Newsflash donderdag 13 juli 2017
Eerste Kamer akkoord met meldplicht vitale infrastructuur
(security.nl)

De Eerste Kamer is gisteren akkoord gegaan met het wetsvoorstel Wet gegevensverwerking en meldplicht cybersecurity die aanbieders van vitale infrastructuur verplicht om digitale veiligheidsincidenten en datalekken bij de staatssecretaris van Veiligheid en Justitie te melden.

Bij aanbieders van vitale infrastructuur moet worden gedacht aan energienetwerkbeheerders, drinkwaterbedrijven, telecombedrijven, banken en Rijkswaterstaat.

De melding aan de staatssecretaris wordt in behandeling genomen door het Nationaal Cyber Security Centrum (NCSC). Het NCSC kan zo de getroffen aanbieder helpen en andere aanbieders waarschuwen en daarmee de schade beperken.

Verizon partner data breach exposes millions of customer records
(theverge.com)

Millions of Verizon customers have had their records exposed, ZDNet reported earlier today. Verizon confirmed that 6 million records were compromised by Nice Systems, a Verizon partner that facilitates customer service calls.

The records, which held logs from residential customers who had called Verizon customer service in the past six months, were accessed via an unprotected Amazon S3 storage server controlled by an employee of Nice Systems.

CNN reports that the cause was a misconfigured security setting on the server. As a result, anyone who knew the web address could download the files. But Verizon says no other external party had access to the data, telling CNN that no loss or theft of customer information occurred.

Achieving Compliance in the Ever-Mobile Healthcare Industry
(cio.com)

Not only are cloud-delivered, software-defined network solutions progressing the healthcare industry by introducing network mobility to mobile clinics, ambulatory applications, and traveling doctors, but these network solutions are also improving the security of patients’ private information.

Leaders in the healthcare field recognize that these evolving network technologies are necessary for ensuring and affording compliance.

Compliance challenges include keeping medical and financial data accessible yet secure and making the most of the limited resources in the face of potentially expensive solutions. Healthcare organizations must be proactive in their designs to ensure compliance, rather than being reactive after the fact.

WannaCry prompts promise of extra cash towards NHS security
(theregister.co.uk)

The NHS is to get a funding boost for cybersecurity measures, while the UK government has promised patients a digital service that lets them see who's accessed their health records.

The commitments are part of its response to two reviews into patient data – one from the National Data Guardian for health and care, Fiona Caldicott, and one from the Care Quality Commission – that were published last year.

The response (PDF) accepts the recommendations of both reviews, which included a simplified model for consent, the adoption of 10 data security standards and significant improvements to the way data use is communicated to the public.

German military aviation command launches cyber threat initiative
(reuters.com)

The German military's aviation safety chief has launched a new initiative against cyber threats, citing research that he said shows hackers can commandeer military airplanes with the help of equipment that costs about 5,000 euros ($5,700).

A defense ministry spokesman told Reuters that development of new "aviation cyber expertise" would cover everything from raising consciousness about cyber threats to technical research projects and equipping aircraft with protective systems.

State Secretary Katrin Suder had backed the idea, which Major General Ansgar Rieks, head of the German Military Aviation Authority, proposed in a letter in June, the spokesman said.

How Active Intrusion Detection Can Seek and Block Attacks
(darkreading.com)

Researchers at Black Hat USA will demonstrate how active intrusion detection strategies can help administrators detect hackers who are overly reliant on popular attack tools and techniques.

Penetration testers as well as bad-guy hackers typically rely on several common attack tools to break into business networks.

Enterprises defending their networks can flip the equation on attackers by using active intrusion detection strategies to create situations where attackers overly reliant on these tools inadvertently expose themselves to detection and other complications, says John Ventura, practice manager for applied research at Optiv. It's a trap that even pen testers can fall into while running their tools, he says.

Security analytics and operations are becoming more difficult
(helpnetsecurity.com)

A new Enterprise Strategy Group (ESG) study, which involved a survey of more than 400 IT and cybersecurity professionals, found that 72 percent feel cybersecurity analytics and operations is more difficult today than it was two years ago, and that the rapidly evolving threat landscape and growing volumes of security alarms are the most common challenges facing enterprises today.

Despite increased spending, organizations are still looking for ways to increase efficiency and improve risk management. Research revealed that 31 percent of organizations are looking to use threat intelligence to help automate remediation tasks.

According to ESG, 89 percent of organizations use external threat intelligence, but IT professionals are still feeling that cyber adversaries are moving faster than network defenders can keep up.

New SQL Injection Tool Makes Attacks Possible from a Smartphone
(darkreading.com)

Recorded Future finds new hacking tool that's cheap and convenient to carry out that old standby attack, SQL injection.

Like a lingering cold, SQL injection continues to plague the enterprise with no end in sight. Researchers have found that the latest SQLi hits to some organizations have come by way of a new hacking tool that has made it easier than ever for attackers to wage these exploits: via their smartphones.

Known as "Katyusha Scanner," this previously unknown tool combines the power of the Anarchi Scanner open-source penetration testing tool with the ephemeral and encrypted communication of the cloud-based Telegram messaging service.

Someone stole this security CEO's identity. Then they had him declared 'bankrupt.'
(cnn.com)

The CEO of one of the world's largest security companies was briefly declared bankrupt this week after having his identity stolen.
Swedish firm Securitas confirmed that chief executive Alf Goransson was declared bankrupt on Monday by the Stockholm District Court after a fraudulent application was made using stolen personal information.

The decision was reversed on Wednesday at the CEO's request.
Securitas said that Goransson was not contacted by the court prior to its initial ruling, and the incident has been reported to police.

There were other consequences. Securitas said in a press release that the Swedish Companies Registration Office had de-registered Goransson as the company's CEO after the court ruling.

How Magecart attackers monetize stolen payment card info
(helpnetsecurity.com)

The Magecart campaign, aimed at compromising online shops with malicious JavaScript code to collects payment card info, is still going strong, and researchers have pinpointed another way threat actors behind it monetize the stolen information.

First spotted in October 2016 by RiskIQ and ClearSky researchers, Magecart mainly hits e-commerce sites running outdated and unpatched versions of shopping cart software from Magento, Powerfront, and OpenCart.

After gaining access to the web platforms, the attackers change the source code of the website to include the malicious script. The script loads from one of the many domains they set up to host it, and can hook web forms and access data form submissions.

The future of payments: sensor fingerprinting, facial recognition, retinal scanning and voice control
(helpnetsecurity.com)

Viewpost surveyed a cross-section of 1,000 U.S.-based consumers, finding that overall, 80 percent of Americans are in support of payments technologies and currencies, including tools like sensor fingerprinting, facial recognition, retinal scanning and voice control, as well as currencies like bitcoin.

Electronic payments have become commonplace today, with nearly 51 percent of people reporting that they are paid electronically via direct deposit, and an increasing comfort level with these paperless transactions appears significant in driving consumers’ interest in even more sophisticated forms of electronic payment.

Respondents are unenthusiastic about traditional paper checks, as one-third of them think that paper checks will die within five years, and 83 percent believe they will be completely eliminated within the next 20 years.

Kaspersky Lab says it has become pawn in U.S.-Russia geopolitical game
(reuters.com)

Russian cyber security firm Kaspersky Lab, reacting to a U.S. government move restricting its activities, said on Wednesday it had fallen victim to U.S.-Russia global sparring while the Kremlin criticized the U.S. action as politically-motivated.

The Trump administration on Tuesday removed the Moscow-based firm from two lists of approved vendors used by government agencies to purchase technology equipment, amid concerns its products could be used by the Kremlin to gain entry into U.S. networks.

"By all appearances, Kaspersky Lab happened to be dragged into a geopolitical fight where each side is trying to use the company as a pawn in its game," RIA news agency quoted the company's press service as saying.

Killing Cortana: How to disable Windows 10's info-hungry digital assistant
(pcworld.com)

Killing Cortana isn’t as easy as it used to be.

When Windows 10 first released, turning off Cortana was as simple as flipping a switch in the digital assistant’s settings, but Microsoft removed the option in the Windows 10 Anniversary Update. Now there’s no obvious way to disable Cortana—but it is possible using not-so-obvious methods.

Completely eradicating Cortana requires a quick and easy registry edit, which we’ll detail here. If you don’t want Cortana spying on you but also detest the idea of mucking with your PC’s deepest software innards, PCWorld’s guide to privacy-boosting Cortana tweaks can show you how to limit the personal information it sends Microsoft. Cortana will still run in the background with limited functionality if you don’t perform the registry edit, though.

AGFEO smart home controllers need patching
(theregister.co.uk)

Smart-home controllers from German company AGFEO have adopted best practice internet things security by offering an unsecured Web admin interface.

The now-patched attack vectors included unauthenticated access to some services, authentication bypass, cross-site scripting (XSS) vulns, and hard-coded cryptographic keys.

The bugs were discovered by SEC Consult, and landed on Full Disclosure after the vendor finally released an update. The AGFEO ES 5xx and 6xx firmware has three certificates with their associated private keys, which would ultimately let an attacker get administrative credentials and do as they pleased.

Facebook shuts down 'legal pot shops'
(bbc.com)

Facebook has shut down pages offering marijuana for sale in Alaska, angering the businesses that run them, who say they were licensed to sell it.

It highlights the problems faced by social networks trying to set boundaries for what users can post. The National Cannabis Industry Association said it was seeking "clearer guidelines" from Facebook.

Affected businesses should appeal to have their accounts restored, the NCIA told the Associated Press news agency. The problem had affected all of the nine US states that had legalised recreational and medical cannabis, deputy director Taylor West added.

Robo-surgeons, self-driving cars face similar legal, ethical headaches
(theregister.co.uk)

In a research paper published on Wednesday, "Robot Autonomy for Surgery," UC San Diego assistant professor Michael Yip and lecturer Nandan Das explore the growing role played by surgical robots and the issues raised by systems that are increasingly autonomous.

Just as self-driving cars have six levels of autonomy, ranging from human control to complete surrender, surgical robots can be grouped into similar categories.

The da Vinci Surgical System, which debuted in 2000, was the first FDA-approved robotic system for laparoscopic surgery, the paper explains, and represents a remotely controlled tool.

Glove turns sign language into text for real-time translation
(newscientist.com)

Handwriting will never be the same again. A new glove developed at the University of California, San Diego, can convert the 26 letters of American Sign Language (ASL) into text on a smartphone or computer screen.

Because it’s cheaper and more portable than other automatic sign language translators on the market, it could be a game changer. People in the deaf community will be able to communicate effortlessly with those who don’t understand their language. It may also one day fine-tune our control of robots.

ASL is a language all of its own, but few people outside the deaf community speak it. For many signing is their only language, as learning written English, for example, can be difficult without having the corresponding sounds to go with it.

Scientists encode a film in DNA, the ultimate hard drive
(theage.com.au)

It was one of the very first motion pictures ever made: a galloping mare filmed in 1878 by British photographer Eadweard Muybridge, who was trying to learn whether horses in motion ever become truly airborne.

More than a century later, that clip has rejoined the cutting edge. It is now the first movie ever to be encoded in the DNA of a living cell, where it can be retrieved at will and multiplied indefinitely as the host divides and grows.

The advance, reported in the journal Nature by researchers at Harvard Medical School, is the latest and perhaps most astonishing example of the genome's potential as a vast storage device.