Symantec, the security software firm, is reporting that its researchers have discovered a new, malicious “worm” that is spreading on the Internet and has been adapted to attack embedded devices running the Linux operating system, including many devices that are part of the Internet of Things. Writing on the Symantec research blog, Kaoru Hayashi, a threat analyst within Symantec’s Security Response organization, said that the company had uncovered the worm, dubbed Linux.Darlloz, spreading between more common PC systems. However, an analysis of the program revealed that its creators were thinking big: engineering the worm to be capable of attacking a “range of small, Internet-enabled devices in addition to traditional computers.” Specifically, Symantec’s team found variants of Darlloz for chip architectures common in devices ranging from home routers and set-top boxes to security cameras. The warnings about an “Internet of Things worm” were hypothetical, however. Hayashi said that no attacks against non-PC […]
Hacks & Hackers
Fix From LG Ends Involuntary SmartTV Snooping, But Privacy Questions Remain
The electronics firm LG issued a software update for some “Smart TV” models that were discovered spying on owners, but the company still faces scrutiny over its privacy policy. The company issued a firmware update for its LG 42LN575V model television sets, which were the subject of scrutiny last week after a UK-based technology consultant using the handle “DoctorBeet” discovered that his LG television was transmitting information about his viewing habits to company servers without his consent. The blogger, “DoctorBeet” (aka Jason Huntley, of Yorkshire, England) first wrote about his discovery on November 18, setting off a small firestorm of controversy. An analysis by Huntley uncovered a number of sketchy or outright illegal data harvesting behaviors. Among them: His LG television sent information on which channels he viewed to an LG-owned web domain. (The domain in question was not in service at the time.) The LG television relayed information on […]
The Security Week In Review: Same Breach, Different Day
It’s the end of another week and, as has become a pattern, we’re weighing the impact of another massive data breach: this one at Cupid Media, the owner of a network of dating web sites. According to a report on Krebsonsecurity.com, data on some 40 million Cupid Media customers turned up on the same servers that were found holding data stolen from Adobe Inc., PR Newswire and other victims. To get a handle on the impact of this breach and others like it, I invited Ted Julian, the Chief Marketing Officer of CO3 Systems, to talk about the recent string of embarrassing breaches and how companies go wrong (and sometimes right) in responding to them. Co3 sells a service that helps companies structure their response to data breaches and other adverse incidents. We also took the time to talk about the recent FTC Workshop on security and privacy on The […]
Verizon: New Cloud Encryption Service Will Secure IoT Devices
Identity is one of the biggest challenges facing companies that are deploying products for the “Internet of Things,” as well as traditional enterprises that find IoT technologies of all types knocking at the door. The question, in short, is “how do I know that this device is legitimate, and ties back to an identity that I trust with access to my network resources and data? Of course, identity management has always been an aching problem in the enterprise space. The problem with the IoT is scale – given the sheer size of the IoT (30 billion connected devices by 2020), you can add a few “zeros” onto the number of devices that could, potentially, be seeking access to your network at any time. [Related read: Identity Management’s Next Frontier: The Interstate] It makes sense that, in a distributed environment like that, the cloud may be the best place to address […]
Snowden Borrowed from APT Playbook In NSA Hack
We know for sure that Edward Snowden made short work of the protections that the National Security Agency used to segregate classified data. Snowden’s revelations about government spying on foreign governments, domestic and foreign firms and…well…just about everyone else first appeared in print in May. Since that time, a looming question is “how?” In other words: how did a single contractor gain access to such a massive trove of classified intelligence while working for the most security conscious organization in the world? While the exact methods used by Snowden are still not known, there are many theories. Now the security firm Venafi thinks that it has an answer, and is challenging the NSA to prove it wrong. In a blog post on Wednesday, the company laid much of the blame on poor management of digital certificates and user credentials, which allowed Snowden to move laterally within the NSA’s classified […]
