Security

Hacking groups are getting busy--or perhaps busier. Symantec announced that attackers believed to be located in China have targeted satellite, telecommunications, and defense companies in the U.S. and Southeast Asia. Meanwhile, researchers at Kaspersky revealed that the Olympic Destroyer group that targeted the Winter Olympic Games 2018 in Pyeongchang, South Korea has set its sights on biological and chemical threat protection labs in Europe. The attacks discovered by Symantec are thought to be the work of Thrip, a hacking group the company has been tracking since 2013, and were traced back to three computers in China. Symantec discovered attacks on a satellite communications operator, a geospatial mapping company, three Southeast Asian telecom operators, and a U.S. defense contractor. All of these targets would be high priorities for China-sponsored attackers. Hacks traced back to China are often motivated by corporate espionage. (Why bother going through R&D yourself when you can … [Read more...] about New Reports Say Hackers Targeting Defense Companies, Biochem Labs

Google Home. Image credit: Google Google Devices Design Flaw During a lab experiment Craig Young, a researcher working for the security firm Tripwire, was conducting for his Black Hat training, Young discovered that the Home app, which is what Google Home and Chromecast owners use to configure their devices, wasn’t performing its tasks only through the Google Cloud infrastructure, but also through a local HTTP server.  The main issue here is that these commands lack any form of authentication, a problem that is common with most Internet of Things (IoT) devices, but which Google’s devices weren’t expected to have. Using this design flaw in Google’s products, Young was able to not only hijack the screen attached to the Chromecast, but also pinpoint his physical location with a 10m precision, which is almost as precise as the GPS location. Apparently, Google’s use of the HTML5 location API, which can gather location information from proximity to other … [Read more...] about Google Home Helps Attackers Find Your Home

In March, artist and programmer Brannon Dorsey became interested in a retro web attack called DNS rebinding, teaching himself how to illicitly access controls and data by exploiting known browser weaknesses. It's a vulnerability that researchers have poked at on and off for years—which is one reason Dorsey couldn't believe what he found. Sitting in his Chicago apartment, two blocks from Lake Michigan, Dorsey did what anyone with a newfound hacking skill would: He tried to attack devices he owned. Instead of being blocked at every turn, though, Dorsey quickly discovered that the media streaming and smart home gadgets he used every day were vulnerable to varying degrees to DNS rebinding attacks. He could gather all sorts of data from them that he never would have expected. "I'm technical, but I'm not an information security professional," Dorsey says. "I didn’t reverse any binaries or do any intense digging. I just followed my curiosities and suddenly I found some sketchy … [Read more...] about Millions of Streaming Devices Are Vulnerable to a Retro Web Attack

Verizon customers' smartphones will soon quit being snitches. The Associated Press reports that the company plans to stop selling location data to third-party companies, such as LocationSmart and Zumigo, which in turn sell that data to dozens of other companies, "as soon as possible." Most people know their smartphones are monitoring their every move. Yet relatively few knew that wireless carriers like Verizon, AT&T and Sprint sell that location data to brokers, effectively knocking over the first domino in a series of transactions involving their personal info. That changed in May, when it was revealed that anyone could access real-time location data about any phone in the U.S., thanks to LocationSmart. This leak was particularly worrisome because consumers have no way of stopping companies like LocationSmart and Zumigo from collecting this information. It's much like the Equifax data breach that put hundreds of millions of Americans' personal data at risk even though most … [Read more...] about Verizon Plans to Stop Selling Location Data to Brokers

Shareholder groups, civil liberties organizations, and over 150,000 consumers have signed letters and petitions calling on Amazon to stop selling its facial recognition technology to law enforcement, fearing a high potential for abuse from the government. Amazon Shareholders Concerned About Governments' Use Of “Rekognition” In a letter to Amazon founder and CEO Jeff Bezos, 19 shareholders expressed their concerns with Amazon’s “Rekognition” facial recognition technology being used by law enforcement. According to them, the technology poses not only privacy risks to customers, but also for Amazon’s stock value and the company’s investors.The shareholders worry that while Rekognition may be used to aid law enforcement in legal activities, it could also be used to violate human rights. The letter comes at a time when the Trump administration is embroiled in a scandal over separating immigrant children from their parents. ACLU had warned before … [Read more...] about Amazon Faces Backlash Over ‘Rekognition’ Software’s Use By Law Enforcement