Tuesday, 4 August 2015
WikiLeaks documents show the US spied on Japan
WIKILEAKS HAS PUBLISHED DOCUMENTS that make it look a lot like the US National Security Agency (NSA) has been spying on Japan and the Japanese government.
WikiLeaks, a thorn in the side of governments and regimes, and an early adopter of AirBnB-like services in extremis, has official documents and details about the situation and has released them in a package called Target Tokyo.
The documents show information about the targeting of 35 subjects and the news that pickled persons from outfits including the Japanese cabinet and companies like Mitsubishi have been watched and listened to.
Information relating to trade deals, political relations and climate change strategies are hot topics. The NSA has tried to limit its exposure to this kind of bad chat.
“In these documents we see the Japanese government worrying in private about how much or how little to tell the US in order to prevent undermining of its climate change proposal or its diplomatic relationship,” said Julian Assange, editor-in-chief of WikiLeaks.
“And yet we now know that the US heard everything and read everything, and was passing around the deliberations of Japanese leadership to Australia, Canada, New Zealand and the UK.
“The lesson for Japan is this: do not expect a global surveillance superpower to act with honour or respect. There is only one rule: there are no rules.”
WikiLeaks said that the surveillance dates back to at least 2006, and included a study into prime minister Shinzo Abe and his administration.
Other hotlines sent up by the NSA are said to include hooks into Mitsubishi’s natural gas division, and at least one home phone number for a high ranking banker.
Phone numbers for various ministries, including the cabinet office, may have been tapped and callers may have heard some unexpected clicking on the line.
WikiLeaks said there are clues that the information was shared between the Five Eyes group, a government hearing post hydra that includes Australia, Canada, the UK and New Zealand, and that the information gathered and processed gave an “intimate” look into the workings of the Japanese government and its position in the world.
“Today’s publication shows us that the US government targeted sensitive Japanese industry and climate change policy. Would the effectiveness of Japan’s industry and climate change proposals be different today if its communications had been protected?” asked WikiLeaks investigations editor Sarah Harrison.
“Japan has been a close historical ally of the US since the end of World War II. During a recent presidential visit to Japan, Barack Obama described the east Asian country as ‘one of America’s closest allies in the world’.”
We have asked the NSA for its response, but then it probably knew that already.
View the original content and more from this author here: http://ift.tt/1IesNGP
from hacker samurai http://ift.tt/1M8J705
via IFTTT
Popcorn Time vulnerability could allow hackers to take over your computer
One of the most popular movie streaming apps online might be a prime target for hackers. On Monday, TorrentFreak shared a report from Antonios Chariton (aka DaKnOb), a security engineer and researcher who discovered a major vulnerability in one of the most popular forks of Popcorn Time.
“There are two reasons that made me look into Popcorn Time,” said Chariton. “First of all, I know many people who have installed this application on their personal computers and use it, and second of all, by pure accident: I was setting up my computer firewall when I noticed the network traffic initiated by Popcorn Time.”
Basically, in order to bypass the blocking in Europe, the developers of Popcorn Time utilizes CloudFlare infrastructure, which would mean that European ISPs would theoretically have to block the entire CloudFlare network in order to effectively shut off access to Popcorn Time.
Unfortunately, “the request to Cloudflare is initiated over plain HTTP,” which Chariton explains could allow an intruder to initiate a man-in-the-middle attack on the host’s computer. Seemingly without much effort, Chariton was able to inject malicious code through the app himself, taking control of the application.
But not all is lost, providing the developers are willing to follow the researcher’s advice:
“HTTP is insecure. There’s nothing you can do to change this. Please, use HTTPS everywhere, especially in applications that don’t run inside a web browser. Second, sanitize your input. Even if you receive something over TLS v1.2 using a Client Certificate, it still isn’t secure! Always perform client-side checks of the server response.”
It took one hour for Chariton to find this vulnerability, come up with a plan to exploit it and write the necessary code. This is clearly an issue that requires immediate attention. There’s an ongoing discussion between Chariton and the developers on the site’s GitLab.
View the original content and more from this author here: http://ift.tt/1OLYAAJ
from hacker samurai http://ift.tt/1ID62cH
via IFTTT
Hackers get access to medical files of 3.9 million people
An Indiana company provides services for Concentra, which operates urgent care centers in Maine.
FORT WAYNE, Ind. — An Indiana medical software company has reported the private information of 3.9 million people nationwide was exposed when its networks were hacked earlier this year, the U.S. Department of Health and Human Services said Monday.
Medical Informatics Engineering reported the number of people affected by the hack to the federal agency on July 23. The Fort Wayne company announced June 10 that the attack on its main network and its NoMoreClipboard network began May 7 and was detected May 26. The company said the exposed information includes names, addresses, birthdates, Social Security numbers and health records.
A notice posted on the company’s website said the hack affected patients of 11 health care providers. They include Texas-based Concentra, which operates three urgent care centers in Maine; Franciscan St. Francis Health Indianapolis; and Rochester Medical Group in the Detroit area. The hack also affected patients served by 44 hospitals and other radiology centers in Indiana, Ohio and Michigan, the notice said.
View the original content and more from this author here: http://ift.tt/1ID5ZNX
from hacker samurai http://ift.tt/1M8J4Be
via IFTTT
Zero-Day Vulnerability in Mac OS X 10.10 Lets Hackers Install Malware Without User’s Consent
It would appear that researchers have just discovered a serious zero-day vulnerability in Apple’s OS X 10.10 (Yosemite) computer operating system that could allow attackers and skilled hackers to install malware and adware into a target Mac without the need for administrative privileges.
Malwarebytes announced the big news on August 3, 2015, which is called a DYLD_PRINT_TO_FILE exploit. The 0-day vulnerability affects the current stable version of Mac OS X 10.10 (build 10.10.4), as well as the recent Beta build of OS X 10.10.5 Yosemite, and was discovered by Adam Thomas while testing a new adware installer.
Mr. Thomas reports that he discovered the zero-day security vulnerability in Mac OS X 10.10.4 Yosemite during some tests of a new adware installer that had modified his sudoers file, so anyone can install anything on the target Mac without needing the user’s consent or any other system password.
Hackers can take advantage of this zero-day vulnerability, which is actually related to some error logging features introduced in Mac OS X 10.10.4, to install adware like MacKeeper, VSearch, and Genieo. Check out the attached screenshot to see how the sudoers file was modified by the adware installer.
“Then the script uses sudo’s new password-free behavior to launch the VSInstaller app, which is found in a hidden directory on the installer’s disk image, giving it full root permissions, and thus the ability to install anything anywhere. (This app is responsible for installing the VSearch adware.),” says Thomas Reed on behalf of Malwarebytes.
Mac OS X 10.11 El Capitan is not affected
While there’s nothing you can do to stop a skilled hacker from installing malware and adware on your Mac running the latest stable or Beta version of OS X 10.10 Yosemite, there’s some good news for those who are using Mac OS X 10.11 El Capitan Beta builds, asit appears that they’re not affected. Until Apple fixes the security flaw, here’s how you can protect yourself from malware and adware.
View the original content and more from this author here: http://ift.tt/1hh6BTF
from hacker samurai http://ift.tt/1hh6BTG
via IFTTT
Subscribe to:
Posts (Atom)