Sleepless in Midland

Cyber-insecurity -- is anything safe online anymore?

I started this post before the revelation about KRACK and the world wide vulnerability of the WPA2 protocol described in KRACK in Wi-Fi security: Everything you need to know and in articles elsewhere around the 'net. When there is this much attention paid to a tech problem then hopefully a easy fix is right around the corner.

But what about all those companies that get hacked? It seems that hardly a week goes by during which we DON'T hear about some big corporation losing all its customers' personal information to hackers. See, for example, Russian hackers reportedly found using Kaspersky software, Equifax website borked again, this time to redirect to fake Flash update, and get this, Secret files on jets and navy ships stolen in 'extensive and extreme' hack.

Yegads! Not our military secrets too! Apparently so.

Take a gander at this warning from this June 2017 blackhat.com survey: Portrait of an imminent cyberthreat.  Intro: Cyber attacks on US enterprises and critical infrastructure are coming soon, according to some of the industry’s most experienced and highly informed security professionals. And in most cases, defenders are not prepared.

The survey reveals a wide range of insights, including:

1. 60% of respondents believe that a successful cyber attack on US critical infrastructure will occur in the next two years. Only 26% are confident that U.S. government and defense forces are equipped and trained to respond appropriately.
2. 69% of IT security professionals believe that state-sponsored hacking from countries such as Russia and China has made US enterprise data less secure.
3. Only 26% of information security pros believe that the new White House administration will have a positive impact on cybersecurity policy, regulation, and law enforcement over the next four years.
4. About two-thirds of respondents think it’s likely that their own organizations will have to respond to a major security breach in the next 12 months. Sixty-nine percent say they don’t have enough staff to meet the threat; 58% believe they don’t have adequate budgets.
5. IT security professionals’ greatest concerns are around phishing and social engineering (50%) and sophisticated attacks targeted directly at their own organizations (45%).
6. The increased use of ransomware remains the most serious new threat faced by cybersecurity professionals, cited by 36% of respondents.

Take a look at number 5 again. "Security professionals’ greatest concerns are around phishing and social engineering (50%)..." Boy! If there's one thing Hillary Clinton, et al, taught us it's that we shouldn't fall for phishing schemes.

------

10:46 AM 10/17/2017

Fairly or unfairly, Kaspersky Lab is hobbled by work of Russian spies

Reading this article -- Local governments keep using this software — but it might be a back door for Russia -- one comes away with a heavy suspicion that the Kaspersky Lab could be a participant in all this Russian spying that is supposed to be going on.

Maybe the company is being judged guilty by association. And maybe they are as independent from the Russian government as they claim to be.

But from the article, there's this:

The federal agency in charge of purchasing, the General Services Administration, this month removed Moscow-based Kaspersky Lab from its list of approved vendors. In doing so, the agency’s statement suggested a vulnerability exists in Kaspersky that could give the Russian government backdoor access to the systems it protects, though they offered no explanation or evidence of it. Kaspersky has strongly denied coordinating with the Russian government and has offered to cooperate with federal investigators.

Lack of evidence certainly hasn't diminished the claims that President Trump colluded with Russians to win the election. Maybe those making that claim are seeking consistency by applying the same standard to Kaspersky.

However, this seems relevant:

James Lewis, a cybersecurity expert at the Center for Strategic and International Studies in Washington, said “it's difficult, if not impossible” for a company like Kaspersky to be headquartered in Moscow “if you don't cooperate with the government and the intelligence services.”

In any event, for those of us out here in flyover country who are sufficiently frightened by the almost weekly headline about huge data breaches, it's better to be safe than sorry.

------

1:23 PM 7/24/2017

Electronic medical records -- still full of bugs

It must have seemed like a good idea back in the days before we began seeing almost weekly reports of major internet hacks, massive information hijacking, and ransomware demands. Well, what do you know, here's one right here: The Latest: Pennsylvania health company restoring network.

Who could have seen this cyber-catastrophe coming? Plenty did. See How Electronic Medical Records Exploded In Doctors’ Faces And Politicians Got Off Scot-Free. That article concentrated more on government ineptitude than on cyber-crimes, although, to be fair, it's not clear which is worse.

Meanwhile, the folks at Sophos.com have a modest proposal: Is it time for cash for medical “Clunkers”?. Such a program would have the government buy up those antiquated Windows XP computers still favored among medical professionals to encourage them to upgrade their systems.

But is more government spending the answer? The medical professions seems to devote a great deal of effort in warding off or limiting malpractice suits. So maybe a few well placed lawsuits might be the factor motivating upgrades. Oh, and get the government out of healthcare, while you're at it.

------

1:31 PM 6/28/2017

Crashoverride -- malware that blacked out parts of Ukraine identified as still a threat

It's a hot day today in sunny West Texas with temps projected to reach 101°F. Thank goodness for air conditioners. There's a price to pay for this luxury, though. However, there's one thing worse than those outrageously expensive summertime electricity bills. That would be a blackout with no electricity at all.

The fear of an emp attack is real enough. But there's a simpler way for an enemy to sabotage the electric grid -- malware like the one that was used against Ukraine.

Cybersecurity companies ESET and Dragos Inc. have released information about Crashoverride, the malware that did the dirty deed. Read all about it at any of these articles:

Lights out: How Crash Override hits power grids -- hard. Excerpt:

Attacks targeting infrastructure can lead to chaos, like when engineers hacked into Los Angeles' traffic signal system and purposely created traffic jams. The researchers who discovered Industroyer warn it can be used to do significant damage to electrical power systems, and can be modified to hit other kinds of infrastructure. That makes it the biggest threat to industrial systems since Stuxnet in 2010.

'Crash Override': The Malware That Took Down a Power Grid. Excerpt:

The researchers say this new malware can automate mass power outages, like the one in Ukraine’s capital, and includes swappable, plug-in components that could allow it to be adapted to different electric utilities, easily reused, or even launched simultaneously across multiple targets. They argue that those features suggest Crash Override could inflict outages far more widespread and longer lasting than the Kiev blackout.

Found: “Crash Override” malware that triggered Ukrainian power outage Excerpt.

What makes Crash Override so sophisticated is its ability to use the same arcane technical protocols that individual electric grid systems rely on to communicate with one another. As such, the malware is more notable for its mastery of the industrial processes used by global grid operators than its robust code. Its fluency in the low-level grid languages allowed it to instruct Ukrainian devices to de-energize and re-energize substation lines, a capability not seen in the attack a year earlier that used a much cruder set of tools and techniques. The concern is that "Industroyer"—the other name given to the malware—can be used against a broad range of electric systems around the world.

Or, if you are a serious student of the subject, go to Dragos' 35 page PFD at CRASHOVERRIDE -- Analyzing the Threat to Electric Grid Operations.

Let's hope those in control at the utility companies are not complacent about the potential catastrophe that could follow a major power disruption.

------

12:54 PM 6/13/2017

Does the government have a duty to warn us of malware vulnerabilities?

Those agencies warning us of global warming and saturated fats act as if they have such a duty to warn, although there doesn't seem to be any penalty for failure.

Anecdotally, the movies are rife with scenes in which a law enforcement officer warns a mobster under surveillance that there's a contract out on him. Does that really happen? Don't know.

But how about malware vulnerabilities on someone's computer which the government knows about? It could be subverted by the agency into a spy tool. Or they could warn the individual or company of the danger. Apparently, that's an ethical dilemma they are trying to navigate.

This is brought to our attention in The Zero-Day Dilemma: Should Government Disclose Company Cyber Security Gaps?.

In that article Levi Maxey provides both sides of the issue. On one hand, the possibility that the vulnerability is discovered by someone inclined to misuse it isn't that great. On the other hand, an agency with knowledge about it may itself be vulnerable to Snowden like spies. But they have no duty to disclose it to the vulnerable entity.

It's a jungle out there on the net. The best advice is to keep operating systems and software, especially antivirus software, updated.

Yahoo email keeps you logged in by default -- is that safe?

It's common knowledge that Yahoo has experienced major hacks in recent years. And law enforcement has ferreted out some of the perpetrators. See US charges two Russian spies and two hackers in Yahoo data breach. They used phishing attacks and forged cookies in the commission of their criminal endeavors.

Those of us who still use Yahoo email, not knowing whether the barn door was eventually locked, are undoubtedly taking our own precautions. An easy one would seem to be to log out after each usage and delete Yahoo's cookies. But Yahoo wants users to stay logged in.

Look at the login page. The default is a check in the box that says "Stay logged in." That serves Yahoo, but it's hard to say whether the email user is protected with the connection open indefinitely. In any event, part of my login procedure is to uncheck that box. It might help, but it couldn't hurt.

Government is reluctant to allow civilians freedom to give hackers a taste of their own medicine

When it came to crimes against the person, governments, for the longest time, told the citizens not to fight back but to cooperate with criminals to minimize the harm they might do. That changed, and the citizens began to take control of their own safety. Civilians all across the nation began arming themselves in the name of self defense.

Currently, a victim of cybercrime can't do much but report it and make repairs. But maybe that's changing, too, as we learn that Rep. Tom Graves (R-GA) has proposed a billed called the Active Cyber Defense Certainty Act (ACDC). From his news release:

The bill makes changes to the Computer Fraud and Abuse Act (CFAA) to allow the use of limited defensive measures that exceed the boundaries of one’s network in an attempt to identify and stop attackers. Once a cybercriminal is identified, the victim can share that information with law enforcement or try to disrupt an ongoing attack.

The enhanced flexibility will allow individuals and the private sector to develop and use tools that are currently restricted under the CFAA to protect their own network. Additionally, by allowing defenders to develop and deploy new tools, it will also serve as a disincentive for criminal hacking.

“This bill is about empowering individuals to defend themselves online, just as they have the legal authority to do during a physical assault,” said Rep. Graves.  “While the bill doesn’t solve every problem, it’s an important first step. I hope my bill helps individuals defend themselves against cybercriminals while igniting a conversation that leads to more ideas and solutions that address this growing threat.”

Oh sure, there could be missteps, and innocent people might get caught in the crossfire. Robert Chesney discusses some of the issues at Legislative Hackback: Notes on the Active Cyber Defense Certainty Act discussion draft.  One of them is obvious. An attack might proceed through several computers before it reaches the intended victim. A hackback might have to take the reverse route even though the owners of those computers may have also been innocent victims.

We worried about innocent victims when we armed civilians, too. There's always that risk. All the more reason for adequate training of those to whom the cyber-defensive tools are entrusted. Meanwhile, it would be satisfying revenge to picture a hacker staring at his computer realizing all his data have just been sent to the FBI through a reverse hack.

Some Yahoo email users got another hacking warning

Wait a minute. Didn't we just go through this?

Apparently some, but not all, Yahoo email users got another warning the other day from Yahoo about a breach. It's not clear what's new here, because the news report suggest the breaches occurred in 2013 through 2016 and that the culprit is a "state-sponsored actor." Excerpt:

In a statement, Yahoo tied some of the potential compromises to what it has described as the "state-sponsored actor" responsible for the theft of private data from more than 1 billion user accounts in 2013 and 2014. The stolen data included email addresses, birth dates and answers to security questions. ...

The malicious activity that was the subject of the user warnings revolved around the use of "forged cookies" — strings of data which are used across the web and can sometimes allow people to access online accounts without re-entering their passwords.

A billion users violated -- it might seem hard to put a price tag on that. Yahoo didn't do it in its 10Q (filed 11/09/16) which does say 23 class action suits have been filed. However, "the Company cannot reasonably estimate a range of possible losses ...".

But prospective buyer Verizon has number. See Verizon Said to Near Yahoo Deal at Lower Price After Hacks:

Verizon Communications Inc. is close to a renegotiated deal for Yahoo! Inc.’s internet properties that would reduce the price of the $4.8 billion agreement by about $250 million after the revelation of security breaches at the web company, according to people familiar with the matter.

That article goes on to say Verizon and Yahoo will share the potential liability, so maybe that's a guess that the total might come to $500 million. That comes to about $0.50 per customer. But that's before legal fees, court costs, and related expenses. So fellow Yahoo customers, don't go on a spending spree just yet.

More cold water on the Russia hacking story

Yesterday on these pages we noted that cyber expert John McAfee cast some serious doubt on the reports that Russia was involved in hacking the U.S. election. He's got some company.

Bloomberg.com has this: U.S. Intelligence Got the Wrong Cyber Bear in which Leonid Bershidsky comes just shy of calling the claims "fake news."

As part of his support of the theory he cites wordfence.com which contains this article, Election Hack Report FAQ: What You Need to Know which contains, among other things, this brief but conclusive summary:

Does the report prove that Russia Hacked the 2016 US Election?

No it does not. What Wordfence revealed on Friday is that the PHP malware sample that the US government provided is:

-An old version of malware. The sample was version 3.1.0 and the current version is 3.1.7 with 4.1.1 beta also available.
-Freely available to anyone who wants it.
-The authors claim they are Ukrainian, not Russian.
-The malware is an administrative tool used by hackers to upload files, view files on a hacked website, download database contents and so on. It is used as one step in a series of steps that would occur during an attack.

Wordfence also analyzed the IP addresses available and demonstrated that they are in 61 countries, belong to over 380 organizations and many of those organizations are well known website hosting providers from where many attacks originate. There is nothing in the IP data that points to Russia specifically.

In other words, it could have been the Russians. Or maybe not. The available evidence is inconclusive.

BTW, does anyone notice the similarity between the claims about intelligence agency consensus in the hacking case and claims of scientific community consensus on global warming? If the msm had been more responsible during the 2016 campaign and the warnings about global warning their customers might be less suspicious of their reports.

John McAfee throws cold water on theory that Russia was responsible for hacking

To believe the Obama administration's claim that Russia hacked certain individuals and institutions in order to influence the election one would have to believe that Russia wanted to get caught.

Security expert John McAfee made some cogent points in 'It's a FALLACY' John McAfee shuts down 'manipulative' FBI claims of Russian hacking. Here's the meat:

“When the FBI or when any other agency says the Russians did it or the Chinese did something or the Iranians did something – that's a fallacy,” said McAfee.

“Any hacker capable of breaking into something is extraordinarily capable of hiding their tracks. If I were the Chinese and I wanted to make it look like the Russians did it I would use Russian language within the code.

He makes it sound so easy. But he's probably right. However, that doesn't rule out the possibility that Russia really did do it and wanted everyone to know it. It's entirely possible Putin orchestrated the hacks not to influence the election but to demonstrate how capable Russia is and how weak and ineffectual the U.S. is. In that case, mission accomplished.

healthcare providers still using Windows XP make themselves vulnerability

Anyone who has visited a doctor's office or hospital may have caught a glimpse of the idle screen on a computer monitor. The last one I saw showed the Windows XP logo. Turns out there are lots of health care providers who still use Windows XP in spite of the lack of support from Microsoft. I concluded that Microsoft must have outsourced the right to help secure those old systems. But that was a wrong guess.

This comes to our attention today because of this article at NakedSecurity.sophos.com. See Windows XP ‘still widespread’ among healthcare providers:

Capture Billing, a medical billing organization based in South Riding, Virginia, estimates on its website that one in four of the world’s PCs still run Windows XP and it’s likely many healthcare facilities need to “take corrective action” immediately. The company warns that such organizations might be violating HIPAA.

Hackers who are able to sneak in ancient malware can go undetected by modern anti-virus software. But having an updated system is still no guarantee of safety. All it takes is a system connected to the internet and some gullible user clicking an unsafe email attachment. It was only a few months ago that Hollywood Presbyterian Medical Center got hacked and ended up paying ransom to get back access to their medical records.

John Podesta provided us with an opportunity to learn how to avoid getting hacked

Boy, did he pay a price! But it's a learning opportunity for us.

Apparently John Podesta had his email hacked, and as a result some emails that proved very embarrassing to Hillary Clinton and her campaign became public knowledge. The best I can determine is that he opened a phishing email, then opened an attachment containing malware. Big mistake.

Peter Mackenzie at Sophos.com provided a helpful lesson on how to avoid that outcome at Why you should be cautious of emails from friends or colleagues. He used a real life example with a bogus email that purportedly came from his solicitor.

It worked this way. A hacker hijacked his lawyer's email address and sent phishing emails to Mr. Mackenzie and maybe other clients. The email contained what looked like a legitimate attachment, e.g., a contract for the client's approval. He rolled his cursor over the attachment link and found something suggesting it wasn't what it seemed. The pdf had an additional suffix: pdf.htm. Clicking on that led him to a link for a fake Gmail login page, but it didn't really go to a website, it was code included in the HTM file. If he had entered his login information it would have been forwarded to the hacker which would have given the hacker access to his email account.

The important take-away from this is to be especially wary of any pdf with an additional suffix, e.g., pdf.htm.

Read the whole thing and you'll be more knowledgeable than Hillary Clinton's most trusted adviser.

Computer bug catcher claims to make $250,000 per year -- if only they could guarantee bug free voting boxes

It seems that hardly a week goes by that we don't hear of some big company or government agency getting hacked with large caches of customer information or government secrets being purloined. It's as if nothing put in a computer is safe anymore.

Technologyreview.com tells us about a bug catcher who claims to make a quarter million a year, but that the work is tedious, and the payoff is typically much less. Excerpt:

Bug bounty programs have been around since 1995, but they’ve really taken off in the last few years, after Google and Facebook launched their initiatives in 2010 and 2011. Microsoft, Samsung, Uber, and Tesla (which pays for bugs found in its cars’ software) all have cash-for-bugs schemes. Apple, which was a holdout until earlier this month—and faced criticism for it—now says it will pay up to $200,000 per bug, but you have to be invited. Even the U.S. government got in on the trend earlier this year, with its Hack the Pentagon program.

The Department of Defense invited hackers to "identify vulnerabilities on a predetermined department system." And we can hope they can eliminate whatever is causing the massive NSA leakage. But that would probably be coincidental.

Here's a job for the bug catchers. We have a federal election coming up with most voters using computerized ballots. We generally assume that any cheating will benefit Democrats and that Republicans have to exceed the margin of fraud to win. But these days maybe we should simply accept the fact that hacking will occur and hope that the side we favor has the best hackers.

Problem with a criminal in the White House is her people won't cooperate with future FBI investigations

Who could have seen this coming? The FBI has a difficult task protecting the nation and the government from cyber espionage. The least we can do is help them when they ask.

Unfortunately, the Democrat nominee for president, Hillary Clinton, has her own problems with sloppy or no precautions against cybercriminals. And she is understandably shy about any new FBI inquiries. But this? Hillary refused to cooperate with the FBI investigation into her campaign being hacked:

The FBI warned the Clinton campaign that it was a target of a cyberattack last March, just weeks before the Democratic National Committee discovered it had been penetrated by hackers it now believes were working for Russian intelligence, two sources who have been briefed on the matter told Yahoo News.

In a meeting with senior officials at the campaign’s Brooklyn headquarters, FBI agents laid out concerns that cyberhackers had used so-called spear-phishing emails as part of an attempt to penetrate the campaign’s computers, the sources said. One of the sources said agents conducting a national security investigation asked the Clinton campaign to turn over internal computer logs as well as the personal email addresses of senior campaign officials. But the campaign, through its lawyers, declined to provide the data, deciding that the FBI’s request for sensitive personal and campaign information data was too broad and intrusive, the source said.

Yeah, I guess she has a right to remain silent. But it's disturbing that this is the person so many Americans want to be president.

Nothing online is safe anymore, even at your Panamanian lawyer's office

Businessinsider.com gushes about it in The largest leak of secret documents in history was just released — here are its key findings.

Apparently, someone hacked a huge cache of documents belonging to a Panamanian mega-law firm and released the contents to journalists. Some of the contents regarding offshore accounts held by government officials will certainly be tantalizing. But the information is still stolen property.

That's what's scary. Maybe readers can justify it by citing the nefarious dealings of people in fiduciary positions. But it drives home the point that nothing is secret anymore. Or if it is currently, it's susceptible to computer hackers.

Pity that poor law firm. They are in for pure hell from the clients who trusted them with their dearest financial secrets. I don't know what the law is in Panama about that, and maybe the client has to agree in advance that the lawyers won't be liable for stolen information even it it was preventable. But one would think that to secure the reputation it had, the law firm must have convinced the clients that their information was safe.

Was Vladimir Putin one of the clients? Boy, look out. When he says heads will roll, they may not literally roll. But people who cross him somehow end up in hospice care not long after.

Does anyone doubt that the Chinese have a way to decrypt iPhones

Customers in China probably make up a fairly large percentage of iPhone purchasers. So when Tim Cook preaches to the American audience about Apple's responsibility to protect information on iPhones, one wonders if foreign customers get the same respect.

We all know how repressive regimes like to keep tabs on their citizens, and it seems likely that if a particular product prevented that, it would be banned. Or more likely, the producer would be required to modify it so that the government could spy on it.

Maybe this is simply paranoid speculation. But it makes perfect sense.

As does this: A third party claims to have found a way to unlock an encrypted iPhone. Imagine that.

How long before hackers get into the vote counting software

The other day we were treated with news of a hospital in Los Angeles that paid ransom to hackers who hijacked the hospital's computer system. Seems that hardly a week goes by that we don't hear about some newsworthy hack. It's only a matter of time when we don't consider it newsworthy any more, just routine. See The hacked Hollywood hospital is not alone — schools and clinics across the country are increasingly being hacked for ransom and Hospital Hack Spotlights How Medical Devices and Systems Are at Risk.

As the big league bloggers say, it's a feature not a bug.

Anyway, most local election commissioners went to electronic voting very loudly and proudly several years ago. It was fool proof, they said. But honestly, is it really? If some of the most secure government systems are capable of being hacked, then if it hasn't already happened, votes can disappear, appear, or change, and we may not learn about it until long after the wrong person has been sworn into office. That's progress.

With hackers gaining access to 20,000 FBI employee details, how safe can local police information be?

One would think that information technology at the FBI would be about as secure as such a thing could be these days. So it's disturbing to see headlines like this: Hacker dumps thousands of files of FBI, DHS employees online.

There must be thousands of local law enforcement agencies that are similarly vulnerable. And maybe it's just a matter of time before their employee files are corrupted or purloined by a thief biding his/her time for just the right moment to expose the information.

It's a small consolation, but at least the FBI hack only pertained to employee information and not pending case files.

In any event, with the ease displayed there, hacking into Hillary Clinton's email server was probably child's play by comparison.

IRS phone scam -- if you're not content to just hang up, here's where to report them

We've all gotten those calls. It's a robot telling you the IRS is about to sue for non payment of a past due tax debt. Most us simply think, "F U," and hang up.

IRS publication IR-16-014 addresses those calls and alerts us to websites available for online reporting if hanging up doesn't quite satisfy the urge to get at them.

We don't know whether the IRS will actually do anything. Nonetheless, the Treasury Inspector General for Tax Administration has the IRS Impersonation Scam Reporting website which takes information about the attempted fraud. And it get a little bit of your own personal information, too.

Don't you just love giving personal information to the IRS? It's probably safe. But things like the following headline don't inspire confidence: IRS computer problems shut down tax return e-file system. Oh, brother. Maybe it's just a glitch. Then again, maybe it's a hack. Aside from the actual people involved with the system security or the hack itself, who really knows these days?

123456 holds onto 1st place as most used password

It's always fun to see the list of most common passwords gleaned from published lists of purloined passwords. The most recent top 25 can be found at teamsid.com.

The top two maintained their positions on the list: "123456" and "password." And here's a new one on the list at #24: "passw0rd." Get it? Very clever. They used a zero instead of an o. The program probably required at least one number or character other than letters. Problem solved!

Of course, most of the stuff we have to seal with a password isn't worth stealing anyway. But it's like locking a car door. There may be nothing in there, but the idea of a thief browsing around in our personal space can be disturbing -- even more so knowing they can change the lock.

Via Washingtonpost.com which contained an easily copied HTML list of those 25, to wit:

1) 123456
2) password
3) 12345678
4) qwerty
5) 12345
6) 123456789
7) football
8) 1234
9) 1234567
10) baseball
11) welcome
12) 1234567890
13) abc123
14) 111111
15) 1qaz2wsx
16) dragon
17) master
18) monkey
19) letmein
20) login
21) princess
22) qwertyuiop
23) solo
24) passw0rd (using zero)
25) starwars

I had to look up letmein. Sounded foreign. Nope. Let me in. Doh!

Scoundrels attack email providers with DDOS, demand ransom

Some of the smaller email providers seem to be vulnerable to DDoS attacks, and in at least one case the culprits got a modest payday. I say modest, and although $6,000 isn't hay, it pales in comparison to the millions hackers pilfered from banks in the past. Source: Naked Security.

The email service I've been using lately, Hushmail.com, was one of the victims. They were down for days, and their webpage said they weren't going to pay. DDoS attacks are still probably a threat, but at least they got the service back up and running.

Another case involved Protonmail which has in common with Hushmail a stated policy of attempting to protect clients from prying eyes. According to Protonmail's statement, they eventually paid the ransom due to the pressure they were getting from other companies that were tangentially affected due to use of the same ISP.

Email providers like Yahoo are probablly so big that they're basically immune to DDoS attacks. But the smaller outfits can't easily afford the cost of protecting themselves.

According to the aforementioned statement, the expense of protecting themselves runs about $100,000 annually. It's a racket on both ends.

Ultra secure password manager got hacked -- how long before our voting machines are compromised?

It seems as though major cybercrimes are coming along about once a week, at least the ones that get big news coverage.

The one last week was the news about LastPass. Here's CNN's take on it: Irony alert: Password-storing company is hacked. Yes, it does seem ironic that a company which consistently got good recommendations from techies, a company that is supposed to let users store all their passwords in one convenient spot, got hacked.

But that's what happened. LastPass released a public announcement on June 15 in which they said the following:

We want to notify our community that on Friday, our team discovered and blocked suspicious activity on our network. In our investigation, we have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed. The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised.

Sophos defines "salting" and "hashing" as follows:

Salting is where you add some random nonsense to the actual password text. So even if two users pick the same password, their password representations end up different. Hashing is where you scramble the salted password cryptographically and store the one-way scrambled version only.

They're presuming it would take the hackers a long time to get to a customer's original password with a standard computer with a brute force program. So LastPass is recommending that their customers change their passwords as soon as possible. Thinking hypothetically, if the hackers had also gotten the customers' data, they could eventually get access to it using the same type program regardless of what the customers did in the meantime.

While we're being worry warts, let's also wonder how long it will be before hackers compromise our elections through those computerized voting machines election administrators are so proud of. Experts say they're easy targets.

Brokeback Government -- OPM director's Twitter is more focused on LGBT pride than info breach

Yesterday we talked about the huge security breach that occurred at the U.S. Office of Personnel Management. While those of us out here in flyover country might think that's a pretty big deal, at look at the Twitter account of OPM Director, Katherine Archuleta, suggests that's not as important as something else.

That's right. It's LGBT pride month. And apparently the government has a new guidebook to help the troglodytes comprehend this rather large social movement. But it's not just a social movement. The guide tells us on page 3 that the EEOC has declared that the Civil Rights Act of 1964 provides protection against discrimination based on sexual orientation and gender identity.

Democrats got a lot of mileage out of that phony war-on-women talk, and now they've moved onto something else that might be useful -- embracing gay rights while mocking bake shop and pizzeria owners who are too slow to hop onto a speeding bandwagon.

Meanwhile, let's hope government workers don't get so exited about it that they let their guard down. Someone is out there plotting spear phishing expeditions to exploit employees who are so eager to open email documents that they look before they think.

Why would hackers want government personnel records?

Seems like everything in confidential files eventually ends up on hackers' hard drives. Why do they want all that information? Recently it was the IRS who fessed up to a loss of taxpayer data. Now it's the U.S. Office of Personnel Management's turn. Here's their news release. (See below for some useful tips from there.)

What will hackers do with all that information? Jeremy Wagstaff speculates for Reuters in Medical data, cybercriminals' holy grail, now espionage target. Excerpt:

Whoever was behind the latest theft of personal data from U.S. government computers, they appear to be following a new trend set by cybercriminals: targeting increasingly valuable medical records and personnel files.

This data, experts say, is worth a lot more to cybercriminals than, say, credit card information. And the Office of Personnel Management (OPM) breach revealed on Thursday suggests cyberspies may now also be finding value in it.

Credit card information is so easily obtainable on the black market that it isn't worth much these days, he says. But medical records are a different matter. Apparently, a person's medical records can gain access to drugs and medical devices at the expense of someone else.

The OPM news release focuses on something more likely, the possibility of future spear phishing expeditions to get further infiltrated into government computers. Here's their tip sheet:

Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.

Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person’s authority to have the information.

Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.

Do not send sensitive information over the Internet before checking a website’s security (for more information, see Protecting Your Privacy, http://www.us-cert.gov/ncas/tips/ST04-013).

Pay attention to the URL of a website. Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net).

If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group (http://www.antiphishing.org).

Install and maintain anti-virus software, firewalls, and email filters to reduce some of this traffic (for more information, see Understanding Firewalls, http://www.us-cert.gov/ncas/tips/ST04-004; Understanding Anti-Virus Software, http://www.us-cert.gov/ncas/tips/ST04-005; and Reducing Spam, http://www.us-cert.gov/ncas/tips/ST04-007).

Take advantage of any anti-phishing features offered by your email client and web browser.

Employees should take steps to monitor their personally identifiable information and report any suspected instances of identity theft to the FBI’s Internet Crime Complaint Center at www.ic3.gov.

Looks like good advice.

IRS got hacked -- too bad they didn't get Lois Lerner's emails

Is it any wonder that rational people have lost faith in the federal bureaucracy? We're learning now that the Internal Revenue Service has revealed that some taxpayers information was obtained by hackers from the IRS. See IRS hit by cyberattack, thousands of taxpayers’ information stolen. Lead paragraph:

Fraudsters stole private information from the IRS on more than 100,000 taxpayers and used it to bilk the agency of tens of millions of dollars, Commissioner John Koskinen said Tuesday — though he insisted the breach didn’t affect most Americans.

Well, of course 100,000 taxpayers is not "most Americans." But it's still a large number. Apparently, only those taxpayers who have enrolled at the IRS' Get Transcript program were affected. And it can't be comforting to know that hackers had access to the victims' tax returns for however far back the transcript access goes.

It's also not very comforting to think that all Obamacare patients' information will be kept by the IRS.

Now if only those hackers would publish those lost Lois Lerner emails.

Hillary figured out how to do what we would all like to do -- keep prying eyes out of her emails

That's something we all would like to have -- an email account that is truly private, not just from those annoying commercial services that scan for information useful for buyers of that data, but from the government's prying eyes.

The Clintons have found a way:

In most cases, individuals who operate their own email servers are technical experts or users so concerned about issues of privacy and surveillance they take matters into their own hands. It was not immediately clear exactly where Clinton ran that computer system.

Clinton has not described her motivation for using a private email account - hdr22(at)clintonemail.com, which traced back to her own private email server registered under an apparent pseudonym - for official State Department business.

Operating her own server would have afforded Clinton additional legal opportunities to block government or private subpoenas in criminal, administrative or civil cases because her lawyers could object in court before being forced to turn over any emails. And since the Secret Service was guarding Clinton's home, an email server there would have been well protected from theft or a physical hacking.

That's fine for private citizens Clinton. But it's not so fine for those of us out here in flyover land who expect honesty and transparency from so called "public servants" who increasingly appear to be looking out for themselves more so than for us.

The NSA probably has Hillary's emails, but expecting them to give them up to a Congressional subpoena would presume the agency isn't politicized.

Meanwhile, if the Clintons ever end up flat broke again, there's a business for them in email service providing. Although, customers would probably want to take a close look at their privacy policy.

Outfit that handles online non-profit filings for IRS hacked

Sometimes it seems as though nothing we submit online is safe from hackers.

The latest hacking news came from the company that accepts online 990 and 990-N filings from non-profit organizations for transmission to the IRS. Yesterday anyone who submitted such a filing online within the past few years received an email which started out this way, to wit:

The Urban Institute’s National Center for Charitable Statistics (NCCS) recently discovered that an unauthorized party or parties have accessed the Form 990 Online and e-Postcard filing systems for nonprofit organizations. This unauthorized access affected nonprofit users of IRS Forms 990, 990-EZ, and 990-N (e-Postcard). In addition, it affected users of Form 8868 extensions and filings for charitable organizations in Hawaii, Michigan, and New York.

We regret to inform you that the username, first and last name, email address, IP address, phone number, and password associated with your nonprofit organization were compromised in this incident.

Here's the web version of the warning.

It went on to say that they don't think the filings themselves were compromised and that users would be required to change their passwords the next time they logged in. That presumes the hackers have not already changed the passwords.

What would a hacker do with the information? Well, for starters, it's not hard to imagine some mischief making by radical lefties against conservative non-profits.

Meanwhile, let's take a glance at their Privacy Policy:

Personal Login Information: The personal information you provide to us when you request a login ID will not be given, sold, or otherwise provided to any individual or organization that is not involved with the 990-N (e-Postcard) process. This information (with the exception of your email address) WILL be made available to the IRS as part of the filing process. We do not send your email address to the IRS.

Oops.

Obama admin can't stop blabbing about its spying -- revealed how it knows North Korea hacked Sony

The Obama administration has been relentless in its attacks on leakers of information harmful to the administration.

But if something might make them look good, then strategic leaks put it all over the news. So we found out that the Stuxnet virus that hampered Iran's nuclear activity was a U.S. action. We found out the details of the raid that killed Osama bin Laden. Arguably, these things should have been keep close to the vest.

Here's another dirty little secret now public. We now know how the U.S. knew that North Korea hacked Sony's information system. See Why the US was so sure North Korea hacked Sony: it had a front-row seat. Excerpt:

According to the New York Times, a recently released top-secret document traces the NSA's infiltration back to 2010, when it piggybacked on South Korean "implants" on North Korea's networks and "sucked back the data". ...

Unidentified officials told the New York Times that the program snowballed, to the point that malware was placed to track the internal workings of many of the computers and networks used by North Korea's cyber forces: an army that South Korea’s military recently said has about 6,000 elite hackers.

But like a lot of surveillance, it didn't prevent anything, it just helped identify the culprits.

In any event, that particular avenue of information is now compromised. That leads us to speculate that either Obama administration desperately needed something to brag about, or they calculated that the elite North Korea hackers couldn't do anything worse than mess up Sony's computer system.

FBI unimpressed with evidence North Korea didn't hack Sony

The FBI said on December 19 that the North Korean govenment hacked Sony:

As a result of our investigation, and in close collaboration with other U.S. government departments and agencies, the FBI now has enough information to conclude that the North Korean government is responsible for these actions.

Then on December 29th, Norse Corporation said this:

The investigators believe the disgruntled former employee or employees may have joined forces with pro-piracy hacktivists, who have long resented the Sony’s anti-piracy stance, to infiltrate the company’s networks. ...

Norse plans to fully brief the FBI on the current status of their investigation early this week, and says it is up to law enforcement to decide if there is enough evidence to pursue the individuals identified.

The disclosure casts further doubt on the FBI’s assertion that the attack was carried out by state-sponsored actors under the control of North Korea, a theory that has been all but discredited by a host of security professionals over the last week, including former federal prosecutor Mark Rasch.

Then on December 30 Politico said this:

After FBI agents were briefed yesterday, they concluded the security company offering the alternate theory did not have an accurate understanding of all the evidence, a U.S. official familiar with the matter told POLITICO today.

The three-hour meeting with FBI investigators yesterday by cyber intelligence firm Norse “did not improve the knowledge of the investigation,” according to the U.S. official.

So who is right? We still don't know. It would be nice to think the FBI is the top expert in this field. But that's not a given.

On the other hand, it is a given that the FBI has digital dossiers on all of us, so it's nice to think that they may actually use that to clear someone of wrong doing.

If Obama claims North Korea hacked Sony -- Obama's history tells us to be suspicious

It was only two years ago that the Obama administration made a major screw-up in Benghazi. Americans were killed, and Obama, et al., lied about it blaming a video. The videographer went to jail, Hillary Clinton said "what difference does it make," and the Obama administration did some major stonewalling which continues to this day.

So now Obama, et al., blame North Korea for hacking Sony over a different video. Why should we believe him? He has done nothing to rehabilitate his credibility.

Now we see this in Daily Mail: North Korea was NOT behind the Sony hack according to multiple security experts who discredit FBI findings and reveal that a studio insider named 'Lena' may be responsible.

It's such a shame that the President of the United States has become so untrustworthy. There was a time when he could tell a lie that people believed. Those days are gone.

Now the question on people's minds is why Obama blamed North Korea. There's an ulterior motive that's not apparent just now, but we're sure to learn it eventually.