Log inRegister

Fraud News

The potential scenario of this cybersecurity flaw being exploited is not as severe, as say, the plot from the movie Wargames, but several major holes have been found in defense facilities housing technical information on the nation’s ballistic missile defense systems (BMDS) that could prove disastrous to America’s ability to defend itself against an ICBM attack.

In a report filed last week, the Inspector General (IG) for the Department of Defense found systematic issues surrounding BMDS networks that process, store and transmit both classified and unclassified BMDS technical information. Some of the problems included not using multifactor authentication, protecting removable media holding classified information, encrypt BMDS technical information transmission and implement intrusion detection capabilities.

“We determined that officials did not consistently implement security controls and processes to protect BMDS technical information,” the report stated, “facility security officers did not consistently implement physical security controls to limit unauthorized access to facilities that managed BMDS technical information.”

The weapons in the ballistic missile defense system are not nuclear-tipped offensive missiles but are part of the nation’s land and sea-based defensive anti-missile systems.

“The disclosure of technical details could allow U.S. adversaries to circumvent BMDS capabilities, leaving the United States vulnerable to deadly missile attacks,” the report stated.

The IG noted the weaknesses exist and persist because those in charge do not consistently verify whether or not the security protocols put in place are actually effective.

The report suggested eight recommendations be made:

• using multifactor authentication;
• mitigating vulnerabilities in a timely manner;
• protecting data on removable media; and
• implementing intrusion detection capabilities.
• enforce the use of multifactor authentication to access systems that process, store, and transmit BMDS technical information or obtain a waiver from using multifactor authentication from the DoD Chief Information Officer;
• develop plans and take appropriate and timely steps to mitigate known vulnerabilities;
• encrypt BMDS technical information stored on removable media; and
• assess gaps in physical security coverage and install security cameras to monitor personnel movements throughout facilities.

Lamar Bailey, Tripwire’s director of security research and development, pointed out that at first glance this report looks “horrible”, but he noted the report covered very few defense facilities and the main takeaway was security was not consistently applied across the board.

“[The report] shows results for the facilities visited broken down into weaknesses in the seven areas audited. Only one audit hit all five locations and this dealt with justification for access. Five of the weaknesses say they were not “consistently” used but this can apply to “administrative, facility, a lab or both” so they may not apply to the networks with the defense/offense controls.  This audit was also only done at five facilities, which is less than 5 percent of the facilities in operation,” he said.

Apps on a smartphone Image copyright Getty Images Image caption The report suggests YouTube, Tumblr, Pinterest, Instagram and Google+ were affected by Russian interference, as well as Facebook and Twitter

Russia used every major social media platform to try to influence the 2016 US election, a report claims.

New research says YouTube, Tumblr, Instagram and PayPal - as well as Facebook and Twitter - were leveraged to spread propaganda.

The report, released today by the US Senate, exposes the scale of Russian disinformation efforts.

Its authors criticise the "belated and unco-ordinated response" by tech firms.

The report was put together by University of Oxford's Computational Propaganda Project and the social network analysis firm Graphika.

It is the first analysis of millions of social media posts provided by Twitter, Google and Facebook to the Senate Intelligence Committee.

While Facebook and Twitter have previously disclosed Russian interference, little has been known about the use of other platforms.

The report suggests YouTube, Tumblr, PayPal and Google+ were all affected, with Russia adapting techniques from digital marketing to target audiences across multiple channels.

"It's a whole family of social media sites," says Philip N Howard, director of the Oxford Internet Institute. "We think the goal was to make the campaigns seem more legitimate."

The research details a vast campaign spearheaded by the Internet Research Agency (IRA) - a Russian company that has been described by the United States Intelligence Community as a troll farm with ties to the Russian government.

The report says Russia had a particular focus on targeting conservatives with posts on immigration, race and gun rights.

There were also efforts to undermine the voting power of left-leaning African-American citizens, by spreading misinformation about the electoral process.

Another report, also released today by the Senate, by the research firm New Knowledge, similarly highlights Russia's efforts to target African-Americans.

It explains how Russia's IRA were focused on "developing Black audiences and recruiting Black Americans as assets," which included encouraging activists to stage rallies.

One IRA campaign highlighted in the Oxford and Graphika paper, Black Matters US, existed across Twitter, Facebook, Instagram, YouTube, Google+, Tumblr and PayPal. These various accounts would promote each other's posts and events.

When Facebook suspended the group on its platform, the group's Twitter account complained about the move and accused the social network of "supporting white supremacy".

Image copyright AFP Image caption Donald Trump beat Hillary Clinton in the 2016 US presidential election

"What is clear is that all of the messaging clearly sought to benefit the Republican Party - and specifically Donald Trump," the report says.

"Trump is mentioned most in campaigns targeting conservatives and right-wing voters, where the messaging encouraged these groups to support his campaign. The main groups that could challenge Trump were then provided messaging that sought to confuse, distract and ultimately discourage members from voting."

While the data used by the researchers was provided by Facebook, Twitter and Google, their findings criticise the "belated and uncoordinated response" from these companies to Russia's disinformation campaign.

The researchers highlight details that could have led internet companies to detect interference earlier, such as the use of the Russian rouble to buy advertisements and internet signatures relating to the IRA's base of operations.

The BBC has asked Russia's Embassy in the UK for comment.

The IRA was among the three companies indicted earlier this year, as part of special counsel Robert Mueller's investigation into Russian interference in the 2016 election. Twelve of the agency's employees faced indictment charges, as well as its alleged financier, Yevgeny Prigozhin.

"Social media have gone from being the natural infrastructure for sharing collective grievances and co-ordinating civic engagement, to being a computational tool for social control, manipulated by canny political consultants and available to politicians in democracies and dictatorships alike," the report says.

Hacked message Image caption This text and image form part of a longer document sent to the printers

Hackers have taken control of printers around the world.

It is the latest in a series of such attacks, but this time they say they have the power to destroy the machines.

The stunt was first carried out last month, when one member claimed to have forced about 50,000 printers to create posters supporting his favourite vlogger PewDiePie.

The latest incident again urges support for the YouTuber, but also calls on victims to improve their security.

"I've been trying to show that 'hacking' isn't a game or toy, it can have serious real-life consequences," the original hacker told the BBC, speaking anonymously online.

"We really want people to pay attention to this because causing physical damage is very much a possibility."

He explained that flaws in the printers' firmware meant that he could continuously force data to be written to their chips.

"These chips have a limited lifetime of 'writes'," he explained.

"If you keep the loop on enough, the chip will fry and the printer will no longer function."

Hijacked files

The potential financial costs to this are obvious but the hacker also pointed to another danger that his stunt has thrown up.

"The fallout goes beyond print-outs, we could also be capturing sensitive documents as they get printed or even modify documents as they get printed."

Although the hacker can geo-locate the countries that he is affecting, it's not clear whether or not a targeted attack on an individual company or household is possible.

The hackers claim to have printed out their latest message on more than 100,000 machines.

The BBC has not been able to verify the claim, but people from countries including the UK, US, Argentina, Spain, Australia and Chile have posted pictures on social media of the latest print-outs.

More people are expected to notice their printers have created copies of the poster when they return to work on Monday.

It reads: "PewDiePie is in trouble and he needs your help to defeat T-Series!"

The message then instructs readers to subscribe to the YouTuber before adding: "Seriously. Fix your printer. It can be abused!"

PewDiePie has been YouTube's most subscribed to creator since 2013. He currently has about 77 million followers on the platform.

Over recent months, the Indian music label and movie studio T-Series has come close to overtaking his lead, which has led some PewDiePie fans to mount stunts to attract new subscribers.

Image copyright Getty Images Image caption Felix Kjellberg - who is known as PewDiePie - is currently YouTube's most subscribed-to creator

'Act now'

Security vendors say that the stunt shows just how vulnerable some organisations can be to attack through the plethora of connected devices that fill modern office spaces.

Their advice is to:

carry out regular audits of connected devices install the latest security patches question whether or not everything connected to the internet really needs to be

"The risk of causing financial damage in this case is as real as it gets," commented Bob Reny from the security firm ForeScout.

"And all of this because organisations or individuals installed a connected device without really taking the time to audit the implications this has on their existing network security infrastructure."

The hackers provided contact details on the latest print-outs as a way to allow people to get in touch if they needed further help fix the exploited flaw.

One told the BBC that they believed they were breaking the law, but still thought their act was justified.

"While authorities might not see eye to eye with us, what we're doing is much better than someone destroying printers and offices around the world in an attempt to hold printers ransom or something."

Vulnerabilities in network printers have been known about for years but many people are unaware of the risks.

One security researcher who has studied the problem confirmed it was possible to destroy the machines by sending them commands from afar.

"These devices should never be directly reachable over the internet," said Jens Mueller from Ruhr-University in Germany.

"Who is to blame? [In offices] definitely the network administrators allowing direct access to their devices over the internet."

No data encryption, no antivirus programs, no multifactor authentication mechanisms, and 28-year-old unpatched vulnerabilities are just some of the cyber-security failings described in a security audit of the US' ballistic missile system released on Friday by the US Department of Defense Inspector General (DOD IG).

The report [PDF] was put together earlier this year, in April, after DOD IG officials inspected five random locations where the Missile Defense Agency (MDA) had placed ballistic missiles part of the Ballistic Missile Defense System (BMDS) --a DOD program developed to protect US territories by launching ballistic missiles to intercept enemy nuclear rockets.

bmds.png Image: DOD MDA

But this recent security audit has concluded that "the Army, Navy, and MDA did not protect networks and systems that process, store, and transmit BMDS technical information ."

Multifactor authentication was not consistently used

Auditors found several problematic areas. The biggest of these was in relation to multifactor authentication.

Under normal circumstances, any new MDA employee would receive a username and password that they can use to access BMDS' network. As new employees are eased into their new jobs, they'd also receive a common access card (CAC) that they'd have to enable for their accounts and use together with their password, as a second-factor authentication. Normal procedure says that all new MDA workers must use multifactor authentication within two weeks of being hired.

But the DOD IG report says that at three of the five inspected locations, investigators found that many users did not enable multifactor authentication for their accounts, and were still using their username and password to access BMDS' network.

One user had accessed BMDS data for seven years without the protection provided by their card, and at one MDA site, investigators said they also found that the network was never configured to support multifactor authentication at all.

The lack of a multifactor authentication means that employees are vulnerable to phishing attacks that could collect their passwords and allow attackers remote or on-premise access to BMDS systems without further security challenges (second authentication factor).

Vulnerabilities were not consistently patched

However, the report found even more worrisome problems. DOD IG inspectors found that IT administrators at three of the five locations they visited had failed to apply security patches, leaving computers and adjacent network systems vulnerable to remote or local attacks.

Investigators found that systems were not patched for vulnerabilities discovered and fixed in 2016, 2013, and even going as far as back as 1990.

The DOD IG report is heavily redacted in this particular section, suggesting that MDA administrators are still patching these flaws.

Server racks not secured

Aside from software flaws, investigators also found physical security issues. For example, at two locations investigators found that server racks unlocked and easily accessible.

Any attacker, guest, or visitors who gained access or was invited to one of these locations could have easily plugged in a malicious device in one of these server racks.

Confronted with the unlocked racks, one of the data center managers said he wasn't aware of this security protocol, and even played down its importance by saying that the base limited who could access the data center anyway.

In the second location, the server rack was unlocked even if the rack featured a sign stating that the server door must remain locked at all times.

Removable media data was not encrypted

Another report finding was that MDA officials did not consistently use encryption when moving data between air-gapped systems using removable media.

MDA officials blamed this on "legacy systems that lacked the capability and bandwidth to encrypt data, did not have the resources to purchase encryption software, and used encryption software that did not always align with DoD encryption software."

This issue was discovered at three locations. At one, officials said they weren't even aware that they were supposed to encrypt data stored on removable media, while another official said they didn't even have the controls and systems in place to detect when an employee was downloading data to removable media, let alone see if the data was unencrypted.

No intrusion detection system

DOD IG officials also discovered that at one MDA location, IT administrators failed to install an intrusion detection and prevention system --also known as an antivirus or security product.

"Without intrusion detection and prevention capabilities, [REDACTED] cannot detect malicious attempts to access its networks and prevent cyberattacks designed to obtain unauthorized access and exfiltrate sensitive BMDS technical information from occurring," the report said.

Local MDA officials at that location blamed the issue on their supervisors, who, they said, failed to approve a request for the proper software, which they filed almost a year before.

bmds-findings.pngbmds-findings.png Image: DOD IG

No database with written justifications

But besides physical and cyber-security-related issues, there was also a logistics and management related slip-up. According to the report, all the five locations DOD IG officials visited failed to maintain a database of written justifications of why employees received access to the BMDS network.

Without this database, officials didn't know the exact reason why employees needed access to the system, and couldn't enforce a "least privilege" access hierarchy.

DOD IG investigators said that in a random test, they selected a small sample of employees from each BMDS location and asked to see their access forms. In all cases, access justification forms weren't complete, and in some, administrators couldn't provide forms for some employees at all.

Woeful physical security controls

But more disheartening was the report's findings on the physical security controls implemented at several of these MDA bases.

Auditors said that in many cases surveillance cameras failed to cover the entire base, creating gaps that an attacker could exploit to enter the groundwork and buildings.

Furthermore, there were also issues with door sensors that showed doors as closed, when they were not, and with some facilities that didn't lock doors.

Last but not least, MDA personnel didn't challenge auditors who entered buildings without proper badges, allowing unauthorized personnel to wander around through top secret buildings.

The MDA currently has 104 ballistic missile locations and plans to build another 10. But if it doesn't improve both its physical and cyber-security protections, these bases could be easily attacked in case of a conflict. The DOD IG report made a set of recommendations that top officials and the rest of the MDA bases are now supposed to review and implement.

In October, the US Government Accountability Office (GAO) found that new next-gen computerized weapons systems that are currently under development at the Pentagon also featured similar cyber-security-related problems and were easy to hack.

More cyber-security coverage:

An Arizona real estate agent was shocked when a voice started broadcasting from his Nest security camera recently, addressing him directly.

Andy Gregg was in his backyard when he heard the voice, belonging to someone who claimed to be a “white hat hacker” from Canada, Gregg told the Arizona Republic. A white hat hacker is a hacker who exposes security vulnerabilities for the greater good, rather than their own benefit.

Gregg recorded the conversation that followed. In the video, a voice can be heard over the speaker telling Gregg that he was contacting him in the creepiest way possible to warn him about the security risks of his internet-connected camera.

“We don’t have any malicious intent, but I’m just here to kind of let you know so that no one else, like any black-hat hackers, follow,” the voice can be heard saying. “There are so many malicious things somebody could do with this.”

It’s worth noting that the “hack” here was not particularly sophisticated, if it went down as described.

Gregg told the newspaper that the hacker told him his private information had been “compromised,” and recited to Gregg a password that he had used for multiple websites. Since Gregg used the same password for his Nest, and apparently didn’t use two-factor authentication, it would have been easy for anyone with that information to log in remotely to the camera.

There have been numerous data breaches that leaked usernames, emails, and passwords for millions of people, and databases containing such information are bought and sold online, and Nest said to the Arizona Republic in a statement that it was aware passwords stolen in hacks of other companies have been used to access its cameras.

The creepy incident is a reminder of why it’s important to set up basic security and privacy protections, such as using a password manager (so your password is different for every account), and setting up two-factor authentication (so even if someone steals your password, they can’t log in to your account very easily). To help you set up two-factor authentication, see this website and keep in mind that experts don’t consider SMS a secure second factor anymore. Instead, use an app such as Google Authenticator, DUO Mobile, or Authy.

You can easily check if your information was included in any data leaks by visiting Have I Been Pwned. Motherboard’s extensive guide to not getting hacked also gives you some easy-to-follow steps on how to protect yourself online. It takes just a few minutes to make sure your information is more secure—unless you’re set on using your smart home devices to meet some new Canadian hacker friends, that is.

Fishing hooks (Image: HMRC)

South Korea's finance watch dog, the Financial Supervisory Service (FSS), together with SK Telecom, will develop AI to prevent voice phishing attacks.

The FSS will provide its data on financial fraud while the telecommunications carrier will build an AI system that alerts callers when it is suspected that they have received a voice phishing call.

The FSS said damages caused by voice phishing in the first half of this year amounted to 180.2 billion won ($159 million), an increase of a staggering 73.7 percent from a year ago.

Existing filtering methods detect phishing attacks based on the use of certain keywords. The new AI system will detect phishing attacks based on context, the FSS said.

The service is expected to roll out sometime in the first half of next year.

Phishing, whether through voice or email, has risen globally as a serious threat. Cybersecurity company FireEye, which examined over half-a-billion emails sent between January and June 2018, found that one in 101 emails were classified as being malicious.

South Korea has been looking into various ways to apply AI into industries starting in 2016, following the Go-bout between AlphaGo and local player Lee Se-dol, in which the latter lost.

Related Coverage

The biggest phishing attacks of 2018 and how companies can prevent it in 2019 (TechRepublic)

Phishing attacks flourished in 2018, but organizations can protect themselves with the three tips below.

Phishing spikes as private health continues to be most breached sector in Australia

Lawyers, accountants, and management types are the most likely to click on phishing links, according to the Notifiable Data Breaches report for July to September.

Phishing attacks: Why is email still such an easy target for hackers?

The majority of cyber attacks begin with one simple phishing email. So will it ever be possible to close this door to hackers, once and for all?

10 tips to combat phishing via social media platforms (TechRepublic)

Social media platforms are just as susceptible to phishing attempts as email. Learn some strategies to protect yourself and your users from such attacks.

8 tips for avoiding phishing, malware, scams, and hacks while holiday shopping online (TechRepublic)

The holiday season isn't just busy for shoppers--it's busy for cybercriminals, too. Here's a holiday shopping safety guide with advice on how to stay safe online.

London’s Metropolitan Police Service will betestingfacial recognition technology in a handful of locations across the central core of the British capital on both Monday and Tuesday for eight hours each day.

This trial marks the seventh such trial in London since 2016. In addition to the December 17-18 tests, authorities have said there will be three more tests that have yet to be scheduled.

According to the police, these trials, which "will be used overtly with a clear uniformed presence and information leaflets will be disseminated to the public," are set to take place specifically in the vicinity of Soho, Piccadilly Circus, and Leicester Square.

The Met noted in a statement that anyone who declines to be scanned "will not be viewed as suspicious by police officers."

Law enforcement in South Wales has also previously tested this technology, among other locales around the United Kingdom. Numerous tests in the United States have shown that this technology can be flawed, particularly when in use against non-white suspects.

Here in the US, the technology has already become quietly pervasive.

The test has been decried by London-based pro-privacy group Big Brother Watch:

  1. Hacker Banner Ads Are Totally Wild
  2. 70% Of Americans Worried About Holiday Shopping Identity Theft
  3. Were Taylor Swift Fans Tracked At Her Gig?
  4. Ebola Outbreak Reaches City Of 1 Million Residents

Page 335 of 354