A cyberattack on USIS, formerly known as US Investigations Services, a company that conducts background checks for federal government employees, compromised the personal data of at least 25,000 of those workers, including undercover investigators. For example, the breach exposed personal information of Department of Homeland Security (DHS) employees. The compromised information includes Social Security numbers, education and criminal history, birth dates, and personal information about relatives and friends. Dmitri Alperovitch, chief technology officer with cybersecurity firm CrowdStrike, said hackers “would be collecting this data to identify individuals who might be vulnerable to extortion and recruitment.” USIS disclosed the attack earlier this month—saying it has “all the markings of a state-sponsored attack”—but did not say how many records had been compromised or which agencies were affected. DHS suspended all work with the company and the FBI is investigating the attack. USIS could not be reached for comment. (Reuters)(NBC News)
Saturday, September 13, 2014
Saturday, March 8, 2014
Brazil Plans to Augment World Cup Security with Robots
Brazilian law enforcement will get high-tech assistance during the 2014 World Cup soccer games from 30 robots. The national government purchased the machines for $7.2 million. They will be stationed in the 12 host cities during the soccer matches and will primarily be used to help examine any suspicious objects. The small and sturdy robot, which weighs roughly 40 pounds, is designed to fit in a backpack such that a human can deploy it immediately. It is able to reach speeds of up to 9 miles/hour and can navigate uneven and steep terrain, but it is also submersible at depths of up to 2 meters. The PackBot robot is made by Bedford, Massachusetts-based iRobot. It was first deployed in 2002 in Afghanistan and has since been used by the military in Iraq and several other countries. The PackBot was also the first remote controlled robot to enter the Fukushima nuclear facility after the Japanese earthquake and tsunami in March 2011. (SlashDot)(International Business Times UK)(Robohub)
Wednesday, November 20, 2013
US Security Officials Use Government, Private Databases to Prescreen Airline Passengers; Privacy Advocates Worry
The US Transportation Security Administration (TSA) has expanded its airline-passenger screening by gathering information from various government and private databases, including those that the Department of Homeland Security maintains. Privacy advocates are concerned about the intrusive nature of the program, which was likened to a “pre-crime assessment every time you fly” according to a consultant to one of the groups opposing the program. Edward Hasbrouck said, “The default will be the highest, most intrusive level of search.” TSA agents are now accessing data such as car registrations, tax identification numbers, previous travel information, and material gathered by law-enforcement or intelligence officials for all travelers, not just those entering the US. The TSA has not publicly released many details of the new program. “The measures go beyond the background check the government has conducted for years, called Secure Flight, in which a passenger’s name, gender and date of birth are compared with terrorist watch lists,” noted the New York Times. (SlashDot)(The New York Times)
Sunday, May 12, 2013
Popular Android Applications Contain Security Flaws
Researchers from the University of California, Davis, discovered security flaws in roughly 120,000 free applications for the Android smartphone, including several popular texting, messaging, and microblogging programs. These vulnerabilities could be exploited by malware that could then allow the hackers to access users’ private information or post fraudulent messages using social media. The UC Davis researchers found developers of these applications didn’t secure parts of the code. In the WeChat service, for example, they were able to malicious code to turn off the WeChat background service such that a user would think the service is continuing to work when it is not. They have notified the developers concerning the flaws they found.(EurekAlert)(University of California Davis)
Sunday, January 27, 2013
Grammar undercuts security of long computer passwords
A team led by Ashwini Rao, a software engineering Ph.D. student in the Institute for Software Research, developed a password-cracking algorithm that took into account grammar and tested it against 1,434 passwords containing 16 or more characters. The grammar-aware cracker surpassed other state-of-the-art password crackers when passwords had grammatical structures, with 10 percent of the dataset cracked exclusively by the team's algorithm.
"We should not blindly rely on the number of words or characters in a password as a measure of its security," Rao concluded. She will present the findings on Feb. 20 at the Association for Computing Machinery's Conference on Data and Application Security and Privacy (CODASPY 2013) in San Antonio, Texas.
Basing a password on a phrase or short sentence makes it easier for a user to remember, but the grammatical structure dramatically narrows the possible combinations and sequences of words, she noted.
Likewise, grammar, whether good or bad, necessitates using different parts of speech -- nouns, verbs, adjectives, pronouns -- that also can undermine security. That's because pronouns are far fewer in number than verbs, verbs fewer than adjectives and adjectives fewer than nouns. So a password composed of "pronoun-verb-adjective-noun," such as "Shehave3cats" is inherently easier to decode than "Andyhave3cats," which follows "noun-verb-adjective-noun." A password that incorporated more nouns would be even more secure.
"I've seen password policies that say, 'Use five words,'" Rao said. "Well, if four of those words are pronouns, they don't add much security."
For instance, the team found that the five-word passphrase "Th3r3 can only b3 #1!" was easier to guess than the three-word passphrase "Hammered asinine requirements." Neither the number of words nor the number of characters determined password strength when grammar was involved. The researchers calculated that "My passw0rd is $uper str0ng!" is 100 times stronger as a passphrase than "Superman is $uper str0ng!," which in turn is 10,000 times stronger than "Th3r3 can only b3 #1!"
The research was an outgrowth of a class project for a masters-level course at CMU, Rao said. She and Gananand Kini, a fellow CMU graduate student, and Birendra Jha, a Ph.D. student at MIT, built their password cracker by building a dictionary for each part of speech and identifying a set of grammatical sequences, such as "determiner-adjective-noun" and "noun-verb-adjective-adverb," that might be used to generate passphrases.
Rao said the grammar-aware password cracker was intended only as a proof of concept and no attempt has been made to optimize its performance. But it is only a matter of time before someone does, she predicted.
Share this story on Facebook, Twitter, and Google:Other social bookmarking and sharing tools:
Story Source:
The above story is reprinted from materials provided by Carnegie Mellon University.
Note: Materials may be edited for content and length. For further information, please contact the source cited above.
Note: If no author is given, the source is cited instead.
Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.
Friday, October 26, 2012
Perfecting email security
Writing in the International Journal of Security and Networks, computer scientists Duncan Wong and Xiaojian Tian of City University of Hong Kong, explain how previous researchers had attempted to define perfect email privacy that utilizes PGP by developing a technique that would preclude the decryption of other emails should a private key be compromised. Unfortunately, say Wong and Tian this definition fails if one allows the possibility that the email server itself may be compromised, by hackers or other malicious users.
The team has now defined perfect forward secrecy for email as follows and suggested a technical solution to enable email security to be independent of the server used to send the message: "An e-mail system provides perfect forward secrecy if any third party, including the e-mail server, cannot recover previous session keys between the sender and the recipient even if the long-term secret keys of the sender and the recipient are compromised."
By building a new email protocol on this principle, the team suggests that it is now possible to exchange emails with almost zero risk of interference from third parties. "Our protocol provides both confidentiality and message authentication in addition to perfect forward secrecy," they explain.
The team's protocol involves Alice sending Bob an encrypted email with the hope that Charles will not be able to intercept and decrypt the message. Before the email is encrypted and sent the protocol suggested by Wong and Tian has Alice's computer send an identification code to the email server. The server creates a random session "hash" that is then used to encrypt the actual encryption key for the email Alice is about to send. Meanwhile, Bob as putative recipient receives the key used to create the hash and bounces back an identification tag. This allows Alice and Bob to verify each other's identity.
These preliminary steps are all automatically and without Alice or Bob needing to do anything in advance. Now, Alice writes her email, encrypts it using PGP and then "hashes" it using the random key from the server. When Bob receives the encrypted message he uses his version of the hash to unlock the container within which the PGP-encrypted email sits. Bob then uses Alice's public PGP key to decrypt the message itself. No snoopers on the internet between Alice and Bob, not even the email server ever have access to the PGP encrypted email in the open. Moreover, because a different key is used to lock up the PGP encrypted email with a second one-time layer, even if the PGP security is compromised past emails created with the same key cannot be unlocked.
Share this story on Facebook, Twitter, and Google:Other social bookmarking and sharing tools:
Story Source:
The above story is reprinted from materials provided by Inderscience Publishers, via EurekAlert!, a service of AAAS.
Note: Materials may be edited for content and length. For further information, please contact the source cited above.
Journal Reference:
Duncan S. Wong, Xiaojian Tian. E-mail protocols with perfect forward secrecy. International Journal of Security and Networks, 2012; 7 (1): 1 DOI: 10.1504/IJSN.2012.048491Note: If no author is given, the source is cited instead.
Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.
Thursday, September 20, 2012
Cyber security risk to smart grids and intelligent buildings
Writing in the latest issue of the journal Intelligent Buildings International, David Fisk of the Laing O'Rourke Centre for Systems Engineering and Innovation at Imperial College London warns that, as we have seen with the humble PC, the basic building blocks of intelligent buildings -- the process controllers that make up the distributed building management system (BMS) -- can be infected by malware, often through a 'backdoor' left ajar on a trusted network.
David Fisk notes that: "… the basic system -- for example, the bare minimum standby generators -- should normally be independent of the intelligent-building software (much as a warship still carries a sextant should the GPS be jammed)." And he warns:
"This is not current practice as far as can be discerned from existing ASHRAE and CIBSE standards."
Fisk's article, 'Cyber security, building automation, and the intelligent building' begins with a short history of the rise in intelligent control -- from the 1960s, when the only real threat was an irate engineer armed with a hammer, through the movement away from bespoke hardware and software to proprietary software such as the ubiquitous Windows system during the 1980s, to the post-9/11 emergence of the anonymous cyber-aggressor.
The middle section of the article then presents a review of a more recent attack, now known as Stuxnet, which demonstrated the wide-ranging havoc that could be caused by malicious software infecting plant controllers. This section also explains how such attacks now present a threat to the 'smart grid' and other open systems.
Finally, the article discusses how risks may be assessed and mitigated, using a hypothetical attack on the heating, ventilation and air-conditioning (HVAC) systems of a super-casino to illustrate the urgent need for the building systems design community to re-think traditional security strategies. As a minimum, building services professionals should deploy a 'whole-system design approach' and owners should plan for periods during which 'intelligence' is not available.
Share this story on Facebook, Twitter, and Google:Other social bookmarking and sharing tools:
Story Source:
The above story is reprinted from materials provided by Taylor & Francis, via AlphaGalileo.
Note: Materials may be edited for content and length. For further information, please contact the source cited above.
Journal Reference:
David Fisk. Cyber security, building automation, and the intelligent building. Intelligent Buildings International, 2012; : 1 DOI: 10.1080/17508975.2012.695277Note: If no author is given, the source is cited instead.
Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.
Monday, August 27, 2012
Better security for web and mobile applications
Called RockSalt, the clever bit of code can verify that native computer programming languages comply with a particular security policy.
Presented at the ACM Conference on Programming Language Design and Implementation (PLDI) in Beijing, in June, RockSalt was created by Greg Morrisett, Allen B. Cutting Professor of Computer Science at the Harvard School of Engineering and Applied Sciences (SEAS), two of his undergraduate students Edward Gan '13 and Joseph Tassarotti '13, former postdoctoral fellow Jean-Baptiste Tristan (now at Oracle), and Gang Tan of Lehigh University.
"When a user opens an external application, such as Gmail or Angry Birds, web browsers such as Google Chrome typically run the program's code in an intermediate and safer language such as JavaScript," says Morrisett. "In many cases it would be preferable to run native machine code directly."
The use of native code, especially in an online environment, however, opens up the door to hackers who can exploit vulnerabilities and readily gain access to other parts of a computer or device. An initial solution to this problem was offered over a decade ago by computer scientists at the University of California, Berkeley, who developed software fault isolation (SFI).
SFI forces native code to "behave" by rewriting machine code to limit itself to functions that fall within particular parameters. This "sandbox process" sets up a contained environment for running native code. A separate "checker" program can then ensure that the executable code adheres to regulations before running the program.
While considered a major breakthrough, the solution was limited to devices using RISC chips, a processor more common in research than in consumer computing. In 2006, Morrisett developed a way to implement SFI on the more popular CISC-based chips, like the Intel x86 processor. The technique was adopted widely. Google modified the routine for Google Chrome, eventually developing it into Google Native Client (or "NaCl").
When bugs and vulnerabilities were found in the checker for NaCl, Google sent out a call to arms. Morrissett once again took on the challenge, turning the problem into an opportunity for his students. The result was RockSalt, an improvement over NaCl, built using Coq, a proof development system.
"We built a simple but incredibly powerful system for proving a hypothesis -- so powerful that it's likely to be overlooked. We want to prove that if the checker says 'yes,' the code will indeed respect the sandbox security policy," says Joseph Tassarotti '13, who built and tested a model of the execution of x86 instructions. "We wanted to get a guarantee that there are no bugs in the checker, so we set out to construct a rigorous, machine-checked proof that the checker is correct."
"Our proofs about the correctness of our own tool say that if you run the tool on a program, and it says it's safe to run, then according to the model, this program can only do certain things," Tassarotti adds. "Our proof, however, was only as good as this model. If the model was wrong, then the tool could potentially have an error."
In other words, he explains, think of an analogy in physics. While you might mathematically prove that according to Newton's laws, a moving object will follow a certain trajectory, the proof is only meaningful to the degree that Newton's laws accurately model the world.
"Since the x86 architecture is very complicated, it was essential to test the model by running programs on a real chip, then simulating them with the model, and seeing whether the results matched. I specified the meanings of many of these instructions and developed the testing infrastructure to check for errors in the model," Tassarotti says.
Even more impressively, RockSalt comprises a mere 80 lines of code, as compared to the 600 lines of the original Google native code checker. The new checker is also faster, and, to date, no vulnerabilities have been uncovered. The tool offers tremendous advantages to programmers and users alike, allowing programmers to code in any language, compile it to native executable code, and secure it without going through intermediate languages such as JavaScript, and even to cross back and forth between Java and native code. This allows coders to choose the benefits of multiple languages, such as using one to ensure portability while using others to enhance performance.
"The biggest benefit may be that users can have more peace of mind that a piece of software works as they want it to," says Morrisett. "For users, the impact of such a tool is slightly more tangible; it allows users to safely run, for example, games, in a web browser without the painfully slow speeds that translated code traditionally provides."
Previous efforts to develop a robust, error-free checker have resulted in some success, but RockSalt has the potential to be scaled to software widely used by the general public. The researchers expect that their tool might end up being adopted and integrated into future versions of common web browsers. Morrisett and his team also have plans to adapt the tool for use in a broader variety of processors.
Reflecting on how the class project has been transformative, Tassarotti says, "I plan to pursue a Ph.D. in computer science, and I hope to work on projects like this that can improve the correctness of software. As computers are so prevalent now in fields like avionics and medical devices, I believe that this type of research is essential to ensure safety."
Share this story on Facebook, Twitter, and Google:Other social bookmarking and sharing tools:
Story Source:
The above story is reprinted from materials provided by Harvard University.
Note: Materials may be edited for content and length. For further information, please contact the source cited above.
Note: If no author is given, the source is cited instead.
Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.
Wednesday, August 22, 2012
Security risk: Sensitive data can be harvested from a PC even if it is in standby mode, experts say
Writing in a forthcoming issue of the International Journal of Electronic Security and Digital Forensics, Christos Georgiadis of the University of Macedonia in Thessaloniki and colleagues Stavroula Karayianni and Vasilios Katos at the Democritus University of Thrace in Xanthi explain how their discovery could be used by information specialists in forensic science for retrieving incriminating evidence from computers as well as exploited by criminals to obtain personal data and bank details.
The researchers point out that most computer users assume that switching off their machine removes any data held in random access memory (RAM), this type of fast memory is used by the computer to temporarily hold data currently used by a given application. RAM is often referred to as volatile memory, because anything contained in RAM is considered lost when a computer is switched off. Indeed, all data is lost from RAM when the power supply is disconnected; so it is volatile in this context.
However, Georgiadis and colleagues have now shown that data held in RAM is not lost if the computer is switched off but the mains electricity supply not interrupted. They suggest that forensics experts and criminals might thus be able to access data from the most recently used applications. They point out that starting a new memory-intensive application will overwrite data in RAM while a computer is being used, but simply powering off the machine leaves users vulnerable in terms of security and privacy.
"The need to capture and analyse the RAM contents of a suspect PC grows constantly as remote and distributed applications have become popular, and RAM is an important source of evidence," the team explains, as it can contain telltale traces of networks accessed and the unencrypted forms of passwords sent to login boxes and online forms.
The team tested their approach to retrieving data from RAM after a computer had been switched off following a general and common usage scenario involving accessing Facebook, Gmail, Microsoft Network (MSN) and Skype. They carried out RAM dumps immediately after switch off at 5, 15 and 60 minutes. They then used well-known forensic repair tools to piece together the various fragments of data retrieved from the memory dumps.
The team was able to reconstruct login details from the memory dumps for several popular services being used in the Firefox web browser including Google Mail (GMail), Facebook, Hotmail, and the WinRar file compression application. "We can conclude that volatile memory loses data under certain conditions and in a forensic investigation such memory can be a valuable source of evidence," the team says.
Share this story on Facebook, Twitter, and Google:Other social bookmarking and sharing tools:
Story Source:
The above story is reprinted from materials provided by Inderscience, via AlphaGalileo.
Note: Materials may be edited for content and length. For further information, please contact the source cited above.
Journal Reference:
Christos Georgiadis, Stavroula Karayianni and Vasilios Katos. A framework for password harvesting from volatile memory. International Journal of Electronic Security and Digital Forensics, 2012Note: If no author is given, the source is cited instead.
Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.
Wednesday, August 15, 2012
Researchers advance biometric security
Professor Marina Gavrilova, the founding head of the lab -- among the first in the research community to introduce and study neural network based models for information fusion -- says they have developed a biometric security system that simulates learning patterns and cognitive processes of the brain.
"Our goal is to improve accuracy and as a result improve the recognition process," says Gavrilova. "We looked at it not just as a mathematical algorithm, but as an intelligent decision making process and the way a person will make a decision."
The algorithm can learn new biometric patterns and associate data from different data sets, allowing system to combine information, such as fingerprint, voice, gait or facial features, instead of relying on a single set of measurements.
The key is in the ability to combine features from multiple sources of information, prioritise them by identifying more important/prevalent features to learn and adapt the decision-making to changing conditions such as bad quality data samples, sensor errors or an absence of one of the biometrics.
"It's a kind of artificial intelligence application that can learn new things, patterns and features," Gavrilova says. With this new multi-dimensional approach, a security system can train itself to learn the most important features of any new data and incorporate it in the decision making process.
"The neural network allows a system to combine features from different biometrics in one, learn them to make the optimal decision about the most important features, and adapt to a different environment where the set of features changes. This is a different, more flexible approach."
Biometric information is becoming more common in our daily lives, being incorporated in drivers' licenses, passports and other forms of identification. Gavrilova says the work in her lab is not only pioneering the intelligent decision-making methodology for human recognition but is also important for maintaining security in virtual worlds and avatar recognition.
The research has been published in several journals, including Visual Computer and International Journal of Information Technology and Management, as well as being presented in 2011 at the CyberWorlds and International Conference on Cognitive Informatics & Cognitive Computing in Banff.
Share this story on Facebook, Twitter, and Google:Other social bookmarking and sharing tools:
Story Source:
The above story is reprinted from materials provided by University of Calgary.
Note: Materials may be edited for content and length. For further information, please contact the source cited above.
Note: If no author is given, the source is cited instead.
Disclaimer: This article is not intended to provide medical advice, diagnosis or treatment. Views expressed here do not necessarily reflect those of ScienceDaily or its staff.
Wednesday, July 11, 2012
Researchers advance biometric security
Professor Marina Gavrilova, the founding head of the lab -- among the first in the research community to introduce and study neural network based models for information fusion -- says they have developed a biometric security system that simulates learning patterns and cognitive processes of the brain.
"Our goal is to improve accuracy and as a result improve the recognition process," says Gavrilova. "We looked at it not just as a mathematical algorithm, but as an intelligent decision making process and the way a person will make a decision."
The algorithm can learn new biometric patterns and associate data from different data sets, allowing system to combine information, such as fingerprint, voice, gait or facial features, instead of relying on a single set of measurements.
The key is in the ability to combine features from multiple sources of information, prioritise them by identifying more important/prevalent features to learn and adapt the decision-making to changing conditions such as bad quality data samples, sensor errors or an absence of one of the biometrics.
"It's a kind of artificial intelligence application that can learn new things, patterns and features," Gavrilova says. With this new multi-dimensional approach, a security system can train itself to learn the most important features of any new data and incorporate it in the decision making process.
"The neural network allows a system to combine features from different biometrics in one, learn them to make the optimal decision about the most important features, and adapt to a different environment where the set of features changes. This is a different, more flexible approach."
Biometric information is becoming more common in our daily lives, being incorporated in drivers' licenses, passports and other forms of identification. Gavrilova says the work in her lab is not only pioneering the intelligent decision-making methodology for human recognition but is also important for maintaining security in virtual worlds and avatar recognition.
The research has been published in several journals, including Visual Computer and International Journal of Information Technology and Management, as well as being presented in 2011 at the CyberWorlds and International Conference on Cognitive Informatics & Cognitive Computing in Banff.
Share this story on Facebook, Twitter, and Google:Other social bookmarking and sharing tools:
Story Source:
The above story is reprinted from materials provided by University of Calgary.
Note: Materials may be edited for content and length. For further information, please contact the source cited above.
Note: If no author is given, the source is cited instead.
Disclaimer: This article is not intended to provide medical advice, diagnosis or treatment. Views expressed here do not necessarily reflect those of ScienceDaily or its staff.
Wednesday, June 20, 2012
Website security: Spot a bot to stop a botnet
One of the most significant threats faced by computer networks is from "bots." A bot is simply a program that runs on a computer without the owner's knowledge and carries out any of a number of tasks over the network and the wider internet. It can run the same tasks, such as sending emails or accessing a specific page on the internet, at a much higher rate than would be possible if a person were to carry out the task. A collection of bots in a network, used for malicious purposes, is a botnet and while they are often organized and run by a so-called botmaster there are bots that are available for hire for malicious and criminal activity.
Bots might be illicitly installed on computers in the home, schools, businesses, government buildings and other installations. They are usually carried into a particular computer through a malicious link on the internet, in an email or when a contaminated external storage device, such as a USB drive is attached to a computer that has no malware protection software installed.
Botnets are known to have been used to send mass emails, spam, numbering in the hundreds of millions, if not billions of deliveries. They have also been used in corporate spying, international surveillance and for carrying out attacks known as Distributed Denial of Service (DDoS) attacks, which can decommission whole computer networks by accessing their servers repeatedly and so blocking legitimate users.
Manoj Thakur of the Veermata Jijabai Technological Institute (VJTI), in Mumbai, India, and colleagues have developed a novel approach to detecting and combating bots. Their technique uses a two-pronged strategy involving a standalone and a network algorithm. The standalone algorithm runs independently on each node of the network and monitors active processes on the node. If it detects suspicious activity, it triggers the network algorithm. The network algorithm then analyzes the information being transferred to and from the hosts on the network to deduce whether or not the activity is due to a bot or a legitimate program on the system.
The standalone algorithm is heuristic in nature, the team says, which means it can spot previously unseen bot activity, whereas the network algorithm relies on network traffic analysis to carry out its detection. The two techniques working together can thus spot activity from known and unknown bots. This approach also has the advantage of reducing the number of false positives.
Share this story on Facebook, Twitter, and Google:Other social bookmarking and sharing tools:
Story Source:
The above story is reprinted from materials provided by Inderscience Publishers, via EurekAlert!, a service of AAAS.
Note: Materials may be edited for content and length. For further information, please contact the source cited above.
Journal Reference:
Manoj Thakur et al. Detection and prevention of botnets and malware in an enterprise network. Int. J. Wireless and Mobile Computing, 2012, 5, 144-153Note: If no author is given, the source is cited instead.
Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.