Showing posts with label Data Security. Show all posts
Showing posts with label Data Security. Show all posts

Thursday, June 7, 2018

Facebook data scandal


Facebook says it will end its data partnership with Huawei by the end of this week following a backlash over the Chinese phone maker's access to Facebook user data.

Huawei, a company flagged by U.S. intelligence officials as a national security threat, is the latest device maker at the center of a fresh wave of allegations over Facebook's handling of private data.

Facebook said earlier this week that Chinese firms Huawei, Lenovo, Oppo and TCL were among numerous handset makers that were given access to Facebook data in a "controlled" way approved by the social media giant.

Huawei said Wednesday it has never collected or stored Facebook user data. Huawei spokesman Joe Kelly said in a text message that the arrangement was about making Facebook services more convenient for users. — AP

source: philstar.com

Friday, July 28, 2017

North Korea hacking focused more on making money than espionage – South Korean study


SEOUL — North Korea is behind an increasingly orchestrated effort at hacking into computers of financial institutions in South Korea and around the world to steal cash for the impoverished country, a South Korean state-backed agency said in a report.

In the past, suspected hacking attempts by North Korea appeared intended to cause social disruption or steal classified military or government data, but the focus seems to have shifted in recent years to raising foreign currency, the South’s Financial Security Institute (FSI) said.

The isolated regime is suspected to be behind a hacking group called Lazarus, which global cybersecurity firms have linked to last year’s $81 million cyber heist at the Bangladesh central bank and the 2014 attack on Sony’s Hollywood studio.

The U.S. government has blamed North Korea for the Sony hack and some U.S. officials have said prosecutors are building a case against Pyongyang in the Bangladesh Bank theft.

In April, Russian cybersecurity firm Kaspersky Lab also identified a hacking group called Bluenoroff, a spinoff of Lazarus, as focused on attacking mostly foreign financial institutions.


The new report, which analyzed suspected cyberattacks between 2015 and 2017 on South Korean government and commercial institutions, identified another Lazarus spinoff named Andariel.

“Bluenoroff and Andariel share their common root, but they have different targets and motives,” the report said. “Andariel focuses on attacking South Korean businesses and government agencies using methods tailored for the country.”

Pyongyang has been stepping up its online hacking capabilities as one way of earning hard currency under the chokehold of international sanctions imposed to stop the development of its nuclear weapons program.

Cyber security researchers have also said they have found technical evidence that could link North Korea with the global WannaCry “ransomware” cyberattack that infected more than 300,000 computers in 150 countries in May.

“We’ve seen an increasing trend of North Korea using its cyber espionage capabilities for financial gain. With the pressure from sanctions and the price growth in cryptocurrencies like Bitcoin and Ethereum — these exchanges likely present an attractive target,” said Luke McNamara, senior analyst at FireEye, a cybersecurity company.

North Korea has routinely denied involvement in cyberattacks against other countries. The North Korean mission to the United Nations was not immediately available for comment.

ATMs, online poker


The report said the North Korean hacking group Andariel has been spotted attempting to steal bank card information by hacking into automated teller machines, and then using it to withdraw cash or sell the bank information on the black market. It also created malware to hack into online poker and other gambling sites and steal cash.

“South Korea prefers to use local ATM vendors and these attackers managed to analyze and compromise SK ATMs from at least two vendors earlier this year,” said Vitaly Kamluk, director of the APAC research center at Kaspersky.

“We believe this subgroup (Andariel) has been active since at least May 2016.”

The latest report lined up eight different hacking instances spotted within the South in the last few years, which North Korea was suspected to be behind, by tracking down the same code patterns within the malware used for the attacks.

One case spotted last September was an attack on the personal computer of South Korea’s defense minister as well as the ministry’s intranet to extract military operations intelligence.

North Korean hackers used IP addresses in Shenyang, China to access the defense ministry’s server, the report said.

Established in 2015, the FSI was launched by the South Korean government in order to boost information management and protection in the country’s financial sector following attacks on major South Korean banks in previous years.

The report said some of the content has not been proven fully and is not an official view of the government.

source: interaksyon.com

Monday, July 17, 2017

Adultery website Ashley Madison in $11.2 million settlement over data breach


The owner of the Ashley Madison adultery website said on Friday it will pay $11.2 million to settle U.S. litigation brought on behalf of roughly 37 million users whose personal details were exposed in a July 2015 data breach.

Ruby Corp, formerly known as Avid Life Media Inc, denied wrongdoing in agreeing to the preliminary class-action settlement, which requires approval by a federal judge in St. Louis.

Ashley Madison marketed itself as a means to help people, primarily men, cheat on their spouses, and was known for its slogan “Life is short. Have an affair.”

But the breach cost privately held Ruby more than a quarter of its revenue, and prompted the Toronto-based company to spend millions of dollars to improve security and user privacy.

Last December, Ruby agreed to pay $1.66 million to settle a probe by the U.S. Federal Trade Commission and several states into lax data security and deceptive practices, also without admitting liability.


According to Friday’s settlement, users with valid claims can recoup up to $3,500 depending on how well they can document their losses attributable to the breach.

Layn Phillips, a former federal judge who mediated the settlement, said in a court filing that the accord offered “a valuable recovery for the class in the face of many obstacles,” including Ruby’s preference that victims arbitrate their claims.

Lawyers for Ashley Madison users may receive up to one-third of the $11.2 million payout to cover legal fees, court papers show.

The case is In re: Ashley Madison Customer Data Security Breach Litigation, U.S. District Court, Eastern District of Missouri, No. 15-md-02669.

source: interaksyon.com

Friday, April 15, 2016

US govt worse than all major industries on cyber security: report


Add caption
WASHINGTON — U.S. federal, state and local government agencies rank in last place in cyber security when compared against 17 major private industries, including transportation, retail and healthcare, according to a new report released Thursday.

The analysis, from venture-backed security risk benchmarking startup SecurityScorecard, measured the relative security health of government and industries across 10 categories, including vulnerability to malware infections, exposure rates of passwords and susceptibility to social engineering, such as an employee using corporate account information on a public social network.

Educations, telecommunications and pharmaceutical industries also ranked low, the report found. Information services, construction, food and technology were among the top performers.

Government agencies have struggled for years to keep pace with malicious hackers and insider threats, a challenge that came into focus after it was disclosed last year that more than 21 million individuals had their sensitive data pilfered during a breach at the Office of Personnel Management.

SecurityScorecard said it tracked 35 major data breaches across government from April 2015 to April 2016.

President Barack Obama has made improving cyber defenses a top priority of his remaining year in office. His administration asked Congress to dedicate $19 billion to cyber security in its fiscal 2017 budget proposal, which would include $3.1 billion for technology modernization at various federal agencies.

Federal agencies scored most poorly on network security, software patching flaws and malware, according to SecurityScorecard, which said they may be more vulnerable to risk due to their large size.

Of the 600 government entities tracked, NASA performed the worst, the report found. The space exploration agency was vulnerable to email spoofing and malware intrusions, among other weaknesses, according to SecurityScorecard’s analysis.

Other low-performing government organizations included the U.S. Department of State and the information technology systems used by Connecticut, Pennsylvania, Washington and Maricopa County, Arizona.

Government organizations with the strongest security postures included Clark County, Nevada, the U.S. Bureau of Reclamation, and the Hennepin County Library in Minnesota.

source: interaksyon.com

Saturday, March 5, 2016

Criminals like Apple iPhones because of encryption — Police


Some criminals have switched to new iPhones as their “device of choice” to commit wrongdoing due to strong encryption Apple Inc has placed on their products, three law enforcement groups said in a court filing.

The groups told a judge overseeing Apple’s battle with the U.S. Department of Justice on Thursday that, among other things, they were aware of “numerous instances” in which criminals who previously used so-called throwaway burner phones had switched to iPhones. They did not list a specific instance.

The brief by the Federal Law Enforcement Officers Association and two others also cited a jailhouse phone call intercepted by New York authorities in 2015, in which an inmate called Apple’s encrypted operating system a “gift from God.”

The government obtained a court order last month requiring Apple to write new software to disable passcode protection and allow access to an iPhone used by one of the shooters in the December killings in San Bernardino, California.

Apple asked that the order be vacated, arguing such a move would set a dangerous precedent and threaten customer security.

Tech industry leaders including Google, Facebook and Microsoft and more than two dozen other companies filed legal briefs on Thursday supporting Apple. The Justice Department received support from law enforcement groups and six relatives of San Bernardino victims.

The law enforcement groups said in their brief that Apple’s stance poses a grave threat to investigations across the country.

The FBI says Rizwan Farook and his wife, Tashfeen Malik, were inspired by Islamist militants when they shot and killed 14 people on Dec. 2 at a holiday party. The couple later died in a shootout with police and the FBI said it wants to read the data on Farook’s work phone to investigate any links with militant groups.

In a filing on Thursday, the San Bernardino County District Attorney’s Office said at least two 911 calls from the time of the shooting reported three assailants, not two.

Even though those reports were “not corroborated,” if in fact there were three attackers it would be important to crack open the iPhone “to identify as of yet unknown co-conspirators,” the District Attorney’s filing stated.

Apple has said it respects the FBI and has cooperated by turning over data in its possession.

The latest request is different, Apple says, because it requires them to crack a phone with a software tool that does not currently exist.

source: interaksyon.com

Tuesday, November 3, 2015

Third teen arrested over cyber attack on UK’s TalkTalk


LONDON — British police said Tuesday they had arrested a third teenager in connection with a cyber attack on Internet and telephone provider TalkTalk that put millions of customers’ data at risk.

The 16-year-old boy was arrested in the east England city of Norwich on Tuesday evening and taken to a police station while the property was searched, according to a statement from the Metropolitan Police.

It comes after the arrests last week of a 16-year-old boy from west London, a 15-year-old boy in Northern Ireland, and a 20-year-old man in Staffordshire in central England. All three have since been released on bail.

The personal data of some four million customers of TalkTalk are feared to have been breached in the hack, which was the third cyber attack on the firm in eight months in which customers’ data was stolen.

TalkTalk has said that it is not sure how many customers were affected but that data including names, bank details and addresses could be at risk.

The company has said that not all information on customers was encrypted, and described the attack as “significant and sustained”.

Police are working together with serious organised crime body the National Crime Agency and cyber crime detectives on the case.

Investigators are examining a ransom demand sent to TalkTalk and purporting to be from the hacker, though the company is not sure if the demand was genuine.

source: interaksyon.com

Sunday, October 25, 2015

Tech spats spark fears of ‘digital protectionism’


WASHINGTON — As American tech giants extend their global reach, fears are growing on their side of the Atlantic over trade barriers some see as “digital protectionism”.

While China has long been a difficult market for US firms to navigate, tensions have been rising with the European Union on privacy, antitrust and other issues, impacting tech firms such as Google, Facebook and Uber.

In recent weeks, Europe’s highest court struck down an agreement which allowed US firms to transfer personal data out of the region without running afoul of privacy rules.

In parallel, Brussels is looking to create a new “digital single market” simplifying rules for operating across EU borders — but which could also include new regulations for online “platforms”.

Some see this as a jab at US retailers like Amazon, “sharing economy” services like Airbnb or even news outfits.

Ed Black, president of the Computer and Communications Industry Association, said the platform proposal “has the potential to be troublesome.”

“Nobody has defined what a platform is,” Black told AFP. “It feels like a proposal to solve a non-problem.”

After the European Court of Justice invalidated the so-called “Safe Harbor” data-sharing agreement this month, Secretary of Commerce Penny Pritzker said Washington was “deeply disappointed.”

For the past 15 years, the key transatlantic accord allowed tech firms like Facebook to operate on both sides of the ocean without running afoul of EU privacy laws.

The ruling, Pritzker said, “creates significant uncertainty for both US and EU companies and consumers and puts at risk the thriving transatlantic digital economy.”

Undercurrent of fear

“We’re waiting to see which way Europe goes,” says Daniel Castro, vice president at the Information Technology & Innovation Foundation, a Washington think tank.

Castro detects “an undercurrent of fear” in Europe because of the popularity of services such as Google and Facebook but argues that the US and EU “need to be on the same side when it comes to free trade.”

Another source of friction is Europe’s effort to enforce the “right to be forgotten,” allowing individuals to remove online content from searches that are outdated or inaccurate.

France has ordered Google to carry this out worldwide, not just in Europe — but US firms see this as a form of censorship, effectively enabling people to rewrite history to hide embarrassing data.

“You’re taking about Europe imposing its version of how the world should be on everyone else,” Castro said.

President Barack Obama expressed concerns about digital trade barriers in an interview earlier this year with Re/code.

“We have owned the Internet. Our companies have created it, expanded it, perfected it in ways that (European firms) can’t compete,” Obama said in response to a question about European actions in the digital sphere.

“And oftentimes what is portrayed as high-minded positions on issues sometimes is just designed to carve out some of their commercial interests.”

Buy time for Europe

That view was echoed by Kati Suominen, who heads the Future of Trade initiative for the Center for Strategic and International Studies, a think tank.

Europe sees it is lagging and is moving on policies in order “to buy time,” she argued.

“Europe is seeking to build its own digital economy by complicating the operations of foreign companies on European soil. In that sense, it is protectionism,” she said.

Rather than throw up new barriers, she argued, Europe should be tearing them if it wishes to foster a digital economy — notably to enable better access to venture capital.

Last month Guenther Oettinger, the EU commissioner for the digital economy and society, brushed aside suggestions of protectionism.

“Our rules on a European level are relevant for everybody, for European producers and players, for Asian players, and for American players as well,” he said during a visit to San Francisco.

Snowden impact

While Google has been the target of a contentious EU anti-trust probe among other issues, Facebook has been especially impacted by privacy rules, with Ireland become the latest to examine the legality of its transfer of user data across the Atlantic.

Belgian officials have also sought to prevent Facebook from using a data “cookie” that gathers information about users. The social media giant says the tool helps verify legitimate accounts and combat spam.

A key element in the US-EU row over privacy has been the fear that US Internet firms are handing over data to the National Security Agency, in light of revelations from former intelligence contractor Edward Snowden.

To address those concerns, US lawmakers have moved to pass a bill allowing non-citizens to enforce their data protection rights in US courts under the Privacy Act.

Berin Szoka, president of the activist group TechFreedom, said the bill was a step toward “repairing America’s tarnished image on data privacy.”

He noted that the failure until now to address the issue in Washington “has provoked an international crisis — one that could lead to a European blockade of American Internet companies.”

Suominen argued that the US and EU have an chance to foster a flourishing digital economy — with appropriate rules — as part of the Transatlantic Trade and Investment Partnership (TTIP) currently being negotiated.

But she warned that policymakers need to bring their thinking up to date.

“Policymakers are struggling to understand what these technologies are and what they can do, and we have archaic policies from the 20th century,” she said. “I worry that we are not on the right path for the 21st century.”

source: interaksyon.com

Wednesday, October 15, 2014

Social media — More hindrance than help in banks’ cyber crime fight


LONDON — Banks are fighting an uphill battle to protect themselves and their client accounts from cyber attacks, and the sometimes careless use of social media by customers and staff isn’t making the fight any easier.

British police and banks this week warned customers about the rise in criminals using social media to strike up a relationship and then try to get money from them.

Personal details from sites such as Facebook, Twitter and LinkedIn are also being used by fraudsters to scam customers, including to help in the increasingly common practice of “vishing”, or voice phishing, industry sources said.

“Vishing” involves fraudsters calling and saying they are from the bank. They say there is a security problem, and ask the customer to call the emergency number on their bank card. But the fraudsters never hang up from the call — in Britain they are able to stay on the line for 2 minutes — and create a fake dial tone to convince the customer to provide account details or even transfer money to another account.

Britain’s BBA banking lobby group estimates one in six customers could fall for this type of fraud, or 8 million people in the United Kingdom alone.

“The classic cyber crime doesn’t involve extremely sophisticated technology, it involves finding a date of birth on social media,” said Paul Clandillon, European practice leader for fraud and financial crime at IBM, at a recent conference on financial crime.

Revelations this month that hackers had obtained details of 83 million customers of JP Morgan — one of the biggest data breaches in corporate history — have shown how vulnerable banks remain, despite spending hundreds of millions of dollars a year on cyber defences.

That was a complex attack, but far simpler and more frequent frauds involve scammers using social media profiles to obtain a fuller picture of potential victims, bank industry sources and fraud investigators said.

Fraudsters can map out a bank’s organizational chart via information on social media, or dig out customer information online. Often they don’t need to look far — when Barclays introduced debit cards with photos on them, for example, some customers posted photos of their new cards, including account details printed on them, on social sites.

The weakest link 


“They (fraudsters) view the customer as the weakest link and they are convincing customers they are the bank. They have access to data in ways they never had before,” Bruce Forbes, head of security investigations and digital forensics at Royal Bank of Scotland, said at last month’s BBA conference.

Banks have long been the favorite target of cyber criminals — although retailers, healthcare firms and others have also been hit — with attacks including attempts to steal money, client data or confidential information about sensitive financial deals, or just trying to disrupt systems.

So-called hacktivists can break into financial systems to score political points while state-sponsored hackers can look to conduct industrial espionage or disrupt economic activity using banks as intermediate targets.

Cyber crime costs the global economy $445 billion (279.36 billion pound) a year and continues to grow, according to the Center for Strategic and International Studies (CSIS). These losses come from fraud, intellectual property theft, and the mushrooming spending on cybersecurity itself.

Often hackers will not use data themselves, but parcel them up and sell them to other people to use, notably specialists who convert stolen passwords and identities into financial gains. Criminals can keep data for months or years before using it.

Defence tool

Social media provides a double-edged sword for banks, however, and the industry is also using it to fight back.

“Social media helps the criminals pursue their trade, but it also leaves a digital footprint in evidence that provides opportunities for us,” said Mark Rowley, assistant commissioner for specialist operations for London’s Metropolitan Police.

Technology developed more than a decade ago to help casinos in Nevada detect collusion between players and dealers is among the tools being used by banks to hunt for networks of organised fraudsters, by hunting out associations between people on social media that were otherwise nearly impossible to find.

Facebook, LinkedIn and Google Earth are also being used by banks alongside more complex searches, involving trawling for data that does not show on regular search engines.

Such “unstructured data” includes not just social media but pictures and videos and other information, and accounts for more than 80 percent of all data available.

“Focusing on unstructured data is what will give us the edge (over criminals) to be able to identify the very complex and organised collusive rings,” said IBM’s Clandillon.

source: interaksyon.com

Wednesday, March 6, 2013

Google says FBI watching the Web


WASHINGTON — Google says the FBI is monitoring the Web for potential terrorist activity. But it can’t confirm the extent of the surveillance.

As part of the Google Transparency Report, the Internet giant released data this week on so-called National Security Letters — official requests for data under the Patriot Act passed after the September 11, 2001 attacks.




But Google said it was only allowed to provide broad ranges of numbers: in the years from 2009 to 2012, for example, it received between zero and 999 requests.

The requests affected between 1,000 and 1,999 accounts, except in 2010, when the range was 2,000 to 2,999 accounts.

“You’ll notice that we’re reporting numerical ranges rather than exact numbers,” said a blog post from Google law enforcement and information security director Richard Salgado.

“This is to address concerns raised by the FBI, Justice Department and other agencies that releasing exact numbers might reveal information about investigations.”

He thanked government officials for collaborating with Google in providing “greater insight” into the use of National Security Letters.

The numbers, while inexact, were believed to be the first data from a private company about the requests, criticized by civil liberties groups for giving the government too much power to conduct surveillance without a warrant.

The Electronic Frontier Foundation calls the letters “dangerous” and has challenged the authority, along with the American Civil Liberties Union.

Google’s actions are “an unprecedented win for transparency,” EFF’s Dan Auerbach and Eva Galperin said Wednesday.

Despite a lack of exact data, “Google has helped to at least shed some limited light on the ways in which the US government uses these secretive demands for data about users,” they added in a blog post.

“While we continue to be in the dark about the full extent of how the law is being applied, this new data allays fears that NSLs are being used for sweeping access to large numbers of user accounts — at Google, at least.”

One inspector general review found “serious deficiencies” in the FBI’s handling of the process and noted that the letters concerned tens of thousands of US citizens and non-Americans.

EFF said public records have documented the FBI’s “systemic abuse” of the power.

source: interaksyon.com

Sunday, November 4, 2012

Hack-proof data security solution now available in Phl

MANILA, Philippines - A breakthrough solution to the worldwide problem of data theft that its developers say is hack-proof was launched recently in the Philippines. The technology called Splitlock was developed in Australia and has been patented in all the major countries in the world.

According to Melbourne-based Splitlock, Inc. CEO Anthony Liston, who flew in for the launch, Splitlock’s goal is “to ensure that any data held in any storage device would be worthless to any person who gained unauthorized access to the database.”

To achieve this, Splitlock splits the data into at least two pieces and then locks the data in a unique and patented procedure dubbed “Splitcryption.”

“We consider it to be the most complete of data protection available and the ultimate data security product in the world,” Liston added.

In the Philippines, TransPay Network Solutions, Inc. is the exclusive partner of Splitlock, Inc.

In his opening remarks, TransPay Network Solutions Philippines president and CEO Francisco Ravena III cited the newly enacted Republic Act 10175, otherwise known as the Cybercrime Act of 2012, and said that the technology that would help address the security issues and challenges stated in the law is now in the Philippines.

“Data protection is a must,” he stressed, “especially for valuable customer and financial data in order to keep public trust in banks and for sensitive information in government offices and in the military.” He pointed out the proliferation of cyber syndicates that prey on inadequately protected data bases.

source: philstar.com