France looking at banning Tor, blocking public Wi-Fi

Leaked docs from Ministry of Interior show worryingly illiberal trend for France.

According to leaked documents France's Ministry of Interior is considering two new proposals: a ban on free and shared Wi-Fi connections during a state of emergency, and measures to block Tor being used inside France.

The documents were seen by the French newspaper Le Monde. According to the paper, new bills could be presented to parliament as soon as January 2016. These proposals are presumably in response to the attacks in Paris last month where 130 people were murdered.

The first proposal, according to Le Monde, would forbid free and shared Wi-Fi during a state of emergency. The new measure is justified by way of a police opinion, saying that it's tough to track people who use public hotspots.

The second proposal is a little more gnarly: the Ministry of Interior is looking at blocking and/or forbidding the use of Tor completely. Blocking people from using Tor within France is technologically quite complex, but the French government could definitely make it difficult for the average user to find and connect to the Tor network. If the French government needs some help in getting their blockade set up, they could always talk to the only other country in the world known to successfully block Tor: China, with its Great Firewall.

Forbidding the use of Tor through legislative means is another option: France could simply make it illegal for people to access Tor. The difficulty there, though, is in the policing of that new law: the country's ISPs would have to snoop on its users to find out who is using Tor, and then report back to the police. In the UK, where the new Snooper's Charter may require ISPs to log the last 12 months of user activity, a lot of resistance is being met.

The main problem with such a ban on Tor is that it wouldn't achieve a whole lot. Would-be terrorists could still access Tor from outside the country, and if they manage to access Tor from within France I doubt they're concerned about being arrested for illegal use of the network. There is evidence to suggest that the recent Paris attacks were planned via unencrypted channels, too: the Bataclan "go" message was sent in the clear via SMS.

On the other hand, criminalising and/or blocking Tor might affect many other legitimate users of the network, such as whistleblowers, journalists, and anyone else who wants to surf the Web privately.

The proposal to block Wi-Fi hotspots during a state of emergency is slightly more feasible, and you can see where the French government is coming from—but again, it would be technologically very difficult to implement, and the collateral damage would be huge. Millions of people would have to go without public Wi-Fi access, potentially for weeks at a time.

On November 20, a week after the attacks in Paris, France introduced new legislation that extended the current state of emergency to three months. At the same time, new laws were also introduced to make it easier for the Minister of the Interior to block any terrorism-related website, and to dramatically increase police powers for searching seized devices. The French prime minister suggested that they may soon make it illegal to merely visit a terrorism-related website, too.

Come January 2016 we'll see if the French government actually goes ahead with these new Tor and Wi-Fi blocking measures. Hopefully cooler heads will prevail: France is one of the most powerful and influential Western democracies, but it's also rapidly becoming one of the most illiberal. If France rolls out its own Great Firewall, it would then be whole lot easier for the UK, Germany, and other neighbouring countries to do the same thing.

Five security must-dos for first time cloud users

What do Apple, Amazon and Microsoft have in common?

The answer: All three technology giants, considered the gold standard among cloud computing providers, have suffered the ignominy of being breached by hackers.

Apple’s “celebgate” incident exposed personal photos of its celebrity iCloud users and made unwelcome news headlines last year. UK technology provider Code Spaces was forced out of business last year after hackers tried to blackmail it and subsequently deleted crucial data from its Amazon Web Services-hosted cloud storage. In 2013, an expired SSL certificate in Microsoft's Azure cloud service gave hackers the chance to bring down the Xbox Live and a raft of other cloud-hosted services.

Cloud security risks are rising, with attacks growing at 45% year-on-year globally, according to cloud security firm Alert Logic. In the next five years, US$2 billion will be spent by enterprises to shore up their cloud defences, according to Forrester Research.

First time cloud users can be most at risk, simply because of unfamiliarity with the new environment and the added burden of having to grapple with a new way of managing users, data and security.

Here are five security must-do’s before taking the plunge.

1. Know the cloudy areas
There are three main segments in any cloud deployment - the cloud vendor, network service provider and enterprise. Given that the cloud should be treated like an extension of the enterprise data centre, the question to ask is therefore: can a common set of security services and policies be applied across the three segments? What are the security gaps?

During vendor selection, ask the cloud vendor what security services it provides and which security vendors it works with. The cloud is a dynamic environment and requires regular updates to the security architecture to stay up with the latest threats. How does the cloud vendor guard against new security exploits and zero-day vulnerabilities?

Also find out where the boundaries are in the shared security models that come with the cloud service. Understand the extent of your cloud provider’s responsibilities - and your own. In some cloud services, such as IaaS, it is the responsibility of the enterprise to secure its applications and data in the cloud. It is therefore important to know what security appliances and vendors the cloud provider offers/allows the enterprise to deploy in the cloud to do just that.

2. New apps, new fortifications
Ready to move an application into the cloud? Before you do, consider adding new fortifications to the existing security measures you have built around your application’s authentication and log-in processes.

To fortify the access to your cloud application, you should have a granular data access scheme. You can do so by tying access privileges to roles, company positions and projects.  This will add an additional layer of protection when attackers steal your staff’s login credentials.

Account hijacking may sound basic but this age old breach has been flagged by Cloud Security Alliance as a continuing top threat for cloud users. To fortify your login process, consider implementing two-factor authentication, posture checking and the use of one-time passwords. A good tip is requiring user IDs to be changed at initial logins.

3. Embrace encryption
Data encryption is one of your biggest security ally in the cloud, and it should be non-negotiable when it comes to file transfers and emails. While it may not prevent hacking attempts or data theft, it can protect your business and save an organization from incurring hefty regulatory fines when the dreaded event happens.

Ask your cloud vendor about their data encryption schemes. Find out how it encrypts data that is at rest, in use, and on the move. To understand what data should be encrypted, it helps to get a handle of where they reside - whether in your cloud vendor’s servers, the servers of third-party companies, employee laptops, office PCs or USB drives.

4. Wrestling with the virtual
Moving into the cloud lets businesses reap the benefits of virtualization, but a virtualized environment can present challenges to data protection. The main issue has to do with managing the security and traffic in the realm of multi-tenancy and virtual machines.

Physical security appliances are typically not designed to handle the data that is in the cloud. This is where virtual security appliances come in - to secure traffic as it flows from virtual machine to virtual machine. Such appliances are built to handle the complexities of running multiple instances of applications, or multi-tenancy.

They therefore let businesses exert fine security control over their data in the cloud. Ask your cloud provider how it safeguards its virtual environment and find out what virtual security appliances it is using. If you are building your own private or hybrid cloud, consider getting virtual security products that focus on granular control.

5. Don’t be in the dark about shadow IT
There is no shortage of anecdotes and reports out there that point to how the unauthorised use of applications and cloud services, or shadow IT, is on the rise among businesses. The uncontrolled nature of this poses a security threat and governance challenge.

Your new cloud application will be at risk because of this. Consider the simple scenario in which your employees use their smartphones to open a file on their device. It is likely that the phone will make a copy of the file, which could then be sent to an unapproved online storage destination when the phone does its routine automatic backup. Your secure corporate data has just been moved to an insecure location.

Preventing access to shadow IT is unlikely to stop its growth in any given organization. It is more effective to educate your users and use technology to manage the issue. Encryption, network monitoring and security management tools can help defend your first cloud app against the risks of the shadow IT.

Symantec doubles APAC presence with new SOC in Singapore

Symantec Corp. has announced plans to beef up its Cyber Security Services business globally with an investment of more than US$50 million. A portion of this investment has been leveraged to build a new dedicated Security Operations Center (SOC) in Singapore, inaugurated yesterday, doubling Symantec’s Cyber Security Service expertise in the Asia-Pacific region.

Now more than ever, organizations require a deeper security understanding and strong proactive security measures to gain the upper hand on adversaries. Symantec’s SOCs analyze 30 billion logs worldwide each day to provide enterprise-wide protection to help organizations strengthen their defenses and respond to new threats as they emerge 24 hours a day, 7 days a week, 365 days a year.

With the launch of the SOC in Singapore, businesses will have access to intelligence, accurate threat detection and proactive notification of emerging threats to ensure their most sensitive data is protected. The new SOC will also enable businesses to shorten the time between detection and response, reduce operational costs and proactively counter emerging threats.

“Today, technology alone may not stop advanced threats. Organizations need security experts on hand to interpret and prioritize the critical events that need action. By investing in people and security IQ in Singapore and the Asia-Pacific, Symantec is expanding its visibility into the region, enabling us to bolster customers’ security operations capabilities, and protect their critical information and assets,” said Samir Kapuria, SVP and general manager of Cyber Security Services at Symantec.

“The Asia-Pacific region is incredibly diverse and multi-cultural. This allows us to attract highly educated multi lingual security professionals who bring expertise and experience from many vertical industries and global security organizations and are well-versed in the security landscape,” added Kapuria.

Last year Symantec’s team of cyber professionals protected organizations from more than half a million web attacks per day, according to the 2015 Internet Security Threat Report.

The investment will enable the company to expand its Chennai, India SOC as well as the Tokyo, Japan SOC. The next phase of the company’s SOC expansion will take place in Europe, with more facilities expected to open within the next 12 months. Once complete, Symantec will have eight SOCs worldwide, extending their current team of 500+ certified cybersecurity professionals to address every stage of the cyber-attack lifecycle.

Symantec has also invested significantly in its cyber services-enabling technology, including big data analytics and distributed computing. With an increasing demand to manage customers’ security environments with Security as a Service, Symantec Cyber Security Services offers a strong portfolio, including Managed Security Services, DeepSight Intelligence, Incident Response and Security Simulation training.

This announcement follows a US$20 million investment in existing SOCs across Australia, India and Japan in the past year.

Dell's Laptops are Infected with 'Superfish-Like' pre-installed Malware

Similar to the Superfish malware that surrounded Lenovo laptops in February, another big computer manufacturer Dell spotted selling PCs and laptops pre-installed with a rogue SSL certificate that could allow attackers:

• To impersonate as any HTTPS-protected website and spy on when banking or shopping online.

The rogue certificate, dubbed eDellRoot, was first discovered over the weekend by a software programmer named Joe Nord. The certificate is so creepy that it automatically re-installs itself even when removed from the Windows operating system.

Superfish 2.0: Unkillable Zombie
The self-signed transport layer security (TLS) credential came pre-installed as a root certificate on Dell PCs and laptops that are signed with the same private cryptographic key, which is stored locally.
That means an attacker with moderate technical skills can extract the key and abuse it to sign forged version of TLS certificates for any HTTPS-protected site on the Internet, exposing users to all manner of SSL attacks.

The certificate key can be used to conduct man-in-the-middle (MITM) attacks on Dell owners, silently stealing user names, passwords, session cookies, and other sensitive information when the affected Dell machines are connected to a malicious Wi-Fi hotspots in cafes, hospitals or airports.

The problem is similar to the scandal that hit Lenovo in February when the PC manufacturer was caught pre-installing an invasive adware program called Superfish with a similar self-signed cert to inject third-party advertisements into websites on browsers.

Although Dell's case is different as there is no indication that the certificate is being used to inject advertisements on the laptops, the resulting security issue is the same.

Affected PCs and Laptops
The self-signed certificate key was discovered to be pre-installed as a root certificate on at least three Dell laptop models:

• Dell Inspiron 5000 series notebook
• Dell XPS 15
• Dell XPS 13

This indicates that the dangerous certificate may be present on a significant number of the Dell desktops and laptops currently on the market, specifically recent Dell Inspiron Desktop, XPS, and Precision M4800 and Latitude models.

To Check if Your Computer is Vulnerable
To discover the dangerous certificate:

• Open up the Start menu
• Select Run
• Type in certmgr.msc – the Windows certificate manager – into the box and Hit Enter
• Open up the Trusted Root Certification Authority folder on the left
• Select Certificates
• Search for eDellRoot

Once found, right-click over eDellRoot and hit "Remove." It appears to be gone, but actually it's not.

Reboot your computer and reopen certmgr.msc and search for the certificate "eDellRoot". Yeah, the removed root CA cert is back.

What Should You do? How to Remove?
It seems that even if the certificate is clearly fraudulent, Google Chrome and Microsoft Edge and Internet Explorer browsers always establish an encrypted Web session with no warnings.

But fortunately, Mozilla's Firefox web browser generates an alert warning that the certificate was not trusted.

So, Dell customers with new XPS, Precision, and Inspiron models are advised to use Firefox to browse the web.

To fix the issue completely, Dell users will need to manually revoke the certificate permissions, which is a complex and technically demanding task.

Moreover, security researcher Darren Kemp from Duo Security says that the problem may be even worse than what Nord suggested.

According to an analysis done by Kempa, a bundled plugin re-installs the root CA file when it is removed. So, to remove the eDellRoot certificate completely, you must:

• First delete Dell.Foundation.Agent.Plugins.eDell.dll from your system
• Then remove the eDellRoot root CA certificate

Dell's Response
In a statement, a Dell spokesperson said the company is investigating the report and looking into the certificate, but emphasized the company’s policy of minimizing pre-loaded software for security reasons.

"Customer security and privacy is a top concern for Dell," the spokesperson said. "We've a team investigating the current [issue] and will update you as soon as we have more information."

Node.js discloses two critical security vulnerabilities

Node.js is facing two security vulnerabilities, including a potentially major denial-of-service issue, with patches for the problems not available for a week. Releases of Node.js ranging from 0.12 to version 5 are vulnerable to one or both issues.

A bulletin issued today by the Node.js Foundation, which has jurisdiction over the popular server-side JavaScript platform, covers "a high-impact denial-of-service vulnerability" and a "low-impact V8 out-of-bounds access vulnerability." V8 is the Google-developed JavaScript engine leveraged by Node.js. Officially, the DoS issue is labeled as CVE (Common Vulnerabilities and Exposures) 2015-8027, while the access problem is identified as CVE-2015-6764.

 "We have two previously undisclosed vulnerabilities. One's not that a big deal [the out-of-bound access issue], one's a slightly bigger deal," said Mikeal Rogers, community manager for the foundation. "Both will be fixed on Wednesday (December 2)" via patches that will be available at Nodejs.org. Rogers said these vulnerabilities had not been exploited.

The bulletin describes the DoS vulnerability as widespread among Node versions. "A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service. The severity of this issue is high, and users of the affected versions should plan to upgrade when a fix is made available."

The out-of-bounds vulnerability description is less dire. "An additional bug exists in Node.js, all versions of v4.x and v5.x, whereby an attacker may be able to trigger an out-of-bounds access and/or denial of service if user-supplied JavaScript can be executed by an application. The severity of this issue is considered medium for Node.js users, but only under circumstances where an attacker may cause user-supplied JavaScript to be executed within a Node.js application. Fixes will be shipped for the v4.x and v5.x release lines along with fixes for CVE-2015-8027." The 0.10x and 0.12x lines are not affected.

Despite the seriousness of the security issues, Node representatives stressed that users shouldn't be worried. The threat to the community is "minimal," Rogers said. "In fact, we already have fixes for both. It is a routine part of our security policy, which we take seriously, to inform our community of vulnerabilities, and then give them time to plan for an upgrade."

Rogers said Node.js security is under more scrutiny since the formation of the foundation, which is affiliated with the Linux Foundation. "We have much more formal and proper security policy now."

Chinese cybercriminal underground thriving more than ever

By the end of 2013, the Chinese cybercrime underground was a very busy economy, with peddled wares that not only targeted PCs, but mobile devices as well—making it its most prolific segment, according to Trend Micro’s report entitled “Prototype Nation: The Chinese Cybercriminal Underground in 2015.”

The report also saw cybercriminals abusing popular Web services such as the instant-messaging app (IM), QQ, to communicate with peers.

Today, the Chinese underground is thriving more than ever. Data (either leaked or stolen) are now being traded along with prototypes and new functional hardware, like point-of-sales (PoS) and automated teller machine (ATM) skimmers.

Tampered PoS devices are sold to resellers who may or may not know that these devices are rigged. Some PoS skimmers come with an SMS-notification feature that allows the cybercriminal to access the stolen data remotely every time the device is used.C

Commonly sold on B2B websites, ATM skimmers are fraud-enabling devices that allow fraudsters to carry out bank fraud and actual theft. The devices have keypad overlays that are used to steal victims’ PINs.

Pocket skimmers are also widely used. These small, unnoticeable magnetic card readers can store track data of up to 2,048 payment cards. They do not need to be physically connected to a computer or a power supply to work. All captured data can be downloaded onto a connected computer.