All iSpy conspiracy bullshit aside, you are probably more interested in what your iPhone does with location data. Well, if you opt-in to the iPhone's location services, detailed—but anonymized—location data is transmitted back to Apple on a regular basis.
Gadget Lab reminds us of a letter Apple general counsel Bruce Sewell sent to a couple of Congressman last year explaining how and why Apple collects location data. (Wired's hosting the letter here.) Basically, if you've got Location Services turned on, whenever you request current location data (like via an app), Apple collects info about nearby cell towers and Wi-Fi hotspots. If you happen to be using GPS, it'll collect the GPS coordinates too. That data's then transmitted to Apple every 12 hours over "secure" Wi-Fi networks, anonymized with a "random identification number generated every 24 hours by an iOS device," so neither Apple nor anybody can personally identify you.
If you remember, Apple started doing its own location services last year (from iOS 3.2 onward), instead of using Google or Skyhook's location data. So, it needs to build and maintain its own database of known tower locations and Wi-Fi hotspots—that's where this info comes in. You're an official location scout for Apple, in other words. When your device asks where it's at, it hits up this database before zeroing in with GPS.
Not too crazy, though it doesn't make the ease with which your location history can be extracted from your Mac or iPhone any less unnerving. Also, it makes the lack of a purge after the data's transmitted to Apple seem more and more like a mere oversight.
More on this is at Gadget Lab: [Gadget Lab] via [Gizmodo]
Thursday, 28 April 2011
Hide Your Data Through Fragmentation, Not Encryption
The thing about data encryption is that it's basically a flashing neon sign indicating "SENSITIVE DATA HERE!" A new technique lets you secure your data by customizing the way that data is fragmented across your drive.
The new method uses special software to place data on specific parts of your hard disc using a code instead of the disc drive controller chip. Your sensitive data is encoded into a binary value and used to modify the fragmentation patterns of an existing file. The conversion is based on whether or not sequential clusters of data are stored adjacently. If they are, it represents a binary 1; if they aren't, it's a 0.
The system was developed by Hassan Khan and his colleagues at the University of Science and Technology in Islamabad, Pakistan. They say that it can hide a 20MB message on a 160GB hard drive, and detecting its existence would be "unreasonably complex." This is important because the normal methods of encryption are so well known that they're dead giveaways that something is amiss, and often the fact that you have something to hide can be just as damning as the information itself.
This isn't a permanent solution for data security, of course. Now that this type of camouflage is in the field, it won't be long until a detection method is reverse engineered. But research like this is important for everyone—journalists, dissidents, LOIC enthusiasts—who thinks they are at risk of having their drives seized and searched for incriminating information.
[ScienceDirect via New Scientist via Gizmodo]
Tuesday, 12 April 2011
Corrupt bank worker jailed over Trojan-powered tax scam
A former local business manager at a bank who participated in a £3.2m self assessment tax fraud was jailed for three years and three months on Friday.
Nikola Novakovic, 34, conspired with Oleg Rozputnii, 28, to register over 1,050 fictitious taxpayers on the Income Tax Self Assessment system. The pair claimed fraudulent tax refunds under assumed names before laundering the proceeds of the scam via 200 fraudulent bank accounts.
Personal details needed to pull off the racket were extracted from the computers of consumers using an unspecified computer virus. Rozputnii, an illegal immigrant from the Ukraine, used numerous false identities to help commit the fraud, which also involved Dmytro Shepel, 26, a Ukrainian, also from London.
Joe Rawbone, assistant director of HMRC Criminal Investigation, said: "These men ran an audacious scam stealing millions of pounds. They set up hundreds of false bank accounts using viruses to hack into personal computers to gain information. They used their illegal profits to fund lavish lifestyles, buying performance cars including Porches, Mercedes and Jaguars. HMRC takes tax fraud extremely seriously and we will recover any financial gain from this criminal activity."
The scam netted £3.2m between January 2008 and September 2010 when the racket was uncovered following a lengthy investigation by HM Revenue & Customs (HMRC).
Sentencing, Mr Recorder Singh QC said that Novakovic "had abused his position with the bank" as part of a "sophisticated and orchestrated fraud".
Novakovic and Rozputnii pleaded guilty to cheating the public revenue in March. Rozputnii, the main mover behind the scam, was jailed for three years and nine months on Friday. Shepel was sentenced to three-and-a-half years at an earlier hearing in August 2010.
Pictures of the subjects and their cars can be found in a HMRC statement on the case here. ®
[TheRegister]
Nikola Novakovic, 34, conspired with Oleg Rozputnii, 28, to register over 1,050 fictitious taxpayers on the Income Tax Self Assessment system. The pair claimed fraudulent tax refunds under assumed names before laundering the proceeds of the scam via 200 fraudulent bank accounts.
Personal details needed to pull off the racket were extracted from the computers of consumers using an unspecified computer virus. Rozputnii, an illegal immigrant from the Ukraine, used numerous false identities to help commit the fraud, which also involved Dmytro Shepel, 26, a Ukrainian, also from London.
Joe Rawbone, assistant director of HMRC Criminal Investigation, said: "These men ran an audacious scam stealing millions of pounds. They set up hundreds of false bank accounts using viruses to hack into personal computers to gain information. They used their illegal profits to fund lavish lifestyles, buying performance cars including Porches, Mercedes and Jaguars. HMRC takes tax fraud extremely seriously and we will recover any financial gain from this criminal activity."
The scam netted £3.2m between January 2008 and September 2010 when the racket was uncovered following a lengthy investigation by HM Revenue & Customs (HMRC).
Sentencing, Mr Recorder Singh QC said that Novakovic "had abused his position with the bank" as part of a "sophisticated and orchestrated fraud".
Novakovic and Rozputnii pleaded guilty to cheating the public revenue in March. Rozputnii, the main mover behind the scam, was jailed for three years and nine months on Friday. Shepel was sentenced to three-and-a-half years at an earlier hearing in August 2010.
Pictures of the subjects and their cars can be found in a HMRC statement on the case here. ®
[TheRegister]
Wireless Security – Choosing the Best Wi-Fi Password
Running through some tests for an upcoming wireless security book and it really brings home the importance of choosing a good password for your Wi-Fi network.
Currently, the best security setting for your home or office Wi-Fi is WPA2.
WPA2 Enterprise is the best if your organization supports it, but WPA2 Personal is great for home and small offices.
Do not use WEP. It has been cracked a long time ago, and an attacker does not even have to crack it, the WEP key can be passed just like NTLM passwords.
The most common technique used for WPA/WPA2 hacking is a dictionary attack.
The attacker captures a WPA password handshake and passes this through a program that will try numerous passwords from a word list.
Here is the key, if the password is not in the word list, they hacker does not get into your system.
Using a lengthy complex password goes a long way in keeping your WPA2 network secure.
A combination of upper/lower case letters, numbers and special characters is the best bet.
Some prefer using a short sentence that means something to them, while replacing some of the letters with numbers and adding in a few extra characters.
I just ran one common word list attack against my WPA2 password. It tried over 1 million word combinations from the list with no dice. My network is still secure!
The more un-dictionary looking your password is, the better!
Building More Secure Passwords
The problem of weak, guessable security passwords isn’t a new one, but it’s not going away.
In fact it’s getting worse, despite pleading from IT professionals to choose tough-to-guess passwords.
Workers are still disconcertingly likely to come up with something like “password1!” or simply attach a few numbers like “123,” to the end of a word.
As users have to create several passwords for different systems and change them every 60 or 90 days, it’s little wonder they default to the least complicated password their systems allow and make only minor variations when forced to change them.
Unfortunately, such passwords are easy to guess. At the other end of the scale are passwords software programs randomly generated, which are difficult for users to remember (leading them to write these passwords down which defeats the effort).
In a recent paper coauthored by Cisco, Florida State University, and Redjack LLC, researchers examined how different password requirements affect password strength — such as requiring a minimal password length or the addition of a special character.
The researchers discovered that such policies usually don’t provide greater security since hackers are well-versed in these tactics and can use them to guess passwords and access accounts.
For instance, hackers know that when users are required to use a special character in a password, they can simply append that character to the end of the password.
A better practice say the researchers, is an external password creation tool that changes a password after it’s created to add a guaranteed amount of randomness — for example, adding two random digits to the end of a password.
This allows users to choose a password that they are likely to remember while making it difficult for hackers to guess.
Another option is to implement a “judgmental” password policy which will reject a password instantly based on its estimated strength and suggest a stronger one.
Or administrators could implement password protection software, which lets users remember only one strong master password, leaving the application to store encrypted passwords.
Excerpted and adapted from the Cisco 2010 Annual Security Report
[infosecIsland]
In fact it’s getting worse, despite pleading from IT professionals to choose tough-to-guess passwords.
Workers are still disconcertingly likely to come up with something like “password1!” or simply attach a few numbers like “123,” to the end of a word.
As users have to create several passwords for different systems and change them every 60 or 90 days, it’s little wonder they default to the least complicated password their systems allow and make only minor variations when forced to change them.
Unfortunately, such passwords are easy to guess. At the other end of the scale are passwords software programs randomly generated, which are difficult for users to remember (leading them to write these passwords down which defeats the effort).
In a recent paper coauthored by Cisco, Florida State University, and Redjack LLC, researchers examined how different password requirements affect password strength — such as requiring a minimal password length or the addition of a special character.
The researchers discovered that such policies usually don’t provide greater security since hackers are well-versed in these tactics and can use them to guess passwords and access accounts.
For instance, hackers know that when users are required to use a special character in a password, they can simply append that character to the end of the password.
A better practice say the researchers, is an external password creation tool that changes a password after it’s created to add a guaranteed amount of randomness — for example, adding two random digits to the end of a password.
This allows users to choose a password that they are likely to remember while making it difficult for hackers to guess.
Another option is to implement a “judgmental” password policy which will reject a password instantly based on its estimated strength and suggest a stronger one.
Or administrators could implement password protection software, which lets users remember only one strong master password, leaving the application to store encrypted passwords.
Excerpted and adapted from the Cisco 2010 Annual Security Report
[infosecIsland]
DHL Express spam campaign leads to fake AV
A new spam campaign impersonating the popular mail service DHL Express is currently underway, warn Bkis researchers.
The email in question looks like this:
Once the user downloads and opens the attachment, the worm contained in it downloads a fake AV solution from a server located in Russia.
The fake AV ("XP Home Security") immediately starts its work and tries to trick the user into buying a full version that will supposedly remove all the infections it found.
Users are warned to be careful when reviewing emails purportedly coming from DHL express or any of the other well-known express mail services - more often than not, they are fake emails containing malicious attachments.
[net-security]
The email in question looks like this:
Once the user downloads and opens the attachment, the worm contained in it downloads a fake AV solution from a server located in Russia.
The fake AV ("XP Home Security") immediately starts its work and tries to trick the user into buying a full version that will supposedly remove all the infections it found.
Users are warned to be careful when reviewing emails purportedly coming from DHL express or any of the other well-known express mail services - more often than not, they are fake emails containing malicious attachments.
[net-security]
Ransom Trojan locks Windows
Ransomware is slowly becoming quite a problem, and the latest one spotted by F-Secure tries a rather innovative approach: it locks the victims out of Windows and doesn't allow them boot Windows in either normal or Safe mode until they have entered a code to "complete activation":
Posing as a legitimate Microsoft action, the scammers claim that the activation is "absolutely free and is simply a formality." The victims are offered six phone numbers to which they can place a call, enter a given code and once they receive an activation key, enter it and gain access to their computer again.
The note says that the call from the victim's county is free of charge, but that's a complete lie. The calls purportedly go to Microsoft call centers, but these numbers belong to rogue call centers seemingly located in countries such as the Dominican Republic or Somalia - i.e. countries with expensive phone rate.
But, these rogue call centers are actually located in countries the calls to which are much cheaper than to the previously mentioned ones, so the scammers and the owners of these call centers split the difference in the fee.
F-Secure's Mikko Hypponen demonstrated how the scam works, and says that no matter how many times and to which of the offered numbers one makes the call, one is forced to listen to a four minutes long prerecorded message that reveals at the end always the same activation code: 1351236.
You Windows can be unblocked only by entering the code or formatting your hard drive and restoring its contents from your backup - there is no other way.
[net-security]
Posing as a legitimate Microsoft action, the scammers claim that the activation is "absolutely free and is simply a formality." The victims are offered six phone numbers to which they can place a call, enter a given code and once they receive an activation key, enter it and gain access to their computer again.
The note says that the call from the victim's county is free of charge, but that's a complete lie. The calls purportedly go to Microsoft call centers, but these numbers belong to rogue call centers seemingly located in countries such as the Dominican Republic or Somalia - i.e. countries with expensive phone rate.
But, these rogue call centers are actually located in countries the calls to which are much cheaper than to the previously mentioned ones, so the scammers and the owners of these call centers split the difference in the fee.
F-Secure's Mikko Hypponen demonstrated how the scam works, and says that no matter how many times and to which of the offered numbers one makes the call, one is forced to listen to a four minutes long prerecorded message that reveals at the end always the same activation code: 1351236.
You Windows can be unblocked only by entering the code or formatting your hard drive and restoring its contents from your backup - there is no other way.
[net-security]
Subscribe to:
Posts (Atom)