Bitdefender analyst Bogdan Botezatu said the previously undiscovered hacking group flew under researchers’ radar by using well-worn electronic espionage techniques, some more than a decade old.

He told The Associated Press the group’s “simplicity is its strength.”

Botezatu wouldn’t reveal the group’s identity or its targets beyond saying that its victims included a slew of government agencies. He said he needed to be discreet to avoid disrupting ongoing investigations.

The group, dubbed Netrepser, is dissected in a 20-page report published Friday.

Attempts to reach the hackers were unsuccessful.—AP

Image: Alamy

The post Spying made simple: Hackers use old tools to dodge detection appeared first on KT10.

“We don’t expect this trend to slow down. As hackers get more aggressive and more sites become outdated, hackers will continue to capitalize by infecting more sites,” Google said in a post on its webmaster blog.

Google, which inserts security warnings when it detects hacked sites, said most of those warned can clean up their pages, but that 61 percent are not notified because their sites are not verified by the search engine.

“As always, it’s best to take a preventative approach and secure your site rather than dealing with the aftermath,” the blog said. “Remember a chain is only as strong as its weakest link.”

The news comes amid growing concerns over cybersecurity in the wake of massive hacks affecting Yahoo, the US government and major e-commerce firms.

Google said certain website hacks often follow similar patterns — some insert “gibberish” on a page, while others create Japanese text that links to fake brand merchandise sites.

“Hacking behavior is constantly evolving, and research allows us to stay up to date on and combat the latest trends,” Google said.—AFP

The post Hacked websites on the rise: Google appeared first on KT10.

The report, submitted to the U.N. Human Rights Council by the U.N. independent expert on privacy, Joe Cannataci, said traditional privacy safeguards such as rules on phone tapping were outdated in the digital age.

“It’s time to start reclaiming cyberspace from the menace of over-surveillance,” Cannataci told the Council.

With governments worldwide demanding data from firms such as Microsoft, Google, Facebook, Apple and Twitter, it did not make sense to rely entirely on U.S. legal safeguards, and creating an “international warrant” for data access or surveillance would unify global standards, he said.

“What the world needs is not more state-sponsored shenanigans on the Internet but rational, civilised agreement about appropriate state behaviour in cyberspace,” the report said. “This is not utopia. This is cold, stark reality.”

Cannataci was appointed as the first “Special Rapporteur on the right to privacy” in 2015, following the uproar caused by revelations by Edward Snowden, a former U.S. security contractor who once worked at the U.S. mission in Geneva.

His report was submitted last week, before the latest publication by anti-secrecy group WikiLeaks of what it said were thousands of pages of internal CIA discussions of hacking techniques of smartphones and other gadgets.

The United States did not react to Cannataci’s report, but many countries welcomed it and agreed that online privacy standards should be as strong as offline standards.

China’s diplomat at the Council said rapid technological advances and the “drastic increase worldwide in the violation of privacy” made it urgent to enhance protection, while Russia’s representative said Cannataci’s report was “extremely topical”.

Venezuela, Iran and Cuba all welcomed Cannataci’s work and criticised international surveillance.

A draft legal text was being debated by activists and “some of the larger international corporations” and was expected to be published within a year, Cannataci said.

In his report, he criticised populist laws that intruded on privacy in the name of fighting terrorism.

He said such sweeping but unproven powers were largely based on fear, and said that their lack of proportionality should be tested in ways similar to those used by a U.S. federal judge when he assessed President Donald Trump’s proposed restrictions on migrants from Muslim-majority countries.

“The level of the fear prevents the electorate from objectively assessing the effectiveness of the privacy-intrusive measures proposed,” he wrote.

“Trying to appear tough on security by legitimising largely useless, hugely expensive and totally disproportionate measures which are intrusive on so many people’s privacy and other rights – is patently not the way governments should go.”—Reuters

Image: Reuters

The post UN expert urges states to work towards cyber surveillance treaty appeared first on KT10.

“Cybercriminals go where there is value, and they have understood that the smartphone has become the preferred terminal for online shopping and payment,” said Tanguy de Coatpont, head of the French branch of international anti-virus firm Kaspersky Lab at the Mobile World Congress in Barcelona.

Ransomware, which seizes control of computers and demands money to unblock users’ data, has already started to target smartphones.

Now the devices are also being sought after as a gateway to key information about its user, experts at the phone industry’s largest annual trade fair said.

Cybercriminals have progressed from smartphone ransomware attacks to using Trojan Horse malware that can steal the login credentials of mobile banking users, said Fabien Rech, the head of the French division of Intel Security.

Using the stolen credentials, thieves can then log in to the victim’s account remotely and transfer money out.

“We see more and more attacks against banking apps,” said Rech.

There was a 17 percent increase in attacks targeting banking apps last year around the world, according to Slovakian cybersecurity firm ESET.

A new crop of younger cybercriminals is more at ease with smartphones, said Russian online security specialist Eugene Kaspersky, the head of Kaspersky Lab.

“I think that old generation of cybercriminals are on personal computers, the new are those who are on mobile,” he said.

While most cyberattacks target Android, the widespread smartphone operating system developed by US Internet giant Google, Apple’s iOS system, used on iPhones and generally considered more secure, is not immune from attack either.

“Frauding iOS could be easier because you only have few devices using it,” said Avishai Shoushen, the head of Israeli mobile advertising platform ClicksMob.

Since iPhones can be connected to other Apple products, hacking into the handset can give a cybercrimnal access to the data in other connected gadgets as well, said Ciaran Bradley, chief technology officer at Irish security firm Adaptive Mobile.

“Just an email looking like its coming from Apple can give an opportunity to access personal account information from any other device,” he said.

Some phonemakers like Australia’s Cog System are developing phones with extra security features to appeal to consumers who are concerned about hacking.

The company unveiled in Barcelona the D4 Secure SDK, which it called “the world’s most secure smartphone”.

Cog Systems, which has for years supplied super secure phones for governments, is targeting big companies with the device.

Experts say most cyberattacks could be prevented by smartphone users, who are often not aware that their device could be targeted.

“Consumers think that it is up to manufacturers to handle security issues, they tend to believe their connected devices are secure and they don’t think about it once it is open and running,” said Rech.

De Coatpont said proper use of a smartphone was key to preventing cyberattacks.

“Protecting your mobile phone implies not installing unofficial applications and regularly updating its operating system when asked to do so. And of course paying attention to how you manage passwords,” he said.—AFP

Image: Alamy

The post Cybercriminals focusing on data-rich smartphones appeared first on KT10.

Smart cities integrate businesses in an expanding global innovation network. They do much more than creating a single great product or industry to stay ahead of the innovation curve. They develop visioning initiatives to create their preferred futures.

But making products that “change the world” does help keep locations in the news. Hyperloop systems to increase the speed and lower the cost of travel are synonymous with Californian innovators. Augmented reality glasses that will remove the need to work at your PC put New York developers in the spotlight. Singapore is known for its digital economy and driverless taxis.

Smart cities cannot afford to be complacent about their achievements. If they stand still, they will soon be overtaken by further innovation.

Digital disrupter Uber plans to add driverless cars to its ride-sharing network. The next innovative mode of travel around smart cities will be autonomous aerial vehicles – drones and quadcopters. Dubai plans to have passenger drones up and running within months.

How can cities stay ahead of the curve?

For futurist Sohail Inayatullah, progressive innovation is empowering (increasing inclusion), nature-based (learning from, protecting and often enhancing through new technologies) and purposeful.

Mayors, CEOs and leaders create a progressive culture that attracts and retains talented staff. Smart organisations improve staff skills and design reflective spaces. They provide a healthy lifestyle culture supported by excellent pay and conditions.

They also encourage employees to participate in innovation hubs, city labs, maker spaces, universities and business start-ups, and via shared platforms with Creative Commons licences.

California’s high-tech companies – Apple, Facebook, Yahoo, Netflix, eBay, Tesla and the like – gain product feedback from customers and New York financiers every year at CES in Las Vegas. CES 2017 displayed TVs with 2.5mm screens that vibrate to make sound, holographic displays, eye-tracking phones and an electric car that accelerates from 0-59km per hour in 2.39 seconds. While products on display were designed in US cities, global suppliers made many of them.

Cities also stay ahead of the innovation curve through the actions of industry leaders who promote the diversity and stability of local workforces. In 2008, US smart cities benefited from the support of Microsoft founder Bill Gates, who testified to the importance of hiring foreigners.

Microsoft, along with Amazon and Expedia, again supported Washington State in 2017 by testifying against US President Donald Trump’s immigration ban. In a joint message of co-operative governance to protect global relationships, 16 US attorneys-general rallied against the presidential executive order denying entry to citizens from seven Muslim-majority countries. They rejected the immigration ban for undermining national security and America’s core values as a “nation of immigrants”.

Separating reality from hype

Smart city “reality” is about co-creation at the fastest rate in history. This relies on physical and digital connectivity, openness to global markets and high-speed internet. By 2020, Australians will enjoy a 5G wireless internet service with speeds 100 times fast than the current NBN.

High-speed connectivity is needed to support virtual reality and rich entertainment experiences. SpaceX wants to launch 4,425 satellites, rebuilding the internet in space to create a “full and continuous global coverage”.

For leaders, smart city “reality” also means promoting their city’s unique benefits. Socially inclusive, affordable cities with liveable climates attract talented staff.

Australia’s largest city, Sydney, offers those conditions. It is a global leader in bio-tech, high-tech manufacturing. It also has some of the highest levels of sustainability and natural environmental open space in the world.

Compared to London, Sydney rates better for political stability, crime rate, cost of living and cost of rent. Sydney is similar to London in productivity, world university rankings, and health system performance.

Cities with the most advanced technology and liveability include Sydney, London, Stockholm, Seoul and Toronto.

Aligning innovation to emerging futures

Smart cities reduce hype by creating visions. Visioning imagines socially inclusive, sustainable and transformational futures and consequences before enacting them.

When delivering foresight workshops, I use the acronym SELECTFTGP – for “select futures that grow possibilities”. This seeks to encompass all systems: social, environmental, legislative, economic, cultural, technological, futures, transport, governance and political. Considering all social possibilities and impacts, before narrowing to preferred futures, helps to avoid “hype”.

The Australian government has a national Smart Cities Plan. The plan emphasises attraction of talent, accessibility, connecting high-density housing and job centres and high-quality urban design. It recommends a smart city reference group to improve stakeholder engagement, a national cities performance framework, and City Deals.

Queensland is including a Townsville City Deal in its draft regional planning framework, ShapingSEQ. The City Deal will “hard wire” ShapingSEQ through an agreed delivery mechanism for project prioritisation, funding and governance. Submissions on the draft document close March 3, 2017.

Brisbane, Gold Coast, Logan, Sunshine Coast and Geelong have applied futures studies methods to their city visioning.

Smart cities will advance across the Australian landscape when state governments legislate for cities to create and align 20-to-30-year visions to their emerging futures.

The Conversation

Picture source: Alamy Image

Picture used for illustrative purpose only

The post Here’s what smart cities do to stay ahead appeared first on KT10.

In many instances, however, these failures may be caused by the impact of electrically charged particles generated by cosmic rays that originate outside the solar system, a study says.

“This is a really big problem, but it is mostly invisible to the public,” said Bharat Bhuva, Professor of Electrical Engineering at Vanderbilt University in Nashville, Tennessee, US.

When cosmic rays travelling at fractions of the speed of light strike the Earth’s atmosphere they create cascades of secondary particles, including energetic neutrons, muons, pions and alpha particles. Millions of these particles strike your body each second.

Despite their numbers, this subatomic torrent is imperceptible and has no known harmful effects on living organisms.

However, a fraction of these particles carry enough energy to interfere with the operation of microelectronic circuitry.

When they interact with integrated circuits, they may alter individual bits of data stored in memory. This is called a single-event upset or SEU.

Since it is difficult to know when and where these particles will strike and they do not do any physical damage, the malfunctions they cause are very difficult to characterise.

As a result, determining the prevalence of SEUs is not easy or straightforward.

”When you have a single bit flip, it could have any number of causes. It could be a software bug or a hardware flaw, for example. The only way you can determine that it is a single-event upset is by eliminating all the other possible causes,” Bhuva, an alumnus of University of Baroda in India, explained.

“Our study confirms that this is a serious and growing problem,” said Bhuva in a presentation at the recently concluded annual meeting of the American Association for the Advancement of Science in Boston.

“This did not come as a surprise. Through our research on radiation effects on electronic circuits developed for military and space applications, we have been anticipating such effects on electronic systems operating in the terrestrial environment,” he added.

The good news, Bhuva said, is that the aviation, medical equipment, IT, transportation, communications, financial and power industries are all aware of the problem and are taking steps to address it.

“It is only the consumer electronics sector that has been lagging behind in addressing this problem,” he said.

IANS

Picture source: Alamy Image

Picture used for illustrative purposes alone

The post Computer crashed? Blame cosmic rays from outer space appeared first on KT10.

Countries need to develop and abide by global rules for cyber attacks similar to those established for armed conflict at the 1949 Geneva Convention that followed World War Two, Smith said. Technology companies, he added, need to preserve trust and stability online by pledging neutrality in cyber conflict.

“We need a Digital Geneva Convention that will commit governments to implement the norms needed to protect civilians on the internet in times of peace,” Smith said in a blog post.

Smith outlined his proposal during keynote remarks at this week’s RSA cybersecurity conference in San Francisco, following a 2016 U.S. presidential election marred by the hacking and disclosure of Democratic Party emails that U.S. intelligence agencies concluded were carried out by Russia in order to help Republican Donald Trump win.

Cyber attacks have increasingly been used in recent years by governments to achieve foreign policy or national security objectives, sometimes in direct support of traditional battlefield operations. Despite a rise in attacks on governments, infrastructure and political institutions, few international agreements currently exist governing acceptable use of nation-state cyber attacks.

The United States and China signed a bilateral pledge in 2015 to refrain from hacking companies in order to steal intellectual property. A similar deal was forged months later among the Group of 20 nations.

Smith said President Donald Trump has an opportunity to build on those agreements by sitting down with Russian President Vladimir Putin to “hammer out a future agreement to ban the nation-state hacking of all the civilian aspects of our economic and political infrastructures.”

A Digital Geneva Convention would benefit from the creation of an independent organization to investigate and publicly disclose evidence that attributes nation-state attacks to specific countries, Smith said in his blog post.

Smith likened such an organization, which would include technical experts from governments and the private sector, to the International Atomic Energy Agency, a watchdog based at the United Nations that works to deter the use of nuclear weapons.

Smith also said the technology sector needed to work collectively and neutrally to protect internet users around the world from cyber attacks, including a pledge not to aid governments in offensive activity and the adoption of a coordinated disclosure process for software and hardware vulnerabilities.—Reuters

Image: Alamy

The post Digital Geneva Convention’ needed to deter nation-state hacking: Microsoft president appeared first on KT10.

After the demonetisaion move, the drive to digitisation has accelerated, bringing to the fore the concerns for cybersecurity and the level of risk remains the same everywhere and for every sector, said Vicente Diaz, Principal Security Analyst at Kaspersky lab.

“Poorly secured Industrial Cybersecurity Solutions (ICS) is nothing new but now attacking them provides direct benefit to the hackers. There will be more attacks in ICS sector,” Diaz told reporters here.

He added that Advanced Persistent Threat (APT) had learnt from mistakes and now their deployment would be more silent in those poorly monitored systems.

APT usually refers to a group, such as a government, with both the capability and the intent to target, persistently and effectively, a specific entity.

With the ultimate aim to cause an industrial accident, other incentives for hackers include money and control of infrastructure.

Diaz added that some cyber attacks on Indian sectors or government are sponsored by other governments.

His comments came a few months after the US intelligence community accused Russians of being responsible for the hacking that led to the leaking of damaging material which dogged Democratic presidential nominee Hillary Clinton till the Election Day.

While Trump had openly accused Russia of hacking, Moscow refuted the accusations saying that it was a “tiresome witch-hunt”.

Recently, the Kaspersky Lab commented that hackers behind US cyber attacks were hard to trace.

Meanwhile, Vikram Kalkat, Business Development Manager, APAC at Kaspersky lab said that soon Internet of Things (IoT) will become a reality in India and it will become very important to take effective measures to check hacking.

“New technologies in IoT industry and developments in IT will compel all to rethink industrial cyber protection,” added Kalkat.

He noted that patchwork and partial solutions would be unable to handle the sophistication of a cyber attack that can cripple the infrastructure.

In 2016, hackers also disrupted the Korean transport system, American DAM and Swiss water company.

The same year also saw a malware-related security breach following which the State Bank of India (SBI), HDFC Bank, ICICI Bank, Axis Bank and YES Bank blocked millions of debit cards that were compromised.—IANS

Image: kaspersky.com

The post Poorly secured infrastructure at cybersecurity risk in India: Kaspersky lab appeared first on KT10.

Pattern lock is a security measure that protects mobile phones or tablets. However, users only have five attempts to get the pattern right before the device becomes locked. It is used by around 40 per cent of Android device owners.

According to researchers from Lancaster University in Britain, Northwest University in China and University of Bath, Germany, attackers can crack pattern lock reliably within five attempts by using video and computer vision algorithm software.

By covertly videoing the owner drawing their pattern lock shape to unlock their device, the attacker, who is pretending to play with their phone, can then use software to quickly track the owner’s fingertip movements relative to the position of the device.

“Within seconds, the algorithm produces a small number of candidate patterns to access the Android phone or tablet,” the researchers said in a university statement.

“People tend to use complex patterns for important financial transactions such as online banking and shopping because they believe it is a secure system. However, our findings suggest that using Pattern Lock to protect sensitive information could actually be very risky,” said Zheng Wang, principle investigator and co-author of the paper.

Researchers evaluated the attack using 120 unique patterns collected from independent users. They were able to crack more than 95 per cent of patterns within five attempts.

Experts believe that complex shapes were easier to crack because they help the fingertip algorithm to narrow down the possible options.

“Contrary to many people’s perception that more complex patterns give better protection, this attack actually makes more complex patterns easier to crack and so they may be more secure using shorter, simpler patterns,” added lead author Guixin Ye from Northwest University.

Researchers could crack all but one of the patterns categorised as complex within the first attempt but they successfully cracked 87.5 per cent of median complex patterns and 60 per cent of simple patterns with the first attempt.—IANS

Image: Alamy

The post Just 5 attempts can open Android pattern lock appeared first on KT10.

Information on the security flaw, identified by researchers at MedSec Holdings in reports months ago, was only formally made public after the manufacturer, St. Jude Medical, made a software repair available Monday. MedSec is a cybersecurity research company that focuses on the health-care industry.

The government advisory said security patches will be rolled out automatically over months to patients with a device transmitter at home, as long as it is plugged in and connected to the company’s network. The transmitters send heart device data back to medical professionals.

Abbott Laboratories’ St. Jude said in a statement it was not aware of deaths or injuries caused by the problem. The Food and Drug Administration also said there was no evidence patients were harmed.

The federal investigation into the problem started in August.

MedSec CEO Justine Bone said on Twitter that St. Jude’s software fix did not address all problems in the devices.

St. Jude’s devices treat dangerous irregular heart rhythms that can cause cardiac failure or arrest. Implanted under the skin of the chest, the devices electronically pace heartbeats and shock the heart back to its normal rhythm when dangerous pumping patterns are detected.

The company’s Merlin(at)home Transmitter electronically sends details on the device’s performance to a website where the patient’s physician can review the information. But that device can also be hacked.

The FDA’s review is ongoing, agency spokeswoman Angela Stark said. Its investigation confirmed the vulnerabilities of the home transmitter, which could potentially be hacked and used to rapidly deplete an implanted device battery, alter pacing and potentially administer inappropriate and dangerous shocks to a person’s heart.

The software patch issued by St. Jude “addresses vulnerabilities that present the greatest risk to patients,” Stark said.

Stark said the company is working to address remaining vulnerabilities quickly. She said any new cardiac devices submitted to the FDA for review that use the affected transmitter will not be cleared or approved without the software update.

St. Jude disclosed details about the problem after it merged with Abbott. The company has previously denied findings that their devices could be hacked and filed a lawsuit against Muddy Waters LLC and MedSec, alleging that they tried to manipulate the markets to profit from the vulnerability research disclosures.

The revelations about a hacker’s ability to potentially gain remote access and affect even the workings of a human heart shed light on the pressing problems of cybersecurity in an increasingly networked world. The advisory also highlights the dilemma for security researchers who may feel an obligation to inform the public of possible dangers but don’t want to cause unnecessary panic.

“Your average patient isn’t going to be targeted by assassins,” said Matthew Green, an assistant professor for computer science at Johns Hopkins University. He was hired by Muddy Waters to help validate the MedSec findings after St. Jude filed its lawsuit. “An attack on this level is low-probability but very high-impact.” He called it “probably the most impactful vulnerability I’ve ever seen.”

Green said many of the more severe vulnerabilities identified by MedSec for the devices themselves have not been fixed, but the new software would make the home system a little more secure.

The FDA has been urging manufacturers to update their products, software and security measures since at least 2013. However, agency guidelines issued last year are not binding. The FDA does not review the vast majority of cyber security updates made to devices, under its own rules intended to streamline medical device upgrades.

In 2015 the FDA issued two separate safety alerts to hospitals over drug pumps made by Hospira, now owned by Pfizer.

In the second notice, regulators told hospitals to stop using the company’s Symbiq Infusion System after the company confirmed the system could be remotely hacked, allowing an outside party to potentially reprogram the drug pumps. The devices are used to slowly dose intravenous drugs for pain, infection, nutrition and other uses and are usually programmed through a wireless hospital network.

No patient injuries were reported in connection with the issue, but the agency urged users “to begin transitioning to alternative infusion systems as soon as possible.”

Hospira discontinued the pumps for unrelated reasons prior to the FDA announcement, according to the agency.—AP

Image: medsec.com

The post US warns of unusual cybersecurity flaw in heart devices appeared first on KT10.