Tag Archives: Bitcoin

NotPetya Ransomeware Wreaking Havoc

Post Syndicated from Darknet original http://feedproxy.google.com/~r/darknethackers/~3/0IfKiBP5jIo/

The latest splash has been made by the Petya or NotPetya Ransomware that exploded in Ukraine and is infecting companies all over the World. It’s getting some people in deep trouble as there’s no way to recover the files once encrypted. The malware seems to be trying to hide it’s intent as it doesn’t really […]

The post NotPetya Ransomeware…

Read the full post at darknet.org.uk

Cybercrime Officials Shutdown Large eBook Portal, Three Arrested

Post Syndicated from Andy original https://torrentfreak.com/cybercrime-officials-shutdown-large-ebook-portal-three-arrested-170626/

Back in February 2015, German anti-piracy outfit GVU filed a complaint against the operators of large eBook portal Lul.to.

Targeted mainly at the German audience, the site carried around 160,000 eBooks, 28,000 audiobooks, plus newspapers and periodicals. Its motto was “Read and Listen” and claimed to be both the largest German eBook portal and the largest DRM-free platform in the world.

Unlike most file-sharing sites, Lul.to charged around 30,000 customers a small fee to access content, around $0.23 per download. However, all that came to end last week when authorities moved to shut the platform down.

According to the General Prosecutor’s Office, searches in several locations led to the discovery of around 55,000 euros in bitcoin, 100,000 euros in bank deposits, 10,000 euros in cash, plus a “high-quality” motorcycle.

As is often the case following significant action, the site has been completely taken down and now displays the following seizure notice.

Lul.to seized (translated from German)

Authorities report that three people were arrested and are being detained while investigations continue.

It is not yet clear how many times the site’s books were downloaded by users but investigators believe that the retail value of the content offered on the site was around 392,000 euros. By volume, investigators seized more than 11 terabytes of data.

The German Publishers & Booksellers Association welcomed the shutdown of the platform.

“Intervening against lul.to is an important success in the fight against Internet piracy. By blocking one of the largest illegal providers for e-books and audiobooks, many publishers and retailers can breathe,” said CEO Alexander Skipis.

“Piracy is not an excusable offense, it’s the theft of intellectual property, which is the basis for the work of authors, publishers, and bookshops. Portals like lul.to harm the media market massively. The success of the investigation is another example of the fact that such illegal models ultimately can not hold up.”

Last week in a separate case in Denmark, three men aged between 26 and 71-years-old were handed suspended sentences for offering subscription access to around 198 pirate textbooks.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Bitcoin, UASF… и политиката

Post Syndicated from Григор original http://www.gatchev.info/blog/?p=2064

Напоследък се заговори из Нета за UASF при Bitcoin. Надали обаче много хора са обърнали внимание на тия акроними. (Обикновено статиите по въпроса на свой ред са салата от други акроними, което също не улеснява разбирането им.) Какво, по дяволите, значи това? И важно ли е?

Всъщност не е особено важно, освен за хора, които сериозно се занимават с криптовалути. Останалите спокойно могат да не му обръщат внимание.

Поне на пръв поглед. Защото дава и сериозно разбиране за ефективността на някои фундаментални политически понятия. Затова смятам да му посветя тук част от времето си – и да изгубя част от вашето.

1. Проблемите на Bitcoin

Електронна валута, която се контролира не от политикани и меринджеи, а от строги правила – мечта, нали? Край на страховете, че поредният популист ще отвори печатницата за пари и ще превърне спестяванията ви в шарена тоалетна хартия… Но идеи без проблеми няма (за реализациите им да не говорим). Така е и с Bitcoin.

Всички транзакции в биткойни се записват в блокове, които образуват верига – така нареченият блокчейн. По този начин всяка стотинка (пардон, сатоши 🙂 ) може да бъде проследена до самото ѝ създаване. Адресите, между които се обменят парите, са анонимни, но самите обмени са публични и явни. Може да ги проследи и провери за валидност всеки, които има нужния софтуер (достъпен свободно) и поддържа „пълен възел“ (full node), тоест е склонен да отдели стотина гигабайта на диска си.

Проблемът е, че блокът на Bitcoin има фиксиран максимален размер – до 1 мегабайт. Той побира максимум 2-3 хиляди транзакции. При 6 блока на час това означава около 15 000 транзакции на час, или около 360 000 на денонощие. Звучи много, но всъщност е абсолютно недостатъчно – доста големи банки правят по повече транзакции на секунда. Та, от известно време насам нуждата от транзакции надхвърля капацитета на блокчейна. Което създава проблем за потребителите на валутата. Някои от тях започват да я изоставят и да се насочват към традиционни валути, или към други криптовалути. Съответно, влиянието и ролята ѝ спада.

2. Положението с решенията

Предлагани са немалко решения на този проблем. Последното се нарича SegWit (segregated witness). Срещу всички тях (и конкретно срещу това) обаче има сериозна съпротива от ключови фактори в Bitcoin.

Сравнително скоро след създаването на Bitcoin в него беше въведено правилото, че транзакциите са платени. (Иначе беше много лесно да бъдат генерирани огромен брой транзакции за минимална сума напред-назад, и така да бъде задръстен блокчейнът.) Всяка транзакция указва колко ще плати за включването си в блок. (Това е, което я „узаконява“.)

Кои транзакции от чакащите реда си ще включи в блок решава този, който създава блока. Това е „копачът“, който е решил целта от предишния блок. Той прибира заплащането за включените транзакции, освен стандартната „награда“ за блока. Затова копачите имат изгода транзакциите да са колкото се може по-скъпи – тоест, капацитетът на блокчейна да е недостатъчен.

В добавка, немалко копачи използват „хак“ в технологията на системата – така нареченият ASICBOOST. Едно от предимствата на SegWit е, че пречи на подобни хакове – тоест, на тези „копачи“. (Подробности можете да намерите тук.)

Резултатът е, че някои копачи се съпротивляват на въвеждането на SegWit. А „копаещата мощност“ е, която служи като „демократичен глас“ в системата на Bitcoin. Вече е правен опит да се въведе SegWit, който не сполучи. За да е по-добър консенсусът, този опит изискваше SegWit да се приеме когато 95% от копаещата мощност го подкрепи. Скоро стана ясно, че това няма да се случи.

3. UASF? WTF? (Демек, кво е тва UASF?)

Не зная колко точно е процентът на отхвърлящите SegWit копачи. Но към момента копаенето е централизирано до степен да се върши почти всичкото от малък брой мощни компании. Напълно е възможно отхвърлящите SegWit да са над 50% от копаещата мощност. Ако е така, въвеждането на SegWit чрез подкрепа от нея би било невъзможно. (Разбира се, това ще значи в близко бъдеще упадъка на Bitcoin и превръщането му от „царя на криптовалутите“ в евтин музеен експонат. В крайна сметка тези копачи ще са си изкопали гроба. Но ако има на света нещо, на което може да се разчита винаги и докрай, това е човешката глупост.)

За да се избегне такъв сценарий, девелоперите от Bitcoin Core Team предложиха т.нар. User-Activated Soft Fork, съкратено UASF. Същността му е, че от 1 август нататък възлите в мрежата на Bitcoin, които подкрепят SegWit, ще започнат да смятат блокове, които не потвърждават че го поддържат, за невалидни.

Отхвърлящите SegWit копачи могат да продължат да си копаят по старому. Поддържащите го ще продължат по новому. Съответно блокчейнът на Bitcoin от този момент нататък ще се раздели на два – клон без SegWit и клон с него.

4. Какъв ще е резултатът?

Преобладаващата копаеща мощност може да се окаже в първия – тоест, по правилата на Сатоши Накамото той ще е основният. Но ако мрежата е разделена на две, всяка ще има своя основен клон, така че няма да бъдат технически обединени. Ще има две различни валути на име Bitcoin, и всяка ще претендира, че е основната.

Как ще се разреши този спор? Потребителите на Bitcoin търсят по-ниски цени за транзакции, така че огромният процент от тях бързо ще се ориентират към веригата със SegWit. А ценността и приетостта на Bitcoin се дължи просто на факта, че хората го приемат и са склонни да го използват. Затова и Segwit-натият Bitcoin ще запази ролята (и цената) на оригиналния Bitcoin, докато този без SegWit ще поевтинее и ще загуби повечето от релевантността си.

(Всъщност, подобно „разцепление“ вече се е случвало с No. 2 в света на криптовалутите – Ethereum. Затова има Ethereum и Ethereum Classic. Вторите изгубиха борбата да са наследникът на оригиналния Ethereum, но продължава да ги има, макар и да са с много по-малка роля и цена.)

Отхвърлилите SegWit копачи скоро ще се окажат в положение да копаят нещо, което струва жълти стотинки. Затова вероятно те шумно или тихо ще преминат към поддръжка на SegWit. Не бих се учудил дори доста от тях да го направят още на 1 август. (Въпреки че някои сигурно ще продължат да опищяват света колко лошо е решението и какви загуби понасят от него. Може да има дори съдебни процеси… Подробностите ще ги видим.)

5. Политиката

Ако сте издържали дотук, четете внимателно – същността на този запис е в тази част.

Наскоро си говорих с горда випускничка на български икономически ВУЗ. Изслушах обяснение как икономията от мащаба не съществува и е точно обратното. Как малките фирми са по-ефективни от големите и т.н…

Нищо чудно, че ги учат на глупости. Който плаща, дори зад сцената, той поръчва музиката. Странно ми е, че обучаваните вярват на тези глупости при положение, че реалността е пред очите им. И че в нея големите фирми разоряват и/или купуват малките, а не обратното. Няма как да е иначе. Както законите на Нютон важат еднакво за лабораторни тежести и за търговски контейнери, така и дисипативните закони важат еднакво за тенджери с вода и за икономически системи.

В ИТ бизнеса динамиката е много над средната. Където не е и няма как да бъде регулиран лесно, където нещата са по-laissez-faire, както е примерно в копаенето на биткойни, е още по-голяма. Нищо чудно, че копаенето премина толкова бързо от милиони индивидуални участници към малък брой лесно картелиращи се тиранозаври. Всяка система еволюира вътрешно в такава посока… Затова „перфектна система“ и „щастие завинаги“ няма как да съществуват. Затова, ако щете, свободата трябва да се замесва и изпича всеки ден.

„Преобладаващата копаеща мощност“, било като преобладаващият брой индивиди във вида, било като основната маса пари, било като управление на най-популярните сред гласоподавателите мемове, лесно може да се съсредоточи в тесен кръг ръце. И законите на вътрешната еволюция на системите, като конкретно изражение на дисипативните закони, водят именно натам… Тогава всяко гласуване започва да подкрепя статуквото. Демокрацията престава да бъде възможност за промяна – такава остава само разделянето на възгледите в отделни системи. Единствено тогава новото получава възможност реално да конкурира старото.

Затова и всеки биологичен вид наоколо е започнал някога като миниатюрна различна клонка от могъщото тогава стъбло на друг вид. Който днес познават само палеобиолозите. И всяка могъща банка, или производствена или медийна фирма е започнала – като сума пари, или производствен капацитет, или интелектуална собственост – като обикновена будка за заеми, или работилничка, или ателие. В сянката на тогавашните тиранозаври, помнени днес само от историците. Намерили начин да се отделят и скрият някак от тях, за да съберат мощта да ги конкурират…

Който разбрал – разбрал.

No, Netflix Hasn’t Won The War on Piracy

Post Syndicated from Ernesto original https://torrentfreak.com/no-netflix-hasnt-won-the-war-on-piracy-170604/

Recently a hacker group, or hacker, going by the name TheDarkOverlord (TDO) published the premiere episode of the fifth season of Netflix’s Orange is The New Black, followed by nine more episodes a few hours later.

TDO obtained the videos from Larson Studios, which didn’t pay the 50 bitcoin ransom TDO had requested. The hackers then briefly turned their attention to Netflix, before releasing the shows online.

In the aftermath, a flurry of articles claimed that Netflix’s refusal to pay means that it is winning the war on piracy. Torrents are irrelevant or no longer a real threat and piracy is pointless, they concluded.

One of the main reasons cited is a decline in torrent traffic over the years, as reported by the network equipment company Sandvine.

“Last year, BitTorrent traffic reached 1.73 percent of peak period downstream traffic in North America. That’s down from the 60 percent share peer-to-peer file sharing had in 2003. Netflix was responsible for 35.15 percent of downstream traffic,” one reporter wrote.

Piracy pointless?

Even Wired, a reputable technology news site, jumped on the bandwagon.

“It’s not that torrenting is so onerous. But compared to legitimate streaming, the process of downloading a torrenting client, finding a legit file, waiting for it to download, and watching it on a laptop (or mirroring it to a television) hardly seems worth it,” the articles states.

These and many similar articles suggest that Netflix’s ease of use is superior to piracy. Netflix is winning the war on piracy, which is pretty much reduced to a fringe activity carried out by old school data hoarders, they claimed.

But is that really the case?

I wholeheartedly agree that Netflix is a great alternative to piracy, and admit that torrents are not as dominant as they were before. But, everybody who thinks that piracy is limited to torrents, need to educate themselves properly.

Piracy has evolved quite a bit over the past several years and streaming is now the main source to satisfy people’s ‘illegal’ viewing demands.

Whether it’s through pirate streaming sites, mobile apps or dedicated media players hooked to TVs; it’s not hard to argue that piracy is easier and more convenient than it has even been in the past. And arguably, more popular too.

The statistics are dazzling. According to piracy monitoring outfit MUSO there are half a billion visits to video pirate sites every day. Roughly 60% of these are to streaming sites.

While there has been a small decline in streaming visits over the past year, MUSO’s data doesn’t cover the explosion of media player piracy, which means that there is likely a significant increase in piracy overall.

TorrentFreak contacted the aforementioned network equipment company Sandvine, which said that we’re “on to something.”

Unfortunately, they currently have no data to quantify the amount of pirate streaming activity. This is, in part, because many of these streams are hosted by legitimate companies such as Google.

Torrents may not be dominant anymore, but with hundreds of millions of visits to streaming pirate sites per day, and many more via media players and other apps, piracy is still very much alive. Just ask the Motion Picture Association.

I would even argue that piracy is more of a threat to Netflix than it has ever been before.

To illustrate, here is a screenshot from one of the most visited streaming piracy sites online. The site in question receives millions of views per day and featured two Netflix shows, “13 Reasons Why” and the leaked “Orange is The New Black,” in its daily “most viewed” section recently.

Netflix shows among the “most viewed” pirate streams

If you look at a random streaming site, you’ll see that they offer an overview of thousands of popular movies and TV-shows, far more than Netflix. Pirate streaming sites have more content than Netflix, often in high quality, and it doesn’t cost a penny.

Throw in the explosive growth of piracy-capable media players that can bring this content directly to the TV-screen, and you’ll start to realize the magnitude of this threat.

In a way, the boost in streaming piracy is a bigger threat to Netflix than the traditional Hollywood studios. Hollywood still has its exclusive release windows and a superior viewing experience at the box office. All Netflix content is instantly pirated, or already available long before they add it to their catalog.

Sure, pirate sites might not appeal to the average middle-class news columnist who’s been subscribed to Netflix for years, but for tens of millions of less fortunate people, who can do without another monthly charge on their household bill, it’s an easy choice.

Not the right choice, legally speaking, but that doesn’t seem to bother them much.

That’s illustrated by tens of thousands of people from all over the world commenting with their public Facebook accounts, on movies and TV-shows that were obviously pirated.

Pirate comments on a streaming site

Of course, if piracy disappeared overnight then only a fraction of these pirates would pay for a Netflix subscription, but saying that piracy is irrelevant for the streaming giant may be a bit much.

Netflix itself is all too aware of this it seems. The company has launched its own “Global Copyright Protection Group,” an anti-piracy division that’s on par with those of many major Hollywood studios.

Netflix isn’t winning the war on piracy; it just got started….

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Was The Disney Movie ‘Hacking Ransom’ a Giant Hoax?

Post Syndicated from Andy original https://torrentfreak.com/was-the-disney-movie-hacking-ransom-a-giant-hoax-170524/

Last Monday, during a town hall meeting in New York, Disney CEO Bob Iger informed a group of ABC employees that hackers had stolen one of the company’s movies.

The hackers allegedly said they’d keep the leak private if Disney paid them a ransom. In response, Disney indicated that it had no intention of paying. Setting dangerous precedents in this area is unwise, the company no doubt figured.

After Hollywood Reporter broke the news, Deadline followed up with a report which further named the movie as ‘Pirates of the Caribbean: Dead Men Tell No Tales’, a fitting movie to parallel an emerging real-life swashbuckling plot, no doubt.

What the Deadline article didn’t do was offer any proof that Pirates 5 was the movie in question. Out of the blue, however, it did mention that a purported earlier leak of The Last Jedi had been revealed by “online chatter” to be a fake. Disney refused to comment.

Armed with this information, TF decided to have a dig around. Was Pirates 5 being discussed within release groups as being available, perhaps? Initially, our inquiries drew a complete blank but then out of the blue we found ourselves in conversation with the person claiming to be the Disney ‘hacker’.

“I can provide the original emails sent to Disney as well as some other unknown details,” he told us via encrypted mail.

We immediately asked several questions. Was the movie ‘Pirates 5’? How did he obtain the movie? How much did he try to extort from Disney? ‘EMH,’ as we’ll call him, quickly replied.

“It’s The Last Jedi. Bob Iger never made public the title of the film, Deadline was just going off and naming the next film on their release slate,” we were told. “We demanded 2BTC per month until September.”

TF was then given copies of correspondence that EMH had been having with numerous parties about the alleged leak. They included discussions with various release groups, a cyber-security expert, and Disney.

As seen in the screenshot, the email was purportedly sent to Disney on May 1. The Hollywood Reporter article, published two weeks later, noted the following;

“The Disney chief said the hackers demanded that a huge sum be paid in Bitcoin. They said they would release five minutes of the film at first, and then in 20-minute chunks until their financial demands are met,” HWR wrote.

While the email to Disney looked real enough, the proof of any leaked pudding is in the eating. We asked EMH how he had demonstrated to Disney that he actually has the movie in his possession. Had screenshots or clips been sent to the company? We were initially told they had not (plot twists were revealed instead) so this immediately raised suspicions.

Nevertheless, EMH then went on to suggest that release groups had shown interest in the copy and he proved that by forwarding his emails with them to TF.

“Make sure they know there is still work to be done on the CGI characters. There are little dots on their faces that are visible. And the colour grading on some scenes looks a little off,” EMH told one group, who said they understood.

“They all understand its not a completed workprint.. that is why they are sought after by buyers.. exclusive stuff nobody else has or can get,” they wrote back.

“That why they pay big $$$ for it.. a completed WP could b worth $25,000,” the group’s unedited response reads.

But despite all the emails and discussion, we were still struggling to see how EMH had shown to anyone that he really had The Last Jedi. We then learned, however, that screenshots had been sent to blogger Sam Braidley, a Cyber Security MSc and Computer Science BSc Graduate.

Since the information sent to us by EMH confirmed discussion had taken place with Braidley concerning the workprint, we contacted him directly to find out what he knew about the supposed Pirates 5 and/or The Last Jedi leak. He was very forthcoming.

“A user going by the username of ‘Darkness’ commented on my blog about having a leaked copy of The Last Jedi from a contact he knew from within Lucas Films. Of course, this garnered a lot of interest, although most were cynical of its authenticity,” Braidley explained.

The claim that ‘Darkness’ had obtained the copy from a contact within Lucas was certainly of interest ,since up to now the press narrative had been that Disney or one of its affiliates had been ‘hacked.’

After confirming that ‘Darkness’ used the same email as our “EMH,” we asked EMH again. Where had the movie been obtained from?

“Wasn’t hacked. Was given to me by a friend who works at a post production company owned by [Lucasfilm],” EMH said. After further prompting he reiterated: “As I told you, we obtained it from an employee.”

If they weren’t ringing loudly enough already, alarm bells were now well and truly clanging. Who would reveal where they’d obtained a super-hot leaked movie from when the ‘friend’ is only one step removed from the person attempting the extortion? Who would take such a massive risk?

Braidley wasn’t buying it either.

“I had my doubts following the recent [Orange is the New Black] leak from ‘The Dark Overlord,’ it seemed like someone trying to live off the back of its press success,” he said.

Braidley told TF that Darkness/EMH seemed keen for him to validate the release, as a member of a well-known release group didn’t believe that it was real, something TF confirmed with the member. A screenshot was duly sent over to Braidley for his seal of approval.

“The quality was very low and the scene couldn’t really show that it was in fact Star Wars, let alone The Last Jedi,” Braidley recalls, noting that other screenshots were considered not to be from the movie in question either.

Nevertheless, Darkness/EMH later told Braidley that another big release group had only declined to release the movie due to the possiblity of security watermarks being present in the workprint.

Since no groups had heard of a credible Pirates 5 leak, the claims that release groups were in discussion over the leaking of The Last Jedi intrigued us. So, through trusted sources and direct discussion with members, we tried to learn more.

While all groups admitted being involved or at least being aware of discussions taking place, none appeared to believe that a movie had been obtained from Disney, was being held for ransom, or would ever be leaked.

“Bullshit!” one told us. “Fake news,” said another.

With not even well-known release groups believing that leaks of The Last Jedi or Pirates 5 are anywhere on the horizon, that brought us full circle to the original statement by Disney chief Bob Iger claiming that a movie had been stolen.

What we do know for sure is that everything reported initially by Hollywood Reporter about a ransom demand matches up with statements made by Darkness/EMH to TorrentFreak, Braidley, and several release groups. We also know from copy emails obtained by TF that the discussions with the release groups took place well before HWR broke the story.

With Disney not commenting on the record to either HWR or Deadline (publications known to be Hollywood-friendly) it seemed unlikely that TF would succeed where they had failed.

So, without comprimising any of our sources, we gave a basic outline of our findings to a previously receptive Disney contact, in an effort to tie Darkness/EMH with the email address that he told us Disney already knew. Predictably, perhaps, we received no response.

At this point one has to wonder. If no credible evidence of a leak has been made available and the threats to leak the movie haven’t been followed through on, what was the point of the whole affair?

Money appears to have been the motive, but it seems likely that none will be changing hands. But would someone really bluff the leaking of a movie to a company like Disney in order to get a ‘ransom’ payment or scam a release group out of a few dollars? Perhaps.

Braidley informs TF that Darkness/EMH recently claimed that he’d had the copy of The Last Jedi since March but never had any intention of leaking it. He did, however, need money for a personal matter involving a family relative.

With this in mind, we asked Darkness/EMH why he’d failed to carry through with his threats to leak the movie, bit by bit, as his email to Disney claimed. He said there was never any intention of leaking the movie “until we are sure it wont be traced back” but “if the right group comes forward and meets our strict standards then the leak could come as soon as 2-3 weeks.”

With that now seeming increasingly unlikely (but hey, you never know), this might be the final chapter in what turns out to be the famous hacking of Disney that never was. Or, just maybe, undisclosed aces remain up sleeves.

“Just got another comment on my blog from [Darkness],” Braidley told TF this week. “He now claims that the Emoji movie has been leaked and is being held to ransom.”

Simultaneously he was telling TF the same thing. ‘Hacking’ announcement from Sony coming soon? Stay tuned…..

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

The Future of Ransomware

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2017/05/the_future_of_r.html

Ransomware isn’t new, but it’s increasingly popular and profitable.

The concept is simple: Your computer gets infected with a virus that encrypts your files until you pay a ransom. It’s extortion taken to its networked extreme. The criminals provide step-by-step instructions on how to pay, sometimes even offering a help line for victims unsure how to buy bitcoin. The price is designed to be cheap enough for people to pay instead of giving up: a few hundred dollars in many cases. Those who design these systems know their market, and it’s a profitable one.

The ransomware that has affected systems in more than 150 countries recently, WannaCry, made press headlines last week, but it doesn’t seem to be more virulent or more expensive than other ransomware. This one has a particularly interesting pedigree: It’s based on a vulnerability developed by the National Security Agency that can be used against many versions of the Windows operating system. The NSA’s code was, in turn, stolen by an unknown hacker group called Shadow Brokers ­ widely believed by the security community to be the Russians ­ in 2014 and released to the public in April.

Microsoft patched the vulnerability a month earlier, presumably after being alerted by the NSA that the leak was imminent. But the vulnerability affected older versions of Windows that Microsoft no longer supports, and there are still many people and organizations that don’t regularly patch their systems. This allowed whoever wrote WannaCry ­– it could be anyone from a lone individual to an organized crime syndicate — to use it to infect computers and extort users.

The lessons for users are obvious: Keep your system patches up to date and regularly backup your data. This isn’t just good advice to defend against ransomware, but good advice in general. But it’s becoming obsolete.

Everything is becoming a computer. Your microwave is a computer that makes things hot. Your refrigerator is a computer that keeps things cold. Your car and television, the traffic lights and signals in your city and our national power grid are all computers. This is the much-hyped Internet of Things (IoT). It’s coming, and it’s coming faster than you might think. And as these devices connect to the Internet, they become vulnerable to ransomware and other computer threats.

It’s only a matter of time before people get messages on their car screens saying that the engine has been disabled and it will cost $200 in bitcoin to turn it back on. Or a similar message on their phones about their Internet-enabled door lock: Pay $100 if you want to get into your house tonight. Or pay far more if they want their embedded heart defibrillator to keep working.

This isn’t just theoretical. Researchers have already demonstrated a ransomware attack against smart thermostats, which may sound like a nuisance at first but can cause serious property damage if it’s cold enough outside. If the device under attack has no screen, you’ll get the message on the smartphone app you control it from.

Hackers don’t even have to come up with these ideas on their own; the government agencies whose code was stolen were already doing it. One of the leaked CIA attack tools targets Internet-enabled Samsung smart televisions.

Even worse, the usual solutions won’t work with these embedded systems. You have no way to back up your refrigerator’s software, and it’s unclear whether that solution would even work if an attack targets the functionality of the device rather than its stored data.

These devices will be around for a long time. Unlike our phones and computers, which we replace every few years, cars are expected to last at least a decade. We want our appliances to run for 20 years or more, our thermostats even longer.

What happens when the company that made our smart washing machine — or just the computer part — goes out of business, or otherwise decides that they can no longer support older models? WannaCry affected Windows versions as far back as XP, a version that Microsoft no longer supports. The company broke with policy and released a patch for those older systems, but it has both the engineering talent and the money to do so.

That won’t happen with low-cost IoT devices.

Those devices are built on the cheap, and the companies that make them don’t have the dedicated teams of security engineers ready to craft and distribute security patches. The economics of the IoT doesn’t allow for it. Even worse, many of these devices aren’t patchable. Remember last fall when the Mirai botnet infected hundreds of thousands of Internet-enabled digital video recorders, webcams and other devices and launched a massive denial-of-service attack that resulted in a host of popular websites dropping off the Internet? Most of those devices couldn’t be fixed with new software once they were attacked. The way you update your DVR is to throw it away and buy a new one.

Solutions aren’t easy and they’re not pretty. The market is not going to fix this unaided. Security is a hard-to-evaluate feature against a possible future threat, and consumers have long rewarded companies that provide easy-to-compare features and a quick time-to-market at its expense. We need to assign liabilities to companies that write insecure software that harms people, and possibly even issue and enforce regulations that require companies to maintain software systems throughout their life cycle. We may need minimum security standards for critical IoT devices. And it would help if the NSA got more involved in securing our information infrastructure and less in keeping it vulnerable so the government can eavesdrop.

I know this all sounds politically impossible right now, but we simply cannot live in a future where everything — from the things we own to our nation’s infrastructure ­– can be held for ransom by criminals again and again.

This essay previously appeared in the Washington Post.

WannaCry Ransomware

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2017/05/wannacry_ransom.html

Criminals go where the money is, and cybercriminals are no exception.

And right now, the money is in ransomware.

It’s a simple scam. Encrypt the victim’s hard drive, then extract a fee to decrypt it. The scammers can’t charge too much, because they want the victim to pay rather than give up on the data. But they can charge individuals a few hundred dollars, and they can charge institutions like hospitals a few thousand. Do it at scale, and it’s a profitable business.

And scale is how ransomware works. Computers are infected automatically, with viruses that spread over the internet. Payment is no more difficult than buying something online ­– and payable in untraceable bitcoin -­- with some ransomware makers offering tech support to those unsure of how to buy or transfer bitcoin. Customer service is important; people need to know they’ll get their files back once they pay.

And they want you to pay. If they’re lucky, they’ve encrypted your irreplaceable family photos, or the documents of a project you’ve been working on for weeks. Or maybe your company’s accounts receivable files or your hospital’s patient records. The more you need what they’ve stolen, the better.

The particular ransomware making headlines is called WannaCry, and it’s infected some pretty serious organizations.

What can you do about it? Your first line of defense is to diligently install every security update as soon as it becomes available, and to migrate to systems that vendors still support. Microsoft issued a security patch that protects against WannaCry months before the ransomware started infecting systems; it only works against computers that haven’t been patched. And many of the systems it infects are older computers, no longer normally supported by Microsoft –­ though it did belatedly release a patch for those older systems. I know it’s hard, but until companies are forced to maintain old systems, you’re much safer upgrading.

This is easier advice for individuals than for organizations. You and I can pretty easily migrate to a new operating system, but organizations sometimes have custom software that breaks when they change OS versions or install updates. Many of the organizations hit by WannaCry had outdated systems for exactly these reasons. But as expensive and time-consuming as updating might be, the risks of not doing so are increasing.

Your second line of defense is good antivirus software. Sometimes ransomware tricks you into encrypting your own hard drive by clicking on a file attachment that you thought was benign. Antivirus software can often catch your mistake and prevent the malicious software from running. This isn’t perfect, of course, but it’s an important part of any defense.

Your third line of defense is to diligently back up your files. There are systems that do this automatically for your hard drive. You can invest in one of those. Or you can store your important data in the cloud. If your irreplaceable family photos are in a backup drive in your house, then the ransomware has that much less hold on you. If your e-mail and documents are in the cloud, then you can just reinstall the operating system and bypass the ransomware entirely. I know storing data in the cloud has its own privacy risks, but they may be less than the risks of losing everything to ransomware.

That takes care of your computers and smartphones, but what about everything else? We’re deep into the age of the “Internet of things.”

There are now computers in your household appliances. There are computers in your cars and in the airplanes you travel on. Computers run our traffic lights and our power grids. These are all vulnerable to ransomware. The Mirai botnet exploited a vulnerability in internet-enabled devices like DVRs and webcams to launch a denial-of-service attack against a critical internet name server; next time it could just as easily disable the devices and demand payment to turn them back on.

Re-enabling a webcam will be cheap; re-enabling your car will cost more. And you don’t want to know how vulnerable implanted medical devices are to these sorts of attacks.

Commercial solutions are coming, probably a convenient repackaging of the three lines of defense described above. But it’ll be yet another security surcharge you’ll be expected to pay because the computers and internet-of-things devices you buy are so insecure. Because there are currently no liabilities for lousy software and no regulations mandating secure software, the market rewards software that’s fast and cheap at the expense of good. Until that changes, ransomware will continue to be profitable line of criminal business.

This essay previously appeared in the New York Daily News.

NSA Brute-Force Keysearch Machine

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2017/05/nsa_brute-force.html

The Intercept published a story about a dedicated NSA brute-force keysearch machine being built with the help of New York University and IBM. It’s based on a document that was accidentally shared on the Internet by NYU.

The article is frustratingly short on details:

The WindsorGreen documents are mostly inscrutable to anyone without a Ph.D. in a related field, but they make clear that the computer is the successor to WindsorBlue, a next generation of specialized IBM hardware that would excel at cracking encryption, whose known customers are the U.S. government and its partners.

Experts who reviewed the IBM documents said WindsorGreen possesses substantially greater computing power than WindsorBlue, making it particularly adept at compromising encryption and passwords. In an overview of WindsorGreen, the computer is described as a “redesign” centered around an improved version of its processor, known as an “application specific integrated circuit,” or ASIC, a type of chip built to do one task, like mining bitcoin, extremely well, as opposed to being relatively good at accomplishing the wide range of tasks that, say, a typical MacBook would handle. One of the upgrades was to switch the processor to smaller transistors, allowing more circuitry to be crammed into the same area, a change quantified by measuring the reduction in nanometers (nm) between certain chip features.

Unfortunately, the Intercept decided not to publish most of the document, so all of those people with “a Ph.D. in a related field” can’t read and understand WindsorGreen’s capabilities. What sorts of key lengths can the machine brute force? Is it optimized for symmetric or asymmetric cryptanalysis? Random brute force or dictionary attacks? We have no idea.

Whatever the details, this is exactly the sort of thing the NSA should be spending their money on. Breaking the cryptography used by other nations is squarely in the NSA’s mission.

Hackers Demand Ransom Over Stolen Copy of ‘Pirates of the Caribbean 5’

Post Syndicated from Ernesto original https://torrentfreak.com/hackers-demand-ransom-over-stolen-copy-of-pirates-of-the-caribbean-5-170516/

During a town hall meeting in New York on Monday, Disney CEO Bob Iger informed a group of ABC employees that hackers have stolen one of the company’s movies.

The hackers offered to keep it away from public eyes in exchange for ransom paid in Bitcoin but Disney says it has no intention to pay.

Although Iger did not mention the movie by name during the meeting, Deadline reports that it’s a copy of ‘Pirates of the Caribbean: Dead Men Tell No Tales.’

The fifth movie in the ‘Pirates‘ franchise starring Johnny Depp, is officially scheduled to appear in theaters next week. Needless to say, a high-quality leak at this point will be seen as a disaster for Disney.

The “ransom” demand from the hacker is reminiscent of another prominent entertainment industry leak, where the requested amount of Bitcoin was not paid.

Just a few weeks ago a group calling itself TheDarkOverlord (TDO) published the premiere episode of the fifth season of Netflix’s Orange is The New Black, followed by nine more episodes a few hours later.

Despite Netflix’s anti-piracy efforts, the ten leaked episodes of Orange is The New Black remain popular on many torrent indexes and pirate streaming sites.

There is no indication that the previous and threatened leaks are related in any way. TorrentFreak has seen a list of movies and TV-shows TDO said they have in their possession, but the upcoming ‘Pirates’ movie isn’t among them.

The Disney hackers have threatened to release the movie in increments, but the movie studio is hoping that they won’t go ahead with their claims.

Thus far there haven’t been any reports of leaked parts of the fifth Pirates of the Caribbean film. Disney, meanwhile, is working with the FBI to track down the people responsible for the hack.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

A Poloniex API PHP wrapper

Post Syndicated from Григор original http://www.gatchev.info/blog/?p=2056

A week ago a friend, who is interested in trading in cryptocurrencies, asked me to write for him a Poloniex trading bot.

Initially I decided to implement it over the API PHP wrapper by Compcentral. It worked like a charm, but was missing some API calls, probably added by Poloniex later. So I ended up writing my own API wrapper. It implements all API calls currently documented by Poloniex. (And adds some parameters that they haven’t documented, but can be found in their javascripts. 🙂 )

So, being my own project, this PHP API wrapper is now licensed under a free license, and available for download. Enjoy! 🙂

Of course, if someone feels this worthy of donation, I won’t refuse a bitcoin or two. 😉

(A shameless boasting: I also threw together a quick Poloniex bot of my own. Not being skilled in cryptocurrency trading, I implemented only some loaning to the margin traders. Tested it against myself – the beastie turned out better than me! 🙂 Not that I am anywhere near good lender, too – but it is pleasant when your children are smarter than you!)

Some notes on #MacronLeak

Post Syndicated from Robert Graham original http://blog.erratasec.com/2017/05/some-notes-on-macronleak.html

Tonight (Friday May 5 2017) hackers dumped emails (and docs) related to French presidential candidate Emmanuel Macron. He’s the anti-Putin candidate running against the pro-Putin Marin Le Pen. I thought I’d write up some notes.

Are they Macron’s emails?

No. They are e-mails from members of his staff/supporters, namely Alain Tourret, Pierre Person, Cedric O??, Anne-Christine Lang, and Quentin Lafay.
There are some documents labeled “Macron” which may have been taken from his computer, cloud drive — his own, or an assistant.

Who done it?
Obviously, everyone assumes that Russian hackers did it, but there’s nothing (so far) that points to anybody in particular.
It appears to be the most basic of phishing attacks, which means anyone could’ve done it, including your neighbor’s pimply faced teenager.

Update: Several people [*] have pointed out Trend Micro reporting that Russian/APT28 hackers were targeting Macron back on April 24. Coincidentally, this is also the latest that emails appear in the dump.

What’s the hacker’s evil plan?
Everyone is proposing theories about the hacker’s plan, but the most likely answer is they don’t have one. Hacking is opportunistic. They likely targeted everyone in the campaign, and these were the only victims they could hack. It’s probably not the outcome they were hoping for.
But since they’ve gone through all the work, it’d be a shame to waste it. Thus, they are likely releasing the dump not because they believe it will do any good, but because it’ll do them no harm. It’s a shame to waste all the work they put into it.
If there’s any plan, it’s probably a long range one, serving notice that any political candidate that goes against Putin will have to deal with Russian hackers dumping email.
Why now? Why not leak bits over time like with Clinton?

France has a campaign blackout starting tonight at midnight until the election on Sunday. Thus, it’s the perfect time to leak the files. Anything salacious, or even rumors of something bad, will spread viraly through Facebook and Twitter, without the candidate or the media having a good chance to rebut the allegations.
The last emails in the logs appear to be from April 24, the day after the first round vote (Sunday’s vote is the second, runoff, round). Thus, the hackers could’ve leaked this dump any time in the last couple weeks. They chose now to do it.
Are the emails verified?
Yes and no.
Yes, we have DKIM signatures between people’s accounts, so we know for certain that hackers successfully breached these accounts. DKIM is an anti-spam method that cryptographically signs emails by the sending domain (e.g. @gmail.com), and thus, can also verify the email hasn’t been altered or forged.
But no, when a salacious email or document is found in the dump, it’ll likely not have such a signature (most emails don’t), and thus, we probably won’t be able to verify the scandal. In other words, the hackers could have altered or forged something that becomes newsworthy.
What are the most salacious emails/files?

I don’t know. Before this dump, hackers on 4chan were already making allegations that Macron had secret offshore accounts (debunked). Presumably we need to log in to 4chan tomorrow for them to point out salacious emails/files from this dump.

Another email going around seems to indicate that Alain Tourret, a member of the French legislature, had his assistant @FrancoisMachado buy drugs online with Bitcoin and had them sent to his office in the legislature building. The drugs in question, 3-MMC, is a variant of meth that might be legal in France. The emails point to a tracking number which looks legitimate, at least, that a package was indeed shipped to that area of Paris. There is a bitcoin transaction that matches the address, time, and amount specified in the emails. Some claim these drug emails are fake, but so far, I haven’t seen any emails explaining why they should be fake. On the other hand, there’s nothing proving they are true (no DKIM sig), either.

Some salacious emails might be obvious, but some may take people with more expertise to find. For example, one email is a receipt from Uber (with proper DKIM validation) that shows the route that “Quenten” took on the night of the first round election. Somebody clued into the French political scene might be able to figure out he’s visiting his mistress, or something. (This is hypothetical — in reality, he’s probably going from one campaign rally to the next).

What’s the Macron camp’s response?

They have just the sort of response you’d expect.
They claim some of the documents/email are fake, without getting into specifics. They claim that information is needed to be understand in context. They claim that this was a “massive coordinated attack”, even though it’s something that any pimply faced teenager can do. They claim it’s an attempt to destabilize democracy. They call upon journalists to be “responsible”.

New Torrent Search Engine Abuses Wikipedia to Get Traffic

Post Syndicated from Andy original https://torrentfreak.com/new-torrent-search-engine-abuses-wikipedia-to-get-traffic-170503/

In the world of file-sharing, few will argue that the environment in 2017 is very, very different from that of 2007. Running sites is far from straightforward, with all kinds of roadblocks likely to appear along the way.

One of the early problems is getting new sites off the ground. Ten years ago it was easy to find mainstream technology sites touting the latest additions to the pirate landscape. These days, however, reporting is mainly restricted to innovative platforms or others with some particularly newsworthy aspect.

With those loose advertising opportunities now largely off-limits, new sites and those on the fringes are often taking more unusual approaches. Today another raised its head revealing a particularly poorly judged promotional effort.

Back in April, a new torrent site hit the scene. Called RapidTorrent, it’s a meta-search engine that by definition indexes other torrent sites. Like many others, it’s doing whatever it can to get noticed, but it’s probably the first to try and do that by using Wikipedia.

Early today, the Wikipedia pages of a whole range of defunct and live torrent sites were edited to include links to RapidTorrent. One of the first was the page for defunct meta-search engine BTDigg.

“In May 2017 BTDig (sic) staff launched rapidtorrent, a fast torrent search engine,” the page now reads, along with a link to the new torrent site.

Similar edits could also be found for Demonoid’s page, which was also defaced to note that “In May 2017 Demonoid launched rapidtorrent, a fast torrent search engine.”

In fact, links to the new torrent site were inserted in a range of other pages including The Pirate Bay, Mininova, isoHunt and ExtraTorrent.

While many people might like the opportunity to discover a new torrent site, there can be few who appreciate the defacing of Wikipedia to achieve that goal. Millions of people rely on the platform for information so when that is compromised by spam and what amount to lies, people are seriously misled.

Indeed, striking while the iron’s hot, the Wikipedia spam this morning also extended to the French language Wikipedia page of NYAA, a site that unexpectedly shut down only this week.

As shown in the image below, the site’s real domain has been completely removed only to be replaced with RapidTorrent’s URL.

While the other edits are bad enough, this one seems particularly cruel as people looking for information on the disappeared site (which is in the top 500 sites in the world) will now be led directly to a non-affiliated domain.

Those that do follow the link are greeted with another message on the site itself which claims that the search engine is being run by the original NYAA team, while at the same time soliciting bitcoin donations.

For new torrent sites looking for an early boost in traffic, times are indeed hard, so it’s no surprise that some turn to unorthodox methods. However, undermining free and valuable resources like Wikipedia is certainly not the way to do it, will not produce the required results, and is only likely to annoy when the deception is unveiled.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Hackers Leak Netflix’s Orange is The New Black, Season 5 Premiere

Post Syndicated from Andy original https://torrentfreak.com/hackers-leak-netflixs-orange-is-the-new-black-season-5-premiere-170429/

tdo-logoMuch to the disappointment of studios everywhere, movie and TV shows leak onto the Internet every single week.

However, if what is unfolding today lives up to its billing, we could be looking at the start of one of the most significant piracy leaks of recent times.

Earlier this evening, the first episode of the brand new season of Netflix’s Orange is the New Black was uploaded to The Pirate Bay, months ahead of its official June release date.

So how did this unreleased content fall into the wrong hands?

As seen from the torrent details uploaded to Pirate Bay, the leak is the work of a hacking entity calling itself TheDarkOverlord (TDO). An extraction of the .torrent file’s meta data reveals a 1.1GB file named:

‘Episode1/ORANGEep5001_HDSR_CTM_ProResProxy_8.15.16-H264_SD_16x9.mov’.

In information sent to TF, the group says that sometime during the closing months of 2016, it gained access to the systems of Larson Studios, an ADR (additional dialogue recorded) studio, based in Hollywood. The following screenshot reportedly from the leak indeed suggests a copy that was in production and possibly unfinished in some way.

After obtained its haul, TDO says it entered into “negotiations” with the video services company over the fate of the liberated content.

“After we had a copy of their data safely in our possession, we asked that we be paid a small fee in exchange for non-disclosure. We approached them on the Eve of their Christmas,” a member of the group previously told us over an encrypted channel.

So who are TDO? According to several security reports, TDO is a fairly prolific hacking group (their spokesman says they are more than one) that has claimed responsibility for a number of attacks in recent months.

One, which targeted construction company Pre-Con Products Ltd, involved the leak of contracts and a video which purported to show a fatal accident. Another, concerning polyurethane and epoxy product company GS Polymers, Inc, resulted in a leak of data after the company reportedly showed a “disinterest” in “working” with TDO. The group has also targeted medical organizations and leaked gigabytes of data obtained from Gorilla Glue.

As is clear from its actions, TDO takes its business seriously and when the group allegedly contacted Larson Studios before Christmas, they had extortion (their word) in mind. In a lengthy business-like ‘contract’ shared with TorrentFreak, TDO laid out its terms for cooperation with the California-based company.

“This agreement of accord, assurances, and satisfaction is between Larson Studios (the ‘Client’) and thedarkoverlord, a subsidiary of TheDarkOverlord Solutions, a subsidiary of World Wide Web, LLC [WWW, LLC] (the ‘Proposer’),” the wordy contract begins.

In section 2 of the contract, headed “Description of Services,” TheDarkOverLord offers to “refrain from communicating in any method, design, or otherwise to any individual, corporation, computer, or other entity any knowledge, information, or otherwise,” which appears to be an offer not to leak the content obtained.

Unsurprisingly, there were a number of conditions. The subsequent section 3 reveals that the “services” come at a price – 50 bitcoins – plus potential late payment fees, at TDO’s discretion.

tdo-contract

TDO informs TF that Larson Studios agreed to the pay the ransom and even sent back the contract.

“They printed, signed, and scanned the contract back to us,” the group says.

A copy seen by TF does have a signature, but TDO claims that Larson failed to follow through with the all-important bitcoin payment by the deadline of 31st December. That resulted in follow-up contact with the company.

“A late fee was levied and they still didn’t hold up their end of the agreement,” TDO says.

In an earlier discussion with TDO after the group reached out to us, we tried to establish what makes a group like this tick. Needless to say, they gave very little away. We got the impression from news reports that the group is mostly motivated by money, possibly power, but to remove doubt we asked the question.

“Are you familiar with the famous American bank robber, Willie Sutton?” a spokesperson replied.

“In an interview, he was once asked ‘Why do you rob banks?’ To which replied, ‘Because that’s where the money is.’ It’s said that this exchange led to the creation of Sutton’s law which states that when diagnosing, one should consider the obvious. We’ll leave you to interpret what we’re motivated by.”

Later, the group stated that its only motivation is its “greed for internet money.”

TorrentFreak understands that the leak of this single episode could represent just the start of an even bigger drop of pre-release TV series and movies. TDO claims to be sitting on a massive trove of unreleased video material, all of it high-quality.

“The quality is almost publish quality. One will find small audio errors and video errors like lack of color correction, but things are mostly complete with most of the material,” TDO says.

TheDarkOverlord did not explain what it hopes to achieve by leaking this video content now, months after it was obtained. However, when questioned the group told us that the information shared with us thus far represents just “the tip of the iceberg.”

In the past few minutes the group has taken to its Twitter account, posting messages directed at Netflix who are likely to be watching events unfold.

This is a breaking news story, updates will follow

Update: The group has published a statement on Pastebin.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

BitTorrent Inventor Bram Cohen Will Start His Own Cryptocurrency

Post Syndicated from Ernesto original https://torrentfreak.com/bittorrent-inventor-bram-cohen-will-start-his-own-cryptocurrency-170424/

credit: Ijon CC BY-SA 4.0BitTorrent’s inventor is known for his passion for puzzles, and more generally speaking, offering elegant solutions to complex problems through lines of code.

When Bram Cohen first launched BitTorrent he offered a solution to the bandwidth scarcity problem, by allowing anyone to distribute large files without having to invest in expensive infrastructure.

In recent years Cohen has closely followed the cryptocurrency boom. Not as a money hungry investor with dollar signs in his eyes, but as a programmer who sees problems that need solving.

In doing so, Cohen hasn’t shied away from offering his opinions and suggestions. Most recently, he presented a paper and a talk at the Stanford blockchain conference, discussing proofs of space and proofs of time.

Without going into technical details, Cohen believes that Bitcoin is wasteful. He suggests that a cryptocurrency that pins the mining value on storage space rather than processor time will be superior.

In an interview with TorrentFreak’s Steal This Show, Cohen revealed that his interest in cryptocurrencies is not merely abstract. It will be his core focus in the near future.

“My proposal isn’t really to do something to BitCoin. It really has to be a new currency,” Cohen says. “I’m going to make a cryptocurrency company. That’s my plan.”

By focusing on a storage based solution, BitTorrent’s inventor also hopes to address other Bitcoin flaws, such as the 51% attack.

“Another benefit of storage based things is actually that there’s a lot less centralization in mining. So there’s a lot less concern about having a 51% attack,” Cohen says.

“Sometimes people have this misapprehension that Bitcoin is a democracy. No Bitcoin is not a democracy; it’s called a 51% attack for a reason. That’s not a majority of the vote, that’s not how Bitcoin works.”

While the idea of a storage based cryptocurrency isn’t new, Burstcoin uses a similar concept, there is little doubt that Cohen believes he can do better. And with his status and contacts in the Bitcoin developer community, his project is likely to gain some eyeballs.

Before diving into it completely, Cohen will first finish up some other work at BitTorrent Inc. But after that, his full dedication will go into creating a superior cryptocurrency.

“In the next few months I’m going to devote myself full-time to the cryptocurrency stuff,” Cohen concludes.

The full interview with Bran Cohen is available here, or on the Steal This Show website.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Mirai, Bitcoin, and numeracy

Post Syndicated from Robert Graham original http://blog.erratasec.com/2017/04/mirai-bitcoin-and-numeracy.html

Newsweek (the magazine famous for outing the real Satoshi Nakamoto) has a story about how a variant of the Mirai botnet is mining bitcoin. They fail to run the numbers.

The story repeats a claim by Mcafee that 2.5 million devices were infected with Mirai at some point in 2016. If they were all mining bitcoin, how much money would the hackers be earning?
I bought security cameras and infected them with Mirai. A typical example of the CPU running on an IoT device is an ARM926EJ-S processor.
As this website reports, such a processor running at 1.2 GHz can mine at a rate of 0.187-megahashes/second. That’s a bit fast for an IoT device, most are slower, some are faster, we’ll just use this as the average.
According to this website, the current hash-rate of all minters is around 4-million terahashes/second.
Bitcoin blocks are mined every 10 minutes, with the current (April 2017) reward set at 12.5 bitcoins per block, giving roughly 1800 bitcoins/day in reward.
The current price of bitcoin is $1191.
Okay, let’s plug all these numbers in:
  •  total Mirai hash-rate = 2.5 million bots times 0.185 megahash/sec = 0.468 terahashes/second
  •  daily Bitcoin earnings = $1191 times 1800 = $2.1 million/day
  •  daily Mirai earnings = (0.468 divided by 4-million) times $2.1 million = $0.25
In other words, if the entire Mirai botnet of 2.5 million IoT devices was furiously mining bitcoin, it’s total earnings would be $0.25 (25 cents) per day.
Conclusion

If 2.5 million IoT devices mine Bitcoin, they’d earn in total 25 pennies per day. It’s inconceivable that anybody would add bitcoin mining to the Mirai botnet other than as a joke.

Bonus: A single 5 kilogram device you hold in your hand can mind at 12.5 terahashes/second, or 25 times the hypothetical botnet, for $1200.

20th Century Fox & Dreamworks Blackmailed Over The Boss Baby Leak

Post Syndicated from Andy original https://torrentfreak.com/20th-century-fox-dreamworks-blackmailed-over-the-boss-baby-leak-170324/

When copies of movies leak onto the Internet, there is usually very little studios and distributors can do about it. Once a copy gets out there, it’s invariably too late, with thousands of people downloading in the opening hours.

Recently, however, a potential leak took on a different complexion. Sometime in February, a then unknown individual managed to get his hands on a pre-release copy of the upcoming Dreamworks movie The Boss Baby.

According to a local media report, the movie was due to be distributed in Serbia by local company MEGAKOM during April. But first, it needed to be localized with a Serbian language soundtrack.

Somewhat bizarrely given the security that usually surrounds high-profile releases, the movie ended up on a translator’s PC. The movie was copied, apparently without her knowledge, to the laptop of a man who lives with her.

Instead of immediately leaking it online, the man – subsequently identified as 26-year-old Momcilo Đinović – reportedly decided to make some cash. He contacted DreamWorks and 20th Century Fox with blackmail demands – pay a large bitcoin ransom or have your global release day ruined.

With help from local police, distributor MEGAKOM launched an investigation to find out how a third-party had obtained the movie. That involved tracing back the IP addresses of the person carrying out the extortion.

Meanwhile, local media reports indicate that 20th Century Fox paid Belgrade-resident Đinović – the son of a retired policeman – first four and then five bitcoin. Apparently, that was not enough to satisfy the 26-year-old, but in any event, things didn’t end well.

After being arrested by local police, Đinović appeared at the High Prosecutor’s Office charged with extorting both 20th Century Fox and Dreamworks. The judge ordered him to be held in pre-trial detention for 30 days. Sources close to the investigation inform local news outlet Novosti that he faces up to 10 years in prison.

Serbia has certainly been busy on the piracy front in recent days. According to an announcement from the Ministry of the Interior, two suspects have just been arrested following an investigation by the country’s organized crime unit into popular local TV streaming site, Serije.rs.

Police reportedly carried out searches of flats and other premises used by the site’s administrators while seizing equipment. The pair stand accused of committing criminal copyright infringement offenses.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Assert() in the hands of bad coders

Post Syndicated from Robert Graham original http://blog.erratasec.com/2017/03/assert-in-hands-of-bad-coders.html

Using assert() creates better code, as programmers double-check assumptions. But only if used correctly. Unfortunately, bad programmers tend to use them badly, making code worse than if no asserts were used at all. They are a nuanced concept that most programmers don’t really understand.

We saw this recently with the crash of “Bitcoin Unlimited”, a version of Bitcoin that allows more transactions. They used an assert() to check the validity of input, and when they received bad input, most of the nodes in the network crashed.

The Bitcoin Classic/Unlimited code is full of bad uses of assert. The following examples are all from the file main.cpp.



Example #1this line of code:

  1.     if (nPos >= coins->vout.size() || coins->vout[nPos].IsNull())
  2.         assert(false); 

This use of assert is silly. The code should look like this:

  1.     assert(nPos < coins->vout.size());
  2.     assert(!coins->vout[nPos].IsNull());

This is the least of their problems. It understandable that as code ages, and things are added/changed, that odd looking code like this appears. But still, it’s an example of wrong thinking about asserts. Among the problems this would cause is that if asserts were ever turned off, you’d have to deal with dead code elimination warnings in static analyzers.

Example #2line of code:

  1.     assert(view.Flush());

The code within assert is supposed to only read values, not change values. In this example, the Flush function changes things. Normally, asserts are only compiled into debug versions of the code, and removed for release versions. However, doing so for Bitcoin will cause the program to behave incorrectly, as things like the Flush() function are no longer called. That’s why they put at the top of this code, to inform people that debug must be left on.

  1. #if defined(NDEBUG)
  2. # error “Bitcoin cannot be compiled without assertions.”
  3. #endif

Example #3: line of code:

  1.     CBlockIndex* pindexNew = new CBlockIndex(block);
  2.     assert(pindexNew);

The new operator never returns NULL, but throws its own exception instead. Not only is this a misconception about what new does, it’s also a misconception about assert. The assert is supposed to check for bad code, not check errors.

Example #4: line of code

  1.     BlockMap::iterator mi = mapBlockIndex.find(inv.hash);
  2.     CBlock block;
  3.     const Consensus::Params& consensusParams = Params().GetConsensus();
  4.     if (!ReadBlockFromDisk(block, (*mi).second, consensusParams))
  5.         assert(!“cannot load block from disk”);

This is the feature that crashed Bitcoin Unlimited, and would also crash main Bitcoin nodes that use the “XTHIN” feature. The problem comes from parsing input (inv.hash). If the parsed input is bad, then the block won’t exist on the disk, and the assert will fail, and the program will crash.

Again, assert is for checking for bad code that leads to impossible conditions, not checking errors in input, or checking errors in system functions.


Conclusion

The above examples were taken from only one file in the Bitcoin Classic source code. They demonstrate the typically wrong ways bad programmers use asserts. It’d be a great example to show students of programming how not to write bad code.

More generally, though, it shows why there’s a difference between 1x and 10x programmers. 1x programmers, like those writing Bitcoin code, make the typical mistake of treating assert() as error checking. The nuance of assert is lost on them.


Updated to reflect that I’m refering to the “Bitcoin Classic” source code, which isn’t the “Bitcoin Core” source code. However, all the problems above appear to also be problems in the Bitcoin Core source code.

What’s the Diff: Hot and Cold Data Storage

Post Syndicated from Peter Cohen original https://www.backblaze.com/blog/whats-the-diff-hot-and-cold-data-storage/

Hot And Cold Storage

Differentiating cloud data storage by “temperature” is common practice when it comes to describing the tiered storage setups offered by various cloud storage providers. “Hot” and “cold” describes how often that data is accessed. What’s the actual difference, and how does each temperature fit your cloud storage strategy? Let’s take a look.

First of all, let’s get this out of the way: There’s no set industry definition of what hot and cold actually mean. So some of this may need to be adapted to your specific circumstances. You’re bound to see some variance or disagreement if you research the topic.

Hot Storage

“Hot” storage is data you need to access right away, where performance is at a premium. Hot storage often goes hand in hand with cloud computing. If you’re depending on cloud services not only to store your data but also to process it, you’re looking at hot storage.

Business-critical information that needs to be accessed frequently and quickly is hot storage. If performance is of the essence – if you need the data stored on SSDs instead of hard drives, because speed is that much of a factor – then that’s hot storagae.

High-performance primary storage comes at a price, though. Cloud data storage providers charge a premium for hot data storage, because it’s resource-intensive. Microsoft’s Azure Hot Blobs and Amazon AWS services don’t come cheap.

Read on for how our B2 Cloud Storage fits the hot storage model. But first, let’s talk about cold storage.

Cold Storage

“Cold” storage is information that you don’t need to access very often. Inactive data that doesn’t need to be accessed for months, years, decades, potentially ever. That’s the sort of content that cold storage is ideal for. Practical examples of data suitable for cold storage include old projects, records you might need for auditing or bookkeeping purposes at some point in the future, or other content you only need to access infrequently.

Data retrieval and response time for cold cloud storage systems are typically slower than services designed for active data manipulation. Practical examples of cold cloud storage include services like Amazon Glacier and Google Coldline.

Storage prices for cold cloud storage systems are typically lower than warm or hot storage. But cold storage often incur higher per-operation costs than other kinds of cloud storage. Access to the data typically requires patience and planning.

Apocryphally, “cold” storage meant just that: Data physically stored away from the hot machines running the media. Today, cold storage is still sometimes used to describe purely offline storage – that is, data that’s not stored in the cloud at all. Sometimes this is data that you might want to quarantine from from the Internet altogether – for example, cryptocurrency like BitCoin. Sometimes this is that old definition of cold storage: data that is archived on some sort of durable medium and stored in a secure offsite facility.

How B2 Cloud Storage Fits the Cold and Hot Model

We’ve designed B2 Cloud Storage to be instantly available. With B2, you won’t have delays accessing your information like you might have with offline or some nearline systems. Your data is available when you need it.

B2 is built on the physical architecture and advanced software framework we’ve been developing for the past decade to power our signature backup services. B2 Cloud Storage sports multiple layers of redundancy to make sure that your data is stored safely and is available when you need it.

We’ve taken the concept of hot storage a step further by offering reliable, affordable, and scalable storage in the cloud for a mere fraction of what others charge. We’re one-quarter the price of Amazon.

B2 Cloud Storage changes the pricing model for cloud storage. B2 changes the pricing model so much that our customers have found it economical to migrate away altogether from slow, inconvenient and frustrating cold storage and offline archival systems. Our media and entertainment customers are using B2 instead of LTO tape systems, for example.

What Temperature Is Your Cloud Storage?

Different organizations have different needs, so there’s no right answer about what temperature your cloud data should be. It’s imperative to your bottom line that you don’t pay for more than what you need. That’s why we’ve designed B2 to be an affordable and reliable cloud storage solution. Get started today and you’ll get the first 10GB for free!

Have a different idea of what hot and cold storage are? Have questions that aren’t answered here? Join the discussion!

The post What’s the Diff: Hot and Cold Data Storage appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

Building Smarter Ransomware

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2017/03/building_smarte.html

Matthew Green and students speculate on what truly well-designed ransomware system could look like:

Most modern ransomware employs a cryptocurrency like Bitcoin to enable the payments that make the ransom possible. This is perhaps not the strongest argument for systems like Bitcoin — and yet it seems unlikely that Bitcoin is going away anytime soon. If we can’t solve the problem of Bitcoin, maybe it’s possible to use Bitcoin to make “more reliable” ransomware.

[…]

Recall that in the final step of the ransom process, the ransomware operator must deliver a decryption key to the victim. This step is the most fraught for operators, since it requires them to manage keys and respond to queries on the Internet. Wouldn’t it be better for operators if they could eliminate this step altogether?

[…]

At least in theory it might be possible to develop a DAO that’s funded entirely by ransomware payments — and in turn mindlessly contracts real human beings to develop better ransomware, deploy it against human targets, and…rinse repeat. It’s unlikely that such a system would be stable in the long run ­ humans are clever and good at destroying dumb things ­ but it might get a good run.

One of the reasons society hasn’t destroyed itself is that people with intelligence and skills tend to not be criminals for a living. If it ever became a viable career path, we’re doomed.