Article
Issue No. 1 | January 2014
Monthly newsletter
10 January
RF Cybersecurity Strategy Concept
On 29 November 2013, the Russian Federation Council held parliamentary hearings on the draft concept of a national cybersecurity strategy. Recognising the pressing nature of cyber threats on national, organisational and personal levels, participants proposed an online discussion of the draft.
27 January
Transactions in virtual currencies such as Bitcoin
According to the Bank of Russia, there has been a rise in transactions that use virtual currency such as Bitcoin. Virtual currencies are neither backed nor are they a legally binding contract. Transactions in virtual currencies are speculative in nature and carried out as so-called virtual stock exchanges, involving rather high devaluation risks.
30 January
Bank of Russia to come up with recommendations on monitoring social network content
As part of its standardisation efforts based on Technical Committee 122, the Bank of Russia is working on draft recommendations to monitor social network content related to financial institutions," said Artyom Sychov, deputy head of the bank’s Central Administration for Information Security and Protection, at Infoforum, a Russian information security forum.
Legislative news and regulatory recommendations
22 January
Spying LG Smart TVs: The end of the Story
An article published by Habrahabra.ru on 19 November 2013 told the world about how advanced TV sets can secretly collect and send certain information about TV users. The article immediately triggered several reposts that were then followed by heated debates in user comments both on Habrahabra.ru and the reposting websites.
It made me curious about how regulatory authorities would respond to this situation and whether they would take the consumers' side. So, I went to the website of the Federal Antimonopoly Service for Stavropol and filed an application summarising the case and attaching a link to the article. The response from the FAS came in about several weeks.
9 January
Protecting children from harmful information
When I saw that the post on protecting children from harmful information had attracted a lot of attention, I decided to take a deeper look into it. I was curious better understand current thinking on why children should be protected from information in the first place and, if so, what protective measures have been implemented in other countries and what more could be done.
Secure yourself/ Be on the alert
Finance sector
9 January
Ukrainian hacker who stole $9 million from bank accounts identified
According to news published on its official website, the Ukrainian Security Service has identified a person in Kiev who was allegedly involved in a hacker attack that resulted in $9 million being stolen from the bank accounts of foreign and Ukrainian customers.
10 January
Moscow police suspects in bank card theft
Moscow police have arrested two people involved in an organised group, accusing them of using skimming devices to steal money from bank cards, according to a report from the press service for the Internal Affairs Division for the southwestern district of Moscow. On 4 January alone, the group stole 4.5 million rubles from a self-employed entrepreneur’s bank account. A criminal case has been opened into the theft under Article 150 (Stealing) of the Russian Criminal Code.
13 January
More than 70 million rubles stolen from individual bank accounts
Police have disrupted an organised gang accused of stealing money from deposit accounts with Russian banks. According to the press service of the Central Criminal Investigation Department of the Russian Ministry of Internal Affairs, the losses are estimated at more than 70 million rubles. Four people involved in the group, active in the Moscow region and St. Petersburg, have been arrested. The suspects have been detained and a criminal investigation has been launched into the fraud.
13 January
Sberbank: bank cards double-charged due to error by acquiring bank
Sberbank cards were double-charged last week as a result of an incorrect file being sent from a third-party acquiring bank to Sberbank, one of Russia’s largest lending institutions, Sberbank’s press service told Banki.ru.
14 January
Natalia Burykina, the chairman of the State Duma Committee for Financial Markets, and Alexey Mitrofanov, chairman of the State Duma Committee for Information Policy, have prepared a draft law to help prevent distribution of misleading information about banks. According to Vedomosti, state Duma deputies have proposed blocking websites that contain misleading information about banks, the banking system and public entities - namely lenders, insurers, and other entities operating in the securities market and subject to financial reporting requirements.
15 January
Man from Chelyabnisk returns 10 billion rubles mistakenly credited to account by Alfa Bank
Alfa Bank mistakenly credited 10 billion rubles to the account of Timur Fatkullin, a citizen of Chelyabinsk, ZNKAK.com reported .
21 January
South Korean programmer steals banking data from 20million fellow citizens
According to a report from the BBC, a programmer in South Korea stole credit card and social insurance data from 20 million South Koreans – 40 percent of the country’s population.
26 January
U.S. sees new large credit card data leak
Following the hacking scandal around Target, Neiman Marcus, another network retailer, confirmed a credit card data theft that occurred in mid-December last year. The theft targeted POS payments, but did not affect the retailer’s online customers of the retailer. As reported today, Michaels, another large network retailer, has launched an investigation into credit card data theft. Banking security services have already recorded hundreds of fraud attempts to access the credit card data stolen from Michaels.
31 January
Hackers get data on 49,000 bank cards in 11 countries
As reported by Reuters, hackers obtained data from 49,000 customer bank cards from small-size retailers in 11 countries.
Internet and telecommunications
2 January
A Syrian cyber-army launched an attack on Skype's blog and Twitter account, telling people not to use Microsoft email services such as Outlook and Hotmail and claiming "they are monitoring your accounts and selling it to the U.S. government." There is no information yet on whether the criminals got access to user data or other Skype services. By the time of this report, the hackers' messages had been removed from the blog. However, Skype still has no control over its Twitter account, where the messages still remain.
3 January
Snapchat: user data leak confirmed, but no apologies offered
Snapchat sees the recent leak of user names and telephone numbers of 4.6 million of its users as an "abuse" of the API service. However, TechCrunch reported, the company has actually admitted that its approach to storing data made it possible to match user names to telephone numbers.
Snapchat says it will fix its applications and service to prevent future leaks. In particular, it will add an option enabling users to opt out of the friend search function based on telephone numbers.
10 January
Openly examining public website vulnerabilities
About a month ago Joshua Rogers, a 16-year old student from Australia, got the idea to test for vulnerabilities in the Public Transport Victoria (PTV) website (ptv.vic.gov.au), Melbourne's official authority responsible for all public transport. While it is not quite clear what the youngster used as his testing tool, some believe that the device was simply a vulnerability scanner downloaded from the Internet that was designed specifically for a certain URL.
12 January
On 11 January 2014, many Dropbox users started to get error messages from the service, which returned a 500 code error when they tried to perform various actions. Customers also encountered service failures when using the iOS application with Dropbox's API.
13 January
Computer virus disrupts photo and video control systems in Moscow region
A virus knocked out over 100 photo and video systems in the Moscow region, Gazeta.ru reported.
17 January
U.S. Congressmen turn to Bruce Schneier for NSA secrets
On January 16, Bruce Schneier, one of the leading experts in information security, participated in an hour-long discussion with six U.S. Congressmen after the lawmakers sought him out for information about the NSA's activities - something they have been unable to obtain from official sources. While the National Security Agency (NSA) is tight-lipped about its activities, even when it comes to requests from the U.S. Congress, Schneier is a prominent expert on cybersecurity and one of the few people with access to Edward Snowden's database.
28 January
U.S. arrests man allegedly behind SpyEye
According to a report from krebsonsecurity, federal authorities in Atlanta will soon make an official announcement about the arrest of and charges against Alexander Panin, a Russian citizen from Tver. Panin, allegedly also known as Gribodemon, is said to be among those behind SpyEye, one of the most harmful Trojan banking malwares.
Industry and services
20 January
Last update on Target hacking story
It’s been several weeks since the story about a large-scale hacker attack on retailer Target. Hackers installed a malicious code on computers connected with POS credit card terminals, resulting in data from 50 million users being compromised. It became known later on that the hackers got access to confidential information such as the e-mails and telephone contacts of Target's customers and employees.
21 January
Russian Consumer Rights Protection Association urges Russians to start a boycott on eBay and PayPal
The Russian Consumer Rights Protection Association reports that it has joined the protest against limiting free e-commerce, urging Russians to begin a boycott on those lobbying this initiative.
Articles
3 January
NSA working on a quantum computer to break any cryptographic algorithms – still far from success
According to a document reported by The Washington Post, the NSA is financing a project to build a new quantum computer that can crack any cypher existing today. There are still no signs that the NSA has been progressing faster than other researchers working in the field.
The document, unveiled by Edward Snowden, discusses the NSA's research program Penetrating Hard Target, which has a budget of $79.7 million. One of the program’s objectives is to build a quantum computer that could be used for codebreaking. According to the document, the research is largely based at a physics lab at Maryland University, however, it does not provide any information about the status of the project.
8 January
The U.S. Defense Advanced Research Projects Agency (DARPA) is working on an interesting project to design electronic components capable of physically disappearing when sent an externally-initiated command. The project is not just a pure flight of imagination: DAPRA has already transferred $4.7 million to SRI, a nonprofit independent researcher, for the initiative, on which it’s collaborating along with Honeywell, an electronics producer.
15 January
Blackphone becomes first-ever smartphone protected from wiretapping
Silent Circle, an encrypted communications firm, has designed a new smartphone in collaboration with Geeksphone that comes with an integrated cryptographic module which provides encrypted protection for voice data, text messages, video chats and files when stored or exchanged. The device, called Blackphone, is the first of its kind.
Blackphone runs PrivateOS, a privacy-oriented fork of Android. The cell phone will not be tied to any particular carrier or producer.
20 January
Botnet of smart TV sets, media centers, a PC and a fridge detected...
Habrahabra often tells its users about smart houses, Internet devices, etc. With an ever-increasing number of new devices capable of communicating with each other and connecting to the Internet, it’s quite possible that we will see houses getting smarter about several years from now. It’s exciting to have a fridge that knows whether you’re short on any food items and automatically places an order within a budget allocated by its owner.
21 January
2013 trend in malware threats reinforced
Each year global threats increase in number and activity, with new malware programs, modifications of the old ones, and other similar hacking tools emerging every day. The last year has just reinforced a continuing major trend defining two basic types of malware. The first type is programs that are used by hackers for personal gain. The second is malware for watering-hole attacks designed to compromise a particular company, industry or geographic region.
24 January
Progress in deciphering Voynich Manuscript
The Voynich Manuscript, a famously mysterious hand-written codex known to almost any cryptography enthusiast, has started to yield its secrets to the world.
24 January
Win32/Boaxxe.BE as a click fraud tool
This analysis is a discussion of an interesting malware species — Win32/Boaxxe.BE, which employs various click frauds designed to channel traffic to advertising websites, allowing hackers to obtain per-click payments from an advertiser. The first part discusses the infrastructure of the partner network that is used to distribute the malware, while the second part addresses technical aspects of this malicious code.
29 January
Cryptographic analysis competition for hash-function GOST R 34.11-2012
At the end of 2013, the Technical Committee for Standardisation "Cryptography and Security Mechanisms" (TC 26), the Russian Cryptography Academy and OAO Infotecs, announced a competition to analyze the cryptographic properties of a hash-function algorithm based on GOST R 34.11-2012. Please visit www.streebog.info for details about the competition. This contest shows that existing research results for this cryptographic standard, which provide a springboard for further research into the algorithm covered by GOST R 34.11-2012, have attracted heightened attention from cryptoanalysts.
Cybersecurity technology updates
January 24
Register for licenses for technical protection of confidential information
This register contains information about the activities of government bodies and local administration entities. It is published online as arrayed data and is formatted to enable automatic data processing for further reuse without the need for any preliminary manual modification (i.e. machine-readable form). This data is available for free.
To be added to bookmarks
January 05
VSAT terminals are opened for targeted cyber attacks (CIO.com)
Security researchers from IntelCrawler, a Los-Angeles based cyber intelligence company, announced that very-small-aperture terminal (VSAT) used for satellite communications are exposed to external cyber attacks, especially, on distributed critical infrastructures and network environments.
January 26
Spear Phishing attack was used in CNN Blogs hack
Some of CNN's social media accounts and blogs were compromised Thursday. The affected accounts included CNN's main Facebook account, CNN Politics' Facebook account and the Twitter pages for CNN and CNN's Security Clearance. Blogs for Political Ticker, The Lead, Security Clearance, The Situation Room and Crossfire were also hacked.
January 17
The massive data breach at Target during the 2013 holiday shopping season which the retailer now admits affected 70 million customers used an inexpensive "off the shelf" malware known as BlackPOS. The same malware may have also been involved in the Neiman Marcus attack.