Independent – Page 429 – Computer Security Articles

Credit to Author: Lucian Constantin| Date: Thu, 23 Feb 2017 14:35:00 -0800

Security researchers have achieved the first real-world collision attack against the SHA-1 hash function, producing two different PDF files with the same SHA-1 signature. This shows that the algorithm’s use for security-sensitive functions should be discontinued as soon as possible.

SHA-1 (Secure Hash Algorithm 1) dates back to 1995 and has been known to be vulnerable to theoretical attacks since 2005. The U.S. National Institute of Standards and Technology has banned the use of SHA-1 by U.S. federal agencies since 2010, and digital certificate authorities have not been allowed to issue SHA-1-signed certificates since Jan. 1, 2016, although some exemptions have been made.

To read this article in full or to leave a comment, please click here

ComputerWorld Independent

February 23, 2017 admin

Ransomware 'customer support' chat reveals criminals' ruthlessness

Credit to Author: Gregg Keizer| Date: Thu, 23 Feb 2017 14:14:00 -0800

Ransomware criminals chatting up victims, offering to delay deadlines, showing how to obtain Bitcoin, dispensing the kind of customer support that consumers lust for from their cable and mobile plan providers, PC and software makers?

What’s not to love?

Finnish security vendor F-Secure yesterday released 34 pages of transcripts from the group chat used by the crafters of the Spora ransomware family. The back-and-forth not only put a spotlight on the gang’s customer support chops, but, said a company security advisor, illustrated the intertwining of Bitcoin and extortion malware.

To read this article in full or to leave a comment, please click here

ComputerWorld Independent

February 23, 2017 admin

Breaking and protecting devops tool chains

Ken Johnson, CTO of nVisium, and Chris Gates, Senior Security Engineer at Uber talk to CSO Online's Steve Ragan about working with devops tool chains.

ComputerWorld Independent

February 23, 2017 admin

Bruce Schneier and the call for "public service technologists"

Bruce Schneier, CTO of IBM Resilient on the increasing importance of technologist's presence in education and policy-making.

ComputerWorld Independent

February 23, 2017 admin

Police arrest man suspected of building million-router German botnet

Credit to Author: Peter Sayer| Date: Thu, 23 Feb 2017 09:06:00 -0800

Last year, someone turned a German internet service provider into a million-router botnet. German police think they will soon have the culprit.

The U.K.’s National Crime Agency (NCA) made an arrest on Wednesday in connection with the November 2016 hack on Deutsche Telekom. The agency said it arrested a 29-year-old man at Luton airport, acting on a European Arrest Warrant issued by the public prosecutor’s office in Cologne, Germany.

The German Federal Criminal Police Office (Bundeskriminalamt, or BKA), which led the investigation, said it had worked with British law enforcement officials to arrest the man, a Briton.

To read this article in full or to leave a comment, please click here

ComputerWorld Independent

February 23, 2017 admin

Eleven-year-old root Linux kernel flaw found and patched

Credit to Author: Lucian Constantin| Date: Thu, 23 Feb 2017 07:49:00 -0800

Linux system administrators should be on the watch for kernel updates because they fix a local privilege escalation flaw that could lead to a full system compromise.

The vulnerability, tracked as CVE-2017-6074, is over 11 years old and was likely introduced in 2005 when the Linux kernel gained support for the Datagram Congestion Control Protocol (DCCP). The problem was discovered last week and was patched by the kernel developers on Friday.

The flaw can be exploited locally by using heap spraying techniques to execute arbitrary code inside the kernel, the most privileged part of the OS. Andrey Konovalov, the Google researcher who found the vulnerability, plans to publish an exploit for it a few days.

To read this article in full or to leave a comment, please click here

ComputerWorld Independent

February 23, 2017 admin

Amid cyberattacks, ISPs try to clean up the internet

Credit to Author: Michael Kan| Date: Thu, 23 Feb 2017 06:26:00 -0800

If your computer’s been hacked, Dale Drew might know something about that.

Drew is chief security officer at Level 3 Communications, a major internet backbone provider that’s routinely on the lookout for cyberattacks on the network level. The company has linked more than 150 million IP addresses to malicious activity worldwide.

That means all of those IP addresses have computers behind them that are probably involved in distributed denial-of-service attacks, email spam, or breaches of company servers, Drew said.

Hackers have managed to hijack those computers to “cause harm to the internet,” but the owners don’t always know that, Drew said.

To read this article in full or to leave a comment, please click here