пятница, 6 декабря 2013 г.

Satoshi Nakamoto is (probably) Nick Szabo


I recently became interested in identifying the pseudonymous creator of Bitcoin, Satoshi Nakamoto. I started from the Bitcoin whitepaper [0] published in late 2008, and proceeded to run reverse textual analysis –essentially, searching the internet for highly unusual turns of phrase and vocabulary patterns (in particular places which you would expect a cryptography researcher to contribute to), then evaluating the fitness of each match found by running textual similarity metrics on several pages of their writing.
Which led me rather directly to several articles from Nick Szabo’s blog.

пятница, 8 ноября 2013 г.

UBIC Launches Global Forensics Team

UBIC, a provider of strategic international litigation support through CJK TAR™(Technology Assisted Review) and forensic solutions, announced today the launch of Global Forensics Services, a globally deployed team of highly experienced, certified investigators supported with dedicated facilities in Asia and North America.
In support of its Global Forensics Services team, UBIC recently opened a state-of-the-art forensics laboratory in Silicon Valley, Calif., which complements its facility in Asia.
A global provider of eDiscovery services and solutions, UBIC built and maintained a formidable forensics capability over the past ten years to meet the needs of its global corporate and international law firm clients. Now, as evidence discovery pushes beyond a corporation’s own data network into an ever-expanding digital landscape that includes third-party enterprise networks, social media and personal digital devices, UBIC has focused its industry-leading computer forensics experience and capabilities into a dedicated, highly experienced team of consultants and examiners, most drawn from existing functions within UBIC’s world-leading eDiscovery business.
“We are taking this step to provide our clients a dedicated, strategic ally in managing the formidable, complex challenges related to large-scale, global investigations,” UBIC Chairman and Chief Executive Officer Masahiro Morimoto stated.
Combined with similar facilities and experts in Asia and the company’s recently released Xaminer™ forensics software, UBIC has materially expanded its capacity to meet fast-growing demand for sophisticated forensic investigation services.
Corporate Forensics Services, a Growth Industry
Business news reports over the past 12 months establish a trend of increased attention by governments to cross-border business practices and transactions, a result of rigorous and far-reaching laws and regulations put in place by individual nations and multinational regulatory organizations to govern the activities of corporations and the behaviors their employees.
UBIC’s Global Forensic Team consults with international corporations efficiently and strategically to manage the intensive, high-stakes demands of internal as well as government-initiated investigations, in addition to preparing for the litigation of multi-million dollar lawsuits.
“Whether to conduct investigations, evaluate data or provide expert testimony, UBIC can deploy its forensics team representatives in a matter of hours to jurisdictions virtually anywhere in the world,” stated Mr. Naritomo Ikeue, President and COO, UBIC North America, Inc. “The manner in which such investigations are conducted, can have enormous impact on a particular business as well as the reputation and valuation of an entire corporation.”
Specialized Expertise & Experience Defines UBIC Services and Solutions
The new unit offers a host of specialized competencies including the ability to conduct a thorough incident response investigation involving the identification and collection of evidence from multiple and far-flung corporate information networks as well as individual employees’ personal digital devices including smartphones.
UBIC’s Global Forensic Services team is supported with state-of-the-art analytical software, including UBIC’s own Xaminer™ forensics suite and its Lit i View™ data processing, search and review platform.
With these tools UBIC’s Global Forensics Services team can identify and manage vast volumes of data in multiple languages to quickly categorize, evaluate and rank the relevance of information and communications relative to a particular investigative focus, issue or concern.
About UBIC
UBIC, Inc. (TSE: 2158; NASDAQ: UBIC) is a leading provider of Asian-language eDiscovery, forensic solutions and services. UBIC has extensive eDiscovery and forensic experience and expertise with information documented in Japanese, Korean, Chinese as well as English languages, and applies its expertise in connection with cross-border litigation, administrative proceedings and internal investigations, including those related to anti-trust investigations, intellectual property (IP) litigation, the Foreign Corrupt Practices Act (FCPA) and product liability (PL) investigations. UBIC serves its clients from offices in Japan, the United States, South Korea, Taiwan, Hong Kong and the United Kingdom.
UBIC’s proprietary technology platform, Lit i View™, version 6.7, is an innovative eDiscovery solution that accurately handles Asian-language characters, encoding schemes and native file systems. UBIC also recently launched its flexible and customizable Legal Cloud™ service to address the problem of rising costs associated with the growth and dispersion of data volumes across the globe, along with prolonged investigations and litigations.
With flexible, customizable end-to-end solutions and services covering the entire electronic discovery reference model (EDRM) life-cycle for corporate litigation strategy and crisis management, UBIC has assisted clients in more than 310 administrative and legal proceedings in the United States, including Department of Justice (DOJ), International Trade Commission (ITC) and Securities and Exchange Commission (SEC) investigations and more than 700 corporate investigations in Japan, South Korea, China, Taiwan and Singapore. Assisted by highly experienced litigation attorneys, UBIC provides a range of services facilitating fact discovery, patent management, security, internal audit and regulatory compliance that can provide a significant cost savings to its clients.
Source: http://www.prweb.com/releases/2013/11/prweb11311200.htm

четверг, 4 апреля 2013 г.

Secret Files Expose Offshore’s Global Impact

Dozens of journalists sifted through millions of leaked records and thousands of names to produce ICIJ’s investigation into offshore secrecy ­

A cache of 2.5 million files has cracked open the secrets of more than 120,000 offshore companies and trusts, exposing hidden dealings of politicians, con men and the mega-rich the world over.

The secret records obtained by the International Consortium of Investigative Journalists lay bare the names behind covert companies and private trusts in the British Virgin Islands, the Cook Islands and other offshore hideaways.

They include American doctors and dentists and middle-class Greek villagers as well as families and associates of long-time despots, Wall Street swindlers, Eastern European and Indonesian billionaires, Russian corporate executives, international arms dealers and a sham-director-fronted company that the European Union has labeled as a cog in Iran’s nuclear-development program.

The leaked files provide facts and figures — cash transfers, incorporation dates, links between companies and individuals — that illustrate how offshore financial secrecy has spread aggressively around the globe, allowing the wealthy and the well-connected to dodge taxes and fueling corruption and economic woes in rich and poor nations alike.

The records detail the offshore holdings of people and companies in more than 170 countries and territories.

The hoard of documents represents the biggest stockpile of inside information about the offshore system ever obtained by a media organization. The total size of the files, measured in gigabytes, is more than 160 times larger than the leak of U.S. State Department documents by Wikileaks in 2010.

To analyze the documents, ICIJ collaborated with reporters from The Guardian and the BBC in the U.K., Le Monde in France, Süddeutsche Zeitung and Norddeutscher Rundfunk in Germany, The Washington Post, the Canadian Broadcasting Corporation (CBC) and 31 other media partners around the world.

Eighty-six journalists from 46 countries used high-tech data crunching and shoe-leather reporting to sift through emails, account ledgers and other files covering nearly 30 years.

“I’ve never seen anything like this. This secret world has finally been revealed,” said Arthur Cockfield, a law professor and tax expert at Queen’s University in Canada, who reviewed some of the documents during an interview with the CBC. He said the documents remind him of the scene in the movie classic The Wizard of Oz in which “they pull back the curtain and you see the wizard operating this secret machine.”

Mobsters and Oligarchs

The vast flow of offshore money — legal and illegal, personal and corporate — can roil economies and pit nations against each other. Europe’s continuing financial crisis has been fueled by a Greek fiscal disaster exacerbated by offshore tax cheating and by a banking meltdown in the tiny tax haven of Cyprus, where local banks’ assets have been inflated by waves of cash from Russia.

Anti-corruption campaigners argue that offshore secrecy undermines law and order and forces average citizens to pay higher taxes to make up for revenues that vanish offshore. Studies have estimated that cross-border flows of global proceeds of financial crimes total between $1 trillion and $1.6 trillion a year.

ICIJ’s 15-month investigation found that, alongside perfectly legal transactions, the secrecy and lax oversight offered by the offshore world allows fraud, tax dodging and political corruption to thrive.

Offshore patrons identified in the documents include:

  • Individuals and companies linked to Russia’s Magnitsky Affair, a tax fraud scandal that has strained U.S.-Russia relations and led to a ban on Americans adopting Russian orphans.
  • A Venezuelan deal maker accused of using offshore entities to bankroll a U.S.-based Ponzi scheme and funneling millions of dollars in bribes to a Venezuelan government official.
  • A corporate mogul who won billions of dollars in contracts amid Azerbaijani President Ilham Aliyev’s massive construction boom even as he served as a director of secrecy-shrouded offshore companies owned by the president’s daughters.
  • Indonesian billionaires with ties to the late dictator Suharto, who enriched a circle of elites during his decades in power.

The documents also provide possible new clues to crimes and money trails that have gone cold.

After learning ICIJ had identified the eldest daughter of the late dictator Ferdinand Marcos, Maria Imelda Marcos Manotoc, as a beneficiary of a British Virgin Islands (BVI) trust, Philippine officials said they were eager to find out whether any assets in the trust are part of the estimated $5 billion her father amassed through corruption.

Manotoc, a provincial governor in the Philippines, declined to answer a series of questions about the trust.

Politically connected wealth

Imee MarcosMaria Imelda Marcos Manotoc

The files obtained by ICIJ shine a light on the day-to-day tactics that offshore services firms and their clients use to keep offshore companies, trusts and their owners under cover.

Tony Merchant, one of Canada’s top class-action lawyers, took extra steps to maintain the privacy of a Cook Islands trust that he’d stocked with more than $1 million in 1998, the documents show.

In a filing to Canadian tax authorities, Merchant checked “no” when asked if he had foreign assets of more than $100,000 in 1999, court records show.

Between 2002 and 2009, he often paid his fees to maintain the trust by sending thousands of dollars in cash and traveler’s checks stuffed into envelopes rather than using easier-to-trace bank checks or wire transfers, according to documents from the offshore services firm that oversaw the trust for him.

One file note warned the firm’s staffers that Merchant would “have a st[r]oke” if they tried to communicate with him by fax.

Tony Merchant.Tony Merchant.

It is unclear whether his wife, Pana Merchant, a Canadian senator, declared her personal interest in the trust on annual financial disclosure forms. 

Under legislative rules, she had to disclose every year to the Senate’s ethics commissioner that she was a beneficiary of the trust, but the information was confidential.

The Merchants declined requests for comment.

Other high profile names identified in the offshore data include the wife of Russia’s deputy prime minister, Igor Shuvalov, and two top executives with Gazprom, the Russian government-owned corporate behemoth that is the world’s largest extractor of natural gas.

Shuvalov’s wife and the Gazprom officials had stakes in BVI companies, documents show. All three declined comment.

In a neighboring land, the deputy speaker of Mongolia’s Parliament said he was considering resigning from office after ICIJ questioned him about records showing he has an offshore company and a secret Swiss bank account.

“I shouldn’t have opened that account,” Bayartsogt Sangajav, who has also served as his country’s finance minister, said. “I probably should consider resigning from my position.”

Bayartsogt said his Swiss account at one point contained more than $1 million, but most of the money belonged to what he described as “business friends” he had joined in investing in international stocks.

He acknowledged that he hasn’t officially declared his BVI company or the Swiss account in Mongolia, but he said he didn’t avoid taxes because the investments didn’t produce income. 

“I should have included the company in my declarations,” he said.

Wealthy Clients

The documents also show how the mega-rich use complex offshore structures to own mansions,  art and other assets, gaining tax advantages and anonymity not available to average people.

Baroness Carmen Thyssen-Bornemisza.Baroness Carmen Thyssen-Bornemisza.

Spanish names include a baroness and famed art patron, Carmen Thyssen-Bornemisza, who is identified in the documents using a company in the Cook Islands to buy artwork through auction houses such as Sotheby’s and Christie’s, including Van Gogh’s Water Mill at Gennep.

Her attorney acknowledged that she gains tax benefits by holding ownership of her art offshore, but stressed that she uses tax havens primarily because they give her “maximum flexibility” when she moves art from country to country.

Among nearly 4,000 American names is Denise Rich, a Grammy-nominated songwriter whose ex-husband was at the center of an American pardon scandal that erupted as President Bill Clinton left office.

A Congressional investigation found that Rich, who raised millions of dollars for Democratic politicians, played a key role in the campaign that persuaded Clinton to pardon her ex-spouse, Marc Rich, an oil trader who had been wanted in the U.S. on tax evasion and racketeering charges.

Denise Rich.Denise Rich.

Records obtained by ICIJ show she had $144 million in April 2006 in a trust in the Cook Islands, a chain of coral atolls and volcanic outcroppings nearly 7,000 miles from her home at the time in Manhattan.

The trust’s holdings included a yacht called the Lady Joy, where Rich often entertained celebrities and raised money for charity.

Rich, who gave up her U.S. citizenship in 2011 and now maintains citizenship in Austria, did not reply to questions about her offshore trust.

Another prominent American in the files who gave up his citizenship is a member of the Mellon dynasty, which started landmark companies such as Gulf Oil and Mellon Bank. James R. Mellon – an author of books about Abraham Lincoln and his family’s founding patriarch, Thomas Mellon – used four companies in the BVI and Lichtenstein to trade securities and transfer tens of millions of dollars among offshore bank accounts he controlled.

Like many offshore players, Mellon appears to have taken steps to distance himself from his offshore interests, the documents show. He often used third parties’ names as directors and shareholders of his companies rather than his own, a legal tool that owners of offshore entities often use to preserve anonymity.

James R. Mellon.James R. Mellon.

Reached in Italy where lives part of the year, Mellon told ICIJ that, in fact, he used to own “a whole bunch” of offshore companies but has disposed of all of them.  He said he set up the firms for “tax advantage” and liability reasons, as advised by his lawyer. “But I have never broken the tax law.”

Of the use of nominees, Mellon said that “that’s the way these firms are set up,” and added that it’s useful for people like him who travel a lot to have somebody else in charge of his businesses. “I just heard of a presidential candidate who had a lot of money in the Cayman Islands,” Mellon, now a British national, said, alluding to former U.S. presidential candidate Mitt Romney.

“Not everyone who owns offshores is a crook.”

Offshore growth

The anonymity of the offshore world makes it difficult to track the flow of money. A study by James S. Henry, former chief economist at McKinsey & Company, estimates that wealthy individuals have $21 trillion to $32 trillion in private financial wealth tucked away in offshore havens — roughly equivalent to the size of the U.S. and Japanese economies combined.

Even as the world economy has stumbled, the offshore world has continued to grow, said Henry, who is a board member of the Tax Justice Network, an international research and advocacy group that is critical of offshore havens. His research shows, for example, that assets managed by the world’s 50 largest “private banks” — which often use offshore havens to serve their “high net worth” customers — grew from $5.4 trillion in 2005 to more than $12 trillion in 2010.

Henry and other critics argue that offshore secrecy has a corrosive effect on governments and legal systems, allowing crooked officials to loot national treasuries and providing cover to human smugglers, mobsters, animal poachers and other exploiters.

Offshore’s defenders counter that most offshore patrons are engaged in legitimate transactions. Offshore centers, they say, allow companies and individuals to diversify their investments, forge commercial alliances across national borders and do business in entrepreneur-friendly zones that eschew the heavy rules and red tape of the onshore world.

“Everything is much more geared toward business,” David Marchant, publisher of OffshoreAlert, an online news journal, said. “If you’re dishonest you can take advantage of that in a bad way. But if you’re honest you can take advantage of that in a good way.”

Much of ICIJ’s reporting focused on the work of two offshore firms, Singapore-based Portcullis TrustNet and BVI-based Commonwealth Trust Limited (CTL), which have helped tens of thousands of people set up offshore companies and trusts and hard-to-trace bank accounts.

Regulators in the BVI found that CTL repeatedly violated the islands’ anti-money-laundering laws between 2003 and 2008 by failing to verify and record its clients’ identities and backgrounds. “This particular firm had systemic money laundering issues within their organization,” an official with the BVI’s Financial Services Commission said last year.

The documents show, for example, that CTL set up 31 companies in 2006 and 2007 for an individual later identified in U.K. court claims as a front man for Mukhtar Ablyazov, a Kazakh banking tycoon who has been accused of stealing $5 billion from one of the former Russian republic’s largest banks. Ablyazov denies wrongdoing.

Thomas Ward, a Canadian who co-founded CTL in 1994 and continues to work as a consultant to the firm, said CTL’s client-vetting procedures have been consistent with industry standards in the BVI, but that no amount of screening can ensure that firms such as CTL won’t be “duped by dishonest clients” or sign on “someone who appears, to all historical examination, to be honest” but “later turns to something dishonest.”

“It is wrong, though perhaps convenient, to demonize CTL as by far the major problem area,” Ward said in a written response to questions. “Rather I believe that CTL’s problems were, by and large, directly proportional to its market share.”

ICIJ’s review of TrustNet documents identified 30 American clients accused in lawsuits or criminal cases of fraud, money laundering or other serious financial misconduct. They include ex-Wall Street titans Paul Bilzerian, a corporate raider who was convicted of tax fraud and securities violations in 1989, and Raj Rajaratnam, a billionaire hedge fund manager who was sent to prison in 2011 in one of the biggest insider trading scandals in U.S. history.

TrustNet declined to answer a series of questions for this article.

Blacklisted

The records obtained by ICIJ expose how offshore operatives help their customers weave elaborate financial structures that span countries, continents and hemispheres.

A Thai government official with links to an infamous African dictator used Singapore-based TrustNet to set up a secret company for herself in the BVI, the records show.

Nalinee Taveesin.Nalinee Taveesin.The Thai official, Nalinee “Joy” Taveesin, is currently Thailand’s international trade representative. She served as a cabinet minister for Prime Minister Yingluck Shinawatra before stepping down last year.

Taveesin acquired her BVI company in August 2008. That was seven months after she’d been appointed an advisor to Thailand’s commerce minister — and three months before the U.S. Department of Treasury blacklisted her as a “crony” of Zimbabwean dictator Robert Mugabe.

The Treasury Department froze her U.S. assets, accusing her of “secretly supporting the kleptocratic practices of one of Africa’s most corrupt regimes” through gem trafficking and other deals made on behalf of Mugabe’s wife, Grace, and other powerful Zimbabweans.

Taveesin has said her relationship with the Mugabes is “strictly social” and that the U.S. blacklisting is a case of guilt by association. Through her secretary, Taveesin flatly denied that she owns the BVI company. ICIJ verified her ownership using TrustNet records that listed her and her brother as shareholders of the company and included the main address in Bangkok for her onshore business ventures.

Records obtained by ICIJ also reveal a secret company belonging to Muller Conrad “Billy” Rautenbach, a Zimbabwean businessman who was blacklisted by the U.S. for his ties to the Mugabe regime at the same time as Taveesin. The Treasury Department said Rautenbach has helped organize huge mining projects in Zimbabwe that “benefit a small number of corrupt senior officials.”

When CTL set Rautenbach up with a BVI company in 2006 he was a fugitive, fleeing fraud allegations in South Africa. The charges lodged personally against him were dismissed, but a South African company he controlled pleaded guilty to criminal charges and paid a fine of roughly $4 million.

Rautenbach denies U.S. authorities’ allegations, contending that they made “significant factual and legal errors” in their blacklisting decision, his attorney, Ian Small Smith, said. Smith said Rautenbach’s BVI company was set up as “special purpose vehicle for investment in Moscow” and that it complied with all disclosure regulations. The company is no longer active.

‘One Stop Shop’

Offshore’s customers are served by a well-paid industry of middlemen, accountants, lawyers and banks that provide cover, set up financial structures and shuffle assets on their clients’ behalf.

Documents obtained by ICIJ show how two top Swiss banks, UBS and Clariden, worked with TrustNet to provide their customers with secrecy-shielded companies in the BVI and other offshore centers.

Clariden, owned by Credit Suisse, sought such high levels of confidentiality for some clients, the records show, that a TrustNet official described the bank’s request as “the Holy Grail” of offshore entities — a company so anonymous that police and regulators would be “met with a blank wall” if they tried to discover the owners’ identities.

Clariden declined to answer questions about its relationship with TrustNet.

“Because of Swiss banking secrecy laws, we are not allowed to provide any information about existing or supposed accountholders,” the bank said. “As a general rule, Credit Suisse and its related companies respect all the laws and regulations in the countries in which they are involved.”

A spokesperson for UBS said the bank applies “the highest international standards” to fight money laundering, and that TrustNet “is one of over 800 service providers globally which UBS clients choose to work with to provide for their wealth and succession planning needs. These service providers are also used by clients of other banks. 

TrustNet describes itself as a “one-stop shop” — its staff includes lawyers, accountants and other experts who can shape secrecy packages to fit the needs and net worths of its clients. These packages can be simple and cheap, such as a company chartered in the BVI. Or they can be sophisticated structures that weave together multiple layers of trusts, companies, foundations, insurance products and so-called “nominee” directors and shareholders.

When they create companies for their clients, offshore services firms often appoint faux directors and shareholders — proxies who serve as stand-ins when the real owners of companies don’t want their identities known. Thanks to the proliferation of proxy directors and shareholders, investigators tracking money laundering and other crimes often hit dead ends when they try to uncover who is really behind offshore companies.

An analysis by ICIJ, the BBC and The Guardian identified a cluster of 28 “sham directors” who served as the on-paper representatives of more than 21,000 companies between them, with individual directors representing as many 4,000 companies each.

Among the front men identified in the documents obtained by ICIJ is a U.K.-based operative who served as a director for a BVI company, Tamalaris Consolidated Limited, which the European Union has labeled as a front company for the Islamic Republic of Iran Shipping Line. The E.U., the U.N. and the U.S. have accused IRISL of aiding Iran’s nuclear-development program.

TrustNet Thousands of offshore entities are headquartered on this building's third floor, which houses TrustNet's Cook Islands office. Photo: Alex Shprintsen

‘Zone of Impunity’

International groups have been working for decades to limit tax cheating and corruption in the offshore world.

In the 1990s, the Organization for Economic Cooperation and Development began pushing offshore centers to reduce secrecy and get tougher on money laundering, but the effort ebbed in the 2000s. Another push against tax havens began when U.S. authorities took on UBS, forcing the Swiss bank to pay $780 million in 2009 to settle allegations that it had helped Americans dodge taxes. U.S. and German authorities have pressured banks and governments to share information about offshore clients and accounts and UK Prime Minister David Cameron has vowed to use his leadership of the G8, a forum of the world’s richest nations, to help crack down on tax evasion and money laundering.

Promises like those have been met with skepticism, given the role played by key G8 members — the U.S., the U.K. and Russia — as sources and destinations of dirty money. Despite the new efforts, offshore remains a “zone of impunity” for anyone determined to commit financial crimes, said Jack Blum, a former U.S. Senate investigator who is now a lawyer specializing in money laundering and tax fraud cases.

“Periodically, the stench gets so bad somebody has to get out there and clap the lid on the garbage can and sit on it for a while,” Blum said. “There’s been some progress, but there’s a bloody long way to go.”

 

source

суббота, 30 марта 2013 г.

Android Trojan Found in Targeted Attack

source

In the past, we've seen targeted attacks against Tibetan and Uyghur activists on Windows and Mac OS X platforms. We've documented several interesting attacks (A Gift for Dalai Lamas Birthday and Cyber Attacks Against Uyghur Mac OS X Users Intensify) which used ZIP files as well as DOC, XLS and PDF documents rigged with exploits.

Several days ago, the e-mail account of a high-profile Tibetan activist was hacked and used to send targeted attacks to other activists and human rights advocates. Perhaps the most interesting part is that the attack e-mails had an APK attachment - a malicious program for Android.

The attack

On March 24th, 2013, the e-mail account of a high-profile Tibetan activist was hacked and used to send spear phishing e-mails to their contact list. This is what the spear phishing e-mail looked like:

In regards to the message text above, multiple activist groups have recently organized a human rights conference event in Geneva. We've noticed an increase in the number of attacks using this event as a lure. Here's another example of such an attack hitting Windows users:

Going back to the Android Package (APK) file was attached to the e-mail, this is pushing an Android application named "WUC's Conference.apk".

This malicious APK is 334326 bytes file, MD5: 0b8806b38b52bebfe39ff585639e2ea2 and is detected by Kaspersky Lab products as "Backdoor.AndroidOS.Chuli.a".

After the installation, an application named "Conference" appears on the desktop:

If the victim launches this app, he will see text which "enlightens" the information about the upcoming event:

The full text reads follows. Notice notice the use of the mistaken "Word" instead of "World":

"On behalf of all at the Word Uyghur Congress (WUC), the Unrepresented Nations and Peoples Organization (UNPO) and the Society for Threatened Peoples (STP), Human Rights in China: Implications for East Turkestan, Tibet and Southern Mongolia

In what was an unprecedented coming-together of leading Uyghur, Mongolian, Tibetan and Chinese activists, as well as other leading international experts, we were greatly humbled by the great enthusiasm, contribution and desire from all in attendance to make this occasion something meaningful, the outcome of which produced some concrete, action-orientated solutions to our shared grievances. We are especially delighted about the platform and programme of work established in the declaration of the conference, upon which we sincerely hope will be built a strong and resolute working relationship on our shared goals for the future. With this in mind,we thoroughly look forward to working with you on these matters.

Dolkun lsa

Chairman of the Executive Committee

 

Word Uyghur Congress"

While the victim reads this fake message, the malware secretly reports the infection to a command-and-control server. After that, it begins to harvest information stored on the device. The stolen data includes:

  • Contacts (stored both on the phone and the SIM card).
  • Call logs.
  • SMS messages.
  • Geo-location.
  • Phone data (phone number, OS version, phone model, SDK version).

It is important to note that the data won't be uploaded to C&C server automatically. The Trojan waits for incoming SMS messages (the "alarmReceiver.class") and checks whether these messages contain one of the following commands: "sms", "contact", "location", "other". If one these commands is found, then the malware will encode the stolen data with Base64 and upload it to the command and control server. The C2 URL is:

hxxp://64.78.161.133/*victims's_cell_phone_number*/process.php

In addition to this, the malware also reports to another script, "hxxp://64.78.161.33/android.php". First, it will get the "nativenumber" variable from the "telmark" value of "AndroidManifest.xml". This is hardcoded and equals "phone". Then, it will add the result of the public method localDate.getTime(), which simply gets the current date. An example of the string which is sent to the command-and-control would be "phone 26.03.2013".

It is interesting that the attackers used Java Base64 library developed by Sauron Software. This software is free and distributed under LGPL license.

Also, command communications with the malware are parsed with a function named "chuli()" prior to POSTing stolen data to the command-and-control server. It appears that the attackers are somewhat familiar with the language and mountain-trekking culture of the targets - the meaning of "chuli" is "summit":

The command-and-control server and parameters can be easily seen in the decompiled source code:

Command and control server interaction code

Throughout the code, the attackers log all important actions, which include various messages in Chinese. This was probably done for debugging purposes, indicating the malware may be an early prototype version. Some actions include (with rough translations):

The command-and-control server

The command-and-control server is located at IP 64.78.161.133. This IP is located in Los Angeles, U.S.A., at a hosting company named "Emagine Concept Inc".

Interestingly, there is a domain which used to point there, "DlmDocumentsExchange.com". The domain was registered on March 8th, 2013:

Registration Service Provided By: SHANGHAI MEICHENG TECHNOLOGY INFORMATION DEVELOPMENT CO., LTD.

Domain Name: DLMDOCUMENTSEXCHANGE.COM

Registration Date: 08-Mar-2013

Expiration Date: 08-Mar-2014

 

Status:LOCKED

The domain registration data indicates the following owner:

Registrant Contact Details:

peng jia

peng jia (bdoufwke123010@gmail.com)

beijingshiahiidienquc.d

beijingshi

beijing,100000

CN

Tel. +86.01078456689

 

Fax. +86.01078456689

The command-and-control server is hosting an index page which also serves an APK file:

The referenced "Document.apk" is 333583 bytes in size, MD5: c4c4077e9449147d754afd972e247efc. It has the same functionality as the one described above but contains different text. The new text (in Chinese, about relations between China, Japan and the disputed "Senkaku Islands / Diaoyudao Islands / Diaoyutai Islands") is shown to the victims and reads as following:

When opened in a browser, this is what the command-and-control index page looks like:

The text on the top means "Title Title Title" in Chinese, while the other strings appear to be random characters typed from the keyboard.

Interestingly, the command and control server includes a publicly accessible interface to work with the victims:

Some of the commands with rough translations:

The command-and-control server is running Windows Server 2003 and has been configured for Chinese language:

This, together with the logs, is a strong indicator that the attackers are Chinese-speaking.

Conclusions

Every day, there are hundreds if not thousands of targeted attacks against Tibetan and Uyghur supporters. The vast majority of these target Windows machines through Word documents exploiting known vulnerabilities such as CVE-2012-0158, CVE-2010-3333 and CVE-2009-3129.

In this case, the attackers hacked a Tibetan activist's account and used it to attack Uyghur activists. It indicates perhaps an interesting trend which is exploiting the trust relationships between the two communities. This technique reminds us of a combination between ages old war strategies "Divide et impera" and "By way of deception".

Until now, we haven't seen targeted attacks against mobile phones in the wild, although we've seenindications that these were in development.

The current attack took advantage of the compromise of a high-profile Tibetan activist. It is perhaps the first in a new wave of targeted attacks aimed at Android users. So far, the attackers relied entirely on social engineering to infect the targets. History has shown us that, in time, these attacks will use zero-day vulnerabilities, exploits or a combination of techniques.

For now, the best protection is to avoid any APK attachments that arrive on mobile phones via e-mail.

We detect the malware used in this attack as "Backdoor.AndroidOS.Chuli.a".

MD5s:

c4c4077e9449147d754afd972e247efc Document.apk

 

0b8806b38b52bebfe39ff585639e2ea2 WUC's Conference.apk

When a Secretive Stingray Cell Phone Tracking "Warrant" Isn't a Warrant

An Arizona federal court this afternoon will be the battleground over the government's use of a "Stingray" surveillance device in a closely watched criminal case, United States v. Rigmaiden. And in an important development, new documents revealed after an ACLU of Northern California Freedom of Information Act (FOIA) request should leave the government with some explaining to do.

"Stingray" is the brand name of an International Mobile Subscriber Identity locator, or “IMSI catcher.” A Stingray acts as a fake cell-phone tower, small enough to fit in a van, allowing the government to route all network traffic to the fake tower. We've warned that Stingrays are dangerous because they have the capability to obtain the contents of electronic and wire communications while necessarily sucking down data on scores of innocent people along the way.

The Fourth Amendment requires searches be "reasonable," generally meaning they must be accompanied by a warrant. To get a warrant, the government must show there is probable cause to believe the place they want to search will have evidence of a crime. And it means the judge must ensure the warrant is "particular," or limited to only allow searches into areas where the evidence is most likely to be found. The only way a judge can make these tough decisions is with the government being forthright about what it's doing.

But when it comes to Stingrays the government has been extremely secretive about its use, withholding documents in FOIA requests, failing to explain (or even understand) the technology to a Texas federal judge and in Rigmaiden, misleading the court about the fact it's even using one at all.

Daniel David Rigmaiden is charged with a variety of tax and wire fraud crimes. Hoping to pinpoint Rigmaiden's precise location within an apartment complex, federal agents applied for an order requesting the court to order Verizon to help the agents pinpoint the physical location of a wireless broadband access card and cell phone they believed Rigmaiden was using. The order is clearly directed towards Verizon:

The Court therefore ORDERS, pursuant to Federal Rule of Criminal Procedure 41(b); Title 18, United States Code, Sections 2703 and 3117; and Title 28, United States Code, Section 1651, that Verizon Wireless, within ten (10) days of the signing of this Order and for a period not to exceed 30 days, unless extended by the Court, shall provide to agents of the FBI data and information obtained from the monitoring of transmissions related to the location of the Target Broadband Access Card/Cellular Telephone...

Ultimately, it turns out the government did not just get Verizon to give it the data. It also used a Stingray device to find Rigmaiden, sucking up loads of other data from other electronic devices in the complex as well, which it deleted.

When Rigmaiden filed a motion to suppress the Stingray evidence as a warrantless search in violation of the Fourth Amendment, the government responded that this order was a search warrant that authorized the government to use the Stingray. Together with the ACLU of Northern California and the ACLU, we filed an amicus brief in support of Rigmaiden, noting that this "order" wasn't a search warrant because it was directed towards Verizon, made no mention of an IMSI catcher or Stingray and didn't authorize the governmentrather than Verizonto do anything. Plus to the extent it captured loads of information from other people not suspected of criminal activity it was a "general warrant," the precise evil the Fourth Amendment was designed to prevent.

The FOIA documents bolster our argument that this isn't a warrant. The documents are a series of internal emails from DOJ attorneys in the United States Attorney's Office for the Northern District of California, the district where the order in Rigmaiden's case was issued. Theemails make clear that U.S. Attorneys in the Northern California were using Stingrays but not informing magistrates of what exactly they were doing. And once the judges got wind of what was actually going on, they were none too pleased:

As some of you may be aware, our office has been working closely with the magistrate judges in an effort to address their collective concerns regarding whether a pen register is sufficient to authorize the use of law enforcement's WIT technology (a box that simulates a cell tower and can be placed inside a van to help pinpoint an individual's location with some specificity) to locate an individual. It has recently come to my attention that many agents are still using WIT technology in the field although the pen register application does not make that explicit.

While we continue work on a long term fix for this problem, it is important that we are consistent and forthright in our pen register requests to the magistrates… 

These emails, combined with the text of the disputed order itself, suggest agents obtained authorization to use a pen register without indicating they also planned to use a Stingray. Either at the time of the application or after the fact, the government attempted to transform that order into a warrant that authorized the use of a Stingray.

Judicial superivison of searches is most needed when the government uses new technologies to embark into new and unknown privacy intrusions. But when the government hides what it's really doing, it removes this important check on government power. We hope the court sees its been duped, and makes clear to the government that honesty and a warrant are requirements to using a Stingray.

source

понедельник, 25 марта 2013 г.

Multiplatform Wiper widespread in attacks against South Korea

Recently South Korea has been hit by powerful cyber attack malware based, network provided by LG UPlus Corp was hacked by a group calling itself the “Whois Team”. The attack targeted also media and banking of the country, television networks YTN, MBC and KBS and Shinhan Bank and NongHyup Bank, two major banks of the country, suffered serious outage. Fortunately according South Korea’s representative none of critical infrastructures of the country was interested by the attacks.  

WhoIsTeam

All principal security firms are investigating on the event analyzing the malicious code used for the attacks that revealed the capability to erase data also on Linux machines.  The source code of the Windows malware used by attackers presented an unexpected surprise, it was in fact equipped with a module able to work on Linux systems erasing the disks.

The malware include also a BASH shell script, attempts to erase partitions Unix systems, including Linux and HP-UX.

“The bash script is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions. It wipes out the /kernel, /usr, /etc, and /home directories.”

S_Korea_Wiper_Code

The discovery was announced by Symantec firms that dubbed it Jokra, following an extract from its blog post:

” The dropper for Trojan.Jokra contains a module for wiping remote Linux machines. We do not normally see components that work on multiple operating systems, so it is interesting to discover that the attackers included a component to wipe Linux machines inside a Windows threat.”

The trojan Jokra runs on Windows XP and 7 invoking an open source remote access manager, named mRemote, that could be used to manage devices on different platforms.

The malware is able to overwrite the Master Boot Record of the infected machine making impossible the bootstrapping, according McAfee analysis the agent wiped out the MBR on the hard drives overwriting it with either one of these strings:

  • PRINCIPES
  • HASTATI
  • PR!NCPES
  • HASTATI and PR!NCPES in combination
  • PRINCPES

 S_Korea_Wiper2

Malware analysts at McAfee explained in their post on the topic:

“The attack also overwrote random parts of the file system with the same strings, rendering several files unrecoverable,” “So even if the MBR is recovered, the files on disk will be compromised too.”

“Three wipers are packaged as a position-independent executable (PIE) and a fourth as a dynamic-link library (DLL) injection. There are also some differences in regard to the timing.”

Another interesting behavior observed by researchers is that the malware also try to kill processes related two South Korean antivirus products commercialized by the companies Ahnlab and Hauri.

Avast security firm discovered the alleged source of the attack against Korean banks, it seems started from website of the Korean Software Property Right Council compromised to serve up an iframe that delivered an attack hosted on a third website.

Officials confirmed that the analysis of IP addresses did not reveal the real responsible for the attacks, due this reason Government of Seoul hasn’t speculated about the event, neither it has blamed North Korea, the situation is very complex and cyber attacks observed on this day may have been triggered by independent groups of hackers or by other states interested in exacerbating tensions in the area.

source

CrySyS Lab revealed a decennial cyber espionage operation by TeamSpy

Last week was monopolized by discussion on cyber attacks that hit North and South Korea, but was found a news equally stunning, researchers at Hungary-basedCrySyS Lab have discovered a decade-long cyber espionagecampaign that targeted high-level political and industrial entities in Eastern Europe.

The attackers, dubbed by security researchers TeamSpy, used the popular remote-access program TeamViewer and a specially crafted malware to steal secret documents and encryption keys from victims.

TeamSpy_FileStolen

TeamSpy used various methods for cyber espionage including the use of a digitally signed malicious version of TeamViewer in which has been included “DLL hijacking” library to allow spying activities in real-time. Once installed the compromised program provides attackers with a backdoor to control victims.

Which are the targets of cyber espionage campaign?

The hackers hit a large variety of high-level subjects including Russia-based Embassy for a not reveled undisclosed country belonging to both NATO and the European Union, multiple research and educational organizations in France and Belgium, an electronics company located in Iran and an industrial manufacturer located in Russia. Following the list provided by the post in the correct timeline.

  • 11/2012: Hungarian high profile governmental victim.
  • 03/2013: Embassy of NATO/EU state in Russia
  • 04/2010: Electronics company in Middle-East, Govt. background
  • 03/2013: Multiple research/educational organizations in France and Belgium
  • 03/2013: Industrial manufacturer in Russia

TeamSpyVictims1

TeamSpyVictims2

All started when Hungary’s National Security Authority revealed that an unnamed “Hungarian high-profile governmental victim” was hit by the TeamSpy.

What is really concerning is that the analysis of the malware dated the beginning of the cyber espionage operations to many years ago, and exactly as many other campaigns the attacks may have involved a great variety of countries all over the world.

The surprises do not end here, security researchers found that techniques adopted by TeamSpy are quite similar to methods implemented by the authors of an online banking fraud ring known as Sheldon, meanwhile researchers at Kaspersky Labfound similarities to the Red October cyber espionage campaign.

Both the TeamViewer technique and command servers used in the attack reminded to the researchers the  modus operandi of Sheldon malware.

The Kaspersky security experts wrote in the report:

“For at least several years, a mysterious threat actor infiltrated and tracked, performed surveillance and stole data from governmental organisations, some private companies and human rights activists throughout the Commonwealth of Independent States (CIS) and Eastern European nations. Some parts of this operation extended into Western nations and the Middle East as well, with victims in sectors such as energy and heavy industry manufacturing. The attackers performed their intelligence gathering and surveillance partly using TeamViewer (http://www.teamviewer.com/en/index.aspx), a legitimate support software package commonly used for remote administration. In addition, they deployed custom written intelligence gathering components and lateral movement utilities.”

Colleagues at CrySyS Lab confirmed that the campaign could be started a decade ago:

“Most likely the same attackers are behind the attacks that span for the last 10 years, as there are clear connections between samples used in different years and campaigns,” “Interestingly, the attacks began to gain new momentum in the second half of 2012.” “The attackers surely aim for important targets. This conclusion comes from a number of different facts, including victim IPs, known activities on some targets, traceroute for probably high-profile targets, file names used in information stealing activities, strange paramilitary language of some structures, etc.”

The TeamSpy operation also relies on more traditional malware tools that were custom-built for the purpose of espionage or bank fraud.

Kaspersky team confirmed that attackers used various malware and exploit kitsinfecting victims using “watering hole” attacks, in this way the TeamSpy compromised websites frequented by the intended victims, in many cases the malicious code used to infect victims was spread by Eleonore exploit kit.

This discovery is just the last in order of time, in the last couple of years several cyber espionage campaigns have been discovered, from Duqu to Flame, arriving to recentMahdi and Red October, the complexity of the operations, the target chosen, the nature of information stolen and the capability of attacker to maintains low profile for a so long time led security expert to believe that behind the campaigns there are groups of state sponsored hackers that conduct intelligence for their governmets.

I wonder how many political decisions have already been influenced by knowledge of the information stolen during these campaigns …

 

source

Richard Stallman says Ubuntu Linux is 'spyware'

 

FREE SOFTWARE PIONEER Richard Stallman has asked a South American free software association not to promote Ubuntu Linux at its events because it "spies on its users" by collecting its users' desktop search activity and selling the data to Amazon.

Canonical released Ubuntu 12.10 last October with Amazon search integrated into its Dash desktop search function.

Although Ubuntu users can opt out and Canonical claims it anonymises users' search information before sending it to Amazon, the change resulted in Ubuntu users being shown Amazon ads in response to desktop search queries.

The 'feature' has attracted a lot of criticism and might have led some users to defect to other Linux distributions.

When Stallman's request was denied by the FLISOL event organiser with the excuse that it would limit user freedom of choice, Stallman fired off a response to the organisation's entire mailing list on Sunday. Parts of his email are quoted below, as translated by Groklaw.

"The issue I raise is about what should happen at FLISOL events. Give away copies of Ubuntu or not? Promote Ubuntu or no? I asked the organisers of the event that they, as a policy, not distribute or promote Ubuntu.

"Freedom of users is something else, and there isn't a conflict between a user's freedom and my request. If someone decides to install Ubuntu, I would consider it a mistake, but it's his own choice to do it. What I ask is that you don't participate, help or suggest that he do it. I didn't request that you block him from doing so.

"As a matter of principle, I don't believe anyone has a right, morally, to distribute proprietary software, that is, software that deprives the users of freedom. When the user controls his own software, he can install what he wants and no one can stop him. But today's issue isn't about him, what he does, but rather what you do with him."

As Stallman sent his email only yesterday, it's not yet known whether FLISOL has reconsidered promoting Ubuntu at its free software events.

These points might seem like splitting hairs, but apparently Richard Stallman - the author of the GNU General Public Licence (GPL), as well as the founder and president of the Free Software Foundation - is serious about them.

пятница, 22 марта 2013 г.

Browser Security: Settings for Chrome, Firefox and Internet Explorer

Optimizing your browser’s settings is a critical step in using the Internet securely and privately. Today’s popular browsers include built-in security features, but users often fail to optimize their browser’s security settings on installation. Failing to correctly set up your browser’s security features can put you at a higher risk for malwareinfections and malicious attacks. This installation of our “Cybersecurity 101” series provides our tips for securing several of today’s most popular browsers, including Google Chrome, Mozilla Firefox, and Microsoft Internet Explorer. While it is impossible to guarantee complete protection from cyber threats, following these tips will greatly increase the security of your web browser.

Tips for Secure Browsing with Google Chrome

These settings can be accessed through Chrome’s “Advanced Settings” menu or by navigating to “chrome://settings/.”

  • Enable phishing and malware protection: Make sure that Chrome’s phishing and malware protection feature is enabled under the “Privacy” section. This feature will warn you if a site you’re trying to visit may be phishing or contain malware.
  • Turn off instant search: The Instant search feature should be turned off for optimal security. While it offers some convenience in searching, having this feature enabled means that anything you type in the address bar is instantly sent to Google.
  • Don’t sync: Disconnect your email account from your browser under the “Personal Stuff” tab. Syncing your email account with your Chrome browser means that personal information such as passwords, autofill data, preferences, and more is stored on Google’s servers. If you must use sync, select the “Encrypt all synced data” option and create a unique passphrase for encryption.
  • Configure content settings: Click “Content settings” under the “Privacy” section and do the following:
    • Cookies: Select “Keep local data only until I quit my browser” and “Block third-party cookies and site data.” These options ensure that your cookies will be deleted upon quitting Chrome and that advertisers will not be able to track you using third-party cookies.
    • JavaScript: Select “Do not allow any site to run JavaScript.” It is widely recommended that JavaScript be disabled whenever possible to protect users from its security vulnerabilities.
    • Pop-ups: Select “Do not allow any site to show pop-ups.
    • Location: Select “Do not allow any site to track my physical location.”
  • Configure passwords and forms settings: Disable Autofill and deselect “Offer to save passwords I enter on the web” under the “Passwords and forms” section. Doing so will prevent Chrome from saving your logins, passwords, and other sensitive information that you enter into forms.

Tips for Secure Browsing with Mozilla Firefox

These settings can be accessed through the “Options” menu.

  • Configure privacy settings: Under the “Privacy” tab, complete the following steps. These measures ensure that Firefox is storing only as much of your information as it needs to function normally.
    • Select “Use custom settings for history.”
    • Deselect “Remember my browsing and download history.”
    • Deselect “Remember search and form history.”
    • Deselect “Accept third-party cookies.”
    • Set cookie storage to “Keep until I close Firefox.”
    • Select “Clear history when Firefox closes.”
  • Configure security settings: Under the “Security” tab, choose the following settings. These steps prevent Firefox from saving your passwords and keep you from visiting potentially harmful sites.
    • Verify that “Warn me when sites try to install add-ons,” “Block reported attack sites,” and “Block reported web forgeries” are all selected.
    • Deselect “Remember passwords for sites.”
  • Disable javaScript: Deselect “Enable JavaScript” under the “Content” tab. JavaScript is notorious for containing security vulnerabilities and it is recommended that users only enable it for trusted sites.
  • Enable pop-up blocking: Verify that “Block pop-up windows” is selected under the “Content” tab. This feature should be turned on by default as it protects users from unwarranted advertisements and windows.
  • Don’t sync: Avoid using Firefox Sync. By doing so you prevent Firefox from storing your logins, passwords, and other sensitive information.
  • Turn on automatic updates: Verify that “Automatically install updates” is selected in the “Update” tab under “Advanced.” Doing so will ensure that your browser receives critical security updates. Verify that “Automatically update Search Engines” is selected as well.
  • Use secure protocols: Verify that “Use SSL 3.0” and “Use TLS 1.0” are selected in the “Encryption” tab under “Advanced.”

Tips for Secure Browsing with Microsoft Internet Explorer 10

These settings can be accessed through the “Internet Options” menu.

  • Configure security settings: Under the “Security” tab, do the following:
    • Set security zones: IE offers the option to configure different security settings for different “zones,” including the Internet, local intranet, trusted sites, and restricted sites. Set up the zones for Intranet, Trusted Sites, and Restricted sites to your desired security level.
    • Set Internet zone security to “Medium High” or higher. This blocks certain cookie types, enables ActiveX filtering, and implements several other default settings for increased security.
    • Disable javaScript: Click “Custom Level,” locate the “Active Scripting” setting, and select “Disable.” It is recommended that users disable JavaScript because of the high amount of vulnerabilities it contains.
  • Automatically clear history: Select “Delete browsing history on exit” under the “General” tab. Clearing your history at the end of each session helps to limit the amount of information IE saves when you browse.
  • Configure privacy settings: Under the “Privacy” tab, complete the following steps:
    • Privacy setting: Set the Internet zone privacy to “Medium High” or higher. This blocks certain cookie types to prevent sites from tracking or contacting you without your consent.
    • Location: Select “Never allow websites to request your physical location.”
    • Pop-up Blocker: Double check that Pop-up Blocker is enabled.
  • Configure Advanced Security settings: Scroll down to the “Security” section under the “Advanced” tab and do the following:
    • Ensure that all default settings are in place. If you aren’t sure, click “Restore advanced settings” before making any other changes.
    • Select “Do not save encrypted pages to disk.” This will delete files cached from HTTPS pages when the browser is closed.
    • Select “Empty Temporary Internet Files folder when browser is closed.” This prevents IE from storing your personal info (logins, passwords, activity, etc) beyond your browsing session.
    • Turn off autoComplete: The AutoComplete feature should be turned off for forms and usernames/passwords. Keeping AutoComplete turned off ensures that your sensitive information isn’t being stored unnecessarily.
  • Tracking protection: IE’s Tracking Protection feature keeps your browsing private from specified third-party websites. This feature can be accessed through IE’s “Safety” menu. In order to use Tracking Protection you will need to provide a Tracking Protection List that names all of the sites you don’t want your information being sent to. You can create a list yourself or download lists online.

Which is the Most Secure Browser?

Nominating one browser as the most secure is difficult. Since each browser is regularly updated with security patches, the rankings for most secure browser could change at any time. As of today, Veracode recommends Google Chrome as the most secure browser.

Source: http://www.veracode.com/blog/2013/03/browser-security-settings-for-chrome-fire

BlackBerry software ruled not safe enough for essential government work


this article was published Tuesday 19 March 2013 18.13 GMT but removed from original source as well as Google cache, but keeps translated and here and in exported to pdf from evernote

CESG rejects BB10 software in new Z10 handset, dealing blow to Canadian firm in key market

    The BB10 software in the new BlackBerry Z10 handset has been rejected as not secure enough for essential government work. Photograph: Mast Irham/EPA
    BlackBerry's new BB10 software has been rejected by the British government as not secure enough for essential work, the Guardian can reveal.
    The news is a blow to hopes that the new operating system, released on the Z10 handset in January, would spark a rapid revival in the company's fortunes after a torrid year of losses.
    The previous BlackBerry version, 7.1, was cleared by the UK's Communications-Electronics Security Group (CESG) in December 2012 for classifications up to "Restricted" – two levels below "Secret".
    But the Guardian understands that tests on BB10 and the BlackBerry Balance software, intended to separate work and personal accounts and prevent any copying of data between them, have shown that it fails the same security requirements. BlackBerry has confirmed that BB10 has not been passed yet by CESG, but could not offer a date when revised software would be submitted.
    That is a blow because the Z10 and its upcoming keyboard-based version, the Q10, are high-priced devices intended to win back corporate customers who have begun to migrate to Apple's iPhone or to Android devices, or to replace older BlackBerry 7 phones. Nor has the company offered a clear date when it will fix the weakness.
    Missing out on government business could cost BlackBerry millions in lost revenues, even if rivals are unable to fill the same security space: the government and NHS are two of its biggest clients in the UK, with tens of thousands of users.
    Analyst reports also suggest that sales in the UK of the touchscreen Z10 handset, the first to run BB10, are slowing after an initial spurt among consumers when they went on sale in January, leaving sellers with surplus stock.
    The Z10 goes on sale in the US on Friday, with the company seeking to rebuild its share of the smartphone market there, which has plummeted from a high of 22% in September 2010 with 21m users to just 5.9% and 7.6m users in January according to ComScore.
    But James Faucette at the stockbrokers Pacific Crest, who has a "sell" rating on BlackBerry, said in a research note looking at sales in the UK and Canada that "sell-through run-rates for the Z10 have declined meaningfully in the weeks following launch. We believe carriers and third-party retailers in the UK are well above typically targeted inventory levels" and that retailers Carphone Warhouse and Phones4U have begun discounting the handsets. "We are concerned that … may ultimately push the Z10 downmarket" and hit profit margins, he told clients.
    He added that he thinks Canadian stores and carriers are also approaching the same point
    BlackBerry said in a statement: "We have a long-established relationship with CESG and we remain the only mobile solution approved for use at 'Restricted' when configured in accordance with CESG guidelines. This level of approval only comes following a process which is rigorous and absolutely necessary given the highly confidential nature of the communications being transmitted.
    "The current restructuring of this approval process, due to the Government Protective Marking Scheme review and the new CESG Commercial Product Assurance scheme has an impact on the timeline for BlackBerry 10 to receive a similar level of approval. The US government's FIPS 140-2 certification of BlackBerry 10 and the selection of BlackBerry 10 by the German Procurement Office and Federal Office for Information Security underline how our new platform continues to set the standard for government communications.
    "We are continuing to work closely with CESG on the approval of BlackBerry 10 and we're confident that BlackBerry 10 will only strengthen our position as the mobile solution of choice for the UK government."
    • Canada's industry minister has declined to say whether he would block any attempted takeover of BlackBerry by the Chinese PC and smartphone maker Lenovo. Christian Paradis told Reuters "I hope BlackBerry will continue to be a Canadian champion in the world, that it grows organically." But, he added, "we don't know what might happen. The market is very aggressive. When you talk about the telecoms sector … this is a very, very aggressive sector."
    Asked whether he would block a bid from Lenovo, mooted last week in an interview with that company, Paradis said "As the industry minister, I don't want to send a signal and I don't want it to look like I prejudged a deal or not."
    The Canadian government could block the deal on national security grounds. Last year, the Chinese state-owned oil company CNOOC bought Canadian energy firm Nexen, but it provoked a storm. Analysts believe the US and UK governments might block a similar Chinese bid for BlackBerry because of its importance to secure email.
    Updated: corrected expansion of CESG.

    1-15 March 2013 Cyber Attacks Timeline

    Other troubles for system administrators: March is confirming the 2013 dangerous trend with several high profile breaches against industrial, financial and governmental targets.

    The first two weeks of March have begun with the breach to Evernote, and continued with (among the others) the third phase of the infamous Operation Ababil, targeting U.S. Banks and an alleged Chinese attack against the Reserve Bank of Australia.

    Additional noticeable events include a wave of DDoS attacks against several Czech Republic’s targets (belonging to media, news and financial sector), a breach suffered by the NIST Vulnerability Database (unfortunately not an isolated example of the attacks against US governmental targets happened in these two weeks) and also the leak of 20,000 records from an Avast! German distributor.

    Last but not least, the examined period has also confirmed the role of Twitter as the new mean to make resounding attacks against single individuals or organizations. Qatar Foundation, Saudi Aramco, and France 24 are only several of the organizations fallen victims of accounts hijacking.

    Of course, these are only the main events, feel free to scroll down the list to analyze in detail what happened in these two weeks.

    If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 20112012 and now 2013 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

    Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

    Once again, a special thanks to Kim Guldberg AKA @bufferzone for continuously advising me about significant cyber events through the Submit Form! Much Appreciated!

    1-15 March 2013 Cyber Attacks Timeline

     

    1. http://hackread.com/qatar-foundations-twitter-and-facebook-accounts-hacked-by-syrian-electronic-army
    2. https://twitter.com/th3inf1d3l/status/307658779904856064
    3. http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/
    4. http://www.dailymail.co.uk/news/article-2287138/Public-schoolboy-hacker-masterminded-15m-fraud-jails-IT-class–hacks-prisons-system.html
    5. http://news.softpedia.com/news/South-African-Ministry-of-State-Security-s-Twitter-Account-Hacked-334896.shtml
    6. http://uk.reuters.com/article/2013/03/04/us-czech-hackers-idUKBRE92309D20130304
    7. http://www.lupa.cz/clanky/ddos-pokracuje-cilem-jsou-dnes-weby-mobilnich-operatoru/
    8. http://techcrunch.com/2013/03/08/hacker-steals-12000-worth-of-bitcoins-in-brazen-dns-based-attack/
    9. http://hackread.com/bangladeshi-supreme-court-ministry-of-agriculture-websites-breached-against-violence-user-accounts-leaked-by-phr0zenmyst/
    10. http://news.softpedia.com/news/Website-of-AngloAmerican-Mining-Company-Hacked-By-Anonymous-for-OpGreenRights-335092.shtml
    11. http://www.lupa.cz/clanky/ddos-pokracuje-cilem-jsou-dnes-weby-mobilnich-operatoru/
    12. http://thehackernews.com/2013/03/pakistan-intelligence-agency-hacked-by.html
    13. http://hackread.com/france-24-arabia-and-france-24-observers-twitter-accounts-hacked-by-syrian-electronic-army/
    14. http://www.zdnet.com/raspberry-pi-site-suffers-ddos-attack-7000012251/
    15. http://hilf-ol-fozoul.blogspot.com/2013/03/the-bank-of-america-has-been-out-of.html
    16. http://hilf-ol-fozoul.blogspot.com/2013/03/the-fifth-third-bank-also-have-gotten.html
    17. http://uk.reuters.com/article/2013/03/06/czech-hackers-banks-idUKL6N0BY52420130306
    18. http://www.lupa.cz/clanky/ddos-pokracuje-cilem-jsou-dnes-weby-mobilnich-operatoru/
    19. http://nakedsecurity.sophos.com/2013/03/06/saudi-aramco-saudi-arabias-national-oil-company-has-had-its-twitter-hacked/
    20. http://www.cyberwarnews.info/2013/03/06/time-warner-cable-support-service-hacked-and-defaced-by-nullcrew/
    21. http://hackread.com/soneri-banks-online-banking-system-website-hacked-by-pakbugs/
    22. http://hilf-ol-fozoul.blogspot.com/2013/03/the-hsbc-and-us-bank-have-defeated.html
    23. http://hilf-ol-fozoul.blogspot.com/2013/03/the-hsbc-and-us-bank-have-defeated.html
    24. http://hilf-ol-fozoul.blogspot.com/2013/03/the-fifth-third-bank-and-pnc-are-next.html
    25. http://hilf-ol-fozoul.blogspot.com/2013/03/the-fifth-third-bank-and-pnc-are-next.html
    26. http://sg.news.yahoo.com/hackers-assault-czech-mobile-operators-005419745.html
    27. http://www.lupa.cz/clanky/ddos-pokracuje-cilem-jsou-dnes-weby-mobilnich-operatoru/
    28. http://news.softpedia.com/news/German-Studio-Constantin-Film-Hacked-in-Protest-Against-Anti-Piracy-Group-335462.shtml
    29. http://hackread.com/avast-germany-website-hacked-defaced-20000-user-accounts-leaked-by-maxney/
    30. http://www.illsecure.com/2013/03/us-government-state-websites-hacked-in.html
    31. http://www.ehackingnews.com/2013/03/hackers-infect-pentagon-admin-by.html
    32. http://www.afr.com/p/national/cyber_attackers_penetrate_reserve_FEdCLOI50owRMgI0urEYnK
    33. http://arstechnica.com/security/2013/03/dating-site-zoosk-resets-some-user-accounts-following-password-dump/
    34. http://gawker.com/5989904/either-colin-powells-facebook-was-hacked-or-he-has-had-a-sudden-change-of-heart-about-george-w-bush
    35. http://thehackernews.com/2013/03/pakistan-government-servers-messed-up.html
    36. http://news.softpedia.com/news/Indian-Hacker-Leaks-Admin-Passwords-for-35-Pakistani-Government-Sites-336734.shtml
    37. http://hackread.com/serbian-students-hack-billboard-display-advert-in-piratebays-support-video-included
    38. http://anon-news.blogspot.in/2013/03/firma-la-petizione-per-chiudere.html
    39. http://hilf-ol-fozoul.blogspot.com/2013/03/bbt-and-chase-bank-are-first-targets-of.html
    40. http://nakedsecurity.sophos.com/2013/03/14/bill-gates-personal-info/
    41. http://nakedsecurity.sophos.com/2013/03/12/celebrity-hack-social-security/
    42. http://www.bloomberg.com/news/2013-03-12/equifax-transunion-say-hackers-stole-celebrity-reports.html
    43. http://community.websense.com/blogs/securitylabs/archive/2013/03/12/israeli-website-for-international-institute-for-counter-terrorism-waterhole-serving-cve-2012-4969.aspx
    44. https://plus.google.com/u/0/106350285372295328202/posts/HNayDzUoYEz
    45. http://hilf-ol-fozoul.blogspot.com/2013/03/today-attacks-of-qassam-group-shocked.html
    46. http://hilf-ol-fozoul.blogspot.com/2013/03/the-us-bank-has-gotten-out-of-reach.html
    47. http://hilf-ol-fozoul.blogspot.com/2013/03/the-chase-bank-has-targeted-against.html
    48. http://www.ehackingnews.com/2013/03/al-qaeda-electronic-army-hack-us-government.html
    49. http://www.mediabistro.com/fishbowldc/national-journal-gets-hacked_b98192
    50. http://thehackernews.com/2013/03/philippines-presidents-website-defaced.html
    51. http://hackread.com/indian-defence-organisation-drdo-servers-hacked-china-among-the-suspects/
    52. http://hilf-ol-fozoul.blogspot.com/2013/03/chase-pnc-bbt-qassam-groups-today-goals.html
    53. http://news.yahoo.com/nkorea-accuses-us-skorea-cyberattacks-074913828–finance.html
    54. http://news.yahoo.com/polish-presidents-computer-network-attacked-hackers-181856391.html
    55. http://www.wbj.pl/article-62178-top-polish-government-systems-hacked-again.html
    56. http://www.ehackingnews.com/2013/03/opblacksummer-two-us-petroleum-websites.html
    57. http://www.cyberwarnews.info/2013/03/14/14000-student-credentials-leaked-from-ktu-career-center-lithuania/
    58. http://www.theregister.co.uk/2013/03/15/cctv_hack_casino_poker/
    59. http://news.softpedia.com/news/OpIran-Hacktivists-Launch-DDOS-Attacks-Against-Major-Iranian-Sites-337585.shtml
    60. http://hackread.com/german-broadcaster-deutsche-welles-dw-twitter-account-hacked-by-syrian-electronic-army/
    61. http://anon-news.blogspot.in/2013/03/forza-nuova-lealta-azione-fiamma.html