Expert: Passwords Are Not The Problem But People

This week, Microsoft unveiled Windows 10 biometric logon will support so users no longer have to use password to gain access to their systems and accounts, but according to one expert passwords are not the problem, but people.

"Although there are safer alternatives and other authentication methods that can be used in addition to the password, the password will still be a long time with us, whether you like it or not," said Richard Walters of Inter media. He also thinks there should be more attention to their passwords "work". Most programs currently only works with passwords. "The reality is that there is nothing wrong with passwords. People are the problem. Users choose passwords that are too simple, too short and too predictable."

Walters points to the passwords of Sony and LinkedIn users who came out through data leaks. Then it appears that more than half of the passwords consist of fewer than eight characters. Even when websites take measures such as salting and hashing these kinds of short passwords still a risk, according to the expert. Users also increase the risk by using the same password for multiple websites.

Password Management

"Despite all attempts to educate users on the importance of using relatively long, complex passwords and willing hour, they do not. And they are rarely changed." Walters, however, sees programs a solution that not only choose a password for the user, but also changes regularly. This form of "automated password management" can help prevent attacks or reduce their impact. "The risk of a data breach is now greater than ever. The removal of human interaction with passwords and the selection and re sizing automation will be a big step forward at different levels."

Sony Compensate Damage Of Hacked PSN Gamer

A gamer who the Sony PlayStation Network account was hacked and used to reimburse hundreds of dollars in fraudulent purchases gets the damage from Sony. The player with the alias "Kadjar" on social news site Reddit message that last week he suddenly got all kinds of confirmations of purchases that he had not done. It would be an amount of more than $ 600.

The gamer logged onto his PSN account and removed the credit card that was linked to the account. By linking a credit to the account it is possible to buy all sorts of games and expansions through the PSN store from Sony. The attacker used this to yourself to purchase any games at the expense of Kadjar. After the card was removed took gamer contact Sony. An employee said that the company is an amount up to $ 150 would compensate.

Kadjar did have the option to cast doubt on the transactions at his bank, but warned the employee that his PSN account banned would be in this case. Therefore, the gamer would lose all his previous purchases. The attacker who had hacked the account of the gamer had deactivated the PlayStation 4 of Kadjar and activated its own console. The Sony Helpdesk allows one activation every six months. Therefore, the gamer would half a year without access to his own account.

Solution

The story was widely picked up by the media and made ​​sure Sony On contacting Kadjar and told to investigate the matter.The gamer is now reporting on Reddit that the investigation showed that his account was indeed hacked and Sony will arrange everything. Also told the employee that the Sony headquarters knew his situation and that there will be now examined whether the policy should be adjusted.

US warns of SMB worm that was used against Sony

The Computer Emergency Readiness Team (US-CERT) of the US government has issued a warning for an SMB (Server Message Block) -worm that started against Sony. The worm uses brute force authentication to spread through shared Windows SMB shares.

Every five minutes makes the malware connects to the server command of the attackers to send data successfully to another Windows computer via SMB port 445 has infected. The tool also listens for connections on TCP port 195 and TCP port 444. Furthermore, the worm has a backdoor that allows to download files and execute commands. The worm can so via Universal Plug and Play (UPNP) ports in your firewall to discover routers, gateways and port mappings.

Thus it is possible to attacked computers that are behind a NAT (Network Address Translated) network are to allow incoming connections. The part of the worm that is most striking is the "clear", which overwrites the Master Boot Record of the hard drive and thus makes the system unusable. The delete function is also used against systems that are accessible via shared network folders. The malware attempts to log on to these computers via a number of usernames and passwords that are previously specified by the attackers.

The US-CERT warns that organizations that deal with this malware get must take account of the theft of intellectual property and the disruption of critical systems. As a solution to get the system advised to use virus scanners and keep up-to-date, operating systems and software to keep up-to-date, "defense in depth" to apply strategies and a plan to establish order with destructive malware to go.

Attackers Sony used password system

The attackers knew the network from Sony to break used the stolen password of an administrator, so claim US researchers on the basis of evidence found via the password the attackers had access to the entire Sony network.

The discovery is one of the reasons why the researchers think that the attack on Sony's done with the help of an employee, so let officers across CNN know. The US authorities have now declared the attack a matter of national security. According to CNN, Washington will be today North Korea blame designate behind the attack.

Security expert Jeffrey Carr argues that the US should provide evidence first before it can be assumed that North Korea is actually behind the attack. He himself has serious doubts about this. "My advice to journalists, managers, policy makers and the public to doubt everything you hear on the granting of cyber attacks. There is no concrete evidence and possible indicators that can not be verified."

Even Kim Zetter of Wired published an article why the evidence against North Korea is thin. The film would also "The Interview" have been no reason for the attack. The film was the first announcement is not mentioned by the attackers. The fact that the malware on a computer with a Korean language is compiled does not say anything. Setter outlines two scenarios then who is behind the attack. Possibly it is a group of people who, like Anonymous operate, or there were several groups with different motives that had access to the Sony network.

Destover malware signed with Sony certificate

It has been discovered a new variant of the dangerous malware attackers against Sony Pictures Entertainment have deployed and those with a digital certificate of the company is signed, so let researchers know. It is the "Destover" malware, which also last year against South Korean banks and television companies was used. On infected computers malware steals data and then removes all files, making the machines currently unusable.

During the attack on Sony, the attackers have the private keys captured and published that the company used to provide files of a digital certificate. However, they can also be used to sign malware, and then be used in further attacks, let anti-virus firm Kaspersky Lab know. They discovered Destover variant was signed on 5 December. Because Sony certificates are trusted by security makes this attack effectively. The digital certificate has been revoked, let certificate authority DigiCert via Twitter know.

Security Researcher Colin Keigher leave via Twitter that this is a "joke" among security researchers. A researcher who requested anonymity had found the certificate and discovered that it was the password file. Then this investigator signed the Destover malware with the Sony certificate and uploaded it to VirusTotal, which eventually landed at Kaspersky Lab.

SONY - Malware Analysis

The malware was used recently against Sony is the same " destructive "malware that the FBI this week warned. Reported that the Japanese anti-virus company Trend Micro that a copy of the malware got hold. The main part of the malware is a collection of user names and passwords to be logged on shared network drives.

Once active users remove the malware files and files connected network drives and stops the Microsoft Exchange Information Store service. Then the malware two hour idle and then restart the system. Another part of the malware puts a .bmp file on the computer that contains the message "Hacked by #GOP". This is the same image that would have appeared on the computers from Sony. Trend Micro therefore proposes that the malware that was used against Sony.

Here is Deep Analysis of Destructive Malware By Some Security Research Companies:

Trend Mirco
Kaspersky
Symantec
BlueCoat

VirusTotal Link:
https://www.virustotal.com/en/file/4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9/analysis/1417763962/