Yahoo today launched a redesigned Mail app which allows users without a password to login. In addition, e-mail accounts from multiple e-mail providers are supported, as the Internet giant announced. New in the app is the addition of the "Yahoo! Account Key".
This key is according to Yahoo a simpler and safer alternative to the password. During login, users need a password to give more but simply a tap of a button. In this case, a notification with the Key Account is sent to the smartphone. The user can then via a single tap to confirm that he really wants to log in, then he is also logged as Yahoo late in a blog posting know. The new Yahoo Mail app is available for iOS and will appear later today on Google Play.
Microsoft uses its own Bing search engine to prevent Internet users use Google Chrome or Mozilla Firefox. Who through Bing for 'firefox' or 'chrome' is looking for gets a big black bar on the screen stating that Microsoft Windows 10 recommends the use of Microsoft Edge.
This was discovered by VentureBeat. The bar also contains a button that a page opens with the advantages of Microsoft Edge. The page is available only for US users only, the message isn’t showing up in other countries.The black bar appears also to be shown once and does not appear in the search for 'opera'. Microsoft said in a statement that the notification is intended to give people information quickly and easily. In the past also Yahoo and Google to bring people in a similar way to have to adjust their browser or search engine.
The director of a Russian company that develops encryption software has been attacked by a group who are more concerned with attacking NATO, the White House and the German parliament. It claims the Japanese anti-virus company Trend Micro. It would go to a group of Russian spies.
Although several organizations abroad were the target group, there are attacks carried out in Russia. This involves phishing attacks whereby refined manner attempts to steal login details for email accounts. According to Trend Micro, members of the rock band Pussy Riot, politicians, journalists and software developers have been targeted. Besides the director of the company that develops encryption software was also a developer of web mail service Mail.ru attacked.
Phishing
The attacks on the Russian people were part of a larger campaign involving tens of thousands of people were targeted with phishing emails. This relates to users of well-known webmail providers such as Gmail, Yahoo, Hushmail, Outlook and other providers in the Ukraine, Iran, Norway and China. The way the attacks occur varies. Some campaigns use malware and vulnerabilities. The group of attackers have used at least six zero-day vulnerabilities in the past.
In addition, also targeted phishing attacks used to obtain login details. The phishing e-mails claim, for example that a new service is to deliver guaranteed emails. It then attempts to get through OAuth, an open authentication protocol for example, Yahoo offers to app developers to access the user's mailbox. The links in the phishing email while pointing to a legitimate website of Yahoo for OAuth. So users may think that it is a harmless link. What is the goal of the attackers know Trend Micro, but they may try to keep potential threats to Russia in the eye.
Since Internet giant Yahoo late 2013 a reward program for researchers and hackers have started it more than $ 1 million paid to bug reports. In total, Yahoo received during this period 10,000 bug reports, of which 1500 were finally rewarded financially, so let the company know .
Of the more than 1,800 people who took part in the rewards program have delivered about 600 bugs that could be verified. It is a small group bug detectors (6%) which is responsible for 50% of all bug reports. According to Yahoo was the addition of a reputation system to the reward program a big improvement. This gives researchers points for reporting verified bug reports, and the amount of the paid compensation. Through the reputation system, researchers can then compare the program with other participants their skills.
If the newly Chief Security Officer (CSO) of Facebook is going Adobe to stop Flash and also stop all browser developers supporting the popular technology in their browsers. Alex Stamos , which previously held the highest security function at Yahoo is not yet two weeks of the new CSO of Facebook.
Via Twitter , he said that Adobe will announce a date after which Flash is no longer supported. Browser developers such as Mozilla, Microsoft and Google then can a "killbit" record, so the technology after that date no longer work in their browsers. According Stamos is the only way to get all websites and technologies that are Flash dependent apart and at one time to upgrade the entire ecosystem.
The remark Stamos seems to be separate from the recent vulnerabilities found in Adobe Flash Player. He focuses on Flash and web technology. According Stamos select developers and software companies choose not to upgrade to their HTML5 tools and programs, as they expect that Flash will be supported forever. If Adobe provides a date can however be started to reduce dependency on Flash and HTML5 to switch.
Visitors to the emergency patch this week for Adobe Flash Player are not yet installed get urgent advice to do so directly, since cyber criminals are now actively trying to infect computers with malware through the vulnerability.
The vulnerability attackers can take the computer completely. Visiting a hacked or malicious Web site or see getting an infected ads is sufficient. There is no further interaction is required. In announcing the emergency patch let Adobe know that the vulnerability on a limited scale was used in targeted attacks. It is in this case usually attacks against companies and organizations with valuable information.
Exploitkit
Security Researcher JuK of the blog Malware Do not Need Coffee now reports that an exploit that vulnerability uses the Magnitude Exploitkit added. This means that much more Internet users run the risk of being attacked via the leak. There contaminated ads in the past on Yahoo appeared that visitors to the Magnitude Exploitkit sent them. Last month, warned security company Zscaler for infectious ads that were distributed on the Internet in conjunction with the exploitkit.
In the case of Internet users their Flash Player not have up-to-date with the exploitkit come into contact CryptoWall-ransomware is installed on the computer. This ransomware encrypts files on the computer for ransom. Last week, the Magnitude Exploitkit was already in the news because an exploit for another just patched Flash Player flaw had been added to the arsenal. Users who have installed Flash Player belong version 18.0.0.194 to use. This page shows you which version is installed on the computer.
HackerOne, the platform for reporting vulnerabilities in various software projects and applications, during a new round of investment $ 25 million received. HackerOne was in 2013 founded with the help of Facebook and Microsoft. Initially HackerOne focused on rewarding bug reports in popular software projects from which millions of people use. Meanwhile, all kinds of software companies through the website launched a so-called "bug bounty program."
HackerOne fulfills coordination between bug detector and the software in question. Also advises the platform software vendors for their own software via HackerOne want to start a rewards program. The money in the latest round of investment was raised include from Salesforce Chairman and CEO Marc Benioff, Dropbox's CEO and co-founder Drew Houston and Yelp CEO and co-founder Jeremy Stoppelman.
Since the last round of investment HackerOne the number of employees has expanded from 10 to 50. By now, Yahoo !, Twitter, Adobe, Dropbox, LinkedIn, Snap Chat and Airbnb all use the services of the platform. The total number of customers has now passed the 250. These software companies and projects in recent years to more than 1,500 researchers over $ 3.2 million was paid. The money was used to locate nearly 10,000 vulnerabilities and fix. Despite the positive noises made LinkedIn recently announced that it had started a private reward program for a select group of researchers, because programs where everyone can join would create too much noise to. Why chose LinkedIn sure to route payments to researchers via HackerOne.
Amazon did not participate in the PRISM program by the NSA, as the Internet giant has during the presentation of the first transparency report ( pdf ) let you know. PRISM was unveiled in 2013 by whistleblower Edward Snowden. It turned out to be a secret surveillance program of US intelligence that data of at least nine major US Internet companies collected. Amazon, however, was one of the companies not in the NSA slides stated.
In the announcement of the transparency report states that Amazon also regularly goes to subpoenas from the government to appeal customer data. However, it is handed over or information in the majority of cases, as appears from the own figures.From 1 January 2015 to 31 May this year, Amazon received from the US government 813 subpoenas. In 542 cases, all requested information has been submitted and 126 time it was partial information. In 145 cases, no information was ceded.
Amazon also received the American investigators 25 "search warrants", where 13 cases were fully cooperated and in 8 cases partially. Four times they did not even ceded. Besides the US authorities also knocked foreign governments at Amazon. In total there are 132 requests, which was 108 times fully co-operated and 7 part time. 17 times Amazon decided not to provide the information requested. Whether the Dutch authorities have filed requests with Amazon is unknown, since no breakdown by country is made, as in the example transparency reports of Yahoo, Twitter, and Google is the case.
The US government agency that attackers late last year for a second time managed to break in and possibly the data of millions of officials spoils were very likely also sensitive private data stolen by which officials could be extorted.
The Office of Personnel Management runs a system called e-QIP, where federal officials can apply for security clearances. It should be introduced all sorts of very personal information ( pdf ), including financial data. Research now shows that these sensitive data may be stolen. It would be forms that officials must fill highly personal information, such as mental health problems, drug and alcohol use, arrests by police and bankruptcies. Also have names of acquaintances and contacts are being completed, and the social security number.
In a statement allows the White House that researchers have found that with a "very high degree of certainty" the systems for the background checks of current, former and future officers used are compromised and data is stolen, reports the Associated Press . As with the first report of the burglary researchers have no hard evidence that the data are actually captured.
Big tech companies such as Microsoft, Google and Yahoo and American civil rights organizations like the EFF and ACLU have the US Congress a letter ( PDF controlled) which they call to stop the mass surveillance of telephone calls. It involves conversation data collected under section 215 of the Patriot Act. Section 215 allows to store the metadata calls the NSA. On 1 June this year expires this section and thus the authority for the NSA.
Opponents this is a good time to implement reforms. Congress has, however, consistently refused reforms of section 215, with threats to national security are given as a reason. In the letter sent now Congress is called to ensure that any proposal that section 215 adjusts at least put an end to mass surveillance, establishes rules for transparency and no demands on data storage or technology.
"We understand that the government plays an important role in protecting our communities, but we must do so in a manner consistent with our values that. Almost two years after the government surveillance became known, the US government still has work to do to distrust in technology that it has caused to recover, " says Microsoft's Fred Humphries.
Police in the US city of Baltimore has been hit by a computer virus which systems worked slower than normal. IT staff of the police was doing a research on what the inertia of the police systems caused the last few months, when they discovered the virus.
It was a variant of the Qakbot. This malware can data for online banking login credentials for social networks, Hotmail, Gmail, Yahoo !, credit card information, FTP, POP and IMAP logins, certificates and even steal the browsing history. Also can install additional malware Qakbot. Last year there was still a Qakbot botnet discovered from 500,000 computers existed.
How many computers have been infected with the police of Baltimore by the malware is unknown, but according to officials it could involve hundreds of machines, reports the Baltimore Sun . Police believe that the lack of security updates and other security has ensured that the virus could spread. The police do not think that information has been compromised or stolen.Meanwhile, outside help is enabled and started an investigation into the infection.
Yahoo has unveiled a new service allowing users without their password on their account login. Instead of getting the own Yahoo password to remember, users of the new "on-demand" service sent an SMS with a short password, which must be completed.
To use the service, users must first log in using their own password and then register their phone. If the service is enabled, the user gets the next time he wants to login to see no password field, but a button that the password code of four characters is sent to his unit.
"This is the first step in eliminating passwords", said Yahoo CEO Dylan Casey while Southwest festival in Texas know. The process resembles that of two-factor authentication, only without the first factor, the password of the user. The new service is now available for US users, according to Yahoo . When it appears for other users is unknown.
Internal giant Yahoo will later this year, end-to-end encryption to offer to users, which emails are fully encrypted and can only be read by the sender and recipient. It is a plug-in based, and last year was the PGP plugin Google announced .
During the South By Southwest festival in Texas Yahoo gave a demonstration of the plug-in. The images show that users can set the encryption via a few clicks, then encrypted e-mail. According to Alex Stamos, Chief Information Security Officer of Yahoo, was end-to-end encryption until a few years ago, hardly any attention or was it well understood. "Today our users are always better that they should be safe on the Internet."
Stamos suggests that e-mail encryption, a variety of purposes, from tax to the e-mail in a country where there is no freedom of speech. At this time, Yahoo shares the source code with experts so that can give feedback. "Our goal is to provide an intuitive encryption solution for all users at the end of the year," said Stamos.
Google shows a new call to Firefox Users searching on Google.com, but have set a different default search engine in the browser. In late January , the Internet giant was already showing a message, but the message is still apparent. Following the decision of Mozilla not Google but Yahoo to create the default search engine for Firefox Users US.
Thereby Yahoo saw rising share of the US search engine market since cooperation with Mozilla, from 8.7% to 10.7%, although growth in February was already over, as reported research firm StatCounter . A growing number of American Firefox users decided last month Google again to set as default search engine. However, Google now shows the new call, as discovered Twitterers
The NSA wants technology give the secret service access to the encrypted data and communications from customers, but NSA director Mike Rogers does not speak of a "backdoor". According to Rogers, in the fight against terrorism necessary to decrypt encrypted devices.
"The discussion I have seen is mostly about all or nothing, or full encryption or no encryption", as the NSA director said yesterday during a cybersecurity forum in Washington. According to Rogers, it is feasible to establish a legal framework so that there can still gain access to encrypted data. He pointed to the fight against child pornography where technology companies with public authorities and hopes to achieve a similar cooperation in the field of encryption, reports AFP .
Alex Stamos, Chief Security Information Officer Yahoo asked Rogers if he wants technology backdoors add to their products and services. "Backdoor is not the context that I would use. If I use the term" backdoor "Sure, I think it is suspicious. Why would you want through the back door? It would be correct public should be," gave the NSA director reply . "We can develop a legal framework to do this. It's not something that we necessarily have to hide."
Programmers create code and hackers find errors in it and use them. Discovered a hole in the most widespread cryptographic the OpenSSL could potentially lead to data theft almost all Internet users.
Seventh of April came security bulletin CVE-2014-0160, from which it became aware of the continued existence of a critical vulnerability in the cryptographic package OpenSSL.
Found that implementation algorithms TLS and SSL are used today in most versions of OpenSSL properly handle expansion packs Heartbeat (because of what the error was called HeartBleed). This allows hackers to gain remote access to confidential information from RAM active network process outside the buffer.
An error in the system has learned the Finnish-American company Codenomicon, what hastened to inform the world through a special website heartbleed.com. Heart Bleed - is the name given error experts, loosely translated it means "bleeding heart."
Such dramatic name was not chosen randomly. An error was detected in the package heartbeat (heart beat, heart rate) used for fault detection and resource management server cluster. The result was a play on words in the heart of the leak occurred.
Surprisingly, the critical vulnerability did not notice for two years. It affects all versions from 1.0.1 to OpenSSL 1.0.1f inclusive and 1.0.2-beta1.
As a result of that error in them is not checked in the recording of the actual length of SSLv3. This allows you to read without authorization to 64 Kbytes of RAM process on the connected client or server for each request. In many cases this is enough to get the keys, passwords or other sensitive data. Vulnerable versions of OpenSSL cryptographic package from March 2012 are included in many distributions and BSD OS family of almost all branches of the Linux Debian, RedHat and Slackware.
The first error affects servers Apache, nginx, project Tor (via the web server https://www.torproject.org), as well as many websites that use the HTTPS, even if access to them is carried out by VPN.
Unlike all the other "helpers hackers» Heart Bleed intercepts encryption keys - the cornerstone of secure connections, which encrypts the data transmission between servers. By themselves, the captured data is not worth anything, because the same encrypted PIN bank card might look like, «dkgh # k87u». Without the key, which will allow to decipher the code, it's just a set of symbols. But if the key will be in the hands of criminals, then get the raw data for them there is no trouble.
The greatest danger lies in the fact that this hack does not leave absolutely no trace in the case of data theft is not possible to know about this.
It would seem, what's this, because such errors are almost every day. However encryption package OpenSSL - the most widespread in the world. It is used mostly in the Apache web server and nginx. According to research company Netcraft, on these architectures employ about 66% of all sites on the Internet. Thus, only every third site does not represent a potential threat in terms of data theft. Among the endangered sites include such popular services like Twitter, Dropbox, Yahoo!, Steam and others. OpenSSL packages are used to everything else for the operation of e-mail servers and diverse client software.
To determine the degree of risk of error Codenomicon tried to kidnap their own data as it would make professional hackers.
As a result, they managed to make an attack on their own servers, without leaving any traces. Using only a hole in the system, Codenomicon received encryption keys. Using them, experts have collected from servers usernames and passwords, correspondence employees through messengers and email, as well as confidential company records stored on your computer.
Of course, such a dangerous hole could not remain uncovered. As a result, on April 7 was released a new version of OpenSSL, in which the error is no longer present. However, a simple upgrade package is not enough. If criminals have stolen encryption keys, they can use them in the same way as in the previous version, and for security administrators need to get a new security certificates and to generate new keys.
Of course, for large projects should not worry, because the price of their negligence administrators too great. It can be assumed that the relevant work already done on the servers.
In Codenomicon even see the positive side of Heart Bleed: because administrators can not ignore the fact that hole detection, they have to update the system data encryption on their servers. Along with them are likely to be installed, and other updates that have been postponed for a certain period.
While common in the bulletin and news reports officially recommend the following steps:
Install a patched version of OpenSSL 1.0.1g or 1.0.2-beta2 or recompile OpenSSL package with key OPENSSL_NO_HEARTBEATS;
reissue the SSL-certificate;
lures (honeypot), simulating the presence of a vulnerable server package OpenSSL, and check to connect to them.
We recommend that if you do not use in public places WiFi network, then try to put this kind of functionality is temporarily closed. Personal use of computers when not readily allow strangers remote control of their computer to prevent personal information from being stolen. Once the leakage of information to remind consumers to timely remedy, keep relevant evidence, take the initiative to safeguard their rights.
