Google Encrypts All Traffic To blogs On Blogspot

Google has decided to encrypt all traffic to the blogs on its own Blogspot blogging service. In September last year the Internet giant began offering the option for bloggers to activate it yourself. This option has now been removed and traffic to all blogs are now encrypted.

There is also a new option available for bloggers called "HTTPS Redirect", making it possible to enable all visitors to the HTTP version of the blog visit automatically redirected to the https version. In case the option is disabled, it is possible to visit the blog via both http and https. Google warns however for mixed content that may not work properly the https version of the blogs.

It is in this case content such as images, gadgets, ads or templates that are invoked via http. In the case of an https site may cause a mixed content warning. Google argues that it can solve many of these problems, but some must be resolved by the bloggers themselves. To help bloggers and administrators with this, there is now a special tool launched to find mixed content into blogs and posts.

Millions Of Vulnerable Devices By The Same Encryption Keys

Researchers warn that millions of devices such as Internet routers, IP cameras and modems are vulnerable because they use the same encryption keys. Attackers can therefore perform man-in-the-middle attacks and eavesdropping and decrypt encrypted traffic.

Therefore might enter sensitive information into the wrong hands. The problem is with so-called embedded devices, including routers, modems, IP cameras and VoIP phones. Researchers from security firm SEC Consult watched for their research firmware more than 4,000 such devices from more than 70 manufacturers.

They mainly looked at cryptographic keys in firmware, such as public keys, private keys and certificates. It mainly involves keys that are used to connect through SSH and X.509 certificates used for HTTPS. In total, were found more than 580 unique private keys in the 4,000 studied devices.

This information was then correlated with data from large-scale Internet scans. It emerged that the dataset with the 580 unique keys contains the private keys of 9% of the HTTPS web hosts and the private keys of more than 6% of all SSH hosts.At least 230 of the 580 keys were actively used and seen by millions of hosts.

The keys are added by manufacturers to provide connection via HTTPS and SSH. The problem is that all devices with the appropriate firmware using the same keys. It was remarkable that the same keys were found in the products of different manufacturers. For example, a certificate of Broadcom were found on the Internet at more than 480,000 units, including Linksys and ZyXEL. The problem also arises in Cisco, Huawei, Ubiquiti Networks and other vendors. The devices are especially vulnerable in the United States (26.3%) and Mexico (16.5%).

Solution

SEC Consult has worked with the CERT Coordination Center (CERT / CC) at Carnegie Mellon University to warn the manufacturers involved and browser developers. Meanwhile, some parties have released updates. Manufacturers also are advised to use unique cryptographic keys for each device. In addition, Internet service providers to ensure that remote access over the WAN port to the equipment of their subscribers is not possible. Finally end users are advised to generic SSH keys and X.509 certificates on their devices to replace unique versions. However, the CERT / CC states that in many cases, there is no practical solution is available.

Big Malware Advertising Campaign Unraveled

Malwarebytes claims to have exposed one of the largest advertising campaigns to malware of recent months. With the campaign large numbers of visitors were redirected to websites casino while their computers were infected with malware.

The campaign focused on visitors somewhat questionable websites including torrents, live streams of the latest movies and pirated software. Some ads that were on those sites, visitors automatically sent by (without having to click on the ad) to one of the casino sites.

Iframes

These sites were used as a diversion while there were loaded onto the background iframes variety of domains, which ultimately caused the Angler exploit kit to the victim was installed. Since this week would also Neutrino exploit kit can be used.

The ad campaign would be launched on October 21 and have lasted at least three weeks. That it took so long is, according Malwarebytes because both visitors and administrators of the dubious torrent sites had little need to report abuse, since they themselves were engaged in illegal content.

According SimilarWeb, a service that collects and analyzes data on website traffic, these ad networks generated in October visit more than two billion.

F-Secure Reveals WiFi Router For Internet Of Things

The Finnish anti-virus firm F-Secure today announced a new device unveiled it as a kind of Wi-Fi router 'for the Internet of Things can be seen and monitors all traffic for malware, adware, phishing, tracking and other threats. Sense, such as the device is called, must be connected to an already existing router.Sense then create a secure network where traffic from all devices in the home is long.

This involves the movement of laptops, smartphones, game consoles and IoT devices. The traffic is then monitored for any threats. Thus devices can also be protected where it is not possible to install security software. It may also block undesired Sense tracking. What exactly is understood to mean here is still unclear.

In addition Sense also comes with a Sense app, which devices such as laptops, smartphones and tablets can be installed.The app must ensure that the devices are also protected if they leave the house. It is also possible to manage the safety of all connected devices via the app. Possibly the router will also be enhanced with new features, such as protection for Internet banking and a VPN to surf anonymously.

Sense supports Windows 7 and newer, and newer Android 4.0 and iOS 8.4.1 and newer. In addition to Wi-Fi (IEEE 802.11a / b / g / n / ac) are also three Gigabit LAN ports offer gigabit and WAN port. The hardware should appear in the spring of next year and the rate for the first 5,000 preorders 99 euros. The normal amount is 199 euros. In addition, after the first year, 8 per month to pay for the subscription.

WhatsApp Collects Phone Numbers And Call Duration

WhatsApp collects phone numbers, duration of calls and other information, as researchers from the University of New Haven determined. WhatsApp, the popular chat app in the world and has over 800 million users worldwide.

Last year it was acquired by Facebook for $ 19 billion. Due to the acquisition by the social network and the large number of users, according to the researchers, is important to know how the network protocol of WhatsApp works and what forensically relevant data it contains. For the study, the researchers decided to unravel the connection between the WhatsApp program and the WhatsApp servers.

Through the network traffic, the researchers were able to identify various data, such as WhatsApp phone numbers, metadata about the call set-up and the duration of the call. They also discovered the codec used WhatsApp for calls, as well as the IP addresses of the relay servers which run the WhatsApp conversations.

"Our research shows which data can be gathered through forensic examination of WhatsApp and provides a way for others to conduct additional research on network forensics messaging apps," said researcher Ibrahim Baggili. The researchers note that decrypting the network traffic was not easy. For this it is necessary to have access to both the data on the device as the entire network traffic. The research of the researchers: "WhatsApp Network Forensics: Decrypting and Understanding WhatsApp Call Signaling Messages" is published in the journal Digital Investigation.

Android Version Firefox Receives Click-To-Play For Images

To save bandwidth and ensuring that websites load faster Mozilla has released an early test version of Firefox 44 for Android added click-to-play for images. Click-to-play is a mechanism that the browser is now used to activate browser plug-ins.

A user in this case will have to make an extra click before a Web browser plug-in can call. This should prevent users automatically via vulnerable browser plug-ins can be attacked because the user still needs to activate the plug-in. Click-to-play for images but works slightly different and mainly saving data traffic and faster loading websites as the reason. In case an image for a larger view links provides a single tap on the screen that the bigger picture is loaded.

A long tap on the image displays the context menu in which the user can then choose to display the image. The option currently applies to separate images. A user will be on a site with multiple images therefore have to tap several times before the images are displayed on the page, says Soren Hentzschel who discovered the feature. Click-to-play for images present in the Nightly version of Firefox 44 and must itself be activated by users.

Google Will Support HTTPS For Blogspot

Owners of a blog on Google can now set HTTPS, so that traffic to and from the blog is encrypted. That Google has announced. The Internet giant has in recent years more and more services HTTPS enabled, but not for the popular blog platform Blogspot.

That is about to change. For blogs can enable encryption are important because, according to Jo-el Bergen, software engineer at Google Security. HTTPS can define users as to whether they are on the right website and not redirected to a malicious site. There may also be detected via HTTPS or an attacker to manipulate the data that is sent from Blogspot to a visitor, says Van Bergen.

HTTPS is not immediately available automatically to all Blogspot users, and will be gradually rolled out. Bloggers can Enable all myself. It only applies to blogs here, which are accessible via the domain of Blogspot. Bloggers who use their own domain name will be later supported. Bloggers do get a warning that after enabling HTTPS certain things may not work as templates, gadgets or content. It often matters that are offered via HTTP. To set a good example Google is now also a number of own blogs to move HTTPS.

Adblock Plus For iOS App Store Officially Launched

The makers of the popular browser extension Adblock Plus now also have a version for iOS nine developed which is free from the App Store to obtain. Through the AdBlocker allows users to block ads on their iPhone and iPad. This can save users data traffic, protect themselves against infectious ads, improve privacy and reduce battery consumption, according to the developers.

To use Adblock Plus for iOS users must perform some actions. The developers of the browser extension therefore have a very brief guide put online. Adblock Plus has been downloaded over 300 million times and has tens of millions of active users. It is by far the most popular browser extension on the Internet. The iOS version is free via the App Store to download. Yesterday launched also the Finnish anti-virus firm F-Secure its own free AdBlocker. Since Apple iOS nine state AdBlocker apps increasing, which now several apps has produced.

Google: Anti-Virus Software, Kaspersky Still Leak

The anti-virus software of the Russian anti-virus firm Kaspersky Lab still contains multiple vulnerabilities, says Google researcher Tavis Ormandy. Recently released the virus fighter that's been a big leak could poem was found by Ormandy and the system could allow an attacker to take complete without users here had to do something.

The researcher Google has much more major vulnerabilities found in the anti-virus software, so Ormandy late in an analysis of the leak know that are already patched. The analysis was made ​​on the Project Zero blog from Google. Project Zero is a team consisting of Google hackers and researchers looking for vulnerabilities in popular software. This included the anti-virus software from Kaspersky scrutinized.

Not patched

"Many of the bug reports I submitted are still not patched, but Kaspersky has made enough progress that I can talk about some of the problems," as the researcher says. Ormandy had found dozens of bugs in the anti-virus software and reported. The research shows that some of the most dangerous leaks were very easy to abuse. The researcher is pleased that Kaspersky Lab here for additional security rolls out. The impact of a vulnerability will increase in anti-virus software because the virus often file system and network traffic intercepted.

Visiting a website or receive an e-mail is enough to be attacked. It is then not even be necessary to open the e-mail, since the input / output of the reception of the e-mail is sufficient to cause the vulnerability. Besides the discovered vulnerabilities Ormandy also found several major design flaws in other parts of the anti-virus software. These other vulnerabilities to attack his distance. As the updates previously been deferred, he will discuss these issues later.

Security software harmful?

According to Ormandy, there are strong indications that there is an active trade in exploits for antivirus software exists."Research shows that a readily accessible attack surface that exposure to targeted attacks increased enormously," says the researcher. Therefore, he believes that security software developers the strictest security guidelines when developing their software must implement in order to reduce problems caused by the software. Something that fail anti-virus companies. In the past Ormandy has major problems in the software of anti-virus company Sophos and ESET found.

The researcher concludes with a warning and request for anti-virus companies. They would parts of their software does not have to run with system privileges. "Do not wait for the network worm that it has provided in your software, or targeted attacks against your users. Add even today the development of a sandbox to your development plan." Regarding the outstanding vulnerabilities in the software of Kaspersky Ormandy says that the anti-virus company responds very quickly and that a number of critical vulnerabilities in the coming weeks will be patched.

Small Network Scanner CUJO Great Success IndieGoGo

A small device that scans network traffic for malware and other attacks is a huge success on crowd funding platform IndieGoGo. CUJO has the size of a large apple and monitor the movement of all devices on the network. Users need to connect the device only on their router and CUJO does the rest, according to the description on IndieGoGo.

According to the developers CUJO acts as a gateway between the internet and the devices on the network. All traffic is then inspected at the package level and blocked in the event of malware or other threats. For this fit CUJO deep packet inspection (DPI) increased. In addition to paying for the device itself, which costs $ 49, there must be a subscription of $ 9 per month closure. The subscription fees are required according to the developers to detect new threats.

For this retrieves the local CUJO-device information from the CUJO cloud. Although CUJO network traffic scanning, users have advised locally on the computer to install a virus. In four days time CUJO already raised $ 90,000 by 1259 people on Indie Gogo, while $ 30,000 was intended. With just 28 days to go, the network scanner is now at 300% of the funding goal.If everything goes according to plan, the first CUJO are delivered next February or March.

Avira Tool For Lost iPhone Logins Sent Over HTTP

A free tool from antivirus company Avira for finding stolen or lost iPhones appeared to send unencrypted passwords over HTTP. This would allow an attacker who get the network traffic could eavesdrop usernames, passwords and other sensitive information.

It discovered security researcher David Coomber. According Coomber were the passwords that the Avira Mobile Security iOS app sent well protected by the weak MD5 algorithm, but would offer no protection against an attacker could sniff network traffic. Mobile Security is an app that allows users to trace five lost or stolen iPhones. Also, users can check via the tool or their e-mail was hacked, the address book or safe and iOS is up to date. Avira was informed on July 17 and published on September 3 version 1.5.11 in which the issue is resolved.

Teen Gets Community Service Because Of DDoS Attack On Spamhaus

A British teenager in Britain was sentenced to community service of 240 hours for his role in a major DDoS attack on anti-spam organization Spamhaus in 2013. At the peak was 300Gbps there to traffic sent to the website, which collapsed as a result, reports the BBC .

The teen would have offered as "mercenary" to get websites fee from the air. The attack against Spamhaus would possibly other parties were involved. After his arrest, was found a sum of 101,000 euros in his bank account. On his computer, investigators found the source code of the software that the attack was carried out. According to the judge there would be no likelihood of recurrence and the teenager really regret his actions. He therefore decided not to impose imprisonment.Spamhaus may know agrees with the judge's ruling, CIO Richard Cox so late.

Finnish Teenager Convicted Of Computer Crimes

A 17-year-old Finnish teenager was sentenced in Finland to a suspended sentence of two years for a large number of computer crimes. The boy needs help "combating cyber crime," notes the website Daily Dot according to reports in the Finnish media .

The Finn was convicted based on 50,700 counts of computer crime. It was to include data breaches, credit card fraud, money laundering, fraud and violating commercial secrets and other matters. He placed with stolen credit cards at various retailers orders. In one case, he happened to wine from Ireland. The Finland Times reports that the teenager also the e-mail traffic of 15,000 users of the Massachusetts Institute of Technology (MIT) intercepted and network traffic of the university sent to another server.

The teenager was also part of the Lizard Squad have been. The group was last year responsible for DDoS attacks on the networks of Xbox Live and the PlayStation Network. The Finnish teenager was also interviewed by the British television channel Sky News for the DDoS attacks. Were the attacks on the networks of Microsoft and Sony hacked thousands of home routers are used.

Anti-Virus Companies Were Targeted GCHQ And NSA

Several anti-virus companies in the past have been the target of US and British intelligence, focusing in particular went to the Russian virus fighter Kaspersky Lab, according to documents from whistleblower Edward Snowden in 2008.

The US NSA and the British GCHQ looked for ways to circumvent virus and other security software. The e-mail traffic was monitored in order to bring users of anti-virus software identified. The documents also show that British intelligence software Kaspersky wanted to reverse engineer and that the NSA was looking for vulnerabilities. US intelligence also shows traffic between the servers and Kaspersky users have viewed the software.

In 2008 discovered a research team from the NSA that the Kaspersky software users sensitive information sent back to the company's servers. This information could easily be captured to track users, says a report. The NSA would have intercepted e-mails, which were intended for security companies and which were warned of new viruses and vulnerabilities, reports the intercept today using different Snowden documents.

According to researcher Joxean Koret anti-virus software is an attractive target for attackers. The software often takes the highest rates in the system. An attack on a virus an attacker could cause these rights. Moreover, the security of many anti-virus software to be desired and even years on other client applications such as browsers and document readers behind, Koret said. "It means that Acrobat Reader, Microsoft Word or Google Chrome are much more difficult to attack than 90% of the virus." It was recently announced that Kaspersky Lab was the victim of a sophisticated attack carried out by a state, according to the virus fighter.

Research: Botnets Consist Of Average 1700 Computers

In the first quarter of this year were from botnets average 1700 computers, claims ISP Level 3 on the basis of own research ( pdf ). For the study 600 to 1000 Command & Control servers were monitored allow cyber criminals to control infected computers.

The number of computers part of a botnet accounted fluctuated considerably in the first months of this year. So it went in January to an average of 3,763 computers, but this was dropped in March to 338 computers. According to Level 3 is due to the decline in the "vigilance" by the security community. Computers that are part of a botnet are found mainly in China and the United States, each with more than half a million infected machines, followed by Norway with 213,000 "zombies."

Norway was in the first quarter, also the target of the most botnet traffic, followed by the US and Spain. The presence of Norway is explained by a single incident where a botnet server was hosted within a specific hosting environment.

Netherlands

The report also mentioned several times Netherlands. For example, the Netherlands is in fourth place worldwide in countries that generate botnet traffic and in third place in Europe. "From a global perspective, the Netherlands is higher in relation to other European countries. The top 10 listing is primarily due to a large and heavy port scanner which made a number of victims in the Nordic region," says the report. It is further stated that the Netherlands provides a "robust infrastructure," making it "ideal" is to centralize botnets in the region.

VPN Service Hola Used For DDoS Attack On 8Chan

The popular free VPN service Hola has recently been used to carry out a DDoS attack on the 8Chan website. Hola is as an extension for Google Chrome easy to install and use, which besides being free explains the popularity. In order not to pay for the traffic of users makes the VPN service using a P2P system where the traffic of users is through the connection of other users.

What many users do not know is that the company behind the VPN service sells the users of bandwidth via a service called Luminati. Luminati gives people to pay for access to the Hola network, for example, to commercial traffic anonymous routing.In this way Hola remains free to users. Via Luminati However, it is also possible to use the bandwidth of Hola users for DDoS attacks.

On May 24 was Luminati used as botnet to attack the 8Can website, so let investigator Nikoloz Kokhreidze Monday already know. The founder of 8Chan, Fredrick Brennan, then placed a warning on the website that users Hola better not use. "Hola is the most unethical VPN've ever seen," he observes. In a response to Business Insider Hola let know that the party that the DDoS attack conducted could use any VPN service. In addition, it should also be obvious to users how Hola works, but is there because of all the fuss surrounding private details are put on the website.

Secret Unit Google Fights Against Botnets And Click Fraud

Google has a secret unit of over a hundred people who are working every day with combating botnets click and ad commit fraud. The botnets generate traffic and clicks for ads and would advertisers and advertising platforms billions of euros.

Google is the largest ad provider on the Internet ad fraud and therefore constitutes a serious risk to giant internal. A risk is increasing. "We are at a point which malware is being used mainly for advertising fraud," says Douglas Hunter Google versus Ad Age . The website received a unique insight into the workings of the secret unit, whose existence has not been made ​​public by Google.

Malware

To combat fraud, the ad team analyzes all kinds of malware, which include Google through the online virus scan service VirusTotal receives. By analyzing the malware a click fraud botnet can be mapped. Then look at the traffic that generates the malware. Traffic which malware authors try to make it look as human as possible.

In the Google case "non-human" traffic will encounter the publisher ads showing not paid and the advertiser is no fee will be charged. By now inspire to step outside Google hopes other companies to share their findings and to tackle together ad fraud."Our job is to increase the cost for the fraudsters to a point that advertising fraud no longer interesting for them," concludes De Jager.

American College Gets Offline Network After Attack

An American university network was taken offline after it had advanced malware discovered that for years was active. On November 21 last year, the Penn State College of Engineering was warned by the FBI for an attack. There was a study conducted in silence, the attackers did not let them know they were discovered so, said in a university statement .

Also had a "deviant action" by an individual user can provide unwanted operations to aggravate the situation. During the investigation, it was discovered that two sophisticated attackers had gained access to the network. One of the attackers since September 2012 would have had access to the network. Because of the size it is now decided to disconnect the network from the Internet and check all systems.

Further measures will be taken to prevent future attacks. There will be tighter security rules for workers and students are implemented. In addition, the IT policy will be adjusted properly. In the attack, no personal information would be captured.However, the attackers were able to compromise multiple accounts and passwords. From all accounts, the password will be reset. According to the university, the operation will take several days.

Research: Bots Generate More Traffic Than People

The amount of traffic crash last year was greater than that of men, claims the US bot opponent Distil Networks . Was in 2013. 55% of human traffic, last year this had fallen to 41%. The increase in bone traffic is mainly due to "good bone." This involves automated systems of search engines and social media sites for instance index websites.

The movement of these good bots rose from 21% to 36%. Besides the good bots there are also "bad bots". These are systems that perform brute force attacks, scrape information from competing websites trying to hijack accounts, execute man-in-the-middle attacks, looking for vulnerabilities and commit click fraud. The movement of these bots decreased slightly, from 24% to just under 23%.

The bad bots according Distil Networks mainly a problem at Amazon. 78% of all traffic from Amazon in 2014 consisted of "bad bots". Virtually unchanged from a year earlier. The Dutch service provider SoftLayer is responsible for a lot of bad bots, says Distil Networks. Almost 96% of the traffic is classified as "bad bots." Bad bots are also becoming increasingly behave as humans to be if not detected.

Is specifically looked at countries than are most bad bots (52.2%) in the United States. Netherlands enters the list with 2.5% in sixth place back. However, there is also a bath ratio of impact in relation to the number of Internet users. Then the first place is occupied by Singapore with 153, while the Netherlands has a ratio of 3.3 and thus ends up in eighth place.

Attack On WaterTreatment Appears To Incorrectly Set Switch

A large amount of traffic with which to make the network an American water treatment plant was caused by an incorrectly set switch and was not the result of malware. That leaves the Industrial Control Systems Cyber ​​Emergency Response Team (ICS-CERT) of the US Department of Homeland Security in a new report ( pdf ) know.

The water treatment plant took an upgrade to the network location. The misconfigured switch was, however, generated a huge amount of network traffic, causing large load with control systems. For the central seemed as if the systems were infected with malware. The ICS-CERT analyzed the configuration of the router and switch and discovered an error.

The wrong configuration meant that excess network traffic was sent to the system, causing the processors could not handle it anymore. The ICS-CERT advises organizations in vital infrastructure whatsoever to first test new configurations in a test environment, consult with suppliers or new systems are compatible with existing systems and that the supplier is in the delivery of new systems locally.