G-Data Reins In Regin: Top-tier Espionage Tool.

Regin is a full cyber espionage platform capable of complete remote control and monitoring on all possible levels. Attribution is difficult in cases like this however considering the complexity of development, G-Data suspects that this operation is supported by a nation-state, but not originating from Russia and not from China.

Kaspersky Lab has done some research on the Regin as well;

Perhaps one of the most publicly known victims of Regin is Jean Jacques Quisquater (https://en.wikipedia.org/wiki/Jean-Jacques_Quisquater), a well-known Belgian cryptographer. In February 2014, Quisquater announced he was the victim of a sophisticated cyber intrusion incident. We were able to obtain samples from the Quisquater case and confirm they belong to the Regin platform.

G-Data has created a tool to detect the trojan;

We identified the use of an encrypted virtual file system. In the version mentioned above, the file system is a fake .evt file in %System%\config. The header of the virtual file system is always the same:

typedef struct _HEADER {
  uint16_t SectorSize;
  uint16_t MaxSectorCount;
  uint16_t MaxFileCount;
  uint8_t FileTagLength;
  uint16_t crc32custom;
}

During our analysis, the checksum was a CRC32. A generic approach to detect the infection could be a detection of the existence of a virtual file system on the infected system by checking the custom CRC32 value at the beginning of the file system.

 Get the tool from G-Data

FBI Warns Business Of 'Destructive' Malware Attackes In The Wake Of Sony Hack.

According to Reuters, the FBI has warned businesses in the USA via a confidential report about new malicious software that can be used to launch "destructive" cyber attacks, which explains that U.S. businesses should remain vigilant. Last week Sony Pictures was hacked and and investigators are still at task.
The report does not directly connect the Sony incident but the five page FBI report mentions about the malware used in the attack. It advices business how to react to the Malware and to report any suspected malware to FBI.
The malware overrides all data on hard drives of computers, including the master boot record, which prevents them from booting up.The hard drives will need to be replaced or re imaged after such attacks and is very time consuming.
Reuters

EFF Files Amicus Brief Asking To Invalidate DietGoal's "Picture Menu" Patent.

EFF filed an amicus brief yesterday asking Federal Circuit to invalidate U.S. Patent No. 6,585,516 because it improperly claims ineligible abstract ideas. EFF Brief, argues that the patent on using picture menus stored in a database to create meals should never have been granted in the first place. But more importantly, EFF argues that the Federal Circuit should confirm that quick, early decisions as to patent eligibility are vital to clearing our system of bad patents.

Typical troll fashion, DietGoal sued over 70 different companies since 2011, including restaurant chains such as Pita Pit, Taco John’s, and Panda Express. Usually trolls go after people who are too small, or have no much knowledge in the patent laws, to fight back.
But they met their match when they sued Bravo Media, for offering the public recipes (and presumably pictures) from its “Top Chef” show. Unlike other defendants faced with the troll's lawsuit and settling, Bravo filed, and won, a motion for “summary judgment” (a court procedure that can end the case before it goes to a jury). The court found the patent invalid because it claimed matter that is ineligible for patent protection.
DietGoal appealed that decision, wasting valuable time of the courts and people to keep their scheme afloat.
The brief was filed on behalf of a diverse group of non-profits and industry associations: Application Developers Alliance, the Computer and Communications Industry Association, EFF, Engine Advocacy, the National Restaurant Association, and Public Knowledge.
Read more at  EFF, "EFF to Court: Don’t Waste Time, A “Picture Menu” is Not Patentable"

FTC Denies AgeCheq's COPPA Rule verifiable parental consent method,

After conducting a public comment period and review of AgeCheq, Inc.’s application for Children’s Online Privacy Protection (COPPA) Rule verifiable parental consent method, the FTC has decided deny the company’s application.

Under the COPPA Rule, online sites and services directed at children under 13, and general audience sites or services that knowingly collect, use, or disclose personal information from children under 13, must obtain permission from a child’s parents before collecting personal information from that child. The rule lays out a number of acceptable methods for gaining parental consent, but also includes a provision allowing interested parties to submit new verifiable parental consent methods to the Commission for approval. Approved methods may be used by any company, not just the particular applicant requesting approval of the method.

FTC

Flip A Coin With Google App, OK Google!

Among many other things that you can do with the Android devices and Android Lollipop, you can also flip a coin.

Can't decide 49ers or Warriors (it is Warriors, for me) just say OK Google Flip A Coin.

Google App, Gets Material Design - OK Google! | VOIP IP Telephony

Music Manager Asks Youtube To Pull 20,000 Music VIdeos.

Man, after Taylor Swift, everyone one wants a piece of every music. Long time music royalty manager, of Global Music Rights, which holds catalog that includes songs written by John Lennon, the Eagles, Pharrell Williams, Ira Gerswhin and Smokey Robinson, has asked Youtube to pull out as many as 20,000 songs.
GMR has said the YouTube's Music Key does not cover it's client and further more they will go after other music services like Pandora, SoundCloud for the same end, to increase the haul.
WSJ

USA Freedom Act Fails In The Senate.

Even as we all watched with fingers crossed type anticipation, The USA Freedom Act or NSA Reform failed to gain 60 votes it needed to succeed. it was 58 to 42.
Given the current situation in the Senate, I guess we will have to hope, with uncrossed fingers next few years.
But in the mean while, horn up you encryption capabilities, encrypt email, and don't call anyone :) for next few years. You will be fine, as any of those senators who voted against would say.

FORM SF 2014 : Design

google.com/design/form

LetsEncrypt Will Offer Free Encryption Server Certificates, With EFF Support.

I pay a lot for my server certificates else where, but that is because it is enforced to do so. If we had free certificates like Letsencrypt, 5 years ago, world wide web would be a much better place. But it is never too late.

EFF, LetsEncrypt To Offer Free Encryption Server Certificates. 

Ultramercial’s Infamous Patent On Advertising On the Internet Invalidated

Patent troll Ultramercial was using absurd patent U.S. Patent 7,346,545 to sue internet companies for showing advertisements before the actual content in 2009. The ensuring years, abstract software patents were challenged in various courts and former Chief Judge Randall Rader, twice found the patent valid. Yes some people take long to learn. It must be pretty easy to pass the bar.
But the Supreme Court was different, it vacated both of these rulings and sent the case back for reconsideration.
Proving common sense is still present, Today, on its third try, the Federal Circuit finally held the patent invalid.
Please read the complete article on FSF, who wrote 4 amicus briefs for the court on the case. 

Chromebook And Google Apps For Education Get Approval For NYC Schools

After getting Google leading the pack in terms of tablets and notebooks sold to K-12 education providers, both domestically some countries like Malayasia, now it is set to expand the ground. Google has been approved to provide Chromebooks and Google Apps for Education to the New York City Department of Education. The NYC CIO has signed on with google, Chromebooks and Google Apps for Education, as part of their approved and supported (from an IT standpoint) tools for this school year. There is  NYC DoE Google Apps for Education Resource Center that helps teachers or anyone in their districts to get started.
This is very good for Google because now it can reach out to another 1 million plus students, in 1,800 schools with approval.
Google also worked hard on their end to ensure that Chromebooks and Google Apps for Education worked, properly by working with OEMs who built Chromebooks to ensure that the devices meet the standard.

Netflix Shutters Public API, And Some Apps WIth It.

Netflix has closed it's public API and a buch of applications with it. But I guess every one knew what was coming as Netflix restricted the access to it's public API, two years ago.

Now only a very few App developers remain as partners and continue to operate their apps with Netflix data. InstantWatcher, CanIStreamIt, Flixster, Fanhattan, Yidio, are some of those.

But apps like A Better Queue, which we wrote up last year as “A way to find movies worth watching on Netflix”, are shutting the doors today. Write’s ABetterQueue’s developer Dave Jachimiak:

Read more at TechCrunch.

Airbnb, Could Get Hosts In Legal Trouble, Learn And Posper

I was reading a post on Engadget that lays out how a Airbnb host could run afoul of laws if not careful. Unknowingly, one could end up owing taxes and get fined in the process.
Read the article "What you need to know about Airbnb's legal challenges".
You can also find out more information by following the Airbnb's website itself, and Airbnb's Public Policy Blog offers updates on initiatives all over the world that impact Airbnb-ers.
But if you are planing to rent out an Airliner like KLM does, you are on your own, go get a bunch of lawyers.

Engadget

Email Encryption, For Better Or Worse.

EMail Encryption, For Better Or Worse.... For Better of course.

Whether it is avoiding surveillance, keeping the free speech free, or simply keeping the thieves at bay, encryption has helped all of us. Now people are beginning to think how they could encrypt their personal emails, for those same reasons.
Right in time with those thoughts, FSF, Free Software Foundation has published a guide on how to encrypt your email.

 This guide will teach you a basic surveillance self-defense skill: email encryption. Once you've finished, you'll be able to send and receive emails that are coded to make sure a surveillance agent or thief intercepting your email can't read it. All you need is a computer with an Internet connection, an email account, and about half an hour.

 If you think this is for you, please visit and select the preferred language and the platform;
Email Self-Defense

US Navy Testing Laser Weapon System In The Real World.

We always knew that lasers could be used in bringing down the enemy. But now US NAVY is actually using / testing the LaWS, Laser Weapon System in the real world, against small ships, drones and mess up enemy weapons and sensors.
Bloomberg tells us that the amphibious transport ship USS Ponce has been patrolling with a prototype 30-kilowatt-class Laser Weapon System since late August. Perhaps to test the system in the real situation. It is fascinating to watch the video, even if you knew what the LaWS is capable of.

The Laser Weapon System (LaWS) temporarily installed aboard the guided-missile destroyer USS Dewey (DDG 105) (shown here conducting an operational test) in San Diego, Calif., is a technology demonstrator built by the Naval Sea Systems Command from commercial fiber solid state lasers, utilizing combination methods developed at the Naval Research Laboratory.

Philae Lands On Comet But On Uneven Ground, Rosetta Watches.

Philae lander

• Traveled 6.4 billion km (four billion miles) to reach the comet
• Journey took 10 years
• Planning for the journey began 25 years ago

Comet 67P

• More than four billion years old
• Mass of 10 billion tonnes
• Hurtling through space at 18km/s (40,000mph)
• Shaped like a rubber duck

25 years in the making, and the last 10 years of that in traveling, Rosetta carrying Philae, traveled 4 Billion miles to reach the comet 67P. Yes the feat it self is mind boggling but Philae, did land.
It seems after touching down, Philae rose hundreds of meters above the surface at one stage and remained in flight for nearly two hours. One might say it was airborne, spaceborne as comet has no air.
While Philae was off the surface, the comet will have rotated beneath it. Each rotation takes about 12 hours which means the lander may effectively travelled across one-sixth of the comet's surface. By the time it came down again, the original landing zone - chosen for its relative safety and ideal amount of sunshine - was left far behind. The lander is now in different, undetermined area that may prove far more hazardous.It will receive much less sun than originally expected. But scientists are happy as they already received more data and the mission itself is a huge educational task.

New Critical Internet Explorer (IE) Vulnerabilities Discovered In IE versions 8, 9, 10 and 11 By Palo Alto Networks.

Palo Alto Networks researcher has discovered three new critical Internet Explorer (IE) vulnerabilities in IE versions 8, 9, 10 and 11. They include two IE Memory Corruption Vulnerabilities and an IE ASLR Bypass Vulnerability. All of these are a part of the November 2014 Security Bulletin and documented in Microsoft Security Bulletin MS14-065.
Palo Alto Networks continuously and proactively identifying these vulnerabilities (like the WireLurker discovered recently) which in turn are used to develop protection solutions for their customers, and as well as us by sharing them with Microsoft, Apple, other developers, or product owners for patching.
Palo Alto Networks.

Apple Gets Geofence-based Wireless Diagnostics Patent

USPTO has granted Apple, U.S. Patent No. 8,886,178 for a "Location-based profile," the mobile dead spot identification solution which I think mostly would benefit of cellular carriers and network providers.
Using on board location subsystems like GPS and wireless access point triangulation, devices can inform server-side systems about localized areas where calls are regularly dropped or data transfers fail. The date gathered could later be used in aiding a more robust network creation.
Apple's geofence-based wireless diagnostics patent was first filed for in 2010 and credits Shuvo Chatterjee as its inventor. 

Raspberry PI A+, The Latest Member Of Raspberry Family.

The Raspberry Pi, the credit card size computer, has a new member, Model A+ The PI Foundation Just announced.  It is an updated version of its Model A board,  smaller and more energy-efficient than its predecessor and costs $5 cheaper.
Improvements in the Model A+ includes more GPIO, with 40 pins now on board , and a micro SD card slot is taking the place of SD slot. Also in the mix is improved audio. The improvements to the GPIO means the A+ is able to communicate with expansion hardware boards for Raspberry Pi family. The A+ still carries only a single USB port, no Ethernet and 256MB of RAM, just like Model A.

According to the foundation, Model A+ inherits from the many improvements made to Model B+, the current flagship.

The Raspberry PI Foundation

USPS, Unites States Postal Service, Hacked, Possibly By Chinese.

USPS, Unites States Postal Service, Hacked, Possibly By Chinese.

Hackers originating from China are suspected of breaching the computer networks of the United States Postal Service, compromising the data of more than 800,000 employees. FBI is currently investigating the intrusion. The intrusion was initially discovered in mid-September and according to the officials, and is now secure.
The compromised data included names, dates of birth, Social Security numbers, addresses, dates of employment and other information, officials said. Every employee from the letter carrier to the postmaster general was exposed.
“It is an unfortunate fact of life these days that every organization connected to the Internet is a constant target for cyber intrusion activity, the United States Postal Service is no different. Fortunately, we have seen no evidence of malicious use of the compromised data and we are taking steps to help our employees protect against any potential misuse of their data.” Postmaster General Patrick Donahoe said in a statement.
Washington Post
USPS Press Release

Operation Onymous Grabs More Darkweb Sites Than Silkroad 2.0,

Looks like the net cast by authorities over the Silkroad 2.0, has rounded up more than just SIlkroad and the mastermind behind it. The effort is comprised of law enforcement of 17 nations launched, I assume inside the TOR network. The operation nabbed 410 hidden services leading to the arrests of 17 and the seizure of $1 million in Bitcoin, 180,000 Euros in cash, drugs, gold and silver.
Blake Benthal was the headliner and people are wondering how did FBI hack a TOR network to catch the culprits. After reading the piece on ARS, it is not rocket science, the agent D'Agostino is too clever and the criminals were dumb. Like in too clever dumb.
Either way, 27 sites were nabbed along with Silkroad 2.0, and “offer for sale illicit goods and services of one kind or another.”

1. Alpaca
2. Black Market
3. Blue Sky
4. Bungee 54
5. CannabisUK
6. Cloud Nine
7. Dedope
8. Fake Real Plastic
9. FakeID
10. Farmer1
11. Fast Cash!
12. Flugsvamp
13. Golden Nugget
14. Hydra
15. Pablo Escobar Drugstore
16. Pandora
17. Pay Pal Center
18. Real Cards
19. Silk Road 2.0
20. Smokeables
21. Sol's Unified USD Counterfeit's
22. Super Note Counter
23. Tor Bazaar
24. Topix
25. The Green Machine
26. The Hidden Market
27. Zero Squad

Forbes via Gizmodo

WireLurker, Infects Apple OS X And iOS, Check If Yours Is.

Palo Alto Networks, a security research group discovered WireLurker, a malware that could find its way in to even non rooted iPhones and iPads via Mac OS X. There is a tool to detect if your Mac is infected, follow the link.
WireLurker, Apple OS X And iOS Malware Detected.

Silk Road 2.0 Meets Busted 2.0, Mastermind Arrested.

The Silk Road 2.0 operator, Blake Benthall, an ex Space X employee, has been arrested by the FBI in San Francisco after federal agents shut down the secret site on Wednesday. The site was said to be a copy of the original Silk Road, a secure black market site allegedly run by Ross Ulbricht.

Operator of Silk Road 2.0, Blake Benthall, arrested yesterday by FBI agents in San Francisco, CA
— FBI New York (@NewYorkFBI) November 6, 2014

Bionic Bird, I want one. A Bird Shaped Drone.

Get yours here at Bionic Bird Crowd Funding.

Revamped BlackEnergy Covers All, Windows, Linux And Cisco routers!

They will also be able to say, Mission Impossible : This System Will Self Destruct to the tune of,,,,, Mission Impossible. Researchers from Kaspersky Labs have discovered new capabilities in the BlackEnergy crimeware tool that are beyond what believed to be. The new varients of BE, are able  to run on network devices, DDoS attacks, stealing passwords, scanning ports, logging IP sources, covertly taking screenshots, gaining persistent access to command and control channels, and destroying hard drives, just to name a few.
The article written by the researchers is pretty scary as it reveals the capabilities of BE2, and BE3. Hiding their paths with 'dstr' command;
"By all appearances, the attackers pushed the 'dstr' module when they understood that they were revealed, and wanted to hide their presence on the machines. Some machines already launched the plugin, lost their data and became unbootable."

• "BlackEnergy2 and BlackEnergy3 are known tools. Initially, cybercriminals used BlackEnergy custom plugins for launching DDoS attacks. There are no indications of how many groups possess this tool. BlackEnergy2 was eventually seen downloading more crimeware plugins - a custom spam plugin and a banking information stealer custom plugin. Over time, BlackEnergy2 was assumed into the toolset of the BE2/Sandworm actor. While another crimeware group continues to use BlackEnergy to launch DDoS attacks, the BE2 APT appears to have used this tool exclusively throughout 2014 at victim sites and included custom plugins and scripts of their own. To be clear, our name for this actor has been the BE2 APT, while it has been called "Sandworm Team" also."

If you are security conscious or even not, this paper is a must read. 

Kaspersky Labs via ARS

Open Documents On Google Drive With Desktop Apps With Ease.

If you use Google Drive, (who does not? if you are not jump ri to the bottom and follow Google's instructions to get it setup :) ), you will be a bit, lot more happier than yesterday. Today Google posted about a great new feature for its cloud storage service, Google Drive. The new feature in a form of Chrome extension will allow users to more easily launch the files they have saved in the cloud using their preferred desktop applications. With the Chrome extension. installed, users will be able to right-click on documents or other files stored in Google Drive and open them using a compatible application on their computer. It cuts like a switchblade and Please note the extension will be rolling out over the next several days.

Google tells us;
"To get started, install the latest version of the Drive app for Mac or PC (version 1.18) and sync your files. Then, visit Google Drive in your Chrome browser (make sure you’re on the new Google Drive). Finally, right-click on the file and select “Open with” to see a list of compatible applications on your computer that can open it. For example, you can choose to open a PDF file with Adobe Reader, or a .psd with Photoshop, make your edits and save back changes to Drive which will sync across all your devices and other collaborators. If you have any questions about this feature, you can learn more in the Help Center."

Tinder Plus Will Allow You To Swipe Back You Missed Date, For A Fee.

Undo Tinder Swipe

Tinder, set to sparkle fire in lonely hearts going in new ways with the service. Tinder Plus is to provide bevy of services than the regular version, most interesting is the capability swipe back and have a look at that sugar loaf once again. It also allow you to swipe to a different locale than your home turf! Like checking out babes in Paris before going there.
So what these sugar coating going to cost Tinderers? Could be anywhere from $0.99 to $20 and will initially be launched in the UK, Brazil and Germany to a select group of users.
Read more at TechCrunch