Tor Project Releases Sandboxed Tor Browser 0.0.2

The non-profit organization behind TOR – the largest online anonymity network that allows people to hide their real identity online – has launched an early alpha version of Sandboxed Tor Browser 0.0.2.

Yes, the Tor Project is working on a sandboxed version of the Tor Browser that would isolate the Tor Browser from other processes of the operating system and limit its ability to interact or

Hackers Used New Weapons to Disrupt Major Websites Across U.S.

Crucial sites were difficult to reach to individuals crosswise over wide swaths of the United States on Friday after an organization that oversees vital parts of the web's framework said it was under assault. Programmers unleashed a mind-boggling operation on the internet through some devices like webcams and computerized recorders and slice access to a portion of the world's best-known sites, a staggering rupture of worldwide web dependability. Clients reported sporadic issues achieving a few sites, including The New York Times, Spotify, Twitter, Reddit, Airbnb,Etsy, SoundCloud, and Netflix. The organization, Dyn, whose servers screen and reroute web activity, said it started encountering what security specialists called a dispersed dissent of-administration assault in the early morning.

Reports that numerous locales were blocked off began on the East Coast, however, spread westbound in three waves as the day wore on and into the night. Also, in an upsetting improvement, the assault seems to have depended on a huge number of web associated gadgets without their proprietors' knowledge — with programming that permits programmers to summon them to surge an objective with overpowering activity.

The assaults were not just more regular, they were greater and more advanced. The run of the mill assault dramatically increased in size. Besides, the aggressors were all the while utilizing diverse techniques to assault the organization's servers, making them harder to stop. The most successive targets were organizations that give web foundation administrations like Dyn.

The main cause and working of the gadgets-

Jason Read, the creator of the web execution checking firm CloudHarmony, possessed by Gartner Inc., said his organization followed a half-hour-long interruption early Friday influencing access to numerous destinations from the East Coast. Dyn is a New Hampshire-based supplier of administration for overseeing DNS, which goes about as switchboard associating web activity. Krebs, whose site was focused by a comparative assault in September, said the XiongMai gadgets are basically unfixable and will remain a threat to others unless they are completely expelled from the web.

These gadgets are thusly used to make a botnet, or robot system, to send a large number of messages that thumps the out casualties' PC frameworks. The source code for Mirai was discharged on the purported dull web, locales that work as a kind of online underground for programmers, toward the start of the month.

The assault comes during an era of increased open affectability and worry that the country's establishments and framework could confront huge scale hacking assaults. The latest illustration has been the arrival of messages stolen from the servers of the Democratic National Committee, which the USA knowledge sources say was the work of Russian Federation.

The theme has come up often amid the fall's hard-battled presidential crusade. The US Department of Homeland Security and Federal Bureau of Investigation both were mutually exploring the late blackout. Dyn authorities wouldn't affirm the figure amid a phone call later Friday with correspondents.

It is too soon to figure out who was behind the assaults, however, it is this kind of assault that has US authorities concerned. They are concerned that an assault could keep nationals from submitting votes.

Have hackers turned my printer into an offensive weapon?

It was just last month that is in September one of the largest net attacks took place with pinpointed a renowned OVH a French hosting firm and a blogger. This single attack is believed to have comprised of over one trillion bits of data. Both of the hacking events marked a change in the methods used by hackers who survive by breaking into websites which hold widespread data add this form of attacks is known as Distributed Denial of Service attacks (DDoS). The data was sent to the targets through and other such "smart" devices which were hijacked by the hackers.

Can I tell if my webcam/DVR/printer is attacking someone? 

Well to be honest, not easily. If you are a medium of bombarding someone else, your internet speed may slow down however it may not be noticed at times of normal browsing while it may be evident when it comes to video or music streaming or games which will lag. For those who are tech savvy, they can make use of software’s which keep a tab on the flow of data packs on their home network, however this is not easy if you are unaware of what you are doing exactly.

Could I get in trouble for letting my webcam attack someone? 

In terms of legality, you can’t get into trouble with the police however it is believed through researches that a hacker can get into your internal network through a webcam hack and keep a tab on everything else. So in such a case you have an intruder which is best if gotten rid of by taking the necessary action.

Why are malicious hackers using these devices? 

That’s because it is way easier to hack in comparison to PCs or servers and these devices tend to make use of default passwords and fail to have any kind of security software in place. And to the benefit of the hackers, there are endless numbers that stay on all day long and it is a task to both update as well as secure. In modern days it is extremely easy for hackers, they are able to target vulnerable devices and put together an army of their own to create a botnet without having to rent hijacked machines like in the past.

What kind of devices are they scanning for? 

Web-associated cameras are especially prominent however outputs are likewise being completed for advanced TV recorders, home routers and printers. All these have a fundamental processor inside that can be subverted to pump out attack packets. Brian Krebs, the blogger who experienced an assault an IoT botnet, has ordered a rundown of gadgets known to have misused his webpage with information. Large portions of the login names and passwords for these gadgets are anything but difficult to-crack. On 1 October, source code for one IoT assault was freely shared, driving some to propose that numerous more malignant programmers will now begin checking for vulnerable gadgets. This guide made by security firm Symantec demonstrates where Europe's botnets are facilitated. Turkey is home to the vast majority of the commandeered devices and PCs.

How new are these types of attacks? 

The main DDoS assaults were seen on the web in 2000. The primary influx of information bombardments was gone for betting locales which were undermined with being thumped disconnected unless they paid an expense. The greater part of those coercion endeavors utilized commandeered PCs to send information. Presently the ascent of the Internet of Things that is populated with brilliant gadgets has commenced recharged enthusiasm for these sorts of assaults. Security scientists have cautioned about the perils of unreliable IoT gadgets for quite a while yet they are beginning to be utilized for critical assaults sooner than numerous individuals anticipated.

Hackers Breach the Ultra-Secure Messaging App Telegram in Iran

Telegram Accounts Hacked – Susceptibility of SMS Text Message

According to Reuters, over a dozen Iranian Telegram accounts, like the messaging app having a focus on security have been compromised in the last year due to the susceptibility of an SMS text message.They have recognized around 15 million Iranian users’ phone numbers, which seems to be the biggest known breach of the encrypted communication systems as informed by cyber researchers to Reuters.

 According to independent cyber researcher Collin Anderson and Amnesty International technologist Claudio Guarnieri, studying Iranian hacking groups for three years has informed that the attack which had occurred this year, had not been reported earlier, has endangered the communication of activists, journalist together with several others in sensitive positions in Iran, where Telegram is said to be utilised by around 20 million users.

Telegram tends to endorses itself as an ultra-secure instant messaging system since all the data is encrypted from beginning to end which is known as end-to-end encryption. Various other messaging services comprising of Facebook Inc., WhatsApp state that they have the same proficiencies. Telegram, which is headquartered inBerlin, states that it has 100 million active subscribers and is extensively usedin Middle East, inclusive ofthe Islamic State militant group and in Central and Southeast Asia as well as Latin America.

Authorization Code –Diverted by Phone Company/Shared with Hackers

According to Anderson and Guarnieri, the susceptibility of Telegram is in its use of SMS text messages in activating new devices. When a user tends to log on to Telegram from a new phone, the company directs them with an authorization code through SMS which can be diverted by the phone company and shared with the hackers, according to the researchers.

Equipped with the codes, the hackers can now add new devices to the Telegram account of the user enabling them to read chat histories together with the new messages. Anderson had informed during an interview that they had over a dozen cases where Telegram accounts have been negotiated through ways that sound like fundamentally coordinated with the cellphone company.

According to the researchers, Telegram’s dependence on SMS verification tends to make it defenceless in any country where the cellphone companies are possessed or profoundly influenced by the government.

Iranian Hacking Group – Rocket Kitten

Telegram spokesman stated that customers could defend against these attacks by not relying on the verification of SMS. Telegram enables though it is not essential that customers create passwords which could be reset with the so-called recovery emails.

The spokesman, Markus Ra has informed that if one has a strong Telegram password and the recovery email is secure, the attackers can do nothing about it. The researchers believe that the Iranian hacking group Rocket Kitten is responsible for the Telegram breaches based on resemblances to the setup of past phishing attacks credited to the group.

There is a prevalent rumour that Rocket Kitten tends to have ties to the Iranian government. John Hultquist, managing the cyber espionage intelligence team at the security firm FireEye, of Rocket Kitten has informed that `their focus generally revolves around those with an interest in Iran and defense issues however their action is completely global. With regards to Telegram attacks, it has also been suggested by the researchers that SMS messages could have been conceded by Iranian cell phone companies, which is an industry that has prospective links with the government

How to Stay Anonymous Online

Credit:MIT News

New Privacy Pattern – Strong Security Guarantees

Privacy networks tend to guard individuals living under exploitive regimes from scrutiny of the Internet usage. However from recent discovery of susceptibilities in most of the well-known networks, Tor has urged computer scientists in endeavouring to come up with more secured privacy patterns. In July, at the Privacy Enhancing Technologies Symposium, scientists at MIT’s Computer Science and Artificial Intelligence Laboratory and the Ecole Polytechnique Federal de Lausanne will be presenting a new privacy pattern which would offer strong security guarantees though will use bandwidth more efficiently than its ancestors.

In tests, the systems of the researchers needed only one-tenth as much time just like secure experimental systems in transferring a large file between unidentified users. Albert Kwon, a graduate scholar in electrical engineering and computer science and first author on the new paper, said that the initial use case that they thought of was to do anonymous file-sharing where the receiving end and sending end do not know each other.

The reason was that things like honeypotting, where spies tend to offer services through an anonymity network in order to entrap its users, are a real issue. However they have also studied applications in microblogging, something like Twitter, where one would want to secretly broadcast your messages to everyone.

Heart of System – Sequence of Servers - Mixnet

The system invented by Kwon and his co-authors, his advisor, Srini Devadas, the Edwin Sibley Webster Professor of Electrical Engineering and Computer Science at MIT, David Lazar, a graduate student too in electrical engineering and computer science together with Bryan Ford SM `02 PhD’08, an associate professor of computer and communication sciences at Ecole Polytechnique Federale de Lausanneworks on many prevailing cryptographic techniques though connects them in a novel way.

The heart of the system is a sequence of servers called a mixnet wherein each server tends permutes the order where it receives messages before it is passed on to the next. If messages from Sender Alice, Bob and Carol tend to reach the first server in the order A, B, C that server would send them to the second server in an altered order like C, B, A. The second server would permute them before sending them to the third and so on. The message that had been tracked from the point of origin, by an opponent would not know which was which by the time they had exited from the latest server

The New System – Riffle

It is this reshuffling of the messages which is said to be named – Riffle, for the new system. Similar to several privacy systems, Riffle tends to also use a technique known as onion encryption – Tor, in which case is an abbreviation for `the onion router’.

In the case of onion encryption, the sending computer tends to wrap each message in many films of encryption utilising a public key encryption system such as those that tend to protect most of the online financial transactions. Each of the servers in the mixnet seems to remove only one layer of encryption so that last server only knows the final destination of the message.

To prevent message tampering, Riffle tends to use a system known as verifiable shuffle. Due to the onion encryption, the messages which each server seems to forwards do not look like the one it received, it has peeled off a layer of encryption. However the encryption could be done in a way which the server would generate a mathematical proof which the messages it sends seems valid operations of the ones receiving it.

Core Tor Contributor Leaves Project; Shutting Down Important Tor Nodes

Another blow to the Tor Project: One of the Tor Project's earliest contributors has decided to quit the project and shut down all of the important Tor nodes under his administration.

Lucky Green was part of the Tor Project before the anonymity network was known as TOR. He probably ran one of the first 5 nodes in the TOR network at its inception and managed special nodes inside the anonymity

Hackers Steal Millions of Minecraft Passwords

Minecraft Passwords Stolen by Hackers

Login data of more than seven million members of the Minecraft site Lifeboat has been stolen by hackers. Lifeboat is a service for determined servers and customized multiplayer games for Minecraft Pocket Edition and this data breach tends to affect customers who seem to use the service. If one has used Minecraft Pocket Edition without signing up for Lifeboat, it is ok but if one used Lifeboat, they would possibly get a message compelling them to change the password for the site in early 2015 which was because the company was aware about the hack, though it had not made the information public till recently. Lifeboat permits members to run servers for customised, multiplayer maps for smartphone edition of Minecraft.

There is confirmation that the information that is stolen comprising of email addresses and passwords is provided on site that trade in hacked data. Investigation recommends that passwords were weakly protected and hence attackers could work them out with ease. Evidence regarding the breach had been passed to Tony Hunt, independent security expert, who stated that he had received the list from someone who tends to trade in stolen identifications. Most of the people had informed him that the data had been circulating on dark net sites.

Passwords for Lifeboat Hashed – Little Security

Mr Hunt had mentioned that the data had been stolen in early 2016 though the breach had only been known, now. He said that passwords for Lifeboat accounts were hashed though the procedure utilised provided little security. Hashing is said to be a technique utilised to scramble passwords in order that they are not easily read if the data tends to get stolen or lost. According to Mr Hunt, usually a Google search for hashed password would practically provide it in an accurate plain text and people familiar in cracking tools could possibly computerize and accelerate this procedure.

He further stated that a Google search for a hashed password could quickly return the correct plain text value and well known cracking tools could automate as well as speed up this procedure. He had mentioned in a blogpost regarding the breach that a large percentage of those passwords would be reverted to plain text in a short time. He also informed that this often tends to lead to other security problems since several people re-use passwords and find out one which could lead attackers to compromise accounts on other sites. Lifeboat, in a statement provided to Motherboard, had stated that it had taken action in limiting the damage.

How to Minimise Damage to Users

It informed the news site that when this occurred in early January, they figured the best thing for their players was to quietly force password resets without letting the hackers know they had limited time to act, adding that it now used stronger hashing procedures. It also mentioned that they had not received any reports of anyone being damaged by this. Mr Hunthad been critical of the company for `quietly’ compelling the password re-set stating this policy had left him speechless.

As an alternative, he said that Lifeboat should have done more in alerting users so that they could change passwords rapidly if they used the same one on other sites. He said that the first thing which should be a priority with any company after an incident like this is `How to minimise the damage to the users’.

The Ransomware That Knows Where You Live

Ransomware - Scam Email Quoting People’s Postal Addresses -

As per security researcher, an extensively distributed scam email quoting people’s postal addresses tends to link to a dangerous kind of ransomware. After getting to know of an episode of BBC Radio 4’s You and Yours that discuss about the phishing scam, Andrew Brandt, of US firm Blue Coat had got in touch with BBC. He found that the emails seemed to be linked to ransomware known as Maktub.

The malware tends to encrypt the files of the victims, demanding a ransom to be paid before they can be unlocked. The recipients were told by the phishing emails that they owed hundreds of pounds to UK businesses and that they could print an invoice by clicking a link. However, according to Mr Brandt that leads to malware. One of the said emails had been received by You and Yours reporter, Shari Vahl. Mr Brandt had informed BBC that `it was incredibly fast and by the time the warning message had appeared on the screen, it had already encrypted everything of value on the hard drive, it happened in seconds’. Maktub does not only demand a ransom but it tends to increase the fee which needs to be paid in bitcoin, as time passes.

Addresses Highly Precise

One of the website connected with the malware had explained that during the first three days, the fee is at 1.4 bitcoins or around $580 and rises to 1.9 bitcoins or $799 after the third day. The recipients are told by the phishing emails that they owe money to British business and charities when they do not owe them anything. One of the organisations named was Koestler Trust, a charity that tends to help ex-offenders and prisoners produce artwork.

Chief executive Sally Taylor told You and Yours that they rely on generous members of the public and was very distressed when they discovered that people felt they had received emails from them asking for money when they had not been generated by them at all. A remarkable feature of the scam was that they included not only the victim’s name but the postal address as well. Several of them including the BBC staff had noticed that the addresses were generally highly precise.

Data Derived from Leaked/Stolen Databases

As per cybersecurity expert at the University of London, Dr Steven Murdoch, it is yet not clear how scammers were able to gather people’s addresses and link them to names and emails. The data could have been derived from a number of leaked or stolen databases for instance making it difficult in tracking down the source.

Many of the people had got in touch with You and Yours team to inform that they were concerned that the data could have been taken from their eBay account since their postal addresses had been stored in the same format there as they seemed to appear in the phishing emails.

The firm had mentioned in a statement that eBay tends to work aggressively in protecting customer data and privacy which is their highest priority and they are not aware of any link between this new phishing scam and the data of eBay. In an effort of creating the safest, environment possible for their customers, they tend to constantly update their approach to customer data security.

Why the Government can’t Actually Stop Terrorists from Using Encryption

Encrypted devices at the hand of the governmental agencies seem like a bliss but same is made available for the common public or more importantly lands in the hands of terrorists then world appears to be in danger. U.S. government is currently failing to gain an upper hand in the fight to compel the tech giant Apple and others to give access to their encrypted devices. But having to these encrypted devices and technologies will not be enough to marginalize the wide availability of same technologies to the terrorists and criminal minded individuals.

How the encrypted service or devices turns to be out-of-reach of U.S. government

Most of the encrypted products and services are made by the developers who are from all parts of globe. In simple words most of the encryption projects happens to be open source in nature which brings an amalgamation of great developers from across the globe and it puts them out of government’s reach as well.

An example will help in understanding the limitation of governmental agencies in going after the encrypted services and products. There is a popular instant messaging service based in Germany called Telegram and it offers one of kind encrypted chat functionality. Another encrypted services provider which helps in encrypted voice call and test messages is called Silent Phone which is based in Switzerland. They are simply out of reach of the U.S. government but are easily available for the public and criminal minded individuals alike.

Open source projects are simply driving the ushering of encrypted technologies reach

A research conducted by the Open Technology Institute has revealed that there are about 16 different applications for encrypted communications are being developed outside of US mainly through the open source projects.

U.S. government hands are simply tied as it can’t stop the developers from developed such application outside its borders. However it is enraging a battle against the domestic companies which offers encryption services to its consumers.

Even more number of common users has started making use of strong means and forms of encryption technologies than before for their own reasons. This has made it necessary for the tech companies to bring such encrypted features in their own applications as default in order to reign in consumers from adopting other applications. iPhone has already brought the features of setting up the password by default in order to encrypt the information stored on the device. On other hand Facebook owned Whatsapp is thinking aggressively about bring an encrypted texts and messages features on its instant messaging platform.

U.S. government has finally understood that with continuous availability and emergence of new mode of encrypted communication applications it is not feasible to reign in the availability to the users. But as it is working on other front of reducing the amount of information which is likely to get encrypted by bringing in default encryption features in the popular applications and devices. In other words U.S. battle against encryption is not going to stop the common users and terrorist alike from using the encryption technologies in future.

Chinese Hackers Behind U.S. Ransomware Attacks Security Firms

A group of four security firm investigating the cyber attacks on the U.S. based companies has found that most of the hackers make use of the same tactics and tools which were once associated with the Chinese government supported cyber attacks. Ransomware has become a major tool for unleashing the cyber attacks on the unsuspecting common users. Ransomware as the name suggests simply take over the control of the system and very carefully encrypts all the data stored on the system which leaves it inaccessible to the users. In order to get back the access users are required to a ransom of few Bitcoins.

Hackers tricks users into installing Ransomware

Security firms have stated that hackers use various complex and highly intelligent ways to spread ransomware by actively exploiting the vulnerabilities found in the application servers. Once vulnerability has been compromised hackers tricks users into installing ransomware on their devices. In one of the recent attacks more than 30% of the machines at transportation and a technology firm were infected with the ransomware.

The rise of ransomware over the years

Ransomeware aren’t something new as it has been in wide usage by the cyber criminals over a decade. In the beginning unsuspecting users were lured into downloading infected programs or antivirus suits which when installed happens to overtake the device and requires a ransom of certain amount in order to get back the access.

However in the recent years cyber criminals has got hand at the better encryption techniques which ensures that users wouldn’t be able to get access to their files without paying the ransom. Formatting the devices is a great way to do away with the ransomware but it comes at the cost of losing all the data associated with device. Ransomware payments are mainly made in the virtual currency Bitcoin which offers secrecy from governmental agencies and others.

‘Mind’ game behind ransom

Ransomware happens to be one of the most successful tools of the cyber criminals as a greater percentage of infected users end up in paying the modest ransom amount for their inaccessible data. Cyber criminals usually set a modest price as a ransom in order to give back the access to the users. Most of the victims are willing to pay this amount in order to get back their data and it also results in getting positive response in the online sphere. Assume a victim pays about 1 or 2 Bitcoin which amounts to $600 and he gets back the access to its data and he give a feedback on the online forums that he was relieved to get access to data finally after paying then ransom operators. In short all the other victims searching for this malady online will be more willing to pay on basis of this feedback.

On other hand security firms have warned victims that paying ransom will only end up in making cyber criminals much more ambitious. Very soon they will shift from asking ransoms of few Bitcoins to performing some complicated scams and credit card theft as well.

Spies can steal objects by recording the sound of a 3D printer

Industrial espionage isn’t a new thing rather it has been going for ages since the old age. Over the years the technological advancement has opened up a new frontier for the industrial spies to discreetly spy over the industries secrets without even being there. Researchers have discovered that industrial spies can easily and accurately steal the 3D objects by simply recording the sound produced by the 3D printer when printing such objects.

University of California shows the method of reversing the work done by 3D printer

University of California researchers have shown a simple yet mind blowing method which reverse engineers the 3D design by carefully analyzing the vibrations made a 3D printer. Industrial spies are likely to perform the same trick to get hold of 3D objects by using this very method for their own end.

Shedding more light on this research the director of the UCI’s Adavanced Integrated Cyber Physical Systems Lab, Mohammand Al Faruque, said that industrial spies can even make use of the smartphone to record the vibrations made by the 3D printer to develop their own 3D object.

Researchers had made the use of recording wherein data recorded included things like how a 3D printer parts move and the very same logic can be used recreating the 3D objects with an accuracy of almost 90% which is more than enough to know what is being created.

3D print theft are becoming more commonplace

Over the years 3D print theft signs have been raised throughout the globe but this research will only help in cementing the idea of 3D print theft more convincingly. The losses incurred due to this kind of cybercrime are relatively small or not much known about it at the present.

Another point which doesn’t go positive with the thought of rampant 3D print theft without getting under the radar is that 3D file come heavily encrypted. But some of the system has been developed which can be used to unscramble and remove the encryptions from the 3D files with ease and simplicity. Companies can invest huge amount in securing the printing networks but it is not possible to protect the vibrations and sound made by the 3D printers.

This research turns head of the US agencies

Following the publication of the results of this research some of the US agencies and other researchers had shown active interest in the possible 3D thefts. Al Faruque has stated that the prospects of the 3D printing theft technology can be used in the surveillance and military sector which will help in making the 3D printer networks much more secure and better than before.

Researchers have concluded that 3D printer manufacturers should use some precautionary measures like adding white noises or some other distant and random vibration in order thwart the likelihood of 3D printing theft. Furthermore companies should also term the 3D printing machine zones as the ‘no smartphone’ zone which will help in minimizing the 3D print theft to a great extent.

Your Phone Isn't That Secure It Can Be Hacked With Play-Doh

Chinese Start-up Reveals how to Unlock Apple iPhone with Play-Doh

A Chinese start-up had revealed how it can unlock an Apple iPhone through the fingerprint sensor utilising Play-Doh. Jason Chaikin, President of mobile security firm Vkansee had developed a mould of his fingerprint and then took the modelling clay Play-Doh pressed it on to the mould and created a duplicate. He then touched the Play-Doh on the fingerprint scanner of the iPhone and the device seemed to get unlocked. Chaikin did the demonstration to emphasize the lack of sophistication in the present day biometric solution and not just on iPhones but on the other devices as well.

Apple had not provided any official comments but pointed to the security sections of its website. The website stated that every fingerprint is unique and so it is rare that even a small section of two separate fingerprints are alike enough to register as a match for Touch ID. The possibility of this taking place is 1 in 50,000 for one enrolled finger’.Touch ID only enables five unsuccessful fingerprint match attempts prior to which one must enter the passcode and one cannot progress unless it has been provided.

Patented Fingerprint Sensor beneath Glass of the Phone

Chaikin showed the firm’s patented fingerprint sensor which is placed beneath the glass of a phone. Presently, manufacturers have to cut a hole in the device in order to put the sensor. He informed CNBC at the time of the interview at the Mobile World Congress – MWC in Barcelona recently, that the demand for under glass scanning which is resistant to hacking is the first thing which is heard from the device manufacturers.

The solution of Vkansee picks up third level details on an individual’s finger like the thickness of the ridges on the person’s finger or the pores of the skin. The product also enables fingers to be read when they seem to be wet that is presently an issue with such sensors. According to Chaikin, the issue at the moment is that the biometric seems to be too simple and he had named an example of 2014 wherein a hacker had managed to take a high resolution picture of German Defense Minister Ursula von der Leyen’s finger and engaged in reverse plot in unlocking her phone.

Eye Print another System of Authentication

Manufacturers are observing new biometric systems to validate users as consumers tend to use their mobile devices for various tasks comprising of banking and shopping and the eye print seems to be another system of authentication that can be done by utilising a smartphone’s front facing camera. The company, EyeVerify is one of the companies producing software which tends to recognize minute details in a person’s eye like the blood vessels.

The chief executive of the U.S Company, Toby Rush, had stated that the eyes’ features are stable. He had informed CNBC in a phone interview that they look at micro features just outside the eye and the strongest is the blood vessels in the eye. They tend to be stable and work really well. He added that fingerprints are great and not going anywhere, but fingers and eyes would win the day. Anyone in biometrics would agree that multiple options provide the best security in a strong manner and best user experience.

Hack' on DoJ and DHS downplayed

Data Breach – DoJ/DHS

The US authorities had approved a data breach disturbing the Department of Justice, DoJ as well as the Department of Homeland Security – DHS, though restrained its severity. As per technology news site, Motherboard, the hacker has stated that they would soon share personal information of around 20,000 DoJ employees comprising of staff at the FBI.

It was informed by the news site that it had verified small parts of the breach, but had also observed that some of the details listed seemed to be improper or probably out-dated. The Department of Justice too restrained the significance of the breach. DoJ spokesman, Peter Carr had informed Guardian that `the department has been looking into the unauthorized access of a system which was operated by one of its components comprising of employee contact information and this unauthorized access is under investigation.

However, there is no indication at this time that there is any breach of sensitive personally identifiable information. The department has taken this very seriously and is continuing to arrange protection as well as defensive measure in safeguarding information. Any activity which is determined to be criminal in nature would be referred to law enforcement for investigation’

Hacked Data Posted on Encrypted Website

Hacked data which had been anonymously posted on encrypted website and reviewed by the Guardian comprise of a DHS personnel directory and the information listed included phone numbers together with email addresses. These were for individuals who have not worked for DHS for years. Besides this, some of the listings also had out-dated titles.

The encrypted DHS directory had appeared online prior to 7 pm EDT on Sunday and the password seemed to be `lol’. A source demanding responsibility had informed Motherboard who had revealed the story of the hack, that they had compromised the employee account of DHS and had then used the information from it to convince an FBI phone operator to provide access to the computer system of DoJ.

 The hackers had promised to release the information from the DoJ on Monday. At 4 pm EDT, an identical list had been posted on the same site with a DoJ staff directory which had also appeared to be out-dated. In order to assess the hack, during a government wide-meeting, an official compared it to stealing a years old AT&T phone book after the telecom had digitized most of its data already.

Disruption Regularly in Government Data Security

However, experienced officials state that it should be less simple in obtaining access token by imitating an official from a different department over the phone to a help desk.Things tend to be disrupted regularly in government data security and the OPM hack, exposed in June, revealed the deeply researched security clearance of 21.5m present and former government employees together with contractors from phone numbers to fingerprints.

 But the DHS breach seems to be far less severe and it is especially embarrassing considering that the department has been selected the point of entry for all corporate data shared with government agencies in the debated information sharing program between government and industry developed last year, by the Cybersecurity Information Sharing Act. The program wherein private companies tend to share user information with the government in exchange for immunity from regulation had not been accepted from its start at the DHS, which is left holding the bag in the incident of a breach.

Alejandro Mayorkas, DHS deputy secretary cited troubling provision from the bill to Senator Al Franken in a letter sent in July, wrote that `the authorization to share cyber threat indicators and defensive measures with any other entity or the Federal Government, notwithstanding any other provision of law, could sweep away important privacy protection’