Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Alert

NEWS - December 18, 2014

Dec 18, 2014 1:27AM PST
Sony cancels parody film as NKorea suspected over hack

Sony Pictures cancelled the release of a madcap comedy about North Korea that triggered chilling threats from hackers, as US investigators reportedly blamed Pyongyang for a damaging cyber-raid on the movie giant.

The Hollywood studio announced the move after US theater chains said they would not screen "The Interview," about a fictional plot to assassinate North Korean dictator Kim Jong-Un.

The dramatic action came as several US media outlets reported that investigators now believe North Korea was behind the devastating cyber-attack that saw hackers gain access to a trove of internal Sony documents and unreleased movies.

Continued : https://news.yahoo.com/sony-cancels-dec-25-release-nkorea-parody-film-221105289.html

Related:
Sony pulls 'The Interview' after 9/11 terror threat
Sony cancels 'The Interview' amid terror hack threats
Hackers rejoice: Sony pulls Korea film, bows to criminal pressure

Discussion is locked

- Collapse -
Mobile spyware makers are on shaky ground as the law ..
Dec 18, 2014 2:56AM PST
.. begins to catch up with them

Symantec Security Response blog:

Mobile spyware authors market their products as legitimate, but the software's secretive nature give stalkers, thieves, and abusive partners the means to spy on their victims' every move.

The CEO of a company that created the StealthGenie mobile spying app recently pleaded guilty for advertising and selling spyware. The US Department of Justice ordered Hammad Akbar to pay a US$500,000 fine and to hand over the spyware's source code. It's a significant result, as it marks the first ever criminal conviction surrounding the sale of a mobile spyware app.

"... While the shutdown of StealthGenie is a great move for mobile privacy, it's not the only mobile spying software on the market. Spyware such as mSpy (Android.Mobilespy) and Flexispy (Android.Flexispy) allows people with minimal technical skills to compromise their target's mobile devices and observe all of their communications and online activity. "

Continued: http://www.symantec.com/connect/blogs/mobile-spyware-makers-are-shaky-ground-law-begins-catch-them
- Collapse -
Ars Technica was hacked. Readers advised to change passwords
Dec 18, 2014 2:56AM PST

Technology news website Ars Technica has admitted that it suffered a hack attack on Tuesday.

The hack was apparently prefaced by a defacement of Ars Technica's front page, before the hacker returned a day or so later and managed to access a user database.

As a result, registered users of Ars Technica may now have had their email addresses exposed as well as hashed and salted passwords.

Tonight users who had registered on the site began to receive email notifications from the site, advising them that it would be sensible in an "excess of caution" to ensure that they are not using the same password on any other websites. [Screenshot: Copy of Email]

Continued : http://grahamcluley.com/2014/12/ars-technica-hacked-readers-advised-change-passwords/

Related : Ars Technica readers urged to change passwords in wake of hack
Prior post: Ars Technica is the latest site to fall victim to hack

- Collapse -
Complex Solutions to a Simple Problem
Dec 18, 2014 2:56AM PST

My inbox has been flooded of late with pitches for new technologies aimed at making credit cards safer and more secure. Many of these solutions are exceedingly complex and overwrought — if well-intentioned — responses to a problem that we already know how to solve. Here's a look at a few of the more elaborate approaches.

Some of these ideas may have benefited from additional research into where financial institutions actually experience most of their fraud losses. Hint: Lost-and-stolen fraud is minuscule compared to losses from other types of fraud, such as counterfeit cards and online fraud. Case in point: A new product called Safe Swipe. From their pitch:

"The basic premise of our solution, Safe Swipe...is a technology which 'marries' your smart mobile device, phone, tablet and or computer to your credit/debit card(s). We've developed a Geo-Locator software program which triangulates your location with the POS device and your mobile phone so that if your phone and credit card are not within a certain predetermined range of one another the purchase would be challenged. In addition, we incorporated an ON/OFF type switch where you can 'Lock Down' your credit/debit card from your mobile device making it useless should it ever be stolen."

Continued: http://krebsonsecurity.com/2014/12/complex-solutions-to-a-simple-problem/

- Collapse -
Don't Let the Grinch Steal Christmas
Dec 18, 2014 3:07AM PST

The Alert Logic blog:

Since we are in the thick of the holiday season, we are analyzing which operating systems support the needs of e-commerce and brick and mortar retail shops. Due to the lower cost of ownership and efficiencies such as a non-resource heavy operating system that allow for applications to run more smoothly, we found that Linux is dominating when it comes to e-commerce site deployment.

According to a 2013 report from W3Tech, approximately 65% of all web servers on the Internet utilize a Unix/Linux based operating system. We uncovered a bug that impacts all Linux platforms, including mobile devices, and we're calling it "grinch." Fortunately, there are ways to detect the exploit of this bug in your environment until a patch is released.

Continued : https://www.alertlogic.com/blog/dont-let-grinch-steal-christmas/

- Collapse -
Linux "Grinch" Vulnerability: Separating Fact From FUD
Dec 18, 2014 3:27AM PST

Recently, a security firm reported what they claimed to be a flaw with a major impact on organizations running Linux. (And apparently since all the rage these days is to give bugs code names, they pre-seeded the market with this timely one: "grinch").

Linux software bugs have been huge this year, leaving administrators reeling to patch themselves from Shellshock, Heartbleed, POODLE, etc. With claims that this vulnerability could have an impact similar to Shellshock, I really wanted to dive into what the "grinch" bug means in order to separate the fact from the FUD.

Continued : http://blog.threatstack.com/the-linux-grinch-vulnerability-separating-the-fact-from-the-fud

- Collapse -
Certified pre-pw0ned Android Smartphones: Coolpad Firmware
Dec 18, 2014 3:07AM PST
.. Backdoor

SANS Internet Storm Center (ISC):

Researchers at Palo Alto found that many ROM images used for Android smart phones manufactured by Coolpad contain a backdoor, giving an attacker full control of the device. Palo Alto named the backdoor "Coolreaper".

With Android, it is very common for manufacturers to install additional applications. But these applications are installed on top of the Android operating system. In this case, Coolpad integrated additional functionality into the firmware of the device. This backdoor was then used by Coolpad to push advertisements to its users and to install additional Android applications. But its functionality goes way beyond simple advertisements.

The backdoor provides full access to the device. It allows the installation of additional software, accessing any information about the device, and even notifying the user of fake over the air updates.

Continued : https://isc.sans.edu/forums/diary/Certified+pre-pw0ned+Android+Smartphones+Coolpad+Firmware+Backdoor/19075
- Collapse -
Manufacturer's Backdoor Found on Popular Chinese Android..
Dec 18, 2014 5:33AM PST
.. Smartphone

A popular Android smartphone sold primarily in China and Taiwan but also available worldwide, contains a backdoor from the manufacturer that is being used to push pop-up advertisements and install apps without users' consent.

... For now it appears the manufacturer's motivation is revenue generation, given that most users who complained about suspicious behavior in Coolpad user forums expressed concerns about pop-ups and unwanted ads.

... With plans to expand distribution into the United States, Europe and Southeast Asia, the disclosure of CoolReaper, there is the potential for widespread abuse.

... "We've never seen something with this much capability [from a manufacturer]," Olson said, pointing out that CoolReaper even exceeds Carrier IQ's software that was found to be recording keystrokes in addition to gathering device and usage information. "This is way more than logging keystrokes. It is installing apps without consent and aggressively hiding from the OS and antivirus programs on the phone."

Continued : http://threatpost.com/manufacturers-backdoor-found-on-popular-chinese-android-smartphone/109929
- Collapse -
ICANN data compromised in spearphishing attack
Dec 18, 2014 5:34AM PST

A so-called spearphishing attack on ICANN has compromised the email credentials of several ICANN staff members and allowed the attacker access to user information, including email and postal addresses.

The targeted phishing attack also allowed the attacker to gain access to all files in ICANN's Centralized Zone Data System (CZDS), a centralized point for interested people to request access to so-called zone files provided by participating top level domains. ICANN gave notice of the breach Tuesday, though the CZDS aspect of the compromise was discovered earlier this month.

Continued : http://news.techworld.com/security/3591434/icann-data-compromised-in-spearphishing-attack/

Related:
Spear phishing attack led to ICANN compromise
ICANN systems breached via spear-phishing emails
Attackers Compromise ICANN, Access Zone Files System
'Spear phished': Hackers attack internet overlord ICANN

- Collapse -
Sony emails show a studio ripe for hacking
Dec 18, 2014 5:34AM PST

In the weeks before hackers broke into Sony Pictures Entertainment, the studio suffered significant technology outages it blamed on software flaws and incompetent technical staffers who weren't paying attention, even as hackers targeted executives to trick them into revealing their online credentials.

Its chief executive was regularly reminded in unsecure emails of his own secret passwords for his and his family's mail, banking, travel and shopping accounts, according to a review of more than 32,000 stolen corporate emails circulating on the Internet.

Scrutiny of Sony's stolen computer data hasn't yet revealed exactly how hackers managed to slip inside to steal such an enormous cache, when it happened, who was behind the theft or their motives.

But late Wednesday, a U.S. official told The Associated Press that federal investigators have now connected the Sony hack to North Korea. The official was not authorized to discuss an ongoing criminal case openly, and spoke on condition of anonymity.

Continued : http://www.apnewsarchive.com/2014/Sony-emails-reveal-loose-use-of-passwords-and-IDs-ripe-for-hacking/id-041c9dc46e9d408fa569ccac15c0ffe0

Related : Sloppy security hygiene made Sony Pictures ripe for hacking

- Collapse -
"USBdriveby" Emulates Mouse and Keyboard to Hijack Computers
Dec 18, 2014 5:34AM PST

A $20 USB microcontroller that someone can wear around their neck can be used to weaponize mouse clicks and keyboard actions in an effort to install backdoors, evade firewalls and modify DNS settings in a matter of seconds, a researcher has demonstrated.

Security researcher Samy Kamkar has taken a Teensy 3.1 USB-based microcontroller and fitted it with software that can emulate a mouse and a keyboard when connected to a computer. The gadget, dubbed USBdriveby, leverages the fact that many systems blindly trust USB devices connected to them.

Once it's plugged in to a machine, USBdriveby immediately starts performing mouse and keyboard actions, which allows it to carry out a wide range of tasks, such as opening a backdoor, disabling the firewall, and controlling traffic flow by changing DNS settings. After the device is disconnected, the attacker has full access to the targeted computer.

Continued: http://www.securityweek.com/usbdriveby-emulates-mouse-and-keyboard-hijack-computers