09 09 2014
0 likes328 views
Home Depot confirmed that its payment systems in Canada and the US were breached, potentially affecting customers who used credit or debit cards between April-September 2014. Experts say the same malware may have been used in other recent retailer breaches like Target and Sally Beauty. Barclays is introducing finger-vein biometrics for internet banking authentication by 2015. A small number of Australians have microchipped themselves for convenience and to be on the cutting edge of technology.
09 09 2014
- 1. Security News Digest September 9, 2014 Home Depot Says Canadians Could Be Affected By Security Breach http://www.cbc.ca/news/business/home-depot-says-canadians-could-be-affected-by-security-breach-1.2759859 Home Depot has confirmed its payment data systems, including those at its Canadian stores, have been breached. In a statement late Monday, the do-it-yourself retailer said customers who used credit or debit cards at stores in Canada and the U.S. could be affected by the breach. It was the first confirmation of a suspected breach reported last week. Home Depot says there is no evidence that PIN numbers were snatched. Home Depot is offering free identity protection, including credit monitoring to any customer who used a card at a Home Depot store from April 2014 on. Home Depot Breach Linked to Target's? http://www.databreachtoday.com/home-depot-breach-linked-to-targets-a-7293 Now that Home Depot has confirmed its payment data systems were breached, industry experts weigh the possibility that the same point-of-sale malware may have hit the home-improvement giant as well as Target Corp., Sally Beauty, P.F. Chang's and other recently breached retailers. Although they stop short of confirming that the Home Depot, Target and other breaches are definitively tied to BlackPOS, other industry sources acknowledge that the malware continues to evolve. And they say BlackPOS has likely compromised numerous U.S. retailers, many of which have not yet confirmed or even discovered a card data compromise. B.C. Government Set To Review Controversial Privacy Law http://metronews.ca/news/vancouver/1147499/b-c-government-set-to-review-controversial-privacy-law/ The privacy of B.C.’s residents lays in the balance with an upcoming review of one of the province’s most controversial laws. Until Sept. 19, B.C. residents have an opportunity to voice any concerns over the provincial Personal Information Privacy Act (PIPA), which has been criticized for overstepping the boundary when it comes to the privacy rights of citizens. The key concerns with PIPA include how personal information is handed over to government authorities and other organizations without a warrant or consent, and citizens aren’t notified when their information has been given up. Barclays Brings Finger-Vein Biometrics To Internet Banking http://arstechnica.com/security/2014/09/barclays-brings-finger-vein-biometrics-to-internet- banking/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+T echnica+-+All+content%29 Barclays has announced the arrival of personal biometric scanners to keep your Internet banking security firmly under your thumb. Gone are the days of fumbling with desktop card readers, phone authentication, and PIN codes as a finger scanner will be available to wealthy corporate banking clients from 2015, and the rest of us surely soon after. The device, developed with Hitachi's Finger Vein Authentication Technology (VeinID), will read the subdermal patterns of the client's finger vasculature in order to combat identity fraud. Vein pattern recognition holds several advantages over fingerprint scanning, including reliability and speed, with the authentication taking only two seconds. Each unit houses a near-infrared (NIR) LED and monochrome CCD camera sensor, so as the red pigment in blood (hemoglobin) absorbs NIR light, veins appear as dark lines on the resulting image. This pattern is cryptographically stored on the SIM-card sent out by Barclays and used to authenticate the user on their next login, with no biometric details stored on a central database. Microchip Implant Ahead Of iPhone 6 Release http://www.smh.com.au/technology/sci-tech/microchip-implant-ahead-of-iphone-6-release-20140906-10cx9c.html With a wave of his left hand, Ben Slater can open his front door, turn on the lights and will soon be able to start his car. Without even a touch he can link to databases containing limitless information, including
- 2. personal details such as names, addresses and health records. The digital advertising director has joined a small number of Australians who have inserted microchips into their skin to be at the cutting edge of the next stage of the evolution of technology. Warning As Hackers Target Apple's iCloud http://www.bbc.com/news/technology-29124991 Cyber-thieves are exploiting the furore around iCloud by launching a phishing campaign that seeks to steal Apple IDs. The criminal gang behind the phishing email messages runs the Kelihos/Waledac botnet, said Symantec in a blog post about the cyber-attack. A botnet is a large network of compromised computers used for a wide variety of cybercrimes, including sending out spam or mining victims' machines for saleable data. The phishing campaign revolves around an email which appears to be from Apple and which claims that a song has been bought on iTunes via a person's Apple account. The message said the purchase was made from a device not previously used by that account and that the internet address used by whoever bought the track is in Volgograd, Russia. Naked Celeb Hack Lesson: 'Delete' Doesn't Mean Delete http://money.cnn.com/2014/09/02/technology/security/cloud-delete/index.html The naked photo you took on your phone - and deleted - is still around, somewhere. That's the reality today because of how modern phones, tablets and laptops save your data. By default, photos and documents don't reside on your device alone. They're routinely "backed up to the cloud." That means they're quietly copied onto a company's computer servers. Your embarrassing selfie lives on half a dozen machines in North America and Europe. This is why you can easily access the same photos on your phone, personal laptop and work computer. But it also means the data isn't in your hands anymore. Cloud services like Apple's iCloud, Google Drive and Microsoft's OneDrive operate this way. That means your iPhone takes all your stuff and automatically places it on Apple servers. Your Android keeps your photos at a Google data center. Microsoft does it for Windows Phone and laptops. But it doesn't end there. Companies strike deals to manage the flood of data. So your private documents actually end up in computer servers at companies you never had contact with: Cisco, IBM, Verizon and others all over the world. The lesson: Unless you take careful steps, your files no longer begin and end with the device on which you created them. If you delete a file from your phone, it lives on in the cloud. And even if you log into that cloud service and delete it there too, the disturbing truth is that company probably already copied your files to another server you can't access. In that case it would be hard for hackers to get them too - but they're still out there. Apple Will Tighten Security On iCloud, CEO Tim Cook Says http://www.vancouversun.com/technology/personal- tech/Apple+planning+more+security+measures+after/10177793/story.html Apple is planning to add more security measures to help protect its users following a celebrity photo hacking incident. CEO Tim Cook told The Wall Street Journal that Apple Inc. will use email and push notifications to let users know when someone tries to restore iCloud data on a new device, change an account password or attempts an initial log on to an account with a new device. Previously there were no notifications for restoring iCloud data, but users did receive an email when someone tried to change a password or log in for the first time from a new device. Apple expects to start sending notifications in two weeks. The iPhone maker said the new security being implemented will allow users to change passwords to reclaim control of an account or notify Apple's security team about a potential problem. For Sale Soon: The World’s First Google Glass Detector http://www.wired.com/2014/09/for-sale-soon-the-worlds-first-google-glass-detector/ Earlier this summer, Berlin-based artist and coder Julian Oliver released Glasshole.sh, a simple and free piece of software designed to detect Google Glass and boot it from any local Wi-Fi network. Later this month, Oliver says he’ll start taking pre-orders for Cyborg Unplug, a gadget no bigger than a laptop charger that plugs into a wall and patrols the local Wi-Fi network for connected Google Glass devices, along with other potential surveillance gadgets like Google Dropcams, Wi-Fi-enabled drone copters, and certain wireless microphones. When it detects one of those devices, it can be programmed to flash an alert with an LED light, play a sound through connected speakers, and even ping the Cyborg Unplug
- 3. owner’s smartphone through an Android app, as well as silently booting those potential spy devices from the network. Bitcoin Creator Satoshi Nakamoto Targeted By Email Hack http://www.theguardian.com/technology/2014/sep/09/bitcoin-creator-satoshi-nakamoto-email-hack Bitcoin creator Satoshi Nakamoto appears to have received a hacking attack against at least some of his online accounts, with the hacker offering to sell the anonymous developer’s personal information for 25BTC, or around £7,000 ($11,000). A post on anonymous text sharing site Pastebin offered to provide the documents, which potentially include information about the famously secretive developer’s real identity, if 25BTC was sent to a particular bitcoin address. No time limit was given, but as of Tuesday the address has received just 1.5BTC. Verizon to Pay $7.4M to Settle Privacy Investigation http://www.fcc.gov/document/verizon-pay-74m-settle-privacy-investigation-0 The US Federal Communications Commission’s Enforcement Bureau has reached a $7.4 million settlement with Verizon to resolve an investigation into the company’s use of personal consumer information for marketing purposes. The Enforcement Bureau’s investigation uncovered that Verizon failed to notify approximately two million new customers, on their first invoices or in welcome letters, of their privacy rights, including how to opt out from having their personal information used in marketing campaigns, before the company accessed their personal information to market services to them. In addition to the $7.4 million payment, Verizon has agreed to notify customers of their opt-out rights on every bill for the next three years. Obamacare Site Hacked but Nothing Taken, HHS Says http://money.cnn.com/2014/09/04/technology/security/obamacare-hacked/index.html Hackers silently infected a Healthcare.gov computer server this summer. But the malware didn't manage to steal anyone's data, federal officials say. On Thursday, the Health and Human Services Department, which manages the Obamacare website, explained what happened. "Our review indicates that the server did not contain consumer personal information; data was not transmitted outside the agency, and the website was not specifically targeted," HHS spokesman Kevin Griffis said. It all happened because of a series of mistakes. A computer server that routinely tests portions of the website wasn't properly set up. It was never supposed to be connected to the Internet - but someone had accidentally connected it anyway. That left it open to attack, and on July 8, malware slipped past the Obamacare security system, officials said. As health department officials describe it, the malware was run-of-the-mill, low-level hacker stuff. It wasn't even designed to steal patient data. It was actually malware meant to turn the computer server into a zombie machine, part of a robot network, or botnet, to spews out spam or computer viruses to the rest of us. But federal officials said the malware didn't do any damage. It just lay there dormant, quiet and dumb. The Security News Digest (SND) is a collection of articles published by others that have been compiled by the Information Security Branch (ISB) from various sources. The intention of the SND is simply to make its recipients aware of recent articles pertaining to information security in order to increase their knowledge of information security issues. The views and opinions displayed in these articles are strictly those of the articles’ writers and editors and are not intended to reflect the views or opinions of the ISB. Readers are expected to conduct their own assessment on the validity and objectivity of each article and to apply their own judgment when using or referring to this information. The ISB is not responsible for the manner in which the information presented is used or interpreted by its recipients. For previous issues of Security News Digest, visit the current month archive page at: http://www.cio.gov.bc.ca/cio/informationsecurity/securitynewsdigest/securitynews_digest.page To learn more about information security issues and best practices, visit us at: Information Security Branch – Office of the Chief Information Officer, Ministry of Technology, Innovation and Citizens’ Services 4000 Seymour Place, Victoria, BC V8X 4S8 http://www.cio.gov.bc.ca/cio/informationsecurity/index.page CITZCIOSecurity@gov.bc.ca
- 4. The information presented or referred to in SND is owned by third parties and protected by copyright law, as well as any terms of use associated with the sites on which the information is provided. The recipient is responsible for making itself aware of and abiding by all applicable laws, policies and agreements associated with this information. We attempt to provide accurate Internet links to the information sources referenced. We are not responsible for broken or inaccurate Internet links to sites owned or operated by third parties, nor for the content, accuracy, performance or availability of any such third-party sites or any information contained on them. ************************************************************************************************************************