Beating cyber crime requires board leadership

EYresearch recently revealed that while awareness of these cyber threats is growing, most leaders believe their organizations are underprepared. Many report that they have no real-time insight on cyber risks and lack the agility to adapt quickly to fast-evolving threats. They also cite the lack of executive buy-in, budget and skills to combat rising cyber crime.

Click here to read more .... http://business.financialpost.com/2014/11/17/beating-cybercrime-requires-board-leadership/?__lsa=8e18-401f

‘High risk’ cyber-crime is really a mixed bag of threats

Lumping in alleged terrorist activity and major fraud with hamfisted phishing, Russian love goddesses and Nigerian princes serves to underplay the actual threat experienced at the sharp end. A sharp end where harm to the individual, the organisation and the nation state take place and where the policing resources do not get effectively focused.

As we piece together the picture, it soon becomes clear that cyber-crimes each have distinct modus operandi, covered by distinct bodies of law. At one level we have “crimes against the machine”, crimes that attack the integrity of the computer’s access mechanisms such as hacking and cracking, cyber-vandalism, cyber-spying, DDOS(distributed denial of service) attacks and viruses. In the UK, such offences are mainly covered by the Computer Misuse Act 1990 and the key source of evidence is found in the computer’s login and operating logs.

At another level lie the “crimes that use machines”, such as fraud, but also phishing or advanced fee fraud which use networked computer systems (often legitimately) to engage victims with the intention of dishonestly acquiring cash, goods or services. These crimes are covered by the Fraud Act 2006 and related legislation. The evidence is to be found in computer transaction logs and those of relevant financial systems.

Finally, there are the “crimes in the machine”. These are computer-content crimes that relate to the illegal content of computer systems. They include the trade and distribution of extreme pornographic and hate crime materials or materials that intend to deprave, corrupt or incite violence. In the UK these are covered by a range of laws including the Extreme Pornography laws (sections 63 to 67 of the Criminal Justice and Immigration Act 2008) and Hate Speech Laws, Communications Act 2003 and others. The evidence for these crimes is usually located in the computer’s main storage space.

Click here to read more .... http://theconversation.com/high-risk-cyber-crime-is-really-a-mixed-bag-of-threats-34091

Four 'volume crime hubs' target cyber-crime impacting the UK capital

At Falcon's launch Commissioner Sir Bernard Hogan-Howe issued a statement saying: "Falcon will see the Met have the best and, I believe, largest cyber-crime and fraud team in Europe, with up to 500 specialist officers dedicated to tackling this crime.” Currently the team comprises 300 officers, including those based at head office covering complex cyber-frauds and pro-actively targetting serious cyber-crime gangs.
Snelgrove explained the background to SC: "MOPAC (The Mayor's Office for Policing And Crime*) research found that only 12 percent of business crime in London was being reported to the police, and a lot of that was cyber-crime and fraud. Plus cyber-crime and fraud that was reported wasn't being prioritised, with both resourcing issues and boroughs prioritising issues such as burglary and robbery.  Now Falcon is prioritising cyber-crime and fraud, and the hubs have been set up  to encourage cyber-fraud to be reported directly to the Met. Falcon is only involved in crimes where there is some impact in London, so it targets cyber-crimes where either the victim or suspected perpetrator is in London. But we liaise with NCCU where there is a national impact and work closely with international colleagues (where appropriate)."

Click here to read more ....http://www.scmagazineuk.com/four-volume-crime-hubs-target-cyber-crime-impacting-the-capital/article/383711/

China hit by 'biggest ever' cyber-attack

.....The distributed denial of service (DDoS) attack was said to have targeted servers responsible for sites with a ".cn" domain name...

....The technique is typically employed by hacktivists looking to disrupt websites from operating correctly.......

....Notice of the attack was posted on the website of the China Internet Network Information Center (CNNIC).....

....It said that the DDoS had begun at 02:00 local time on Sunday - before intensifying at 04:00......

...It said it would "enhance the service capabilities" of the network responsible for the affected domains.....

Click here to read more ....

HP admits to backdoors in storage products

Hewlett-Packard has agreed that there is an undocumented administrative account in its StoreVirtual products, and is promising a patch by 17 July.

.....HP has now issued this security advisory, stating:

“This vulnerability could be remotely exploited to gain unauthorized access to the device.
“All HP StoreVirtual Storage systems are equipped with a mechanism that allows HP support to access the underlying operating system if permission and access is provided by the customer. This functionality cannot be disabled today.
“HP has acknowledged this vulnerability and will provide a patch that will allow customers to disable the support access mechanism on or before July 17, 2013”...

"...Although data isn't accessible via the backdoor, one user with around 50 TB of StoreVirtual capacity said the account gave sufficient access to reboot nodes in a cluster, “and so cripple the cluster"....

Click here to read more ....

Rules under Section 69 Information Technology Act 2000

NOTIFICATION

New Delhi, the 27^th October, 2009

G.S.R. 780 (E).— In exercise of the powers conferred by clause (y) of sub-section (2) of section 87, read with sub-section (2) of section 69 of the Information Technology Act, 2000 (21 of 2000), the Central Government hereby makes the following rules, namely:

1.  Short title and commencement— (1) These rules may be called the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009.             (2)  They shall come into force on the date of their publication in the Official Gazette.

2. Definitions—In these rules, unless the context otherwise requires, --

(a) 'Act' means the Information Technology Act. 2000 (21 of 2000);

(b)'communication' means dissemination, transmission, carriage of information or signal in some manner and include both a direct communication and an indirect communication;

(c)'communication link' means the use of satellite, microwave, radio, terrestrial line, wire, wireless or any other communication media to inter-connect computer resource;

(d)'competent authority' means -

(I) The Secretary in the Ministry of Home Affairs, in case of the Central Government; or

(II) The Secretary in charge of the Home Department, in case of a State Government or Union territory, as the case may be;

(e) 'Computer resource' means computer resource as defined in clause (k) of sub-section (1) of section 2 of the Act;

(f)'decryption' means the process of conversion of information in non-intelligible form to an intelligible form via a mathematical formula, code, password or algorithm or a combination thereof;

(g)'decryption assistance' means any assistance to -

(I) allow access, to the extent possible, to encrypted information; or

(II) Facilitate conversion of encrypted information into an intelligible form;

(h)'decryption direction' means a direction issued under rule 3 in which a decryption key holder is directed to -

(I)disclose a decryption key; or

(II)provide decryption assistance in respect of encrypted information

(i)'decryption key' means any key, mathematical formula, code, password, algorithm or any other data which is used to -

(I)allow access to encrypted information; or

(II)facilitate the conversion of encrypted information into an Intelligible form;

(j) 'decryption key holder' means any person who deploys the decryption mechanism and who is in possession of a decryption key for purposes of subsequent decryption of encrypted information relating to direct or indirect communications;

(k) 'information' means information as defined in clause (v) of sub-section (1) of section 2 of the Act;

(I) 'intercept' with its grammatical variations and cognate expressions, means the aural or other acquisition of the contents of any information through the use of any means, including an interception device, so as to make some or all of the contents of a information available to a person other than the sender or recipient or intended recipient of that communication, and includes—

(a)monitoring of any such information by means of a monitoring device;

(b)viewing, examination or inspection of the contents of any direct or indirect information; and

(c)diversion of any direct or indirect information from its intended destination to any other destination;

(m)'Interception device' means any electronic, mechanical, electro-mechanical, electro-magnetic, optical or other instrument, device, equipment or apparatus which is used or can be used, whether by itself or in combination with any other instrument, device, equipment or apparatus to intercept any information; and any reference to an "interception device' includes, where applicable, a reference to a 'monitoring device';

(n)'intermediary' means an intermediary as defined in clause (w) of sub-section (1) of section 2 of the Act;

(o)"monitor' with its grammatical variations and cognate expressions, includes to view or to inspect or listen to or record information by means of a monitoring device;

(p)'monitoring device means any electronic, mechanical, electro-mechanical, electro-magnetic, optical or other instrument, device, equipment or apparatus which is used or can be used, whether by itself in combination with any other instrument, device, equipment or apparatus, to view or to inspect or to listen to or record any information;

(q)'Review Committee' means the Review Committee constituted under rule 419A of Indian Telegraph Rules, 1951.

3. Directions for interception or monitoring or decryption of any Information — No person shall carry out the interception or monitoring or decryption of any information generated, transmitted, received or stored in any computer resource under Sub-section (2) of section 69 of the Act, except by an order issued by the competent authority;

Provided that in an unavoidable circumstances, such order may be issued by an officer, not below the rank of the Joint Secretary to the Government of India, who has been duly authorised by the competent authority;

Provided further that in a case of emergency-

(I) In remote areas, where obtaining of prior directions for interception or monitoring or decryption of information is not feasible; or

(II) for operational reasons. where obtaining of prior directions for interception or monitoring or decryption of any information generated, transmitted, received or stored In any computer resource is not feasible,

the interception or monitoring or decryption of any information generated, transmitted, received or stored in any computer resource may be carried out with the prior approval of the Head or the second senior most officer of the security and law enforcement agency (hereinafter referred to as the said Security agency) at the Central level and the officer authorised in this behalf, not below the rank of the Inspector General of Police or an officer of equivalent rank, at the Stale or Union territory level;

Provided also that the officer, who approved such interception or monitoring or decryption of information in case of emergency, shall inform in writing to the competent authority about the emergency and of such interception or monitoring or decryption within three working days and obtain the approval of the competent authority thereon within a period of seven working days and if the approval of competent authority is not obtained within the said period of seven working days, such Interception or monitoring or decryption shall cease and the information shall not be intercepted or monitored or decrypted thereafter without the prior approval of the competent authority.

4. Authorisation of agency of Government- The competent authority may authorise an agency of the Government to intercept, monitor or decrypt information generated, transmitted, received or stored in any computer resource for the purpose specified in sub-section (1) of section 69 of the Act.

5. Issue of decryption direction by competent authority — The competent authority may, under rule 3 give any decryption direction to the decryption key holder for decryption of any information involving a computer resource or part thereof.

6. Interception or monitoring or decryption of information by a State beyond its Jurisdiction— Notwithstanding anything contained in rule 3, if a State Government or Union territory Administration requires any interception or monitoring or decryption of information beyond its territorial jurisdiction, the Secretary in-charge of the Home Department in that State or Union territory, as the case may be, shall make a request to the Secretary in the Ministry of Home Affairs, Government of India for issuing direction to the appropriate authority for such interception or monitoring or decryption of information.

7. Contents of direction — Any direction issued by the competent authority under rule 3 shall contain reasons for such direction and a copy of such direction Shall be forwarded to the Renew Committee within a period of seven working days.

8. Competent authority to consider alternative means in acquiring Information- The competent authority shall, before issuing any direction under rule 3, consider possibility of acquiring the necessary information by other means and the direction under rule 3 shall be issued only when it is not possible to acquire the information by any other reasonable means.

9.Direction of interception or monitoring or decryption of any specific information— The direction of interception or monitoring or decryption of any information generated, transmitted, received or stored in any computer resource shall be of any information as is sent to or from any person or class of persons or relating to any particular subject whether such information or class of information are received we one or more computer resources, or being a computer resource likely to be used for the generation, transmission, receiving, storing of information from or to one particular person or one or many set of premises, as may be specified or described in the direction.

10.Direction to specify the name and designation of the officer to whom information to be disclosed — Every directions under rule 3 shall specify the name and designation of the officer of the authorised agency to whom the intercepted or monitored or decrypted or stored information shall be disclosed and also specify that the use of Intercepted or monitored or decrypted information shall be subject to the provisions of sub-section (1) of section 69 of the said Act.

11.Period within which direction shall remain in force — The direction for interception or monitoring  or decryption shall remain in force, unless revoked earlier, for a period not exceeding sixty days from the date of its issue and may be renewed from time to time for such period not exceeding the total period of one hundred and eighty days.

12. Authorised agency to designate nodal officer— The agency authorised by the competent    authority under rule 4 shall designate one or more nodal officer, not below the rank of Superintendent of Police or Additional Superintendent of Police or the officer of the equivalent rank, to authenticate and send the requisition conveying direction issued under rule 3 for interception, or monitoring or decryption to the designated officers of the concerned intermediaries or person in-charge of computer resource;

Provided that an officer, not below the rank of Inspector of Police or officer of equivalent rank, Shall deliver the requisition to the designated officer of the Intermediary.

13. Intermediary to provide facilities, etc.— (1) The officer issuing the requisition conveying direction issued under rule 3 for interception or monitoring or decryption of information shall also make a request in writing to the designated officers of intermediary or person in-charge of computer resources, to provide all facilities, co-operation and assistance for interception or monitoring or decryption mentioned in the direction.

(2)On the receipt of request under sub-rule (1), the designated officers of intermediary or person in-charge of computer resources, shall provide all facilities, co-operation and assistance for interception or monitoring or decryption of information mentioned in the direction.

(3)Any direction of decryption of information issued under rule 3 to intermediary shall be limited to the extent the information is encrypted by the intermediary or the intermediary has control over the decryption key.

14.Intermediary to designate officers to receive and handle requisition— Every intermediary or  person in-charge of computer resource shall designate an officer to receive requisition, and another officer to handle such requisition, from the nodal officer for interception or monitoring or decryption of information generated, transmitted, received or stored in any computer resource.

15.Acknowledgement of instruction — The designated officer of the intermediary or person in-charge of computer resources shall acknowledge the instructions received by him through letters or fax or email signed with electronic signature to the nodal officer of the concerned agency within two hours on receipt of such intimation or direction for interception or monitoring or decryption of information.

16.Maintenance of records by designated officer— The designated officer of intermediary or person  in-charge of computer resource authorised to intercept or monitor or decrypt any information shall maintain proper records mentioning therein, the intercepted or monitored or decrypted information, the particulars of persons, computer resource, e-mail account, website address. etc whose information has been intercepted or monitored or decrypted, the name and other particulars of the officer or the authority to whom the intercepted or monitored Of decrypted information has been disclosed, the number of copies, including corresponding electronic records of the intercepted or monitored or decrypted information made and the mode or the method by which such copies, including corresponding electronic record are made, the date of destruction of the copies, including corresponding electronic record and the duration within which the directions remain in force.

17. Decryption key holder to disclose decryption key Or provide decryption assistance— If a decryption direction or a copy thereof is handed to the decryption key holder to whom the decryption direction is addressed by the nodal officer referred to in rule 12, the decryption key holder shall within the period mentioned in the decryption direction -

(a) disclose the decryption key; or

(b) provide the decryption assistance,

Specified in the decryption direction to the concerned authorised person.

18. Submission of list of Interception or monitoring or decryption of information— (1) The designated officers of the intermediary or person in-charge of computer resources shall forward in every fifteen days a list of interception or monitoring or decryption authorisations received by them during the preceding fortnight to the nodal officers of the agencies authorised under rule 4 for confirmation of the authenticity of such authorizations.

(2) The list referred to in sub-rule (1) shall include details, such as the reference and date of orders of the concerned competent authority including any order Issued under emergency cases, date and time of receipt of such order and the date and time of implementation of such order.

19. Intermediary to ensure effective check In handling matter of Interception or monitoring or decryption of Information— The intermediary or the person n-charge of the computer resource so directed under rule 3, shall provide technical assistance and the equipment including hardware, software, Firmware, storage, interface and access to the equipment wherever requested by the agency authorised under rule 4 for performing interception or monitoring or decryption including for the purposes of-

(I)the installation of equipment of the agency authorised under rule 4 for the purposes of interception or monitoring or decryption or accessing stored information in accordance with directions by the nodal officer; or

(II)the maintenance, testing or use of such equipment; or

(III)the removal of such equipment; or

(iv) the performance of any action required for accessing of stored information under the direction issued by the competent authority under rule 3.

20. Intermediary to ensure effective check In handling matter of interception or monitoring or decryption of Information— The intermediary or person in-charge of computer resources shall put in place adequate and effective internal checks to ensure the unauthorised interception of information does not take place and extreme secrecy is maintained and utmost care and precaution shall be taken in the matter of interception or monitoring or decryption of information as it affects privacy of citizens and also that it is handled only by the designated officers of the intermediary and no other person of the intermediary or person in-charge of computer resources shall have access to such intercepted or monitored or decrypted information.

21. Responsibility of Intermediary— The intermediary or person in-charge of computer resources shall be responsible for any action of their employees also and in case of violation pertaining to maintenance of secrecy and confidentiality of information or any unauthorized interception or monitoring or decryption of information, the intermediary or person in-charge of computer resources shall be liable for any action under the relevant provisions of the laws for the time being in force.

22. Review of directions of competent authority— The Review Committee shall meet at least once in two months and record its findings whether the directions issued under rule 3 are in accordance with the provisions of sub-section (2) of section 69 of the Act and where the Review Committee is of the opinion that the directions are not in accordance with the provisions referred to above, it may set aside the directions and issue order for destruction of the copies, including corresponding electronic record of the intercepted or monitored or decrypted information.

23. Destruction of records of Interception or monitoring or decryption of information— (1) Every record, including electronic records pertaining to such directions for interception or monitoring or decryption of information and of intercepted or monitored or decrypted information shall be destroyed by the security agency in every six months except in a case where Such information is required, or likely to be required for functional requirements.

 (2) Save as otherwise required for the purpose for any ongoing investigation, criminal complaint or legal proceedings, the intermediary or person in-charge of computer resources shall destroy records pertaining to directions for Interception of information within a period of two months of discontinuance of the Interception or monitoring or decryption of such information and in doing so they shall maintain extreme secrecy.

24. Prohibition of interception or monitoring or decryption of information without authorisation —  (1) Any person who intentionally or knowingly, without authorisation under rule 3 or rule 4, intercepts or attempts to intercept, or authorises or assists any other person to intercept or attempts to intercept any information in the course of its occurrence or transmission at any place within India, shall be proceeded against and punished accordingly under the relevant provisions of the laws for the time being in force.

(2) Any interception, monitoring or decryption of Information in computer resource by the employee of an intermediary or person in-charge of computer resource or a person duly authorised by the intermediary, may be undertaken in course of his duty relating to the services provided by that intermediary, if such activities are reasonably necessary for the discharge his duties as per the prevailing industry practices, in connection with the following matters, namely-

(I) installation of computer resource or any equipment to be used with computer resource; or

(II) operation or maintenance of computer resources; or

(III) installation of any communication link or software either at the end of the intermediary or subscriber, or installation of user account on the computer resource of intermediary and testing of the Same for its functionality;

(iv)accessing stored information from computer resource relating to the installation, connection or maintenance of equipment, computer resource or a communication link or code; or

(v)accessing stored information from computer resource for the purpose of—

(a)implementing information security practices in the computer resource;

(b)determining any security breaches, computer contaminant or computer virus;

(c)undertaking forensic of the concerned computer resource as a part of investigation or internal audit, or

(iv) accessing or analysing information from a computer resource for the purpose of tracing a computer resource or any person who has contravened, or is suspected of having contravened or being likely to contravene, any provision of the Act that is likely to have an adverse impact on the services provided by the intermediary.

(3) The intermediary or the person in-charge of computer resource and its employees shall maintain strict secrecy and confidentiality of information while performing the actions specified under sub- rule (2)

25. Prohibition of disclosure of intercepted or monitored or decrypted information — (1) The contents of intercepted or monitored or stored or decrypted information shall not be used or disclosed by intermediary or any of its employees or person in-charge of computer resource to any person other than the intended recipient of the said information under rule 10.

(2)The contents of intercepted or monitored or decrypted information shall not be used or disclosed by the agency authorised under rule 4 for any other purpose, except for investigation or sharing with other security agency for the purpose of investigation or in judicial proceedings before the competent court in India.

(3)Save as otherwise provided in sub-rule (2), the contents of intercepted or monitored or decrypted information shall not be disclosed or reported in public by any means, without the prior order of the competent court in India.

(4)Save as otherwise provided in Sub-rule (2), strict confidentiality shall be maintained in respect of direction for interception, monitoring or decryption issued by concerned competent authority or the nodal officers.

(5)My Intermediary or its employees or person in-charge of computer resource who contravenes provisions of these rules shall be proceeded against and punished accordingly under, the relevant provisions of the Act for the time being in force.

(6)Whenever asked for by the concerned security agency at the Centre the security agencies at the State and the Union territory level shall promptly share any information which they may have obtained following directions for interception or monitoring or decryption of any information generated, transmitted, received or stored in any computer resource under rule 3, with the security agency at the Centre.

                                                                                                              Sd/-                      

[No.9(16/2004-EC)]                                                                                                                                N. RAVI SHANKER, Jt. Secy

Chinese hacked Obama, McCain campaigns, took internal documents, officials say

By Michael Isikoff
National investigative correspondent

The U.S. secretly traced a massive cyberespionage operation against the 2008 presidential campaigns of Barack Obama and John McCain to hacking  units backed by the People’s Republic of China, prompting  high level warnings to Chinese officials to stop such activities,  U.S. intelligence officials tell NBC News.

....

“There’s been successful exfiltration of data from government agencies (by the Chinese) up and down Pennsylvania Avenue,” said Shawn Henry, who headed up the FBI’s probe of the 2008 attacks as the bureau’s chief of cyberinvestigations. 

Click here to read more ....

Microsoft and FBI strike blow against $500m cyber crime ring

Microsoft and the FBI say they have significantly disrupted a ring of botnets that has stolen $500 million in the last 18 months. 

The Citiadel botnet ring was made up of 1,400 individual botnets - networks of malware-infected PCs

....The ring had amassed some 5 million infected machines in over 90 countries. Organisations affected include American Express, Bank of America, Citigroup, Credit Suisse, PayPal and HSBC......

.....Citadel was developed using augmented source code from the Zeus toolkit. .....

....“Creating successful public-private partnerships –in which tools, knowledge and intelligence are shared– is the ultimate key to success in addressing cyber threats and is among the highest priorities of the FBI," McFeeley said......

Click here to read more ....

Hackers to be denied US entry under House cyber security Bill

.....Computer hackers who target US agencies and companies on behalf of countries such as China and Russia would be denied entry into the US and have their bank accounts frozen under legislation to be unveiled on Thursday.....

....This is putting a face to the criminals, Knight said in an interview. If you’re a foreign agent working on behest of a nation and participating in cybercrime, you will not be allowed a visa into the country, nor will your family.....


Click here to read more..

Researchers prove that light, sound can activate mobile malware

....Researchers have discovered a way to trigger and control malware on smartphones using sensory channels, like light, vibrations, music or other sounds...

.....The paper, titled “Sensing-Enable Channels for Hard-to-Detect Command and Control of Mobile Devices,” described one example in which music that blares from a speaker could cause compromised smartphones to carry out malicious activities at a sports event.

Attackers could instruct the malware to perform actions such as launch distributed denial-of-service attacks, interfere with other non-mobile networks in range....

...So, if an attacker was clever enough to make use of these tricks, it would make for an interesting story, or possibly bragging rights, but wouldn't give them a pass to wreak havoc undetected.

Click here to read more ....

Drupal breach compromises nearly one million accounts

.....Hackers ransacked the servers of Drupal.org, an open source content management platform, to plunder the sensitive information of nearly one million accounts. .....

......In a Wednesday blog post, Ross said usernames, email addresses, country information, and hashed passwords were exposed in the incident. All passwords were hashed, while only some were salted, an additional security layer where a sequence of symbols is added to passwords before they're hashed......

......As a safety measure, the company reset all passwords for its nearly one million accounts. ......

Click here to read more