Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Alert

NEWS - October 15, 2014

Oct 15, 2014 12:34AM PDT
The secure smartphone that won't get you beaten with rubber hoses

"A new take on the secure smartphone, with a secure messaging app to go with it."

Interest in secure communications is at an all time high, with many concerned about spying by both governments and corporations. This concern has stimulated developments such as the Blackphone, a custom-designed handset running a forked version of Android that's built with security in mind.

But the Blackphone has a problem. The mere fact of holding one in your hand advertises to the world that you're using a Blackphone. That might not be a big problem for people who can safely be assumed to have access to sensitive information—politicians, security contractors, say—but if you're a journalist investigating your own corrupt government or a dissident fearful of arrest, the Blackphone is a really bad idea. Using such a phone is advertising that you have sensitive material that you're trying to keep secret and is an invitation to break out the rubber hoses.

That's what led a team of security researchers to develop DarkMatter, unveiled today at the Hack In The Box security conference in Kuala Lumpur. DarkMatter is a secure Android fork, but unlike Blackphone and its custom hardware, DarkMatter is a secure Android that runs on regular Android phones (including the Galaxy S4 and Nexus 5) and which, at first glance, looks just like it's stock Android.

Continued : http://arstechnica.com/security/2014/10/the-secure-smartphone-that-wont-get-you-beaten-with-rubber-hoses/

Discussion is locked

- Collapse -
New POODLE SSL 3.0 Attack Exploits Protocol Fallback Issue
Oct 15, 2014 12:39AM PDT

A new attack on the SSLv3 protocol, disclosed Tuesday, takes advantage of an issue with the protocol that enables a network attacker to recover the plaintext communications of a victim. The attack is considered easier to exploit than similar previous attacks against SSL/TLS, such as BEAST and CRIME, and can enable an attacker to retrieve a supposedly secure cookie for a given site.

The attack is known as POODLE and was developed by several researchers at Google, including Thai Duong, who was part of the duo who developed the BEAST and CRIME attacks several years ago. The technique takes advantage of the fact that when a secure connection attempt fails, servers will fall back to older protocols, such as SSLv3, in an attempt to communicate securely with the remote client. An attacker who can trigger a connection failure can then force the use of SSLv3 and attempt the new attack.

Continued: http://threatpost.com/new-poodle-ssl-3-0-attack-exploits-protocol-fallback-issue/108844

Related:
POODLE vulnerability: The end of life of SSL 3.0
SSL broken, again, in POODLE attack
There Is a New Security Vulnerability Named POODLE, and It Is Not Cute
Security experts warn of 'POODLE' attack against SSL 3.0

- Collapse -
Kaspersky warns of Android game, not realising it is ..
Oct 15, 2014 12:39AM PDT
.. another security firm's proof-of-concept

At the end of last week, researchers at Kaspersky Lab announced to the media that they had identified a new trojan targeting Android smartphones, disguised as a Tic Tac Toe (also known as "Noughts and crosses") game.

According to the Russian security firm, the Gomal Trojan hid behind the disguise of a seemingly harmless game to steal information from home and corporate users: [...]

Sounds nasty, right?

Perhaps, like me, you would be interested in hearing who created this particular spyware game.

Well, hold onto your seats - because I can reveal that the creators are none other than... an anti-virus company!

Continued : http://grahamcluley.com/2014/10/android-tic-tac-toe/
- Collapse -
Malicious YouTube ads lead to exploits, ransomware
Oct 15, 2014 12:49AM PDT

In the last few months, Trend Micro researchers have been following a malvertising campaign that ended up affecting almost exclusively US users at the beat of more than 113,000 per month.

In the latest stage of the campaign, the criminals behind this campaign have concentrated their efforts on Youtube visitors, and have succeeded in making the ads appear on extremely popular videos.

"The ads we've observed do not directly lead to malicious sites from YouTube. Instead, the traffic passes through two advertising sites, suggesting that the cybercriminals behind this campaign bought their traffic from legitimate ad providers," the researchers noted.

Continued: http://www.net-security.org/malware_news.php?id=2883