Security

San Francisco Examiner:

Computer systems at San Francisco’s transit system, Muni, have been restored following a malware attack on Friday afternoon.

Payment systems across the agency’s subways read “OUT OF ORDER” in large red digital letters at Powell Station, Embarcadero Station and other stations across The City following the attack.

On Friday and Saturday, computers in station agents’ booths across the San Francisco Municipal Transportation Agency displayed “You Hacked, ALL Data Encrypted. Contact For Key([email protected])ID:681 ,Enter.”

Sidebar: We are on the cusp of quantum computing, which will potentially make computers capable of easily solving sophisticated problems used as the basis of today’s encryption. And that will mean more hacking, but could also mean sophisticated tools to break ransomware. Depends who gets there first.

Jean-Louis Gassée:

You start with a basic Application Processor from Mediatek or one of its competitors. This gives you an ARM processor, a pared-down embedded Linux software engine, and a network stack — everything you need for Internet connectivity, with and without wires. Add your choice of sensors and drivers, hire a manufacturing contractor to assemble your security camera according to your own specs, and you’re in business.

And:

Your computer module suppliers have sold millions of identical building blocks to your competitors and other Consumer IoT dreamers: DVRs, smart locks, weather stations, lighting systems… Finished products are sold to technically unsophisticated consumers who ignore updates or forget their logins and passwords. The module makers have anticipated this predicament and designed in a backdoor, a login/password combination that allows tech support to remotely take control and make the user happy.

Yikes! A fascinating read. Jean-Louis does a nice job making this problem easy to follow. And he embeds one of my all-time favorite Joy of Tech cartoons to boot.

Sam Biddle, writing for The Intercept:

After Tuesday’s revelatory story by Reuters’ Joseph Menn that exposed an apparent vast, secret, government-ordered email surveillance program at Yahoo, the company has issued a brief statement through Joele Frank, a public relations firm.

Here’s a link to the Reuters article in question.

Yahoo’s email statement, via Jacob Silber of the Joele Frank communications firm:

Good morning –

We are reaching out on behalf of Yahoo regarding yesterday’s Reuters article. Yahoo said in a statement:

“The article is misleading. We narrowly interpret every government request for user data to minimize disclosure. The mail scanning described in the article does not exist on our systems.”

Best,

The Joele Frank Team

Sam Biddle:

This is an extremely carefully worded statement, arriving roughly 20 hours after the Reuters story first broke. That’s a long time to craft 29 words.

And:

It would mean a lot more for this denial to come straight from the keyboard of a named executive at Yahoo—perhaps Ron Bell, the company’s general counsel—rather than a “strategic communications firm.”

This feels like a disaster for Yahoo.

The Verge:

Twitter spam isn’t a new phenomenon, but over the past few weeks the amount of it has certainly increased. I use the social network on a daily basis, and not an hour goes by without a tweet of mine from months or even years ago being liked by a spambot. It’s a practice that generates a notification designed to make you click into the profile, where you’re met with what’s typically a pornographic pinned tweet and a link that will likely bury your PC into malware oblivion.

Yup. I see this on a regular basis. Always wondered what the end-game for the bot creators was. Are they rolled out by the bad guys in the hopes of sowing malware seeds? If I don’t click on the link, is there any other path to harm?

Twitter claims it has a variety of systems in place to detect spam on Twitter, and that the company responds to new forms continuously to combat spammers. Twitter also relies on users to report spammers, but it’s not clear how effective this route actually is.

If there was a UI for specifically reporting spambots, I’d definitely use it. But the spam reporting in the official Twitter client is buried under the … menu, then under the word Report, with the options:

• I’m not interested in this Tweet
• It’s spam
• It’s abusive or harmful

I think Twitter would get more feedback/responses if they let me press and hold on a tweet and select Spambot from a popup menu. Much more direct.

Terrific tweet-storm. Incredibly galling. Makes me wonder what’s lurking in the cavernous depths of my Mac.

The Washington Post:

Imagine having all the files on your computer — your documents, your photos, your videos — locked and held hostage by hackers who demand a payout just because you opened the wrong email attachment or clicked the wrong link. That’s the nightmare scenario facing victims of ransomware, a type of malware that quietly encrypts files on a computer so that only a digital key held by the attacker can release them.

But a new initiative called No More Ransom may offer a glimmer of hope for victims. The project, a collaboration among Europol, the Netherlands’s national police and cybersecurity firms Intel Security and Kaspersky Lab, launched a website Monday featuring tools that can help some victims decrypt their data without paying off the criminals.

Read on for more details.

This is a bit hard to follow, but it is a pretty ingenious scheme. In a nutshell, the scammer sets up a pay phone line, a phone number that people have to pay to use. They then use that number as a verification number with Google, Facebook, Microsoft, etc. and take an action which causes that number to be called.

By automating the process, they bring in a nice little wave of money. That’s the theory, anyway. This was pieced together by a security researcher who raised the issue to get companies to put barriers in place to prevent this hack.