Monthly Archives: April 2016


The federal government will lean heavily on the private sector to help it deliver its long-awaited national cyber security policy and initiatives like voluntary infosec health checks for businesses and joint threat sharing centres in capital cities. iTnews can exclusively reveal the policy, which is expected to be released in the coming weeks, will contain five key pillars intended to help Australia grow by embracing disruptive technologies from a secure footing in all areas of the economy. The 46-page strategy, sighted by iTnews, is the first update to Australia’s national cyber security policy since 2009. Businesses and government agencies have been awaiting the updated document since late 2014, when then-PM Tony Abbott announced a review of the ageing strategy.


Swift-Software-ExploitedA bug in SWIFT banking software may have been exploited to allow hackers to make off with $81 million from Bangladesh’s central bank in February, according to reports. Investigators at British defense contractor BAE Systems told Reuters that the malware in question, evtdiag.exe, had been designed to change code in SWIFT’s Access Alliance software to tamper with a database recording the bank’s activity over the network. That apparently allowed the attackers to delete outgoing transfer requests and intercept incoming requests, as well as change recorded account balances – effectively hiding the heist from officials. The malware even interfered with a printer to ensure that paper copies of transfer requests didn’t give the attack away. It’s thought that the malware was part of a multi-layered attack and used on the SWIFT system once Bangladesh Bank admin credentials had been stolen. Although it was written specifically for this attack it could be repurposed for similar attacks in the future, BAE claimed.


FBI-Unmask-TOR-UsersDo you know who created malware for the FBI that allowed Feds to unmask Tor users?
It’s an insider’s job… A former Tor Project developer. In an investigation conducted by Daily Dot journalists, it turns out that Matthew J. Edman, a former part-time employee of Tor Project, created malware for the Federal Bureau of Investigation (FBI) that has been used by US law enforcement and intelligence agencies in several investigations, including Operation Torpedo. Matthew Edman is a computer scientist who specializes in cyber security and investigations and joined the Tor Project in 2008 to build and enhance Tor software’s interactions with Vidalia software, cross-platform GUI for controlling Tor. After 2009, Matthew was hired by a contractor working for defense and intelligence agencies, including the FBI, to develop an anti-Tor malware.



Anonymous-Web-Surfing-Surf-AnonymouslyFacebook has hit another Milestone: More than 1 MILLION people, or you can say privacy conscious, are accessing Facebook over TOR. Facebook proudly announced today that, this month, for the first time, the people connected to the anonymous version of Facebook that’s accessible only through the TOR anonymity network exceeded 1 Million – an increase of almost 100% in the past ten months.


Now, the Defense Advanced Research Projects Agency is finding someone in the private sector to develop a hacker-proof “secure messaging and transaction platform” for the U.S. military.

Darpa wants researchers to create a secure messaging and transaction platform that should be accessible via the web browser or standalone native application.

The secure messaging app should “separate the message creation, from the transfer (transport) and reception of the message using a decentralized messaging backbone to allow anyone anywhere the ability to send a secure message or conduct other transactions across multiple channels traceable in a decentralized ledger,” agency’s notice explains.


Encrypted-Smartphone-ServiceOn Tuesday, the Dutch Police arrested a 36-year-old man, Danny Manupassa, on suspicion of money laundering and involvement in selling encrypted smartphones to criminals. Manupassa owns a company called Ennetcom, which provides customized Blackberry Phones with the secure PGP-encrypted network. Reportedly, Ennetcom sold nearly 19,000 encrypted cell phones at 1500 euros each in last few years.Police have seized Ennetcom servers based in the Netherlands and Canada and pulled them offline. The seized servers contain data of encrypted communications belong to a large number of criminals.


MIT-AI-Detects-CyberattacksMIT’s new AI²  has false positives detection rate five times smaller than similar cyber-security solutions

MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL), together with researchers from security firm PatternEx, have built an artificial intelligence (AI) system that can predict cyberattacks 85 percent of the time.

Known as the AI² , the prediction of the attacks created five times fewer false positives than existing cyberattack spotting AIs.

The new system doesn’t depend wholly on AI, but also on user input, something that researchers call analyst intuition (AI), hence its name of AI².

In tests carried out using 3.6 billion log lines of internet activity, AI² was able to identify 85 percent of attacks ahead of time, allowing the system to scan the content with unsupervised machine-learning techniques. The system at the end of each day presents its findings to a human operator, who then confirms or dismisses security alerts.



FBI Director James Comey said Wednesday that the agency was able to avoid a prolonged legal battle with Apple by buying a tool from a private source to hack into terrorist Syed Farook’s iPhone 5C.

Apple was engaged in a legal battle with the Department of Justice (DOJ) for a month over a court order that forces the company to write new software, which could disable passcode protection on Farook’s iPhone to help them access data on it.


NIST-Email-SecurityThe last effort of the NIST Agency in the development of email security guidelines is dated 2007 when it published the  NIST SP 800-45, Version 2 – Guidelines on Electronic Mail Security.

The new NIST guide is a document composed of 81 pages that aim to give recommendations and guidelines for enhancing trust in email.

This guideline applies to Government IT environment, but it is also useful for private organizations of any size.

The recommendations in the NIST guide for secure email include suggestions on the practices to adopt for securing the environments around enterprise mail servers and mail clients. This guide also provides recommendations and guidance for email digital signatures and encryption (via S/MIME), recommendations for protecting against spam messages.

Security email needs a multidisciplinary approach that involves secure solutions, effective configurations and trained personnel.



Do you remember the Apple iOS date bug?

In February, the security community highlighted the existence of the embarrassing problem for Apple iOS mobile devices running 64-bit iOS 8 or higher, the issue affects the Apple iOS date and time system and could be triggered by setting the date to January 1, 1970. The news appeared in Reddit discussions warning users about a flaw that could brick iPhone forever.

“Setting the date of your iPhone to January 1st, 1970 will brick your device, according to users across the web and confirmed by iClarified. The bug will affect any 64-bit iOS device that is powered by the A7, A8, A8X, A9, and A9X. 32-bit iOS devices are reportedly not affected by this issue.” reported iClarified.


Facebook-Certificate-Transparency-Log-Monitoring-ServiceEarlier this year, Facebook came across a bunch of duplicate SSL certificates for some of its own domains and revoked them immediately with the help of its own Certificate Transparency Monitoring Tool service. Digital certificates are the backbone of our secure Internet, which protects sensitive information and communication, as well as authenticate systems and Internet users. The Online Privacy relies heavily on SSL/TLS Certificates and encryption keys to protect millions of websites and applications. As explained in our previous article on The Hacker News, the current Digital Certificate Management system and trusted Certificate Authorities (CAs) are not enough to prevent misuse of SSL certificates on the internet.



Ransomware has risen dramatically since last few years and is currently one of the most popular threats on the Internet. The Ransomware infections have become so sophisticated with the time that victims end up paying ransom in order to get their critical and sensitive data back. But if you are infected with Petya Ransomware, there is good news for you. You can unlock your infected computer without paying the hefty ransom. Thanks to the Petya author who left a bug in the Ransomware code.

Petya is a nasty piece of ransomware that emerged two weeks ago and worked very differently from any other ransomware. The ransomware targets the victims by rebooting their Windows computers, encrypting the hard drive’s master boot file, and rendering the master boot record inoperable.



Hack-iphone-6The FBI didn’t disclose the identity of the third-party company that helped them access the San Bernardino iPhone, but it has been widely believed that the Israeli mobile forensic firm Cellebrite was hired by the FBI to put an end to the Apple vs. FBI case.
For those unfamiliar in the Apple vs. FBI case: Apple was engaged in a legal battle with the Department of Justice over a court order that was forcing the company to write software, which could disable passcode protection on terrorist’s iPhone, helping them access data on it.



Apple and the FBI will return to US Congress next week to testify before lawmakers about their heated disagreement over law enforcement access to encrypted devices, a congressional committee announced today.

Apple’s general counsel, Bruce Sewell, and Amy Hess, executive assistant director for science and technology at the Federal Bureau of Investigation, will testify on separate panels before a House Energy and Commerce subcommittee, in addition to other law enforcement officials and technology experts.

FBI director James Comey appeared before a separate congressional committee last month to defend his agency’s pursuit of a court order to compel Apple’s assistance in unlocking an iPhone linked to one of the San Bernardino, California, shooters. Sewell also testified at that hearing.


Spear Phishing AttackA former employee of the Nuclear Regulatory Commission (NRC) has been sentenced to 18 months in prison after offering to hand over the email addresses of Energy Department employees to a foreign government for use in cyber attacks, and then trying to carry out a spear phishing campaign.

Charles Harvey Eccleston, 62, pleaded guilty in February to one count of “attempted unauthorized access and intentional damage to a protected computer,” after being arrested in the Philippines in 2015, according to the Justice Department.

He first came to the attention of the FBI in 2013 after entering a foreign embassy in Manila and offering to sell a list of over 5,000 e-mail accounts of employees of the agency, which he claimed he could get thanks to his security clearance – despite having being sacked three years earlier.


Researchers at IBM have disFranken-Trojancovered a new piece of malware that has stolen $4 million from more than 24 American and Canadian banks in just a few days.

Numerous credit unions and popular e-commerce platforms were also said to have been targeted.

IBM said that the hackers combined code from two malware types, known as Nymaim and Gozi, to create the unholy hybrid dubbed GozNym—a franken-trojan, if you will.

“Cyber criminals have specialties just like their white-hat counterparts. By taking bits of code from different pieces of malware, they are able to create their malicious payload quicker than writing everything from scratch,” said Travis Smith, senior security research engineer at Tripwire, via email. “This will reduce their time to exploit and increase potential profits from criminal activity.”


SecurityFacebook is making it easier for developers to build post-password apps.

The social network introduced Account Kit this week at its F8 developer conference. Using the Account Kit SDK, app developers and site owners can let users log in without passwords—instead, they can use their phone number or email address—or Facebook login (an existing feature). It does not require people to have a Facebook account.

Chris Webber, security strategist for Centrify, said that the move will help users learn how to use mobile authenticators.

“With more and more consumer companies leveraging mobile devices for SMS-based authentication, users are going to grow familiar with this new authentication paradigm more quickly—which is great for both consumer and business-related security,” he said via email. “I’m sure that we’ll see cranky nay–sayers commenting across the internet. They’ll try to sound smart and assert that mobile devices can be lost or stolen, or that people can be out of coverage range and not receive an SMS notification, and so mobile authenticators have drawbacks. These people are missing the point entirely, and don’t understand that passwords alone provide next to no protection in today’s world. Mobile authentication raises the bar for security, and makes it much harder for attackers.”



BlackBerry has long been known for its stance on mobile security, as it was the first mobile phone maker to provide end-to-end encryption. But a new report revealed that the company has provided a master backdoor to law enforcement in its secure devices since 2010.

The Royal Canadian Mounted Police (RCMP) have been in possession of a global decryption key for BlackBerry phones since 2010, according to a new report from Vice News published yesterday.
The report suggests that the Canadian police used the master key to intercept and decrypt over 1 Million messages sent using its own encrypted and allegedly secure BlackBerry Messenger (BBM) service in a criminal investigation over the course of 2 years.


FBI-Director-tape-over-webcamWhat do you do to protect your ‘Privacy‘ while using your computer? FBI Director James Comey uses tape to cover up his laptop webcam to ensure Privacy.
Yes, you heard it right. During the Q&A session at Kenyon College last week, Comey said that he uses tape to cover his laptop webcam in order to mitigate the danger of secret surveillance.
While giving a speech about encryption and privacy, Comey repeated his argument that “absolute privacy” hampers the law enforcement and has never existed in America – until now, when by default encryption offered by big tech giants created boundaries where law enforcement can’t enter, even with a court order.This isn’t the first time Comey made this kind of statement. Comey has always suggested tech companies to adopt encryption techniques that help federal agencies intercept end-to-end encrypted communications when necessary.