Hacking and Anonymous surfing

The long-awaited update to the US Federal Financial Institutions Examination Council (FFIEC) guidelines around authentication has been released.

The supplement (pdf) specifically speaks to the widespread scourge of corporate bank account takeovers.

Over the last several years, US organisations have lost hundreds of millions of dollars because their accounts were hijacked by adversaries to steal funds by initiating fraudulent ACH transactions or wire transfers. The guidance directs financial institutions conducting “high-risk transactions” to implement a layered security approach to mitigate the threat.

A penetration tester has exploted a hole in Google Chrome that granted unauthorised access to gmail accounts.

WhiteHat Security researcher Matt Johansen identified the vulnerability in a Chrome OS note-taking application. He disclosed the hole to Google which patched it and gave him US$1000 as part of its Chromium security initiative.

Johansen told Reuters he intercepted data travelling between a Chrome browser extension and the Google cloud.

“I can get at your online banking or your Facebook profile or your email as it is being loaded in the browser,” he said. Google has not yet revealed details of the security hole which Johansen plans to release at the Black Hat conference in Las Vegas this year.

After setting up its own cyber-warfare team, China’s military has now developed its first online war game aimed at improving combat skills and battle awareness, state press said Wednesday.

“Glorious Mission” is a first-person shooter game that sends players on solo or team missions armed with high-tech weapons, the China Daily reported.

Weapons used in the game are part of the actual arsenal of China’s People’s Liberation Army, it added. The final version of the game, which took nearly three years to develop and test, was launched on June 20.

“I think it is possible the game will be made open online for Chinese military fans to download and play,” an unnamed PLA press officer was quoted as saying.

It took only three months for the TDL rootkit – also known as Tidserv, TDSS and Alureon – to add over 4,5 million infected computers to the developers’ botnet, say Kaspersky Lab researchers.

Back in 2010, its authors have surprised researchers by selling the source code for the TDL3 version, but now they know that this move has been the result of the creation of the next variant – TDL4. TDL4 was different enough from the previous one and improved in such a way that the developers believed that the sold variant wouldn’t be able to compete with it.

And they were right. The improvements were considerable. The new version still spreads via affiliates, and the malware is often found on booby-trapped sites with adult content and pirated material, as well as sites for image or video storing. It installs itself by taking advantage of known vulnerabilities, but that’s about the only thing that remained the same.

Despite countless WikiLeaks copycats popping up since the secret-spilling site first dumped its cache of State Department cables last year, the new generation of leaking sites has produced few WikiLeaks-sized scoops. So instead of waiting for insider whistleblowers, the hacker movement Anonymous hopes that a few outside intruders might start the leaks flowing.

Earlier this week members of the hacker collective, and specifically a sub-group known as the People’s Liberation Front, (PLF) launched two new leaking sites, LocalLeaks.tk (not to be confused with the similarly named Localeaks.com) and HackerLeaks.tk. Both hope to receive documents through anonymous submission systems, analyze them, and then distribute them to the press to get “maximum exposure and political impact.”

Cleveland Police suffered a major outage after its computer systems were infected by the Conficker worm in February, ZDNet UK has learnt.

The North of England police force’s main systems had to be taken offline for three days after becoming infected, Cleveland Police told ZDNet UK in response to a Freedom of Information request. “[An] infected CD containing evidential CCTV footage [was] loaded into a standalone PC, which was inadvertently joined to the network briefly for routine maintenance,” Cleveland Police said.

A Cleveland Police spokeswoman told ZDNet on Wednesday that the infection was from a Conficker variant. Conficker is a pernicious network worm that targets flaws in Microsoft software and can spread via a number of methods, including infected USB drives and dictionary attacks on passwords over a network.

A popular Twitter-like service in China with 140 million users was hit by a worm earlier this week that resembles past attacks that infected Twitter and MySpace, according to a security analyst.

Sina Weibo, a microblog service in China, said the worm first appeared on Tuesday night. Affected posts displayed a malicious link with enticing messages like “Move a woman’s heart with 100 lines of poetry” or “Software to listen to other people’s phones.” When the link was clicked, the user’s own account would repost and send out private messages circulating the malicious link again.

Sina reported in a post to users on Wednesday that the worm had been stopped on the same night at 9:25 p.m. The problem stemmed from a flaw in the web pages that the worm could exploit.

Chinese police have arrested 36 suspects for allegedly operating scams that netted $6.6 million from customers from customers of e-commerce platform Alibaba.com and other sites.

The arrests were made in the Chinese city of Putian in April, but were only disclosed on Wednesday at a news conference held by Alibaba and Hangzhou’s public security bureau.

The arrested suspects operated by pretending to be legitimate suppliers on Alibaba.com, a business-to-business platform that helps connect Asian manufacturers with global buyers. The alleged scammers would receive payments for orders, without shipping the goods, according to Alibaba spokeswoman Jasper Chan. At other times, the suspects would ship goods of lower quality than was advertised.

Spam levels have dropped massively in recent months, though researchers fear this is simply because botnet operators have switched their attention to more lucrative activities.

Junk mail volumes – which reached 90 per cent last summer – are down to 75 per cent this summer, net security firm Symantec reports.

A teenage burglar has been ordered to hand over his beloved games console as part of his bail conditions.

The 13-year-old boy, who can’t be named because of his age, was charged with a series of burglaries in County Down, Northern Ireland, and found himself up before the beak in a Belfast High Court, according to RTE News.

Although the boy has yet to be convicted, the judge asked him what was his most valued possession. Not the brightest button in the box, the teenage toe-rag admitted that he was rather attached to his Xbox which the judge promptly ordered to be confiscated until the case was over. The judge said he thought deprived of the gadget would teach the wayward youth a lesson in how it felt having things he valued taken away from him.