SurvivalRing

Rich Fleetwood on Survival & Preparedness - Founded/Established 1997

Personal Cybersecurity #46: Weekly news

What you need to know for your personal cyber security life…

Number forty-six in a series of semi-regular daily current and topical computer threats that may affect your online, or even offline, digital and real life. Why cyber-security on SurvivalRing? Because everything you do in your life, everyday, is a part of the cyber world…even your offline plans. So, be aware, and pay attention. The bad guys WILL eventually get around to YOU…personally…so be prepared for it, by staying in the informational loop.

And, just so you know, I’ve got 32 years of IT experience, and my day job is with the State of Wyoming as an Information Specialist. I believe an informed prepper is a BETTER prepper. Information is the life blood of being prepared. Learn more with every article in this continuing series. Please ask questions if you want to learn more…I’m here to help.

evil inside

# # #

HEADLINES…for this issue…21 articles

  1. Cash, IT security threaten NASA Deep Space Network operation
  2. ‘Red Team’ exposing Army technology vulnerabilities
  3. Survey: 75% of firms would take hours or longer to spot breach
  4. Where the Military’s Smartest Hackers Aren’t Human at All
  5. Tasmanian Audit Office reveals ‘excessive’ online attack risks
  6. GitHub ordered to hand over access logs to Uber
  7. FBI Threat Intelligence Cyber-Analysts Still Marginalized In Agency
  8. Former Tesla Intern Releases $60 Full Open Source Car Hacking Kit For The Masses
  9. A million hacks a day, but Israel’s electric grid survives
  10. The marriage between DevOps & SecOps
  11. Stealing Data From Computers Using Heat
  12. U.S. did carry out cyber operations in response to N.K.’s hack on Sony: report
  13. Key Takeaways From the Premera Data Breach
  14. Role of Ethical Hacking Stressed
  15. GoDaddy accounts vulnerable to social engineering and Photoshop
  16. Chicago woman to plead guilty in ID theft case
  17. Target poised to settle breach for $10 million
  18. Premera Blue Cross hack exposes 11M
  19. The new MacBook’s single port comes with a major security risk
  20. China Reveals Its Cyberwar Secrets
  21. N. Korea behind nuke power plant data leakage: investigators

 

# # #

Cash, IT security threaten NASA Deep Space Network operation

http://www.networkworld.com/article/2902506/security0/cash-it-security-threaten-nasa-deep-space-network-operation.html

  • By Michael Cooney
  • Layer 8
  • Network World
  • March 26, 2015

Money needed for upgrades to older equipment and IT security issues continue to drag on NASA, according to a report issued this week by the space agency’s Office of Inspector General.

The report focuses on NASA’s Deep Space Network, which through variety of antennas and transmitters at communications complexes in three locations: Goldstone, California; Madrid, Spain; and Canberra, Australia provides space missions with the tracking, telemetry, and command services required to control and maintain spacecraft and transmit science data. NASA’s international partners also use the Deep Space Net.

From the OIG report: “Much of DSN’s hardware is more than 30 years old, costly to maintain, and requires modernization and expansion to ensure continued service for existing and planned missions. Although DSN is meeting its current operational commitments, budget reductions have challenged the Network’s ability to maintain these performance levels and threaten its future reliability. Specifically, in FY 2009 the Network implemented a plan to achieve $226.9 million in savings over 10 years and use most of that savings to build new antennas and transmitters. However, in FY 2013 the NASA’s Space Communications and Navigation (SCaN) Program cut the Network’s budget by $101.3 million, causing DSN to delay upgrades, close antennas, and cancel or re-plan tasks.

[…]

# # #

‘Red Team’ exposing Army technology vulnerabilities

http://www.army.mil/article/145106/_Red_Team__exposing_Army_technology_vulnerabilities/

  • By David Vergun
  • Army.mil
  • March 24, 2015

SPRINGFIELD, Va. (March 24, 2015) — Operations, a few years ago in Afghanistan, were a wake-up call to the Army’s force-protection vulnerabilities, said Mary J. Miller, deputy assistant secretary of the Army for research and technology.

Two small outposts, Camps Keating and Wanat, were nearly overrun, she said, speaking at a National Defense Industrial Association-sponsored Army Science and Technology seminar here, March 24.

Although the Army placed a lot of capabilities in those outposts, there were “collections of pieces that didn’t integrate well together and the enemy watching,” she said. “They found and exploited those seams” in methods and technologies.

That wake-up call was heard by the Army’s nearly 12,000 scientists and engineers, some of whom were tasked to ensure something like that would never happen again, she said.

Therein was born the Deployable Force Protection Adapter Red Team, or just Red Team for short.

“Red Team must be a really fun place to work because they get to break all the rules,” she said. “They take on the persona of the adaptive enemy. We give them a lot of latitude – as much as the lawyers would allow.”

They are instructed to think and act like the enemy and, they can even go outside the rules of engagement in gaming vulnerabilities, she said.

Red Team took the mission and ran with it, devising “non-conventional ways of coming at our technology and exploiting ‘black hat’ capabilities,” she said. It was no-holds barred.

They exposed weaknesses in the armor, illustrating that “we as scientists and engineers think we have a great solution and ha-ha moments, thinking Soldiers will love this” new piece of gear. Then the Red Team would show up and show all the weaknesses, she said, so “we started solving those problems.”

From that point on, anything deployed to small forward operating outposts of 300 people or less gets a Red Team going over from “the construct of the operational perspective, technology perspective, and how we could integrate it in such a way not to create inherent vulnerabilities. It’s been very effective.”

The Red Team approach was so successful, she said, that they began gaming vulnerabilities in systems very early in the materiel development lifecycle, she said.

[…]

# # #

Survey: 75% of firms would take hours or longer to spot breach

http://www.csoonline.com/article/2902252/data-breach/survey-75-of-firms-would-take-hours-or-longer-to-spot-breach.html

  • By Maria Korolov
  • CSO
  • March 26, 2015

Although 68 percent of companies said they are prepared for a breach, 75 percent estimated it would take hours, days, or weeks for them to notice that one had occurred, according to a new survey released this morning.

Osterman Research conducted interviews with 225 mid-sized and large organizations on behalf of Sunnyvale, Calif.-based security vendor Proofpoint, Inc. to assess attitudes and processes around data breaches and data loss prevention.

Only 6 percent of respondents said they were “very well prepared” to deal with data breaches, 27 percent said they were “well prepared,” and 35 percent said they were “prepared.” Another 18 percent said they were “somewhat prepared” and the remaining 14 percent were either not well prepared, poorly prepared, or not prepared at all.

However, only 4 percent of respondents said they could detect a potential breach within seconds, and 20 percent said it would take them several minutes.

[…]

# # #

Where the Military’s Smartest Hackers Aren’t Human at All

http://www.defenseone.com/technology/2015/03/where-militarys-smartest-hackers-arent-human-all/108562/

  • BY ALIYA STERNSTEIN
  • NEXTGOV
  • MARCH 26, 2015

Next month, unmanned computers all over the globe will face off in a dress rehearsal for a Las Vegas hacking tournament run by the U.S. military.

The $2 million “Cyber Grand Challenge” pits hacker-fighting software against malicious code programmed by Pentagon personnel. During the 2016 finals in Vegas, the humans who built these cyberbots might as well go play blackjack.

At stake in the cyber challenge is a chunk of change and perhaps societal gratitude. That’s because the research and development gleaned during the two-year competition could lay the groundwork for a world where machines are in charge of cybersecurity.

At least, that’s the hope of many of the contestants and the Defense Advanced Research Projects Agency, the Pentagon component leading the program.

[…]

# # #

Tasmanian Audit Office reveals ‘excessive’ online attack risks

http://www.zdnet.com/article/tasmanian-audit-office-reveals-excessive-online-attack-risks/

  • By Leon Spencer
  • Security
  • ZDNet News
  • March 27, 2015

A report from the Tasmanian Audit Office released on Thursday has revealed that at least five state government departments were open to excessive risk from online attacks.

The Tasmanian auditor-general’s report (PDF) No. 8 of 2014-15, Security of information and communications technology (ICT) infrastructure, outlines a number of weaknesses in the audited departments’ digital security.

The audit was conducted on five of the state government’s departments, including Treasury; the Department of Primary Industries, Parks, Water and the Environment; the Department of Health and Human Services; the Department of Premier and Cabinet; and the Department of Police and Emergency Management.

The Audit Office found that although information was generally safe and secure with reasonable backup and access restrictions, all of the audited departments were at excessive risk from online attacks, due to a lack of Australian Signals Directorate-recommended mitigation strategies.

[…]

# # #

GitHub ordered to hand over access logs to Uber

http://www.theregister.co.uk/2015/03/25/github_ordered_to_hand_over_user_data_to_uber/

  • By Kieren McCarthy
  • The Register
  • 25 Mar 2015

GitHub has been ordered to hand over records on some of its users to taxi-booking app Uber after unsuccessfully challenging a subpoena.

Last month, Uber announced its driver database had been hacked in May 2014, but it had only noticed in September of that year. Uber discovered that a supposedly secret database access key had somehow ended up in a couple of Gists in a public area of GitHub. It’s alleged this key was spotted by miscreants who used the key to delve into Uber’s internal database of driver names and license plates.

Uber asked GitHub to hand over the web access logs for the two Gist pages for the May-September period.

GitHub refused, and so on 27 February this year, Uber created a John Doe lawsuit in order to subpoena GitHub to hand over the logs. Earlier this month, GitHub challenged the subpoena in a San Francisco court but lost, with the judge late last week giving GitHub 30 days to comply.

[…]

# # #

FBI Threat Intelligence Cyber-Analysts Still Marginalized In Agency

http://www.darkreading.com/risk/fbi-threat-intelligence-cyber-analysts-still-marginalized-in-agency/d/d-id/1319618

  • By Sara Peters
  • Dark Reading
  • 3/25/2015

Despite good progress, 9/11 Review Commission says that analysts could have a greater impact on FBI counter-terrorism activities if they had more domain awareness, forensics capabilities, and were more empowered to question agents.

FBI threat intelligence analysts, a position created post-9/11, have proven their worth to counter-terror operations, but their impact has been limited by a lack of domain awareness, insufficient computing technology, and a lack of status within the Bureau, according to a report released today by the FBI 9/11 Review Commission. While the analysts are providing agents with tactical input, they are not yet participating in any strategic way.

Part of the intelligence analysts’ job description, as described by FBIAgentEdu.org, is cyber-forensics and cyber-surveillance — investigating computer evidence at crime scenes, retrieving information secured on info systems, and using linguistic and decryption technologies to decipher high-priority intel.

The Commission credits the Bureau with making a lot of progress to this point. Ten years ago, the FBI changed its focus, “re-aligned its intelligence and law enforcement missions and re-invented itself into a threat-based organization.” This includes threats to critical infrastructure — both physical and logical components, and the control systems that combine the two.

[…]

# # #

Former Tesla Intern Releases $60 Full Open Source Car Hacking Kit For The Masses

http://www.forbes.com/sites/thomasbrewster/2015/03/25/hack-a-car-for-60-dollars/

  • By Thomas Fox-Brewster
  • Forbes Staff
  • 3/25/15

Eric Evenchick knows what it’s like to be at the mercy of modes of transport. That might be why the former Tesla intern is so keen to hack his way to gaining greater control over the vehicles he travels in. When we speak over encrypted call app RedPhone, he’s stuck in Hong Kong airport waiting for a delayed flight to Singapore, where he’ll announce the open sourcing of the CANard tool during the BlackHat Asia conference.

His code will make it cheaper and easier than ever before for tinkerers to get to the innards of their connected cars to determine if there are any useful tweaks they can make, or any worrisome security vulnerabilities that more malicious hackers could exploit. Evenchick is hopeful CANard, based on the widely-used and much-loved Python language, will have a greater impact on the car industry in general. It should allow security researchers of all ilks to easily probe cars for weaknesses, which, Evenchick hopes, will get them to take vehicle hacking more seriously.

His own tinkering with the code has turned CANard into a more powerful tool in recent weeks. In particular, it now has the ability to carry out proper diagnostics over the Controller Area Network (CAN), the network-on-wheels found in almost all modern automobiles to send data around the vehicle, he tells FORBES. This means anyone who knows or learns Python (it’s a good language for newcomers to coding) can start to probe what functions can be accessed using their computer, whether they run an Apple AAPL -2.61% Mac, Microsoft MSFT -3.36% Windows or Linux PC.

They’ll also need to buy some associated hardware to connect laptops to the diagnostics, or OBD2, port, which Evenchick has also produced. He’ll be shipping CANtact, a CAN to USB interface for the low, low price of $59.95 (USB and OBD2 cable not included). There will only be 100 available in the first batch, but the hardware is open source too, meaning it’s easily replicable and even cheaper for those with the right skills.

[…]

# # #

A million hacks a day, but Israel’s electric grid survives

http://www.timesofisrael.com/a-million-hacks-a-day-but-israels-electric-grid-survives/

  • By David Shamah
  • Times of Israel
  • March 24, 2015

That Israel is a favorite target of hackers is common knowledge – but the sheer number and sophisticated level of those attacks is not as well known, according to the Israel Electric Corporation.

On the eve of the annual CyberTech conference in Tel Aviv Monday, IEC chairman Yiftah Ron-Tal said that during last summer’s Operation Protective Edge, the company’s servers and infrastructure were attacked nearly a million times – a day.

“If we compare the number of cyber-attacks in the war to the relative number of missiles fired by Hamas, Israel’s electric grid was hit by two ‘cyber-missiles’ a day throughout 2013. In 2014, that would have been 15 a day,” said Ron-Tal, adding that, with all due respect to a missile that could destroy a single target, a “direct hit” on the electrical grid would have brought the entire country to its knees.

Preventing those kinds of attacks is a major motivator for Israel to develop the world’s best cyber-security technology, said Dr. Eviatar Matania, chairman of Israel’s National Cyber Bureau.

[…]

# # #

The marriage between DevOps & SecOps

http://www.idgconnect.com/blog-abstract/9656/the-marriage-devops-secops

  • By IDG Connect
  • March 24 2015

This is a contributed article by Tim Prendergast, Founder & CEO of Evident.io

The rise of cloud computing brings many exciting changes to the technology industry: elastic scalability of resources, commodity pricing, freedom to experiment, and a newfound love for agile philosophies. Thankfully, the cloud is leaving behind the constraints and practices of the legacy security industry. Here lies an exciting opportunity: with the rise of DevSecOps, we get to truly redefine how operations, engineering, and security can be brought together in harmony to achieve unparalleled success.

In the past, organizations kept the domains of engineering, operations, and security separate for scalability and accountability reasons. Preventing engineering and operations from intermixing guaranteed that production environments were held to a higher standard of reliability, resiliency and consistency than that of engineering environments like those used for development and testing.

However, in the last few years, the evolution of DevOps philosophies has really taken the industry by storm. DevOps is not exactly new — it’s arguably a manifestation of the scientific method in our field (computer science): observe, hypothesize, predict, and experiment (test). This maps neatly to the Learn, Build, Measure principles from the Lean Startup: a DevOps Bible. It’s easy to see how structured, proven methods for improving things, like technology, can propel a business forward. These methods are an improvement compared with legacy practices that often included gut feelings, flawed data samples, and other such inaccurate methodologies.

DevOps pays big dividends for progressive organizations. Rapid delivery of infrastructure, code, and data has enabled a cornucopia of startups to flourish by capitalizing on customer feedback 100 times faster than incumbent players. Deep telemetry of systems, user experiences, and behaviors has helped organizations better serve their customers and predict their growing needs. Transparency around challenges has endeared customers to many disrupters, as they build a level of trust and understanding that is hard to capture via other means.

[…]

# # #

Stealing Data From Computers Using Heat

http://www.wired.com/2015/03/stealing-data-computers-using-heat/

  • By Kim Zetter
  • Security
  • Wired.com
  • 03.23.15

AIR-GAPPED SYSTEMS, WHICH are isolated from the Internet and are not connected to other systems that are connected to the Internet, are used in situations that demand high security because they make siphoning data from them difficult.

Air-gapped systems are used in classified military networks, the payment networks that process credit and debit card transactions for retailers, and in industrial control systems that operate critical infrastructure. Even journalists use them to prevent intruders from remotely accessing sensitive data. To siphon data from an air-gapped system generally requires physical access to the machine, using removable media like a USB flash drive or a firewire cable to connect the air-gapped system directly to another computer.

But security researchers at Ben Gurion University in Israel have found a way to retrieve data from an air-gapped computer using only heat emissions and a computer’s built-in thermal sensors. The method would allow attackers to surreptitiously siphon passwords or security keys from a protected system and transmit the data to an internet-connected system that’s in close proximity and that the attackers control. They could also use the internet-connected system to send malicious commands to the air-gapped system using the same heat and sensor technique.

In a video demonstration produced by the researchers, they show how they were able to send a command from one computer to an adjacent air-gapped machine to re-position a missile-launch toy the air-gapped system controlled.

[…]

# # #

U.S. did carry out cyber operations in response to N.K.’s hack on Sony: report

http://english.yonhapnews.co.kr/full/2015/03/25/26/1200000000AEN20150325000200315F.html

  • Yonhap News Agency
  • 2015/03/25

WASHINGTON, March 24 (Yonhap) — The United States did carry out limited cyber-operations against North Korea in response to the communist nation’s alleged hacking attack on Sony Pictures, but the operations did not cause the North’s Internet outage, a report said Tuesday.

North Korea’s Internet connections suffered outages for days in late December after U.S. President Barack Obama blamed the communist nation for the massive hack on Sony and promised a “proportional response.”

But the U.S. has since neither confirmed nor denied its role in the North’s Internet outages.

The issue re-emerged last week as Rep. Michael McCaul (R-TX), chairman of the House Homeland Security Committee, told a cyber-security event in Washington that the North’s Internet outage was retaliation for the Sony hack.

The lawmaker was quoted as saying, “There were some cyber responses to North Korea.”

[…]

# # #

Key Takeaways From the Premera Data Breach

http://healthitsecurity.com/2015/03/23/key-takeaways-from-the-premera-data-breach/

  • By Elizabeth Snell
  • Health IT Security
  • March 23, 2015

Last week, the Premera data breach announcement further pushed the data security of healthcare organizations into the limelight. The health insurer stated that approximately 11 million members’ sensitive information, including PHI, was potentially exposed after a “sophisticated cyber attack” infiltrated its system.

Premera Blue Cross, Premera Blue Cross Blue Shield of Alaska, and the health insurer’s affiliate brands Vivacity and Connexion Insurance Solutions, Inc. are all potentially affected, with applicants’ and members’ names, dates of birth, email addresses, addresses, telephone numbers, Social Security numbers put at risk. Moreover, member identification numbers, bank account information, and claims information, including clinical information, were all potentially exposed.

ncidents like this are likely to cause healthcare leaders to review their incident response procedures, according to Dan Bowden, Chief Information Security Officer for the University of Utah, University of Utah Health System. Many organizations are already working on their malware defense capabilities, Bowden said, but the two large scale breaches over the last couple of months further underline the importance of incident response.

“There is no absolute to tell your consumers that there is no possible way their data will not get breached,” Bowden said. “We have people come to work every day trying to do the right thing and people make mistakes.”

For example, an employee could open an email that lets malware into the healthcare’s system.

[…]

# # #

Role of Ethical Hacking Stressed

http://www.newindianexpress.com/cities/thiruvananthapuram/Role-of-Ethical-Hacking-Stressed/2015/03/20/article2721810.ece

  • By Express News Service
  • 20th March 2015

THIRUVANANTHAPURAM: Underlining the importance of cyber security in the coming days, A S Kiran Kumar, chairman, Indian Space Research Organisation (ISRO), said here on Thursday that ethical hacking should be integrated to every organisation’s information system to counter security threats.

Kiran Kumar was speaking after inaugurating a two-day seminar on ‘Computers and Information Technology (ISCIT-2015)’ organised by ISRO at the Vikram Sarabhai Space Centre (VSSC). While embracing latest technologies, the importance of cyber security increases manifold. The integration of ethical hacking into the system is essential to proactively counter security threats in the increasingly unsafe cyber world, he said.

Guiding fishermen to better fishing grounds or issuing instructions to orbiting spacecraft, computers powered by the latest IT tools have proved to be the backbone of space research and application across the globe, Kiran Kumar said. Adopting latest technologies is the key to success. Sharing computing services through cloud computing and enhancing performance by quantum computing will get more thrust in the coming days, he said.

Delivering the keynote address, R Narayanan, former vice- president of Tata Consultancy Services, lauded ISRO’s peer review mechanism, its way of looking at a problem from multiple angles, the preference of an optimal solution over the ideal one and the space organisation’s ability to analyse a problem.

[…]

# # #

GoDaddy accounts vulnerable to social engineering and Photoshop

http://www.csoonline.com/article/2898128/disaster-recovery/godaddy-accounts-vulnerable-to-social-engineering-and-photoshop.html

  • By Steve Ragan
  • CSO
  • March 19, 2015

On Tuesday, my personal account at GoDaddy was compromised. I knew it was coming, but considering the layered account protections used by the world’s largest domain registrar, I didn’t think my attacker would be successful.

I was wrong. He was able to gain control over my account within days, and all he needed to do was speak to customer support and submit a Photoshopped ID.

GoDaddy serves more than 13 million customers, who in turn place 59 million domains under the registrar’s management. They have thousands of employees working across the globe who help staff the support and operations teams twenty-four hours a day.

Sometimes, customers forget their account number or password; perhaps they forget what email they’ve used to register a domain. In either case, GoDaddy’s support staff are there to assist.

[…]

# # #

Chicago woman to plead guilty in ID theft case

http://www.chicagotribune.com/suburbs/post-tribune/news/ct-ptb-identity-theft-plea-st-0320-20150319-story.html

  • By Teresa Auch Schultz
  • Post-Tribune
  • March 19, 2015

A Chicago woman claims her boss used her Gary business to help run an identity theft ring that stole information from clients at a medical center.

Montrease Young detailed her own role in the theft, as well as the role of her boss, Alexis Young, of Hammond, in a plea agreement filed Wednesday in the U.S. District Court in Hammond.

Young will plead guilty to one count of conspiracy to possess stolen identification documents, which comes with up to one year in prison.

[…]

# # #

Target poised to settle breach for $10 million

http://www.usatoday.com/story/money/business/2015/03/18/target-hack-breach-10-million/24991847/

  • By Jay Knoll
  • KARE-TV
  • March 19, 2015

MINNEAPOLIS – Target Corp. is poised to settle a class-action lawsuit filed following the retailer’s massive data breach in 2013, court documents filed Wednesday in Minnesota show.

A $10 million dollar fund will be established for victims of the breach, the 97-page settlement says.  Victims will be eligible for up to $10,000 compensation each.

Some aspects of the proposed class action settlement appear unique, said Mark Melodia, founder of the information technology, privacy and data security practice at the law firm of Reed Smith in New York City.

“First, the amount of attorneys’ fees contemplated by this deal is at the high end of the historical range, even for multi-district litigation proceedings,” Melodia said, cautioning that he has not had time to study the settlement.

[…]

# # #

Premera Blue Cross hack exposes 11M

http://www.healthcareitnews.com/news/premera-blue-cross-hack-exposes-data-11m

  • By Mike Miliard
  • Healthcare IT News
  • March 18, 2015

In what looks to be becoming a trend, another health plan has been targeted with a “sophisticated cyberattack,” with hackers gaining access to the financial and medical information of 11 million members.

Washington state-based Premera Blue Cross, a not-for-profit plan whose corporate clients include Pacific Northwest giants Microsoft and Starbucks, announced the breach, which was detected in January, on March 17.

The attackers – who some have suggested may be the same Chinese spies suspected in the massive Anthem breach revealed this past month, gained access to to a plethora of personal data. The Anthem breach compromised the information of nearly 80 million people.

“That information could include names, dates of birth, addresses, telephone numbers, email addresses, Social Security numbers, member identification number, medical claims information and financial information,” according to Premera.

[…]

# # #

The new MacBook’s single port comes with a major security risk

http://www.theverge.com/2015/3/16/8226193/new-apple-macbook-usb-type-c-security-risk-badusb

  • By Russell Brandom
  • The Verge
  • March 16, 2015

After years of development, USB Type-C is making a very big debut. Last week, Apple announced its new MacBook would come with just a single Type-C plug for both power and data, a move that allowed for the slimmest MacBook ever. A few days later, Google unveiled the new version of its flagship Chromebook Pixel with the same Type-C port. To the extent that hardware components can have a moment, USB Type-C is having one.

But while the new port is powerful, it also comes with serious security problems. For all its versatility, Type-C is still based on the USB standard, which makes it vulnerable to a nasty firmware attack, and researchers are also concerned about other attacks that piggyback on the plug’s direct memory access. None of these vulnerabilities are new, but bundling them together with the power cord in a single universal plug makes them scarier and harder to avoid. On a standard machine, users worried about USB attacks could simply tape over their ports, but power is the one plug you have to use. Turning that plug into an attack vector could have serious security consequences.

The biggest concern is the BadUSB vulnerability, first published last year. The attack lives in the firmware of a USB device and infects computers during the earliest stages of the connection, long before users get a chance to see what’s on the device or decide whether to open it up. We know how to protect peripherals against the attack — certain USB sticks have already built in protections against firmware infections — but computers are much harder to secure.

USB is built for compatibility, so there are very few peripherals a computer won’t accept, even if the peripheral ends up spreading malware. Apple’s reportedly allowing for third-party chargers and battery packs under its Type-C implementation, opening even more vectors for infection. (Apple did not respond to a request for comment.) In the case of BadUSB, that means it’s easy for a bad actor to put together a USB device that will spread the virus every time it’s plugged in.

[…]

# # #

Sony Pictures Confirms Hack-Delayed Q3 Profit of $51m, More Than Double February Forecast

http://www.hollywoodreporter.com/news/sony-pictures-confirms-hack-delayed-782423

  • By Gavin J. Blair
  • The Hollywood Reporter
  • 3/17/2015

Sony Pictures generated profits of $51 million (¥6.2 billion) in the quarter ending Dec. 31, the period affected by the hacking attack, more than the $20 million it had predicted in February, Sony Corp. announced in Tokyo on Tuesday.

Sales at the pictures division were $1.707 billion (¥206.6 billion) for the quarter, up from the Feb. 4estimate of $1.633 billion. Compared to the same quarter in 2013, sales were down 20 percent on a dollar basis, but only 7.7 percent in yen, due to the weakening of the Japanese currency.

The final announcement of Sony’s third-quarter earnings was delayed by the hack by a group calling itself Guardians of Peace, which caused huge disruption to the operations of Sony Pictures Entertainment in November and December.

Sony explained at the Feb. 4 provisional announcement that much of the damage caused by the hack was covered by insurance and predicted a cost of approximately $15 million, an amount confirmed in today’s figures.

[…]

# # #

China Reveals Its Cyberwar Secrets

http://www.thedailybeast.com/articles/2015/03/18/china-reveals-its-cyber-war-secrets.html

  • By Shane Harris
  • The Daily Beast
  • March 18, 2015

A high-level Chinese military organization has for the first time formally acknowledged that the country’s military and its intelligence community have specialized units for waging war on computer networks.

China’s hacking exploits, particularly those aimed at stealing trade secrets from U.S. companies, have been well known for years, and a source of constant tension between Washington and Beijing. But Chinese officials have routinely dismissed allegations that they spy on American corporations or have the ability to damage critical infrastructure, such as electrical power grids and gas pipelines, via cyber attacks.

Now it appears that China has dropped the charade. “This is the first time we’ve seen an explicit acknowledgement of the existence of China’s secretive cyber-warfare forces from the Chinese side,” says Joe McReynolds, who researches the country’s network warfare strategy, doctrine, and capabilities at the Center for Intelligence Research and Analysis.

McReynolds told The Daily Beast the acknowledgement of China’s cyber operations is contained in the latest edition of an influential publication, The Science of Military Strategy, which is put out by the top research institute of the People’s Liberation Army and is closely read by Western analysts and the U.S. intelligence community. The document is produced “once in a generation,” McReynolds said, and is widely seen as one of the best windows into Chinese strategy. The Pentagon cited the previous edition (PDF), published in 1999, for its authoritative description of China’s “comprehensive view of warfare,” which includes operations in cyberspace.

[…]

# # #

 

N. Korea behind nuke power plant data leakage: investigators

http://english.yonhapnews.co.kr/full/2015/03/17/15/1200000000AEN20150317005500315F.html

  • Yonhap News Agency
  • 2015/03/17

SEOUL, March 17 (Yonhap) — North Korea is believed to be linked to a series of recent data leaks from South Korea’s nuclear power plants, investigators said Tuesday.

Late last year, an unidentified hacker posted blueprints of nuclear power plants and threatened to destroy the facilities while demanding they be shutdown. Last week, the hacker posted more files on Twitter that included documents concerning the country’s indigenous advanced power reactor 1400, while demanding money.

Announcing the interim results of its probe into the high-profile case, a special investigation team said the series of incidents “is believed to have been caused by an (unidentified) group of North Korean hackers who “aimed at causing social unrest and agitating the people.”

Pointing out that the compromised data “are far from critical,” the investigators said the hackers stole it through hacking e-mails and online communities former and current officials of the Korea Hydro and Nuclear Power Co. (KHNP) have used instead of directly infiltrating the operator’s network.

[…]

# # #

 

Updated: March 28, 2015 — 2:07 pm

The Author

Rich Fleetwood

Rich is the founder of SurvivalRing, now in it's 20th year, author of multimedia CDs and DVDs, loves the outdoors, his family, his geeky skill-set, and lives in rural Missouri, just a few miles from the Big Muddy. Always ready to help others, he shares what he learns on multiple blogs, social sites, and more. With a background in preparedness and survival skills, training with county, state, and national organizations, and skills in all areas of media and on air experience in live radio and television, Rich is always thinking about the "big picture", when it comes to helping individuals and families prepare for life's little surprises. Since 1997, he has provided guidance, authentic government survival history, and commentary on why we all need to get ready for that fateful day in the future, when we have to get our hands dirty and step in to save the day. He is an award winning videographer (2005 Telly Award), has received state and national scholarly recognition (2006 New Century Scholar and All USA Academic Team), and is a natural with computers, technology, gadgets, small furry mammals, and anything on wheels. Rich likes making friends, solving problems, and creating solutions to everyday issues. He doesn't mind mixing things up, when there is a teaching moment ready to happen. As a constitutional conservative, he's staying quite busy these days. The SurvivalRing Radio Show at www.survivalringradio.com will be coming back SOON!

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Connect With Us at
Twitter Twitter | FaceBook Facebook | LinkedInLinkedIn | Quora Quora | Instagram Instagram | Pinterest Pinterest | Youtube Youtube | Tumblr Tumblr
SurvivalRing © 2018
Contact Us | Advertise | Terms of Use | GDPR | TradeMarks | Privacy | Fair Use | Sitemap | F.T.C
Social Media Disclosure | Earnings Disclaimer | Anti Spam Policy | D.M.C.A.
Site Design by Richard Fleetwood - Founder / Director of SurvivalRing.org
Copyright © 1997-2018 SurvivalRing.org/SurvivalRing Media - All Rights Reserved. -
SurvivalRing is the Trademark (TM) & Service Mark (SM) of all SurvivalRing Media Projects
THIS WEBSITE HOSTED BY SURVIVALRING.ORG - Comments Welcome!