CBN limits USSD transactions to N100,000 per day

/in

EFFECTIVE from June this year bank customers will not be able to use Unstructured Supplementary Service Data (USSD) channel to conduct transactions more than N100, 000 per day.

Also they will have to use both their PIN and a soft token to authenticate transactions above N20, 000. The USSD is a technology platform for online payments.

In addition, banks must allow their customers the option to opt out of USSD channel for financial transactions.

These were highlights of the ‘Regulatory Framework for the use of Unstructured Supplementary Service Data (USSD) for Financial Services in Nigeria’, issued by the Central Bank of Nigeria, CBN, yesterday.

In a circular announcing the framework, Director, Banking System and Payments Department, CBN, stated: “The vast applications of the USSD technology, in terms of available services have raised the issue of the risks inherent in the channel. In this regard, concerns have been expressed on the likely exposure of CBN approved entities to the possible breaching of the USSD accessed financial services in view of likely vulnerabilities in the technology and the ever growing threats.

‘‘Furthermore, the implementation in Nigeria has created multiple USSD channels to customers, thereby increasing their exposure to risk, without a common standard for all. ‘‘This framework therefore, seeks to establish the rules and risk mitigation considerations when implementing USSD for financial services offering in Nigeria.”

Among other things, the framework stated: “USSD based financial transaction requires encryption to protect the integrity of the financial information. To this end, Financial Institutions providing use of the USSD channel shall: Ensure that the customer receives notification on the status of every transaction conducted through the channel; Not use the USSD service to relay details of other electronic banking channels (in case of banks), to their customers, to prevent compromise of other electronic banking channels through the USSD channel; Avail the customers the option to opt in/out of the USSD channel for financial Transactions.’’

vanguard

Avast reveals how attackers compromised CCleaner last year

/in

Back in September last year, it was reported that popular system-cleaning tool CCleaner had been compromised by attackers for over a month. Some details of the incident were unclear at the time, but Avast, which acquired maker Piriform last July, has now revealed more information about what happened.

The attack saw hackers modify an updated version of CCleaner to include a malware backdoor. We knew there were 2.27 million downloads of the corrupted installation file worldwide, but how the attackers achieved this feat wasn’t specified at the time.

The security firm’s chief technology officer, Ondrej Vlcek, writes that the threat actors accessed Piriform’s network on March 11, 2017, four months before the company was taken over by Avast. The person or persons responsible somehow managed to get hold of stolen credentials to log into a TeamViewer remote desktop account on a developer PC.

“While we don’t know how the attackers got their hands on the credentials, we can only speculate that the threat actors used credentials the Piriform workstation user utilized for another service, which may have been leaked, to access the TeamViewer account,” he said.

The attackers installed the ShadowPad malware on two of the company’s compromised machines, before using its keylogger abilities to gain further access to Piriform’s systems. It wasn’t until August 2 that the first contaminated download of CCleaner appeared.

“Our investigation revealed that ShadowPad had been previously used in South Korea, and in Russia, where attackers intruded [on] a computer, observing a money transfer,” explained Vlcek.

Of the 2.27 million downloads of the affected program, a second stage attack—installing ShadowPad—took place on just 40 PCs, all of which belonged to tech and telecommunications companies. “We don’t have proof that a possible third stage with ShadowPad was distributed via CCleaner to any of the 40 PCs.”

Vlcek said that for Avast, there are two key takeaways from the attack. “First, M&A due diligence has to go beyond just legal and financial matters. Companies need to strongly focus on cybersecurity, and for us this has now become one of the key areas that require attention during an acquisition process.”

“Second, the supply chain hasn’t been a key priority for businesses, but this needs to change. Attackers will always try to find the weakest link, and if a product is downloaded by millions of users it is an attractive target for them. Companies need to increase their attention and investment in keeping the supply chain secure.”

TechSpot

Learn How to Code with your Phone for Free

/in ,

Grasshopper

A bunch of Google employees participating in the company’s Area 120 internal incubator have launched Grasshopper, a free mobile app for Android and iOS that teaches you the basics of programming.

It’s beautifully designed and is suitable for just about anyone who can be trusted to use a phone on their own. By solving simple challenges and answering quiz questions, you’ll soon get the hang of basic JavaScript.

The gamified app, named after programming pioneer Grace Hopper, currently includes three sets of lessons, which cover the fundamentals of coding (calling functions, using variables and objects, and so on), as well as animations. The idea is to spend a few minutes a day with it, so you can have the app remind you to hop in daily and take on a few challenges.

When you’re done with the content in Grasshopper, you can move on to recommended Coursera classes to learn more about JavaScript, HTML, CSS, algorithms, and web design for a fee, or simply muck around in Grashopper’s online playground and make your own JS animations. Naturally, you can also explore alternatives for learning to code, such as the courses offered by edX and FreeCodeCamp.

I’ve been meaning to get back to coding for a while now, having ditched my chops when I graduated from high school. The app is fun and easy enough to get through a few challenges when you’re on a commute, and feels like a good alternative to scrolling through social media feeds mindlessly.

Grasshopper is the latest product to emerge from Area 120, which gives Google employees a chance to work full-time on their side projects and bring them to life. It’s previously seen launches like Uptime, which lets you watch YouTube videos in sync with friends elsewhere in the world, and Supersonic, a messaging app for emoji lovers.

thenextweb

Five Apps for Keeping Windows 10 Clean

/in , ,

Nobody likes an operating system that’s full of unnecessary stray files, 20 annoying apps that start up when you fire up your computer, and other crap that slows down your system, makes your desktop feel disorganised, or gives you a headache whenever you’re trying to work (or game). Thankfully, there are a number of free apps that can help you clean your Windows PC.

Disk Cleanup

Disk CleanupOne of the first apps you can try using to get control of a messy Windows PC is Windows’ very own Desk Cleanup app—built right into the operating system and free for you to use at any time. On Windows 10, just pull up the Start Menu and start typing in “Disk,” which should make it easy to load the utility. Pick a drive you want Disk Cleanup to take a look at, likely your system’s primary c:\ drive, and click OK.

Once it’s done scanning, Disk Cleanup will tell you about all the different kinds of files that you can safely remove from your system, including the cache for your Edge browser, anything in your Recycle Bin, temporary files left over from apps or app installations, and file thumbnails you might not need anymore—to name a few. You can also click on the “Clean up system files” option to have the app check for log files Windows created during an OS installation, as well as any previous Windows installations that might be lurking around your hard drive (and taking up gigabytes of space).

Once you’ve made your selections for deletion, click “OK,” and then “Delete Files,” to begin the process.

(You can also use a utility like BleachBit to give your drive a more thorough scrubbing. Just don’t use it to muck with your Windows registry; registry cleaners tend to have little noticeable effect, except for when they completely muck up your system by deleting something they shouldn’t have.)

The PC Decrapifier

The PC Decrapifier

Though this app is more useful for desktop or laptop PCs you just purchased, it’s a great tool for eliminating the more obvious bloatware on your system that, perhaps, you simply forgot about (or never had time to clean).

You don’t have to go through any installation routine once you’ve downloaded the app. Just launch it and let it analyze your system. It’ll split any apps it finds into three categories—apps definitely recommended for deletion, questionable apps that people usually remove from their systems, and all other apps. Each app listing tells you whether its a regular application you load yourself or one what starts when your computer launches, a percent that indicates how many other PC Decrapifier users also removed that app, and occasionally a little question mark icon that takes you to the web to learn more about a particular app.

All you have to do is select what you want to remove, confirm it on the next screen (which also allows you to create a Windows restore point if you’re feeling nervous), and let the app flush your unwanted apps down the digital drain.

AdwCleaner

AdwCleaner

Toolbars, spyware, and other kinds of malware can make your PC a mess. Even if you’re a semi-savvy computer user, however, you’re probably pretty good about avoiding the common traps: apps that solicit you to add crappy third-party items to their regular installation process or websites that cajole you to try out a scammy-sounding app—things like that.

That said, it never hurts to run a quick scan every now and then to make sure there’s nothing on your computer that shouldn’t be there. You probably don’t need to pay for a real-time malware scanning app when you have something like AdwCleaner, a lightweight app that requires no installation to effectively (and efficiently) scan your system for crap.

The company that makes the ever-popular Malwarebytes anti-malware app owns AdwCleaner. While you can always switch up to the former for extra protection, given its reputation, the app feels a little more bloaty and definitely loves to let you know about its Premium services.

Steam Cleaner

Steam Cleaner

This one’s for you, gamers. You might not even know that the major online distribution services—Steam, Origin, Uplay, and GoG—might leave some crap on your hard drive even after you’ve uninstalled a game you’re done playing. Even though this app is called “Steam Cleaner,” it does a great job of scanning through each service’s default installation folders and identifying leftover files from past games that you can safely remove. With some simple scanning, you could save gigabytes of space.

(For regular apps, consider using a program like Revo Uninstaller to ensure that all traces of a program are deleted whenever you want to remove it from your system.)

MiniBin

MiniBinHaving to navigate to your Windows desktop to fiddle with your Recycle Bin is annoying. While it’s easy to delete (or shift-delete) files from File Explorer, it’s always nice to have a trash can at the ready. This tiny utility drops a Recycle Bin directly in your system tray, which makes it much easier to drag-and-drop files to oblivion, empty the trash, and restore that which you accidentally deleted.

lifehacker

Judge says Samsung ‘rigged the deck, fixed the game’ with Galaxy S4

/in ,

Samsung Galaxy S4Samsung has been slammed by a federal judge for allegedly misleading consumers who purchased the Samsung Galaxy S4, by fraudulently misrepresenting the amount of power available in the device.

The statement came about as a result of a long-running legal dispute between the Korean tech giant and a class action lawsuit, headed by plaintiff Daniel Norcia. Back in 2011, Norcia filed a suit against Samsung, alleging that the capabilities of the Galaxy S4 flagship phone had been grossly misrepresented, and Samsung had used this to mislead customers into thinking the phone was more powerful than competitors’ phones. Parts of the lawsuit surrounding the available storage have since been dropped, but the courts have upheld Norcia’s complaint on the processing power of the phone.

According to the accusation, Samsung coded the Galaxy S4’s software to detect when specific benchmarking software was being used, and have it commit extra resources to its operation — effectively cheating the test and providing results that could not be replicated outside of the benchmarking app by a casual user. Since these benchmarks are commonly used in third-party reviews of the device, that alleged cheating led to a false impression of superior speed being made public.

“Samsung also knew that if it artificially boosted the performance of its devices when running benchmarking apps, reviewers and the public would falsely believe that the Galaxy S4 was similarly fast in real-world situations. In reality, the processors in the Galaxy S4 run at a lower speed and the artificial performance boost disappears when the devices are performing real-world tasks instead of running benchmarking apps” states Norcia’s complaint.

Samsung had previously attempted to move the case to arbitration court by arguing the Galaxy S4’s warranty specifically forbad class actions lawsuits being brought. Unfortunately for Samsung, an appeals court dismissed this claim on the basis that warranties do not impose anything on the buyer, especially when introduced after the sale.

Speaking in a previous hearing on the case, U.S. District Judge James Donato said: “Samsung rigged the deck, fixed the game; and as a result of that, consumers were misled about the speed of the phone.”

The case is due to be heard in front of a U.S. magistrate judge next week.

Digital Trends

This New Web Standard Could Finally Kill the Password

/in

Passwords are pretty archaic. Unfortunately, despite the best efforts of companies including Google, Apple, Facebook and others, no one has figured out a uniform standard that would make it possible to do away with them entirely. Until, perhaps, now.

A new credential system proposed by the W3C—the World Wide Web Consortium—could be what we need to kill off the password for good.

Per the w3c, the new Web Authentication specification details an “API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users.” In other words, this would be a universal system that could offer unique encryption keys for each user that could be accessed securely across every site, all in your standard web browser.

But the big upgrade is that, instead of being limited to a regular password, the API would also support the use of fingerprint readers, cameras, and USB keys as a method of logging into your account. In fact, some potential use cases even include using the fingerprint reader on your phone to log into a website that you’re browsing on your laptop or desktop, which may not have its own fingerprint sensor.

While the new standard is currently listed as just a “Candidate Recomendation,” the feature is already in use as an experimental technology in FireFox, with other browsers including Chrome and Edge expected to test the Web Authentication API later this year.

The sad part so far is that, despite input and contribution from companies such as Google, Microsoft, PayPal, Mozilla, Qualcomm and others, it doesn’t seem like Apple is on board to help test or refine the tech. That’s a real shame, because even though wide-scale adoption is still a ways out, it would be nice if there was a secure, non-proprietary login platform that all the big tech companies could agree on.

gizmodo

Yes Chrome is scanning your Windows PC, but it might be a bug

/in , ,

A few days ago Kelly Shortridge, a product manager at SecurityScorecard detected some unexpected behavior on her PC, as a honeypot Canarytoken reported being accessed by Chrome.exe. That’s not what you’d expect from a web browser normally, except for one thing — Google did add some antivirus-y capabilities to its browser on Windows late last year as an enhancement to its Chrome Cleanup tool that can help reset hijacked settings. Google Chrome security lead Justin Schuh explained how the feature works and pointed to some documentation about it, and that was that —

If you are hitting this issue and you want a fix right now then go to chrome://downloads in your browser, go to the menu in the top right, and select Clear All. That will clear Chrome’s list of downloaded files so that it won’t have any files to existence-check at startup. If you have a large list of downloaded files then this will improve startup time slightly.

It turns out the “AV scanning” wasn’t that at all, and what it was doing could affect you right now. It turns out that Chrome is checking the integrity of downloaded files at startup, and a bug lead it to that particular folder. It relies on the Downloaded History list for this check, and if you have a lot of files in there, it could slow down your computer when you start Chrome. While the dev team is working to skip the check entirely in a future update, users worried about it can fix it by clearing their download history.

Cisco Switches in Iran, Russia Hacked in Apparent Pro-US Attack

/in , , ,

Hacked Cisco Switch

A significant number of Cisco switches located in Iran and Russia have been hijacked in what appears to be a hacktivist campaign conducted in protest of election-related hacking. However, it’s uncertain if the attacks involve a recently disclosed vulnerability or simply abuse a method that has been known for more than a year.

Cisco devices belonging to organizations in Russia and Iran have been hijacked via their Smart Install feature. The compromised switches had their IOS image rewritten and their configuration changed to display a U.S. flag using ASCII art and the message “Don’t mess with our elections…”

The hackers, calling themselves “JHT,” told Motherboard that they wanted to send a message to government-backed hackers targeting “the United States and other countries.” They claim to have only caused damage to devices in Iran and Russia, while allegedly patching most devices found in countries such as the U.S. and U.K.

Iran’s Communication and Information Technology Ministry stated that the attack had impacted roughly 3,500 switches in the country, but said a vast majority were quickly restored.

Kaspersky Lab reported that the attack appeared to mostly target the “Russian-speaking segment of the Internet.”

While there are some reports that the attack involves a recently patched remote code execution vulnerability in Cisco’s IOS operating system (CVE-2018-0171), that might not necessarily be the case.

The Cisco Smart Install Client is a legacy utility that allows no-touch installation of new Cisco switches. Roughly one year ago, the company warned customers about misuse of the Smart Install protocol following a spike in Internet scans attempting to detect unprotected devices that had this feature enabled.

Attacks, including ones launched by nation-state threat actors such as the Russia-linked Dragonfly, abused the fact that many organizations had failed to securely configure their switches, rather than an actual vulnerability.

Cisco issued a new warning last week as the disclosure of CVE-2018-0171 increases the risk of attacks, but the networking giant said it had not actually seen any attempts to exploit this vulnerability in the wild. Cisco’s advisory for this flaw still says there is no evidence of malicious exploitation.

There are hundreds of thousands of Cisco switches that can be hijacked by abusing the Smart Install protocol, and Cisco Talos experts believe attackers are unlikely to bother using CVE-2018-0171.

The Network Security Research Lab at Chinese security firm Qihoo 360 says the data from its honeypot shows that the attacks have “nothing to do with CVE-2018-0171” and instead rely on a publicly available Smart Install exploitation tool released several months ago.

While none of the major players in the infosec industry have confirmed that the attacks on Iran and Russia rely on CVE-2018-0171, technical details and proof-of-concept (PoC) code have been made available by researchers, making it easier for hackers to exploit.

Hamed Khoramyar, founder of Sweden-based ICT firm Aivivid, said the attacks exploited CVE-2018-0171. Kudelski Security also reported seeing attacks involving both CVE-2018-0171 and another recently disclosed IOS vulnerability tracked as CVE-2018-0156. However, Kudelski’s blog post also lists Khoramyar as one of its sources.

Security Week

Iran hit by global cyber attack that left U.S. flag on screens

/in

DUBAI (Reuters) – Hackers have attacked networks in a number of countries including data centres in Iran where they left the image of a U.S. flag on screens along with a warning “Don’t mess with our elections”, the Iranian IT ministry said on Saturday.

“The attack apparently affected 200,000 router switches across the world in a widespread attack, including 3,500 switches in our country,” the Communication and Information Technology Ministry said in a statement carried by Iran’s official news agency IRNA.

The statement said the attack, which hit internet service providers and cut off web access for subscribers, was made possible by a vulnerability in routers from Cisco (CSCO.O) which had earlier issued a warning and provided a patch that some firms had failed to install over the Iranian new year holiday.

Cisco did not immediately respond to requests for comment.

A blog published on Thursday by Nick Biasini, a threat researcher at Cisco’s Talos Security Intelligence and Research Group, said: “Several incidents in multiple countries, including some specifically targeting critical infrastructure, have involved the misuse of the Smart Install protocol…

“As a result, we are taking an active stance, and are urging customers, again, of the elevated risk and available remediation paths.”

Iran’s IT Minister Mohammad Javad Azari-Jahromi posted a picture of a computer screen on Twitter with the image of the U.S. flag and the hackers’ message. He said it was not yet clear who had carried out the attack.

Azari-Jahromi said the attack mainly affected Europe, India and the United States, state television reported.

“Some 55,000 devices were affected in the United States and 14,000 in China, and Iran’s share of affected devices was 2 percent,” Azari-Jahromi was quoted as saying.

In a tweet, Azari-Jahromi said the state computer emergency response body MAHER had shown “weaknesses in providing information to (affected) companies” after the attack which was detected late on Friday in Iran.

Hadi Sajadi, deputy head of the state-run Information Technology Organisation of Iran, said the attack was neutralised within hours and no data was lost.

Reuters

Facebook’s Cambridge Analytica data scandal, explained

/in , ,

Cambridge Analytica improperly obtained data from as many as 50 million people. That’s put Mark Zuckerberg on the defensive.
The Verge