AVG: Login Via Fingerprint Positive Development

In late December showed a German hacker still see him with a picture fingerprint had copied the German Minister of Defence, but according to Tony Anscombe anti-virus company AVG login via fingerprint correct a positive development. Anscombe also criticizes the negative coverage of biometric authentication, which would let users believe that fingerprint logon is not safe.

"The process to copy someone's fingerprint in this way is difficult and time-consuming, and it is therefore unlikely that the masses will be a problem," says AVG security evangelist. "I think we just have to celebrate that authentication mechanisms that initially only used by companies and governments have now found a place in our daily lives."

Anscombe notes that as biometric security ensures that more people lock their phone, this is a positive development. "It shows that more consumers than ever protect their devices in a certain way in order to prevent their information being stolen." The security evangelist says he understands that research into this type of security is necessary, but he would prefer to see that people are encouraged to use the security on their phone than that they are trying to undermine the systems that can protect them.

US Parking Malware

The payment of various car parks in the United States are infected by malware, where possible, data from credit and debit cards from an unknown number of customers have been stolen. Before warns SP Plus an American company that parking services offered to owners of real estate, such as shopping malls and offices.

SP Plus received a message from the provider that manages the payment systems in the parking garages. An attacker could access the remote access tool received from the supplier and so could log on to the payment. There installed the malware attacker could intercept the data of payment cards which was settled in the car parks. It would be the cardholder's details (cardholder's name, card number, expiration date and verification code).

In all, 17 parks have been affected. Whether there actually map data can be stolen SP Plus does not say, but the company decided to issue a warning. Meanwhile, the malware would be disabled on all affected systems. In addition, the company's supplier obliged henceforth to use two-factor authentication when logging on to the payment.

17 SP+ Affected Parking Location's

Botnet of 500,000 computers - Qakbot Malware

The Attack Chain

Researchers have identified a botnet of 500,000 computers discovered that 52% of machinery exists that run on Windows XP. A comparatively very high percentage, since it no longer supported by Microsoft operating system worldwide share of between 14% and 24%.

The computers have been infected with qbot via known vulnerabilities in Adobe Flash Player, Java, Adobe Reader and Internet Explorer, also known as Qakbot. On infected computers qbot steals all kinds of data for Internet banking. Researchers from Proofpoint found that the login data of 800,000 accounts online banking were intercepted. In 59% of these cases involved one of the five largest American banks.

Further figures ( PDF ) show that the malware on the American Internet has provided, since 75% of the infected computers over an American IP address available. especially In addition to steal login details infected machines are also offered for other cybercriminals. Paid as proxy These criminals can the infected computers as a springboard for other attacks use or for storage or transportation of stolen data.

Following are the steps How It works:

1. Infecting Legitimate Websites

Infecting Legitimate Websites

2. Filtering Targets- Traffic Distribution Systems.

Filtering Targets- Traffic Distribution Systems

3. Getting Into The User's Machines -Exploits

Getting Into The User's Machines -Exploits

4. Stealing User Banking Credentials - Malware

Stealing User Banking Credentials - Malware

Access and location Tesla only protected by password of 6 characters

The only thing standing between a hacker and a $ 100,000 Tesla is a password of 6 characters, says Nitesh Dhanjani , author of several books on hacking and own a Tesla, at the Black Hat security conference in Singapore Asia. Dhanjani found several design flaws in the security system of the Tesla Model S sedan.
He found no vulnerabilities in the main system and its findings forwarded to Tesla.

Dhanjani states that if your password is stolen or hacked be. Thus easily traced the location of the car.
The car can be opened and belongings in the car to be stolen. To actually start the car does need a key.
When the car is ordered, the user creates an account which is only protected by a password of 6 characters. This password is used for the mobile app and the Tesla online account. The freely available app can determine the location of the car but also certain features of the car monitor and manage. The password is vulnerable to attack the usual methods that are used to gain access. To a computer or online account Thus, it is possible to guess the password, for example, via the website Tesla, as it permits an unlimited number of log-in attempts. "It is quite something when a car of $ 100,000 is only protected by a password of 6 characters" says Dhanjani.

Tesla would not comment on the findings of Dhanjani but spokesman Patrick Jones gave an e-mail to the findings of security researchers to observe and investigate further. Extremely seriously "Together with our team of top-notch security professionals protect our products and systems against vulnerabilities. We also work together with the community of security researchers and encourage them to communicate with us."