Obama defends NSA spying system as ‘transparent’

President Obama has dismissed claims that the US is spying on its citizens and said any intelligence gathering done by the security forces is legal and "transparent", while at the same time asking the security services to look at how to declassify aspects of the programme.

In an interview with broadcaster Charlie Rose the president answered several questions on the PRISM scandal that has broken over the past two weeks and he reiterated that the stringent legal processes in place that are required for any data gathering.

“What I can say unequivocally is that if you are a US person, the NSA cannot listen to your telephone calls, and the NSA [National Security Agency] cannot target your emails,” he said. “They cannot and have not, by law and by rule, unless they go to a court, and obtain a warrant, and seek probable cause.”

Obama also said while the collection of bulk data, as gathered from Verizon, could pose a potential privacy issue by allowing authorities to piece data together, such procedures would not take place as that is not authorised within the programme.

“For the government, under the program right now, to do that, it would be illegal. We would not be allowed to do that,” he added.

However, Obama also said he was now looking to make some aspects of the programmes used by the government agencies more open to reassure people that their data is not subject to any abuse.

“What I’ve asked the intelligence community to do is see how much of this we can declassify without further compromising the program,” he said.

“They are in that process of doing so now so that everything that I’m describing to you today – people, the public, newspapers, etcetera – can look at, because frankly, if people are making judgments just based on these slides that have been leaked, they’re not getting the complete story.”

He also said that given the huge growth of big data sets owned by the government and big businesses, he was setting up a committee to oversee how it is gathered and used.

“What I want to do is to set up and structure a national conversation, not only about these two programs, but also the general problem of data, big data sets, because this is not going to be restricted to government entities.”

“I’ve stood up a privacy and civil liberties oversight board, made up of independent citizens including some fierce civil libertarians. I’ll be meeting with them.”

F-Secure releases Blackhole, Cool and Citadel botnet-bashing DeepGuard 5 tool

F-Secure has rolled out its latest DeepGuard 5 behaviour-based analysis technology, promising it will help firms protect themselves from key threats, like the Blackhole and Cool exploit kits.
The Finnish firm said DeepGuard 5 will offer users unprecedented protection by blocking new and emerging threats and intercepting exploits using behaviour data, not the vulnerability they are exploiting like most analysis tools do.
The technology monitors a vast array of areas including the processes of programs that are commonly exploited, such as browsers, plugins, Microsoft Office and Java, as well as programs often used as mules for malware, such as PDF files and Office documents. The tool activates if any of the above checks spot harmful behaviour, blocking any associated activity to avoid infection.

F-Secure security advisor, Sean Sullivan told V3 the tool is the firm's most sophisticated to date. "Basically, we are now monitoring a higher, more generic level. Earlier versions of our behavioral engine monitored how suspicious applications interacted with the OS. Now, DG5 can monitor how known good applications behave – and can determine if they are being exploited," he said
"Take MS Word for example. We didn't monitor that application in the past – hooking directly into it could have made it unstable – and we don't want that. DG5 is able to more generically monitor good applications' behavior for suspicious activity."
Sullivan added that the upgraded approach to analytics is an essential step in the security industry's ongoing battle to counter the recent influx of sophisticated threats targeting industry.
"It's via known good applications that companies are being exploited. So a better behavioural engine is definitely a useful thing to have in your AV. Top-line antivirus technology stopped being about blocking bad guys on a wanted list years ago," he said.
"Blocking malware requires understanding its behaviour. That's why we developed our first version of DeepGuard in 2006. And this newest version is our most powerful learner of bad behaviours yet."
DeepGuard 5's release follows widespread warnings within the security industry that criminals are developing new, sophisticated ways to target businesses. Most recently ex-FBI agent and current Kroll Cyber Investigations managing director Timothy Ryan told V3 that firms need to improve alert systems to deal with the increased threat.

Yahoo reveals 13,000 data requests from snooping spooks

Yahoo has revealed it received between 12,000 and 13,000 requests for customer data from the US government, as it follows the likes of Apple in reporting the data it has had to give to the authorities in the US.
Yahoo chief executive officer Marissa Mayer and general counsel Ron Bell issued a public statement confirming the news, promising the data disclosed was given for legitimate reasons.
"We've worked hard over the years to earn our users' trust and we fight hard to preserve it. To that end, we are disclosing the total number of requests for user data that law enforcement agencies in the US made to us between December 1 2012 and May 31 2013," said the statement.
"During that time period, we received between 12,000 and 13,000 requests, inclusive of criminal, Foreign Intelligence Surveillance Act (Fisa), and other requests. The most common of these requests concerned fraud, homicides, kidnappings, and other criminal investigations."
Mayer and Bell said Yahoo's desire to be more forthcoming about the requests early on was hampered by the laws around Fisa enquiries. "Like all companies, Yahoo cannot lawfully break out Fisa request numbers at this time because those numbers are classified; however, we strongly urge the federal government to reconsider its stance on this issue," read the statement.
"Democracy demands accountability. Recognising the important role that Yahoo can play in ensuring accountability, we will issue later this summer our first global law enforcement transparency report, which will cover the first half of the year. We will refresh this report with current statistics twice a year."
Yahoo is one of many companies revealed to have received an inordinate amount of data requests from US government agencies. Apple was revealed to have received over 5,000 data requests from the US government over a six-month period.
Reports that the US government was hoarding vast sums of customer data from tech companies first broke earlier this month, when leaked documents revealed the National Security Agency (NSA) had been siphoning information from Microsoft, Facebook and Google.

How Cyberwarfare and Drones Have Revolutionized Warfare

Since World War II there have been many advances in military weaponry, communications and technology. In early May 1942, naval forces from Imperial Japan and the allied forces of Australia and the United States fought in the Battle of the Coral Sea. That engagement was the first battle in which naval ships did not shoot upon or even see the opposing force. Aircraft carriers directly engaged one another using aircraft, with their long-distance reach, as their sole offensive weaponry. This new type of warfare, the carrier versus carrier, was an inevitable escalation of the air, radio and radar technology of the day. It was viewed as a revolution in military affairs.
There is a tendency within military circles to call a particular advancement in technology a “revolution.” That was the case when former Defense Secretary Donald Rumsfeld trumpeted technological advances as enabling the United States to wage war in Afghanistan and Iraq without significant numbers of troops. More often than not, an advancement in technology ends up only incrementally changing how war is fought.
But there have been true revolutions in military affairs since the Battle of the Coral Sea, including the development of nuclear and space weapons. And now there is much discussion over two recent advancements in United States military capabilities: cyberwarfare and drones.
We believe the next few decades will be dominated by advancements in software and hardware (cyber and robotics, including drones) just as the last decade was dominated by counterinsurgency. We also believe that historians will look back and see advancements in cyberwarfare and robotics as the first two revolutions in military affairs of the 21st century.
While we were deployed overseas, we saw firsthand the impact of unmanned aerial vehicles, or drones, in a counterinsurgency fight. Drones enabled headquarters to break through the fog of war swiftly, giving commanders greater command and control over the battlefield. At the same time, our ability to undermine the enemy’s communications network was important in the counterinsurgency fight. Often this involved using basic jammers to disrupt insurgents’ abilities to trigger improvised explosive devices using cellphones. While on the lower end of the technological spectrum, those jammers saved lives.
Just as aircraft carriers allowed naval battles to extend their strike distance to the point of aircraft versus aircraft warfare, drones are increasing the strike distance of the military. Nanorobots will further increase the ability to deal precise damage. Drones are often the preferred choice of policymakers because they place no American lives at risk.
Cybertechnology also extends the reach of the military, with the Stuxnet attack on Iran’s nuclear weapons program serving as a prime example. Thanks to the Internet, cyberwarriors can reach immediately not only into the Web-connected world, but also into computers without direct Internet access – all without putting Americans in harm’s way.
But these advances will require policymakers to rethink the economic, political and moral calculus for when and how to deploy robots, or when to commence a cyberattack. Not only do the advanced technologies eliminate the problems with having troops die on foreign soil, but they also greatly decrease the cost of weapons. Weaponized drones are far less expensive than manned jets. Drone costs will continue to fall and their capabilities will continue to increase as robotics technology advances. Why buy the costly F-35 fighter jet when the military can instead buy a fleet of weaponized drones?
Moreover, many people believe that all robots are airborne weapons. But they have long been used by explosive ordnance soldiers when defusing bombs. As robotic technology advances, the Terminator movies might seem less like science fiction.
In the cyberrealm, the big costs – the satellites and fiber cables – have already been paid for. With that infrastructure in place, a few thousand lines of code can now be an effective weapon to inflict disarray and damage. But that also means that securing the network is more important than ever, underscored by the publishing of classified military and diplomatic documents by WikiLeaks and the more recent leaks of National Security Agency records by Edward J. Snowden.
Decreasing costs can be a double-edged sword. Just as I.E.D.s became the highly effective yet inexpensive weapons of choice for insurgents in Iraq and Afghanistan, robots and cyber technology could be the same for adversaries seeking to attack the United States. As costs have declined, these dual-purpose technologies have already become widely available to both state governments and nonstate actors.
This new type of warfare will make it harder to identify the source of an attack using either unmanned vehicles (land, air or sea) or cyber technology. Yet after the intelligence failures in Iraq, it will perhaps be more important than ever for the government to be able to assure its citizens that its intelligence is accurate about the identity of an attacker.
Yet as rapidly as this technology is developing, Americans are just beginning to think hard about the policy implications. Many Americans have begun expressing concerns regarding domestic drone use at home and the potential for lasting foreign policy damage caused by the drone war in Pakistan. And the recent leaks about NSA surveillance programs and the debate over the proposed Cyber Intelligence Sharing and Protection Act, which would make it easier for tech companies to share information about computer security threats with government agencies, seem to have kindled concerns among many Americans that their own privacy is at stake.
These new kinds of warfare seem likely to further empower the executive branch at a time when our nation no longer declares war, potentially making the War Powers Act seem even less constraining and thus more outdated. Ultimately, it seems possible that these major changes will make it easier to wage war because the risks to American servicemen have been minimized. Wars will be fought not only by soldiers with boots on the ground but also by soldiers sitting in front of computer and video monitors. Tomorrow’s future warriors could very much resemble today’s civilian Xbox video gamers.
We are glad to see that the U.S. government is now taking an active role in developing those future warriors with cyber competitions. This is a tactic long used by other countries, like China. However we are concerned about how the government expects to field a large cyber force quickly. Although efforts are underway to train new security and cyber professionals, there is currently an inadequate number of leaders and experienced engineers to expand this force. The government will either have to develop its own experienced officers, or continue to use private contractors – like Mr. Snowden, who worked for one of the N.S.A.’s principal contractors, Booz Allen Hamilton. And filling the ranks will be difficult, too: there is intense competition for experienced engineers in both the cyber and robotics industries.
The future will require a nimble military that will be able to wage full spectrum warfare from counterinsurgency in remote outposts in Afghanistan’s tribal regions to a cyberwarfare campaign possibly initiated in the basement of a state or nonstate actor. Like other major technological changes facing society today, the problem will not be whether or not technology can accomplish a certain feat but whether our nation’s leaders fully understand the moral, social and political consequences of utilizing such technologies.

Belgian police seize huge drug haul as hackers tracked down

Belgian and Dutch authorities investigating computer hacking attacks on shipping companies in the port city of Antwerp have uncovered a massive drug smuggling ring, police said Monday.
Police seized about one tonne of heroin and the same amount of cocaine after being called in by shippers whose computer systems for following container movements had been hacked by drug traffickers.
Several companies at Europe's second biggest port reported hacking attacks last year, with tracking devices put on computer terminals after break-ins or malware installed on them to gain access to information on their hard discs, the Belgian federal police said in a statement.
Being able to identify precisely the location of the containers loaded with drugs arriving in Antwerp port, the traffickers were then able to send drivers to pick them up, they said.
Links were found with criminal elements in neighbouring Holland and the authorities there were contacted.
At the end of May, police seized 250 kilogrammes of cocaine in a container of bananas leaving Antwerp for Holland after the discovery of 114 kilogrammes of the same drug in April in a cargo of wood from Chile which was landed in the Dutch port of Rotterdam.
The Belgian police said a series of raids in both countries followed, rounding up suspects and finding weapons and cash.
Two Belgians believed to be computer specialists were arrested.
At the same time, the authorities stepped up inspections of container traffic in Antwerp, leading to the seizure in late March of 864 kilogrammes of heroin, a record for the port and a major find by international standards, police said.

29 Axis Bank accounts hacked, which includes Mumbai police officers'

 

A total of 29 Axis Bank accounts, including 12 salary accounts of Mumbai police personnel, were hacked in April and May.

Agency reports quoting the police said a sum of Rs 13 lakh was withdrawn through ATMs in Greece from 29 accounts.

Some of the policemen in the city had received SMS messages that cash has been withdrawn from their Axis Bank accounts in euro currency, it said.

An Axis Bank spokesperson said, “A small number (less than 50) of our customers’ accounts have been impacted through transactions at compromised ATMs in Mumbai ‘belonging to multiple banks’.

“We have reversed the impact in all such customers’ accounts with immediate effect to ensure they are not inconvenienced. We are undertaking a full investigation into the incident and are working closely with law enforcement officials in this regard.”

According to Govind Rammurthy, MD and CEO, eScan, there is also a possibility of customers being victims of skimming and / or card cloning. Since all the account holders were from the same bank, it is likely that there exists a rogue skimmer which targets the customers of the bank.

Alternatively, there may also exist a card cloning racket that swipes the cards of the users with the intention of grabbing the card-data, he said.

Police claimed that the debit cards have been cloned and the withdrawal done in Greece. An FIR will be lodged soon in this connection, it is said. 

The Police have also formed a team, led by a DCP, to investigate the episode. The bank too has been asked to look into the details and subsequently submit a report.

Worrying as it is, instances of hacking are a fairly common occurrence, but this particular instance is an indicator of the fact that miscreants are getting bolder with their targets each time.
A report by Akamai Technologies last month found that India stood in eighth place with 2.3 percent of the world’s hacking attack traffic coming from our country during the fourth quarter of last year. India’s share in the hacking space has decreased from 2.5 percent in the Q3 and 3 percent in comparison to the year-ago period.
In a separate instance, figures by Indian Computer Emergency Response Team (CERT-In) in December last year revealed that more than 14,000 websites have been hacked by cyber criminals.

Facebook Pokes Swedish Mayor Before Opening Data Center

 
“Hello Mr. Mayor, this is Facebook,” Karl Petersen heard as he answered his telephone one dark, cold night in northern Sweden in February 2011. “You are the mayor and have to know first -- we are coming to Luleaa.”

That call marked the start of the development of Facebook Inc. (FB)’s first data center outside the U.S. as the world’s biggest social network seeks to accommodate the growing data needs of its more than 1 billion active monthly users. Opened this week in the town of Luleaa, which lies on the same latitude as Fairbanks, Alaska, and has 75,000 inhabitants, the center covers an area equivalent to five soccer fields.
 
With its users generating more than 10 billion messages, 350 million photos and 4.5 billion likes every day, Menlo Park, California-based Facebook needs that space. It also needs electricity, lots of it, and chilly air to cool the facility. In Luleaa, there is an abundance of both.
“We started with the premise that we have more users outside the U.S. than inside and that we wanted something in Europe,” Tom Furlong, Facebook’s director of site operations, said in an interview at the new data center. “We looked across a lot of European countries and some of the key characteristics we are looking for is the climate.”
Luleaa winters are long, dark and cold with temperatures below the freezing point five months of the year and with as little as four hours of daylight during December. That sets the northern Swedish location apart from Facebook’s other data centers in Prineville, Oregon, and Forest City, North Carolina.

Luleaa, situated on the coast of the northernmost part of the Baltic Sea, is also a net exporter of energy thanks to its location by the mouth of a river that generates twice as much power as the Hoover Dam on the Colorado River. This will enable Facebook to run its Luleaa center on hydropower and help the social-media company reach its goal of generating at least 25 percent of its energy from renewable sources by 2015.

Facebook isn’t alone in looking for data-storage space in the Nordic countries. Google Inc. (GOOG), the operator of the world’s most popular Internet search engine, said this month it will buy the entire output of a new wind farm in northern Sweden and use the electricity to power its data center in Hamina, Finland. Iceland, which also has a cool climate and which uses geothermal energy to cover much of its power needs, is also trying to reinvent itself as a data-center hub.
The global market for greener data centers will grow to $45.4 billion by 2016 from $17.1 billion in 2012, according to estimates from Pike Research.
 

‘Node Pole’

Facebook has an option to build two more centers at the Luleaa site. The city is also aiming to attract other companies with data-storage needs through a PR campaign it has branded “The Node Pole,” Mayor Petersen said in an interview. Facebook has employed 50 people in Luleaa so far, most of them locals, he said.
If the U.S. company opens all three centers, it will boost Sweden’s annual electricity consumption by 473 gigawatt hours, according to Kenneth Fors, an environmental engineer at the Norrbotten County administrative board. Such an increase would equal the annual power usage of 16,000 Nordic homes, or 0.3 percent of Sweden’s annual consumption, he said.

‘Project Gold’

While Facebook declined to give exact details on its Luleaa investment, the company said it has spent “hundreds of millions of dollars” on the facility. Swedish construction company NCC AB (NCCB), which built the data center, said its contract was worth 808 million kronor ($123.8 million). The center, which processes requests by Facebook users and stores data like status updates and wall posts, is the most northernly of its kind and the biggest in Europe.
Facebook shares slid 0.8 percent to $23.55 at 9:48 a.m. in New York, giving the company a market value of $56.9 billion.
In Luleaa, Facebook’s plans were code-named “Project Gold” by the municipality and largely kept secret until revealed by Facebook in October 2011, the mayor said.
“You know it’s there, but you don’t hear so much about it,” said David Henriksson Littorin, a 27-year-old who works in a clothing store on Luleaa’s main shopping street, adding he just sold a suit to one of the Facebook employees. “It’s great that Luleaa got this -- it puts Luleaa on the world map.”

Analysts pitch web services and virtualisation for mobile security

Enterprises looking to guard against malware infections should develop a solid set of mobile security policies and practices based on virtualisation and web-based platforms, according to analysts.

Researchers with Gartner said that firms should adopt a solid set of mobile device management (MDM) best practices based on limiting employee use of jailbroken hardware and carefully managing application access and policies.

According to analysts, businesses are being put at a higher risk for malware infections and data breaches by allowing employees to jailbreak their devices, removing restrictions on software installation. While the process allows for the use of third-party software and unauthorised applications, it also removes vital security controls and makes the devices more likely to be infected.

The analysts said that unlike the spread of PC malware, mobile attacks are often smaller in scale and more isolated, preying on reckless user behaviour and at times relying on the physical theft or loss of hardware. Because the mobile security space is driven by a different user approach, analysts argue that firms should also formulate new security plans for the mobile space.

In addition to limiting jailbreak procedures, analysts also recommend that administrators enforce data security policies that protect and isolate important data and limit access to carefully managed 'container' systems. The researchers also recommend that administrators rely on web-based security platforms and services to help limit the exposure of mobile devices and allow for remote wiping of lost and stolen devices.

“At the present time, the biggest risk when using mobile devices will continue to be potential exposure after device loss, and data leakage caused by users, rather than attacks caused by malware,” Gartner said in its report.

“Risk management is all about addressing the most likely risks first, and periodic reports of individual malicious executables have not changed the equation for managing the risks of mobile device use.”

Spammers using web hosts to evade security tools

Spammers are increasingly looking to use web-based services in order to beat the antispam protections in security software, according to research from Virus Bulletin.

The security research and testing firm is reporting that its latest anti-spam study revealed that rather than rely solely on malware-infested PCs and botnets to send spam emails, cybercriminals are taking advantage of web hosting firms to send unsolicited messages.

Overall, researchers have found that the web-based messages were slightly more successful at evading security tools, thus giving the spammers a slightly better chance of getting users to view and follow their spam messages. In a high-volume market such as spam marketing, the higher failure rate can make a big difference for the success of a campaign.

“The report shows that well over one percent of spam sent from web hosts manages to bypass spam filters, compared with less than 0.3 percent for spam sent via other means,” said Virus Bulletin anti-spam test director Martijn Grooten

“Of course, one percent still means the vast majority of messages are blocked, but with spam campaigns easily running to millions of emails, this difference can make or break the campaign for the spammer."

Overall, the report found that anti-spam tools are highly-effective for keeping junk mail out of customer inboxes. Of the products tested in the report, all blocked more than 97 percent of spam messages while maintaining a false positive rate less than 0.25 percent.

Among the top performers in the test were BitDefender and Fortinet. Researchers also noted that LibraEsva, Kaspersky and OnlyMyEmail achieved detection rates above 99 percent while minimising false positive rates.