Iain Thomson in San Francisco, V3.co.uk, Wednesday 3 February 2010 at 02:51:00

A report into the security of internet banking systems has found that one of
the biggest problems is the reuse of log-in passwords on multiple sites.

Online security firm Trusteer monitored over four million computers for a
year, and found that 73 per cent of internet banking customers used the same
password for their online banking services as they did for other, less secure,
sites.

“Using stolen credentials remains the easiest way for criminals to bypass the
security measures implemented by banks to protect their online applications, so
we wanted to see how often users repurpose their financial service user names
and passwords,” said Amit Klein, chief technical officer at Trusteer, and head
of the company’s research organisation.

“Our findings were very surprising, and reveal that consumers are not aware,
or are choosing to ignore, the security implications of reusing their banking
credentials on multiple web sites.”

The
Reused
Login Credentials report (PDF) found that part of the blame lies with
banking web sites that allow users to choose their own IDs, as almost two thirds
of customers use the same ID for other sites. This figure falls to less than
half when users are allocated an ID by the bank.

The research also found that nearly half of banking customers use their ID
and password for a non-financial web site.

The use of the same password for multiple sites raises serious security
risks. If a hacker can get one password from a less secure web site by a ‘brute
force’ dictionary attack, for example, there is a good chance that it can be
used on other sites.

read more from this topic.....

Shaun Nichols in San Francisco, V3.co.uk, Wednesday 3 February 2010 at 02:21:00

A large botnet has begun targeting hundreds of sites with denial of service
(DoS) attacks.

Researchers believe that a malware network known as PushDo has recently
stepped up activity and has been attempting numerous attacks on US government
sites as well as security blogs and social networking sites.

According to security watchdog group Shadow server, the attacks began last
week and attempted to use SSL traffic to cripple targeted sites. Among the sites
said to be in the botnets crosshairs were Twitter, Mozilla.org, security
research group Sans and the homepage of the US Central Intelligence Agency
(CIA).

First spotted in 2007, Pushdo also goes by the names “Cutwail” and “Pandex.”
At its highest point, the botnet
was
believed to account for a sizable portion of all malicious spam traffic.

The latest attacks, however, appear to be far less successful. Sans
researcher Johannes Ullrich said in
a
blog posting that little downtime was being reported, likely do to the large
number of targets spreading Pushdo’s resources thin.

“At this point, it is not clear what the intention is of this botnet. If its
intention is a denial of service attack, then it failed,” he wrote.

“It does not appear that any of the sites listed experiences significant
Pushdo related outages.”

Additionally, Ullrich suggested that the failed attacks were allowing Sans to
better analyze the botnet and gain a clearer picture of how it attacks various
sites.

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Wednesday 3 February 2010 at 02:17:00

A Chinese government official has said that his country is the world’s
leading target for hacking attacks.

Zhou Yonglin, deputy chief of the operations department of the China National
Computer Network Emergency Response Technical Team (CNCERT) said in an interview
with state media that China suffers more hacking attacks than any other country.

“Compared with [internet security issues in] the US, Japan and the Republic
of Korea, it is very serious in China,” he said.

Zhou explained that 262,000 IP addresses in China were hit by Trojans last
year, planted by nearly 165,000 overseas IP addresses. “Those from the US ranked
first, accounting for 16.61 per cent,” he said.

Zhou also denied any knowledge of the hacking attacks on Google that started
the company’s
conflict
with the Chinese authorities. However, Google has apparently presented no
evidence to CNCERT about the attacks.

“We have been hoping that Google will contact us so that we could have
details on this issue and provide them help if necessary,” he said.

CNCERT is working actively with the US Computer Emergency Readiness Team and
others to cut down on attacks, according to Zhou.

He cited a case last year when the Chinese authorities alerted the US about
two US-registered domain names that were planting Trojans on hundreds of Chinese
web sites.

read more from this topic.....

Rosalie Marshall, V3.co.uk, Monday 1 February 2010 at 17:24:00

MI5 has warned UK companies that the Chinese government may have gained
access to their computers with the intention of remotely monitoring their online
activities.

A leaked document seen by The Sunday Times claims that Chinese
security officials have been offering free computer devices that contain Trojan
software to high profile business users in the banking, defence and energy
industries.

The devices include camera equipment and USB memory sticks that have been
given out at trade events.

Business users in public relations companies and law firms are also thought
to have been targeted.

A call to the Department for Business, Innovation and Skills referred queries
on the matter to the Cabinet Office, which said that it would not discuss leaked
documents and could not offer any further clarification on whether businesses
should be worried about the alleged surveillance.

However, a government spokesman referred anxious executives to the Centre for
the Protection of National Industry for advice.

It is unclear how many businesses may have been affected by the Trojans, or
how long the monitoring has been taking place.

Reports suggest that the MI5 document is 14 pages long and entitled The
Threat from Chinese Espionage.

MI5′s Centre for the Protection of National Infrastructure wrote the report a
year ago and shared it with a restricted number of businesses.

read more from this topic.....

Phil Muncaster, V3.co.uk, Sunday 31 January 2010 at 09:45:00

Google’s standoff in China grew even more pronounced last week after chief
executive Eric Schmidt restated the web giant’s opposition to internet
censorship, according to a Bloomberg report.

Schmidt said at the World Economic Forum in Davos on Friday that, although
the web giant is still complying with Chinese law in censoring search results on
Google.cn, in a “reasonably short time from now we will be making some changes
there”.

“We love what China is doing as a country and its growth,” Schmidt is
reported as saying. “We just don’t like the censorship. We hope to apply some
negotiation or pressure to make things better for the Chinese people.”

Google shocked the tech world earlier this month by
threatening
to pull out of China after discovering that hackers it believed originated
in the country had tried to infiltrate its systems to monitor the email accounts
of human rights activists.

Although Schmidt reportedly added that the firm had already “made a strong
statement that we wish to remain in China”, the chances of that happening are
slim, given the Chinese government’s hard line on censorship.

“Foreign enterprises in China need to adhere to China’s laws and regulations,
respect the interests of the general public and cultural traditions and shoulder
corresponding responsibilities. Google is no exception,” a Chinese foreign
ministry spokesman said last week.

read more from this topic.....

Phil Muncaster, V3.co.uk, Wednesday 27 January 2010 at 17:10:00

The average cost of a data breach has risen seven per cent over the past year
to £64 per lost record, or a total average of £1.68m, according to the latest
annual study from encryption software vendor PGP to be published tomorrow.

The 2009 Annual Study: UK Cost of a Data Breach, carried out by
information management research firm the Ponemon Institute, separated the public
and private sectors for the first time.

UK public organisations faced average costs of £59 a record, according to the
report, while the cost to their commercial counterparts stood at £69.

The breaches studied for the research threw up a large disparity in resulting
costs – from £365,000 to £3.92m – the main contributor being lost business due
to reduced consumer trust, which accounted for £29 out of the average £64 per
lost record.

Phil Dunkelberger, chief executive and president of PGP, explained that,
although the research did not take into account any losses resulting from
punitive action by regulators after a breach, losses can nevertheless mount up
from various areas.

“People may change their buying behaviour after a breach, so they want to pay
by cash and not credit card, or they are unwilling to give you marketing
information. Then there is customer churn and an increased cost of customer
acquisition post incident,” he said.

Dunkelberger added that the message about the potential impact of data
breaches and how to mitigate them is still struggling to get through.

“It takes a complicated breach to make people doing business around the world
to realise that their data is at risk,” he said. “The whole reason for data
breach laws [in the US] is that the press is doing an excellent job of finding
incidents. I wonder why it’s still such a mystery to people.”

However, Bob Tarzey, an analyst with Quocirca, argued that companies are
beginning to understand the impact of breaches.

“There is genuine concern out there, a genuine worry about the impact of a
data breach on customers,” he said. “A breach will happen to your
organisation; it’s about having the policies and technologies in place so that
when it happens you can handle it.”

The research also found that costs resulting from a breach can climb to as
much as £81 a record when the breach resulted from third-party loss, while
losses resulting from malicious attack recorded an average cost of £76 per
record.

Conversely, organisations which notified customers swiftly after a breach, or
those with a dedicated chief information security officer to take charge, found
that their average losses were lower.

Dunkelberger warned that email servers remain a security blind spot for many
organisations.

“They should be taking a holistic view, but many don’t realise that the
largest database they have is the mail server,” he said. “So they might want to
get a strategy around that, because what we’re doing at the moment isn’t
working.”

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Monday 25 January 2010 at 20:51:00

The number of corporate security breaches fell last year, but the cost of
each incident is on the up, according to a new study by the Ponemon Institute.

The study of attacks in 15 different industries found that the average
per-incident cost of a security breach was $6.75m (£4.16m) in 2009, compared to
$6.65m (£4.1m) in 2008.

A separate report from the Identity Theft Resource Center said that the
number of successful attacks fell from 657 in 2008 to 498 in 2009.

“In the five years we have conducted this study, we have continued to see an
increase in the cost to businesses of a data breach,” said Dr Larry Ponemon,
chairman and founder of the Ponemon Institute.

“With a variety of threat vectors to contend with, companies must proactively
implement policies and technologies that mitigate the risk of facing a costly
breach.”

The fall in the number of attacks can be attributed to improved security
practices, the study found, such as better staff training and awareness
programmes. Another factor is the regular use of encryption, which was up 14 per
cent to 54 per cent this year.

Nevertheless, the cost of a breach rose from $202 (£125) per compromised
customer record in 2008 to $204 (£126) in 2009. Companies are also being hit by
higher legal costs as a result of data loss.

The most expensive data breach in this year’s study cost nearly $31m (£19m),
and the least expensive $750,000 (£464,000).

“Customers are increasingly aware of, and expecting a secure level of
protection and privacy for, the data they entrust to businesses,” said Phillip
Dunkelberger, president of PGP Corporation, which sponsored the study.

“Our study with the Ponemon Institute continues to demonstrate that companies
whose data is not protected face expensive direct costs from cleaning up a data
breach, and a loss in customer confidence that has long-lasting ramifications.

“A bright spot in this year’s report illustrated that companies with chief
security officer leadership had a lower cost of remediation following a breach.
“

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Saturday 23 January 2010 at 16:50:00

Last week we had a bit of fun and looked at
technologies
for budding dictators, but this week we’re looking at the other side of the
coin: how to stay safe online if your future depends on it.

Every day each of us generates a rapidly expanding amount of data, and that
data is mined by companies and governments. In many cases it’s used for nothing
more irritating than advertising, but for some countries that cloud is also a
trail that can be monitored.

In too many of the world’s countries we are seeing increasing moves to clamp
down on the cheerful anarchy of the internet. China has its infamous Great
Firewall, but some, like North Korea, exert total control, allowing a few modems
out and carefully monitoring each line.

We have few such pressing problems in the Western world, but here the issue
is privacy. Huge legislative battles have been fought in the past over racial
and sexual equality and the role of the state, but the spotlight in the coming
decade is on privacy – who has the right to know what about you.

So there’s a little useful stuff in here for everyone. As ever, if you think
we’ve missed anything, the comments section is below.

Honourable
Mention: Hacking


Shaun Nichols: At first we weren’t sure how to classify this one.
Malware isn’t really the right term, neither is spyware. We decided to go ahead
and use the label ‘hacking’ .

Regardless of how you label it, there are times in the battle for freedom
when you may need to access a system under, well, less than conventional means.
At these times, you may need to use some tools to bypass security protections
and authentication components.

That’s not to say we’re endorsing such activity. Whether your motives are
just or not, this sort of thing is considered illegal pretty much everywhere,
and people who get caught will undoubtedly face some unpleasant consequences.

There are, however, times when the risk of imprisonment and punishment are
worth the potential reward.

Iain Thomson: Is it OK to break the law in a moral cause? Many
people who are now great statesman once thought so; Nelson Mandela comes to
mind. Sadly, the courts disagree.

As we are seeing in the
case
of Gary McKinnon, when the US nabs you on terrorism charges for hacking it
doesn’t mess about. McKinnon isn’t a freedom fighter, merely someone with mental
problems who thought he was on a quest to unveil the truth about UFOs. He’s now
facing decades in prison for his activities.

In the wider world, a measure of hacking is a prerequisite for getting open
access to the internet at all in some countries. There’s also less of a moral
question about getting into the systems responsible for their repression,
although the penalties are much more severe than McKinnon faces in many cases.

Honourable
Mention: Complicit companies


Iain Thomson: This was an unusual last minute entrant, suggested by
Shaun in the light of last week’s Top 10. While initially I was sceptical, Shaun
made his case. Certain companies are beginning to show some guts and say that
business in China is about more than money.

This is not long before time. China has an understandable aversion to some
aspects of Western culture, believing that, if the British, French and Russians
had set up camp in Manhattan for 50 years by force of arms, as Shanghai was,
America would be up in arms.

Since Google has come out against censorship, for whatever reasons, other
Western companies have also been called on to make a stand. Whether they will or
not remains to be seen.

Shaun Nichols: Seeing how Google inspired our top 10 tools for
tyranny list, I think it is only fair that we include companies that don’t
kowtow to oppressive regimes on our list.

It takes a lot of guts to say no to a government when you’re a business. If
you don’t do what you are told, and the people in charge take notice of it, you
and your employees are likely to be out of jobs and possibly even behind bars.

If anything good has come out of the rise of multinational corporations, it
is that some are becoming less beholden to governments and able to take a stand
when something is not right.

China may be a huge economy, but Google has plenty of business elsewhere in
the world. If the company
does
pull out, it will be able to get along just fine.

10.
OpenDNS


Shaun Nichols: We chose OpenDNS here, but there are a myriad
of similar tools that can be used to take some of your dependency off of your
local ISP and into your own hands and those of like-minded people.

For those unfamiliar, the DNS system is what allows clients and servers to
link up the text of a URL with the numerical IP address of the server hosting
the site. The task of cataloguing and matching the URLs and IP addresses is
handled by a DNS server, usually provided by the user’s ISP.

OpenDNS is a well-maintained DNS service which is free and open to all users
and, for a great many people, is far faster and more reliable than their ISP’s
own servers. Additionally, it is constantly maintained and updated to protect
against possible attacks, such as the 2008
DNS
cache-poisoning flaw.

It also gets one more activity out of the hands of ISPs, which are often more
than willing to hand over information to government agencies.

OK, so DNS information isn’t exactly sensitive data, and it’s not as if
OpenDNS would prevent an oppressive regime from keeping people down, but it’s at
least a small way you can take some of your activity out of the ISP’s hands.

Iain Thomson: OpenDNS isn’t perfect by a long chalk but it is a very
valuable tool. Anything that gets your data out of the hands of the ISP is a
good thing on the privacy front, especially if the ISP in question is run by the
government and subject to constant monitoring.

In more closely-run internet monitoring states, the use of OpenDNS may also
be a big red flag so be careful how you use it.

9.
Clean email address


Iain Thomson: A must for the budding activist is a clean email
address, ideally one that has not been used at all. This involves using the
account to write emails in draft form, and not sending them, but having a
trusted contact who can also access the account, read the messages and type a
draft response.

Even if emails are sent, such a low use account would raise few warning bells
in unsophisticated monitoring regimes. With the rise of mobile phone use for
email it would have to be a very quick monitor to pick up a signature.

This is a tactic used by many groups, both benign and malicious. So-called
‘clean skins’ are the hardest operatives to trap, because they have no record.
This is what makes it important to keep certain people solely as methods of
communication, and from the other perspective, to keep watch on the behaviour of
others.

Shaun Nichols: This is one space where collaboration services such
as Google Wave could prove valuable.

If users could access collaboration pages hosted in a safe location, they
could communicate without having to worry about the interception of those
messages by the authorities.

When combined with our earlier nod to companies that don’t give in to
government pressure, you have a pretty effective tool for safe communication, at
least until the local authorities contact your ISP and have the service blocked.

This is, as Iain noted, potentially a good and bad thing. While it could be
used to subvert restrictions on free speech, it could also be used to facilitate
the planning of malicious action. Which brings up a troublesome fact:
‘activists’ and ‘freedom fighters’ in one part of the world are usually
considered ‘criminals’ and ‘terrorists’ in another.

8.
The Electronic Frontier Foundation


Shaun Nichols: While its global reach is still somewhat
limited, the EFF is championed in the computing world for its tireless efforts
on behalf of user rights and access to information.

Founded in 1990 by Mitch Kapor and John Peery Barlow, the EFF has used legal
expertise to argue on behalf of the little guy. The group’s efforts have
included a prominent position in the fight against digital rights management
software and the takedown of user-submitted videos, as well as putting
once-classified government data online for all to see.

The group has also championed net neutrality, and gone after music labels and
studios that use bully-tactics on users suspected of sharing media files online.

It’s somewhat scary to think about what the tech world would be like had it
not been for the efforts of the EFF.

Iain Thomson: To my mind the EFF is the biggest thing Mitch Kapor
can be proud of in the tech arena and, considering the impact of Lotus 1-2-3,
that’s saying something.

The EFF’s web site is a treasure trove of useful stuff for anyone interested
in staying private, which is probably why so many countries try to block it. It
contains software tools to help evade national firewalls, to simple browser
setting advice.

But it is the operation behind it that shines. The EFF has proved a highly
effective watchdog of the technology world, and it keeps governments
(reasonably) honest. It mixes high profile investigations into illegal US
government wire-tapping to draw out legal battles.

If you are a technology user of almost any type the EFF has got your back,
and thankfully it’s very good at what it does.

7.
Social media


Iain Thomson: When the first plane hit the Twin Towers on that
day in September, one camera recorded it, that of a French documentary team
filming New York firemen. By contrast, the vast bulk of the initial footage of
the Haiti disaster has come from social media.

No-one can deny the impact of social media. The demonstrations in Iran, the
Burmese monks and footage of the police in the US and UK have shown that the
pendulum is swinging round from those that control the media to those that
create and consume it.

On a personal note, the moment this really kicked in was at last year’s G20
demonstrations in London, and the death of Ian Tomlinson. Tomlinson was the only
fatality of the demonstrations, and the police story at the time was that he’d
had a heart attack and medics tried to help him but were bottled off by
protesters.

It was only after, ironically enough, a New York investment fund manager put
the footage he had shot online, that the rest of the world saw his attack from
behind by the police, while walking with his hands in his pockets. London may
have the highest concentration of CCTV cameras in the world but none of them
caught this, but a bystander did.

Video recording technology is increasingly being embedded into many devices,
and it is a very effective weapon against the ‘official line’. Add in the reach
of YouTube, Twitter and Facebook, and you have a powerful tool against
oppression.

Shaun Nichols: As we are now seeing, YouTube isn’t just a place for
goofy blooper videos and crackpot political rants; it is also a valuable way for
people to share footage.

News services around the world are picking up on this, and installing portals
where users can upload and share their video of important events. This is
allowing users to capture and broadcast video of government, military and
law-enforcement groups behaving badly, and has in some cases helped police to
bring violent criminals to justice.

As much as we like to malign their usefulness at times, social networking
sites such as Facebook and Twitter have also become tools for sharing
information and campaigning for freedom and justice. Not everyone has the time
or interest to maintain a full blog, and few of us are able or willing to scroll
through dozens of blogs a day.

The aggregator features of social networking sites allow multiple updates to
be seen at once. During a large and tumultuous event such as a protest or
government crackdown, these sites become very useful tools for gathering
information.

6.
Open source software


Shaun Nichols: When people like Richard Stallman and Linus Torvalds
created the pillars of the open-source software movement, they did so with the
fundamental belief that software and digital data should be open and accessible
to all. This is, of course, conflicts with the basic tenants of tyrannical rule.

One of the great things about open-source software is that it can be opened
up and tinkered with by just about anyone who wants to. Additionally,
open-source tools and applications can be more or less shared freely on the web.
This allows people who may not otherwise have access to the resources to use the
software and learn how to build and tinker with it themselves.

Tyranny isn’t always apparent in the form of outright oppression; often it
comes in the form of purposefully maintained ignorance. Open-source software can
allow users to educate themselves, and is therefore a pretty handy tool for
subversion in the grand scheme of things.

Iain Thomson: It would be hard to argue with the use of open source
as a security measure. Firstly, as Shaun points out, a good knowledge of
open-source software is very handy, particularly if you can code your own
applications and don’t have to rely on questionable third parties to supply
them.

Secondly, much of the world’s core infrastructure is run on open-source code,
and a good knowledge of the systems can reap real benefits in terms of staying
off the radar and finding out what you need to know.

Open source may have flaws, as any code will have, but the flaws are few and
the benefits are many.

5.
Smart behaviour


Iain Thomson: While operating under an oppressive regime the
essence to staying hidden is to work under the radar.

If you’re living in a state that has access to potentially all your online
activity you need to be very smart in how you act. Long internet sessions are
bad security, so limit activity to a minimum and leave the modem off for long
periods to reset the IP address if possible.

Avoid your ISP, and never use the built-in search engine. Chances are your
ISP is state-sponsored and will happily, or at least quickly, hand your data
over if requested.

Preserve your anonymity and give out nothing online that you wouldn’t happily
see in print the next day in your local newspaper. Electronic traffic is open to
revelation and the use of code is essential.

Nine times out of 10 the police talk about the fatal flaw that catches the
villain. In fact there’s a lot more detective work that goes on and it’s usually
stupidity that trips people up. But the smart activist doesn’t give their enemy
any clues, and eternal vigilance is the price of liberty.

Shaun Nichols: While at lunch the other day, we were laughing at the
idea that people still need to be told not to crack bomb jokes while in the
airport. But it raised an interesting point in the context of this list: if you
want to keep a low profile while amidst a possibly oppressive group, it’s best
not to attract too much attention to yourself.

There are many simple, commonsense ways for users to stay out of trouble. As
Iain mentioned, knowing where you are and who can see it is the main idea.

Additionally, not falling for scams and social engineering tricks is also
important. The recent malware infections at Google and Adobe were carried out
through ‘spear phishing’ attacks which were specially crafted for each
individual user and intended to look like a genuine document from a co-worker.

It is always a good idea to take a close look at any email attachments and to
be wary of unsolicited messages, even those from friends. This is doubly true if
you’re in a country where the authorities may be out to get you.

4.
Encryption


Shaun Nichols: It may be hard to imagine these days, when
everything from thumb drives to pizza orders is transmitted as encrypted data,
but there was a time when computer encryption tools were considered a danger on
a par with rocket-propelled grenades and automatic weapons.

In World War II, governments learned the importance of cryptography in
sending electronic messages and preventing enemies from intercepting them. The
practice of encoding and decoding was so important, that the UK set up the
Bletchley Park facility and developed what would later become some of the
world’s first computers.

In the decades that followed, cryptography remained a closely guarded
practice that was tightly controlled by governments. In fact, in the US it was
considered illegal to transfer cryptography tools of any sort outside the
country as the technology was classified as “munitions and auxillary military
technology”.

Only in 1995 was the ban officially lifted and citizens were allowed to take
publically available encryption tools outside US borders.

The use of encryption to keep governments or dictatorial regimes out is
obvious: protect transmissions from being intercepted and prevent the recovery
of seized storage drives. But encryption tools can also be a useful way to keep
criminals and data thieves from lifting your info.

Iain Thomson: I would have liked to see encryption higher up the
list, of which more later, since it is fundamental to private and secure online
activity.

In the 1930s the US all but shut down its encryption and code breaking
facilities after US secretary of state Henry Stimson declared that “gentlemen
don’t read other gentlemen’s mail”.

Encryption is a must have for the individual user. It’s appalling that it has
taken Google so long to encrypt its online apps, and I am still gobsmacked by
how many companies don’t bother to encrypt either current data or backups.

Individuals who want their email and other data to remain private must also
get up and do something about it. There are plenty of free encryption services
out there, and every internet user is advised to make use of them.

3.
Mobile phones


Iain Thomson: Mobile phones are a blessing and a curse to the activist.
On the one hand they provide instant communication and, increasingly video
evidence. But on the other they are easily traceable, the encryption is probably
cracked and they are among the first things seized by the authorities.

Mobile phones are very useful in certain circumstances. They can be used for
instant person-to-person conversation, and many of them come with cameras
rivalling most of the handheld camera market. Those pictures can then be
uploaded around the world in seconds.

But there’s a downside. Radio mast triangulation, and increasingly GPS
co-ordinate hacking, mean that mobile phones can actually help pinpoint
so-called troublemakers. A mobile phone is detectable even if it is switched
off, and the only way to avoid this is to remove the battery altogether,
something not possible for iPhone users.

Mobile communications are essential in a system to beat oppression. The
ability to act fast and be in constant contact cannot be underestimated. But
these useful tools come with responsibilities.

Shaun Nichols: The next frontier of electronic activism and privacy
protection is going to be the mobile phone. In fact, it already is. Many
security developers and engineers are working on ways to encrypt phone data and
ensure that attackers cannot compromise the handset.

There is no doubt that mobile phones are incredibly valuable, particularly
now that so many have embedded cameras and audio recorders. However, allow me
one small gripe: the provider.

Much like ISPs tend to roll over to government data requests, mobile phone
service providers are often all too willing to hand over user information, even
in cases where the user poses little to no physical danger to anyone. It’s
definitely foolish to think that anyone using a cell phone is anonymous these
days.

Additionally, there’s the infrastructure issue. As anyone who has tried to
access the mobile broadband networks at a large convention such as CES or CeBit
can tell you, when lots of people are gathering and uploading information, the
networks can quickly become overwhelmed and the flow of data can slow to a crawl
or stop altogether.

2.
Blogs


Shaun Nichols: Perhaps it’s the journalist in me, or perhaps
it’s the unruly new-world colonist in me, but I consider free speech to be
hugely important and I fought long and hard to get this at or near the top of
the list.

With the maturing of the web and the growth of site providers, the concept of
the blog has exploded in the past decade to become a central element of the web
as we know it.

In recent years, the blog has also proved itself an invaluable tool for
giving ordinary citizens a voice and allowing them to speak their minds. Almost
every week, it seems, we find critically important news from some part of the
world that is only emerging through blogs.

With state agencies now tightly controlling the press in so many parts of the
world, blogs are often the only way that the rest of the planet can find out
what’s going on in a region and how the people are truly getting on.

So much effort now is being put into getting computers into remote and
impoverished areas of the world. I believe that shortly after those efforts are
established, someone needs to offer a programme which gives those same
populations free hosting and access to self-publishing tools.

Iain Thomson: Shaun was indeed vociferous in his arguments on this
one, but should blogs really be this high one wonders?

On one level blogs really have become the new political pamphlet, but with a
much wider scope. If Thomas Paine had been alive today I suspect he would be
turning the air blue with purple prose to stir up his readers. One hopes he
wouldn’t be tempted to add LOL to some of them as well.

The importance of the blogosphere in shaping national moods is growing, and
restrictive states are clamping down on bloggers if they don’t follow the party
line. One of China’s leading bloggers has said he is giving up because of the
constant worry that he might end up in prison for expressing his views.

Blogging is particularly effective in states that control the media. Since
the traditional forms of communication are compromised, people automatically
look outside at blogs for an alternative slant on what’s going on. They just
have to find bloggers they trust.

Here in the West the media poses a different problem, since they are the ones
outing anonymous bloggers. A UK court recently ruled that there was no right to
anonymity for bloggers, leading to the shutdown of an informative police blog.

1.
Web proxies


Iain Thomson: In an age of internet communication, anonymity
is surely the best tool for those in the business of getting rid of oppression.

A project known as TOR, a military system developed by the US Naval Research
Laboratory, was taken over by the Electronic Frontier Foundation and is now
being used to shield internet users from repressive regimes around the world.

When the first internet protocols were formed there was little thought of the
future that lay before the internet. There are strong calls for a revision in
the basic IP principles to identify users individually. While this might make
life easier for e-commerce, it would be a death knell for internet users’
freedoms.

Anonymity is what makes the internet so much more subversive than Caxton’s
press ever was. In a minute’s post online, millions more readers can obtain
information than was ever possible under dead tree publishing.

But how people obtain that information has to be safe, and TOR is a valuable
tool in being able to do that. Information on its own is not enough, it has to
be accessed freely.

Shaun Nichols: Again, it’s a fallacy for any user to believe that
they are completely anonymous online. When your computer connects to another
system, it’s invariably going to leave a trail.

As any hacker worth their salt will tell you, the key is to make that trail
as hard to follow as possible. Going through protected connections and servers
is one way to do so, bouncing your connection through numerous proxy systems,
and making the tracking process tedious and difficult.

The Onion Router, or TOR, uses both of these. The general idea is that a
user’s connection goes through a server which then processes the encrypted
connection through a series of proxy servers. The result is a virtual dead-end
for anyone trying to analyse the path a user took.

The ramifications of this are obvious: users can surf the web without being
tracked back to their home systems. Unfortunately, there is also an easy way for
oppressive regimes to prevent this: simply use a filter tool at the ISP level to
block users from accessing the TOR service.

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Thursday 21 January 2010 at 22:07:00

US secretary of state Hillary Clinton has backed up her comments last week on
the
China
Google hack, saying that the US government will work actively to keep the
internet free.

Clinton said in a
speech
at The Newseum in Washington DC that countries which censor internet access
leave their own companies at a disadvantage in the global marketplace, and that
it is vital to keep the internet open for all.

“On their own, new technologies do not take sides in the struggle for freedom
and progress, but the US does,” she said.

“We stand for a single internet where all of humanity has equal access to
knowledge and ideas. And we recognise that the world’s information
infrastructure will become what we and others make of it.

“This challenge may be new, but our responsibility to help ensure the free
exchange of ideas goes back to the birth of our republic.”

Clinton declined to criticise China implicitly, but did call for the Chinese
government to
conduct
an immediate and transparent review of the hacking allegations raised by
Google and others.

“Some countries have erected electronic barriers that prevent their people
from accessing portions of the world’s networks. They have expunged words, names
and phrases from search engine results,” she said.

“They have violated the privacy of citizens who engage in non-violent
political speech. With the spread of these restrictive practices, a new
information curtain is descending across much of the world.”

Clinton maintained that US companies should take a “principled stand” on
behalf of internet freedom, and that this should become part of the “American
brand”.

“We are urging US media companies to take a proactive role in challenging
foreign governments’ demands for censorship and surveillance,” she said.

“The private sector has a shared responsibility to help safeguard free
expression. And when their business dealings threaten to undermine this freedom,
they need to consider what’s right, not simply what’s a quick profit.”

The US government will be holding meetings with key industry players to
hammer out a more coherent policy, she said.

Gigi B. Sohn, president and co-founder of think-tank Public Knowledge,
commended Clinton for raising internet freedom to the level of foreign policy.

“Her speech this morning served to highlight the incredible benefits that
come from a free, interconnected network,” she said.

“At the same time, we should be aware of the benefits of an open internet and
telecommunications network which must be protected domestically as well.

“While Clinton commented on the benefits of text messaging as a means of
expression abroad, there are no legal protections for text messaging here.”

The Chinese government announced yesterday that it will begin censoring
citizens’ text messages.

read more from this topic.....

Phil Muncaster, V3.co.uk, Tuesday 19 January 2010 at 15:28:00

The fallout from Google’s decision to
stop
censoring searches on its Chinese site continued today as it emerged that
the web giant’s plans to further expand its Android phone platform in China have
been halted.

The search giant had planned to launch two Android phones tomorrow, one from
Motorola and one from Samsung, running on the network of Chinese operator China
Unicom, according to reports.

However, a Google spokesperson confirmed today: “The launch we have been
working on with China Unicom has been postponed.”

The firm declined to shed any light on whether the decision had come as a
direct result of its intention to stop filtering internet searches in China,
following a hacking attempt on its systems originating in the country.

It is thought, however, that the sticking point was not the Android platform
itself, but Google applications such as Gmail and Maps, which the phones were
slated to carry. If Google does indeed pull out of the region users of the
phones would have been left high and dry without these features.

The news came as the Chinese authorities referred to Google by name for the
first time since the hacking scandal broke, according to reports.

“Foreign enterprises in China need to adhere to China’s laws and regulations,
respect the interests of the general public and cultural traditions and shoulder
corresponding responsibilities. Google is no exception,” Chinese foreign
ministry spokesman Ma Zhaoxu is reported as saying at a news briefing.

In related news, Google is investigating whether the hacking attack was
facilitated by some of its Google China employees, according to a Reuters report
citing two sources “familiar with the situation”.

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Friday 15 January 2010 at 02:08:00

The accused “underpants bomber” Umar Farouk Abdulmutallab is now being used
by 419 scammers as a method of social engineering.

Researchers at Symantec have come across a 419 letter (named after the
offence in the Nigerian criminal code) that claims to come from the accused
terrorist’s brother, who is attempting to get funds from his account.

The letter says it is looking for a “muslim brother” to provide an account
where the funds can be transferred to via the banking system.

“Without replying to scammer it’s impossible to be sure exactly how the scam
works, but we have every suspicion that it operates like most 419 scams,” said
Nicholas Johnston, senior anti-spam engineer, Symantec Hosted Services.

“Before the non-existent money can be released, various increasingly
inventive fees and charges have to be paid. These fees continue until the victim
of the scam eventually realises that they have no chance of getting any money,
and gives up. Victims are often too embarrassed to contact police, and the
scammers continue.”

This kind of scam is often tied to current events in an attempt to attract
people. Past cases have included the
terror
bombings in London, the
death
of Denis Thatcher and the
war
in Iraq.

The amount such scams can rake in is very large
according
to police. In the US one government official
paid
$1.2m in such a fraud.

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Thursday 14 January 2010 at 03:18:00

US Secretary of State Hillary Clinton has called on the Chinese government to
explain the alleged attacks on Google and around 20 other companies in December.

Google announced yesterday that it is
considering
pulling out of China after a series of hacking attacks against its servers.
Other companies have also given
details
of the attacks, which were highly targeted and aimed at stealing corporate
information or user data.

“We have been briefed by Google on these allegations, which raise very
serious concerns and questions,” Clinton said in a
statement.

“We look to the Chinese government for an explanation. The ability to operate
with confidence in cyber space is critical in a modern society and economy. I
will be giving an address next week on the centrality of internet freedom in the
21st century, and we will have further comment on this matter as the facts
become clear.”

The US Computer & Communications Industry Association trade body for the
industry has joined in requesting the Chinese government to relax its attitude
to censorship.

“It is increasingly apparent that censorship is a barrier to trade, and that
China cannot limit the free flow of information and still comply with its
international trade obligations,” the organisation said.

“The Chinese government has said it is gathering more information before
deciding how to proceed, and we would urge that they look at the issue
holistically with government, economic and trade officials involved in the
decision.”

The Electronic Frontier Foundation has added its voice to calls for Western
companies to reduce or stop dealings with the Chinese regime until it loosens
its grip on internet use.

“Our hope is that other tech companies will follow Google’s lead. Too many of
them have been willing to comply with Chinese demands that they check their
values at the border,” the group said.

“Google has stepped up to this challenge. Now it’s up to technologists and
policy makers to build the tools and to apply the political, economic and
cultural pressure.”

Meanwhile in China people have been visiting Google’s local headquarters and
placing
flowers on the corporate logo outside the building.

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Wednesday 13 January 2010 at 00:03:00

Google has issued a shock announcement that it is to end censoring the
results of its Google.cn search engine, after a series of hacking attacks that
it says was aimed at human rights activists.

The company said in a
posting
on its corporate blog that Google and at least 20 other companies had been
the target of a hacking attack in December.

Google claims to have seen evidence that the attacks were aimed at accessing
the Gmail accounts of Chinese human rights activists.

“These attacks and the surveillance they have uncovered, combined with the
attempts over the past year to further limit free speech on the web, have led us
to conclude that we should review the feasibility of our business operations in
China,” wrote David Drummond, chief legal officer at Google.

“We have decided that we are no longer willing to continue censoring our
results on Google.cn, so over the next few weeks we will be discussing with the
Chinese government the basis on which we could operate an unfiltered search
engine within the law, if at all.

“We recognise that this may well mean having to shut down Google.cn, and
potentially our offices in China.”

Drummond explained that the December attacks were largely unsuccessful, and
resulted only in partial access to two Gmail accounts.

However, the search giant has also discovered that dozens of human rights
campaigners in Europe, the US and China are routinely having their Gmail
accounts accessed by third parties, and suspects that the login details could
have been stolen using malware.

Google started operations in China in 2006 and was widely criticised for its
decision to
bow
to Chinese demands that the information on the site should be censored.
Searches for
Tiananmen
Square, for example, would bring up no mention of the 1989 massacre.

Google co-founder Sergey Brin said later that he
regretted
the decision, and Drummond made clear that the initial decision to censor
was not binding.

“We launched Google.cn in January 2006 in the belief that the benefits of
increased access to information for people in China, and a more open internet,
outweighed our discomfort in agreeing to censor some results,” said Drummond.

“At the time we made clear that we will ‘carefully monitor conditions in
China, including new laws and other restrictions on our services’. If we
determine that we are unable to achieve the objectives outlined, we will not
hesitate to reconsider our approach to China.”

Google’s move is one of the first times that a Western company has taken on
the Chinese government in this way. Companies like Yahoo
routinely
pass user details to the authorities, despite
widespread
international criticism and
legal
action, but today’s announcement will throw down the gauntlet to the Chinese
authorities.

Google.cn has a
strong
market share in China and pulling out completely would be a blow to the
company, albeit one that it can afford for now. Clearly, the evidence of hacking
that Google has amassed is compelling.

read more from this topic.....

Rosalie Marshall, V3.co.uk, Friday 18 December 2009 at 13:06:00

Twitter was hacked and defaced early this morning by a group calling itself
the Iranian Cyber Army.

The Domain Name System hijack occurred at 6am GMT and locked users out of
their accounts for more than two hours.

The message left by the hackers on the micro-blogging site appears to be from
an Iranian group that is against US interference in the country’s politics. The
group also claims to support the party of Mir-Hossein Mousavi, which has
challenged president Mahmoud Ahmadinejad’s power and protested against his
election in June.

The same hacking group has also attacked another web site, Mowjcamp.org,
which has been supportive of the protests.

The background to the message is in black and red with a green flag, the
colours connected to Mousavi.

Part of the message, which we quote verbatim, reads: “U.S.A. think they
controlling and managing internet by their access, but they don’t, we control
and manage internet by our power, so do not try to stimulation Iranian peoples.
“

The US government interfered in Iran’s politics using Twitter during the
uprising by Mousavi supporters. At the time of the protests, the micro-blogging
site was scheduled for maintenance and would have been inaccessible to all
users. But the US intervened to ensure that protesters in Tehran could have
their voices heard.

Twitter has responded to the hack and said that the site is now running
normally.

“Twitter’s DNS records were temporarily compromised tonight but have now been
fixed. As some noticed, Twitter.com was redirected for a while but API and
platform applications were working. We will update with more information and
details once we’ve investigated more fully,” said Twitter co-founder founder Biz
Stone in a
blog
post.

Graham Cluley, senior technology consultant at security firm Sophos, said
that there is no indication that the affected pages are carrying malicious code,
and that the attack appears to be political rather than to steal confidential
information from users.

Cluley explained that his biggest concern is how the hackers managed to
change the DNS for Twitter.

“DNS records work like a telephone book, converting human-readable web site
names like twitter.com into a sequence of numbers understandable by the
internet,” he said.

“What seems to have happened is that someone changed the lookup, so when you
entered twitter.com into your browser you were instead taken to a web site that
wasn’t under Twitter’s control. Just imagine if they had pointed people to a
phishing site posing as Twitter.

“Could it be that cyber criminals managed to guess the passwords used to
secure access to the information, and log in as though they were the
administrators of Twitter’s DNS records?”

Rik Ferguson, senior security advisor at internet security firm Trend Micro,
added: “This attack is called pharming and mostly happens as a result of local
malware modifying individual PCs, not through the compromise of global DNS
records, but the potential is demonstrably there.

“Companies should be monitoring their DNS resolution on several servers to
become aware as early as possible when this kind of attack takes place.”

read more from this topic.....

Rosalie Marshall, V3.co.uk, Tuesday 8 December 2009 at 12:52:00

Google has warned web users of misleading adverts that promise high cash
returns from using the search service.

The scams make promises such as, “Use Google to make 100s of dollars!” and
“Easy cash with Google: you could be making up to $978 a day working from home!”

The use of Google’s name and logo trick people into sending payment
information, said the web giant in a blog
post.

Google said users should keep clear of the following schemes: Google Adwork,
Google ATM, Google Biz Kit, Google Cash, Earn Google Cash Kit, Google Fortune,
Google Marketing Kit, Google Profits, The Home Business Kit for Google, Google
StartUp Kit and Google Works.

“Misleading ads try to take advantage of consumers in the midst of a
difficult economy, and as the economic situation has worsened, the problem has
only grown,” said the blog post.

“Even as we’re taking legal action to try to cut these sites off at the
source, we’re still working constantly to remove scammy URLs from our index, and
we’ll permanently disable AdWords accounts that provide a poor or harmful user
experience, whether or not they use Google’s trademarks illegally.”

Google warned that even though it is fighting the issue, it can not guarantee
the schemes will stop. The firm advised budding web entrepreneurs to create
online businesses that serve users rather than trying to make cash quickly
through an illegal operation.

To highlight its efforts to curb these scams, Google said it is filing a suit
against Pacific WebWorks, which it accuses of defrauding users by offering bogus
e-auction services.

read more from this topic.....

David Neal, V3.co.uk, Friday 27 November 2009 at 12:43:00

The
BCS
Chartered Institute for IT has launched a new
Savvy
Citizens web site designed to boost the technical knowledge of the UK
population.

The organisation said that just 20 per cent of UK citizens are “information
savvy”, and warned that the remainder are missing out on many positive benefits
of new technology.

“Unless all members of society are made aware of how they can access and use
information in their daily lives, the significant proportion of Britons who are
failing to realise the benefits of IT will persist,” said Elizabeth Sparrow,
president of the BCS Chartered Institute for IT.

“This is not just a question of access: information-savvy citizens also know
how to use information and IT to their advantage.”

New research by the BCS found that the most technology-aware citizens are
likely to be men aged 18 to 44, in full time employment and educated to degree
level and above. These men also spend about 10 hours a week involved in
activities such as checking their carbon footprint, reading and publishing
blogs.

The Savvy Citizens site offers advice and recommendations, including guidance
on using price comparison sites, watching video on demand, and boosting personal
online security.

“The research suggests that, in some areas, people are becoming savvier about
the value of information. But, at the same time, almost one third don’t take
even basic safety precautions, like using strong passwords, to protect their
identities,” said Sparrow.

“It is vital therefore that those citizens are informed about how IT can
improve their lives. Until this is achieved, large sections of society are at
risk of losing out. Education, attitude and skills are key if we want to create
an information society with information-savvy citizens.”

read more from this topic.....

V3.co.uk, Wednesday 25 November 2009 at 03:04:00

Iain Thomson and Shaun Nichols discuss the hot news from the US in recent
days. This week we look at iPhone malware, pressure on the EU from the US
Senate, a controversial attack on climate change and AOL’s attempt to rebrand
itself.

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Saturday 7 November 2009 at 08:31:00

Reports in Der Spiegel suggest that the Israeli air strike against
claimed nuclear facilities in Syria were targeted after Mossad successfully
hacked a laptop left in a London hotel bedroom.

The report says that in late 2006 a senior Syrian diplomat staying in London
left his laptop unattended in a London hotel, giving Mossad the chance to
install a Trojan on the computer that allowed communications to be monitored.

On September 6 the next year the Israeli air force carried out a strike on
the Syrian Al Kabir complex in the east of the country. Syrian government media
gave little details of the attack, other than to say that Israeli aircraft had
dropped munitions on an empty portion of the country before being seen off by
local air defences.

In 2008, the International Atomic Energy Agency analysed soil at Al Kabir and
found it contained uranium elements not included in Syria’s nuclear inventory.
Sources in Syria suggest the material was dropped by Israeli planes to justify
the attack.

Security expert Bruce Schneier
highlighted
the case in his blog, saying it was similar to an attack carried out in 2009
where an outside party could install malware on a separate bootloader segment on
the hard drive so that it would access any files, even if encrypted. He calls it
the
”
evil maid” attack.

“Remember the evil maid attack: if an attacker gets hold of your computer
temporarily, he can bypass your encryption software,” he said.

The physical security of laptop computers is an increasingly important issue
for those travelling abroad. The US government has
warned
visitors to China to keep their laptops under constant surveillance while in the
country.

read more from this topic.....

David Neal, V3.co.uk, Friday 16 October 2009 at 17:16:00

Business consultancy Detica has stepped into the ID fraud debate, urging
internet service providers (ISPs) to boost security and warning consumers to
take more responsibility for their faults.

Mark Dampster, head of business development for Detica StreamShield, argued
that the very fact that email security breaches are able to occur demonstrates
the “huge gaps in cyber security that we still face”.

“To make ourselves safer we must get past trying to assign blame or
responsibility to one group,” he said. “It is the shared duty of ISPs and
computer users to ensure online security, and a combined effort will make our
cyber resilience much more robust.”

Dampster suggested that ISPs should introduce software that can mitigate the
threat of spam attacks such as phishing emails by scanning messages before they
reach consumers.

Computer users, meanwhile, should keep software up to date and patched, while
also taking more care of personal information and the places where it is shared,
and changing passwords at regular intervals.

“Online fraudsters are increasingly using ‘soft’ psychological techniques
that exploit fear, greed, ignorance and haste. Tricking a human being can be a
lot easier and more fruitful than hacking secure technology,” said Dampster.

“Users still need to think ‘safety first’ and use common sense. By
recognising that cyber space is shared territory where we all have
responsibilities for security, we can ensure that the internet is as safe as
possible.

“This not only protects consumers, but opens up great opportunities for ISPs
to add value to consumers and gain a competitive edge.”

The warnings came at the end of
National
Fraud Prevention Week.

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Wednesday 14 October 2009 at 21:43:00

The executive director of the
Coalition
for an Airline Passengers’ Bill of Rights has filed a lawsuit claiming that
her email accounts were hacked by Delta Air Lines.

Kate Hanni said in court documents that she had been in an email exchange
with Frederick Foreman, a researcher at a firm called Metron, who was looking
into flight delays. She claims that her AOL account was attacked during these
conversations, and that some of the emails ended up in the hands of Delta
executives.

Foreman had been hired by the Federal Aviation Administration to look into
the statistics of flight delays. Metron had cleared him to talk with Hanni, but
then fired him after confronting him with the emails, he said.

“When Foreman asked Metron how Metron obtained the information, Metron
claimed that Delta had provided them with the stolen emails,” said the court
documents. “Confirming Metron’s claims, the screenshots of the stolen emails
presented to Foreman were from Delta. Foreman was fired by Metron the same day.
“

Foreman said that the emails he saw covered exchanges between Hanni and
himself, as well as between Hanni and her attorney, and emails to journalists.

Meanwhile, Hanni claimed that AOL and Microsoft had confirmed that her PC had
been hacked and the password changed. When she did manage to get access to her
computer, she found that some files had been copied from her system and that
others were hopelessly corrupted.

Hanni is campaigning for an air passengers’ bill of rights that would force
airlines to provide food, water and medical attention to passengers stuck in
planes waiting to take off for more than three hours. She claims that some
passengers have spent as long as 11 hours on the tarmac waiting to take off.

Hanni claimed that such a bill, if made into law, could cost Delta around
$40m (£24m) a year given the company’s record of delays.

Delta has dismissed the charges as “ridiculous”, and Metron has denied any
wrongdoing.

The case has disturbing similarities with the
spying
scandal at HP, and a
bugging
incident at Deutsche Telekom.

read more from this topic.....

Shaun Nichols in San Francisco, V3.co.uk, Wednesday 30 September 2009 at 01:31:00

Security experts have warned of a new malware attack that masquerades as a
tax document.

The US Computer Emergency Response Team (US-Cert) said that it had received
numerous reports of malicious spam messages claiming to be from the US Internal
Revenue Service (IRS).

The messages claim that the IRS has discovered unreported income from the
recipient’s tax forms, and instructs them to open additional material attached
to the email.

Rather than receiving tax forms, however, the victim becomes infected with a
Trojan downloader which attempts to compromise the system with further malware
installations.

The use of phoney tax forms and other
seemingly
official documents has become a popular method for infecting users with
malware. Security experts noted that such attacks often increase in size and
scope during the tax season.

US-Cert is advising people who receive the emails to avoid opening any
attachments, and to contact the IRS through its
scam
reporting site.

The agency pointed out that it does not send notice of fees or other official
documents via email.

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Sunday 6 September 2009 at 07:08:00

A woman has been conned out of $4,000 (£2,400) by scammers who hacked into a
Facebook page belonging to one of her friends.

Jayne Scherrman lost the money after her friend Grace Parry had her log-in
details stolen. Parry’s friends started receiving messages saying that she and
her husband had been robbed in London and needed funds to get home.

Scherrman received several of the messages, as well as a call from a man with
a British accent claiming to be an immigration official.

“He said the woman and her husband were being detained and that more money
was needed to fly them home,” police spokesman Jason Selzer told the Press
Association. “She sent three different wire transfers to London.”

Scherrman sent the money to help out her friend, while Parry was trying to
get the word out that she had been hacked, but was locked out of her account.

“The sad truth is that people are far too trusting of messages they receive
via social networks,” said Graham Cluley, senior technology consultant with
Sophos.

“Just because it appears to come from a friend doesn’t mean that it’s a
friend who typed and sent it. It’s perfectly possible that your online friends
have had their account passwords stolen and have lost control of their Facebook
profiles.”

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Friday 4 September 2009 at 03:29:00

UK information commissioner Christopher Graham has said in testimony to the
House of Commons Select Committee on Culture, Media and Sport that parliament,
the courts and journalists are hampering efforts to protect personal data.

Graham said that an investigation by the Information Commissioner’s Office
had found evidence of requests by over 300 journalists for more than 17,000
searches into private data in 2006, but that parliament had still not addressed
the issue.

“We were let down by the courts, which did not seem to be interested in
levying even the pathetic fines they had at their disposal,” he said, according
to a report in The Guardian.

“We were rather let down by parliament in the end with no legislation, and we
were let down by the newspaper groups which did not take it seriously.”

Graham recommended that the penalties for breaching the Data Protection Act
should be increased to include jail terms for serious offenders. This would end
much of the abuse “at a stroke”, he said.

Also up before the committee were members of the Metropolitan Police who had
investigated past claims of data protection breaches.

Assistant commissioner John Yates defended the limited scale of the police
investigation into allegations that the News of the World
hacked
into mobile phones owned by members of the royal family.

Tom Watson, MP for West Bromwich East, asked Yates: “Doesn’t it look
suspicious that [private investigator Glenn] Mulcaire and [News of the
World royal editor Clive] Goodman may have been tapping royal princes’
phones, and committed a serious crime that undermined their own reputations and
that of their employers, and their employers give them a undisclosed pay-off and
no one has gone back to them and asked what that financial arrangement is about?
“

Yates replied: “It is not our business.”

read more from this topic.....

Iain Thomson in San Francisco, V3.co.uk, Thursday 20 August 2009 at 08:22:00

The Radisson hotel chain has warned customers about potential identity theft
after admitting that its servers had been hacked.

The company said that unknown persons had breached the company’s defences,
and that credit card information may have been stolen. Investigations into the
hack are still continuing, and Radisson is not sure how much data may have been
copied.

“Working with law enforcement and forensic investigators we are conducting a
thorough review of the potentially affected computer systems, and have
implemented additional security measures designed to prevent a recurrence of
such an attack and to protect guest privacy,” said Fredrik Korallus, executive
vice president and chief operating officer at Radisson, in a statement.

The data breaches occurred between November 2008 and May 2009. Customers are
being advised to check their bank statements for unusual activity, and Radisson
has set up a
FAQ
to offer help and guidance on the situation.

Radisson said that the stolen information did not include social security
numbers, but may have involved credit card details. Information from credit card
vendors alerted the firm to the hack.

read more from this topic.....

Ian Williams, V3.co.uk, Tuesday 18 August 2009 at 14:52:00

There are many anti-virus and internet security suites available these days,
and it can be difficult to decide which one to install. In this review we’ll be
putting two of the latest to arrive on the scene,
F-Secure
Internet Security 2010 (IS2010) and
Sunbelt
Vipre, head to head to determine which is better at protecting your valuable
data.

Both install very easily, although IS2010 provides a more robust set of
options when choosing the manual install route. The IS2010 install comes in at
around 70MB, and Vipre at a very lean 16MB.

The products work just fine on Windows XP and Vista, but for those of you who
have already upgraded to the Windows 7 release candidate, or are planning to
upgrade to the new Microsoft operating system when it becomes available, it’s
worth noting that several security applications don’t yet work on Windows 7.

IS2010 had no problems on Windows 7, but we had to use a new beta version of
Vipre in order to get all the functionality working properly. This should be a
full release soon, so we’ll give it a pass on that one.

System performance


Anti-virus programs have come a long way in recent years in terms of
monitoring systems without significantly impacting performance. Some of this is
thanks to improvements in hardware, but a lot of it is down to more efficient
processes.

We installed both suites on separate partitions of a Samsung netbook with 2GB
of memory, and ran Passmark’s Performance Test before and after to gauge the
impact of the applications on the system. Happily, neither IS2010 nor Vipre had
any discernable effect on the Performance Test score, which consistently came
out around the 200 mark before and after installing the security suites.

Vipre takes up only around 17MB of system memory across just two processes,
while IS2010 is a bit more heavy handed, requiring around 35MB across nine
separate processes.

The main screen on both products provides status information, but F-Secure’s
newly revamped interface wins out as the most user friendly with its large icons
and simple menus, while Vipre goes for a more matter-of-fact layout.

IS2010 does offer a bit more in the way of features, with optional packet
logging for technical users, customisable parental controls and a plug-in for
internet browsers with icons next to each link to represent the safety of the
site being pointed to. Unlike AVG, which has a similar feature, this is not just
within the search results but with all links, even in webmail applications.

The parental controls can be configured for children and teenagers, and can
limit the number of hours spent online and/or the times that the internet can be
accessed, as well as restricting the sites and type of content.

Vipre, on the other hand, provides a worldwide threat level meter on the main
page representing the overall threat landscape, as well as a secure file eraser
and history cleaner to help ensure that any of this information can easily be
removed and not recovered. Vipre also features something it calls PC Explorer,
which lets users look deeper into several of the individual running processes to
see the source of various processes, internet applications and ActiveX content.

For notebook users, Vipre provides a battery conservation option which turns
off automatic updates and scheduled scans when the device is not plugged in to a
power source. Although the impact of this is relatively minimal, it could save
some frustration for end users trying to stop these actions while out and about.

As well as virus and malware protection, both also provide a firewall and
email scanning as part of the package.

Threat protection scores


To test the security of the applications we used Comodo Leaktests version
1.1.0.3. Both scored 160 out of 340, meaning that each passed just under half of
the tests. It’s important to note that this doesn’t meant that either of these
products will only protect your PC against half of the threats out there.
Firstly, some rely on being actively run by the user in administration mode,
and, although it means that the attack vector is possible, many would be
detected if it contained a malicious payload.

Full scans


When it came to running the default full scans, Vipre looks like it comes out on
top. Although it took around an hour to run its deep scan, it reported having
searched through 128,381 objects, while IS2010 took just 20 minutes but only
reported scanning 37,553 objects. It’s slightly worrying that Vipre initially
reported several false positives (including the local version of Wordpad and one
F-Secure file residing on the other partition) but this appears to be due to a
few bugs in the beta version we were running. After a reinstall and another
update we were unable to replicate this.

IS2010 will be available from 3 September at £39.95 for a one-year three-PC
licence, while Vipre offers several options including a one-year single-user
licence priced at £29.95 and a Home Site package which provides a one-year
subscription for all PCs located at a single residence for £49.94.

It’s a close call between the two and really comes down to the individual
user, and their requirements and technical skill. But, according to our tests,
both security suites should help defend your PC against most attacks and, while
Vipre’s lean design and deep searches are a bit better suited to more advanced
users, IS2010 is an excellent option for a more general user, thanks largely to
its more user-friendly interface and options.

From a purely financial perspective, those with a single PC or more than
three in one location may find it more economical to opt for Vipre.

For more information on setting up and running F-Secure Internet Security
2010, we’ve also posted up a step-by-step
photo
guide.

read more from this topic.....

Rosalie Marshall, V3.co.uk, Friday 7 August 2009 at 14:56:00

The UK government has vigorously denied claims in a Daily Mail
report that it is easy for hackers to modify the data on ID cards.

The report said that a hacker known as Adam Laurie had managed to clone all
the information on a foreign national’s card, and then change the data to
entitle the individual to benefits and label him a terrorist for police to shoot
on sight.

ID cards are currently voluntary for British citizens, but foreign nationals
are required to hold one to show that they have the right to work in the UK. The
Home Office said recently that plans are underway to ensure that 75,000 are
issued for this purpose by November.

However, the Daily Mail report claimed to show that the microchip on
the card, which contains details such as date of birth, fingerprints and
physical statistics, is easy to break into using only a mobile and laptop.

“This story is rubbish. We are satisfied that the personal data on the chip
cannot be changed or modified, and there is no evidence this has happened,”
said a Home Office spokesman this morning.

“The identity card includes a number of design and security features that are
extremely difficult to replicate.”

read more from this topic.....

Shaun Nichols in San Francisco, V3.co.uk, Monday 3 August 2009 at 23:46:00

An attendee at the
DefCon
security conference has uncovered an ATM scam targeting guests at a popular Las
Vegas hotel.

According to a Forbes report, the man discovered a phoney machine located in
the casino section of the Riviera Hotel, which was hosting the annual hacking
and security research convention.

The fake machine was said to be operating as an unbranded ATM, and was
spotted only when the attendee noticed abnormalities with the machine’s LED
lights and glass display.

On further inspection, the machine was found to be housing a PC which was
believed to be logging card information and PINs for future fraud and identity
theft. The bogus machine and its contents have been handed over to law
enforcement.

The scam is part of a booming criminal industry around the procurement and
trading of bank and credit card information. Cyber criminals have used tactics
ranging from fake and compromised ATMs to phishing and key-logging tools to
obtain card information in a practice known as ‘carding’.

The stolen information is then sold online through IRC channels, or forums
such as the infamous and
now
defunct Dark Market, and ultimately used for identity theft and fraud.

read more from this topic.....

Shaun Nichols in San Francisco, V3.co.uk, Monday 27 July 2009 at 23:09:00

US telecoms giant AT&T found itself blocking traffic from
4chan this
weekend after the controversial image bulletin board allegedly pushed out a
denial-of-service attack.

AT&T said in a statement on Monday that it placed a block on traffic from
4chan on 24 July after the site’s host was said to be the source of an online
attack. The block remained in place throughout the weekend, and was only lifted
on Sunday evening after AT&T determined that 4chan no longer posed a threat.

The telco maintained that the block was purely a security measure, and not an
effort to filter potentially objectionable content.

“To prevent this attack from disrupting service for the impacted AT&T
customer, and to prevent the attack from spreading to impact our other
customers, AT&T temporarily blocked access to the IP addresses in question
for our customers,” the company said in a statement.

“This action was in no way related to the content at img.4chan.org; our focus
was on protecting our customers from malicious traffic.”

Generating headlines and controversy are nothing new for 4chan. The site’s /b
message board has long held a reputation for fostering web phenomena, from
internet memes such as Rickrolling and Advice Dog, to more serious movements
such as the Anonymous activist group and the
2008
hack of US vice presidential candidate Sarah Palin’s email account.

4chan’s founder, who is known only as ‘moot’, confirmed in a
blog
post that the block was not intended to censor content, but was instead the
result of an issue which stemmed from 4chan’s efforts to block a distributed
denial-of-service attack on its own servers.

“In the end, this wasn’t a sinister act of censorship, but rather a bit of a
mistake and a poorly executed, disproportionate response on AT&T’s part,”
said ‘moot’. “Whoever pulled the trigger on blackholing the site probably didn’t
anticipate the consequences of doing so.”

read more from this topic.....

Shaun Nichols in San Francisco, V3.co.uk, Wednesday 15 July 2009 at 23:05:00

A recent system hack targeting a Twitter employee has led to a major data
breach at the micro-blogging site.

Twitter co-founder Biz Stone said on Wednesday that the breach exposed a
number of internal documents, but that no information regarding account
credentials for the Twitter service itself was compromised.

The incident began in May when a French hacker known as ‘Hacker Croll’
broke
into the email account of a Twitter executive, and gained access to a number
of documents through the company’s Google Apps account.

Earlier this week, the hacker began releasing the documents to a number of
news outlets. The items reportedly include information from company meetings,
plans for a television programme and details on the security systems at
Twitter’s headquarters.

Stone assured Twitter users in a
blog
post that no account information was among the stolen data.

“It’s important to note that the stolen documents which where downloaded and
offered to various blogs and publications are not Twitter user accounts, nor
were any user accounts compromised except for a screenshot of one person’s
account and we contacted that person and recommended changing their password,”
he wrote.

“This was not a hack on the Twitter service. It was a personal attack
followed by the theft of private company documents.”

read more from this topic.....

David Neal, V3.co.uk, Thursday 9 July 2009 at 12:42:00

Police are investigating claims of widespread telephone hacking by the
News of the World, according to a report in The Guardian.

The report alleges that telephone hacking carried out by private
investigators at the behest of the Sunday tabloid runs into the thousands, and
includes phone lines owned by politicians and celebrities.

The Guardian broke the story when it discovered that News Group
Newspapers (NGN), which owns the News of the World and The
Sun, had paid out over £1m to settle legal cases relating to its
journalists’ sources. The Guardian accused NGN of “repeated involvement
in the use of criminal methods to get stories”.

The alleged incidents date back to 2006 when Clive Goodman, the News of
the World royal editor, was arrested on suspicion of illegally intercepting
phone calls, along with Glenn Mulcaire, a private detective.

“Scotland Yard had previously been contacted by members of the royal
household who suspected their mobile phones had been hacked into,” said The
Guardian report. “A series of stories in the paper seemed to be based on
voicemails left on their phones.”

A number of other incidents have been identified since that time, and News
International, parent company of NGN, has since paid out £700,000 in damages to
the Professional Footballers’ Association over similar allegations.

The Guardian has claimed that three cases involving the group and
its use of private investigators have been settled out of court.

The News of the World‘s former editor, Andy Coulson, now the
Conservative Party communications director, appears to have shrugged off the
claims, but Metropolitan Police Commissioner Sir Paul Stephenson has apparently
ordered that a senior officer “establish the facts” on the case.

At the time of writing, the following appeared on former deputy prime
minister John Prescott’s Twitter feed: “Whittingdale just confirmed Coulson
would probably be asked to give evidence on NOTW hacking at CMS Select
Committee.”

The message suggests that Coulson will face scrutiny in the House of Commons
as well as the police investigation.

A statement from the police is due later today.

read more from this topic.....