If you're a WhatsApp user, you'll have to share your personal data with Facebook's empire from next month – or stop using the chat app

 If you don't agree then, well, you'll just have to use the infinitely better Signal...

WhatsApp users must agree to share their personal information with Facebook and its wider empire if they want to continue using the messaging service from next month, according to its terms and conditions.

“As part of the Facebook Companies, WhatsApp receives information from, and shares information with, the other Facebook Companies,” its privacy policy, updated this week, states.

“We may use the information we receive from them, and they may use the information we share with them, to help operate, provide, improve, understand, customize, support, and market our Services and their offerings, including the Facebook Company Products.”

Said information includes your personal data. Thus, WhatsApp users who want to keep using the software must agree to allow their personal info to be shared with not only Facebook but also its subsidiaries as and when decided by the tech giant.

Users will be presented with the following choice in the app: accept this arrangement by February 8, or be blocked from using the end-to-end encrypted chat app.

source: The Register

Ransomware Attacks are not problem for us

 

If there is one characteristic that defines cybercrime today, it is the capacity to evolve and adapt to new environments and the ability to find ways of evading the cybersecurity measures taken by victims. 

Ransomware is no exception. One of the main features of ransomware as a threat, in addition to kidnapping data, is that it is constantly reinventing itself to persist over time and ineffectiveness.

This type of malicious software has evolved greatly since it began, and today there is a wide variety of families in existence, giving rise to new, more sophisticated strains.

Did you know that?

• 65% of ransomware infections are delivered via phishing 
• A ransomware attack will take place every 11 seconds by 2021 
• 85% of ransomware attacks target Windows systems. 
• The average cost of a ransomware attack in 2019 was $133,000 
• 50% of IT professionals don’t believe that their organization is ready to defend against a ransomware attack.  
• Hackers attack  every 39 seconds or an average of 2,244 times a day 
• Between January 1st and June 30th, 2020, ID Ransomware received 100,001 submissions relating to attacks that targeted companies and public sector organizations. 
• 90 % of IT pros had clients that suffered ransomware attacks in the past year 
• Ransomware costs will reach $20 billion by 2021 
• 51% of businesses have been impacted by ransomware in the last year
• 0 affected Scicane customers

Don't be a victim - Contact us for further information @ info@scicane.com (no obligation)

Critical Flaw in Windows Preview Pane

Microsoft on 23/3/2020 issued Security Advisory ADV200006 for a "Critical"-rated remote code execution vulnerability in both supported and unsupported Windows systems.

Microsoft updated its security advisory on March 24 to indicate that the vulnerability is just rated "Important" for Windows 10, Windows Server 2016 and Windows Server 2019 systems. It's still rated "Critical" for older systems, though. "We do not recommend that IT administrators running Windows 10 implement the workarounds described below," the advisory explained.

The vulnerability, associated with the Adobe Type Manager Library in Windows systems, has been exposed to "limited, targeted attacks," per the advisory. The library "improperly handles a specially crafted multi-master font." This flaw can be exploited by "convincing a user to open a specially crafted document or viewing it in the Windows [Explorer] Preview pane."

There's no patch currently available. Microsoft's advisory offered three "workarounds" to implement, but they all have limitations.

More info & sources: Microsoft, Redmond

Are any GDPR certification schemes worth the money?

Let's be clear - you can't buy GDPR compliance off the shelf.. Although it is a good idea to get some advice from a GDPR expert, none of the courses touted as making your company GDPR compliant will actually do so.

In short, no - certainly not if you're looking for a certificate demonstrating compliance. There are currently no bodies empowered to audit and certify GDPR compliance.

Those that claim to exist will say their certification is valid for GDPR, but in fact, they're often based on the National Cyber Security Centre's Cyber Secure standard (UK). That means organisations who undertake their courses may still be found non-compliant.

The more any organisation does to comply the better. Obtaining any form of external certification implies that [an] external organisation is going to check where the target organisation is not doing enough, thus enabling the target organisation to become more compliant.

UK Regulator Fines Equifax £500,000

The Equifax Data Breach 2017

Equifax suffered a massive data breach last year between mid-May and the end of July, exposing highly sensitive data of as many as 145 million people globally.

The stolen information included victims' names, dates of birth, phone numbers, driver's license details, addresses, and social security numbers, along with credit card information and personally identifying information (PII) for hundreds of thousands of its consumers.

The data breach occurred because the company failed to patch a critical Apache Struts 2 vulnerability (CVE-2017-5638) on time, for which patches were already issued by the respected companies.

Why U.K. Has Fined a US Company?

The UK's Information Commissioner's Office (ICO), who launched a joint investigation into the breach with the Financial Conduct Authority, has now issued its largest possible monetary penalty under the country's Data Protection Act for the massive data breach—£500,000, which equals to around $665,000.

The ICO said that although the cyber attack compromised Equifax systems in the United States, the company "failed to take appropriate steps" to protect the personal information of its 15 million UK customers.

Breach Was Result of Multiple Failures at Equifax

The ICO said that Equifax had also been warned about a critical Apache Struts 2 vulnerability in its systems by the United States Department of Homeland Security (DHS) in March 2017, but the company did not take appropriate steps to fix the issue.

More info and source: The Hacker News

ΕΔΑΔ: Τα προσωπικά μηνύματα, κατά την εργασία, μπορούν να ελεγχθούν από τους εργοδότες

Απόφαση του ΕΔΑΔ, δημιουργεί νέα δεδομένα στο χώρο εργασίας

Σύμφωνα με νέα απόφαση του Ευρωπαϊκού Δικαστηρίου (ΕΔΑΔ) οι εργοδότες μπορούν να διαβάσουν την αλληλογραφία των εργαζομένων, όταν αυτή αποστέλλεται μέσω chat λογισμικού και email, κατά τη διάρκεια των ωρών εργασίας τους.

Η υπόθεση έφτασε στο Ευρωπαϊκό Δικαστήριο Ανθρωπίνων Δικαιωμάτων μετά από προσφυγή υπαλλήλου το 2008, ο οποίος ισχυρίστηκε ότι η απόφαση απόλυσής του βασίστηκε σε στοιχεία που απέκτησε ο εργοδότης του,  παραβιάζοντας τα προσωπικά του δεδομένα και το απόρρητο της αλληλογραφίας του, αφού απέκτησε πρόσβαση σε αυτήν.  Ως υπεύθυνος πωλήσεων στη συγκεκριμένη εταιρεία, από το 2004 έως το 2007, άνοιξε λογαριασμό στο Yahoo Messenger κατόπιν υπόδειξης του εργοδότη του, ώστε να απαντά στις απορίες των πελατών. Τον Ιούλιο του 2007, ενημερώθηκε ότι η εταιρεία παρακολουθούσε τις συνομιλίες του και τον κατηγόρησε ότι είχε παραβιάσει τους κανονισμούς της, αφού χρησιμοποιούσε το chat και για προσωπική του χρήση.  

Σύμφωνα όμως με τους Δικαστές του Ευρωπαϊκού Δικαστηρίου Ανθρωπίνων Δικαιωμάτων, σε αυτή την περίπτωση ο εργαζόμενος παραβιάζει τους κανόνες της εταιρείας του και συνεπώς ο εργοδότης του έχει το δικαίωμα πρόσβασης και ελέγχου των σχετικών δραστηριοτήτων.

Με την απόφαση του Δικαστηρίου το αίτημα του Ρουμάνου υπαλλήλου απερρίφθη καθώς δεν είναι "παράλογο ο εργοδότης να θέλει να εξακριβώσει αν οι εργαζόμενοι ολοκληρώνουν τα επαγγελματικά τους καθήκοντα κατά τη διάρκεια των ωρών εργασίας".

"Ο εργοδότης ενήργησε εντός των πειθαρχικών εξουσιών του, καθώς, όπως διαπιστώθηκε και στα εθνικά δικαστήρια, απέκτησε πρόσβαση στο λογαριασμό Yahoo Messenger πεπεισμένος ότι οι εν λόγω πληροφορίες είχαν σχέση με την επαγγελματική δραστηριότητα και ότι, επομένως, η πρόσβαση αυτή ήταν νόμιμη. Το δικαστήριο δεν βλέπει το λόγο να αμφισβητήσει τις διαπιστώσεις αυτές. "

Πηγές: ΚΑΘΗΜΕΡΙΝΗ, LAWNET, ΕΔΑΔ

Frequently Asked Questions about the incoming GDPR

When is the GDPR coming into effect?
 The GDPR was approved and adopted by the EU Parliament in April 2016. The regulation will take effect after a two-year transition period and, unlike a Directive it does not require any enabling legislation to be passed by government; meaning it will be in force May 2018. 

In light of a uncertain 'Brexit' -  I represent a data controller in the UK and want to know if I should still continue with GDPR planning and preparation?
  If you process data about individuals in the context of selling goods or services to citizens in other EU countries then you will need to comply with the GDPR, irrespective as to whether or not you the UK retains the GDPR post-Brexit. If your activities are limited to the UK, then the position (after the initial exit period) is much less clear. The UK Government has indicated it will implement an equivalent or alternative legal mechanisms. Our expectation is that any such legislation will largely follow the GDPR, given the support previously provided to the GDPR by the ICO and UK Government as an effective privacy standard, together with the fact that the GDPR provides a clear baseline against which UK business can seek continued access to the EU digital market. (Ref: http://www.lexology.com/library/detail.aspx?g=07a6d19f-19ae-4648-9f69-44ea289726a0)

Who does the GDPR affect?
 The GDPR not only applies to organisations located within the EU but it will also apply to organisations located outside of the EU if they offer goods or services to, or monitor the behaviour of, EU data subjects. It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location.

What are the penalties for non-compliance?
 Organizations can be fined up to 4% of annual global turnover for breaching GDPR or €20 Million. This is the maximum fine that can be imposed for the most serious infringements e.g.not having sufficient customer consent to process data or violating the core of Privacy by Design concepts. There is a tiered approach to fines e.g. a company can be fined 2% for not having their records in order (article 28), not notifying the supervising authority and data subject about a breach or not conducting impact assessment. It is important to note that these rules apply to both controllers and processors -- meaning 'clouds' will not be exempt from GDPR enforcement.

What constitutes personal data?
 Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.

What is the difference between a data processor and a data controller?
 A controller is the entity that determines the purposes, conditions and means of the processing of personal data, while the processor is an entity which processes personal data on behalf of the controller.

Do data processors need 'explicit' or 'unambiguous' data subject consent - and what is the difference?
 The conditions for consent have been strengthened, as companies will no longer be able to utilise long illegible terms and conditions full of legalese, as the request for consent must be given in an intelligible and easily accessible form, with the purpose for data processing attached to that consent - meaning it must be unambiguous. Consent must be clear and distinguishable from other matters and provided in an intelligible and easily accessible form, using clear and plain language. It must be as easy to withdraw consent as it is to give it.​  Explicit consent is required only for processing sensitive personal data - in this context, nothing short of “opt in” will suffice. However, for non-sensitive data, “unambiguous” consent will suffice.

What about Data Subjects under the age of 16?
 Parental consent will be required to process the personal data of children under the age of 16 for online services; member states may legislate for a lower age of consent but this will not be below the age of 13.

What is the difference between a regulation and a directive?
 A regulation is a binding legislative act. It must be applied in its entirety across the EU, while a directive is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to decide how. It is important to note that the GDPR is a regulation, in contrast the the previous legislation, which is a directive.

Does my business need to appoint a Data Protection Officer (DPO)?
 DPOs mustbe appointed in the case of: (a) public authorities, (b) organizations that engage in large scale systematic monitoring, or (c) organizations that engage in large scale processing of sensitive personal data (Art. 37).  If your organization doesn’t fall into one of these categories, then you do not need to appoint a DPO.

How does the GDPR affect policy surrounding data breaches?
 Proposed regulations surrounding data breaches primarily relate to the notification policies of companies that have been breached. Data breaches which may pose a risk to individuals must be notified to the DPA within 72 hours and to affected individuals without undue delay.

Will the GDPR set up a one-stop-shop for data privacy regulation?The discussions surrounding the one-stop-shop principle are among the most highly debated and are still unclear as the standing positions are highly varied. The Commission text has a fairly simple and concise ruling in favor of the principle, the Parliament also promotes a lead DPA and adds more involvement from other concerned DPAs, the Council’s view waters down the ability of the lead DPA even further. A more in depth analysis of the one-stop-shop policy debate can be found here.



Source: https://www.eugdpr.org/gdpr-faqs.html

Συλλογή και επεξεργασία δακτυλικών αποτυπωμάτων - Δικαστική απόφαση

ΑΠΟΦΑΣΗ ΔΙΟΙΚΗΤΙΚΟΥ ΔΙΚΑΣΤΗΡΙΟΥ: απόρριψη προσφυγής αναφορικά με τη συλλογή και επεξεργασία δακτυλικών αποτυπωμάτων

Με την Απόφασή του (Υποθ. Αρ. 1930/2012) ημερ. 19/5/2017 το Διοικητικό Δικαστήριο επικύρωσε την Απόφαση του Επιτρόπου Προστασίας Δεδομένων ημερ. 2/10/2012 με την οποία είχε επιβάλει στο Απολλώνειο Ιδιωτικό Νοσοκομείο τη διοικητική κύρωση της διακοπής της επεξεργασίας και καταστροφής των σχετικών δεδομένων (βλ. άρθρο 25(1)(ε) του Νόμου) με τη διακοπή της λειτουργίας του συστήματος δακτυλοσκόπησης και την καταστροφή των δεδομένων που αφορούσαν στα δακτυλικά αποτυπώματα των υπαλλήλων.

Περισσότερες πληροφορίες στη σελίδα του Επιτρόπου Προσωπικών Δεδομένων.

How the NSA identified Bitcoin 'creator'

The ‘creator’ of Bitcoin, Satoshi Nakamoto, is the world’s most elusive billionaire. Very few people outside of the Department of Homeland Security know Satoshi’s real name. In fact, DHS will not publicly confirm that even THEY know the billionaire’s identity. Satoshi has taken great care to keep his identity secret employing the latest encryption and obfuscation methods in his communications. Despite these efforts (according to my source at the DHS) Satoshi Nakamoto gave investigators the only tool they needed to find him — his own words.
  Using stylometry one is able to compare texts to determine authorship of a particular work. Throughout the years Satoshi wrote thousands of posts and emails and most of which are publicly available. The NSA was able to the use the ‘writer invariant’ method of stylometry to compare Satoshi’s ‘known’ writings with trillions of writing samples from people across the globe. By taking Satoshi’s texts and finding the 50 most common words, the NSA was able to break down his text into 5,000 word chunks and analyse each to find the frequency of those 50 words. This would result in a unique 50-number identifier for each chunk. The NSA then placed each of these numbers into a 50-dimensional space and flatten them into a plane using principal components analysis. The result is a ‘fingerprint’ for anything written by Satoshi that could easily be compared to any other writing.

But why? Why go to so much trouble to identify Satoshi? The source says that the Obama administration was concerned that Satoshi was an agent of Russia or China — that Bitcoin might be weaponized against us in the future. Knowing the source would help the administration understand their motives. As far as I can tell Satoshi hasn’t violated any laws and I have no idea if the NSA determined he was an agent of Russia or China or just a Japanese crypto hacker.
 The moral of the story? You can’t hide on the internet any more. Your sentence structure and word use is MORE unique than your own fingerprint. If an organization, like the NSA, wants to find you they will.

For more information and source: Medium
Author of complete article: Alexander Muse

Petya ransomware

The Petya ransomware attack that crippled computers in 64 countries worldwide was spread by accounting software, according to Microsoft, highlighting the dangers posed by compromised third-party apps.
The outbreak started in Ukraine, where more than 12,500 machines were infected, and there is now evidence this new Petya malware variant was initially spread via an updater for the tax accounting software MEDoc.

 A large number of organizations were infected, many in Ukraine, including Danish transport company Maersk, Russian oil firm Rosneft, the Kiev metro system, National Bank of Ukraine, the law firm DLA Piper, US pharmaceutical company Merck and many others.

How to protect yourself

Once the ransomware infects a machine, it then attempts to spread itself to other PCs on the network. To propagate itself, it will try to steal credentials to gain local admin privileges, attempt to use file-shares to transfer the malicious file between PCs, and then remotely execute the file. The ransomware encrypts entire hard drives and demands a Bitcoin payment of $300 to release them.
The malware can also spread itself using the EternalBlue exploit for an SMB vulnerability, which was used by WannaCry to spread between machines. The vulnerability was patched by Microsoft in March this year.
Microsoft recommends applying this security update, but for those who aren't able to, it suggests firms "disable SMBv1 with the steps documented at Microsoft Knowledge Base Article 2696547" and "consider adding a rule on your router or firewall to block incoming SMB traffic on port 445".
Another workaround for blocking infection by Petya is to create an extensionless, read-only file called perfc in the C:\Windows folder, using the steps outlined here.
Microsoft also provides a detailed a breakdown of commands and network activity that indicate a Petya infection.


Other reports say that the provider of the email address shown to receive the ransom closed it down, deactivated it so there's no way to pay or ask decryption of your data from the attacker.

While steps were taken to be able to block the attack in your pc, so far there's no 'kill switch' to stop the virus from spreading.

Ofcourse the known story still comes up: "keep you windows machine" updated with security updates and also have a good antivirus solution to protect yourself like the one we offer.

Source: Techrepublic

“WannaCry” Ransomware

a ransomware attack has emerged that is worthy of tears. WannaCry ransomware has hit the scene, spreading like wildfire across 150 countries and infecting more than 250,000 machines, which includes a massive takedown of 16 UK NHS medical centers in just one day. Other major countries impacted include Spain, Russia, Ukraine, India, China, Italy, and Egypt.

Now, how is this massive attack possible? The ransomware attack exploits the Server Message Block (SMB) critical vulnerability–also known as the Equation Group’s ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers a couple of weeks ago. Basically, the attacker can use just one exploit to gain remote access into a system. Once access is gained, the cybercriminal then encrypts data with a file extension “.WCRY.” Not to mention, the decypter tool used can hit users in multiple countries at once, and translate its ransom note to the appropriate language for that country. The ransom is said to demand $300 to decrypt the files.

The good news is, consumers don’t have to worry about this attack affecting their personal data, as it leverages a flaw within the way organizations’ networks allow devices to talk to each other.

However, this attack does act as a reminder for consumers to prepare for personal ransomware attacks. In order to stay prepared and keep your personal data secure, follow these tips:

-Be careful what you click on. This malware was distributed by phishing emails. You should only click on emails that you are sure came from a trusted source. Click here to learn more about phishing emails. 

-Back up your files. Always make sure your files are backed up. That way, if they become compromised in a ransomware attack, you can wipe your disk drive clean and restore the data from the backup.

-Update your devices. There are a few lessons to take away from WannaCry, but making sure your operating system is up-to-date needs to be near the top of the list. The reason is simple: nearly every software update contains security improvements that help secure your computer and removes the means for ransomware variants to infect a device.

–Schedule automatic updates. It’s always a good practice to set your home systems to apply critical Windows Security Updates automatically. That way, whenever there is a vulnerability, you receive the patch immediately.

–Apply any Windows security patches that Microsoft has sent you. If you are using an older version of Microsoft’s operating systems, such as Windows XP or Windows 8, click here to download emergency security patches from Microsoft. 

–Keep security solutions up-to-date. 

source: McAfee

Tips to keep your online accounts secure

If you didn't know, the first Thursday in May of each year has been officially declared World Password Day—a day to promote good security hygiene and password habits. In 2017, that day has fallen on May 4.

Here's a simple four-step approach to better passwords:

1. Create strong passwords

Strong passwords, according to the World Password Day website, have at least eight characters, with a mix of uppercase letters, lowercase letter, numbers, and symbols. They also avoid the use of personal information, such as birthdays or middle names.

2. Use a different password for each account

Using a different password for each online account is important because, if you share passwords across accounts, one compromised password can be used to log into another account. This is especially important regarding online banking and financial accounts.

3. Get a password manager

Password managers, like LastPass or 1Password for example, can help you store multiple passwords, often in an encrypted manner, for easy access. Typically, they will require one master password with additional layer of authentication to access the stored passwords.

4. Turn on multi-factor authentication

Multi-factor authentication adds an additional layer of security on top of your standard password. For example, an app may require you answer a security question, input a unique code, or use a fingerprint scanner on top of using your password. Check the security settings of your favorite apps and passwords to see if multi-factor authentication is available.

Source: TechRepublic

GDPR (General Data Protection Regulation) Compliance Requirements

Overview

The European General Data Protection Regulation will come into force throughout Europe by 2018. It is a major change to EU data protection law and includes a significant increase in sanctions. The Council of The European Union has finished writing its new Regulation – “The Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data,” commonly known as the General Data Protection Regulation or GDPR. It was circulated in December 2015.

The EU Parliament formally adopted the new regulation on April 14, 2016. It is due to come into force two years and 20 days after being adopted, so will become law automatically in every EU country on or around May 4, 2018.

The project to write the EU GDPR started in 2012, and is a major update to the previous EU Data Protection Directive published in 1995. It is intended to harmonize the laws across the 28 member states, clarify areas that were previously interpreted differently in different countries, increase its scope to include any organization or individual that collects data on EU citizens, and ensure that the regulations are enforced in a similar manner across all states.

Any organization that collects data (a “data controller”) or stores and processes data (a “data processor”) on residents of the EU must conform to this regulation and incorporate appropriate policies and technology to conform.

The full regulation covers many areas. The top ten provisions are:

Increased fines. Fines can be up to 4% of global turnover or €20M, whichever is higher.Opt-in consent. Users must give clear, unambiguous consent for you to use their data and you must only use it for the purpose defined.Breach notification. The local supervisory authority (see Supervisory Authorities & Their Responsibilities) must be informed within 72 hours of any data loss and users informed “as soon as possible.”Territorial scope. Any organization with data on EU residents has to conform, wherever they are based.Joint liability. Data controllers and data processors are jointly liable for data loss incidents.Right to removal. Users have the right to demand the removal of their data.Removes ambiguity. One law across the EU.Data transfer. Transferring data outside the EU is allowed, but the data controller is ultimately responsible if data is lost via a non-EU cloud provider.Common enforcement. The enforcement agencies are expected to enforce consistently across all the countries.Collective redress. Users can work together to sue using class action lawsuits.

Who does it affect?

GDPR applies to any organization (commercial or governmental) globally that collects, stores, or processes data on EU individuals. The law is an expansion of the previous directive which only affected data controllers and could only be enforced on organizations themselves based in the EU. Data processors are now jointly liable with data controllers, so if your organization collects data on individuals and then outsources the processing of that data to another entity, both you and they are jointly liable for that data.

Data controllers outside the EU

Some data controllers based outside the European Union have, in the past, claimed that they are not subject to the directive because they are not based in one of the 28 countries of the EU. The regulation makes it very clear that anyone, wherever the organization is based, is responsible if they are processing data on European data subjects.

An organization does not need to have a legal presence in a particular EU country for the courts to decide that it is responsible there to the supervisory authority. The Weltimmo case has found that the company is responsible in Hungary even though its headquarters was in another country, Slovakia. As it had at least one employee in Hungary and was offering a service to Hungarian customers via its website, it was liable for the Hungarian interpretation of data privacy laws.

Definition of personal data

The law has been written in a way that does not specify everything that is personal data to ensure the law does not become out of date if a new way of identifying people appears. Broadly speaking, any data that identifies a living person is considered personal data.

Consequences of noncompliance

The current data protection directive left the decision on the imposition of fines and the level of fines to the member states, which has resulted in different levels of fines for each country. Over time, these fines have also been modified. For example, the maximum fine that the UK regulator was able to impose in 1998 was £50,000; this was then increased to £500,000 in April 2010. Over the years, the average fine for a data breach has risen with the largest to date at £350,000 imposed in February 2016. The regulation states that fines should be “effective, proportionate and dissuasive” and the maximum possible fine has been increased to ensure that it gets the attention of organizations

The maximum fine is now €20,000,000 or up to 4% of global turnover of an organization, whichever is higher for breaking the key articles of the regulation. The introduction of the regulation states “The protection of natural persons in relation to the processing of personal data is a fundamental right… everyone has the right to the protection of personal data concerning him or her.” This level of fines should leave no one in any doubt that data protection is taken very seriously and anyone misusing or losing data on people living in the EU countries is at risk of serious penalties.

Source: Skyhigh Networks 

Είστε ασφαλείς; Οπτική υποκλοπή δεδομένων μέσω LED του σκληρού δίσκου

Ερευνητές ασφαλείας από το Πανεπιστήμιο Ben Gurion του Ισραήλ απέδειξαν ότι αν ένας εισβολέας καταφέρει να μολύνει έναν υπολογιστή, θα μπορούσε να κλέψει δεδομένα εξ αποστάσεως, χρησιμοποιώντας μια κάμερα που μπορεί να διαβάσει το LED φωτάκι του σκληρού δίσκου (HDD).

Οι λυχνίες LED των υπολογιστών αναβοσβήνουν όταν η μονάδα βρίσκεται στο στάδιο ανάγνωσης και εγγραφής, αλλά μπορεί να γίνει μετάδοση δεδομένων και οπτικά.

Όπως αναφέρει το Wired, το malware που επινόησαν οι ερευνητές μπορεί να αναγκάσει ένα HDD LED να αναβοσβήνει 6.000 φορές το δευτερόλεπτο. Αν αυτά τα φώτα είναι ορατά από ένα παράθυρο, ένα drone ή ένας τηλεσκοπικός φακός κάμερας μπορεί να συλλάβει τα σήματα από κάποια απόσταση.

Οι ερευνητές εξηγούν σε μία δημοσίευση ότι τα δεδομένα μπορεί να διαρρεύσουν από τα HDD LEDs με ταχύτητα 4kbps. Ναι η ταχύτητα είναι απίστευτα αργή φια τα σημερινά πρότυπα αλλά είναι αρκετή για να κλέψουν όλα τα κλειδιά κρυπτογράφησης.

Οι ερευνητές για να υποκλέψουν δεδομένα, χρησιμοποίησαν μια DSLR της Nikon, μια κάμερα ασφαλείας high-end, μια GoPro Hero5, μια Microsoft LifeCam, ένα Samsung Galaxy S6, τα Glass της Google, και ένα αισθητήρας Siemens Photdiode.

Κατά την γνώμη μας είναι πολύ είναι λίγο τραβηγμένο να κινδυνεύουμε στο παρόν στάδιο από κάτι τέτοιο αλλά κάποια ενημερωση δε βλάπτει.

Για περισσότερες πληροφορίες διαβάστε το SecNews

Ammyy Admin Website Compromised

The website of the Ammyy Admin remote desktop management tool has been compromised to spread malware for the God-knows-what time in the past year.

Softpedia detected that something was wrong after we started receiving worrisome comments from readers on two articles detailing past infections of the Ammyy Admin website.

 Ammyy Admin website compromised for at least two days

The contaminated Ammyy Admin file MalwareHunterTeam managed to obtain had been uploaded on VirusTotal 20 times by 19 different people, between 2016-09-14 07:47:04 and 2016-09-15 06:50:39.

Some users have the habit of double-checking downloaded files by scanning them using VirusTotal. The period above is most likely the interval during which the website had been compromised, and some of its users had scanned the file.

A hybrid analysis of the file reveals a binary called "encrypted.exe" packed with the original AA_v3.exe, the legitimate installer. Every user running the installer would also run this file, which installs the Cerber ransomware.

Ammyy Admin website serving latest version of the Cerber ransomware

Cerber, which appeared at the start of the year, had several major branches, some of which were cracked and security researchers created a free decrypter to help victims recover their files.

The version distributed via the Ammyy Admin installer packs the latest v3 version that locks files via the .cerber3 extension. This version is uncrackable, at the time of writing.

Cerber 3 ransom note

MalwareHunterTeam also said that he didn't inform the website admin of the compromise and that it stopped on its own. Either the crooks realized they were exposed or they're just preparing another version of the Ammyy installer that would spread other types of malware.

Ammyy Admin website has spread at least six other types of malware

In the past, both ESET and Kaspersky have put out reports about how the site was used to spread all sorts of malware, such as the Ranbyus, Lurk and Buhtrap banking trojans, the CoreBot and Fareit infostealers, and the NetWire RAT.

ESET reported that the Ammyy Admin website spread malware in October and November 2015, while Kaspersky reported numerous similar incidents that took place between February to July 2016.

Softpedia has reached out to Ammyy Admin's team for additional comments. At the time of writing, even if Ammyy Admin downloads are clean, we can't vouch that they'll stay this way, taking into account the website's track record.

Read more: Softpedia,Google search

Keep your DATA PRIVATE - Encfs Manager in Ubuntu, Windows or Mac

Features of EncFSMP:

• Mounts EncFS folders on Windows and OS X

• Can create, edit, export and change the password of EncFS folders

• Is 100% compatible with EncFS 1.7.4 on Linux

• Completely free, no nags, no additional downloads like toolbars etc.

With EncFS MP, you can store your data in an encrypted folder (works for usb memory sticks as well). This is especially important if you store your sensitive data in a cloud service like Dropbox or Google Drive.Since EncFS exists on many platforms, you can access your data from a Windows PC, from an Apple computer, from Linux (using the built-in EncFS), or even from an Android device (using Cryptonite).Although EncFSMP is an open source project and its source code is released under the MIT license, it contains a closed-source component. The file system component that allows EncFSMP volumes to be mounted is called Pismo File Mount and is developed by Pismo Technic Inc.. Other than that, EncFSMP is 100% open source.

Windows or Mac

Download the (open source) software from Encfs official site

Ubuntu Linux

To add the official GNOME Encfs Manager PPA and install the application in Ubuntu, use the following commands in terminal:

sudo add-apt-repository ppa:gencfsm/ppasudo apt-get updatesudo apt-get install gnome-encfs-manager