The week in security: Gamers hacked as NSA fallout prompts legal flood

Businesses should avoid using the hardware-based encryption found in many solid state disk (SSD) drives if they want to be able to recover their data in the event of a failure, one data-recovery specialist warned. Instead, he says, use third-party solutions that store keys off of the storage device itself – although some should perhaps worry about open-source alternatives, if some in the encryption debate are correct.

A Nintendo fan site was hit by hackers and 24,000 logins stolen, while vulnerabilities in emergency broadcast equipment were exposed. Rival Konami was hit soon after, with 35,000 accounts compromised.

A lack of process and security-focused culture may be complicating efforts to prevent such compromises, but one security consultant was warning that contractors represent a significant and often unmanaged risk. Yet some advise that despite the many key challenges facing CSOs today, the best strategy is to simply walk the proverbial mile in the average hacker’s shoes to understand their thinking.

Security tools from Kaspersky and Trend Micro scored 100% in real-world detection tests from AV-Comparatives and Kaspersky repeated the feat in separate testing by Dennis Technology Labs. However, nothing seemed to be stopping spyware that targets the South Korean military. Nothing was stopping hackers from compromising Android’s built-in app signature checking, either – which may be a slightly bigger problem for your average user, although Google reckons it won’t affect most of us – even though a second, similar attack was identified soon after.

Fallout from revelations of the NSA’s surveillance programs continued to spread as a US court ruled that wiretapping cases cannot be ignored because they would expose state secrets. The Brazilian government was asking for answers from the US after reports that the NSA has been spying in Brazil, while US privacy advocates railed against the practice and US privacy group EPIC petitioned the US Supreme Court to stop the NSA from collecting customer telephone records and a similar group in the UK sued that country’s government for its own surveillance efforts.

In the context of all this, some were asking whether a NZ bill to improve its intelligence agency’s spying powers was a good idea. At the same time, a Pirate Bay co-founder’s new secure messaging service,, was designed to avoid government spying.

PRISM was even being used as a malware lure, with a multi-platform Java applet called jRAT posing as an NSA-related email attachment. Such attachments may have a persistent success rate, but one study found that in-browser warnings were surprisingly effective at changing user behaviour.

One Japanese government ministry was left wishing its users behaved differently after a Google Groups account used for international treaty negotiations was set to be publicly visible. Improving the security of Bring Your Own Device (BYOD) strategies, however, is another matter entirely since the model introduces such a broad threat surface. Indeed, a new DSD guide on the subject suggests it introduces “significant risks” that companies must work through to ensure their security.

That was by far the only vulnerability in town, however: Microsoft’s latest Patch Tuesday included fixes for a slew of products and even in Windows fonts. And one researcher suggested the publication of a Windows vulnerability by a Google researcher was quickly exploited by hackers.

While it was riffing on the security theme, Microsoft also told developers they had 180 days to patch vulnerabilities in their apps or it would pull their apps from its online stores. The initiative was dismissed by some as a “paper tiger”, even as a Guardian report suggested the company had helped the NSA decrypt accounts as part of government surveillance programs. Little wonder a security conference explicitly banned US government workers from attending, as a protest against the NSA’s actions.

Meanwhile, a study into bug-bounty programs recommended them as a most cost-effective way of debugging software than hiring staff to do the same thing. This, as Microsoft paid out the first bounties under its recently-announced program to encourage public review of its Internet Explorer 11 browser.

Outsourcing was also proving promising for the Australian Federal Police, which outsourced their network security monitoring under a significant three-year, $15m contract to Verizon. With the risk of poor protection becoming ever more pointed – insurance company WellPoint accepted a $US1.7 million fine for exposing over 600,000 personal health records online – such deals may well become more common.

Follow @CSO_Australia and sign up to the CSO Australia newsletter.

Join the CSO newsletter!

Error: Please check your email address.

More about Australian Federal PoliceCSOFederal PoliceGoogleKasperskyKonamiMicrosoftNintendo AustraliaNSATechnologyTrend Micro AustraliaVerizonVerizon

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by David Braue

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place