Security

Laptop Thief Caught On Tape…

AUTHOR’S NOTE:

Be wary of laptop thieves. Word on the street is that that they operate as a cartel & frequent offices that are outside the Central Business District in the evenings when people are leaving the office because that’s when they can’t be easily noticed or questioned. The man is still at large.

Kenya Police website hacked…

AUTHOR’S NOTE:

The Kenya Police website is still down, three days after hackers attacked the site indicating just how unsecured it has been. Following the initial entry, the site has suffered a series of hacks with different disparaging messages posted on each occasion. International technology blogs picked up the story, driving more traffic to the site, which ultimately brought it down for hours. As NTV’s Larry Madowo reports, it’s a curious case of the word ‘password’ being used as a password.

M-Pesa Fraud – Agents Beware!

DISCLAIMER:

Reposted with permission from gmeltdown. The original article can be found here…

Tricksters & dishonest people have always existed in our midst. It is definitely naive to imagine our techno-savvy way of life is an exception to the old age social patterns. This afternoon, an M-Pesa agent was a victim of a new line of M-Pesa fraud.

On Febuary 1st, 2009 in a peri-urban setting about 24 kilometres from the Nairobi City Centre:

  1. Around 2:00 p.m., a lady & gentleman who looked to be in their mid-twenties visited an M-Pesa outlet, claiming to be Safaricom supervisors. The two wore valid looking M-Pesa badges & even carried M-Pesa promotional material for the outlet. The two inspected the outlet’s logbooks and left. NOTE: It is normal for Safaricom to send supervisors to routinely inspect various parameters on operations of M-Pesa outlets. The supervisors usually wear Safaricom badges & often take with them M-Pesa promotional material to the outlets.
  2. About 20 minutes  after the purported supervisors left, an old-looking man estimated to be in his late 50s or early 60s, came to the same outlet requesting to withdraw K.Sh. 35,000. The man was allowed to withdraw the desired K.Sh. 35,000 & went ahead to initiate the withdrawal from his phone, as is the normal procedure.
  3. Shortly after, the outlet attendants received an SMS purporting to record & authenticate the old man’s withdrawal transaction. The SMS received by the attendant had a valid looking M-Pesa transaction number & the old man’s purported names which were verified against an original national ID which he presented.
  4. The M-Pesa attendant, convinced about the validity of the transaction (just like hundreds of others processed daily), gave the old man an inital K.Sh. 30,000 & was reaching out for the remaining K.Sh. 5,000. Before the extra amount could be retrieved, the old man calmly signed the outlet transaction & walked away saying he would come for the remainder later.
  5. The M-Pesa attendant continued with the next customer, expecting their float to have increased by K.Sh. 35,000 as a result of the withdrawal. The expected float was then not reflected in the valid M-Pesa SMS after the next customer’s transaction, raising a red flag to the M-Pesa attendant.
  6. The M-Pesa attendant shortly after called 234 – Safaricom’s M-Pesa service line – for clarification & the service support person on the other end reported that the transaction withdrawing K.Sh. 35,000 wasn’t reflected in the M-Pesa system.
  7. Alarmed at the Safaricom claim, the M-Pesa attendant frantically attempted to call out for the old man who had disappeared by then without a trace.
  8. Late in the afternoon, the M-Pesa attendant went to the police station to report the incident. The police officers took initial details & promised to visit the outlet the following day for further investigations.

A number of discrepancies have since been highlighted on the fake M-Pesa SMS which is copied & pasted below:

P47DT685 confirmed on 01/02/2010 at 2:20 PM Give KSh 35,000 to DANIEL MAINA New M-Pesa balance is Kh 42,049

Sender:MPESA +254771831462

I shal leave the analysis of the text & resulting fraud to the reader for now.

According to the Safaricom M-Pesa support person, the M-Pesa attendant only has to count their loss as no indemnity is payable to the attendant for their predicament. When the known Safaricom / M-Pesa representative for the affected region was contacted, they disowned the “supervisory” visit by the lady & gentleman 20 minutes before the “withdrawal” was requested. I wonder how many more M-Pesa agents have fallen pry to this new M-Pesa trickery?

Most Popular Account Passwords…

AUTHOR’S NOTE:

According to a new analysis, one out of every five Web users still decides to leave the equivalent of a key under the doormat: they choose a simple, easily guessed password like “abc123”, “iloveyou” or even “password” to protect their data.

This suggests that hackers could easily break into many accounts just by trying the most common passwords. Because of the prevalence of fast computers & speedy networks, hackers can fire off thousands of password guesses a minute!

Protecting Children Online & On Mobile…

The World Telecommunications & Information Society Day was held on Sunday 17th May & the theme was on “Protection of Children in Cyberspace…”

This led me to wonder how we’re protecting our young ones from mobile content now that there’s a lot of adult stuff sold on mobiles e.g. wallpapers, tips on relationships, dating services etc.

Children now have access to both web & mobile (with mobiles being harder to monitor).

Who out there is working on such issues?

Wanted: Computer hackers to help government…

WASHINGTON – Wanted: Computer hackers.

Federal authorities aren’t looking to prosecute them, but to pay them to secure the nation’s networks.

General Dynamics Information Technology put out an ad last month on behalf of the Homeland Security Department seeking someone who could “think like the bad guy.” Applicants, it said, must understand hackers’ tools and tactics and be able to analyze Internet traffic and identify vulnerabilities in the federal systems.

In the Pentagon’s budget request submitted last week, Defense Secretary Robert Gates said the Pentagon will increase the number of cyberexperts it can train each year from 80 to 250 by 2011.

With warnings that the U.S. is ill-prepared for a cyberattack, the White House conducted a 60-day study of how the government can better manage and use technology to protect everything from the electrical grid and stock markets to tax data, airline flight systems, and nuclear launch codes.

President Barack Obama appointed a former Bush administration aide, Melissa Hathaway, to head the effort, and her report was delivered Friday, the White House said.

While the country had detailed plans for floods, fires or errant planes drifting into protected airspace, there is no similar response etched out for a major computer attack.

David Powner, director of technology issues for the Government Accountability Office, told Congress last month that the U.S. has no recovery plan for a digital disaster.

“We’re clearly not as prepared as we should be,” he said.

Administration officials says the U.S. has not kept pace with technological innovations needed to protect its computer networks against emerging threats from hackers, criminals or other nations looking for national security secrets.

U.S. computer networks, including those at the Pentagon and other federal agencies, are under persistent attack, ranging from nuisance hacking to more nefarious assaults, possibly from other nations, such as China. Industry leaders told Congress during a recent hearing that law enforcement and other protections are too outdated to fend off threats from criminals, terrorists and unfriendly foreign nations.

Just last week, a former government official revealed that spies had hacked into the U.S. electric grid and left behind computer programs that would let them disrupt service. The intrusions were discovered after electric companies gave the government permission to audit their systems, said the ex-official, who was not authorized to discuss the matter and spoke on condition of anonymity.

Cyberthreats are also included as a key potential national security risk outlined in a classified report put together by Adm. Mike Mullen, chairman of the Joint Chiefs of Staff. Pentagon officials say they spent more than $100 million in the last six months responding to and repairing damage from cyberattacks and other computer network problems.

Nadia Short, vice president at General Dynamics Advanced Information Systems, said the job posting for ethical hackers fills a critical need for the government.

The analysts keep constant watch on the government networks as part of a program called Einstein that was initiated by the Bush administration under the U.S. Computer Emergency Readiness Team.

Short said the $60 million, four-year contract with US-CERT uses the ethical hackers to analyze threats to the government’s computer systems and develop ways to reduce vulnerabilities.

Faced with such cyberchallenges, Obama ordered the 60-day review to examine how federal agencies manage and protect their massive amounts of data and what the government’s role should be in guarding the vast networks that control the country’s vital utilities and infrastructure.

Over the past two months, Hathaway met with hundreds of industry leaders, Capitol Hill staff and other experts, seeking guidance on what the federal government’s role should be in protecting information networks against an attack. She sought recommendations on how officials should define and report cyberincidents and attacks; how the government should structure its cyberoversight; and how the nation can increase security without stifling innovation.

A task force of technology giants, including representatives from General Dynamics, IBM, Lockheed Martin and Hewlett-Packard Co. urged the administration to establish a White House-level official to lead cyberefforts and to develop ways to share information on problems more quickly with the private sector.

The administration has struggled with the basics, such as who should control the nation’s cyberspace programs. There appears to be some agreement now that the White House should coordinate the overall effort, rejecting suggestions that the National Security Agency take it on – a plan that triggered protests on Capitol Hill and from civil liberties groups worried about giving such control to spy agencies.

Source: http://www2.tbo.com/content/2009/apr/19/191330/wanted-computer-hackers-help-government/news-breaking/