Shadow Brokers threaten to unleash more hacking tools | Technology | The Guardian

The so-called Shadow Brokers, who claimed responsibility for releasing NSA tools that were used to spread the WannaCry ransomware through the NHS and across the world, said they have a new suite of tools and vulnerabilities in newer software. The possible targets include Microsoft’s Windows 10, which was unaffected by the initial attack and is on at least 500m devices around the world.

Fuente: Shadow Brokers threaten to unleash more hacking tools | Technology | The Guardian


Microsoft responsabiliza a la Agencia de Seguridad Nacional de EE.UU. de propiciar el ciberataque masivo que afectó al menos a 150 países – El Mostrador

El gigante de la informática criticó el papel de los gobiernos y organizaciones que coleccionan vulnerabilidades informáticas que después pueden ser robadas o vendidas a delincuentes informáticos. La empresa pide que lo sucedido sea una lección para erradicar esta práctica en el mundo.

Fuente: Microsoft responsabiliza a la Agencia de Seguridad Nacional de EE.UU. de propiciar el ciberataque masivo que afectó al menos a 150 países – El Mostrador


WannaCry: por qué los expertos creen que puede haber otro ciberataque muy pronto – El Mostrador

Expertos en informática advierten que un nuevo ataque global con un brote de ransomware es “inminente” y que incluso podría ser lanzado el lunes. BBC Mundo te cuenta los detalles y cómo protegerte de estos virus.

Fuente: WannaCry: por qué los expertos creen que puede haber otro ciberataque muy pronto – El Mostrador


With authoritarianism and state surveillance on the rise, how can civil society be protected from digital threats?

Policymakers have given a great deal of attention to the cyber security of governments, critical infrastructure, military targets and commercial enterprises. But civil society groups are also under threat, including human rights defenders, environmental activists, political watchdogs, and other groups promoting the rule of law and democracy.What can be done about these digital threats to civil society around the world?

Fuente: With authoritarianism and state surveillance on the rise, how can civil society be protected from digital threats?


Someone Is Learning How to Take Down the Internet – Schneier on Security

Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. We don’t know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses.

Fuente: Someone Is Learning How to Take Down the Internet – Schneier on Security


Internet or Splinternet? by Joseph S. Nye – Project Syndicate

The Internet is a network of networks. Each of the separate networks belongs to different companies and organizations, and they rely on physical servers in different countries with varying laws and regulations. But without some common rules and norms, these networks cannot be linked effectively. Fragmentation – meaning the end of the Internet – is a real threat.

Fuente: Internet or Splinternet? by Joseph S. Nye – Project Syndicate


Filtrada World-Check, la base de datos usada por Gobiernos y bancos con sospechosos de terrorismo

La base de datos contendría 2.240.000 entradas con categorías como “individuo político”, “corporativo”, “militar”, “Crimen-narcóticos” y “terrorismo”. Estos datos estarían siendo utilizados por más de 300 gobiernos y agencias de inteligencia, nueve de los diez mejores bufetes de abogados o 49 de los 50 bancos más grandes del mundo. En total, se estima que son 6.000 clientes los que la utilizan en 170 países.

Fuente: Filtrada World-Check, la base de datos usada por Gobiernos y bancos con sospechosos de terrorismo


We cannot afford another digital divide – FT.com

Cloud computing is one of the most important transformations of our time. Although when you think of it, you probably think of entertainment, gaming and messaging apps, it also has significant applications to health, education and development. But

Fuente: We cannot afford another digital divide – FT.com


Una grieta en la seguridad de la Red | Tecnología | EL PAÍS

Una grieta en la seguridad de la Red | Tecnología | EL PAÍS.

 

OpenSSL se crea de manera desinteresada por la comunidad informática. / KACPER PEMPEL (REUTERS / Cordon Press)

 

Un error en uno de los principales programas de conexión segura utilizado en Internet ha tenido potencialmente expuestos a millones de usuarios desde hace dos años. El lunes, Google difundió un punto débil en el sistema de cifrado que utiliza para sus conexiones seguras, llamado OpenSSL, que también ha afectado a gigantes como Yahoo y Amazon. Esta grieta, existente desde 2011 y descubierta en diciembre de 2013 por un técnico de Google, podría haber permitido a hackers robar contraseñas de los usuarios.

 

El problema afecta a las conexiones seguras, las que comienzan con “https” y aparecen en la barra de direcciones cuando el usuario introduce datos delicados, habitualmente contraseñas. El fallo ha sido bautizado en inglés como Heartbleed, o “corazón sangrante”, porque afecta a un tipo de intercambio de información en web, el Heartbeat (latido de corazón).

 

El agujero de seguridad está en el código fuente (los bloques de construcción que componen un programa informático) de las versiones 1.0.1 a 1.0.1f de OpenSSL. Ya existe una nueva versión lista para descargar que subsana el fallo: la 1.0.1g. Los internautas de las páginas que utilizan este código habrían sido potencialmente vulnerables desde 2011. Y si alguien hubiera accedido a información confidencial, no habría dejado rastro. Pero los expertos llaman a la calma porque no hay razones para suponer que la seguridad haya sido violada desde entonces.

 

Open SSL es un sistema de seguridad utilizado por algunas de las principales web que existen, y “entre el 50% y el 70%” de servidores según Igor Unanue, técnico de la empresa de seguridad S21SEC. Ricardo Galli, fundador de Menéame, rebaja los servidores afectados a unos 500.000. Es gratuito y funciona como una herramienta que las web utilizan para cifrar la información que intercambian con los usuarios individuales, para que esta no pueda ser robada por terceros.

 

Open SSL es un programa de código abierto. Es decir, supuestamente cualquier programador puede participar en la escritura de su ADN, aunque eso no quiere decir que lo pueda alterar a voluntad como los artículos de Wikipedia.

 

Lo usan desde Yahoo, Google, Facebook o Amazon, a la plataforma de juegos Steam, pasando por el software de conexión segura Tor. Potencialmente podría haber dejado sin cobertura de seguridad a millones de usuarios que almacenan los datos de sus tarjetas bancarias en páginas de pago, o que utilizan el e-mail o los mensajes instantáneos.


“Heartbleed”: La grave falla que amenaza la seguridad de los usuarios en Internet – BioBioChile

“Heartbleed”: La grave falla que amenaza la seguridad de los usuarios en Internet – BioBioChile.


Heartbleed.com

Heartbleed.com

Publicado por Gabriela Ulloa
Esta semana se dio a conocer un preocupante problema de seguridad web que afecta a dos tercios de Internet: se trata de un error (bug) llamado “Heartbleed”, el cual permite a cualquier cibercriminal con acceso a la red robar datos protegidos en un servidor.

Precisamente corresponde a una falla en OpenSSL, un software de encriptación de código abierto usado por cerca del 66% de los servidores existentes en Internet, y que podría poner en riesgo los datos sensibles de los usuarios como contraseñas, datos de tarjetas de créditos y correos electrónicos, entre otros.

Uno de los aspectos más críticos es que dicha tecnología está detrás de múltiples sitios HTTPS que recogen información personal o financiera, los cuales se identifican con el ícono de un pequeño candado ubicado en la barra de direcciones y que avisa a los cibernautas que sus datos están a salvo de los espías web.

Al respecto, se precisó que actualmente los cibercriminales pueden explotar el bug para acceder a los datos personales de los usuarios y a las contraseñas criptográficas de los sitios, con el fin de crear imitaciones de las páginas para engañar a quienes navegan.


Heartbleed: don't rush to update passwords, security experts warn | Technology | theguardian.com

Heartbleed: don’t rush to update passwords, security experts warn | Technology | theguardian.com.

The severity of the Heartbleed bug means that rushing to change passwords could backfire

 

 

The Heartbleed logo.
The Heartbleed logo. Photograph: Codenomicon

 

Internet security researchers say people should not rush to change their passwords after the discovery of a widespread “catastrophic” software flaw that could expose website user details to hackers.

The flaw, dubbed “Heartbleed”, could reveal anything which is currently being processed by a web server – including usernames, passwords and cryptographic keys being used inside the site. Those at risk include Deutsche Bank, Yahoo and its subsidiary sites Flickr and Tumblr, photo-sharing site Imgur, and the FBI.

About half a million sites worldwide are reckoned to be insecure. “Catastrophic is the right word,” commented Bruce Schneier, an independent security expert. “On the scale of 1 to 10, this is an 11.”

But suggestions by Yahoo and the BBC that people should change their passwords at once – the typical reaction to a security breach – could make the problem worse if the web server hasn’t been updated to fix the flaw, says Mark Schloesser, a security researcher with Rapid7, based in Atlanta, Georgia.

Doing so “could even increase the chance of somebody getting the new password through the vulnerability,” Schloesser said, because logging in to an insecure server to change a password could reveal both the old and new passwords to an attacker.


'Heartbleed': for hundreds of thousands of servers at risk around the world from catastrophic bug | Technology | theguardian.com

‘Heartbleed’: for hundreds of thousands of servers at risk around the world from catastrophic bug | Technology | theguardian.com.

Code error means that websites can leak user details including passwords through ‘heartbeat’ function used to secure connections

 

 

The Heartbleed logo
The Heartbleed logo. Photograph: /Codenomicon

 

Hundreds of thousands of web and email servers worldwide have a software flaw that lets attackers steal the cryptographic keys used to secure online commerce and web connections, experts say.

They could also leak personal information to hackers when people carry out searches or log into email.

The bug, called “Heartbleed”, affects web servers running a package called OpenSSL.

Among the systems confirmed to be affected are Imgur, OKCupid, Eventbrite, and the FBI’s website, all of which run affected versions of OpenSSL. Attacks using the vulnerability are already in the wild: one lets a hacker look at the cookies of the last person to visit an affected server, revealing personal information. Connections to Google are not vulnerable, researchers say.

SSL is the most common technology used to secure websites. Web servers that use it securely send an encryption key to the visitor; that is then used to protect all other information coming to and from the server.

It is crucial in protecting services like online shopping or banking from eavesdropping, as it renders users immune to so-called man in the middle attacks, where a third party intercepts both streams of traffic and uses them to discover confidential information.


Meet the seven people who hold the keys to worldwide internet security | Technology | The Guardian

Meet the seven people who hold the keys to worldwide internet security | Technology | The Guardian

It sounds like the stuff of science fiction: seven keys, held by individuals from all over the world, that together control security at the core of the web. The reality is rather closer to The Office than The Matrix

In a nondescript industrial estate in El Segundo, a boxy suburb in south-west Los Angeles just a mile or two from LAX international airport, 20 people wait in a windowless canteen for a ceremony to begin. Outside, the sun is shining on an unseasonably warm February day; inside, the only light comes from the glare of halogen bulbs.

There is a strange mix of accents – predominantly American, but smatterings of Swedish, Russian, Spanish and Portuguese can be heard around the room, as men and women (but mostly men) chat over pepperoni pizza and 75-cent vending machine soda. In the corner, an Asteroids arcade machine blares out tinny music and flashing lights.

It might be a fairly typical office scene, were it not for the extraordinary security procedures that everyone in this room has had to complete just to get here, the sort of measures normally reserved for nuclear launch codes or presidential visits. The reason we are all here sounds like the stuff of science fiction, or the plot of a new Tom Cruise franchise: the ceremony we are about to witness sees the coming together of a group of people, from all over the world, who each hold a key to the internet. Together, their keys create a master key, which in turn controls one of the central security measures at the core of the web. Rumours about the power of these keyholders abound: could their key switch off the internet? Or, if someone somehow managed to bring the whole system down, could they turn it on again?

The keyholders have been meeting four times a year, twice on the east coast of the US and twice here on the west, since 2010. Gaining access to their inner sanctum isn’t easy, but last month I was invited along to watch the ceremony and meet some of the keyholders – a select group of security experts from around the world. All have long backgrounds in internet security and work for various international institutions. They were chosen for their geographical spread as well as their experience – no one country is allowed to have too many keyholders. They travel to the ceremony at their own, or their employer’s, expense.

What these men and women control is the system at the heart of the web: the domain name system, or DNS. This is the internet’s version of a telephone directory – a series of registers linking web addresses to a series of numbers, called IP addresses. Without these addresses, you would need to know a long sequence of numbers for every site you wanted to visit. To get to the Guardian, for instance, you’d have to enter “77.91.251.10” instead of theguardian.com.

A smartcard is handed over‘Each of the 14 primary keyholders owns a traditional metal key to a safety deposit box, which in turn contains a smartcard, which in turn activates a machine that creates a new master key.’ Photograph: Laurence Mathieu for the Guardian

The master key is part of a new global effort to make the whole domain name system secure and the internet safer: every time the keyholders meet, they are verifying that each entry in these online “phone books” is authentic. This prevents a proliferation of fake web addresses which could lead people to malicious sites, used to hack computers or steal credit card details.

The east and west coast ceremonies each have seven keyholders, with a further seven people around the world who could access a last-resort measure to reconstruct the system if something calamitous were to happen. Each of the 14 primary keyholders owns a traditional metal key to a safety deposit box, which in turn contains a smartcard, which in turn activates a machine that creates a new master key. The backup keyholders have something a bit different: smartcards that contain a fragment of code needed to build a replacement key-generating machine. Once a year, these shadow holders send the organisation that runs the system – the Internet Corporation for Assigned Names and Numbers (Icann) – a photograph of themselves with that day’s newspaper and their key, to verify that all is well.


BitTorrent teases secure chat program | Technology | theguardian.com

BitTorrent teases secure chat program | Technology | theguardian.com.

The peer-to-peer software company is planning an encrypted chat service as demand for secure communications tools rises

 

 

A BitTorrent sticker.
BitTorrent is planning a secure P2P messaging service. Photograph: Anna Hanks/Flickr

 

BitTorrent, the company which maintains the popular peer-to-peer downloading protocol, has announced an entry into the world of secure communications.

 

With the launch of the alpha version of BitTorrent Private Chat, users are able to use a similar version of the distributed network that enables fast (and frequently illegal) downloads of large files in order to chat privately and securely.