Cybercure IT Support. Pembrokeshire.: May 2014

Friday 23 May 2014

Meet DarkCoin, the newest cryptocurrency

It’s not hard to understand the appeal of crypto currencies. It’s a fast and convenient way to buy drugs and launder money, which, to be clear, are not activities we condone in any way. The moral and legal implications of illegal transactions aren’t enough to serve as a deterrent to everybody, so it’s not surprising that cryptocurrencies continue to thrive.

The most famous brand of digital currency in existence is Bitcoin. If the Internet is to be believed, the first transaction using Bitcoin happened in 2010, when a Florida man named Laszlo Hanyecz exchanged 10,000 bitcoins for two Papa John’s pizzas. Since then, bitcoins have achieved a modest level of mainstream acceptance. Websites like Overstock and OKCupid are now accepting bitcoin payments and ATMs for the currency started popping up last year.

DarkCoin just passed Dogecoin to become the world’s fourth largest cryptocurrency.

However, as bitcoin becomes more ubiquitous, it’s gotten away from its intended purpose, which is to facilitate truly untraceable transactions. This is where Darkcoin comes in. The digital currency, which is being pushed as a more private alternative to bitcoin, is in the midst of a boom, multiplying its value ten-fold in just a month. According to Wired, it’s value has risen from 75 cents to $7 as combined coins total around $30 million. In terms of market capitalization, DarkCoin just passed Dogecoin to become the world’s fourth largest cryptocurrency.

While bitcoin has managed to manufacture a reputation for being more private than traditional currency, it has a security flaw that drives away some users. All transactions on the bitcoin network appears on a public ledger called the block chain.

“I believe the central problem with Bitcoin is that the public ledger, although a remarkable accomplishment, also allows a gross invasion of personal privacy by permanently listing all transactions the users have ever done publicly. I would imagine many groups are working to tie the addresses used to real identities and then following the money around to see what is happening with it,” said Darkcoin creator Evan Duffield in a blog post.

Darkcoin has improved on the Bitcoin system through a feature it calls Darksend. Any darkcoin transaction is automatically combined with the transaction of two other users so that it would be harder to analyze the blockchain.

“Darkcoin uses an extension built on top of the standard bitcoin protocol, to create merged anonymous transactions. When a user wants to send money to someone he simply will leave the ‘Use DarkSend’ checkbox checked, then the client will broadcast that it would like to add an input to the pool. These messages are broadcasted throughout the network and once there are enough inputs in that pool, the nodes know it’s time to send ‘outputs’ (where you want to send your money to). After those are gathered together, all users sign the transaction, then it is merged and broadcasted,” Duffield said.

While it is expected that there the cryptocurrency will attract a black market segment, it has also generated interest from legal businesses. A Canadian wine shop and a UK cannabis seeds seller (which is legal in the country) are among the first retailers to accept darkcoins.

Wednesday 21 May 2014

eBay becomes the latest online giant to own up to a password breach

Do you buy and sell stuff online?

If so, you've probably used eBay, which means you can soon expect an email containing bad news.

The online trading megabrand is the latest to suffer a database breach.

Well, to be more precise, eBay is the latest site to admit to a database breach, which apparently happened about three months ago:

eBay Inc. said beginning later today it will be asking eBay users to change their passwords because of a cyberattack that compromised a database containing encrypted passwords and other non-financial data. [...] The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth.

Actually, it's slightly worse than that, because it seems that the crooks didn't just prise loose the database file with some kind of database command injection.

eBay offered a very brief and vague explanation of how the attack happened, writing on its site that:

Cyberattackers compromised a small number of employee log-in credentials, allowing unauthorized access to eBay's corporate network, the company said.

It really does say that: the company said on its blog that the company said that crooks had broken in and wandered around.

Advice for eBay PR flacks: when you're writing your own blog article where you made a security blunder, avoid the temptation to refer to yourself in the third person.

It wasn't someone else that let the crooks in, it was you, so write in the first person: it sounds so much more as though you mean it.

A followup tweet links across to PayPal, eBay's payment processing arm, where you will read the comforting news that:

Extensive forensic research has shown no evidence of unauthorized access or compromise to personal or financial information for PayPal customers. PayPal customer and financial data is encrypted and stored separately, and PayPal never shares financial information with merchants, including eBay.

Good stuff.

Divide and conquer worked for Julius Caesar, who famously divided his empire in Gaul into three parts in order to be able to control it (OK, to keep it subjugated) more effectively.

Divide and conquer works in computer security, too.

If crooks have to break in to three different places, in three different ways, to be able to stitch together all your corporate data, then their job is tougher.

What to do?

The advice from eBay is to change your password right away, and we concur.

The company isn't saying how securely it stored your passwords (it just says they were "encrypted," though it probably means they were salted-and-hashed), so just how safe the stolen password data is against off-line attackers isn't clear.

And make sure you go for something long and strong, not a dictionary word, a well-known phrase or something easy to guess, like your dog's name.

It seems a bit sad to say, "Choose a strong password because that way you'll leave someone else to take the hit," but it's true: if you chose your password wisely, other people's passwords will be cracked first, because the crooks begin with the most likely passwords when they start cracking.

So use the time to get ahead of the password crackers, and update your password now.

And if you used the same password on any other site, change that one too.

BUT YOU DIDN'T DO THAT, DID YOU?

Monday 19 May 2014

First Aid for Android: How to unlock your ransomed phone

We all dread the moment that our computers freeze up on us.

I'm not talking about a Blue Screen of Death or a Kernel Panic.

Those are bad enough, especially if you had just finished the perfect, final draft of a document but hadn't yet hit [Save].

But even after a disorderly and unexpected shutdown of that sort, your computer will generally start back up again, usually automatically, and you can carry on where you left off.

Minus your document, of course.

What's worse than a crash is when the system stays alive, but freezes or locks up so you can't do anything useful.

It could be a misbehaving application that accidentally hogs all your system resources and won't shut down, or it could be malware that deliberately pops up over everything else, hoping to strongarm you into paying a ransom for some sort of deactivation code that will give you back control of your computer.

Either way, rebooting might do the trick, but not if the errant software loads up before you have time to intervene and uninstall it.

If that happens, you may get stuck in an infinite loop of reboot-freeze-reboot-freeze.

Fortunately, most desktop operating systems have a way around this: if all else fails, you can use a special boot CD or USB key, such as Sophos Bootable Anti-Virus, to restart your computer without running any software from your hard disk at all.

Not all faults or infections can be sorted out like this (for example, if you have a failing hard disk, or malware that scrambles your files, like CryptoLocker).

But if all that's in the way is a dodgy program that loads up early and then protects itself from being uninstalled, a clean boot can work wonders.

What about Android?

The question is, however: what about Android devices?

With fake anti-virus and "police warning" ransomware now a real-world threat on Android, it's not impossible that you might be faced with just this sort of problem on your phone or tablet: a working device, but where the only usable app is asking you to pay $300 to make it go away.

Here's the "police warning" ransomware known as Andr/Koler-A, for example, trying to squeeze you for a $300 MoneyPak voucher in return for uninstalling itself:

Koler effectively locks your phone with a pop-over browser window, like the one you see above, that quickly reappears if you try to get rid of it.

The continually reappearing pop-over window makes it as good as impossible to get into the Settings menu to remove the malware, and a plain reboot won't help, because the malware comes back to life early in the restart.

But you can't reboot your Android from a CD or USB key, so what to do?

Android "Safe Mode"

Here's a technique that may get you out of trouble.

It might not always do the trick, but (at least on recent versions of Android) it has three handy benefits:

It doesn't require any special technical skills to carry out.
It doesn't require you to have installed any special software before the problem happened.
If it doesn't work, you can go back to where you were and be no worse off than you were before.

It's called "Safe Mode," and it's similar to safe mode in Windows, where your system starts up without loading any third-party add-ons.

In theory, if your phone isn't rooted (i.e. you haven't deliberately modified it so apps can be promoted to run with root, or system-level privilege), then no third-party apps you have installed should be able to trick the system into loading them in Safe Mode.

So booting into Safe Mode means you should always be able to get into the list of downloaded apps, malware or not, and remove unwanted ones.

(If a malware app doesn't launch in the first place, it can't fire up any active "anti-anti-virus" protection to shield itself from uninstallation.)

Booting into Safe Mode

Life would be much easier if all vendors had agreed on a standardised way to engage Safe Mode, preferably from a cold restart (i.e. after a power-off).

But they haven't, so you will have to plough through the techniques below until you find one that works for your device/version combination.

Method 1

(Reported to work on Google devices and various Android Open Source Project, or AOSP, derivatives like CyanogenMod.)

Press and hold the power button as you would to power down or reboot.
A menu will pop up.
Tap and hold the "Power off" option.
If nothing happens try the same with "Reboot".
A dialog should appear offering you to reboot in Safe Mode.

Method 2

(Reported to work on Samsung Galaxy S4.)

Power down.
Turn on and repeatedly tap the soft-button for "Menu."

Method 3

(Reported to work on Samsung Galaxy S3 and others)

Power down.
Turn on, then press and hold Volume Down (Galaxy S3 and others), Volume Up (HTC One and others), or Volume Down and Volume Up together (various Motorola devices) when the vendor's logo appears.

If you have managed to select Safe Mode, you will see the text "Safe Mode" at the bottom left corner of the screen.

To get out of Safe Mode, try simply rebooting.

If that doesn't work, try rebooting using one of the button-press options listed above, starting with the one you used to engage Safe Mode in the first place.

What to do when "Safe Mode" is active

Here's a practical example, removing the abovementioned Koler malware from an infected Android tablet.

This variant of the malware installs itself under the name BaDoink (apparently the name of a well-known online porn service), like this:

After booting into Safe Mode, third-party apps will no longer show up on the Apps page, as you can see here:

Go instead to the Settings menu and choose Apps:

This will bring up a list of downloaded (third-party) apps, including the Koler-infected BaDoink:

Tap on BaDoink; this won't run it, but will open up the program's App Info screen:

Tap on Uninstall, and you are almost home:

Choose [OK] to uninstall and you are done.

You may now reboot out of Safe Mode.

Hope this helps!

Android "police warning" ransomware - how to avoid it

The rise of ransomware

Ransomware has become a hot topic in recent years.

One sort, such as the Reveton family, leaves your data intact but locks you out of your computer, and demands a fee to let you back in.

The other main sort of ransomware, such as CryptoLocker, leaves your computer running fine but scrambles your data and demands a fee for the decryption key to get it back.

The fee is almost always $300 or thereabouts - the same sort of money that fake support callers charge - which seems to be the optimum price point: not so much that no-one will pay, and just within the reach of users who are desperate to get back to work quickly.

Well, in recent weeks, pay-to-unlock ransomware has made the leap to the Android ecosystem, and the recovery price is once again $300.

Introducing "Koler"

Perhaps the most talked-about ransomware for Android right now is known as "Koler", a threat that follows a very similar pattern to the Reveton malware mentioned above.

In fact, it looks as though the Reveton gang are the crooks behind Koler, following a criminal formula that has worked for them on Windows computers.

The malware is what's known as "policeware" or a "police locker," and it takes over your Android with a warning that claims you are under surveillance by federal agents for alleged criminal activity.

As soon as the malware pops up, it downloads and displays a warning screen saying that the police are accusing you of viewing illegal pornography.

The malware demands a ransom of $300, paid via MoneyPak, to unlock your phone.

Fortunately, Koler doesn't land on your Android entirely by surprise.

According to reports, the crooks are using the time-honored trick of telling you that you need to install a special "video player" app, and then offering it for download.

Note that because Koler has not made it into the Google Play Store, you need to have "Allow installation of apps from unknown sources" enabled in your Android security settings to be at risk.

As with Windows-based police warning ransomware, the malware can adapt the content it displays depending on your country or language settings.

Launching the malware in America, we were told that the warning came from "U.S.A. Cyber Crime Center" and "FBI Department of Defense" (which doesn't make sense because the FBI is not part of the DoD):

The screen shows some fake government seals, and a mashup of ripped-off images, including one of President Obama pointing an accusatory finger:

If that's not enough to scare you, the message informs you, in rather obviously illiterate English, that the government has tapped your phone for audio and video:

ATTENTION! Your phone has been blocked up for safety reasons listed below. All the actions performed on this phone are fixed. All your files are encrypted. CONDUCTED AUDIO AND VIDEO.

If you scroll down in the warning screen, you'll find a demand for $300 and instructions on how to pay the crooks to unlock your device:

Getting rid of Koler

The good news is that Koler doesn't scramble any of your data or exfiltrate audio and video as it claims; it merely locks your phone with a pop-over browser window that quickly reappears if you try to get clear of it.

The bad news is that the continually reappearing pop-over window makes it as good as impossible to get into the Settings menu to remove the malware.

Even rebooting won't help as the malware kicks back in early in the process of restarting.

A factory reset will get rid of it, but that also removes all your other installed apps and stored data.

Facebook 'ASK' Button

Being robotically nosey isn't good enough. Now, Facebook's recruiting our friends to poke their noses into our business.

Here's how it works.

Take a look at your friends on Facebook.

See any that have refrained from listing their romantic status? Where they work? Their hometown? Where they went to high school? Their birthday?

How dare they protect their privacy from phishers, data brokers and Facebook's targeted advertising!

Well, as of last week, Facebook has positioned "Ask" buttons next to fields our friends haven't filled out.

We can just click on the button next to those woefully blank fields, and Facebook will nag our privacy-hoarding friends for us, telling them that so-and-so requested their whatever - relationship status, blood type, maternal line of mitochondrial DNA ...

As Ars Technica points out, Facebook up until now has "directly, politely" asked us to fill out our interests and likes in certain categories, and to fill out personal history portions that we've left blank.

When we don't fill out those fields, Facebook makes automated, educated guesses about things such as where we work and where we went to school.

But the polite, direct route must not have proved sufficient when it comes to feeding Facebook's data-hungry, targeted-ad fueled engines.

When you look at friends via your desktop browser, you'll see the "Ask" button on the profile's top-left "about" box wherever they've left pertinent information fields blank.

Those "Ask" buttons will also appear when clicking through a user's profile on mobile browsers, according to Ars.

A Facebook representative told Ars that the "Ask" feature has actually been rolled out in waves to users since January, though that rep couldn't answer whether it's been in the form of the "Ask" button that's now live across the site, or whether it's been a function that's been there but more buried.

I was thinking of clicking "Ask" to test out this new process of weaseling personal factoids out of cagey friends, but considering that all of my friends (well, OK, maybe just some of my friends!) read Naked Security's posts regarding Facebook and privacy, I figured they'd e-beat me up if I did.

Rightly so.

They know that to keep safe online, the less private information we share, the better. Why hand strangers intimate details about ourselves?

Rubik's Cube 40th Anniversary: 9 Facts Behind The Famous 3-D Puzzle

The Rubik's Cube celebrates its 40-year anniversary this year. Reuters/Laszlo Balogh

The Rubik’s Cube has finally hit its mid-life crisis as it reaches its 40th anniversary this year.

Invented in 1974 by Hungarian sculptor and architecture professor Erno Rubik, the Rubik’s cube has challenged and frustrated countless numbers of players who have ever picked up the 3-D toy puzzle. While the Rubik’s Cube reached its peak popularity in the 1980s, the more than 350 million cubes sold since then make it one of the best-selling toys of all time.

In celebration of the Rubik’s Cube’s 40th anniversary, International Business Times took a look back at the history to bring you some facts about the 3-D cube’s rise to fame.

Rubik’s Cube wasn’t the 3-D toy puzzle's original name

While the Rubik’s Cube is now known by the name of its inventor, the toy originally started out its life as the Magic Cube in Hungary. It was eventually licensed to Ideal Toy Corp. in 1979 and rebranded as the Rubik’s Cube before its appearance internationally in 1980.

Rubik’s Cube was patented in 1975

A year after Erno Rubik invented his then-named “Magic Cube,” he patented it in Hungary. However, prior to the invention of the Rubik’s Cube, an earlier attempt at a 2x2x2 rotational cube was invented by Larry Nichols in 1970, who later attempted to sue the Rubik’s Cube’s licensee, Ideal Toy Corp., in 1984 for patent infringement. While the Rubik’s 2x2x2 cube was found to infringe on Nichols’s patent, the original Rubik’s Cube was found to be not infringing.

There’s only one solution for a Rubik’s Cube, but many more ways to scramble one up

There’s only one solution to the Rubik’s Cube puzzle, where each side of the cube consists of the same colors. However, there are approximately 43 quintillion ways scramble the cube before playing.

Interest in the Rubik’s Cube resulted in the birth of speedcubing

After the Rubik’s Cube’s western release, players became increasingly interested in speed solving the 3-D toy puzzle. In 1982, the first world championship was held, fueling the speed solving craze known as speedcubing. Modern Rubik’s Cube competitions are currently governed by the World Cube Association

Despite the complexity of the Rubik’s Cube, humans have solved the Rubiks Cube in less than 6 seconds

For some players the Rubik’s Cube can take hours or days to solve. For others, solving the Rubik’s cube only takes minutes and for the best of the best, mere seconds. The current human record holder, Mats Valk of the Netherlands, solved the Rubik’s Cube in 5.55 seconds in 2013.

Robots have solved the Rubik’s Cube faster than humans

While Valk is certainly fast, he wasn't faster than the Cubestormer II robot, built from Lego kits, which solved the 3D puzzle in 5.27 seconds in 2011. However, the Cubestormer II’s record was shattered by its successor, the Cubestormer III, in March 2014, solving the 3D puzzle in 3.253 seconds.

The most moves needed to solve a Rubik’s cube was only found in 2010

Since the invention of the Rubik’s Cube, enthusiasts and researchers have searched for years for what is minimum number of moves necessary to solve the 3D puzzle. In July 2010, a team of researchers, with the aid of Google computing power, found that the Rubik’s Cube could be solved in just 20 moves.

Rubik’s Cube comes in more sizes smaller and larger than its original 3x3x3 design

Whether you love or hate the Rubik’s cube, there are now plenty of other versions available for all skill levels. Rubik’s Cubes as small as 2x2x2 and as large by 5x5x5 were created for those looking for more of a challenge.

It took a long time for Erno Rubik to solve his own puzzle the first time

Speedy Rubik’s cube players can solve the puzzle in seconds. It took Rubik himself almost a month to solve the puzzle after he invented it in 1974.

Sunday 18 May 2014

Intel vs AMD: which processor is best?

Your CPU is your PC's brain, so make sure you choose the right processor.

Buying a desktop computer can be a lengthy process involving many complex decisions, but none come with quite as much jargon as figuring out the best CPU.

Before you know it, you're drowning in talk of cores and clock speeds, socket types and memory controllers, Bulldozer, Piledriver and more.

While you'll need to consider at least some of these issues, there's an easier way to approach your purchasing problems. And that's to ignore the technical detail, just for the moment, and focus first on a more fundamental question: Intel vs AMD, which processors are the best for you?

You'll probably find that answering this is much more straightforward. And once you've made your choice, many other decisions about your new PC will fall into place, saving you plenty of time.

Intel vs AMD: Intel CPUs

If you're after performance above else (and you can afford the price tag) then Intel processors are generally a good choice.

The difference can be marginal, though. It may be even less significant if you're planning to spend time overclocking your chosen CPU, or if your target applications make good use of multiple cores - especially as AMD chips are generally priced much lower, which means you can sometimes get extra cores for less money.

Even opting for Intel's very latest Haswell CPUs won't deliver a major leap forward in desktop power, unfortunately. Haswell processors come with the same default clock frequencies as their predecessors, the same four cores (with the mainstream sockets). Performance might edge up by 10 per cent or so, but you're most probably not going to notice any difference.

It's not all bad news, of course, particularly if you're interested in mobile computing. Haswell CPUs have new sleep states and enhanced power management which promise a major leap forward in battery life.

For instance, you should be able to leave a Haswell system on active standby, regularly grabbing emails, downloading social media updates and more, for a whole seven days on a single charge: very impressive.

But on the desktop, even the top-of-the-range Intel Core i7-4770K really doesn't deliver much new (beyond requiring another new socket, meaning you can't drop it into an existing system). As our Intel Core i7-4770K review points out, it's "just barely any better than the processor it replaces", not good news when it also comes with a significant price premium - as we write, it's priced £228.

Intel vs AMD: which processor is better? — Intel's latest could make a big difference for mobile

Intel's latest technologies could make a real difference to mobile devices, then. But if you're looking for a desktop solution then the company's older Ivy Bridge products currently deliver the best mix of price and performance, and that's where its best deals are still to be found.

Intel vs AMD: the AMD competition

If you're wondering how it is that Intel can get away with desktop processors which have changed so little in previous years, the answer is simple: they just don't have much competition.

Partly that's because AMD has been trailing behind Intel for some time now, especially when it comes to desktop performance. While the company has promised a lot, they've singularly failed to deliver, and just can't compete with the best that Intel has to offer.

When there are new products, then like Intel, AMD are generally more focused on the mobile space. As we explained in our report on AMD's new A4, A6, A8 and A10 CPUs, for instance, the headline news is the 21 per cent claimed increase in graphics speed. More general desktop performance only edges up by perhaps 8 per cent.

This isn't quite the end of the story, though. While AMD's desktop CPUs generally lag a little behind the Intel competition, there are a few exceptions. Overclocking can reduce the gap still further, and low prices ensure that there are still some great AMD deals to be found.

What's more, AMD has a particularly interesting new technology, in the shape of its Kaveri chip. This uses a heterogeneous system architecture (thankfully better known as HSA) to not only combine a CPU and GPU in a single die, but also allow both processors to access the same areas of memory without waiting for the other to finish first.

The project has some other promising features, too, and while the end result might not immediately overtake the best Intel CPUs, the first Kaveri releases - due very soon - could bring back some real and much-needed competition to the desktop CPU market.

Intel vs AMD: which is best?

We've looked at the two product families, then - but which is best? It all depends on what you're looking for.

At the low end of the market, where price matters above all else, AMD offers some good deals. The AMD A4-5300 is available for under US$50 (you can buy an entire Socket FM-2-based PC for about US$300), and while its specifications don't impress - two cores only, a mere 1MB cache - if you'll mostly be using the system for email and browsing then it'll serve you very well.

Move up the price range and Intel begins to enter the picture with a product like the Intel Core i3-3225: dual core, 3MB cache, US$134 (about AU$146, £87). And if you prefer Intel and don't need a great deal of power then that might just about be enough.

Once again, though, AMD offers better value. The Socket AM3-based AMD FX-4130 is a particularly good deal: it's a similar speed to the Intel Core i3-3225, but the two extra cores will help with multi-threaded applications, and at £65 it's something like 25 per cent cheaper than Intel's offering.

If anything the AMD FX-6130 is even better, delivering 6 cores, with overclocking potential of 5GHz, and still at a very good price.

Excellent single core performance does mean that regular desktop systems will generally be better off with an Intel processor, though. If you don't need the flexibility of manual overclocking then we'd opt for the £127 Intel Core i5-3470, which offers both excellent single and multi-threaded performance. Meanwhile, the £153 Core i5-3570K is a speedy (and very overclockable) quad-core product with 6MB cache which still performs well today.

Moving beyond this price level won't make a great deal of sense for the average user, as you simply don't get the extra performance to justify the extra cost. But if you have the money, then the Ivy Bridge Intel Core i7-3770K still delivers quality performance, hyperthreading and a fully unlocked CPU multiplier.

This could all change quite soon, of course, particularly with AMD's Kaveri technology. Can it help to bring some real competition back to the desktop CPU world? Just keep an eye on our reviews and news pages and we'll keep you up-to-date.