The week in security: Gamers hacked as NSA fallout prompts legal flood
- — 15 July, 2013 09:39
Businesses should avoid using the hardware-based encryption found in many solid state disk (SSD) drives if they want to be able to recover their data in the event of a failure, one data-recovery specialist warned. Instead, he says, use third-party solutions that store keys off of the storage device itself – although some should perhaps worry about open-source alternatives, if some in the encryption debate are correct.
A Nintendo fan site was hit by hackers and 24,000 logins stolen, while vulnerabilities in emergency broadcast equipment were exposed. Rival Konami was hit soon after, with 35,000 accounts compromised.
A lack of process and security-focused culture may be complicating efforts to prevent such compromises, but one security consultant was warning that contractors represent a significant and often unmanaged risk. Yet some advise that despite the many key challenges facing CSOs today, the best strategy is to simply walk the proverbial mile in the average hacker’s shoes to understand their thinking.
Security tools from Kaspersky and Trend Micro scored 100% in real-world detection tests from AV-Comparatives and Kaspersky repeated the feat in separate testing by Dennis Technology Labs. However, nothing seemed to be stopping spyware that targets the South Korean military. Nothing was stopping hackers from compromising Android’s built-in app signature checking, either – which may be a slightly bigger problem for your average user, although Google reckons it won’t affect most of us – even though a second, similar attack was identified soon after.
Fallout from revelations of the NSA’s surveillance programs continued to spread as a US court ruled that wiretapping cases cannot be ignored because they would expose state secrets. The Brazilian government was asking for answers from the US after reports that the NSA has been spying in Brazil, while US privacy advocates railed against the practice and US privacy group EPIC petitioned the US Supreme Court to stop the NSA from collecting customer telephone records and a similar group in the UK sued that country’s government for its own surveillance efforts.
In the context of all this, some were asking whether a NZ bill to improve its intelligence agency’s spying powers was a good idea. At the same time, a Pirate Bay co-founder’s new secure messaging service, Heml.is, was designed to avoid government spying.
PRISM was even being used as a malware lure, with a multi-platform Java applet called jRAT posing as an NSA-related email attachment. Such attachments may have a persistent success rate, but one study found that in-browser warnings were surprisingly effective at changing user behaviour.
One Japanese government ministry was left wishing its users behaved differently after a Google Groups account used for international treaty negotiations was set to be publicly visible. Improving the security of Bring Your Own Device (BYOD) strategies, however, is another matter entirely since the model introduces such a broad threat surface. Indeed, a new DSD guide on the subject suggests it introduces “significant risks” that companies must work through to ensure their security.
That was by far the only vulnerability in town, however: Microsoft’s latest Patch Tuesday included fixes for a slew of products and even in Windows fonts. And one researcher suggested the publication of a Windows vulnerability by a Google researcher was quickly exploited by hackers.
While it was riffing on the security theme, Microsoft also told developers they had 180 days to patch vulnerabilities in their apps or it would pull their apps from its online stores. The initiative was dismissed by some as a “paper tiger”, even as a Guardian report suggested the company had helped the NSA decrypt Outlook.com accounts as part of government surveillance programs. Little wonder a security conference explicitly banned US government workers from attending, as a protest against the NSA’s actions.
Meanwhile, a study into bug-bounty programs recommended them as a most cost-effective way of debugging software than hiring staff to do the same thing. This, as Microsoft paid out the first bounties under its recently-announced program to encourage public review of its Internet Explorer 11 browser.
Outsourcing was also proving promising for the Australian Federal Police, which outsourced their network security monitoring under a significant three-year, $15m contract to Verizon. With the risk of poor protection becoming ever more pointed – insurance company WellPoint accepted a $US1.7 million fine for exposing over 600,000 personal health records online – such deals may well become more common.