Security

In the handwringing post mortem after a hacker breach, the first point of intrusion usually takes the focus: The phishing email that Clinton campaign manager John Podesta's aide accidentally flagged as legit, or the Apache Struts vulnerability that let hackers get access to an Equifax server. But Dmitri Alperovitch, chief technology officer of security firm Crowdstrike, argues that the crucial moment isn't necessarily the initial penetration, but how quickly intruders can move from that beachhead to expand their control. And no one, Alperovitch has found, does it faster than the Russians. In its annual global threat report, released Tuesday, Crowdstrike introduced a new metric of hacker sophistication: what the firm calls "breakout" speed. Analyzing more than 30,000 attempted breaches in 2018 the company says it detected across its customer base, Crowdstrike measured the time from hackers' initial moment of intrusion to when they began to expand their access, jumping to other machines … [Read more...] about Russian Hackers Go From Foothold to Full-On Breach in 19 Minutes

The phony Facebook pages looked just like the real thing. They were designed to mimic pages that service members use to connect. One appeared to be geared toward a large-scale, military exercise in Europe and was populated by a handful of accounts that appeared to be real service members. In reality, both the pages and the accounts were created and operated by researchers at NATO’s Strategic Communications Center of Excellence, a research group that's affiliated with NATO. They were acting as a "red team" on behalf of the military to test just how much they could influence soldiers’ real-world actions through social media manipulation. The group "attempted to answer three questions,” Nora Biteniece, a software engineer who helped design the project, told WIRED. “The first question is, What can we find out about a military exercise just from open source data? What can we find out about the participants from open source data? And, can we use all this data to … [Read more...] about NATO Group Catfished Soldiers to Prove a Point About Privacy

In the summer of 2006, Fidel Castro unexpectedly announced that he was temporarily handing over power to his brother. Turns out he needed to undergo intestinal surgery. Afterward, an anchor on state-run television read a statement, said to have been written by Castro, attesting that all was well. But there were no photographs of Fidel in recovery, no nine-hour radio address from his hospital bed. Rumors flew that the longtime Cuban leader had died. Then, about two weeks after the operation, the Cuban regime released a picture of the bearded leader wearing an Adidas jacket and holding the August 12, 2006, edition of the Cuban Communist Party newspaper, Granma. He was alive, at least as of that date. Fidel Castro had been verified. The Cuban regime was onto something. The people hadn’t believed statements that Castro was alive and well—so it found a way to offer hard-to-deny proof. Today we are like the Cubans, circa 2006. In our case, fakery is gushing in from everywhere and … [Read more...] about The Imperfect Truth About Finding Facts in a World of Fakes

The US government averted another shutdown when Donald Trump instead opted to declare a national emergency to fund his border wall dreams—a wall which raises huge privacy and security concerns and will cause more problems than it solves. As the country digested the national emergency, cybersecurity workers were still scrambling to clean up the security nightmare wrought by the longest shutdown in history. Amid all the border wall news this week, you’d be forgiven for missing that the president also signed an executive order creating the American AI Initiative. In an op-ed for WIRED, White House deputy assistant to the president for technology policy Michale Kratsios explained why AI strategy is a security issue. Speaking of AI, to combat the growing threat of deep fakes, a new tool uses the blockchain to monitor video for tampering and manipulation. A popular electric scooter can be hacked to speed up and stop. One in three Americans has been the victim of severe online … [Read more...] about Security News This Week: Database Leak Details China’s Oppressive Tracking of Muslims

A group of Google security researchers have warned that Spectre speculative execution attacks are here to stay without serious changes to the design of modern CPU architectures, such as eliminating speculation execution in order to prevent all related side-channel attacks. Speculative Execution Considered Harmful The team of security researchers, including Ross Mcilroy, Jaroslav Sevcik, Tobias Tebbi, Ben L. Titzer and Toon Verwaest, work on Google Chrome’s V8 JavaScript engine and came to the conclusion that all processors that perform speculative execution will always remain susceptible to various side-channel attacks, regardless of specific mitigations the cybersecurity community might find along the way. A little more than a year ago, the Spectre and Meltdown bugs affecting most CPUs were disclosed, sending everyone into panic mode. These bugs were different not just because they affected hardware -- meaning they would be difficult to fix -- … [Read more...] about Spectre Forever: Side-Channel Attacks Inescapable Unless CPU Designs Change, says Research