Cyber attack claims player details from World Rugby

/in ,

World Rugby has been forced to suspend one of its websites after the governing body was the target of a cyber attack that saw hackers obtain personal data from thousands of subscribers to one of their databases, The Sunday Telegraph can reveal.

It is understood that the hackers were able to access the first name, email address and encrypted passwords of thousands of users, including players, coaches and parents from across the world after the security breach on May 3.

It is not yet clear if it was a random attack to steal data or if World Rugby was deliberately targeted by one of the cyber espionage groups that has previously leaked confidential information from the websites of sporting bodies such as WADA and the IAAF.

The hackers targeted World Rugby’s training and education website, which is a platform for the grass-roots game to keep up to date with the latest drills to improve technique and offer advice for the prevention of injuries such as ­concussion.

World Rugby’s main website, including Rugby World Cup ticketing and fan data plus sensitive information around players’ disciplinary hearings, was not at risk from the attack.

World Rugby immediately took down the affected sites and denied access to databases when it detected the breach and brought in data and technology ­security experts to investigate the nature and scope of the incident and put in steps to prevent a similar attack.

As of yesterday, the training and education portal remained offline.

World Rugby also sent emails to the subscribers to warn them of the breach and reassure them that as the passwords were encrypted, there was no danger of them being breached.

Subscribers, however, were recommended to change their passwords when the site comes back online.

As World Rugby is based in Dublin, the governing body also informed the Irish Data Protection Commissioner’s office of the breach. The details of the attack emerged just days before the EU’s general data protection regulation comes into effect on May 25.

World Rugby could have faced a sanction from the Association of Data Protection Officers (ADPO) if the breach had occurred after that date. The ADPO will have the power to fine organisations up to €10 million (₦4,250,000,000) for data security breaches, depending on mitigating factors.

Sean Burnard, one of the subscribers who received the email alert, said he was alarmed by the breach. Burnard uses the portal to access the training drills and technique tips to help his sons improve their skills.

“At first my concern was that it was a spoof email but then it was confirmed that there had been a security breach,” he said.

The Telegraph

Stair-scaling robot dog to be sold in 2019

/in

The yellow robot dogs that so unsettled people in February by opening a door for one another can now easily walk up and down stairs on their own.

Boston Dynamics CEO Marc Raibert — who founded the robot company known for building machines that mimic real animal and human movements — said Friday at the TechCrunch Robotics Sessions conference at UC Berkeley that the robots, called SpotMini, will be ready for purchase in 2019.

While declining to offer a price on the 66-pound, relatively quiet, and uniquely agile robot dogs, Raibert did say that they’re designed to be deployed in commercial office building-like settings — and then eventually homes.

Raibert presented the above video at the conference, which showed the dogs navigating the Boston Dynamics lab on their own. But, although the robot is traversing autonomously, this shouldn’t be confused with “AI,” the hot, and often misapplied buzzword in today’s tech realm.

To be clear, these robots have been given sophisticated motion detection software that maps out the boundaries of where they can go and where they absolutely shouldn’t go. That’s why the robots so confidently scaled the stairs, while staying clear of the edges. They “see” a navigational map in real time, which appears in the video at the bottom left of the screen.

“It knows it can’t bump into the railings,” said Raibert.

Today, the term “AI” is most accurately used to describe software — like image recognition — that is fed a wealth of information, which it can then use to make well-informed predictions on its own. This often involves being wrong, and self-correcting.

For example, in 2017 Google’s DeepMind researchers built an AI program that, over the course of a month, taught itself to become the world’s most dominant Go (an ancient Chinese board game) player, without any previous knowledge of how to win.

Some of today’s leading AI researchers, however, will make the argument that this isn’t true intelligence, but rather impressively complex machines performing sophisticated number-crunching.

Atop the robot in the video is also a small, white rectangular box, which shows how any (capable) third-party users can make their own hardware devices — like an enhanced radio receiver or specialized camera — and attach it to the robot for their specific surveillance needs.

The constant movement of four legs, however, drains the robots’ batteries pretty quickly. They’re capable of moving around for 90 minutes before needing to recharge.

Mashable

Microsoft Publishes PDF With Every Windows Terminal Command

/in ,
Download Windows Commands Reference

If you wanted an exhaustive reference for all the windows terminal command line tools and utilities available in Windows, “/h” was as good as it got. Well, that was until last month, when Microsoft published a whopping big PDF with information on every single terminal command the operating system has to offer.

The document, released on April 18, comes in at 4.6MB and 948 pages and covers the following platforms:

  • Windows Server (Semi-Annual Channel)
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2012
  • Windows Server 2008 R2
  • Windows Server 2008
  • Windows 10
  • Windows 8.1

Even though Windows 7 is absent, it’s fair to say a lot of the commands should work on the older OS.

The reference isn’t just limited to commands — it also contains tips for configuring the command prompt window, as well as changes you can make to the Registry to enable and disable features, such as filename / directory completion.

Best of all, hyperlinks embedded in the file for each command jump directly to online documentation, so you can always check out the most up-to-date content.

This does however raise the question: why have a gigantic reference PDF in the age of online documentation?

Download Windows Commands Reference

lifehacker

First-Ever Ransomware Found Using ‘Process Doppelgänging’ Attack to Evade Detection

/in , ,

Security researchers have spotted the first-ever ransomware exploiting Process Doppelgänging, a new fileless code injection technique that could help malware evade detection.

The Process Doppelgänging attack takes advantage of a built-in Windows function, i.e., NTFS Transactions, and an outdated implementation of Windows process loader, and works on all modern versions of Microsoft Windows OS, including Windows 10.

Process Doppelgänging attack works by using NTFS transactions to launch a malicious process by replacing the memory of a legitimate process, tricking process monitoring tools and antivirus into believing that the legitimate process is running.

If you want to know more about how Process Doppelgänging attack works in detail, you should read this article published late last year on thehackernews.com.

Shortly after the Process Doppelgänging attack details went public, several threat actors were found abusing it in an attempt to bypass modern security solutions.

Security researchers at Kaspersky Lab have now found the first ransomware, a new variant of SynAck, employing this technique to evade its malicious actions and targeting users in the United States, Kuwait, Germany, and Iran.

Synack Ransomware process - Doppelganging

Initially discovered in September 2017, the SynAck ransomware uses complex obfuscation techniques to prevent reverse engineering, but researchers managed to unpack it and shared their analysis in a blog post.

An interesting thing about SynAck is that this ransomware does not infect people from specific countries, including Russia, Belarus, Ukraine, Georgia, Tajikistan, Kazakhstan, and Uzbekistan.

To identify the country of a specific user, the SynAck ransomware matches keyboard layouts installed on the user’s PC against a hardcoded list stored in the malware. If a match is found, the ransomware sleeps for 30 seconds and then calls ExitProcess to prevent encryption of files.

SynAck ransomware also prevents automatic sandbox analysis by checking the directory from where it executes. If it found an attempt to launch the malicious executable from an ‘incorrect’ directory, SynAck won’t proceed further and will instead terminate itself.

Once infected, just like any other ransomware, SynAck encrypts the content of each infected file with the AES-256-ECB algorithm and provides victims a decryption key until they contact the attackers and fulfil their demands.

Synack Ransomware

SynAck is also capable of displaying a ransomware note to the Windows login screen by modifying the LegalNoticeCaption and LegalNoticeText keys in the registry. The ransomware even clears the event logs stored by the system to avoid forensic analysis of an infected machine.

Although the researchers did not say how SynAck lands on the PC, most ransomware spread through phishing emails, malicious adverts on websites, and third-party apps and programs.

Therefore, you should always exercise caution when opening uninvited documents sent over an email and clicking on links inside those documents unless verifying the source in an attempt to safeguard against such ransomware infection.

Although, in this case, only a few security and antivirus software can defend or alert you against the threat, it is always a good practice to have an effective antivirus security suite on your system and keep it up-to-date.

Last but not the least: to have a tight grip on your valuable data, always have a backup routine in place that makes copies of all your important files to an external storage device that isn’t always connected to your PC.

the hacker news

Android P to stop apps from monitoring network activity

/in ,

In the future, it looks like Android apps will no longer be able to detect when other apps on your device are connecting to the internet.

It’s about time Google patches this nasty privacy flaw. Any app can monitor your network activity without your knowledge to see when you connect with a competing app, or perhaps worse.

XDA Developers first noticed the new changes coming to Android’s SELinux rules for apps targeting API level 28 running on Android P:

A new commit has appeared in the Android Open Source Project to “start the process of locking down proc/net.” /proc/net contains a bunch of output from the kernel related to network activity. There’s currently no restriction on apps accessing /proc/net, which means they can read from here (especially the TCP and UDP files) to parse your device’s network activity.

The SELinux changes only enable designated VPN apps to access some networking information, according to the code. As XDA Developers points out, Android apps won’t have to target API level 28 until 2019 — meaning the flaw could still be accessed for some time.

We’ll be looking for changes in the next release of the Android Open Source Project. Hopefully Google will jump in and patch things before Android P’s future release.

zdnet

Sophisticated Android malware ZooPark tracks all your phone activities

/in

An advanced type of malware can spy on nearly every Android smartphone function and steal passwords, photos, video, screenshots and data from WhatsApp, Telegram and other apps. “ZooPark” targets subjects in the Middle East and was likely developed by a state actor, according to Kaspersky Lab, which first spotted and identified it.

ZooPark has evolved over four generations, having started as simple malware that could “only” steal device account details and address book contacts. The last generation, however, can monitor and exfiltrate keylogs, clipboard data, browser data including searching history, photos and video from the memory card, call records and audio, and data from secure apps like Telegram. It can also capture photos, video, audio and screenshots on its own, without the subject knowing. To get the data out, it can silently make calls, send texts and execute shell commands.

Kaspersky — a company with its own spotty security history that has been banned by the US government — said that it has seen less than 100 targets in the wild. “This and other clues indicates that the targets are specifically selected,” Kasperky Lab’s Alexey Firsh told ZDNet. It also implies that the campaign is backed by a nation state, though the security firm didn’t say which.

How the Malware works

At the same time, Kaspersky suggested that the malware might not have been built in-house. “The latest version may have been bought from vendors of surveillance tools,” it wrote. “That wouldn’t be surprising, as the market for those espionage tools is growing, becoming popular among governments, with several known cases in the Middle East.”

As is now known, a lot of those tools came from the US government itself. A group called Shadow Brokers famously stole exploits from the NSA — some of the zero day, unpatched variety — and eventually released them to the public. In other words, a hacking group was able to obtain malware from what should be the most secure agency in the world. That’s one of the reasons that security experts and companies like Apple don’t trust the US government with device backdoors.

Engadget

GravityRAT: the trojan with a unique trick for evading analysis

/in ,

GravityRAT, a malware allegedly designed by Pakistani hackers, has recently been updated further and equipped with anti-malware evasion capabilites, Maharashtra cybercrime officials said.

The RAT was first detected by Indian Computer Emergency Response Team, CERT-In, on various computers in 2017. It is designed to infiltrate computers and steal the data of users, and relay the stolen data to Command and Control centres in other countries. The ‘RAT’ in its name stands for Remote Access Trojan, which is a program capable of being controlled remotely and thus difficult to trace.

Maharashtra cybercrime department officials said that the latest update to the program by its developers is part of GravityRAT’s function as an Advanced Persistent Threat (APT), which, once it infiltrates a system, silently evolves and does long-term damage.

“GravityRAT is unlike most malware, which are designed to inflict short term damage. It lies hidden in the system that it takes over and keeps penetrating deeper. According to latest inputs, GravityRAT has now become self aware and is capable of evading several commonly used malware detection techniques,” an officer of the cybercrime unit said.

One such technique is ‘sandboxing’, to isolate malware from critical programs on infected devices and provide an extra layer of security.

“The problem, however, is that malware needs to be detected before it can be sandboxed, and GravityRAT now has the ability to mask its presence. Typically, malware activity is detected by the ‘noise’ it causes inside the Central Processing Unit, but GravityRAT is able to work silently. It can also gauge the temperature of the CPU and ascertain if the device is carrying out high intensity activity, like a malware search, and act to evade detection,” another officer said.

Officials said that GravityRAT infiltrates a system in the form of an innocuous looking email attachment, which can be in any format, including MS Word, MS Excel, MS Powerpoint, Adobe Acrobat or even audio and video files.

“The hackers first identify the interests of their targets and then send emails with suitable attachments. Thus a document with ‘share prices’ in the file is sent to those interested in the stock market. Once it is downloaded, it prompts the user to enter a message in a dialogue box, purportedly to prove that the user is not a bot. While the users take this to be a sign of extra security, the action actually initiates the process for the malware to infiltrate the system, triggering several steps that end with GravityRAT sending data to the Command and Control server regularly,” an officer said.

The other concern is that the Command and Control servers are based in several countries. The data is sent in an encrypted format, making it difficult to detect exactly what is leaked.

Special Inspector General of Police (Cyber) Brijesh Singh of Maharashtra Police said, “We urge people to follow basic cyberhygiene like watching what they download, updating their anti-virus software and conducting cyber security reviews regularly.” CERT-In had issued an alert for it last year, with an advisory asking users to review cybersecurity measures and update anti-malware tools.

Samsung rolling out update to fix Galaxy S9 and S9+ call stability issues

/in

Reliably making phone calls on your smartphone is easy to take for granted, but there’s nothing like disrupted and dropped calls to help you appreciate that simple function again. Some Samsung Galaxy S9 and S9+ owners are having their voices muted or distorted during calls, or having their calls dropped altogether. Now Samsung is starting to roll out a software update in some countries to fix these issues.

These problems have been reported by more than a few users around the world, and late last month Samsung said a fix would roll out soon. It seems some S9 and S9+ owners in parts of Europe, the Middle East, Africa, and Australia are now receiving the promised update. The build numbers are G960FXXU1ARD4 for the S9 and G965FXXU1ARD4 for the S9+, with slight region-based variations. The size of the update appears to weigh in around 150MB, though the exact size will vary depending on the build number.

The “What’s New” section of the software update includes two items:

  • Call stability has been improved.
  • The quality of Wallpaper has been improved.

It’s worth noting that this update does not include a security patch, which isn’t surprising since Samsung started rolling out updates for the S9 and S9+ that included the April security patch a couple weeks ago.

These call stability issues are reminiscent of some S8 and Note8 units having muted mics, which had to be blown on in order to be fixed. And this isn’t the only issue owners of Samsung’s latest flagships are reporting: Some users have dead zones on their touchscreens.

If you own an S9 or S9+ that has these annoying call issues and get the update, let us know if the fix works. You can manually check for it by going to Settings > Software update.

android police