Facebook Introduced Another Anti-Virus Software

The social network has launched the third free anti-virus scanner, which monitors for malicious activity and offers to scan infected machines directly from Facebook. The software was developed by security company Eset and is expected to protect the user accounts on the social network from being attacked by malicious software on their computers.

Facebook claimed that its goal is to offer the members of the network the best technology to improve their experience of its services and ensure to protect their devices. ESET Online Scanner for the social network is intended to considerably decrease the number of malicious links coming from the trillions of clicks that users make every day on Facebook.

Two years ago, the company launched its first service to detect malicious activity on the users’ accounts and offered Facebook members with suspected infected machines a list of free anti-virus software.

A few months ago, Facebook partnered with a couple of security companies: F-Secure and Trend Micro, and now Eset becomes the third company providing users its tools to directly clean up infections when they are detected.

Facebook believes that a larger number of anti-virus providers will increase the chances that malware will get caught and removed, thus helping people on the social network keep their data more secure.

When you first log into Facebook, you will get notifications if the scanner detects any suspicious behavior, like spam messages or the posting of infected links. You will be offered to download and install light software which scans your machine, but the progress of the scan and results will be delivered via Facebook, which will allow you to get on and do other things while the scanner checks your PC.

The company decided to intensify the anti-virus support of its users following an increasing number of scams and malicious software spreading via the social network. This is not surprising – Facebook accounts for 1.35 billion monthly active potential victims.

The scams are using social engineering in order to force Internet users to click on infected links that spread via friends’ news feeds with click-bait headlines. Although the tech giant has been proactively blocking and removing links it considers malicious, Facebook has not been able to stop the root of the problem – infected machines. Now it makes another try.

Apple Is Accused of Deleting Rivals’ Music from iPods

A huge antitrust class-action lawsuit against the Californian electronics company is currently heard in court. The tech giant is accused of intentionally deleting music not purchased from iTunes from users’ iPods a few years ago. A billion-dollar antitrust suit against the company for abuse of its iTunes Music Store dominance is developing in the US District Court in Oakland, California. The attorneys representing the plaintiffs claim that Apple scanned for music not purchased from iTunes and, if such was found, forced a factory reset of the iPod.

Indeed, it turned out that the users who tried to sync and update an iPod with music from the Apple rivals, including Amazon or 7Digital, faced a message about the error with their iPod. The text of the message was saying that that error could only be solved by a factory restore via iTunes. The latter completely wiped the iPod. Music bought from iTunes was restored on the iPod, but music from rival services wouldn’t. The tech giant for some reason decided to not disclose the problem to the users.

In respond, Apple security director argued that the music from the rival services was deleted for security reasons. The company also claimed that hackers including Jon Lech Johansen (aka “DVD Jon”) and software such as the digital rights management removal tool Requiem had made the company extremely paranoid. Even Steve Jobs wrote at the time that someone was “breaking into their house”.

Apple claimed that between 2007 and 2009, their system was “totally hacked”, and the company had to delete music for security reasons. Finally, Apple said it didn’t need to give iPod users too much information in order to not confuse them. No more comments on the issue were received from the tech giant thus far.

North Korea Claimed It Didn’t Hack Sony

The country has denied its involvement into the last week’s cyber-attack on Sony Pictures. The hack resulted in the leak of several unreleased movies and caused massive disruption to Sony’s email and other services of its internal computer network.

A diplomat from North Korea claimed that recent speculative reports, which linked North Korean hackers to the Sony breach, were just a “fabrication targeting the country”. North Korea publicly declared that it would follow international norms that ban hacking and piracy.

In the meantime, North Korea is known to have a sophisticated cyber-attack unit, and a few days ago a spokesman for its mission to the UN could not rule out the country’s involvement. Instead, he just told reporters to “wait and see” who was behind the attack.

The rumors were that North Korea, perhaps using hackers based in China, broke Sony Pictures’ computer network in order to retaliate for the release of The Interview movie, a comedy about a fictitious plot to assassinate the North Korean leader, Kim Jong-un.

Moreover, the security experts have also been pointing to the fact that the Sony hack was similar to a cyber-attack believed to have been carried out by North Korea on South Korean banks and TV networks in 2013. Finally, when details of The Interview movie were released a few months ago, the country threatened a “merciless and resolute” response unless American authorities banned the film. North Korea’s ambassador to the UN in a letter to the UN secretary general called the movie “the most undisguised sponsoring of terrorism” and “an act of war”.

In result of the hack, at least 5 high-profile movies, such as Still Alice (a remake of the musical Annie), and To Write Love on Her Arms leaked to the file-sharing websites. Moreover, it turned out that the salaries and other confidential data of more than 6,000 Sony employees were also stolen during the hack.

WhatsApp Messages Are Now Encrypted by Default

Over 600m WhatsApp users will benefit from its default end-to-end encryption. It is supposed to prevent any snoops spying on private communications. The move comes after WhatsApp contracted Open Whisper Systems, the developer of the TextSecure encrypted text app, with the purpose to incorporate its technology into WhatsApp.

The company says that the new feature is already available in the Android version of the Facebook-owned messaging provider, but the developers promised to work on an iOS alternative, as well as on encrypted messaging for group chat and media messages.

As you know, systems using end-to-end encryption are protected from breach due to the fact that the key, which unscrambles communications, is only stored on users’ mobiles. However, before the introduction of this feature, those keys were also stored by servers along with users’ phones, in order to provide Facebook or WhatsApp administrators access to messages.

Security experts point out that TextSecure encryption protocol is especially strong, because it uses a kind of “forward secrecy”. This means that a new key is being created for every message sent. The only other comparable service deployed on such a massive scale is, of course, Apple’s iMessage. However, the latter features one notable weakness: many people allow the system to back up their messages to Apple’s iCloud service, where protection isn’t as perfect.

In the meantime, Open Whisper Systems will continue to develop its other products, including RedPhone for Android, which will allow encrypted voice communications, and iOS Signal applications, which make protected calls and messaging.

The idea of the security developers is to make encryption the default on all devices. They believe that WhatsApp’s new encryption feature may not tempt some users away from TextSecure and Signal to Facebook, particularly if they are concerned about the metadata from their messages. Metadata is information that does not include the content of the communication, but only the additional info: the time and sides of it.

Although the developers didn’t comment on WhatsApp’s use of metadata, and on the topic of whether TextSecure was more secure as it wouldn’t share such data, they did say that TextSecure would always remain an application that is focused first and foremost on simple-to-use private communication.

Still, the suspicions are that handing such strong encryption to hundreds of millions of users may irk law enforcement bodies. As usual, any moves to protect private communication and prevent government from spying on people makes law enforcement bodies to suggest that encryption efforts will only benefit terrorists and other criminals. In respond, security experts argue that serious criminals have their own encryption instruments, which are just hard to use. Large-scale surveillance hurts only innocent Internet users.

Apple Will Push Beats Music to iOS Devices

The tech giant is going to integrate its Beats Music subscription service into iOS software next year. Media reports claim that Beats will become part of iOS in March 2015, forcing Apple’s iTunes music buyers to try the new streaming service. It is also known that the service could use the Apple Pay payments technology to charge for monthly subscriptions.

Apple bought Beats Music’s parent company Beats Electronics for $3bn earlier this year, thus acquiring its lucrative headphones business along with Beats Music, which launched in the United States early in 2014 as a rival to other streaming services like Spotify or Rhapsody.

It is expected that Beats Music will be rebranded under the iTunes moniker when it relaunches next year. Media reports say that it will be pushed to “hundreds of millions of iPhones and iPads” and launch globally, having been US-only so far.

Last month, Apple admitted that sales of music downloads on its iTunes store were declining. In the meantime, the development of Spotify, which has over 50 million active users, 25% of which are paying for subscription, has sparked rumors that Apple is going to compete in 2015 and beyond.

Apparently, pushing a rival app to every iPhone and iPad will encourage more people to try it. At the same time, the company seems to be pressing labels for licensing deals that will help it start a price war with competitors. The suggestions are that Apple’s plans for Beats Music go beyond simply rebranding the service and pushing it to iOS devices, as Beats Music’s chief creative officer recently hinted that he was working on new features for the service.

Integrating Apple’s streaming subscription service on every iOS device will likely be less a case of pushing an unwanted app to devices in similar vein to U2’s album iTunes giveaway, and more about incorporating Beats Music into the Music app that is already part of the Apple software.

Taking into account that Spotify remains the biggest streaming subscription music service, Apple may train its sights on Google, which has similar potential to preload its own streaming services on Android devices. It should also be mentioned that there are even more of Android devices out in the wild than iOS devices at the moment.

As usual, Apple hasn’t officially confirmed these plans yet.

Microsoft Warns about Vulnerability Targeting Taiwan

The tech giant warned about new unpatched software vulnerability affecting almost all Windows computers. The flaw looks very similar to the one used in recent hacker attacks on the Ukrainian government. Now it is being used against Taiwanese targets: the attackers create malicious PowerPoint documents which launch exploit code on target machines when opened. The security experts admit the hackers could have used any Office file, but for some reason those chose PowerPoint.

Cyber intelligence experts warned that another (though similar) flaw was being used in so-called “Sandworm” attacks against Ukraine, the European Union, Nato, French telecom companies and even Polish energy suppliers. In previous cases, Russian hackers were suspected of intrusions.

Security companies believe that the two vulnerabilities are linked and have been exploited in the same way. While investigating the patch for the first flaw, the researchers found out that the fix wasn’t working and the vulnerability could still be exploited. However, there is no evidence that the recent flaw was being used by the same Sandworm hacker crew. The security firm’s sensors had detected an activity indicating the zero-day vulnerability was being used to attack people in Taiwan. They came to a conclusion that the Microsoft’s patch for the Sandworm flaw didn’t work properly and the new vulnerability exploits that.

The researchers have seen a number of samples, one of which probably targeted Taiwan and delivered the Taidoor malware. This type of activity has been attributed to Chinese cyber espionage in the past.

3 Google and 2 McAfee researchers were credited with disclosing the latest flaw to Microsoft. It turned out that the vulnerability targets all supported versions of Windows except Windows Server 2003, originating from a technology called an Object Linking and Embedding (OLE) object – this one is used to share data between several applications. For example, in Microsoft Office this technology is used when parts of a file appear within another file, like when an Excel chart is included in a Word document.

When the victim opens a malicious document, usually received via email, they risked handing over control of their machine to the attackers. The experts point out that this vulnerability can’t directly grant an attacker administrator-level access, but would allow them the same permissions as the victim. Advanced users will notice the “User Access Control” popup that requires consent when a malicious file is opened. In the meantime, Microsoft didn’t disclose when it was going to release a patch for the bug, but the company has included a fix-it solution in its advisory.

So, for now, Internet users are recommended to be careful about opening Office documents received via email, social media or instant messengers from unknown parties. Everyone is also reminded of links from untrusted sources, because those may be used to launch a malicious Office document from the hacker’s website.

Google Offers Physical USB Security Key

The tech giant has finally announced a physical USB Security Key for two-factor authentication. The key is expected to ensure that users keep their accounts safe from intruders, but it has its own limitations. Users can buy a compatible USB from a third-party supplier and add the Security Key functionality. After doing so, they can start using it when logging in to Google’s services, including Gmail and Google Drive. The key will contain the code required for two-factor authentication, if the latter has been switched on.

Two-factor authentication is a popular method of security protection. It required both a password and an additional data able to verify the identity of the person logging in. Before, Google provided users with the second piece of authentication data by sending the code via text message or the Authenticator app. Now the USB key can be used without any input required from the keyboard.

The company promises that accounts with Security Key enabled will remain secure from hacking (unless hackers manage to steal the plastic key). This method is presented as more secure than using a smartphone, because hackers have infected mobile devices in the past to steal security codes.

The USB key will also make sure that the website the user is on is owned by Google and not by a third party who uses it for a “man-in-a-middle” attack. The Security Key will not transmit its cryptographic signature if some phishing service is trying to pretend a Google login page.

Google explains that instead of typing a code, you can now insert the Security Key into the USB port of your machine and tap it when prompted in Chrome. The company guarantees that the cryptographic signature can’t be phished when you sign into your Google Account using Chrome browser and the Security Key.

As you might have noticed, there is one significant limitation: the USB key only works via the Chrome browser, and people who use other Internet browsers won’t like it. In addition, there’s the need for added hardware – this can also put some people off.

Apparently, this innovation has its own disadvantages: it is another thing to carry around and keep track of, it requires the Chrome browser to work, and it can’t be used on mobile devices as it needs a USB port to work. Perhaps, the target audience for this innovation is non-technical people who don’t use smartphones and apps. Anyway, if this increases the number of people using two-factor authentication, it is a useful thing.
Besides that, Google is also joining and championing a movement called the FIDO (Fast IDentity Online) Alliance. The goal of the latter is to spread the open Universal 2nd Factor (U2F) protocol used by the Security Key across various websites, so people will only require one USB key for all of them.

FIDO Universal Authentication Framework is widely used in payments apps from PayPal, Samsung, AliPay, and others, and with Google now using FIDO U2F, it is clear that a new era has arrived, where users and providers are urged to move beyond single-factor passwords to more secure authentication.

Source: ET


Russia May Be Unplugged from the Internet

The Russian government is considering radical plans to unplug the country from the worldwide web in the event of a serious military confrontation or big anti-government protests.

Vladimir Putin scheduled meeting of his security council to discuss what steps they may take to disconnect the locals from the Internet “in case of emergency”. This move will help them strengthen the country’s sovereignty in cyberspace. One of the proposals is also to bring the domain .ru under state control.

Today most of the Russian youth do not watch TV or read newspapers. Their flat screens are connected to their laptops which stream online shows and movies. This is not just about the annoying commercials and stupid local TV shows ¬– the matter is that Russian TV and most of the country’s newspapers are already under the Kremlin’s thumb. However, unlike in China, the Internet in the country has so far remained a comparatively open place.

The discussion over “unplugging” the Internet comes at a time when Russia has been bitterly critical of the western media over the situation in Ukraine. The information war escalates, and nobody can tell for sure who is really involved there – on both sides of the conflict.

So, Russia may decide to introduce the new measures early in 2015. The government needs some time to reduce the country’s dependency on the US technology and digital infrastructure, fearing that its communications can be vulnerable to US spying. The suggestions were to build a “national Internet”, which would be a domestic intranet. The government may also strengthen control over ordinary Russian users and their digital habits.

Although it is unlikely that Russian officials would really disconnect the Internet, the moves may be a real step forward in the development of a besieged fortress mentality. While earlier these ideas were mostly to do with so-called government communications, which could make them independent from western technologies, it seems that now they want to expand this crazy idea to the entire Russian Internet.

By the way, the experts point out that it would be technically possible for the government to shut off the Internet. The matter is that Russia has surprisingly few international exchange points, and all of them are under the control of national long-distance operators, which are close to the authorities.

The most worrying thing is the security council’s proposal to take control over .ru (Russia), .su (Soviet Union) and .?? (Russian Federation in Cyrillic) domains. Now they belong to a non-government organization, and many are hosted abroad.

If the decision is approved very quickly, it would open the way to the next step – to force all domains in the .ru zone to be hosted in Russia. It should be noted that Kazakhstan, an authoritarian state intolerant of online criticism, did the same a couple years ago.

However, the Russian authorities explained that they are not going to unplug the worldwide web to escalate the information war – they rather want to protect Russian cyberspace in case of further Western sanctions that may affect the Internet. One has to admit this approach makes sense.

Everyone knows that the Russian economy, which is already teetering on the verge of recession, is also reeling from the stringent Western sanctions over Russia’s alleged(!) involvement in the Ukraine conflict. In fact, it is really strange to discuss its involvement in the destiny of the country, where almost all population is Russian. In result, Washington and Brussels have introduced sanctions that are the toughest punitive measures since the cold war. As the Russians themselves admit, they never noticed the impact of sanctions of the both sides on their daily lives.

Source: ET

Worldwide Web Accounts for Billion Websites

For the first time ever, the number of websites on the Internet has gone above one billion and continues growing. The statistics updated in real time by online tracker Internet Live Stats and tweeted by Sir Tim Berners-Lee (who is known as the father of the Internet), over a billion companies and individuals have their own page today.

According to the statistics, the agency responsible for managing addresses on the worldwide web expands choices far beyond .com and .net in order to provide more online real estate for the ever increasing number of websites. The experts admit that such sort of growth is not back for a technology that celebrated its 25 anniversary in April 2014.

The Internet was born from a technical paper from Sir Tim Berners-Lee, at the time an obscure, young computer scientist at a CERN lab in Switzerland. He outlined a way to easily access files on linked personal computers.

Today over 40% of the world’s population are connected to the Internet, and the number of Internet users worldwide is quickly approaching 3 billion – almost half of them come from Asia. According to the statistics, 2.3 billion emails are sent in each second, and not all of them are spam adverts. Over 75% of websites today are inactive, but are parked domains or similar. People view more than 88,500 YouTube videos in a second, and not all of them are cat related.

Finally, the number of new websites more than doubled two years ago, but then it decreased by more than 20 million. On the downside over 25,000 sites have been hacked and are probably sending out part of those 2.3 billion emails mentioned above.

Original Source: ET

Dropbox Disclosed Data on Government Requests

According to Dropbox’s transparency report, the service received 268 requests for user information from the authorities in the first half of 2014. Besides, the service also received 37 requests for information from abroad, noting that now Dropbox requires non-US governments to follow the Mutual Legal Assistance Treaty process to make a US court issue the required legal process to the company. Last year, Dropbox received 90 requests from abroad.

It is the first time that Dropbox published its transparency report biannually, also sharing data on how many national security requests were received from the American government. However, like other companies, Dropbox is only allowed to disclose the existence of these requests in a nonspecific aggregation. This means that the most information it can share is that “0-249” requests were received, affecting “0-249” accounts.

Of course, that number is small compared to 300 million users of Dropbox, and especially compared to millions of requests Google receives at the moment. However, the service points out that all the requests are treated seriously and scrutinized to make sure they satisfy legal requirements before complying. Dropbox also claims to push back in cases where agencies are looking for too much information or have failed to follow the proper procedures.

In result, the service handed over content 103 times, and “non-content” (such subscriber data as the name and email address; the date of account creation and other transactional information including IP addresses) was handed over 80 more times.

Dropbox also stressed its commitment to informing users of any requests from the law enforcement authorities for their information. At the same time, government agencies ask the service not to notify users of requests for their information, even when they are not legally entitled to do so. If Dropbox receives a request coming with a gag order, it will inform the requesting agency of its policy and let users know about the request unless the agency provides a valid court order.

Dropbox releases the transparency report for the third time now, but it hasn’t prevented attacks from Edward Snowden, calling the company “hostile to privacy” and blaming it of cooperating with NSA under the PRISM program.

Source: ET