TNT parcels ‘backed up to ceiling’ in wake of massive cyberattack

/in ,

Parcels are backing up at TNT depots in their thousands after the company admitted it is still struggling to deal with the aftermath of June’s cyber-attack that crippled IT systems around the world.

Frustrated customers trying to get news of their undelivered parcels have been told by TNT’s UK staff that consignments at its East Midlands hub are “going up to the ceiling” as international shipments are still having to be processed by hand.

TNT was one of thousands of big businesses and other organisations hit by the ransomware attack known as “NotPetya” at the end of June. At least 2,000 individuals and organisations worldwide were affected by the attack, which began in the Ukraine.

Most organisations were up and running again within days and hours. But the full scale of the attack’s impact and resulting losses to some big businesses are only now starting to emerge.

On Monday the consumer group Reckitt Benckiser, the maker of Durex and Nurofen, blamed the same IT attack for a 2% fall in second quarter like-for-like sales. TNT’s parent company, FedEx, has already been forced to warn the New York stock exchange that its earnings would be “materially” down as a result of the attack.

The company said last week the problem has affected TNT operations around the world, pushing down its share more than 3%. It admitted that it did not have insurance to cover the attack.

“Customers are still experiencing widespread service and invoicing delays, and manual processes are being used to facilitate a significant portion of TNT operations and customer service functions,” FedEx said.

“We cannot yet estimate how long it will take to restore the systems that were impacted, and it is reasonably possible that TNT will be unable to fully restore all of the affected systems and recover all of the critical business data that was encrypted by the virus.”

Peter Blohm, an antique dealer from Aberystwyth, is one of those caught up the TNT chaos. He has been trying to find out what happened to a consignment of art that left Switzerland on the 11 July and was due to be delivered a day or so later. “TNT tell me they have had no computer systems since the end of June and there is no estimate for when their systems will be fixed,” he told the Guardian.

“This means there are many thousands of parcels which have like mine been waiting for weeks to be processed by hand with pen and paper. The staff sound harassed, but cannot estimate when my parcel will be delivered, because they simply do not know.”

A TNT spokeswoman said on Monday that there was no update to the statement issued last week. A customer care phone line to TNT’s main UK hub was not working on Monday, adding to the frustration of customers.

Earlier this month the Danish shipping group Maersk said it was too early to predict the financial impact of the cyberattack that hit the shipping giant’s computers and delayed cargoes. Other firms affected include the advertising firm WPP, French construction materials company Saint-Gobain, and Russian steel and oil firms Evraz and Rosneft.

Graham Cluley, an independent cybersecurity expert, said the final bill for the attack could be huge. “There’s no such thing as 100% security, but this malware outbreak has disrupted a number of large multinationals for weeks, hitting their systems, and in some cases financial outlook, for six,” Cluley said.

“I really hope that more companies are recognising the benefits of adopting a layered approach to security, examining closely how they have set up their networks, and taking steps to ensure that they are able to recover quickly should disaster strike.”

The Guardian logo

Mac Computers Hacked With ‘FruitFly’ Surveillance Malware

/in , ,

American Apple Mac computers have been hacked with FruitFly malware, Forbes reports.

The hack is thought to be for surveillance as hackers were able to jump into the webcams of the affected computers and take screenshots, though the FruitFly malware has the ability to take over the entire computer.

“This didn’t look like cybercrime type behaviour, there were no ads, no keyloggers, or ransomware,” said Patrick Wardle, cybersecurity researcher, via Forbes. “Its features had looked like they were actions that would support interactivity: it had the ability to alert the attacker when users were active on the computer, it could simulate mouse clicks and keyboard events.”

This isn’t the first time that FruitFly is making a hacking appearance. Earlier this year, it was used to target biomedical research centers.

“The only reason I can think of that this malware hasn’t been spotted before now is that it is being used in very tightly targeted attacks, limiting its exposure,” wrote Thomas Reed, MalwareBytes researcher. “Although there is no evidence at this point linking this malware to a specific group, the fact that it’s been seen specifically at biomedical research institutions certainly seems like it could be the result of exactly that kind of espionage.”

FruitFly is difficult to detect. Not much is known about the malware.

This cheap password-stealing malware just added to your security headaches

/in ,

A new form of credential-stealing malware — complete with slick marketing and support from its authors — is available for as little as $7, providing wannabes with a worryingly easy entry point into the world of cybercrime.

First appearing a month ago, Ovidiy Stealer is regularly updated by its Russian-speaking authors and the malware has hit targets around the world including the UK, the Netherlands, India, and Russia.

Despite its low price of 450-750 Rubles ($7-13), the malware comes with code designed to avoid analysis and detection.

Uncovered by researchers at Proofpoint, the malware is spread via a number of methods, including malicious email attachments, file-hosting websites, and even within software packages.

It comes with functionality to target multiple applications, but buyers are able to purchase a version of the malware which only focuses on a single browser if they so wish.

If the malware is able to find passwords in its targeted applications, it will send them to the gang using it, putting the victim and their organisation at risk of compromise, especially if the same password is used across multiple accounts.

Ovidiy Stealer is openly sold on a domain which boasts support and features — including the ability to view statistics and logs of infected machines — to potential customers. Payment for the malware is taken by RoboKassa, the Russian equivalent of PayPal.

In order to help drive sales in the competitive criminal world of malware, the developers include statistics and detail plans for future releases of Ovidiy Stealer.

ovidiy-stealer-reviews.png
Reviews help Ovidiy Stealer look appealing to potential buyers.Image: Proofpoint

While Ovidiy Stealer isn’t advanced, the marketing and advertising around it, combined with a low price, could make it very attractive to wannabe cybercriminals who might not otherwise have the expertise to get involved.

“Ovidiy Stealer highlights the manner in the cybercrime marketplace drives innovation and new entrants and challenges organizations that must keep pace with the latest threats to their users, their data, and their systems,” said Proofpoint researchers.

While many cybercriminal operations are run by highly sophisticated gangs which do not sell their products to outsiders, there’s a growing market for ‘cybercrime-as-a-service’ schemes which provide low-level criminals with all the tools they need to get started, in return for a cut of the profits.

ZDNet

‘Petya’ ransomware attack: what is it and how can it be stopped?

/in ,

Many organizations in Europe and the US have been crippled by a ransomware attack known as “Petya”. The malicious software has spread through large firms including the advertiser WPP, food company Mondelez, legal firm DLA Piper and Danish shipping and transport firm Maersk, leading to PCs and data being locked up and held for ransom.

It’s the second major global ransomware attack in the past two months. In early May, Britain’s National Health Service (NHS) was among the organizations infected by WannaCry, which used a vulnerability first revealed to the public as part of a leaked stash of NSA-related documents released online in April by a hacker group calling itself the Shadow Brokers.

The WannaCry or WannaCrypt ransomware attack affected more than 230,000 computers in over 150 countries, with the NHS, Spanish phone company Telefónica and German state railways among those hardest hit.

Like WannaCry, “Petya” spreads rapidly through networks that use Microsoft Windows, but what is it, why is it happening and how can it be stopped?

What is ransomware?

Ransomware is a type of malware that blocks access to a computer or its data and demands money to release it.

How does it work?

When a computer is infected, the ransomware encrypts important documents and files and then demands a ransom, typically in Bitcoin, for a digital key needed to unlock the files. If victims don’t have a recent back-up of the files they must either pay the ransom or face losing all of their files.

How does the “Petya” ransomware work?

The ransomware takes over computers and demands $300, paid in Bitcoin. The malicious software spreads rapidly across an organization once a computer is infected using the EternalBlue vulnerability in Microsoft Windows (Microsoft has released a patch, but not everyone will have installed it) or through two Windows administrative tools. The malware tries one option and if it doesn’t work, it tries the next one. “It has a better mechanism for spreading itself than WannaCry,” said Ryan Kalember, of cybersecurity company Proofpoint.

Is there any protection?

Most major antivirus companies now claim that their software has updated to actively detect and protect against “Petya” infections: Symantec products using definitions version 20170627.009 should, for instance, and Kaspersky also says its security software is now capable of spotting the malware. Additionally, keeping Windows up to date – at the very least through installing March’s critical patch defending against the EternalBlue vulnerability – stops one major avenue of infection, and will also protect against future attacks with different payloads.

For this particular malware outbreak, another line of defence has been discovered: “Petya” checks for a read-only file, C:\Windows\perfc.dat, and if it finds it, it won’t run the encryption side of the software. But this “vaccine”doesn’t actually prevent infection, and the malware will still use its foothold on your PC to try to spread to others on the same network.

Why is it called “Petya”?

Strictly speaking, it is not. The malware appears to share a significant amount of code with an older piece of ransomware that really was called Petya, but in the hours after the outbreak started, security researchers noticed that “the superficial resemblance is only skin deep”. Researchers at Russia’s Kaspersky Lab redubbed the malware NotPetya, and increasingly tongue-in-cheek variants of that name – Petna, Pneytna, and so on – began to spread as a result. On top of that, other researchers who independently spotted the malware gave it other names: Romanian’s Bitdefender called it Goldeneye, for instance.

Where did it start?

The attack appears to have been seeded through a software update mechanism built into an accounting program that companies working with the Ukrainian government need to use, according to the Ukrainian cyber police. This explains why so many Ukrainian organizations were affected, including government, banks, state power utilities and Kiev’s airport and metro system. The radiation monitoring system at Chernobyl was also taken offline, forcing employees to use hand-held counters to measure levels at the former nuclear plant’s exclusion zone. A second wave of infections was spawned by a phishing campaign featuring malware-laden attachments.

How far has it spread?

The “Petya” ransomware has caused serious disruption at large firms in Europe and the US, including the advertising firm WPP, French construction materials company Saint-Gobain and Russian steel and oil firms Evraz and Rosneft. The food company Mondelez, legal firm DLA Piper, Danish shipping and transport firm AP Moller-Maersk and Heritage Valley Health System, which runs hospitals and care facilities in Pittsburgh, also said their systems had been hit by the malware.

Crucially, unlike WannaCry, this version of ‘Petya’ tries to spread internally within networks, but not seed itself externally. That may have limited the ultimate spread of the malware, which seems to have seen a decrease in the rate of new infections overnight.

So is this just another opportunistic cybercriminal?

It initially looked like the outbreak was just another cybercriminal taking advantage of cyberweapons leaked online. However, security experts say that the payment mechanism of the attack seems too amateurish to have been carried out by serious criminals. Firstly, the ransom note includes the same Bitcoin payment address for every victim – most ransomware creates a custom address for every victim. Secondly, the malware asks victims to communicate with the attackers via a single email address which has been suspended by the email provider after they discovered what it was being used for. This means that even if someone pays the ransom, they have no way to communicate with the attacker to request the decryption key to unlock their files.

Who is behind the attack?

It is not clear, but it seems likely it is someone who wants the malware to masquerade as ransomware, while actually just being destructive, particularly to the Ukrainian government. Security researcher Nicholas Weaver told cybersecurity blog Krebs on Security that ‘Petya’ was a “deliberate, malicious, destructive attack or perhaps a test disguised as ransomware”. Pseudonymous security researcher Grugq noted that the real Petya “was a criminal enterprise for making money,” but that the new version “is definitely not designed to make money.

“This is designed to spread fast and cause damage, with a plausibly deniable cover of ‘ransomware,’” he added, pointing out that, among other tells, the payment mechanism in the malware was inept to the point of uselessness: a single hardcoded payment address, meaning the money can be traced; the requirement to email proof of payment to a webmail provider, meaning that the email address can be – and was – disabled; and the requirement to send an infected machine’s 60-character, case sensitive “personal identification key” from a computer which can’t even copy-and-paste, all combine to mean that “this payment pipeline was possibly the worst of all options (sort of ‘send a personal cheque to: Petya Payments, PO Box … ’)”.

Ukraine has blamed Russia for previous cyber-attacks, including one on its power grid at the end of 2015 that left part of western Ukraine temporarily without electricity. Russia has denied carrying out cyber-attacks on Ukraine.

What should you do if you are affected by the ransomware?

The ransomware infects computers and then waits for about an hour before rebooting the machine. While the machine is rebooting, you can switch the computer off to prevent the files from being encrypted and try and rescue the files from the machine, as flagged by @HackerFantastic on Twitter.

If the system reboots with the ransom note, don’t pay the ransom – the “customer service” email address has been shut down so there’s no way to get the decryption key to unlock your files anyway. Disconnect your PC from the internet, reformat the hard drive and reinstall your files from a backup. Back up your files regularly and keep your anti-virus software up to date.

The Guardian logo

Hackers use NSA’s leaked EternalBlue exploit to power more malicious payloads

/in ,

Hackers are expanding the use of EternalBlue, the leaked NSA hacking exploit that was thrust into the spotlight in May with its initial use in the WannaCry ransomware and Adylkuzz cryptocurrencyminer.

Security researchers have now found threat actors exploiting the vulnerability in Microsoft Server Message Block (SMB) protocol to distribute other malicious payloads including Backdoor.Nitol and Trojan Gh0st RAT.

Backdoor.Nitol is a Trojan horse that opens a backdoor on the infected computer. Gh0st RAT is a remote access trojan that has been making the rounds for years to target Windows machines and is capable of giving attackers full access and control of an infected machine. It has also been used in extensive cyber espionage and data stealing campaigns.

According to security firm FireEye, both the well-known payloads have been previously used in cyberattacks targeting the aerospace and defence industry with Gh0st RAT targeting government agencies and activists as well.

“We observed lab machines vulnerable to the SMB exploit were attacked by a threat actor using the EternalBlue exploit to gain shell access to the machine,” FireEye researchers said in blogpost. “The initial exploit technique used at the SMB level is similar to what we have been seen in WannaCry campaigns.

“However, once a machine is successfully infected, this particular attack opens a shell to write instructions into a VBScript file and then executes it to fetch the payload on another server.”

Researchers said the combination of EternalBlue and VBScript has been used to distribute Gh0st RAT in Singapore and Backdoor.Nitol in the South Asia region.

EternalBlue came as part of the cache of alleged NSA hacking tools released by notorious hacking group Shadow Brokers in April.

Security researchers warned that with EternalBlue exploit now released and available for any threat actors to target, it is likely that it will be used in new sophisticated and more frequent cyberattacks.

“The addition of the EternalBlue exploit to Metasploit has made it easy for threat actors to exploit these vulnerabilities,” FireEye said. “In the coming weeks and months, we expect to see more attackers leveraging these vulnerabilities and to spread such infections with different payloads.

“It is critical that Microsoft Windows users patch their machines and update to the latest software versions as soon as possible.”

IBTimes

20% of Risky Emails Bypass Email Security

/in

Far too many risky emails are infiltrating email security solutions, according to a report released Tuesday by Mimecast.

The email and data security company released its second quarterly report on the effectiveness of email security systems, the Mimecast Email Security Risk Assessment (ESRA), based on a study of more than 44,000 users. The results are bleak, depicting how risky and potentially malicious emails continue to infiltrate security solutions.

As much as 9 out of 40 million emails analyzed by Mimecast, all of which passed through an email security vendor or cloud email service, were determined to have the potential for risk. The majority of these emails were spam, but a smaller amount of more dangerous emails also bypassed security, and it only takes one to cause irreversible harm.

More than 8,300 emails examined by Mimecast contained dangerous file attachments, while 1,669 contained known malware and 8,605 were impersonation attacks.

Impersonation attacks, or social engineering scams, are when a cybercriminal attempts to impersonate a trusted individual, like a company CEO, to obtain confidential information from duped employees. These types of scams have risen 400% since the release of Mimecast’s February ESRA report.

Phishing is now the primary entry method for cybercriminals seeking to access organizations according to a recent report from Symantec.

It’s also a preferred method of the Russian military according to a leaked NSA document published Monday by The Intercept. The report describes how the Russian military used email phishing to target United States agencies and services in the lead-up to the 2016 Presidential election.

Hackers attempted to spear-phish a private company in the United States to access information on voting-related technology, as well as targeting government agencies to impede requests for absentee ballots.

MEDIA POST

Password manager OneLogin hacked, exposing sensitive customer data

/in

Password manager and single sign-on provider OneLogin has been hacked.

In a brief blog post, the company’s chief security officer Alvaro Hoyos said that it was aware of “unauthorized access to OneLogin data in our US data region,” and that it had reached out to customers.

Hoyos said that the company had blocked the unauthorized access after the breach and is working with law enforcement.

The blog post initially lacked detailed information about the incident, although the post had omitted that hackers had stolen sensitive customer data — a point that the company had instead only mentioned in an email sent to customers, seen by ZDNet.

“OneLogin believes that all customers served by our US data center are affected and customer data was potentially compromised,” the email read.

Later in the day, the company said in an update: “Our review has shown that a threat actor obtained access to a set of [Amazon Web Services, or AWS] keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US.”

The company confirmed that the attack appears to have started at 2am (PT), but staff were alerted of unusual database activity some seven hours later, who “within minutes, shut down the affected instance as well as the AWS keys that were used to create it”.

“The threat actor was able to access database tables that contain information about users, apps, and various types of keys,” the company said.

The company added that although it encrypts “certain sensitive data at rest,” it could not rule out the possibility that the hacker “also obtained the ability to decrypt data”.

But a spokesperson did not say what kind of data is and isn’t encrypted. We have asked for clarity, and will update when we hear back.

Some had questioned earlier in the day how the hackers had access to customer data that could ultimately be decrypted.

“Am I the only 1 to find it disturbing OneLogin had a decryption method for customer data accessible enough to be grabbed via breach?” said one user on Twitter.

The company has advised customers to change their passwords, generate new API keys for their services, and create new OAuth tokens — used for logging into accounts — as well as to create new security certificates. The company said that information stored in its Secure Notes feature, used by IT administrators to store sensitive network passwords, can be decrypted.

The company also hasn’t said how many customers were affected.

According to its website, dozens of major multinationals, including ARM, Dun & Bradstreet, The Carlyle Group, Conde Nast, and Dropbox (which a spokesperson disputed in an email), are customers.

OneLogin allows corporate users to access multiple web applications, sites, and services with just one password. It’s thought that the company has millions of users serving more than 2,000 companies in dozens of countries, according to CrunchBase.

The single sign-on provider integrates hundreds of different third-party apps and services, such as Amazon Web Services, Microsoft’s Office 365, LinkedIn, Slack, Twitter, and Google services.

It’s the second such breach in as many years. Last August, the company warned users that its Secure Notes service had been accessed by an “unauthorized user,” but it denied that any customer data had been compromised.

ZDNet

Social Media, Brute Force Attacks, Passwords, Fake WAPs & Protecting Yourself

/in , ,

The video above shows a hack of Gmail, but your social media accounts can be just as vulnerable if you choose a common password like:

  • Password
  • 12345
  • QWERTY
  • iloveyou

Social media accounts are online assets, which no matter how big you build them, can still be a liability. This liability comes from how they can be exploited by hackers, especially when you do not take the proper steps to protect them.

You need to put as much effort into protecting your online assets as you do building them. You don’t need an entire IT team to do this, keep reading to learn the basics of what you need to do.

Defeat brute force hacks with better passwords

One of the most brainless hacks out there is known as a brute force hack. I hacker simply sets up a tool to target a specific account and the tool guesses passwords until it is right. You may know these tools as password recovery tools. They have be altered by hackers for nefarious purposes.

You have to defend against brute force hacks with better passwords that are complicated and use a mix of characters.

Fake WAPs: Use a variety of passwords

Let’s say that you took my advice above when you created a password that is “35IrulePLANETearthb1tches!” Good job, but now you have to come up with the new password for each of your social media accounts. This is important because of something known as the fake WAP. This is when a hacker will set up a free Wi-Fi network in a public location. They will then use the network to steal things like passwords.

Your first line of defense should be a good password manager. You can create a very strong password to get into the password manager, and then it could manage a wide variety of strong passwords for you. Good examples include:

Each one is going to help you protect your accounts by using a wide variety of passwords to defend against the fake WAP hack. Even if they do get one password to one of your social media accounts they won’t necessarily get access to all of your other accounts.

Secondary defense against fake WAP

Last failsafe to protect yourself against a fake WAP involves encryption. The problem with the fake WAP is the hacker will set up a hot spot that has no encryption on it. This means that they can see the following in plain text:

  • Confidential information that you send over your social media through private messages.
  • Any customer contact details that you sent back and forth.
  • Brand strategies discussed between related accounts.
  • Any credit card numbers that customers send through there.

The way that you are going to encrypt every single thing that you send over a hotspot, including your social media, is with a VPN with strong encryption. These tools are perfect for this job as they encrypt everything that is transferred to and from your device. All you have to do is connect to the VPN server and that takes care of your encryption, and your social media data.

Do your best against insider threats

Insider threats, especially recently fired employees that still have your social media, are very real. There have been a number of times when staff and being fired but they’re access to the social media has not been removed. The most embarrassing has probably been HMV.

 Here are ways that you can defend against this insider threat:

  • Make a record of all accounts that employees have access to.
  • Have plans in place to remove people from all accounts before they’re fired. Make sure a specific person is assigned to this.
  • If you have multiple accounts that multiple employees are given access to, it may be smart to consolidate these in one social media dashboard. You can use things like HootSuite, SocialFlow, or BufferApp.

The last point will make things easier ‘s that you only have one account to remove access from. Imagine having to remove access to twitter, Facebook, WordPress, Google, LinkedIn, etc.… Consolidate the accounts in one spot to minimize an insider threat caused by oversight on what accounts they have access to.

Social media and online security

Social media is a fantastic way to connect with your customers. It can be a very valuable asset to your company. The value that you get from that can be exploited by hackers for monetary reasons, or simply to troll you. Both of these will wind up costing you money. Invest in these tactics, make sure that your employees follow through on them, and you will save yourself a lot of money and heartache.

Cyber attacks: how your devices can be used

/in

The massive global cyber attack that wreaked havoc in computer systems earlier this month caused plenty of visible disruption, not least in Britain’s National Health Service.

But in the brave new inter-connected world heralded by the internet of things (IoT), so-called “ransomware” attacks could have as their source something quite mundane and yet present in ever more modern households.

In a not so far-off future, the source of a software glitch with serious consequences for the simple consumer could be anything from a connected coffee machine or refrigerator to a techie toy or an outsmart-you television.

Web-connected gadgets are becoming all the rage with tech-aware professionals.

But the mere idea that it only needs a hacker to give the software a malevolent tweak to send them on the blink with disastrous consequences may yet threaten the development of such goods’ popular take-up.

“Regarding last weekend’s attack there is no risk for connected objects. That in particular hit systems running Windows …and today there are no mass market gadgets with Windows loaded in order to function,” says Gerome Billois, a consultant with Wavestone.

“In contrast, there have already been massive attacks on connected objects,” Billois told AFP.

The Mirai malware strain made from hacked IoT devices including badly secured routers and internet connected cameras recently infected hundreds of thousands of poorly secured connected objects.

The idea was not to stop them from working but to transform them into zombies or botnets with a view to using them as relay stations for future cyber attacks.

Last week at a timely cyber security conference in The Netherlands, American wunderkind Reuben Paul, just 11, stunned an audience of security experts by hacking into a teddy bear via bluetooth to show how interconnected smart toys “can be weaponised”.

His prowess showed just how easy it is for tech savvy individuals to use everyday objects to harvest data or use them as spy holes for covert surveillance.

According to documents released in March by Wikileaks, US intelligence can hack smartphones, computers and smart, web-connected TVs, to pilot them and eavesdrop.

“All the other connected objects can be pirated, that has been shown, be it a coffee machine, a refrigerator, a thermostat, electronic entry systems, the lighting system…,” warns Loic Guezo, a cyber security analyst for southern Europe with Japanese security software company Trend Micro.

Mikko Hypponen, head of research at Finnish security specialists F-Secure, has for his part come up with his eponymous Hypponen’s Law.

This states that “once a device is described as ‘intelligent’, you can consider it as vulnerable.”

Neglected security

The future might well spell connected cars – but they too are subject to potential remote hacking, the consequences of which barely need stating.

When hackers lurking with their laptops have finished conjuring what havoc they might wreak on distant roads there are plenty of other things to which they could turn their attention.

These include vases which tell you when they need fresh water, insulin pumps – or how about sex toys?

So, the worried tech consumer may be asking him or herself – can a cyber hacker deprive me of my morning slug of caffeine?

Or maybe keep my thermostat blocked at 10 Celsius – a chilling thought – or even take over my GPS if I don’t hand over a ransom?

Theoretically, yes, specialists tell AFP.

“The logic of a cybercriminal is to make money,” says Wavestone’s Billois. Such an individual will not feel the need to make do with small-scale attacks.

Connected TVs, having rapidly become widespread, are an ideal portal for making ransom demands.

“Tomorrow, one can imagine devices which attack your connected house, bringing it under control, and then you get sent a message by another channel,” muses Guezo.

All that would required would be to perfect the sort of virus one can find on offer within the murky confines of the “darknet”, off the beaten track for day to day netizens.

Cyber security specialists are very much aware of the need to keep working on solutions offering protection as more and more homes go “smart” and “connected” with various boxes as add-ons to their usual routers.

The specialists’ plan is to work with the makers of connected goods in order to incorporate a security interface right from the start, thereby offering what the profession calls “security by design”.

Some experts feel that, in the rush to bring fascinating and cutting edge technologies into the home, the need for commensurate security has been rather left behind.

“It is extremely difficult to calculate the solidity of a connected object in terms of cybersecurity,” Billois regrets.

“As a consumer it is today impossible to know if you are buying a secure connected object or not,” he adds.

“There’s no label such as a made in Europe kind of tag guaranteeing an object won’t catch fire, or won’t pose a risk to children.”

Fin24Tech

Critical flaw in Twitter’s code could let hackers take over your account

/in ,

A security researcher discovered a critical vulnerability in the advertising code of Twitter, the most popular micro-blogging website in the world, which if exploited could let hackers publish updates from any other account without needing access to the victim’s profile.

The white-hat hacker, writing in a blog post this week (22 May), claimed to have uncovered the issue while exploring Twitter’s code for bugs. He said the flaw could give cybercriminals the ability to “publish entries in Twitter-network by any user of this service.”

The vulnerability was initially found on 26 February 2017 and fixed two days later.

The hacker, known as kedrisch, reported the flaw via Twitter’s bug bounty service – a programme managed by the organisation HackerOne which lets researchers disclose bugs in exchange for rewards.

In this instance, kedrisch was handed a bounty of $7,560 (₦2,872,800) for his efforts.

The issue he found was in Twitter’s advertising code. Essentially, the researcher said flaws existed in how the service’s media library uploaded files such as videos, images and gifs to the platform.

Rules surrounding the responsible disclosure programme mean the flaw is only coming to light now.

In a statement, Twitter said: “The reporter discovered a flaw in the handling of Twitter Ads Studio requests which allowed an attacker to tweet as any user.

“By sharing media with a victim user and then modifying the post request with the victim’s account ID the media in question would be posted from the victim’s account. This bug was patched […] and no evidence was found of the flaw being exploited by anyone other than the reporter.”

Charlie Miller, a security expert well-known for being part of the collective which remotely hacked a 2014 Jeep Cherokee, tweeted: “As former appsec [Application Security] tech lead for Twitter, I’ll just say I’m not shocked this was in code from the ads team.” He did not elaborate further.

 Last December, kedrisch was awarded $1,120 (₦425,600) for finding a less critical flaw which could let a hacker change comments on Twitter’s official forums. This was publicly disclosed on 12 May 2017.
Most recently, Twitter issued a warning to users of its Vine service that a bug potentially exposed users’ email addresses and phone numbers to unnamed third parties. In an email sent to all impacted Vine users, it said the bug affected the Vine Archive for “less than 24 hours”.
Vine was bought by Twitter back in 2012 however the company decided to shut down the popular short video publishing application earlier this year amid a period of heavy job cuts.

“We want to emphasise that this information can’t directly be used to access your account, and we have no information indicating that it has been misused,” Twitter’s email to Vine users stressed. “We take these incidents very seriously, and we’re sorry this occurred,” it added.

IBTimes