Category Archives: Risk Assessment

Computer, Privacy, Risk Assessment, Security, Software, surveillance, sysadmin, vulnerabilities, Win10, Windows

How to Enable Windows Defender’s Secret Crapware Blocker

Windows 10’s antivirus does a good job overall, but it lets crapware through. A hidden setting intended for organizations will boost Windows Defender’s security, making it block adware, potentially unwanted programs, PUPs, or whatever you want to call this junk.

Source: How to Enable Windows Defender’s Secret Crapware Blocker

amplification, BItTorrent, DDoS, distributed denial of service, DNS, Law & Disorder, NTP, Risk Assessment, Technology Lab

How BitTorrent could let lone DDoS attackers bring down big sites

Some of the most widely used BitTorrent applications, including uTorrent, Mainline, and Vuze are also the most vulnerable to a newly discovered form of denial of service attack that makes it easy for a single person to bring down large sites.

The distributed reflective DoS (DRDoS) attacks exploit weaknesses found in the open BitTorrent protocol, which millions of people rely on to exchange files over the Internet. But it turns out that features found uTorrent, Mainline, and Vuze make them especially suitable for the technique. DRDoS allows a single BitTorrent user with only modest amounts of bandwidth to send malformed requests to other BitTorrent users.

The BitTorrent applications receiving the request, in turn, flood a third-party target with data that’s 50 to 120 times bigger than the original request. Key to making the attack possible is BitTorrent’s use of the user datagram protocol, which provides no mechanism to prevent the falsifying of IP addresses. By replacing the attacker’s IP address in the malicious request with the spoofed address of the target, the attacker causes the data flood to hit victim’s computer.

Read 4 remaining paragraphs | Comments

Gear & Gadgets, Risk Assessment

Parrot drones easily taken down or hijacked, researchers demonstrate

In two separate presentations at Def Con in Las Vegas last weekend, security experts demonstrated vulnerabilities in two consumer drones from Parrot. The simplest of the attacks could make Parrot drones, including the company’s Bebop model, fall from the sky with a keystroke.

In a live demonstration at Def Con’s Internet of Things Village on August 8, Ryan Satterfield of the security consulting firm Planet Zuda demonstrated a takedown of a Parrot A.R.Drone by exploiting the drone’s built-in Wi-Fi and an open telnet port on the drone’s implementation of the  BusyBox real-time operating system. Connecting to the drone gave him root access to the controller, and he was able to kill the processes controlling flight—causing the drone to drop to the ground.

Ryan Satterfield reproduces the Parrot A.R.Drone 2.0 hack he demonstrated at DEF CON.

In a session at DEF CON on August 9, researcher Michael Robinson, a security analyst and adjunct professor at Stevenson University in Maryland and George Mason University in Northern Virginia, dove further into the vulnerabilities of Parrot’s drones, discussing his research on the Bebop drone in a session entitled, “Knocking My Neighbor’s Kid’s Cruddy Drone Offline.” Robinson noted that because of the Parrot’s open Wi-Fi connection, it would allow anyone with the free Parrot app on a mobile device to pair with the drone in-flight. Using a Wi-Fi “de-auth” attack, he was able to disconnect the control app on the operator’s device and take control with the app from another while the operator of the original controlling device attempted to re-establish a Wi-Fi connection. The new pilot could then simply fly the drone wherever he desired. Robinson warned anyone who planned to take over someone else’s Parrot drone that the mobile app left forensic artifacts on mobile devices—including the serial number of the drone.

Read 4 remaining paragraphs | Comments

exploits, Law & Disorder, malvertising, malware, Risk Assessment, Technology Lab, vulnerabilities

My browser visited Weather.com and all I got was this lousy malware (Updated)

Millions of people visiting weather.com, drudgereport.com, wunderground.com, and other popular websites were exposed to attacks that can surreptitiously hijack their computers, thanks to maliciously manipulated ads that exploit vulnerabilities in Adobe Flash and other browsing software, researchers said.

The malvertising campaign worked by inserting malicious code into ads distributed by AdSpirit.de, a network that delivers ads to Drudge, Wunderground, and other third-party websites, according to a post published Thursday by researchers from security firm Malwarebytes. The ads, in turn, exploited security vulnerabilities in widely used browsers and browser plugins that install malware on end-user computers. The criminals behind the campaign previously carried out a similar attack on Yahoo’s ad network, exposing millions more people to the same drive-by attacks.

Update: A few hours after Ars published this article, Malwarebytes updated the blog post to say the campaign had moved to yet another ad network, which happens to be associated with AOL. Visitors to eBay were among those who were exposed to the malicious ads distributed through the newly discovered network.

Read 3 remaining paragraphs | Comments

Ministry of Innovation, Risk Assessment

Report claims Kaspersky faked malware to trip up competitors’ products

Two former employees of Kaspersky Lab have accused the malware protection software company of seeding competitors’ products with fake malware signatures intended to make them erroneously label benign files on customers’ computers as malicious. The allegations, made in a report published by Reuters Friday morning, have been strongly denied by a Kaspersky Lab spokesperson.

According to Reuters, the “junk” files were tailored to have the same signature as legitimate files, based on the fingerprinting mechanisms of competitors’ products. To do this, the two former employees alleged, Kaspersky assigned employees to reverse-engineer competitors’ products to see how they identified malware and then tailored samples that would match the signatures of common, harmless files.

The report does not include many specifics about the alleged faked signatures, such as which files were targeted for identification as false positives.

Read 5 remaining paragraphs | Comments