Your mobile phone can give away your location, even if you tell it not to

US military officials were recently caught off guard by revelations that servicemembers’ digital fitness trackers were storing the locations of their workouts – including at or near military bases and clandestine sites around the world. But this threat is not limited to Fitbits and similar devices. My group’s recent research has shown how mobile phones can also track their users through stores and cities and around the world – even when users turn off their phones’ location-tracking services.

The vulnerability comes from the wide range of sensors phones are equipped with – not just GPS and communications interfaces, but gyroscopes and accelerometers that can tell whether a phone is being held upright or on its side and can measure other movements too. Apps on the phone can use those sensors to perform tasks users aren’t expecting – like following a user’s movements turn by turn along city streets.

BadRabbit' cyber attacks hit airport, metro in Ukraine

The chief of Ukraine's cyber police said Ukraine was attacked on Tuesday by malware called BadRabbit, adding that the country was barely affected.

Earlier the airport in the southern city of Odessa said it had tightened security measures after being hit by a cyber attack, while the metro system in the capital Kiev reported a hack on its payment system.

Asked whether the malware BadRabbit was used in the attacks, Cyber Police Chief Serhiy Demedyuk said by text message "yes, correct".
READ MORE

Trump admin bans government use of software from Russian firm Kaspersky

The Trump administration on Wednesday told US government agencies to remove Kaspersky Lab products from their networks, saying it was concerned the Moscow-based cyber security firm was vulnerable to Kremlin influence and that using its anti-virus software could jeopardise national security.

The decision represents a sharp response to what US intelligence agencies have described as a national security threat posed by Russia in cyberspace, following an election year marred by allegations that Moscow weaponised the internet in an attempt to influence its outcome.

In a statement, Kaspersky Lab rejected the allegations, as it has done repeatedly in recent months, and said its critics were misinterpreting Russian data-sharing laws that only applied to communications services.

"No credible evidence has been presented publicly by anyone or any organisation as the accusations are based on false allegations and inaccurate assumptions," the company said.

The Department of Homeland Security (DHS) issued a directive to federal agencies ordering them to identify Kaspersky products on their information systems within 30 days and begin to discontinue their use within 90 days.

The order applies only to civilian government agencies and not the Pentagon, but U.S. intelligence leaders said earlier this year that Kaspersky was already generally not allowed on military networks.
READ MORE

G20 Summit: Donald Trump, Vladimir Putin discuss Ukraine, Syria, terrorism

US President Donald Trump and his Russian counterpart Vladimir Putin held their first ever and much-anticipated sit-down discussion here on Friday, focussing on the situation in Ukraine and Syria, fight against terrorism and cyber security, on the sidelines of the G20 summit here.

The meeting lasted about 2 hours and 20 minutes, according to Russian news agency Sputnik.

"I had a very lengthy conversation with the President of the United States. There were a lot of issues such as Ukraine, Syria, other problems, some bilateral issues," Putin said at the beginning of his meeting with Japanese Prime Minister Shinzo Abe, Xinhua news agency reported.

"We again returned to the issues of fighting terrorism and cyber security," Putin added.

The Trump-Putin formal meeting came hours after a brief encounter upon arrival at the Hamburg summit, during which they shook hands and exchanged a few words.

Trump began their meeting by saying: "President Putin and I have been discussing various things. And I think it is going very well."

"We look forward to a lot of very positive things happening for Russia, for the United States and for everybody concerned. And it is an honor to be with you," Trump said.

"I'm delighted to meet you personally, and I hope our meeting will bring results," Putin said after shaking hands with Trump.

Following the meeting, Russian Foreign Minister Sergey Lavrov said the Putin-Trump meeting was constructive and confirmed desire to search for mutually-beneficial agreements, according to Sputnik.
READ MORE

Cyberattack hits Ukraine then spreads internationally

Computer systems from Ukraine to the United States were struck on Tuesday in an international cyberattack that was similar to a recent assault that crippled tens of thousands of machines worldwide.

In Kiev, the capital of Ukraine, A.T.M.s stopped working. About 80 miles away, workers were forced to manually monitor radiation at the old Chernobyl nuclear plant when their computers failed. And tech managers at companies around the world — from Maersk, the Danish shipping conglomerate, to Merck, the drug giant in the United States — were scrambling to respond. Even an Australian factory for the chocolate giant Cadbury was affected.

It was unclear who was behind this cyberattack, and the extent of its impact was still hard to gauge Tuesday. It started as an attack on Ukrainian government and business computer systems — an assault that appeared to have been intended to hit the day before a holiday marking the adoption in 1996 of Ukraine’s first Constitution after its break from the Soviet Union. The attack spread from there, causing collateral damage around the world.

The outbreak was the latest and perhaps the most sophisticated in a series of attacks making use of dozens of hacking tools that were stolen from the National Security Agency and leaked online in April by a group called the Shadow Brokers.

Like the WannaCry attacks in May, the latest global hacking took control of computers and demanded digital ransom from their owners to regain access. The new attack used the same National Security Agency hacking tool, Eternal Blue, that was used in the WannaCry episode, as well as two other methods to promote its spread, according to researchers at the computer security company Symantec.

The National Security Agency has not acknowledged its tools were used in WannaCry or other attacks. But computer security specialists are demanding that the agency help the rest of the world defend against the weapons it created.
READ MORE

China censors entertainment news outlets, cites 'socialist values'

Major social media platform operators including Weibo, WeChat, Youku, Baidu and Netease shut down a large number of social media entertainment news outlets after a June 7 meeting with Beijing's Office of Cyberspace Affairs.

The crackdown has been justified under China's newly implemented Cybersecurity Law, which emphasises ideological control as a core component of maintaining state security.

More than 60 outlets have been shuttered in less than a week, some of which are commercial news outlets funded by private capital investments, while others are entertainment sections of newspapers such as “Entertainment weekly of Southern Metropolis”. Other examples include “Care about gossip association”, which has a market value of up to RMB 100 million (approximately US $15 million) and “Movie Lambaste” with a market value of up to RMB 300 millions (approximately US $40 million dollars).

According to a report from state-run Xinhua news, Beijing's Office of Cyberspace Affairs cited China's Cybersecurity Law, enacted on June 1 2017, as impetus for the crackdown. They implored content platform operators to enforce the law:

Individuals and organisations cannot infringe on other people’s reputation, privacy, intellectual properties and other rights using the Internet. Operators should reinforce the management of their users and the distribution of user content. Once [the operators] find that information has violated related laws and administrative rules, they have to stop transmitting the information, eliminate the sources and prevent the information from spreading. The record should be preserved and reported back to the authorities.

China’s Cybersecurity Law went into effect despite deep concerns about the powers that it gives to law enforcement to obtain sensitive information, including encryption keys, from network operators. The law has also triggered major concerns among foreign companies, over its requirement that local data be stored within China.
READ MORE

Banks rush to buy cyber security cover as digital payments rise

Budget 2017: IT, telecom players expect more for cyber security, broadband

Latest News - With the government's push for digitisation across the board, the information & technology and telecom players are expecting a Union Budget that will try to strengthen cyber security and make broadband available to all that will in turn catalyse digital payments.

"As India digitalises rapidly, holistic approach to cyber security is a pre-requisite to foster and sustain trust of all the stakeholders -- consumers, businesses as well as government," said Sanjay Rohatgi, Senior Vice President, Asia Pacific and Japan, Symantec.

"The government should consider setting aside at least eight per cent of its overall IT budget specifically for cyber security starting with the upcoming budget," Rohatgi said.

After the demonetisation in November 2016, the Indian government is trying hard to (Read More)

Job alert: RBI hiring cyber security experts, applications close on Feb 7

Latest News - The Reserve Bank of India (RBI) is strengthening its information technology (IT) and cyber security cell. It is in the process of hiring specialists for the four divisions of its new unit- cyber security, systems audit, research & innovation, project management and administration.

On Wednesday, it offered the jobs through an advertisement on its website. Reserve Bank Information Technology Pvt Ltd (ReBIT) was set up in May last year as a separate subsidiary of the central bank. 

This is the first time a mass hiring drive is being initiated. The final date for applying is February 7.

Headed by Nandkumar Sarvade- a retired officer of the Indian Police Service with expertise on(Read More)