Route Hijacking, Redirecting Internet Traffic

If a bad actor (e.g., a criminal or government agency) can't access your traffic, it will try to redirect it to a place where it can . . . .

Cyber-security puzzle: Who is sending Internet traffic on long, strange trips? - CSMonitor.com: "Doug Madory, a Renesys expert, is one of the few able to see what was going on. As he watched his computer monitor in late summer, he says, unidentified hackers subtly diverted a US Internet provider’s Denver data stream – its e-mails and electronic file transfers – that were intended to travel just across town to another Denver location. “Route hijacking has been around for a long time, but it’s typically been accidental, brief, and highly public,” Mr. Madory says. “What we’re seeing now is subtle, almost impossible to detect – a man-in-the-middle setup to intercept data over relatively long periods of time: several hours or even an entire day. It looks like a targeted attack by either a criminal organization or nation state.”"

more news below

Follow @zqure

OpenDNS, Internet Security

About Us: "OpenDNS secures the networks used by more than 50 million people to connect to the Internet. Across all continents, in Fortune 50 enterprises and small businesses alike, at one in every three U.S. schools and hundreds of thousands of homes. Our services are smart and lightweight, yet more powerful than anything else available. They require no software or hardware, and can be set up in just minutes, immediately taking effect across all devices that connect to the Internet -- tablets, smartphones, even gaming consoles. Ask anyone who's deployed a network service across an enterprise and they'll tell you just how revolutionary that is. We're changing the face of Internet security."

more news below

Follow @zqure

Google, password-free authentication Chrome OS

Google eyes password-free authentication in Chrome OS | Internet & Media - CNET News: " . . . The chrome.screenlockPrivate feature would let an app wake up a Chromebook or Chromebox if it judges a person to be present based on trusted data from Bluetooth, NFC, or USB ports. "A platform app may use the USB, NFC, and/or Bluetooth APIs to communicate with a secondary trusted device such as a phone, ring, watch, or badge, thereby allowing that trusted device to serve as an alternative form of authentication for the user," said a design document pointed out by Chrome watcher and Google employee Francois Beaufort...."

more news below

Follow @zqure

French government spoofing Google domain certificates

Biggest security risks today come from governments -- from China to the US to France to . . . .

Google catches French govt spoofing its domain certificates | ZDNet: "This is not the first time that the flaws of SSL certificates have been exposed. The US National Security Agency is alleged to have used man-in-the-middle attacks through unauthorised certificates against Google in the past. Additionally, in August 2011, a breach at DigiNotar, another CA, found that an Iranian hacker had created rogue certificates for Google domains, intercepting user passwords for Gmail."

more news below

Follow @zqure

Microsoft Cybercrime Center

The giant from Redmond does do a pretty good job on cybersecurity (but for the NSA et al) --

Microsoft's new Cybercrime Center combines tactics against hacking groups | Reuters: "...Microsoft Corp's expanded Digital Crimes Unit inside the 16,800-square foot, high-security facility combines a wide array of tactics that have worked the best: massive data gathering and analysis, gumshoe detective work, high-level diplomacy and creative lawyering. The new approach, to be launched on Thursday, is the latest attempt to close the gap created in the past decade as criminal hackers innovated in technology and business methods to stay ahead of adversaries mired in the slow-moving world of international law enforcement...."

more news below

Follow @zqure

Names of Hackers and Cybercriminals

Call Me i$Hm@eL: On the Names of Hackers and Cybercriminals: " . . . Then there are those that value reputation over risk, like the hacker and former spammer I met with in Southeast Asia: He has used the same handle, chosen at random from the dictionary, since he was a teenager, through his forays into crime, and even after going straight. “I mean, I’ve got a reputation, I’ve got friends—people trust me,” he explained. Giving it up, he said, would be akin to relinquishing his identity in the physical world and starting again. Today, he works as what is called a penetration tester, a legal hacker of sorts, hired to find holes in a client's system before a real attacker does. Some clients have discovered his past, and his long-established online reputation. But they seem pleased. They figure it means he’s more effective at his job." (read more at link above)

more news below

Follow @zqure

Google says NSA tactics bad for all American companies

Google: NSA tactics bad for all American companies — RT USA: "...“The current lack of transparency about the nature of government surveillance in democratic countries undermines the freedom and the trust in most citizens cherish, it also has a negative impact on our economic growth and security and on the promise of an internet as a platform for openness and free expression,” said Google’s law enforcement and information security director, Richard Salgado, as quoted by Reuters...."

Need we say more?

more news below

Follow @zqure

Internet architects propose encrypting all internet traffic

In other words, the National Security Agency (NSA) will have defeated itself by its egregious practices leading to unintended consequences --

Internet architects propose encrypting all the world’s Web traffic | Ars Technica: "...The proposal, announced in a letter published Wednesday by an official with the Internet Engineering Task Force (IETF), comes after documents leaked by former National Security Agency contractor Edward Snowden heightened concerns about government surveillance of Internet communications. Despite those concerns, websites operated by Yahoo, the federal government, the site running this article, and others continue to publish the majority of their pages in a "plaintext" format that can be read by government spies or anyone else who has access to the network the traffic passes over. Last week, cryptographer and security expert Bruce Schneier urged people to "make surveillance expensive again" by encrypting as much Internet data as possible...."

more news below

Follow @zqure

FBI says US government computers breached by Anonymous

Following up on our last posting re: poor US government cybersecurity practices --

Exclusive: FBI warns of U.S. government breaches by Anonymous hackers | Reuters: "Activist hackers linked to the collective known as Anonymous have secretly accessed U.S. government computers in multiple agencies and stolen sensitive information in a campaign that began almost a year ago, the FBI warned this week. The hackers exploited a flaw in Adobe Systems Inc's software to launch a rash of electronic break-ins that began last December, then left "back doors" to return to many of the machines as recently as last month, the Federal Bureau of Investigation said in a memo seen by Reuters..." (read more at link above)

more news below

Follow @zqure

US Government a Poor Example for Best Security Practices

Do as I say, not as I do! --

President’s tech council plays sad trombone for federal cybersecurity | Ars Technica: ""The Federal Government rarely follows accepted best practices," the report stated. In order to ensure that the country as a whole is more secure against cyber attack, the council advised, the government "needs to lead by example and accelerate its efforts to make routine cyber attacks more difficult by implementing best practices for its own systems.""

more news below

Follow @zqure

NSA infection, 50000 computer networks, malicious software

NSA infected 50,000 computer networks with malicious software - nrc.nl: "The American intelligence service - NSA - infected more than 50,000 computer networks worldwide with malicious software designed to steal sensitive information. Documents provided by former NSA-employee Edward Snowden and seen by this newspaper, prove this...." (read more at link above)

more news below

Follow @zqure

Your Cyberincident-response Plan?

How good is your cyberincident-response plan? | McKinsey & Company: "Many organizations must face a troubling fact: defending their digital perimeter is not enough. They should assume that successful cyberattacks will occur—and develop an effective plan to mitigate the impact...That’s why it’s not enough to focus, as many enterprises do, on defending the digital perimeter with cybertechnologies such as intrusion detection and data-loss prevention. When determined adversaries such as hacktivists and organized criminal syndicates set their minds on finding a way inside, every organization with valuable digitized information is at risk of having its perimeter breached and its critical assets compromised...." (read more at link above)

more news below

Follow @zqure

How the Feds Took Down Silk Road

There IS a difference between a free internet and a lawless internet -- great read at the link below (excerpt follows) --

How the Feds Took Down the Silk Road Drug Wonderland | Threat Level | Wired.com: "...The informant directed investigators to the site, accessible only through the Tor anonymizing network, and explained how transactions for the sale of heroin, cocaine and LSD went down using the digital currency Bitcoin. But that wasn’t all Silk Road was selling — there were stolen credit and debit card numbers, fake IDs, counterfeit currencies, hacking tools and login credentials for hacked accounts. The tip, which arrived about six months after Silk Road was launched and coincided with the emporium’s growing notoriety following a June 2011 Gawker story, spawned a multi-agency task force based in Baltimore — dubbed “Marco Polo” in reference to the drug market’s historical namesake — that eventually included investigators from the FBI, DEA, DHS, the IRS, U.S. Postal Inspection, U.S. Secret Service, and the Bureau of Alcohol, Tobacco, Firearms and Explosives...."

more news below

Follow @zqure