Cyber attack claims player details from World Rugby

/in ,

World Rugby has been forced to suspend one of its websites after the governing body was the target of a cyber attack that saw hackers obtain personal data from thousands of subscribers to one of their databases, The Sunday Telegraph can reveal.

It is understood that the hackers were able to access the first name, email address and encrypted passwords of thousands of users, including players, coaches and parents from across the world after the security breach on May 3.

It is not yet clear if it was a random attack to steal data or if World Rugby was deliberately targeted by one of the cyber espionage groups that has previously leaked confidential information from the websites of sporting bodies such as WADA and the IAAF.

The hackers targeted World Rugby’s training and education website, which is a platform for the grass-roots game to keep up to date with the latest drills to improve technique and offer advice for the prevention of injuries such as ­concussion.

World Rugby’s main website, including Rugby World Cup ticketing and fan data plus sensitive information around players’ disciplinary hearings, was not at risk from the attack.

World Rugby immediately took down the affected sites and denied access to databases when it detected the breach and brought in data and technology ­security experts to investigate the nature and scope of the incident and put in steps to prevent a similar attack.

As of yesterday, the training and education portal remained offline.

World Rugby also sent emails to the subscribers to warn them of the breach and reassure them that as the passwords were encrypted, there was no danger of them being breached.

Subscribers, however, were recommended to change their passwords when the site comes back online.

As World Rugby is based in Dublin, the governing body also informed the Irish Data Protection Commissioner’s office of the breach. The details of the attack emerged just days before the EU’s general data protection regulation comes into effect on May 25.

World Rugby could have faced a sanction from the Association of Data Protection Officers (ADPO) if the breach had occurred after that date. The ADPO will have the power to fine organisations up to €10 million (₦4,250,000,000) for data security breaches, depending on mitigating factors.

Sean Burnard, one of the subscribers who received the email alert, said he was alarmed by the breach. Burnard uses the portal to access the training drills and technique tips to help his sons improve their skills.

“At first my concern was that it was a spoof email but then it was confirmed that there had been a security breach,” he said.

The Telegraph

Microsoft Publishes PDF With Every Windows Terminal Command

/in ,
Download Windows Commands Reference

If you wanted an exhaustive reference for all the windows terminal command line tools and utilities available in Windows, “/h” was as good as it got. Well, that was until last month, when Microsoft published a whopping big PDF with information on every single terminal command the operating system has to offer.

The document, released on April 18, comes in at 4.6MB and 948 pages and covers the following platforms:

  • Windows Server (Semi-Annual Channel)
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2012
  • Windows Server 2008 R2
  • Windows Server 2008
  • Windows 10
  • Windows 8.1

Even though Windows 7 is absent, it’s fair to say a lot of the commands should work on the older OS.

The reference isn’t just limited to commands — it also contains tips for configuring the command prompt window, as well as changes you can make to the Registry to enable and disable features, such as filename / directory completion.

Best of all, hyperlinks embedded in the file for each command jump directly to online documentation, so you can always check out the most up-to-date content.

This does however raise the question: why have a gigantic reference PDF in the age of online documentation?

Download Windows Commands Reference

lifehacker

First-Ever Ransomware Found Using ‘Process Doppelgänging’ Attack to Evade Detection

/in , ,

Security researchers have spotted the first-ever ransomware exploiting Process Doppelgänging, a new fileless code injection technique that could help malware evade detection.

The Process Doppelgänging attack takes advantage of a built-in Windows function, i.e., NTFS Transactions, and an outdated implementation of Windows process loader, and works on all modern versions of Microsoft Windows OS, including Windows 10.

Process Doppelgänging attack works by using NTFS transactions to launch a malicious process by replacing the memory of a legitimate process, tricking process monitoring tools and antivirus into believing that the legitimate process is running.

If you want to know more about how Process Doppelgänging attack works in detail, you should read this article published late last year on thehackernews.com.

Shortly after the Process Doppelgänging attack details went public, several threat actors were found abusing it in an attempt to bypass modern security solutions.

Security researchers at Kaspersky Lab have now found the first ransomware, a new variant of SynAck, employing this technique to evade its malicious actions and targeting users in the United States, Kuwait, Germany, and Iran.

Synack Ransomware process - Doppelganging

Initially discovered in September 2017, the SynAck ransomware uses complex obfuscation techniques to prevent reverse engineering, but researchers managed to unpack it and shared their analysis in a blog post.

An interesting thing about SynAck is that this ransomware does not infect people from specific countries, including Russia, Belarus, Ukraine, Georgia, Tajikistan, Kazakhstan, and Uzbekistan.

To identify the country of a specific user, the SynAck ransomware matches keyboard layouts installed on the user’s PC against a hardcoded list stored in the malware. If a match is found, the ransomware sleeps for 30 seconds and then calls ExitProcess to prevent encryption of files.

SynAck ransomware also prevents automatic sandbox analysis by checking the directory from where it executes. If it found an attempt to launch the malicious executable from an ‘incorrect’ directory, SynAck won’t proceed further and will instead terminate itself.

Once infected, just like any other ransomware, SynAck encrypts the content of each infected file with the AES-256-ECB algorithm and provides victims a decryption key until they contact the attackers and fulfil their demands.

Synack Ransomware

SynAck is also capable of displaying a ransomware note to the Windows login screen by modifying the LegalNoticeCaption and LegalNoticeText keys in the registry. The ransomware even clears the event logs stored by the system to avoid forensic analysis of an infected machine.

Although the researchers did not say how SynAck lands on the PC, most ransomware spread through phishing emails, malicious adverts on websites, and third-party apps and programs.

Therefore, you should always exercise caution when opening uninvited documents sent over an email and clicking on links inside those documents unless verifying the source in an attempt to safeguard against such ransomware infection.

Although, in this case, only a few security and antivirus software can defend or alert you against the threat, it is always a good practice to have an effective antivirus security suite on your system and keep it up-to-date.

Last but not the least: to have a tight grip on your valuable data, always have a backup routine in place that makes copies of all your important files to an external storage device that isn’t always connected to your PC.

the hacker news

Android P to stop apps from monitoring network activity

/in ,

In the future, it looks like Android apps will no longer be able to detect when other apps on your device are connecting to the internet.

It’s about time Google patches this nasty privacy flaw. Any app can monitor your network activity without your knowledge to see when you connect with a competing app, or perhaps worse.

XDA Developers first noticed the new changes coming to Android’s SELinux rules for apps targeting API level 28 running on Android P:

A new commit has appeared in the Android Open Source Project to “start the process of locking down proc/net.” /proc/net contains a bunch of output from the kernel related to network activity. There’s currently no restriction on apps accessing /proc/net, which means they can read from here (especially the TCP and UDP files) to parse your device’s network activity.

The SELinux changes only enable designated VPN apps to access some networking information, according to the code. As XDA Developers points out, Android apps won’t have to target API level 28 until 2019 — meaning the flaw could still be accessed for some time.

We’ll be looking for changes in the next release of the Android Open Source Project. Hopefully Google will jump in and patch things before Android P’s future release.

zdnet

Sophisticated Android malware ZooPark tracks all your phone activities

/in

An advanced type of malware can spy on nearly every Android smartphone function and steal passwords, photos, video, screenshots and data from WhatsApp, Telegram and other apps. “ZooPark” targets subjects in the Middle East and was likely developed by a state actor, according to Kaspersky Lab, which first spotted and identified it.

ZooPark has evolved over four generations, having started as simple malware that could “only” steal device account details and address book contacts. The last generation, however, can monitor and exfiltrate keylogs, clipboard data, browser data including searching history, photos and video from the memory card, call records and audio, and data from secure apps like Telegram. It can also capture photos, video, audio and screenshots on its own, without the subject knowing. To get the data out, it can silently make calls, send texts and execute shell commands.

Kaspersky — a company with its own spotty security history that has been banned by the US government — said that it has seen less than 100 targets in the wild. “This and other clues indicates that the targets are specifically selected,” Kasperky Lab’s Alexey Firsh told ZDNet. It also implies that the campaign is backed by a nation state, though the security firm didn’t say which.

How the Malware works

At the same time, Kaspersky suggested that the malware might not have been built in-house. “The latest version may have been bought from vendors of surveillance tools,” it wrote. “That wouldn’t be surprising, as the market for those espionage tools is growing, becoming popular among governments, with several known cases in the Middle East.”

As is now known, a lot of those tools came from the US government itself. A group called Shadow Brokers famously stole exploits from the NSA — some of the zero day, unpatched variety — and eventually released them to the public. In other words, a hacking group was able to obtain malware from what should be the most secure agency in the world. That’s one of the reasons that security experts and companies like Apple don’t trust the US government with device backdoors.

Engadget

Samsung rolling out update to fix Galaxy S9 and S9+ call stability issues

/in

Reliably making phone calls on your smartphone is easy to take for granted, but there’s nothing like disrupted and dropped calls to help you appreciate that simple function again. Some Samsung Galaxy S9 and S9+ owners are having their voices muted or distorted during calls, or having their calls dropped altogether. Now Samsung is starting to roll out a software update in some countries to fix these issues.

These problems have been reported by more than a few users around the world, and late last month Samsung said a fix would roll out soon. It seems some S9 and S9+ owners in parts of Europe, the Middle East, Africa, and Australia are now receiving the promised update. The build numbers are G960FXXU1ARD4 for the S9 and G965FXXU1ARD4 for the S9+, with slight region-based variations. The size of the update appears to weigh in around 150MB, though the exact size will vary depending on the build number.

The “What’s New” section of the software update includes two items:

  • Call stability has been improved.
  • The quality of Wallpaper has been improved.

It’s worth noting that this update does not include a security patch, which isn’t surprising since Samsung started rolling out updates for the S9 and S9+ that included the April security patch a couple weeks ago.

These call stability issues are reminiscent of some S8 and Note8 units having muted mics, which had to be blown on in order to be fixed. And this isn’t the only issue owners of Samsung’s latest flagships are reporting: Some users have dead zones on their touchscreens.

If you own an S9 or S9+ that has these annoying call issues and get the update, let us know if the fix works. You can manually check for it by going to Settings > Software update.

android police

CBN limits USSD transactions to N100,000 per day

/in

EFFECTIVE from June this year bank customers will not be able to use Unstructured Supplementary Service Data (USSD) channel to conduct transactions more than N100, 000 per day.

Also they will have to use both their PIN and a soft token to authenticate transactions above N20, 000. The USSD is a technology platform for online payments.

In addition, banks must allow their customers the option to opt out of USSD channel for financial transactions.

These were highlights of the ‘Regulatory Framework for the use of Unstructured Supplementary Service Data (USSD) for Financial Services in Nigeria’, issued by the Central Bank of Nigeria, CBN, yesterday.

In a circular announcing the framework, Director, Banking System and Payments Department, CBN, stated: “The vast applications of the USSD technology, in terms of available services have raised the issue of the risks inherent in the channel. In this regard, concerns have been expressed on the likely exposure of CBN approved entities to the possible breaching of the USSD accessed financial services in view of likely vulnerabilities in the technology and the ever growing threats.

‘‘Furthermore, the implementation in Nigeria has created multiple USSD channels to customers, thereby increasing their exposure to risk, without a common standard for all. ‘‘This framework therefore, seeks to establish the rules and risk mitigation considerations when implementing USSD for financial services offering in Nigeria.”

Among other things, the framework stated: “USSD based financial transaction requires encryption to protect the integrity of the financial information. To this end, Financial Institutions providing use of the USSD channel shall: Ensure that the customer receives notification on the status of every transaction conducted through the channel; Not use the USSD service to relay details of other electronic banking channels (in case of banks), to their customers, to prevent compromise of other electronic banking channels through the USSD channel; Avail the customers the option to opt in/out of the USSD channel for financial Transactions.’’

vanguard

Learn How to Code with your Phone for Free

/in ,

Grasshopper

A bunch of Google employees participating in the company’s Area 120 internal incubator have launched Grasshopper, a free mobile app for Android and iOS that teaches you the basics of programming.

It’s beautifully designed and is suitable for just about anyone who can be trusted to use a phone on their own. By solving simple challenges and answering quiz questions, you’ll soon get the hang of basic JavaScript.

The gamified app, named after programming pioneer Grace Hopper, currently includes three sets of lessons, which cover the fundamentals of coding (calling functions, using variables and objects, and so on), as well as animations. The idea is to spend a few minutes a day with it, so you can have the app remind you to hop in daily and take on a few challenges.

When you’re done with the content in Grasshopper, you can move on to recommended Coursera classes to learn more about JavaScript, HTML, CSS, algorithms, and web design for a fee, or simply muck around in Grashopper’s online playground and make your own JS animations. Naturally, you can also explore alternatives for learning to code, such as the courses offered by edX and FreeCodeCamp.

I’ve been meaning to get back to coding for a while now, having ditched my chops when I graduated from high school. The app is fun and easy enough to get through a few challenges when you’re on a commute, and feels like a good alternative to scrolling through social media feeds mindlessly.

Grasshopper is the latest product to emerge from Area 120, which gives Google employees a chance to work full-time on their side projects and bring them to life. It’s previously seen launches like Uptime, which lets you watch YouTube videos in sync with friends elsewhere in the world, and Supersonic, a messaging app for emoji lovers.

thenextweb

Judge says Samsung ‘rigged the deck, fixed the game’ with Galaxy S4

/in ,

Samsung Galaxy S4Samsung has been slammed by a federal judge for allegedly misleading consumers who purchased the Samsung Galaxy S4, by fraudulently misrepresenting the amount of power available in the device.

The statement came about as a result of a long-running legal dispute between the Korean tech giant and a class action lawsuit, headed by plaintiff Daniel Norcia. Back in 2011, Norcia filed a suit against Samsung, alleging that the capabilities of the Galaxy S4 flagship phone had been grossly misrepresented, and Samsung had used this to mislead customers into thinking the phone was more powerful than competitors’ phones. Parts of the lawsuit surrounding the available storage have since been dropped, but the courts have upheld Norcia’s complaint on the processing power of the phone.

According to the accusation, Samsung coded the Galaxy S4’s software to detect when specific benchmarking software was being used, and have it commit extra resources to its operation — effectively cheating the test and providing results that could not be replicated outside of the benchmarking app by a casual user. Since these benchmarks are commonly used in third-party reviews of the device, that alleged cheating led to a false impression of superior speed being made public.

“Samsung also knew that if it artificially boosted the performance of its devices when running benchmarking apps, reviewers and the public would falsely believe that the Galaxy S4 was similarly fast in real-world situations. In reality, the processors in the Galaxy S4 run at a lower speed and the artificial performance boost disappears when the devices are performing real-world tasks instead of running benchmarking apps” states Norcia’s complaint.

Samsung had previously attempted to move the case to arbitration court by arguing the Galaxy S4’s warranty specifically forbad class actions lawsuits being brought. Unfortunately for Samsung, an appeals court dismissed this claim on the basis that warranties do not impose anything on the buyer, especially when introduced after the sale.

Speaking in a previous hearing on the case, U.S. District Judge James Donato said: “Samsung rigged the deck, fixed the game; and as a result of that, consumers were misled about the speed of the phone.”

The case is due to be heard in front of a U.S. magistrate judge next week.

Digital Trends

This New Web Standard Could Finally Kill the Password

/in

Passwords are pretty archaic. Unfortunately, despite the best efforts of companies including Google, Apple, Facebook and others, no one has figured out a uniform standard that would make it possible to do away with them entirely. Until, perhaps, now.

A new credential system proposed by the W3C—the World Wide Web Consortium—could be what we need to kill off the password for good.

Per the w3c, the new Web Authentication specification details an “API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users.” In other words, this would be a universal system that could offer unique encryption keys for each user that could be accessed securely across every site, all in your standard web browser.

But the big upgrade is that, instead of being limited to a regular password, the API would also support the use of fingerprint readers, cameras, and USB keys as a method of logging into your account. In fact, some potential use cases even include using the fingerprint reader on your phone to log into a website that you’re browsing on your laptop or desktop, which may not have its own fingerprint sensor.

While the new standard is currently listed as just a “Candidate Recomendation,” the feature is already in use as an experimental technology in FireFox, with other browsers including Chrome and Edge expected to test the Web Authentication API later this year.

The sad part so far is that, despite input and contribution from companies such as Google, Microsoft, PayPal, Mozilla, Qualcomm and others, it doesn’t seem like Apple is on board to help test or refine the tech. That’s a real shame, because even though wide-scale adoption is still a ways out, it would be nice if there was a secure, non-proprietary login platform that all the big tech companies could agree on.

gizmodo