FTC Releases Alert on Identity Theft

The Federal Trade Commission (FTC) has released an alert about how quickly criminals begin using your personal information once it is posted to a hacker site by an identity thief. FTC researchers found that it can take as few as 9 minutes for crooks to access stolen personal information posted to hacker sites. To prevent identity theft, a user should follow password security best practices, such as multi-factor authentication, which requires a user to simultaneously present multiple pieces of information to verify their identity.

US-CERT encourages users to refer to the FTC alert and the US-CERT Tips on Preventing and Responding to Identity Theft, Choosing and Protecting Passwords, and Supplementing Passwords for more information.


Security Shield Slingers Are Loving Prez Trump’s Cybersecurity Order

US President Donald Trump’s cybersecurity executive order, signed on Thursday after a series of delays, will make federal agency heads accountable for protecting their networks.

On the other side of the fence, computer security product makers have broadly welcomed the policy, which also calls on government and industry to reduce the threat from automated attacks on the internet.

The delayed cybersecurity executive order aims to bolster the government’s information security while protecting the nation’s critical infrastructure from cyberattacks. The order is important because it sets the direction for US infosec policy in government and beyond. Unlike many of President Trump’s other policy initiatives, the order is largely uncontroversial and might (whisper this gently) be seen largely as a continuation of measures former President Barrack Obama was putting into place.

Complete article

IBM Report Details 2017 Tax Scams as IRS Filing Deadline Nears

As the Tax Day 2017 filing deadline of Tuesday April 18 nears, IBM is warning of an increase in tax-related spam and scams.

It’s that time of year again, when Americans rush to file income taxes with the U.S Internal Revenue Service (IRS) and hackers fill inboxes with tax-related spam and phishing email attacks. As the Tax Day 2017 filing deadline of Tuesday April 18 nears, IBM Security is warning of a spike in tax-related spam email and related fraud scams that aim to exploit unsuspecting tax filers.

IBM is out with a new report today titled, ‘Cybercrime Riding Tax Season Tides: Trending Spam and Dark Web Findings’  that details how attackers are ramping up their efforts ahead of Tax Day 2017. According to the report, IBM X-Force security researchers have tracked a 6,000 percent increase in tax-related spam emails from December 2016 to February 2017. A year ago ahead of Tax Day 2016, the IRS issued a warning of its own, about a 400 percent increase in phishing and malware incidents during that year’s tax season.

Sean Michael Kerner

Complete article

Microsoft tool exploit DoubleAgent can turn antivirus software into your worst enemy

Researchers from Israeli zero-day security firm Cybellum have discovered a 15-year-old code injection vulnerability and exploit technique that could allow attackers to maliciously take over antivirus programs and other software by abusing Microsoft’s Windows Application Verifier debugging tool.

The zero-day exploit, dubbed DoubleAgent, only works if the attacked computer has already been previously compromised. Still, the technique can seriously escalate the severity of a previous breach, Cybellum claims, allowing an adversary to further elevate privileges and perform virtually any attack imaginable. Moreover, DoubleAgent continues injecting code even after reboot, allowing actors to establish silent persistence on a machine.

Complete article

‘Sorry, I’ve Forgotten My Decryption Password’ is Contempt of Court, Pal

Claiming you can’t remember your passphrase to unlock data is willful defiance.

The US Third Circuit Court of Appeals today upheld a lower court ruling of contempt against a chap who claimed he couldn’t remember the password to decrypt his computer’s hard drives.

In so doing, the appeals court opted not to address a lower court’s rejection of the defendant’s argument that being forced to reveal his password violated his Fifth Amendment protection against self-incrimination.

In the case under review, the US District Court for the Eastern District of Pennsylvania held the defendant (referred to in court documents as “John Doe” because his case is partially under seal) in contempt of court for willfully disobeying and resisting an order to decrypt external hard drives that had been attached to his Mac Pro computer.

The defendant’s computer, two external hard drives, an iPhone 5S, and an iPhone 6 Plus had been seized as part of a child pornography investigation.

“Doe voluntarily provided the password for the Apple iPhone 5S, but refused to provide the passwords to decrypt the Apple Mac Pro computer or the external hard drives,” the appeals court ruling states. “Despite Doe’s refusal, forensic analysts discovered the password to decrypt the Mac Pro Computer, but could not decrypt the external hard drives.”

Forensic examination of the computer indicated that the device had been used to visit known child exploitation sites and to download thousands of files with the same hash values as known child pornography files.

The files themselves, however, were not present on the computer. They are assumed to be stored on the external hard drives.

Thomas Claburn

Complete article