No Comment Diary

The News Without Comment

This content shows Simple View

Risk Assessment – Ars Technica

Windows 10 will try to combat ransomware by locking up your data

Enlarge / Cryptolocker was one of the ransomware pioneers, bringing together file encryption and bitcoin payment. (credit: Christiaan Colen / Flickr)

The latest Windows 10 build, today’s 16232, contains a few new security features. In addition to the richer control over exploit mitigation that Microsoft announced earlier this week, the new build also includes a trial of a new anti-ransomware capability.

The long-standing approach that operating systems have used to protect files is a mix of file ownership and permissions. On multi-user systems, this is broadly effective: it stops one user from reading or altering files owned by other users of the same system. The long-standing approach is also reasonably effective at protecting the operating system itself from users. But the rise of ransomware has changed the threats to data. The risk with ransomware comes not with another user changing all your files (by encrypting them); rather, the danger is that a program operating under a given user’s identity will modify all the data files accessible to that user identity.

In other words, if you can read and write your own documents, so can any ransomware that you run.

Read 4 remaining paragraphs | Comments

http://ift.tt/2tplwF9 Source: https://arstechnica.com



Ryzen Pro: AMD takes on Intel on the corporate desktop, with one key omission

AMD

AMD today launched Ryzen Pro (styled "PRO" in AMD’s branding, but we’re not going to do that here), a series of processors designed for the corporate desktop. Close counterparts to the existing line of consumer-oriented Ryzen chips, the Pro parts are aimed at Intel’s vPro-compatible processors, which enable a number of additional administrative, security, and management capabilities.

Most of the regular Ryzen models have corresponding Pro versions, albeit topping out at a 1700X rather than the 1800 and 1800X of the consumer parts. This means that at the high end, there’s a couple of eight core, 16 thread parts, which is twice the number of cores and threads of comparable Intel chips.

Read 5 remaining paragraphs | Comments

http://ift.tt/2toa64r Source: https://arstechnica.com



Stealthy Google Play apps recorded calls and stole e-mails and texts

Enlarge (credit: portal gda)

Google has expelled 20 Android apps from its Play marketplace after finding they contained code for monitoring and extracting users’ e-mail, text messages, locations, voice calls, and other sensitive data.

The apps, which made their way onto about 100 phones, exploited known vulnerabilities to "root" devices running older versions of Android. Root status allowed the apps to bypass security protections built into the mobile operating system. As a result, the apps were capable of surreptitiously accessing sensitive data stored, sent, or received by at least a dozen other apps, including Gmail, Hangouts, LinkedIn, and Messenger. The now-ejected apps also collected messages sent and received by Whatsapp, Telegram, and Viber, which all encrypt data in an attempt to make it harder for attackers to intercept messages while in transit.

The apps also contained functions allowing for:

Read 3 remaining paragraphs | Comments

http://ift.tt/2h6aTlT Source: https://arstechnica.com



Microsoft expands bug bounty program to cover any Windows flaw

Some bugs aren’t worth very much cash. (credit: Daniel Novta)

Microsoft today announced a new bug bounty scheme that would see anyone finding a security flaw in Windows eligible for a payout of up to $15,000.

The company has been running bug bounty schemes, wherein security researchers are financially rewarded for discovering and reporting exploitable flaws, since 2013. Back then, it was paying up to $11,000 for bugs in Internet Explorer 11. In the years since then, Microsoft’s bounty schemes have expanded with specific programs offering rewards for those finding flaws in the Hyper-V hypervisor, Windows’ wide range of exploit mitigation systems such as DEP and ASLR, and the Edge browser.

Many of these bounty programs were time limited, covering software during its beta/development period but ending once it was released. This structure is an attempt to attract greater scrutiny before exploits are distributed to regular end-users. Last month, the Edge bounty program was made an on-going, continuous scheme no longer tied to any particular timeframe.

Read 2 remaining paragraphs | Comments

http://ift.tt/2eO2a7a Source: https://arstechnica.com



Perverse” malware infecting hundreds of Macs remained undetected for years

Enlarge (credit: Tim Malabuyo)

A mysterious piece of malware that gives attackers surreptitious control over webcams, keyboards, and other sensitive resources has been infecting Macs for at least five years. The infections—known to number nearly 400 and possibly much higher—remained undetected until recently and may have been active for almost a decade.

Patrick Wardle, a researcher with security firm Synack, said the malware is a variant of a malicious program that came to light in January after circulating for at least two years. Dubbed Fruitfly by some, both malware samples capture screenshots, keystrokes, webcam images, and information about each infected Mac. Both generations of Fruitfly also collect information about devices connected to the same network. After researchers from security firm Malwarebytes discovered the earlier Fruitfly variant infecting four Macs, Apple updated macOS to automatically detect the malware.

The variant found by Wardle, by contrast, has infected a much larger number of Macs and remained undetected by both macOS and commercial antivirus products. After analyzing the new variant, Wardle was able to decrypt several backup domains that were hardcoded into the malware. To his surprise, the domains remained available. Within two days of registering one of the addresses, close to 400 infected Macs connected to the server, mostly from homes located in the United States. Although Wardle did nothing more than observe the IP address and user names of Macs that connected to his server, he had the ability to use the malware to spy on the users who were unwittingly infected.

Read 6 remaining paragraphs | Comments

http://ift.tt/2vUeB4k Source: https://arstechnica.com



Microsoft targets Fancy Bear’s domains in trademark lawsuit

Enlarge (credit: Harald Deischinger)

On Friday, representatives of the notorious hacking entity known as Fancy Bear failed to appear in a federal court in Virginia to defend themselves against a civil lawsuit brought by Microsoft.

As the Daily Beast first reported on Friday, Microsoft has been waging a quiet battle in court against the threat group, believed to be affiliated with the GRU, Russia’s foreign intelligence agency. For now, the company has managed to seize control of 70 domain names, but it’s going after many more.

The idea of the lawsuit, which was filed in August 2016, is to use various federal laws including the Computer Fraud and Abuse Act (CFAA), the Electronic Communications Privacy Act (ECPA), and American trademark law as a way to seize command-and-control domain names used by the group, which goes by various monikers including APT28 and Strontium. Many of the domain names used by Fancy Bear contain Microsoft trademarks, like microsoftinfo365.com among hundreds of others.

Read 5 remaining paragraphs | Comments

http://ift.tt/2gQm3ej Source: https://arstechnica.com



Google drops the boom on WoSign, StartCom certs for good


reader comments
13

Last August, after being alerted by GitHub’s security team that the certificate authority WoSign had errantly issued a certificate for a GitHub domain to someone other than GitHub, Google began an investigation in collaboration with the Mozilla Foundation and a group of security professionals into the company’s certificate issuance practices. The investigation uncovered a pattern of bad practices at WoSign and its subsidiary StartCom dating back to the spring of 2015. As a result, Google moved last October to begin distrusting new certificates issued by the two companies, stating “Google has determined that two CAs, WoSign and StartCom, have not maintained the high standards expected of CAs and will no longer be trusted by Google Chrome.”

WoSign (based in Shenzen, China) and StartCom (based in Eliat, Israel) are among the few low-cost certificate providers who’ve offered wildcard certificates. StartCom’s StartSSL offers free Class 1 certificates, and $60-per-year wildcard certificates—allowing the use of a single certificate on multiple subdomains with a single confirmation. This made the service wildly popular. But bugs in WoSign’s software allowed a number of misregistrations of certificates. One bug allowed someone with control of a subdomain to claim control of the whole root domain for certificates. The investigation also found that WoSign was backdating the SSL certificates it issued to get around the deadline set for certificate authorities to stop issuing SHA-1 SSL certificates by January 1, 2016. WoSign continued to issue the less secure SHA-1 SSL certificates well into 2016.

Initially, Google only revoked trust for certificates issued after October 21, 2016. But over the past six months, Google has walked that revocation back further, only whitelisting certificates for domains from a list based on Alexa’s top one million sites. But today, Google announced that it would phase out trust for all WoSign and StartCom certificates with the release of Chrome 61. That release, about to be released for beta testing, will be fully released in September.

Mozilla has not yet announced a termination for support of older WoSign and StartCom certificates. However, as most of the certificates issued by the companies have a one-year expiration, many of the whitelisted certificates have already begun to expire.

http://ift.tt/2uExhIj Source: https://arstechnica.com



FCC has no documentation of DDoS attack that hit net neutrality comments

Enlarge / John Oliver takes on FCC Chairman Ajit Pai in net neutrality segment. (credit: HBO Last Week Tonight)

The Federal Communications Commission says it has no written analysis of DDoS attacks that hit the commission’s net neutrality comment system in May.

In its response to a Freedom of Information Act (FoIA) request filed by Gizmodo, the FCC said its analysis of DDoS attacks "stemmed from real time observation and feedback by Commission IT staff and did not result in written documentation." Gizmodo had asked for a copy of any records related to the FCC analysis that concluded DDoS attacks had taken place. Because there was no "written documentation," the FCC provided no documents in response to this portion of the Gizmodo FoIA request.

The FCC also declined to release 209 pages of records, citing several exemptions to the FoIA law. For example, publication of documents related to "staffing decisions made by Commission supervisors, draft talking points, staff summaries of congressional letters, and policy suggestions from staff" could "harm the Commission’s deliberative processes," the FCC said. "Release of this information would chill deliberations within the Commission and impede the candid exchange of ideas."

Read 13 remaining paragraphs | Comments

http://ift.tt/2tiNeAc Source: https://arstechnica.com



Russian man who helped create notorious malware sentenced to 5 years

Mark Vartanyan, seen here in 2014. (credit: Mark Vartanyan / Instagram)

A Russian man who helped create and spread the notorious Citadel malware back in 2011 was sentenced Wednesday to five years in prison by a federal judge in Atlanta.

According to the Associated Press, Mark Vartanyan will receive two years’ credit for time already served in Norway, where he had been living previously. He was extradited to the United States in December 2016 and was arraigned and pleaded guilty to hacking charges in March 2017. Vartanyan had apparently been helping prosecutors with their investigation "from the start."

In September 2015, another Russian man, Dimitry Belorossov, was sentenced to 4.5 years on similar charges. In 2014, Ars reported how the malware was being used to target password managers and financial data.

Read 1 remaining paragraphs | Comments

http://ift.tt/2vjwie5 Source: https://arstechnica.com



Campaign managers for Clinton, Romney team up to fight foreign hackers

Enlarge / Eric Rosenbach, who served as the chief of staff to the secretary of defense from 2015 until 2017, seen here in 2014. (credit: Center for Strategic & International Studies)

A new group at Harvard University staffed by the former campaign managers of the Hillary Clinton and Mitt Romney campaigns, along with other top security experts, have banded together to help mitigate various types of online attacks that threaten American democracy.

The initiative, dubbed "Defending Digital Democracy," will be run by former chief of staff for the secretary of defense, Eric Rosenbach.

"Americans across the political spectrum agree that political contests should be decided by the power of ideas, not the skill of foreign hackers," Rosenbach said in a Tuesday statement. "Cyber deterrence starts with strong cyber defense—and this project brings together key partners in politics, national security, and technology to generate innovative ideas to safeguard our key democratic institutions."

Read 3 remaining paragraphs | Comments

http://ift.tt/2u4VYeu Source: https://arstechnica.com




top