Gen Y workers OK with flouting cloud, byod policies

IT World Canada has an interesting article on an issue a lot of my customers have been asking about lately:

Corporate IT administrators may have more to worry about than just the wave of smart watches, Google glasses and other wearable computing devices that could flood the enterprise soon. A recent survey of indicates that more than half of Generation Y workers are prepared to contravene corporate bring your own device and cloud computing policies if it cramps their personal and professional computing and social networking activity.

Skynet Botnet Controlled Over Tor

A botnet has been discovered that uses a hidden Tor IRC service for command and control. Although Tor tends to be on the slow side, the extra layers of anonymity make it significantly difficult and maybe even impossible to locate either the C&C servers, or the people running them.

All kinds of direct hack attacks probably occur over the Tor network. This use however, is interesting in that there currently is no known method for shutting them down. I expect that once a compromised server is found, researchers will begin looking for vulnerabilities on the hidden Tor services in the hopes of finding a vulnerability that exposes the actual IP information.

The article discusses how the bots are being used to mine bitcoins.

Either way, this is interesting, and probably will soon be the de facto way to run botnets.

Ransom hackers encrypt medical centre's entire database

An Australian medical centre is reported to be considering paying a ransom demand of $4,000 AUD (US$4215) after blackmailers broke into the organisation’s servers and encrypted its entire patient database.

 If crime doesn't pay, why is this clinic considering making it profitable? Paying ransom only perpetuates the problem. Instead they should be spending the money on securing their systems. The clinic should be asking themselves:

1. Why should I make this crime profitable for the attacker? 
2. How do I know they will provide the password and instructions for decrypting the data? 
3. How do I know that if I decrypt the database, the data hasn't been tampered with? 
4.  If I pay the ransom, what is to stop them from increasing the demand lest they publish the data online?
5. What is a better plan for securing the systems and moving on? 

They already lost once. If they don't bite the bullet and move on, they risk losing again and again. They would also be giving the attackers valuable incentives for attacking more sites.

Will Mossad Hunt Down Anonymous?

... if Israel does respond, they may find that it’s much easier to hunt Hamas missile launchers than a loosely organized group of hackers. But where the U.S. treats hacking as a law enforcement issue, if Anonymous crosses a red line (there are lots of those in the Middle East), then Israel may treat this as a national security issue. And the rules and the methods of that game are a lot tougher.

John McAfee Wanted For Murder

Antivirus pioneer John McAfee is on the run for murder, according to Belizean police. This story is about to go viral.

Microsoft Causes OSX Vulnerability, Then Gloats

Microsoft discovered a vulnerability in Word that could allow an attacker to execute code on any system using Microsoft Word to read a specially malformed document, then spins it to say it is proof that Macs are just as vulnerable as Windows to document-based attacks.

Communication costs in Canada about to skyrocket

Warrantless spying is about to cause Canada's already too high price of communications to skyrocket. Thanks Stephen Harper. Now even the police are getting greedy.