Update your Flash player to 18.0.0.194 to avoid dangerous security hole

Google Project Zero hacker Mateusz Jurczyk has dropped 15 remote code execution vulnerabilities, including a single devastating hack against Adobe Reader and Windows he reckons beats all exploit defenses. He said, "The extremely powerful primitive provided by the vulnerability, together with the fact that it affected all supported versions of both Adobe Reader and Microsoft Windows (32-bit) – thus making it possible to create an exploit chain leading to a full system compromise with just a single bug – makes it one of the most interesting security issues I have discovered so far." Jurczyk published a video demonstration of the exploit for 32-bit and 64-bit systems. His slides are here [PDF].

WikiLeaks: NSA Eavesdropped On the Last Three French Presidents

The NY Times is reporting that WikiLeaks has released "material which appeared to capture officials in Paris talking candidly about Greece's economy, relations with Germany — and, ironically, American espionage." The information was leaked "a day before the French Parliament is expected to definitively pass a controversial security bill legalizing broad surveillance, particularly of terrorism suspects.

Indian Law and the Pornography

In today’s IT era where every hand has the reach to Internet with just a single click, we all are very much vulnerable to Pornography. Porn today is more freely and widely available on Internet than ever before. Younger generation is therefore able to access it very easily and quickly than ever. This leads to the mentality of unemotional sex. And all this is because we have grown up in a culture where parents feel embarrassed, they are not comfortable to have a healthy conversation about sex with their children. Well then it’s time to open up and come out of our comfort zone to talk about the most hush-hush topic i.e. “Pornography”.

What is Pornography?

The word pornȇ stands for prostitute, and graphein stands for documentary. Pornography literally means “Documenting a Prostitute” or “Depictions of acts of Prostitutes”. Pornography in the eyes of law is not necessarily obscene. Today, the largest industry of Internet is Adult Entertainment. There are millions of individually owned pornographic websites. Research shows that 50% of the web-sites containing potentially illegal contents relating to child abuse were ‘Pay-Per-View’. This indicates that abusive images of children over Internet have been highly commercialized.

Now that you know what Pornography mean let’s take a look at why do people watch it?

• They find sexual excitement and release enjoyable and that’s what they get from porn.
• They try to stay unreal and find their release in reel life.
• It caters to the fetishes that people have and gives them an endless selection to choose from.
• To reduce the level of stress and uncertainty of their personal life.
• Conflict between the sexual moods among couples leads to watching porn.
• To learn about sex.
• Because it is easily available and others are watching.

 

An expert on Sexual Addiction, found that there is a four-step progression among many who consume pornography

1. Addiction: Pornography provides a powerful sexual stimulant or aphrodisiac effect, followed by sexual release, most often through masturbation. It is addictive because it creates dependency on porn.
2. Escalation: Over time addicts require more explicit and deviant material to meet their sexual “needs.”
3. Paralyzing Effect: Sometimes referred as desensitization. What was first perceived as gross, shocking and disturbing, in time becomes common and acceptable.
4. Aggression: Porn leads to acting out sexually. There is an increasing tendency to act out behaviors viewed in pornography. People turn into imitators of what they see. No emotions are involved in the act which lead to aggression.     
   

   Legal to watch, illegal to share

   Coming to the legality of Pornography, our law doesn’t prohibit us from watching pornography privately i.e., consumption of pornography is no offence. All that the law forbids is its publication, transmission, distribution or production. Let’s have a look at the law of the country related to Pornography
   • Section 67 of Information Technology Act 2000
     • Punishment for publishing or transmitting obscene material in electronic form
     • Imprisonment for three years
     • Fine of five lakh rupees
     • For subsequent conviction imprisonment for five years and also with ten lakh rupees fine.
   • Section 293 of Indian Penal Code 1860
     • Sale, etc., of obscene objects to young person
     • Imprisonment for three years
     • Fine of two thousand rupees
     • For subsequent conviction imprisonment for seven years and also with five thousand
       
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   Nowadays most of the Ransomware targets the porn sites.Beware of Cyber Criminals and act accordingly.
   
   
   
   
   
   
   
   

NIST Releases Guidelines for the Security of Controlled Unclassified Information

The National Institute of Standards and Technology (NIST) has published the final version of its guidelines for federal agencies on the securing of sensitive government information stored by contractor’s and other non-federal organizations.
“Contractors routinely process, store and transmit sensitive federal information to assist federal agencies in carrying out their core missions and business operations,” NIST said.
“Federal information is also shared with state and local governments, universities and independent research organizations.”
As such, Executive Order 13556 established the Controlled Unclassified Information (CUI) Program to standardize the way the executive branch handles unclassified information that requires protection, such as personally identifiable information.
“Executive departments and agencies (agencies) employ ad hoc, agency-specific policies, procedures, and markings to safeguard and control this information, such as information that involves privacy, security, proprietary business interests, and law enforcement investigations,” the Executive Order states.
“This inefficient, confusing patchwork has resulted in inconsistent marking and safeguarding of documents, led to unclear or unnecessarily restrictive dissemination policies, and created impediments to authorized information sharing. The fact that these agency-specific policies are often hidden from public view has only aggravated these issues.”
Information which qualifies as CUI is defined by the National Archives and Records Administration (NARA), which administers the program based on laws, regulations, and government-wide policies.
NARA worked with NIST to develop guidelines for protecting this information, and the two organizations drafted the guidelines for protecting CUI which were published for public comment last fall.
The document Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations (NIST Special Publication 800-171) is the final version of those guidelines.
“The new guidelines are designed for federal employees with responsibilities for information systems development, acquisition, management and protection,” NIT said.
“The requirements apply to all components of non-federal information systems and organizations that process, store or transmit CUI, or provide security protection for those components.”
The guidelines are based in part on existing security requirements for federal information systems which can be found in two of NIST’s foundational information security documents, the Federal Information Processing Standard (FIPS)200 and the Security and Privacy Controls for Federal Information Systems and Organizations (NIST SP 800-53).
“NIST SP 800-171 is critical to our strategy to strengthen needed protections for CUI,” says John Fitzpatrick, director of NARA’s Information Security Oversight Office.
“Together with NARA’s recently-proposed CUI regulation and a planned Federal Acquisition Regulation clause, we will bring clarity and consistency to the handling of CUI across government.”

Cryptowall Infections Cost a bomb to US Victims

The Internet Crime Complaint Center (IC3) – a partnership between the Federal Bureau of Investigation (FBI) and the National White Collar Crime Center (NW3C) – reports that 992 U.S. victims of the Cryptowall ransomware campaign have incurred losses in excess of $18 million between April of 2014 and June of 2015.
“Recent IC3 reporting identifies CryptoWall as the most current and significant ransomware threat targeting U.S. individuals and businesses. CryptoWall and its variants have been used actively to target U.S. victims since April 2014,” the IC3 advisory states.
“The financial impact to victims goes beyond the ransom fee itself, which is typically between $200 and $10,000. Many victims incur additional costs associated with network mitigation, network countermeasures, loss of productivity, legal fees, IT services, and/or the purchase of credit monitoring services for employees or customers.”
Earlier this month, the SANS Internet Storm Center warned of a dramatic surge in Cryptowall 3.0 infections over several weeks as a result of an aggressive campaign leveraging the Angler exploit kit and malicious spam emails.
“A malspam campaign pushing CryptoWall 3.0 started as early as Monday 2015-05-25, but it has increased significantly since Monday 2015-06-08. The CryptoWall 3.0 push from Angler EK appears to have started around the same time. Both campaigns (malspam and Angler EK) were active as recently as Wednesday 2015-06-10,” wrote Brad Duncan.
“The timing of these campaigns indicates they might be related and possibly initiated by the same actor.”
Duncan said the bitcoin address for ransom payment by this malware sample is 16REtGSobiQZoprFnXZBR2mSWvRyUSJ3ag, the same address found in a previous sample from 2015-06-04, and they saw the same address used again on 2015-06-09.
IC3 says that the majority of attackers involved in ransomware schemes demand payment in bitcoin because it’s easy to use, publicly available, decentralized, and provides a additional level of anonymity.
The SANS team also detected the Angler exploit kit pushing CryptoWall 3.0 on 2015-05-26, the first time they had seen version 3.0 of CryptoWall used by Angler.
“In each case I’ve documented, the bitcoin address for the ransom payment was 16Z6sidfLrfNoxJNu4qM5zhRttJEUD3XoB. Angler EK is still being used by other groups to send different malware payloads. However, the appearance of CryptoWall 3.0 in Angler since 2015-06-26 using the same bitcoin address indicates this is a separate campaign by a specific actor,” Duncan said.
“The timing of these two campaigns, along with their consistent use of the same bitcoin addresses for the ransom payment, suggest they are related. They may have been initiated by the same actor. This is a significant trend in our current threat landscape. We will continue to monitor this activity and report any significant changes in the situation.”
IC3 recommends Internet users use caution when opening email attachments, clicking on advertisements, and navigating to unverified websites. In addition, users should have an updated antivirus and firewall installed, enable popup blockers, and always back up their system.

I have a personal experience with crypowall attack once and somehow fought back and got 95 % of the data.

Google's New Feature Undo Send

Sending an important and confidential email to one of my friends and mistakenly clicked send to someone else. Holy crap!

This is something experienced by everyone of us at some point. When we accidentally hit the reply-all button, send an email to the wrong person, or sometimes forget to attach a file, and then left only with an instant pain of regret. It feels like there is no going back. Isn't it?

But to make you go back and rectify your mistakes, Google has rolled out a new feature that delays sending your email for 30 seconds after you hit Send, so that you can recall it if you want to make some changes.

You Have 30 Seconds to Unsend an Email

After the feature remained in public beta for six years, Google has finally brought this life-saving "Undo Send" feature to the main settings on the Web version of Google's Gmail service.

Once enabled, the Undo Send feature offers you up to 30-second window to "undo" sending an outgoing email after you hit the send button — just in case you change your mind.

Since March 2009, Undo Send feature has buried in Gmail's Labs section, which Google uses to test out new features for Gmail. However, now the feature is available in Gmail's settings under the "General" tab.

Here's How to enable Undo Send option:

• Go to the gear icon in the top-right corner of your Gmail window and open Settings from the menu
• In General setting, scroll down for Undo Send, which is disabled by default
• Click Enable and select a cancellation period up to 30 seconds
• Hit Save Changes at the bottom 

Once done, every time you send an email the yellow dialogue box will appear that displays "Your message has been sent," giving you an option to Undo it. When you Click on it, the email will reopen, un-sent, in the composition window.

For now, Undo Send feature is not available for the Gmail mobile app for smartphone devices. However, the company is planning to roll out the feature for the mobile app soon.

Introducing the Fan overlay network system in Ubuntu Linux

The brand-new Fan overlay network system technology will be implemented in the test images of the Ubuntu Cloud operating system for the Google Compute Engine and Amazon Web Services (AWS) cloud hosting providers.

Fan overlay network for container addresses is a new innovation from Canonical that promises to deliver the fastest and most scalable address expansion mechanism in the container world by enabling cloud users to grow the number of LXD and Docker containers that can be addressed in just one cloud environment.

"Containers are transforming the way people think about virtual machines (LXD) and apps (Docker)," says Mark Shuttleworth on his blog. "They give us much better performance and much better density for virtualisation in LXD, and with Docker, they enable new ways to move applications between dev, test and production."

Containers offer better performance than traditional KVM and ESX hypervisors

In order to better explain how the new Fan overlay network system works for the Ubuntu operating system, Mark Shuttleworth wrote a lengthy blog post where he stated, among many other interesting things, that containers provide much better performance and density over traditional KVM and ESX hypervisors.

According to Dustin Kirkland, a member of Canonical's Ubuntu Product and Strategy team, it would appear that containers come in no more than two complementary forms, application-centric containers like Rocket and Docker, as well as full machine containers from LXD.

However, the most important fact to know about the new Fan overlay network system technology is that it has been designed from the ground up to be capable of expanding the address space by 250x on each container host.

Social Media Accounts Counterfeit

Interesting article on the inner workings of a Facebook account farm, with commentary on fake social media accounts in general.

Drug Pump Hacking

When you connect hospital drug pumps to the Internet, they're hackable -- only surprising people who aren't paying attention.

Rios says when he first told Hospira a year ago that hackers could update the firmware on its pumps, the company "didn't believe it could be done." Hospira insisted there was "separation" between the communications module and the circuit board that would make this impossible. Rios says technically there is physical separation between the two. But the serial cable provides a bridge to jump from one to the other.
An attacker wouldn't need physical access to the pump because the communication modules are connected to hospital networks, which are in turn connected to the Internet.
"From an architecture standpoint, it looks like these two modules are separated," he says. "But when you open the device up, you can see they're actually connected with a serial cable, and they"re connected in a way that you can actually change the core software on the pump."
An attacker wouldn't need physical access to the pump. The communication modules are connected to hospital networks, which are in turn connected to the Internet. "You can talk to that communication module over the network or over a wireless network," Rios warns.
Hospira knows this, he says, because this is how it delivers firmware updates to its pumps. Yet despite this, he says, the company insists that "the separation makes it so you can't hurt someone. So we're going to develop a proof-of-concept that proves that's not true."

One of the biggest conceptual problems we have is that something is believed secure until demonstrated otherwise. We need to reverse that: everything should be believed insecure until demonstrated otherwise.

Why We Encrypt

Encryption protects our data. It protects our data when it's sitting on our computers and in data centers, and it protects it when it's being transmitted around the Internet. It protects our conversations, whether video, voice, or text. It protects our privacy. It protects our anonymity. And sometimes, it protects our lives.

This protection is important for everyone. It's easy to see how encryption protects journalists, human rights defenders, and political activists in authoritarian countries. But encryption protects the rest of us as well. It protects our data from criminals. It protects it from competitors, neighbors, and family members. It protects it from malicious attackers, and it protects it from accidents.
Encryption works best if it's ubiquitous and automatic. The two forms of encryption you use most often -- https URLs on your browser, and the handset-to-tower link for your cell phone calls -- work so well because you don't even know they're there.
Encryption should be enabled for everything by default, not a feature you turn on only if you're doing something you consider worth protecting.
This is important. If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption in a country, that country's authorities have an easy way of identifying them. But if everyone uses it all of the time, encryption ceases to be a signal. No one can distinguish simple chatting from deeply private conversation. The government can't tell the dissidents from the rest of the population. Every time you use encryption, you're protecting someone who needs to use it to stay alive.
It's important to remember that encryption doesn't magically convey security. There are many ways to get encryption wrong, and we regularly see them in the headlines. Encryption doesn't protect your computer or phone from being hacked, and it can't protect metadata, such as e-mail addresses that need to be unencrypted so your mail can be delivered.
But encryption is the most important privacy-preserving technology we have, and one that is uniquely suited to protect against bulk surveillance -- the kind done by governments looking to control their populations and criminals looking for vulnerable victims. By forcing both to target their attacks against individuals, we protect society.
Today, we are seeing government pushback against encryption. Many countries, from States like China and Russia to more democratic governments like the United States and the United Kingdom, are either talking about or implementing policies that limit strong encryption. This is dangerous, because it's technically impossible, and the attempt will cause incredible damage to the security of the Internet.
There are two morals to all of this. One, we should push companies to offer encryption to everyone, by default. And two, we should resist demands from governments to weaken encryption. Any weakening, even in the name of legitimate law enforcement, puts us all at risk. Even though criminals benefit from strong encryption, we're all much more secure when we all have strong encryption.

3 More Security Updates To do If you Care Your Family

Do you get late night calls from your Dad when he can't send email?
If your colleagues can't print do they stop by your desk before they go to IT?
Do the people in your house act like the speed of the internet is yours to command?
If the answer is 'Yes', then welcome.

Today is the first day of National Cyber Security Awareness Month (NCSAM) and, like last year, we're talking to all those people who act as their family's unofficial IT support: Make today the day you set aside a few minutes to do the simple but important things that make life harder for the bad guys.
The 3 things we asked you to do last year are no less important now than they were a year ago, so don't skip them.
Here's a quick reminder of steps 1,2 and 3 from the original article: Do these 3 essential security tasks for your family today:

1. Check that anti-virus is up-to-date and run a scan
2. Enable WPA or WPA2 on home WiFi
3. Set different passwords for every website

If you do steps 1, 2 and 3 for each of your family members then at some point you're going to find yourself sat in front of a computer, tablet or phone making sure that anti-virus is up to date.
Whilst you're sat there, do 3 more simple things that could really help keep your family cyber-safe:
Update it, lock it, encrypt it.

4. Update it

Every minute of every day there is a quiet but furiously active arms race going on between software vendors and criminals. What's at stake are the network-connected devices used and paid for by ordinary families and businesses.
The criminals are looking for flaws in popular software that they can exploit to take control of computers remotely. The software vendors are looking for ways to confound common attack vectors and trying to patch up flaws as fast as possible.
When the criminals win they can take complete control of a computer, even if it's on the other side of the world.
And, by remote control, they can monitor it, plunder it for all the data they can get their hands and on and recruit it into a giant, illegal, computing cloud called a botnet.
Botnets can be used for everything from looting your files to performing Distributed Denial of Service (DDoS) attacks but they are most commonly used for sending spam.
The biggest botnets are collections of millions of computers and each individual computer can be used to send millions of spam messages a week without the owner even noticing.
One big mistake many people make is to assume that the crooks won't be interested in "little old me," but that's not how it works: cybercriminals simply aren't going to pass up a computer that can send millions of spams a week, all for free.
Software vendors are getting better and better at releasing patches quickly but what matters most isn't how quickly patches are created, it's how quickly we pull patches on to our computers.
One of the largest and most resilient botnets ever seen was created by the notorious Conficker worm that infected over 11 million computers by exploiting a vulnerability in the Windows operating system. A fix for that vulnerability was released by Microsoft 29 days before Conficker first began to appear and if users had applied the patch quickly enough Conficker would have been dead on arrival.
That's how important it is to download the software updates available to you.
Before updating your software consider for a second that it's impossible to exploit software that isn't installed so ditch anything that isn't needed.
Ideally you'll update every piece of software that's left on the system you've got in front of you but as a minimum check for updates to the device's anti-virus, operating system, web browsers and Microsoft Office if it's installed.
I highly recommend you consider life without Adobe Acrobat Reader, Java, Silverlight and Flash but if you absolutely can't face it, update those too.
Just as importantly, open up the preferences on each of the pieces of software you've updated and tell them to download and install updates automatically from now on.

5. Lock it

When you leave a device unattended it should be locked, just like you'd lock your car. If it isn't then it's an open door for thieves and mischief makers.
Anyone who sits at an unlocked computer, laptop, tablet or phone can immediately enjoy the same privileges as the person who left it unattended. Any documents, passwords, photos, credit card numbers, private correspondence, address books or other data that belongs to the user who last logged in is within the thief's grasp.
Criminals work incredibly hard to achieve that kind of access remotely but no amount of patching and anti-virus will protect you from a walk-up.
Make sure that the device demands a password, pin, passcode or swipe when it's locked and then configure it to lock itself after the shortest period of inactivity you can. Remember that if the owner finds it unbearable you can always make it a bit longer later.
The automatic lock is an important back stop because it provides a level of protection no matter how distracted or forgetful the user is but, for bonus points, tell the owner how to lock the device manually too so that it's locked the second they walk away (that's Windows Key + L on Windows and Control + Shift + Eject or Control + Shift + Power on a Mac.)

6. Encrypt it

Unfortunately, just screen-locking your computer is not enough to protect it from thieves with physical access.
By rebooting a locked computer from a USB stick (or a CD on older models), thieves can bypass the normal access controls of your operating system.
Within seconds, they can start copying off your files, and may even be able to reset the login password - not just for you but for the administrator as well.
Then they can reboot a second time and login as if they were you, just as though your computer had never been locked at all.
The answer is to encrypt the device using Full Disk Encryption (FDE). Thieves can still access the raw 0s and 1s stored on the disks that have been encrypted but those and 0s and 1s no longer make any sense - until and unless they're decrypted, they're just noise.
The more expensive editions of Windows (Enterprise and Ultimate for Windows 7; all versions except Basic for Windows 8) come with FDE software called BitLocker and all Macs come with FileVault. To enjoy the protection of FDE you just need to switch those bits of software on.
On iOS, setting a lockscreen passcode as we suggested in stage 2 is enough to enable full disk encryption. The passcode you choose is also your device encryption password, so when you choose a lock code, skip the PIN sort and go for a decent password. It's a bit more trouble but it not only locks your device against snoops, it also keeps the data on it safe even if the whole device is stolen.
On Android, there's a little bit more work involved because once you choose your passcode, you have to wait for the device to scramble all the data. The device will encrypt by itself, so you don't have to do anything, but you won't be able to use the device until it has finished, which takes from one to several hours.

Finally...

Follow my Blog

ITU announcing the next generation ultra speed internet 5G

While many of us are battling with the slow data access and still awaiting the roll-out of 4G Networks, the International Telecommunication Union (ITU) is already looking forward to the next generation of telecommunication network technology.

Yes folks, we are talking about the future 5G standard for mobile networking.

Since 5G standard is currently in the definition stage, the ITU has announced a timeline for a name, demonstration, and distribution.

What's the Standard Data Speed for 5G Network?

When I talk about data speed, the ITU has decided that 5G compliant networks will have to provide a peak data speed of up to 20Gbps, which means it's 20 times faster than the peak speed specification (1Gbps) of 4G LTE networks.

For actual user speeds, this simply means a customer should receive an average Internet speed of between 100 and 1000 Mbps, which is somewhere between 10 and 100 fold increase over the typical 4G LTE speed of 10Mbps.

So, soon in future, you may be able to download a full-length High Definition movie to your mobile phone in just a matter of seconds. Moreover, video chats with friends will be so realistic that you will feel like you can touch the other person right through your phones screen.

Though 20 Gbps has been set as a standard data speed for 5G networks, security researchers from the University of Surrey achieved Record-Breaking data speeds with 5G wireless data connections back in February, achieving an incredible One Terabit per second (1Tbps) speed.

5G for IoT Devices

The specification for 5G networks also serves future internet-of-things (IoT) technologies. 5G will have to provide up to 100 Mbps average data transmission speed to over 1 Million IoT devices within the radius of 1 Km2.

"The vision for the 5G network and its global standardization schedule has been agreed based on our suggestion," a Korean Ministry official told the Korea Times. "This has shown that Korea is leading the world's mobile communications technology and related policies."

When will we get 5G?

The 5G network technology, which is still in the development stage, is expected to roll out between 2018 and 2020.

As for the formal naming scheme, 5G Networks will be called IMT-2020, similar to IMT-2000 for 3G Networks and IMT-Advanced for 4G Networks.

The final details for the 5G standard for mobile networking will be confirmed in October this year, following approval from the 193 International Telecommunication Union (ITU) member countries.

Although an early demonstration of 5G network speeds will be given at the 2018 PyeongChang Winter Olympic Games, South Korea, according to Korean officials.