Target breach likely involved inside knowledge, experts say

<div class="imageContainer580xX" style="width:320px;height:auto;clear:both;margin:auto;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;line-height:19px"><img alt="cloud security" class="largeImage imgId100155717 " itemprop="image" src="http://zapt4.staticworld.net/images/article/2013/12/cloud-security-100155717-large.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: 320px; max-width: 100%;"></div> <div class="department" style="margin:0px 0px 10px;overflow:hidden"><a class="topCatLink" href="http://www.pcworld.com/category/security" style="color:rgb(172,31,43);float:left;font-family:facitweb,sans-serif;font-size:16px;font-weight:700;text-transform:uppercase;margin-right:5px"><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">The Target security breach that left millions of debit and credit</span><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px"> </span><a href="http://www.pcworld.com/article/2081860/target-customers-card-data-said-to-be-at-risk-after-store-thefts.html?tk=rel_news" style="line-height:1.7em;font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px;color:rgb(37,167,215)">card holders at risk</a><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px"> </span><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">of becoming victims of fraud left experts pondering the question of how such a massive theft might have occurred.</span><br> </a></div><span itemprop="articleBody description text" style><p style="line-height:1.7em;margin:0px 0px 0.7em">Theories varied, but the scant details released by the retailer Thursday left some experts believing the criminals had to have some inside knowledge of the company's point-of-sale system in order to compromise it so effectively.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Either people inside the organization were involved or, "at the very least, (the thieves) had sophisticated knowledge and a clear understanding of the cardholder data flows, in order to pinpoint where to steal this very specific data and then exfiltrate it," Mark Bower, director of information protection solutions at Voltage Security, said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Target reported Thursday that card data, including customer name, credit or debit card number and the card's expiration date and CVV code, <a href="http://www.pcworld.com/article/2081844/target-says-40-million-cards-likely-skimmed-in-security-breach.html?tk=rel_news" style="color:rgb(37,167,215)">had been stolen</a> from 40 million accounts used for shopping between November 27 and December 15. The CVV code is the three-digit security number found on the back of cards.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">The theft may have involved tampering with the machines used to swipe cards when making purchases, The Wall Street Journal reported. The information stolen, called track data, is stored in the metal strip on the back of cards.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Target declined to discuss the breach, which a spokeswoman described as "a very sophisticated crime." The Journal reported that the theft involved Target stores nationwide and as many as 40,000 card devices may have been affected. Target has 1797 stores in the U.S.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Malware may have been tool</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">Bower believes the thieves may have planted malware in the electronic cash register attached to the card reader. When a card was swiped, the malicious app would copy the data likely traveling in plain text from the reader.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Modern cash registers often run on Linux or Windows operating systems, so are as vulnerable to malware as regular computers. However, how the collected data got to the thieves' computers is a head-scratcher, because the registers were likely on a closed network that isn't accessible from the Internet.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Because of the difficulty of compromising so many point-of-sale systems, other experts believed the breach more likely occurred at the corporate data center where card data may have been sent from stores before being relayed to a card-processing company.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Lucas Zaichkowsky, enterprise defense architect at AccessData, said hackers may have compromised the corporate system and planted malware that copied data just before it entered the system.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">If the network between the stores and corporate systems were closed, then the data may not have been encrypted, until it left the internal network, said Zaichkowsky, a former employee of card processor Mercury Payment Systems.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"There's only three, maybe five, of these really advanced financial attackers, and they're really good at breaking in and hacking and they understand credit-card processing inside and out," Zaichkowsky said.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Internal access called probable</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">The fact that CVV codes were stolen was a red flag for John Kindervag, analyst for Forrester Research, who said it was an indication that Target may have had a serious security flaw.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">If CVV data were stored, then that would have been a violation of the Payment Card Industry Data Security Standard (PCI DSS) that financial institutions require of businesses accepting credit cards. In addition, if the data wasn't encrypted, then that could also run against the standard.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Because so much account data was stolen in such a short amount of time, Kindervag believes its more likely the thieves broke into a database somewhere on Target's network and grabbed the data, as opposed to intercepting it in transit on the network.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"When you see that many credit-card numbers breached in a single instance, that would lead me to believe that a credit-card database itself had been stolen," Kindervag said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Avivah Litan, analyst for Gartner, said she was confident Target was in compliance with PCI DSS, but that doesn't mean the retailer was protected 100 percent.</p><p style="line-height:1.7em;margin:0px 0px 0.7em"> "It's impossible to plug up all the holes when you're a retailer," Litan said.</p><p style="line-height:1.7em;margin:0px 0px 0.7em">She gave it a "50-50 chance" that either an insider with privileged access to Target's network was involved or the thieves obtained the credentials of a privileged user.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">No matter the cause, the breach is likely to cost Target millions of dollars, Litan said. Credit-card issuers are likely to raise its merchant fee on every transaction and fine Target whether it was in compliance of PCI DSS or not. In addition, the retailer may have to pay back card issuers for any fraud resulting from the breach</p> </span>

Target breach likely involved inside knowledge, experts say

The Target security breach that left millions of debit and credit   card holders at risk   of becoming victims of fraud left experts ponde...

Read more »

Target breach likely involved inside knowledge, experts say

<div class="imageContainer580xX" style="width:320px;height:auto;clear:both;margin:auto;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;line-height:19px"><img alt="cloud security" class="largeImage imgId100155717 " itemprop="image" src="http://zapt4.staticworld.net/images/article/2013/12/cloud-security-100155717-large.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: 320px; max-width: 100%;"></div> <div class="department" style="margin:0px 0px 10px;overflow:hidden"><a class="topCatLink" href="http://www.pcworld.com/category/security" style="color:rgb(172,31,43);float:left;font-family:facitweb,sans-serif;font-size:16px;font-weight:700;text-transform:uppercase;margin-right:5px"><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">The Target security breach that left millions of debit and credit</span><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px"> </span><a href="http://www.pcworld.com/article/2081860/target-customers-card-data-said-to-be-at-risk-after-store-thefts.html?tk=rel_news" style="line-height:1.7em;font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px;color:rgb(37,167,215)">card holders at risk</a><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px"> </span><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">of becoming victims of fraud left experts pondering the question of how such a massive theft might have occurred.</span><br> </a></div><span itemprop="articleBody description text" style><p style="line-height:1.7em;margin:0px 0px 0.7em">Theories varied, but the scant details released by the retailer Thursday left some experts believing the criminals had to have some inside knowledge of the company's point-of-sale system in order to compromise it so effectively.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Either people inside the organization were involved or, "at the very least, (the thieves) had sophisticated knowledge and a clear understanding of the cardholder data flows, in order to pinpoint where to steal this very specific data and then exfiltrate it," Mark Bower, director of information protection solutions at Voltage Security, said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Target reported Thursday that card data, including customer name, credit or debit card number and the card's expiration date and CVV code, <a href="http://www.pcworld.com/article/2081844/target-says-40-million-cards-likely-skimmed-in-security-breach.html?tk=rel_news" style="color:rgb(37,167,215)">had been stolen</a> from 40 million accounts used for shopping between November 27 and December 15. The CVV code is the three-digit security number found on the back of cards.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">The theft may have involved tampering with the machines used to swipe cards when making purchases, The Wall Street Journal reported. The information stolen, called track data, is stored in the metal strip on the back of cards.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Target declined to discuss the breach, which a spokeswoman described as "a very sophisticated crime." The Journal reported that the theft involved Target stores nationwide and as many as 40,000 card devices may have been affected. Target has 1797 stores in the U.S.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Malware may have been tool</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">Bower believes the thieves may have planted malware in the electronic cash register attached to the card reader. When a card was swiped, the malicious app would copy the data likely traveling in plain text from the reader.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Modern cash registers often run on Linux or Windows operating systems, so are as vulnerable to malware as regular computers. However, how the collected data got to the thieves' computers is a head-scratcher, because the registers were likely on a closed network that isn't accessible from the Internet.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Because of the difficulty of compromising so many point-of-sale systems, other experts believed the breach more likely occurred at the corporate data center where card data may have been sent from stores before being relayed to a card-processing company.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Lucas Zaichkowsky, enterprise defense architect at AccessData, said hackers may have compromised the corporate system and planted malware that copied data just before it entered the system.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">If the network between the stores and corporate systems were closed, then the data may not have been encrypted, until it left the internal network, said Zaichkowsky, a former employee of card processor Mercury Payment Systems.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"There's only three, maybe five, of these really advanced financial attackers, and they're really good at breaking in and hacking and they understand credit-card processing inside and out," Zaichkowsky said.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Internal access called probable</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">The fact that CVV codes were stolen was a red flag for John Kindervag, analyst for Forrester Research, who said it was an indication that Target may have had a serious security flaw.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">If CVV data were stored, then that would have been a violation of the Payment Card Industry Data Security Standard (PCI DSS) that financial institutions require of businesses accepting credit cards. In addition, if the data wasn't encrypted, then that could also run against the standard.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Because so much account data was stolen in such a short amount of time, Kindervag believes its more likely the thieves broke into a database somewhere on Target's network and grabbed the data, as opposed to intercepting it in transit on the network.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"When you see that many credit-card numbers breached in a single instance, that would lead me to believe that a credit-card database itself had been stolen," Kindervag said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Avivah Litan, analyst for Gartner, said she was confident Target was in compliance with PCI DSS, but that doesn't mean the retailer was protected 100 percent.</p><p style="line-height:1.7em;margin:0px 0px 0.7em"> "It's impossible to plug up all the holes when you're a retailer," Litan said.</p><p style="line-height:1.7em;margin:0px 0px 0.7em">She gave it a "50-50 chance" that either an insider with privileged access to Target's network was involved or the thieves obtained the credentials of a privileged user.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">No matter the cause, the breach is likely to cost Target millions of dollars, Litan said. Credit-card issuers are likely to raise its merchant fee on every transaction and fine Target whether it was in compliance of PCI DSS or not. In addition, the retailer may have to pay back card issuers for any fraud resulting from the breach</p> </span>

Target breach likely involved inside knowledge, experts say

The Target security breach that left millions of debit and credit   card holders at risk   of becoming victims of fraud left experts ponde...

Read more »

Google fined $1.2 million by Spain over privacy practices

<div class="imageContainer580xX" style="width:320px;height:auto;clear:both;margin:auto;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;line-height:19px"><img alt="google-privacy" class="galleryImage imgId100032193 " itemprop="image" src="http://zapt2.staticworld.net/images/article/2013/04/google-privacy-100032193-gallery.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: 320px; max-width: 100%;"></div> <div class="department" style="margin:0px 0px 10px;overflow:hidden"><a class="topCatLink" href="http://www.pcworld.com/category/government" style="color:rgb(172,31,43);float:left;font-family:facitweb,sans-serif;font-size:16px;font-weight:700;text-transform:uppercase;margin-right:5px"><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">Spain's data protection authority has fined Google $1.2 million and ordered the company to fall in line with the country's data protection rules without delay.</span><br> </a></div><span itemprop="articleBody description text" style><p style="line-height:1.7em;margin:0px 0px 0.7em">The Agencia Española de Protección de Datos (AEPD), said Thursday that Google does not provide users enough information about the personal information it collects, and the purposes it uses it for. It also objects to Google combining data gathered from its various services in violation of local laws.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">The Internet company does not, for example, inform Gmail users that the content of mails and attached files are filtered to insert tailored advertising, AEPD said.</p><p style="line-height:1.7em;margin:0px 0px 0.7em"> Google is also said to keep the data for periods longer than permitted under local data laws. The company was fined $409,500 for each of three violations, AEPD said.</p><p style="line-height:1.7em;margin:0px 0px 0.7em">"The combination of data collected through different services widely exceeds the reasonable expectations of the majority of users, who are not aware of it and lose control of their own personal information," AEPD said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Google <a href="http://www.pcworld.com/article/250950/google_privacy_checklist_what_to_do_before_googles_privacy_policy_changes_on_march_1.html?tk=rel_news" style="color:rgb(37,167,215)">modified its privacy policy</a> in March 2012, giving it the right to use personal data collected from one service on its other services as well, triggering criticism from privacy experts.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Violates data protection laws</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">The investigation carried out by the AEPD has shown that Google illegally collects and processes personal information of both authenticated users, who have logged in with their Google accounts, and non-authenticated users, as well as "passive users" who have not requested Google's services but access Web pages that include elements managed by the Internet company, the data protection authority said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"Google collects personal information through nearly a hundred of services and products offered in Spain, in many cases not providing adequate information about what data is collected, what data is used for what purposes and without obtaining a valid consent of the data subjects," AEPD said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Data protection authorities from France, Germany, Italy, Spain, the Netherlands, and the U.K. <a href="http://www.techhive.com/article/2033375/google-must-defend-privacy-policies-to-6-european-agencies.html?tk=rel_news" style="color:rgb(37,167,215)">said in April</a>they will conduct formal investigations of Google's privacy policy, after the company rejected their requests that it reverse changes it made to the policy. French data protection agency Commission Nationale de L'Informatique et des Libertes (CNIL), which was leading the inquiry, had published in October 2012 a report, giving Google four months to comply with its recommendations. The company did not comply significantly with the recommendations, CNIL said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"We've engaged fully with the Spanish DPA throughout this process to explain our privacy policy and how it allows us to create simpler, more effective services, and we'll continue to do so," Google said in a statement. "We'll be reading their report closely to determine next steps."</p> </span>

Google fined $1.2 million by Spain over privacy practices

Spain's data protection authority has fined Google $1.2 million and ordered the company to fall in line with the country's data pr...

Read more »

Google fined $1.2 million by Spain over privacy practices

<div class="imageContainer580xX" style="width:320px;height:auto;clear:both;margin:auto;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;line-height:19px"><img alt="google-privacy" class="galleryImage imgId100032193 " itemprop="image" src="http://zapt2.staticworld.net/images/article/2013/04/google-privacy-100032193-gallery.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: 320px; max-width: 100%;"></div> <div class="department" style="margin:0px 0px 10px;overflow:hidden"><a class="topCatLink" href="http://www.pcworld.com/category/government" style="color:rgb(172,31,43);float:left;font-family:facitweb,sans-serif;font-size:16px;font-weight:700;text-transform:uppercase;margin-right:5px"><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">Spain's data protection authority has fined Google $1.2 million and ordered the company to fall in line with the country's data protection rules without delay.</span><br> </a></div><span itemprop="articleBody description text" style><p style="line-height:1.7em;margin:0px 0px 0.7em">The Agencia Española de Protección de Datos (AEPD), said Thursday that Google does not provide users enough information about the personal information it collects, and the purposes it uses it for. It also objects to Google combining data gathered from its various services in violation of local laws.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">The Internet company does not, for example, inform Gmail users that the content of mails and attached files are filtered to insert tailored advertising, AEPD said.</p><p style="line-height:1.7em;margin:0px 0px 0.7em"> Google is also said to keep the data for periods longer than permitted under local data laws. The company was fined $409,500 for each of three violations, AEPD said.</p><p style="line-height:1.7em;margin:0px 0px 0.7em">"The combination of data collected through different services widely exceeds the reasonable expectations of the majority of users, who are not aware of it and lose control of their own personal information," AEPD said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Google <a href="http://www.pcworld.com/article/250950/google_privacy_checklist_what_to_do_before_googles_privacy_policy_changes_on_march_1.html?tk=rel_news" style="color:rgb(37,167,215)">modified its privacy policy</a> in March 2012, giving it the right to use personal data collected from one service on its other services as well, triggering criticism from privacy experts.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Violates data protection laws</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">The investigation carried out by the AEPD has shown that Google illegally collects and processes personal information of both authenticated users, who have logged in with their Google accounts, and non-authenticated users, as well as "passive users" who have not requested Google's services but access Web pages that include elements managed by the Internet company, the data protection authority said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"Google collects personal information through nearly a hundred of services and products offered in Spain, in many cases not providing adequate information about what data is collected, what data is used for what purposes and without obtaining a valid consent of the data subjects," AEPD said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Data protection authorities from France, Germany, Italy, Spain, the Netherlands, and the U.K. <a href="http://www.techhive.com/article/2033375/google-must-defend-privacy-policies-to-6-european-agencies.html?tk=rel_news" style="color:rgb(37,167,215)">said in April</a>they will conduct formal investigations of Google's privacy policy, after the company rejected their requests that it reverse changes it made to the policy. French data protection agency Commission Nationale de L'Informatique et des Libertes (CNIL), which was leading the inquiry, had published in October 2012 a report, giving Google four months to comply with its recommendations. The company did not comply significantly with the recommendations, CNIL said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"We've engaged fully with the Spanish DPA throughout this process to explain our privacy policy and how it allows us to create simpler, more effective services, and we'll continue to do so," Google said in a statement. "We'll be reading their report closely to determine next steps."</p> </span>

Google fined $1.2 million by Spain over privacy practices

Spain's data protection authority has fined Google $1.2 million and ordered the company to fall in line with the country's data pr...

Read more »

ZeroAccess takedown leads hackers to abandon bot

<div class="imageContainer580xX" style="width:320px;height:auto;clear:both;margin:auto;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;line-height:19px"><img class="galleryImage imgId100034898 " itemprop="image" src="http://zapt2.staticworld.net/images/article/2013/04/botnet-100034898-gallery.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: 320px; max-width: 100%;"></div> <div class="department" style="margin:0px 0px 10px;overflow:hidden"><a class="topCatLink" href="http://www.pcworld.com/category/security" style="color:rgb(172,31,43);float:left;font-family:facitweb,sans-serif;font-size:16px;font-weight:700;text-transform:uppercase;margin-right:5px"><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">Microsoft is claiming a total victory—at least for this round—over the ZeroAccess bot-herders whose criminal network was the target of a joint effort among Microsoft, the FBI, Europol, and a group of security vendors.</span><br> </a></div><span itemprop="articleBody description text" style><p style="line-height:1.7em;margin:0px 0px 0.7em">"I am pleased to report that our disruption effort has been successful, and it appears that the criminals have abandoned their botnet," writes Richard Boscovich, assistant general counsel of Microsoft's <a href="http://www.pcworld.com/article/2063352/microsoft-dedicates-cybercrime-center.html?tk=rel_news" style="color:rgb(37,167,215)">Digital Crimes Unit,</a> in the Official Microsoft  <a href="http://blogs.technet.com/b/microsoft_blog/archive/2013/12/19/zeroaccess-criminals-wave-white-flag-the-impact-of-partnerships-on-cybercrime.aspx" style="color:rgb(37,167,215)">Blog</a>.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Bot-herders literally signaled their abandonment with a white flag. Part of a message sent to infected computers was "WHITEFLAG" and Boscovich said the team took the message as a victory "which we believe symbolizes that the criminals have decided to surrender control of the botnet. Since that time, we have not seen any additional attempts by the bot-herders to release new code and as a result, the botnet is currently no longer being used to commit fraud."</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">The company has also dropped its civil suit against the criminals (listed as John Does in court papers) in order to give law enforcement officials free rein to pursue them, Boscovich writes.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Significant distruption</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">Getting the bot-herders to walk away from their network wasn't part of the plan two weeks ago when <a href="http://www.pcworld.com/article/2069880/microsoft-europol-claim-victory-in-taking-down-zeroaccess-botnet.html?tk=rel_news" style="color:rgb(37,167,215)">the takedown was executed</a> through a court order that allowed Microsoft to take control of domain names linked to the botnet and to block command and control traffic to infected computers. Similar actions were taken by Europol in five European countries.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">At the time of the takedown, Microsoft said, "Microsoft and its partners do not expect to fully eliminate the ZeroAccess botnet due to the complexity of the threat. However, Microsoft expects that this action will significantly disrupt the botnet's operation."</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Boscovich says that within 24 hours of the disruption, the bot-herders pushed new instructions to infected computers so they could continue their illegal work, but those messages were  traced to their source IP addresses, which were then shut down. The final messages sent to the zombie machines included the word WHITEFLAG, he says.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Microsoft says ZeroAccess, also known as Sirefef, disables security software that might be running on victim computers, making it difficult to get rid of.</p></span>

ZeroAccess takedown leads hackers to abandon bot

Microsoft is claiming a total victory—at least for this round—over the ZeroAccess bot-herders whose criminal network was the target of a j...

Read more »

ZeroAccess takedown leads hackers to abandon bot

<div class="imageContainer580xX" style="width:320px;height:auto;clear:both;margin:auto;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;line-height:19px"><img class="galleryImage imgId100034898 " itemprop="image" src="http://zapt2.staticworld.net/images/article/2013/04/botnet-100034898-gallery.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: 320px; max-width: 100%;"></div> <div class="department" style="margin:0px 0px 10px;overflow:hidden"><a class="topCatLink" href="http://www.pcworld.com/category/security" style="color:rgb(172,31,43);float:left;font-family:facitweb,sans-serif;font-size:16px;font-weight:700;text-transform:uppercase;margin-right:5px"><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">Microsoft is claiming a total victory—at least for this round—over the ZeroAccess bot-herders whose criminal network was the target of a joint effort among Microsoft, the FBI, Europol, and a group of security vendors.</span><br> </a></div><span itemprop="articleBody description text" style><p style="line-height:1.7em;margin:0px 0px 0.7em">"I am pleased to report that our disruption effort has been successful, and it appears that the criminals have abandoned their botnet," writes Richard Boscovich, assistant general counsel of Microsoft's <a href="http://www.pcworld.com/article/2063352/microsoft-dedicates-cybercrime-center.html?tk=rel_news" style="color:rgb(37,167,215)">Digital Crimes Unit,</a> in the Official Microsoft  <a href="http://blogs.technet.com/b/microsoft_blog/archive/2013/12/19/zeroaccess-criminals-wave-white-flag-the-impact-of-partnerships-on-cybercrime.aspx" style="color:rgb(37,167,215)">Blog</a>.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Bot-herders literally signaled their abandonment with a white flag. Part of a message sent to infected computers was "WHITEFLAG" and Boscovich said the team took the message as a victory "which we believe symbolizes that the criminals have decided to surrender control of the botnet. Since that time, we have not seen any additional attempts by the bot-herders to release new code and as a result, the botnet is currently no longer being used to commit fraud."</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">The company has also dropped its civil suit against the criminals (listed as John Does in court papers) in order to give law enforcement officials free rein to pursue them, Boscovich writes.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Significant distruption</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">Getting the bot-herders to walk away from their network wasn't part of the plan two weeks ago when <a href="http://www.pcworld.com/article/2069880/microsoft-europol-claim-victory-in-taking-down-zeroaccess-botnet.html?tk=rel_news" style="color:rgb(37,167,215)">the takedown was executed</a> through a court order that allowed Microsoft to take control of domain names linked to the botnet and to block command and control traffic to infected computers. Similar actions were taken by Europol in five European countries.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">At the time of the takedown, Microsoft said, "Microsoft and its partners do not expect to fully eliminate the ZeroAccess botnet due to the complexity of the threat. However, Microsoft expects that this action will significantly disrupt the botnet's operation."</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Boscovich says that within 24 hours of the disruption, the bot-herders pushed new instructions to infected computers so they could continue their illegal work, but those messages were  traced to their source IP addresses, which were then shut down. The final messages sent to the zombie machines included the word WHITEFLAG, he says.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Microsoft says ZeroAccess, also known as Sirefef, disables security software that might be running on victim computers, making it difficult to get rid of.</p></span>

ZeroAccess takedown leads hackers to abandon bot

Microsoft is claiming a total victory—at least for this round—over the ZeroAccess bot-herders whose criminal network was the target of a j...

Read more »

Could Bitcoin's frothy venture funding dry up?

<div class="imageContainer580xX" style="width:320px;height:auto;clear:both;margin:auto;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;line-height:19px"><img alt="bitcoin" class="galleryImage imgId100039995 " itemprop="image" src="http://zapt3.staticworld.net/images/article/2013/06/bitcoin-100039995-gallery.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: 320px; max-width: 100%;"></div> <div class="department" style="margin:0px 0px 10px;overflow:hidden"><a class="presentedBy" href="http://adfarm.mediaplex.com/ad/ck/12309-189045-1105-2?mpt=%%CACHEBUSTER%%" style="color:rgb(51,51,51);float:none;font-family:facitweb,sans-serif;font-size:10px;font-weight:700;text-transform:uppercase;background-image:url(http://csmb.staticworld.net/images/ads/DellLogo-Blu-54px.png);display:block;width:300px;height:30px;text-align:right;padding-right:30px;vertical-align:middle;line-height:30px;background-repeat:no-repeat no-repeat">PRESENTED BY</a><a class="topCatLink" href="http://www.pcworld.com/category/business-issues" style="color:rgb(172,31,43);float:left;font-family:facitweb,sans-serif;font-size:16px;font-weight:700;text-transform:uppercase;margin-right:5px"><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">Bitcoin: What is it, really? A digital currency? An investment? An</span><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px"> </span><a href="http://www.bloomberg.com/news/2013-12-12/most-americans-don-t-know-bitcoin-while-some-guess-xbox.html" style="line-height:1.7em;font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px;color:rgb(37,167,215)">Xbox game</a><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">? For many people it's not clear, but that hasn't stopped venture capitalists from going gaga over it.</span><br> </a></div><span itemprop="articleBody description text" style><p style="line-height:1.7em;margin:0px 0px 0.7em">Since earlier this year, startups dealing in the technology known as Bitcoin have grabbed millions of dollars from some very prominent Silicon Valley VC firms. The amount totals at least some $50 million, all for a technology that could be gone, or pushed deep underground, if financial regulators decided to ban it.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Half of that $50 million went to<a href="https://coinbase.com/" style="color:rgb(37,167,215)">Coinbase</a> earlier this month in a major<a href="http://blog.coinbase.com/post/69775463031/coinbase-raises-25-million-from-andreessen-horowitz" style="color:rgb(37,167,215)">funding round</a> led by Andreessen Horowitz. Coinbase acts as a Bitcoin bank of sorts, providing a suite of services including an exchange for buying and selling bitcoins, a payment processor, and a so-called wallet service for storing bitcoins.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Other startups attracting investor interest since May include <a href="https://bitpay.com/" style="color:rgb(37,167,215)">BitPay</a>, another payment processor that lets online merchants accept payment in bitcoins; <a href="http://www.circle.com/" style="color:rgb(37,167,215)">Circle</a>, which offers its own payment acceptance tools and an exchange; <a href="https://www.itbit.com/" style="color:rgb(37,167,215)">itBit</a>, yet another marketplace for trading bitcoins; and<a href="https://vip.btcchina.com/" style="color:rgb(37,167,215)">BTC China</a>, which has been described as the country's largest exchange but recently was forced to <a href="http://www.pcworld.com/article/2081500/chinas-largest-bitcoin-exchange-forced-to-stop-accepting-deposits.html?tk=rel_news" style="color:rgb(37,167,215)">stop accepting deposits</a> after banking regulators took action.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">During one particularly manic period in late November, Bitcoin was trading on some exchanges for <a href="http://www.pcworld.com/article/2067660/the-price-of-one-bitcoin-surpasses-1000-on-mt-gox.html?tk=rel_news" style="color:rgb(37,167,215)">well over $1000</a>—now it's down to about $625, according to <a href="http://www.coindesk.com/" style="color:rgb(37,167,215)">CoinDesk</a>, which measures its per-minute value based on various criteria.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Some bankers and regulators appear to be <a href="aid: 2082680 Title: AT&T to report government requests for user data?tk=rel_news" style="color:rgb(37,167,215)">on the technology's side</a> as well. In an early December report, Merrill Lynch said the technology could become "a major means of payment for e-commerce and may emerge as a serious competitor to traditional money transfer providers." And in Washington, D.C., federal officials in November offered <a href="http://www.pcworld.com/article/2064800/us-agencies-coming-around-cautiously-to-seeing-benefits-in-virtual-currencies.html?tk=rel_news" style="color:rgb(37,167,215)">cautionary support</a> for the technology, partly for its potential to promote more efficient global commerce.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Does volatility risk viability?</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">But BTC China's recent setback sent Bitcoin's value plunging, as other governments around the world have offered varying levels of support for it. In recent weeks, authorities in New Zealand, Denmark and the European Union have all issued warnings against the technology and have questioned its viability. Consumers are not protected through regulation when using virtual currencies as a means of payment and may be at risk of losing their money, the European Banking Authority <a href="http://www.eba.europa.eu/-/eba-warns-consumers-on-virtual-currencies" style="color:rgb(37,167,215)">said</a> in a statement.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Given these concerns and the volatility, it could become harder for startups to raise money, and the investments are riskier too, one expert said.</p><img alt="" height="174" src="http://images.techhive.com/images/article/2013/03/bitcoin-100028157-medium.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="300"><p style="line-height:1.7em;margin:0px 0px 0.7em"> Earlier in the year, the feeling among some investors was that they had hit something big, "but hype alone isn't good enough anymore," said Mark Williams, a finance professor at Boston University who has been tracking Bitcoin. "The honeymoon is over," he said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">In the venture capital world, timing is everything. Had China blocked BTC China's deposits two months earlier, "VC funding would have been more difficult to land," Williams said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Increased regulation, oversight and restrictions are also fundamentally at odds with one of Bitcoin's primary purposes—to be a currency free of any central authority. And if the red tape makes it harder to get hold of bitcoins, that could reduce the profit opportunities for startups. Consumers will be less likely to buy something with BitPay, for example, if they don't have any bitcoins to buy it with.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Therefore, startups may now face more pressure to demonstrate to VC firms that their investments will pay off, Williams said.</p><h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em"> Bitcoin's role, challenge</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">Meanwhile, Bitcoin may or may not be a proxy for virtual currencies overall, which could also affect how much funding startups can get in the new year. Views differ on Bitcoin's role.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"Bitcoin is the standard bearer for the fledgling e-currency industry," Boston University's Williams said. "The success or failure of Bitcoin will have a ripple effect on the many startups anticipating an e-currency revolution. ... Bitcoin's success is their success."</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">The investor community, however, might see things differently. They're not investing in the Bitcoin currency so much as in its underlying infrastructure, which could serve <a href="http://www.pcworld.com/article/2033505/of-bitcoins-and-e-bullion-the-sad-history-of-virtual-currency.html?tk=rel_news" style="color:rgb(37,167,215)">other virtual currencies</a> in the future, said Barry Silbert, an active angel investor in the industry. So if Bitcoin fails, it may not even matter to them, or to the startups.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Startups' biggest challenge right now is getting more banks on their side, according to Silbert, founder of the<a href="http://www.bitcointrust.co/" style="color:rgb(37,167,215)">Bitcoin Investment Trust</a>, a private fund for handling Bitcoin investments. "Price volatility is a distraction to VC firms," he said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">But others still see plenty of froth next year. Like Heineken, for example. "Our vision of the future?" the Dutch brewing company <a href="https://twitter.com/Heineken/status/412582896038580224" style="color:rgb(37,167,215)">posted</a> this week on Twitter, "Drink real beer, pay with virtual money." They didn't mention any virtual hangovers, though.</p> </span>

Could Bitcoin's frothy venture funding dry up?

PRESENTED BY Bitcoin: What is it, really? A digital currency? An investment? An   Xbox game ? For many people it's not clear, but that...

Read more »

Could Bitcoin's frothy venture funding dry up?

<div class="imageContainer580xX" style="width:320px;height:auto;clear:both;margin:auto;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;line-height:19px"><img alt="bitcoin" class="galleryImage imgId100039995 " itemprop="image" src="http://zapt3.staticworld.net/images/article/2013/06/bitcoin-100039995-gallery.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: 320px; max-width: 100%;"></div> <div class="department" style="margin:0px 0px 10px;overflow:hidden"><a class="presentedBy" href="http://adfarm.mediaplex.com/ad/ck/12309-189045-1105-2?mpt=%%CACHEBUSTER%%" style="color:rgb(51,51,51);float:none;font-family:facitweb,sans-serif;font-size:10px;font-weight:700;text-transform:uppercase;background-image:url(http://csmb.staticworld.net/images/ads/DellLogo-Blu-54px.png);display:block;width:300px;height:30px;text-align:right;padding-right:30px;vertical-align:middle;line-height:30px;background-repeat:no-repeat no-repeat">PRESENTED BY</a><a class="topCatLink" href="http://www.pcworld.com/category/business-issues" style="color:rgb(172,31,43);float:left;font-family:facitweb,sans-serif;font-size:16px;font-weight:700;text-transform:uppercase;margin-right:5px"><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">Bitcoin: What is it, really? A digital currency? An investment? An</span><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px"> </span><a href="http://www.bloomberg.com/news/2013-12-12/most-americans-don-t-know-bitcoin-while-some-guess-xbox.html" style="line-height:1.7em;font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px;color:rgb(37,167,215)">Xbox game</a><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">? For many people it's not clear, but that hasn't stopped venture capitalists from going gaga over it.</span><br> </a></div><span itemprop="articleBody description text" style><p style="line-height:1.7em;margin:0px 0px 0.7em">Since earlier this year, startups dealing in the technology known as Bitcoin have grabbed millions of dollars from some very prominent Silicon Valley VC firms. The amount totals at least some $50 million, all for a technology that could be gone, or pushed deep underground, if financial regulators decided to ban it.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Half of that $50 million went to<a href="https://coinbase.com/" style="color:rgb(37,167,215)">Coinbase</a> earlier this month in a major<a href="http://blog.coinbase.com/post/69775463031/coinbase-raises-25-million-from-andreessen-horowitz" style="color:rgb(37,167,215)">funding round</a> led by Andreessen Horowitz. Coinbase acts as a Bitcoin bank of sorts, providing a suite of services including an exchange for buying and selling bitcoins, a payment processor, and a so-called wallet service for storing bitcoins.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Other startups attracting investor interest since May include <a href="https://bitpay.com/" style="color:rgb(37,167,215)">BitPay</a>, another payment processor that lets online merchants accept payment in bitcoins; <a href="http://www.circle.com/" style="color:rgb(37,167,215)">Circle</a>, which offers its own payment acceptance tools and an exchange; <a href="https://www.itbit.com/" style="color:rgb(37,167,215)">itBit</a>, yet another marketplace for trading bitcoins; and<a href="https://vip.btcchina.com/" style="color:rgb(37,167,215)">BTC China</a>, which has been described as the country's largest exchange but recently was forced to <a href="http://www.pcworld.com/article/2081500/chinas-largest-bitcoin-exchange-forced-to-stop-accepting-deposits.html?tk=rel_news" style="color:rgb(37,167,215)">stop accepting deposits</a> after banking regulators took action.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">During one particularly manic period in late November, Bitcoin was trading on some exchanges for <a href="http://www.pcworld.com/article/2067660/the-price-of-one-bitcoin-surpasses-1000-on-mt-gox.html?tk=rel_news" style="color:rgb(37,167,215)">well over $1000</a>—now it's down to about $625, according to <a href="http://www.coindesk.com/" style="color:rgb(37,167,215)">CoinDesk</a>, which measures its per-minute value based on various criteria.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Some bankers and regulators appear to be <a href="aid: 2082680 Title: AT&T to report government requests for user data?tk=rel_news" style="color:rgb(37,167,215)">on the technology's side</a> as well. In an early December report, Merrill Lynch said the technology could become "a major means of payment for e-commerce and may emerge as a serious competitor to traditional money transfer providers." And in Washington, D.C., federal officials in November offered <a href="http://www.pcworld.com/article/2064800/us-agencies-coming-around-cautiously-to-seeing-benefits-in-virtual-currencies.html?tk=rel_news" style="color:rgb(37,167,215)">cautionary support</a> for the technology, partly for its potential to promote more efficient global commerce.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Does volatility risk viability?</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">But BTC China's recent setback sent Bitcoin's value plunging, as other governments around the world have offered varying levels of support for it. In recent weeks, authorities in New Zealand, Denmark and the European Union have all issued warnings against the technology and have questioned its viability. Consumers are not protected through regulation when using virtual currencies as a means of payment and may be at risk of losing their money, the European Banking Authority <a href="http://www.eba.europa.eu/-/eba-warns-consumers-on-virtual-currencies" style="color:rgb(37,167,215)">said</a> in a statement.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Given these concerns and the volatility, it could become harder for startups to raise money, and the investments are riskier too, one expert said.</p><img alt="" height="174" src="http://images.techhive.com/images/article/2013/03/bitcoin-100028157-medium.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="300"><p style="line-height:1.7em;margin:0px 0px 0.7em"> Earlier in the year, the feeling among some investors was that they had hit something big, "but hype alone isn't good enough anymore," said Mark Williams, a finance professor at Boston University who has been tracking Bitcoin. "The honeymoon is over," he said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">In the venture capital world, timing is everything. Had China blocked BTC China's deposits two months earlier, "VC funding would have been more difficult to land," Williams said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Increased regulation, oversight and restrictions are also fundamentally at odds with one of Bitcoin's primary purposes—to be a currency free of any central authority. And if the red tape makes it harder to get hold of bitcoins, that could reduce the profit opportunities for startups. Consumers will be less likely to buy something with BitPay, for example, if they don't have any bitcoins to buy it with.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Therefore, startups may now face more pressure to demonstrate to VC firms that their investments will pay off, Williams said.</p><h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em"> Bitcoin's role, challenge</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">Meanwhile, Bitcoin may or may not be a proxy for virtual currencies overall, which could also affect how much funding startups can get in the new year. Views differ on Bitcoin's role.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"Bitcoin is the standard bearer for the fledgling e-currency industry," Boston University's Williams said. "The success or failure of Bitcoin will have a ripple effect on the many startups anticipating an e-currency revolution. ... Bitcoin's success is their success."</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">The investor community, however, might see things differently. They're not investing in the Bitcoin currency so much as in its underlying infrastructure, which could serve <a href="http://www.pcworld.com/article/2033505/of-bitcoins-and-e-bullion-the-sad-history-of-virtual-currency.html?tk=rel_news" style="color:rgb(37,167,215)">other virtual currencies</a> in the future, said Barry Silbert, an active angel investor in the industry. So if Bitcoin fails, it may not even matter to them, or to the startups.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Startups' biggest challenge right now is getting more banks on their side, according to Silbert, founder of the<a href="http://www.bitcointrust.co/" style="color:rgb(37,167,215)">Bitcoin Investment Trust</a>, a private fund for handling Bitcoin investments. "Price volatility is a distraction to VC firms," he said.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">But others still see plenty of froth next year. Like Heineken, for example. "Our vision of the future?" the Dutch brewing company <a href="https://twitter.com/Heineken/status/412582896038580224" style="color:rgb(37,167,215)">posted</a> this week on Twitter, "Drink real beer, pay with virtual money." They didn't mention any virtual hangovers, though.</p> </span>

Could Bitcoin's frothy venture funding dry up?

PRESENTED BY Bitcoin: What is it, really? A digital currency? An investment? An   Xbox game ? For many people it's not clear, but that...

Read more »

Beware ransomware, mobile malware in 2014, McAfee says

<div class="imageContainer580xX" style="width:320px;height:auto;clear:both;margin:auto;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;line-height:19px"><img alt="malware" class="galleryImage imgId100032981 " itemprop="image" src="http://zapt4.staticworld.net/images/article/2013/04/malware-100032981-gallery.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: 320px; max-width: 100%;"></div> <div class="department" style="margin:0px 0px 10px;overflow:hidden"><a class="topCatLink" href="http://www.pcworld.com/category/security" style="color:rgb(172,31,43);float:left;font-family:facitweb,sans-serif;font-size:16px;font-weight:700;text-transform:uppercase;margin-right:5px"><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">Cybercriminals will increasingly use ransomware, malware, and hacktivism over the next year to move further into the lucrative business market.</span><br> </a></div><span itemprop="articleBody description text" style><p style="line-height:1.7em;margin:0px 0px 0.7em">McAfee has released its 2014 threat predictions, which highlight the trend<a href="http://www.pcworld.com/article/258795/ransomware_threatens_victims_with_police_reports_for_child_pornography.html?tk=rel_news" style="color:rgb(37,167,215)">toward ransomware</a> and targeted attacks over the next 12 months.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">In 2014, the security firm also expects to see an increase in the new complex types of attacks on business PCs and<a href="http://www.techhive.com/article/2039530/growing-mobile-malware-threat-swirls-mostly-around-android.html?tk=rel_news" style="color:rgb(37,167,215)">mobile devices,</a> but it is clear that traditional tactics which have been around for years will also continue to impact businesses.</p> <img alt="smartphone malware" height="201" src="http://images.techhive.com/images/article/2013/07/smartphone-malware-100045232-medium.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="300"><p style="line-height:1.7em;margin:0px 0px 0.7em"> A key trend is that ransomware attacks, which usually target consumers, such as CryptoLocker, will move further into the business space where they have the potential to severely affects operations and cost companies a lot of money, said Michael Sentonas, McAfee's Global CTO for Security Connected.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"We also expect to see an increase in mobile malware, which effectively locks the user out of his or her device or machine so the cyber criminals can access data, to have an impact on businesses via their increasingly mobile workforces," he said. "Hacktivism attacks which usually target governments are anticipated to spill over into business and enterprise markets."</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">Understanding cyber threats and areas of vulnerability in the year ahead is vitally important as more businesses move operations into the cloud and embrace mobile technologies, providing cyber criminals with more entry points into company networks and data.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">But Sentonas said, unfortunately, the poor cyber security foundations of many companies will continue to create an environment of high motivation, high opportunity for the attacker in 2014.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"In 2013, I saw a number of successful high profile attacks that occurred due to poor patching, misconfigurations, out of date security, and a lack of enterprise wide security visibility.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em">"Businesses need to understand that lax cyber security could have significant implications on their company data, operations and financial viability."</p><h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em"> Top ten threats for 2014:</h2><p style="line-height:1.7em;margin:0px 0px 0.7em"><strong style>1. Ransomware—</strong>Expect ransomware samples to increase given the financial success the cyber criminals have had with this type of malicious software. Ransomware such as CryptoLocker has typically targeted consumers, but now also targets enterprises.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em"><strong style>2. Mobile Malware—</strong>The increasing volume and complexity of malware designed to capture identity and financial information will continue to crossover from desktops to mobile devices; a significant issue for an increasingly mobile workforce.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em"><strong style>3. Destructive Malware—</strong>Cyber attackers are leveraging more destructive functions within their attack code. Cyber criminals will continue to drive the unprecedented rise in destructive malware, some of which are designed to damage the victim's master boot record resulting in complete computer systems being rendered inoperable.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em"><strong style>4. Hacktivism—</strong>Hacktivist groups based in Singapore, Malaysia, Indonesia, and Australia will continue to target governments in 2014 and are expected to also spill over and target private enterprise.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em"><strong style>5. "Next Generation" security tools will come under attack—</strong>Attackers will continue to develop exploits that will be 'sandbox aware' aiming to bypass security systems, demonstrating that sandboxing is a feature and not a complete security solution.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em"><strong style>6. The Internet of Things comes alive—</strong>All devices that connect to the corporate network and the internet should be considered endpoints that come with a level of risk as they typically have less security, both by design and through poor security practices, and will be a target for attackers.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em"><strong style>7. Bypassing Digital Signatures—</strong>More than 1.5 million samples of malware signed with digital signatures already exist and attackers will continue to circumvent the trust mechanisms upon which our digital ecosystems rely.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em"><strong style>8. Security vs Privacy debate will continue—</strong>In 2014,expect to see some government and corporate organizations go dark in response to privacy issues. Consumer privacy demands will impact security architectures, the cloud, and information-sharing.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em"><strong style>9. Threat cycles will be recycled—</strong>A significant percentage of successful cyber intrusions do not rely on sophisticated techniques, rather the attackers aim to exploit lax security architecture, policy and skills shortages using tried and true methods.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em"><strong style>10. Targeted Attacks to continue—</strong>An increase in targeted attacks on government, large enterprise organizations and small businesses is expected as cyber criminals focus their attempts to financially exploit targets. This does not necessarily mean a correlating increase in advanced malware and advanced persistent threat samples, as attackers may use sophisticated or traditional techniques to achieve their ends.</p> </span>

Beware ransomware, mobile malware in 2014, McAfee says

Cybercriminals will increasingly use ransomware, malware, and hacktivism over the next year to move further into the lucrative business ma...

Read more »