Biodun Iginla, BBC News

Biodun Iginla, BBC News

Tuesday, July 30, 2019

ANALYSIS: 'Amateur' Capital One hack stuns security community


Date created : 

Capital One alerted authorities to a data breach that affected more than 100 million customers, resulting the arrest of a West Coast software developer
GETTY IMAGES NORTH AMERICA/AFP
ADVERTISING
Seattle
by Tamara Kachelmeier and Biodun Iginla, France24 Technology News Analysts
The massive data breach at Capital One appeared to be an unsophisticated attack from a single hacker, raising questions about the security of the financial system and insider threats to cloud computing.
The motive behind the breach and extent of its impact remained unclear Tuesday, a day after FBI agents arrested 33-year-old former web engineer Paige Thompson and charged her with stealing data from more than 100 million credit card applications from the 10th largest US bank.
"The biggest surprise is the amateur nature of the attack," said John Dickson of the security consultancy Denim Group.
Dickson said it was "absolutely earth-shattering" that an individual attacker could gain access to that much data at one of the largest US financial institutions.
"This could have a major impact on confidence in the banking system."
The Capital One hack appears to be different from major breaches at the credit monitoring firm Equifax, internet giant Yahoo and other major incidents which have been attributed to sophisticated nation-state entities.
US authorities said Thompson, a former Amazon Web Services employee, was arrested on the basis of a tip after she boasted of accessing the data on the software sharing site GitHub as well as on Twitter and Slack.
Darren Hayes, a Pace University computer science professor specializing in cybersecurity, said the ability to quickly arrest and prosecute an attacker in this kind of case is unusual.
"Most of these cases are perpetrated by hackers in other countries," he said.
- 'Good people gone bad' -
Hayes said the incident highlights the risk of "insider" attacks when trusted employees turn to theft.
"It is challenging to catch good people gone bad, so a lot of banks look for that now" with artificial intelligence tools to detect anomalies in employee behavior, Hayes said.
Capital One said the incident affected some 100 million US customers and six million Canada, with as many as 140,000 US and one million Canadian social security numbers compromised.
Only some of the data was encrypted, but Capital One said it had no indication any of the data was transferred or sold where it could be damaging for customers.
Still, Hayes said he sees a risk of data loss that could end up compromising bank customers.
"My sense is that we are going to see a lot of class-action lawsuits and the company could be liable for a lot of damages," he said.
News of the Capital One breach comes after US credit monitoring agency Equifax last week agreed to pay up to $700 million to settle a similar incident that hit the company in 2017, affecting nearly 150 million customers.
New York State attorney general Letitia James said her office was opening up its own investigation.
"My office will begin an immediate investigation into Capital One's breach, and will work to ensure that New Yorkers who were victims of this breach are provided relief," James said.
- 'Easier target' -
Dylan Gilbert of the consumer group Public Knowledge said the news raises questions about security procedures by the large bank.
"Why didn't Capital One fully encrypt this data, and why didn't the company place this vast trove of personal information behind a properly configured firewall?" Gilbert said.
"Security is challenging and mistakes happen, but unfortunately for consumers, companies have no incentive to engage in cybersecurity best practices when punishment comes in the form of financial penalties that can be factored in as a mere cost of doing business."
Joseph Hall, chief technologist at the Center for Democracy & Technology, said the incident highlights the risk of depending too much on cloud computing, which stores vast amounts of data in servers.
"The fact that there is so much more data in the cloud makes it an easier target," Hall said.
"If cloud services are misconfigured it's relatively easy for someone walking by to take advantage of that."
Thompson's online resume indicates she left Amazon in 2016, and there was no indication the AWS cloud itself was to blame for the breach.
"AWS was not compromised in any way and functioned as designed," Amazon said in a statement.
"The perpetrator gained access through a misconfiguration of the web application and not the underlying cloud-based infrastructure. As Capital One explained clearly in its disclosure, this type of vulnerability is not specific to the cloud."

Over months of discussions in online forums earlier this year, Paige Thompson acknowledged the personal challenges in her life: Suicidal thoughts, struggles to find employment and difficulties she had faced since transitioning to a woman years earlier.
But those who knew her were nonetheless stunned by what came next: The arrest of Ms. Thompson on Monday on charges that she had stolen the personal data of over 100 million Capital One customers.
Ms. Thompson, 33, had spent years lurching between a promising career as a software developer and a life of upheaval that alienated her from her friends. While she at times found community among fellow computer engineers, she on other occasions grew confrontational with them.
“It was just a lifelong thing for her,” said Sarah Stensberg, a former friend. “When she gets in these phases of intensity, she does really stupid things. She’ll push everyone away. She’ll write threatening emails. She’ll post things online about the things she’s doing.”
At one point, Ms. Stensberg said, she and her husband took Ms. Thompson to the hospital to get her into an inpatient treatment facility. Later, after having continued issues, Ms. Stensberg said she and her husband attempted to cut ties with Ms. Thompson.
“He always said she had a lot of potential to be very focused and do a lot in this world,” Ms. Stensberg said.
Despite the troubles, Ms. Thompson’s technical know-how helped her land a job at Amazon Web Services in 2015, according to her resume. She stayed there for a little more than a year.

Posted by at No comments:
Labels: , , , , , , , , ,

ANALYSIS: Iran and the West

by Leila Mohamed and Biodun Iginla, The Economist Intelligence Unit News Analysts
SpirallingTensions between Iran and the West have the Gulf states on edge

The conflict threatens their infrastructure and their income

| FUJAIRAH
Compared with Jebel Ali in Dubai, it feels like a sleepy Mediterranean harbour. The port at Fujairah, on the eastern coast of the United Arab Emirates (uae), serves mostly as a refuelling depot for ships plying the Strait of Hormuz. It lacks the cargo capacity and the high-tech wizardry of Jebel Ali, the largest port in the Gulf and the ninth-busiest in the world. But Fujairah is the uae’s only link to the high seas that bypasses the troubled strait, and so it has become a focal point amid worsening tension between Iran and the West.
That tension rose on July 19th when Iran’s navy seized the Stena Impero, a British tanker (pictured), as it sailed west through the strait. The 30,000-tonne ship is now anchored near Bandar Abbas, hostage to a dispute that began on July 4th, when Britain impounded an Iranian tanker (allegedly bound for Syria) as it passed Gibraltar. In one of his final acts as foreign secretary, Jeremy Hunt proposed setting up a European task force to protect commercial vessels in the Gulf.
ADVERTISING

Britain and its allies worry about the threat to business and energy supplies. For the Gulf Co-operation Council (gcc), though, tensions with Iran border on an existential issue. Despite some hawkish rhetoric, Gulf states are nervous about President Donald Trump’s policy of imposing “maximum pressure” on Iran. Conflict threatens their infrastructure and could hamper the oil and gas shipments that fill their treasuries. “Who’s going to pay the price? It’s us,” says a Qatari diplomat.
For all its threats, Iran cannot close the Strait of Hormuz, the conduit for one-fifth of the world’s traded oil and a quarter of its liquefied natural gas. But it has already raised the cost of commercial shipping. Fujairah became a target in May, when four oil tankers anchored offshore had holes blown in their hulls. Iran is the prime suspect, though investigators have not formally assigned blame. The bunkering business in Fujairah has suffered as a result.
Insurance premiums for the strait have climbed by an average of 10%. For the largest oil tankers, they have doubled, with a transit now costing as much as $500,000 to insure. Some shippers may decide not to take the risk (and bear the cost) of sailing through the strait. That is a concern for the Gulf states, which rely on the waterway to import everything from wheat to cars. Three of them—Bahrain, Kuwait and Qatar—have no other outlet to the sea.
Infrastructure on land is vulnerable too. The Houthis, a Yemeni Shia militia backed by Iran (and which sometimes acts as its proxy), are fighting a Saudi-led coalition at home. But they have also hit soft targets in the region. In May the Houthis took credit for striking an oil pipeline in Saudi Arabia (American officials blamed Shia militias in Iraq). The Houthis claim to have used long-range drones, which could also hit oilfields in the uae. At least three times since May the group has fired missiles at the international airport in Abha, in southern Saudi Arabia. One person has been killed.
In June the militia lobbed a rocket at a major Saudi desalination plant in Al-Shuqaiq. It caused little damage but highlighted another vulnerability: the kingdom gets about one-third of its drinking water, more than 1bn cubic meters a year, from such facilities, which are expensive to build and easy to target. The Qataris even worry about their national air carrier, which has been forced, since its Arab neighbours imposed an embargo in 2017, to route hundreds of daily flights over Iran. At least two drones (one American, one Iranian) have recently been shot down in the area.
Gulf states struggle to counter these threats. Though they have spent tens of billions of dollars on military kit from America and Europe, it is not always the right kit. Tanks and fighter jets have limited value in an asymmetric conflict. Their navies are small and lack combat experience; they train with the Americans and are investing in new ships, but play only a supporting role in regional security. Years of talk about an integrated gcc missile-defence command has led nowhere, and individual defences are spotty. If drones hit Saudi Arabia’s oil pipeline they would have spent hours flying undetected over the kingdom.
Saudi Arabia has long viewed Iran as its chief enemy. It still broadly supports American policy. Officials in the smaller Gulf emirates are unhappy, though, and those in the uae feel particularly stuck. In public they cannot break with Mr Trump or their Saudi allies. But they are subtly distancing themselves. They are withdrawing troops from Yemen partly to lower tensions with the Houthis—and thus avoid being attacked. They have also taken a cautious line on Iran, even suggesting it may not have been responsible for the sabotage in Fujairah. “They could shut this place down with a few missiles,” says an official in Dubai. “We need to protect our own interests.” ■
This article appeared in the Middle East and Africa section of the print edition under the headline"Spiralling"

| FUJAIRAH
Reuse this content
Posted by at No comments:
Labels: , , , , , , , , , ,

Monday, July 29, 2019

Tuesday: Hong Kong protesters disrupt train services, cause commuter chaos

July 30, 2019  09H:33 GMT/ZULU
HONG KONG - Hundreds of Hong Kong protesters blocked train services during the early morning rush hour on Tuesday, causing commuter chaos in the latest anti-government campaign to roil the former British colony.
Anti-extradition bill demonstrators wearing helmets are seen inside a Mass Transit Railway (MTR) train in Hong Kong, China July 30, 2019. REUTERS/Tyrone Siu
What started three months ago as rallies against an extradition bill that would have allowed people in Hong Kong to be sent to mainland China for trial, has now morphed into a wider backlash against the city’s government and its political masters in Beijing.
Protests have occurred almost daily, sometimes with little notice, disrupting business, piling pressure on Hong Kong’s beleaguered government and stretching the city’s police force, which some have accused of using excessive force.
Activists blocked train doors, playing havoc with services and forcing hundreds of people to stream out of railway stations in search of alternative transport.
“We don’t know how long we are going to stay here, we don’t have a leader, as you can see this is a mass movement now,” said Sharon, a 21-year-old masked protester who declined to give her full name. “It’s not our intention to inconvenience people, but we have to make the authorities understand why we protest. We will continue with this as long as need.”
Others chanted, “Liberate Hong Kong,” and “Revolution of our Time”.
By mid-morning commuters were crammed into stations across the city, waiting to board trains that were badly delayed, with no service on some lines.
ADVERTISEMENT
Rail operator MTR Corp said urged people to seek other forms of transport, while public broadcaster RTHK reported that Transport Secretary Frank Chan had called on protesters to stop targeting a rail network that provided transport to five million people daily.
Hong Kong, which returned to China in 1997, is embroiled in its worst political crisis for decades after two months of increasingly violent protests that have posed one of the gravest populist challenges to Communist Party rulers in Beijing.
China on Monday reiterated its support for Hong Kong’s embattled leader, Carrie Lam, and its police and urged Hong Kong people to oppose violence.
The latest protest follows a demonstration at the Chinese-ruled city’s international airport on Friday and violent protests at the weekend when activists clashed with police who fired rubber bullets, tear gas and sponge grenades - a crowd-control weapon.
Some scuffles broke out between commuters and protesters, who gradually began to disperse, while more police were deployed in train stations, where they stopped protesters to search their bags.
Commuters grew increasingly frustrated over the travel disruption, and shops, including bakeries and convenience stores, had also begun to close.
“It’s so inconvenient and annoying, really. I am in hurry to work, to make a living. Will you give away your salary to me?” said a 64-year-old man surnamed Liu.
ADVERTISEMENT
Others were more supportive, refusing to blame the protesters.
“This non cooperation movement is caused by Carrie Lam. She doesn’t cooperate with the people of Hong Kong or respond to their demands,” Jason Lo, 31, told us at Reuters as he waited for a train.
Posted by at No comments:
Labels: , , , , , , , ,

BREAKING: Dozens of inmates killed in grisly Brazil prison riot


Date created : Latest update : 
Nacho Doce, REUTERS | An improvised wall of metal shipping containers to separate two factions of drug gangs is pictured during an uprising at Alcacuz prison in Natal, Rio Grande do Norte state, on January 23, 2017.
by Renee Celeste and Biodun Iginla, France24, Brazil
At least 52 inmates were killed, many of them beheaded, in a prison riot in northern Brazil on Monday as rival gangs fought each other, local authorities have said.
ADVERTISING
Sixteen of the dead were decapitated in the second major eruption of violence to rock the country's severely overpopulated and deadly prison system in as many months.
Fighting broke out in the Altamira Regional Recovery Center at around 7:00 am (1000 GMT), an official from the Para state government's penitentiary department told us at France24. AFP.
Two guards were taken hostage during the hours-long clashes, which were brought under control at around midday. They were eventually freed.
Brazilian TV stations showed footage of thick black smoke rising from the prison compound and people sitting on the roof of a building.
Other images showed flames inside a building that almost reached the ceiling and people, apparently prisoners, sitting on the ground outside.
"It is likely that many detainees died from asphyxiation (from smoke)," the government official said, adding the death toll could rise.
Around 300 prisoners were being held at the jail, the official said, which reportedly has a capacity for 200.
An outbreak of violence in the same prison in September 2018 left at least seven inmates dead, local media reported previously. Guards had apparently foiled an attempted prison escape.
In May this year, at least 55 prisoners were killed in several jails in the neighboring state of Amazonas in violence also blamed on an apparent drug trafficking gang dispute.
Most of the victims were killed by asphyxiation, the state government said at the time.
The federal government dispatched reinforcements to boost security in the jails.
Overcrowded prisons
Brazil has the world's third largest prison population after the United States and China, with 726,712 inmates as of June 2016, according to official statistics.
The population is roughly double the capacity of the nation's jails, which in the same year was estimated to be 368,049 inmates.
The federal government had been expected to add another 115,000 inmates by the end of 2018, Human Rights Watch said in a recent report.
Around 40 percent of the prison population is made up of pretrial detainees.
Along with severe overcrowding and gang violence, riots and breakout attempts in Brazil's prisons are not uncommon.
Experts have described conditions in the country's jails as inhuman, with most inmates poor, black and with little formal education.

Posted by at No comments:
Labels: , , , , , , ,
Subscribe to: Posts (Atom)