Kamkar showed he was able to intercept communication from the OnStar service and OnStar RemoteLink mobile app. Technical details will be revealed during Def Con next week.

The FBI isn't finding it very easy to beef up its cybersecurity ranks, largely due to lower salaries, according to a report from the US Department of Justice.

In addition to higher salaries in the private sector, trying to get a government position related to cybersecurity involves multiple hoops that people won't have to jump through if they simply go to Silicon Valley. Applicants have to undergo extensive background checks, drug screenings, and other hurdles that private sector companies typically don't bother with.

Under the Justice Department's Next Generation Cyber Initiative, which went live in 2012, the FBI has successfully recruited just 52 of the 134 computer scientists it was granted permission to hire.

United Airlines, the No. 2 largest airline company in the world, was apparently attacked by Chinese hackers in May or June.

If true, it looks like hackers could have been able to collect movement data on millions of American travelers. Passengers, flight origins and destinations, and other data was likely taken by the hackers, according to unnamed officials speaking with Bloomberg.

"Speculation that China is responsible for the United Airlines breach is interesting but at this point, irrelevant," said Jason Polanich, founder and chief architect of SurfWatch Labs. " Too many companies have a false sense of security, thinking it won't happen to them. Pair that with the fact that hacking tools are available to virtually everyone today via illicit trade on the Dark Web and in other places and you've got a recipe for disaster.

The United States faces an overwhelming number of foreign-based cyberattacks, and there is no clear strategy on how to defend - and retaliate - against these attacks.

"We have known for a long time that there are significant vulnerabilities and that these vulnerabilities are gonna accelerate as time goes by, both in systems within government and within the private sector," Obama noted during an international summit last month.

Even though it's important to be able to conduct surveillance - the United States, which arguable has more to lose in the cybersecurity space than other nations - should have worked more diligently to improve its security infrastructure.

As part of its "Operation Anon Down," the Anonymous hacker collective promises to continue leaking documents from the Canadian Security Intelligence Service (CSIS). In its first data release, Anonymous shared a 2014 Treasury Board memo regarding funding of the Canadian spy agency's operational ability overseas.

During a protest of a dam project, the Royal Canadian Mounted Police (RCMP) shot and killed James McIntyre, a protester wearing a Guy Fawkes mask. The police said McIntyre ignored their commands while approaching in an "aggressive manner." Here is what Independent Investigations Office said:

"According to the police, officers were responding to a report of a male causing a disturbance at a public information session. Upon arrival, police encountered a masked individual outside, believed to be connected to the complaint. A confrontation occurred and the male affected person was shot."

Edward Snowden doesn't have very many fans when it comes to people in the US government and the National Surveillance Agency (NSA).

"It is hard to quantify this harm, such as it is, but I think the inflammatory nature of the way the Snowden affair played out really set back our collective discussion on cybersecurity," said Rajesh De, former general counsel for the NSA, when asked about Snowden's data leaks during the Big Law Business Summit.

The White House recently responded to a petition to the White House that sought an official pardon for Snowden. Of course, that's not going to happen:

Alaska Airlines has teamed up with the airport security firm CLEAR to test a biometrics platform that could one day replace traditional boarding passes. The biometrics system should make it even easier to check-in, and save passengers a bit of time before boarding a flight.

A kiosk machine at the Mineta San Jose International Airport scans a traveler's eye, or checks fingerprints, before hopping on a plane. It's a groundbreaking effort that costs members $179 per year, and is currently being tested in 12 US airports.

"We have no specific timeline, but we look forward to working with Alaska Airlines to expand our relationship to other cities in their network," said Ken Cornick, president and CFO of CLEAR, in a statement published by the San Jose Mercury News. "Having direct access to a boarding pass and not needing to print it or download it into their phone is both a significant customer advantage and security advantage."

The White House has responded to an online petition to pardon Edward Snowden, which generated more than 167,000 signatures since going live in June 2013.

The petition had the following description: "Edward Snowden is a national hero and should be immediately issued a full, free, and absolute pardon for any crimes he has committed or may have committed related to blowing the whistle on secret NSA surveillance programs."

"Instead of constructively addressing these issues, Mr. Snowden's dangerous decision to steal and disclose classified information had severe consequences for the security of our country and the people who work day in and day out to protect it," said Lisa Monaco, President Obama's Advisor on Homeland Security and Counterterrorism.

The Obama Administration and law enforcement officials want access to encrypted data, arguing the government and law enforcement need to be able to retrieve information. Ideally, the government would receive warrants and conduct a legal and transparent operation, but companies are willing to stand their ground regardless.

Here is what cryptologist Matt Blaze said during a recent event in Washington, DC (per Washington Times):

"I don't think [FBI] Director [James] Comey wants the world that he's asking for," said .... "I think the world in which we build systems with this added constraint of ensuring law enforcement access is going to cause such an increase in the kinds of digital crimes that are going to become more serious that - even if we take all of the things that we disagree about about values and put them aside - we are going to have the things that we agree about get a lot worse, and that really scares me as we rely on those systems more and more."

It turns out 92 percent of Americans think the US government should take some form of action in retaliation for cyberattacks and data breaches, according to a survey from the Vormetric cybersecurity company. The US government is under attack by cybercriminals, and they are proving to be successful in their efforts to steal data and compromise networks.

The survey found 45 percent of Americans believe the Obama Administration should initiate talks with the suspected country's leaders to stop future breaches. Thirty-six percent say trade sanctions should be created, and 31 percent believe diplomatic sanctions on a nation's representatives located in the United States should take place.

A surprising number of people think there should be more stringent measures, including 25 percent of respondents saying all ties should be cut off with the responsible country - and 10 percent even think a retaliatory cyberattack might help.

Israel understands the importance of building a strong cybersecurity defense, as attacks on its critical infrastructure greatly increased over the past few years.

Israel Electric, responsible for more than 80 percent of Israel's power production and infrastructure, saw cyberattacks increase from a few hundred per hour in 2013 - up to 20,000 per hour in 2014, according to reports. The Israeli government and major businesses are on a cybersecurity hiring spree, trying to help defend against evolving threats.

"You can't be a good defender unless you understand the offense," said Amos Yadlin, former military chief and head of the Tel Aviv University Institute for National Security Studies, in a statement to Bloomberg News. "Therefore, defensive efforts must overlap to some degree with offensive efforts, including those of intelligence collection."

Edward Snowden may have support from a lot of American citizens, but don't count New Jersey Governor Chris Christie as a fan of the former NSA worker.

Recently, Christie described Snowden as a "piece of garbage," and said he "wouldn't send the SEALs in to pick up that piece of garbage," when asked he would send in the special ops unit to retrieve the American.

Just a few months ago, Christie described Snowden's whistleblowing behavior as "treasonous" and that he "should be forced to come home... and face prosecution."

After Anonymous took credit for a data breach targeting the US Census Bureau, the agency is now investigating the incident. The Federal Audit Clearinghouse is responsible for collecting and storing audit information from local and state governments, Indian tribes and non-profit groups.

The Federal Audit Clearinghouse stores non-confidential information, including names, site user names, and organization addresses and phone numbers.

Don't worry, as all internal confidential information remains secure: "That information remains safe, secure and on an internal network segmented apart from the external site and the affected database," said John Thompson, director of the Census Bureau, in a blog post.

As there is a big push for consumers and retailers to adopt contactless payments, there are plenty of cybersecurity headaches that must be addressed.

The Which? Consumer group noted that data from contactless debit and credit cards can be intercepted - and while not all data is taken - it's enough to make fraudulent purchases.

"Using an easily obtainable reader and free software to decode data, we were able to read the card number and expiry date from all 10 cards," said a spokesperson from Which?, in a statement published by Sky News. "We were also able to read limited details of the last 10 transactions, although no cards revealed the CVV security code."

BlackBerry is looking for new business opportunities away from just smartphone handsets, and recently showed off a new line of security products. The company wants to continue its evolution from just a smartphone maker, and has focused more on software and cloud-based offerings.

The full turnaround may take a bit longer than what the company previously predicted, and instead of it taking six months, could take an additional 12 to 18 months.

"I'm pretty satisfied with the progress on the turnaround so far," said John Chen, CEO of BlackBerry, in a statement to Reuters. "I laid out the $500 million software revenue target and I'm still comfortable with that commitment for this fiscal year, it looks good."

It looks like terrorists are communicating about different attack strategies to launch cyberattacks against the United States, according to FBI director James Comey.

"We are picking up signs of increasing content," Comey said during the Aspen Security Forum. "It's a small but potentially growing problem." Comey didn't publicly discuss what types of attacks could take place - and any initial plans are relatively rudimentary - but shows increased concern from the US government.

Cybercriminals have found numerous ways to target US interests online, but there is specific concern of attacks against critical infrastructure. It would seem like organized foreign states, or state-sponsored hackers pose a greater concern, but terrorists could coordinate with hacker mercenaries.

Oops! It looks like a Universal Pictures studio in France may have been responsible for seeding a pirated version of Jurassic World from its office.

Universal submitted a US Digital Millennium Copyright Act (DMCA) takedown notice to Google, asking it to block requests to hosted and linked copies of Jurassic World. One link was https://127.0.0.1:4001/#/fr, indicating it was a "localhost" machine. Movie studios typically use automated scanners to identify sources of their pirated content, and it would seem chaotic that the scanner identified a Universal machine.

It's not surprising that movie pirates have been all over Jurassic World, as it smashed box office records after its release on June 12. A Jurassic World sequel is planned for 2018, as the movie generated so much international box office revenue. In case you missed it, here is the TweakTown review of the film.

Following news that cybersecurity researchers were able to remotely hack an operational Jeep, it looks like Fiat Chrysler has issued a 1.4 million vehicle voluntary safety recall. This is the first time any automaker in the United States has issued a recall because of a cybersecurity threat - after hackers used the infotainment system to gain access to the vehicle.

The security recall will include upgraded vehicle software that has enhanced security features able to resolve the problem. However, it looks like political leaders in Washington want a more proactive response, as more connected vehicles hit the road:

"There are no assurances that these vehicles are the only ones that are this unprotected from cyberattack," said Sen. Ed Markey (D-Mass), as he called upon the National Highway Traffic Safety Administration (NHTSA) to launch a full investigation. "A safe and fully-equipped vehicle should be one that is equipped to protect drivers from hackers and thieves. Both automakers and NHTSA should immediately take steps to verify that other similar vulnerabilities do not exist in other models that are on the road."