Saturday, June 18, 2016
A most interesting hack.
Fund Based on Digital Currency Ethereum to Wind Down After Alleged Hack
… Founders of the fund, DAO, which was built around a digital currency called Ethereum and which raised more than $150 million this spring, said Friday morning they have been forced to shut down the fund and plan for its unwinding.
The attack spirited away roughly 3.6 million Ethereum coins, valued at around $55 million, from DAO to another account.
… The DAO’s founders are planning to “fork” the code and effectively void the hacker’s transactions.
“The DAO’s journey is over but all funds are safe,” said Stephan Tual, the founder of Slock.It, the group that created DAO, which stands for Decentralized Autonomous Organization. “All stolen funds will be retrieved from the attacker.”
… DAO was set up in May as an experiment in using digital currencies and self-operating digital contracts to create a venture-capital fund that could run itself. But it was criticized early on for being poorly constructed, and there were calls for it to halt operations while it worked out its bugs. Those criticisms now appear prescient.
… One investor in the DAO, Menno Pietersen, said he opposed the rescue and called the incident a “horrible mess.” The DAO’s creators “messed up” and didn’t take the time to build their product correctly, he said. He acknowledged that he himself didn’t vet the investment carefully enough, but said that as a backer of Ethereum, he was against any fix that would invalidate the goal of creating a decentralized platform. If trades can simply be erased, he asked, “what will they do next?”
Because no one is perfect. Perhaps penetration testing should be continuous? (Pay attention Ethical Hacking students.)
How Hired Hackers Got “Complete Control” Of Palantir
Palantir Technologies has cultivated a reputation as perhaps the most formidable data analysis firm in Silicon Valley, doing secretive work for defense and intelligence agencies as well as Wall Street giants. But when Palantir hired professional hackers to test the security of its own information systems late last year, the hackers found gaping holes that left data about customers exposed.
Palantir, valued at $20 billion, prides itself on an ability to guard important secrets, both its own and those entrusted to it by clients. But after being brought in to try to infiltrate these digital defenses, the cybersecurity firm Veris Group concluded that even a low-level breach would allow hackers to gain wide-ranging and privileged access to the Palantir network, likely leading to the “compromise of critical systems and sensitive data, including customer-specific information.”
… Virtually every company is vulnerable to hacks, to varying degrees. In recent years, red teams generally have had a high success rate in getting deep inside of companies’ networks, and they virtually always find at least some security flaws, according to an industry source. That Palantir did a red team exercise shows that it wanted to identify and repair any such flaws. The Veris report notes multiple strengths in Palantir’s defenses, including an “excellent” response by its security staff.
I’ll bet this is not their policy. If they have a policy. Something my Computer Security students need to think about.
For today’s object lesson (and maybe abject lesson), I give you FIS Global and Guaranty Bank and Trust. I’ve written up the incident in more detail over on the Daily Dot, but the short version is a hacker (@1×0123) found a vulnerability in FIS Global’s client portal login and tweeted about it. FIS didn’t respond to him directly. Instead, they got his Twitter account locked and the screenshots removed.
Getting a hacker’s Twitter account locked. What could possibly go wrong, right?
It wasn’t just the hacker they failed to respond to. FIS also failed to respond to two inquiries by this blogger to their communications department and one attempt to reach their Twitter team.
Trying a different route, and not knowing at the time whether the vulnerability had been addressed, this blogger also reached out to contact the bank client whose data was being exposed on the Internet. They didn’t reply to two voicemails left with two different executives.
C’mon, folks. Don’t you want people to let you know if they find a vulnerability that’s exposing your customer data or proprietary information? Are you familiar with behaviorism?
If you keep ignoring people when they take time out of their lives to try to alert you to a situation, well, then the next time someone finds a vulnerability, they’ll either just keep it to themselves, exploit it, or share it with others who will exploit it. Is that what you really want? When someone notifies you, then even if you were already aware of the situation, take a damned moment to let them know you got their message and appreciated it.
At the very least, try not to tick off the hacker, okay, because it just may make a difference in their decision to publicly dump your data.
Read my report on the Daily Dot
I thought this might happen. Firefox is allowing anyone to have a personal account, a business account, a dating account, a job search account, a ‘say outrageous things’ account, a ‘don’t let this screw up my credit’ account, etc. No doubt the FBI (et al) will want to make connections that users would like to keep separate.
Firefox Containers Help You Browse The Web Using Separate Identities
In the physical world, when interacting with other people, we like to think that we have a strong, recognizable personality, but the truth is we often tend to change it according to the context we’re in. We behave differently when we are among friends than with our boss, our parents or our children. At work we’re one person, on holiday another.
So far this has been hardly possible to replicate online, mainly because our surfing experience is tracked and monitored in every possible way in order to build a single, identifiable profile, which advertisers can use to target us.
Enters “Containers”, a new interesting feature Mozilla is testing in version 50 of the Nightly build of its popular Firefox browser. As security engineer Tanvi Vyas writes in the company’s blog, with Containers “users are able to portray different characteristics of themselves in different situations”.
Say you have two twitter accounts and want to login to them at the same time? No need to open a secondary browser or launch a desktop application like TweetDeck. With Nightly, you could just open the File menu and select the “New Container Tab” option, choosing between the Personal, Work, Shopping, and Banking options.
… Imagine you’re trying to book a flight and you don’t want the airline to adjust the price according to your browsing history: you won’t have to delete all your cookies any more, just open a separate tab.
As Vyas acknowledges, the idea of contextual identities is not new, but so far it has been hard to implement, mainly because it’s difficult to figure out what the best user experience should be.
The model I’ve proposing for years!
Municipal fiber network will let customers switch ISPs in seconds
Most cities and towns that build their own broadband networks do so to solve a single problem: that residents and businesses aren't being adequately served by private cable companies and telcos.
But there's more than one way to create a network and offer service, and the city of Ammon, Idaho, is deploying a model that's worth examining. Ammon has built an open access network that lets multiple private ISPs offer service to customers over city-owned fiber. The wholesale model in itself isn't unprecedented, but Ammon has also built a system in which residents will be able to sign up for an ISP—or switch ISPs if they are dissatisfied—almost instantly, just by visiting a city-operated website and without changing any equipment.
Perspective. My students will be shocked. They thought Uber was always profitable.
Uber points to profits in all developed markets
Uber says it has now reached profitability in all its developed markets, underscoring the business case for the new ride-hailing models that are disrupting the transportation industry.
Travis Kalanick, chief executive, told the FT that Uber is making money in North America, Australia and in its Europe, Middle East and Africa region, on a basis that excludes interest and tax.
“We have hundreds of cities that are profitable globally,” he said. “That allows us to invest in new places, and to sustainably invest in a very expensive place like China.”
Mr Kalanick also disclosed that China — where the company is fighting a costly subsidy battle with rival Didi Chuxing — is now Uber’s biggest market by number of rides, accounting for a third of the company’s daily trips.
Because crazy people…
Active Shooter Event: Quick Reference Guide – DHS
by Sabrina I. Pacifici on Jun 17, 2016
Department of Homeland Security guide – quick reference guide to assist friends, family, colleagues, co-workers, organizations – “An “active shooter” is an individual who is engaged in killing or attempting to kill people in a confined and populated area; in most cases, active shooters use firearms(s) and there is no pattern or method to their selection of victims.”
Hack Education Weekly News
… “A Swedish college has been ordered to refund tuition fees to an American business student for giving her a poor economics education,” the AP reports. “The Vastmanland court ruled Tuesday the Malardalen University’s two-year program ‘Analytical Finance’ that Connie Askenback attended from 2011 to 2013 ‘had no practical value.’”
… From the press release: “Achieving the Dream Launches Major National Initiative to Help 38 Community Colleges in 13 States Develop New Degree Programs Using Open Educational Resources.” More via The Chronicle of Higher Education.… Via the Detroit Free Press: “Wayne State drops math as general ed requirement.” [5 out of 4 students thrilled! Bob]
… Via The Chronicle of Higher Education: “Facebook Reveals How It Decides if a Research Project Is Ethical.”