Raw sockets backdoor gives attackers complete control of some Linux servers

Raw sockets backdoor gives attackers complete control of some Linux servers

http://ift.tt/2o3CwN9

gA stealthy backdoor undetected by antimalware providers is giving unknown attackers complete control over at least 100 Linux servers that appear to be used in business production environments, warn researchers.

In a blog post published Wednesday, Montreal-based GoSecure claimed that a piece of malware dubbed “Chaos” is infecting poorly secured systems by guessing weak passwords protecting secure shell application administrators use to remotely control Unix-based computers. The secure shell, or SSH, accounts being compromised run as root, and this is how the backdoor is able to get such access as well. Normally, firewalls in front of servers block such backdoors from communicating with the outside Internet. Once installed, Chaos bypasses those protections by using what’s known as a “raw socket” to covertly monitor all data sent over the network.

“With Chaos using a raw socket, the backdoor can be triggered on ports running an existing legitimate service,” Sebastian Feldmann, a master’s degree student intern working for GoSecure, wrote. “As an example, a Webserver that would only expose SSH (22), HTTP (80), and HTTPS (443) would not be reachable via a traditional backdoor due to the fact that those services are in use, but with Chaos it becomes possible.”

Once installed, Chaos allows malware operators anywhere in the world to gain complete control over the server via a reverse shell. The attacker can use their privileged perch to exfiltrate sensitive data, move further inside the compromised network, or as a proxy to conceal hacks on computers outside the network. To activate the backdoor, attackers send a weakly encrypted password to one of the ports of the infected machine.

GoSecure researchers said the password was easy for them to crack because it was hardcoded into the malware using the ancient DES encryption scheme. That means that infected systems aren’t accessible only to the people who originally planted Chaos but by anyone who, like GoSecure, invests the modest resources required to crack the password. The researchers performed an Internet-wide scan on January 19 and detected 101 machines that were infected.

Apathy is malware’s best friend

They reported their findings to the Canadian Cyber Incident Response Center in hopes of getting the affected organizations to disinfect their systems. A scan on Wednesday, however, showed that 98 servers remained infected. The compromised systems were located in a variety of big-name hosting services, including Cloudbuilders, Rackspace, Digital Ocean, Linode, Comcast, and OVH.

As the researchers dug further into Chaos, they discovered that the malware was nothing more than a renamed version of a backdoor that was included in a rootkit known as SEBD—short for Simple Encrypted Backdoor for Linux—which was publicly released in 2013. Despite its availability for more than five years, this VirusTotal query indicates that none of the 58 most widely used anti-malware services detect it. GoSecure further noted that the attackers are bundling Chaos with malware for a botnet that’s being used to mine the cryptocurrency known as Monero.

The key weakness that allows Chaos to spread is the use of a weak password to protect SSH. Best practices call for SSH to be protected with a cryptographic key and a strong password. Wednesday’s blog post provides a set of indicators that administrators can use to determine if any of their systems are compromised. Besides disinfecting affected servers, admins should make sure their SSH apps are adequately protected to prevent similar attacks from succeeding again.

Tech

via Ars Technica https://arstechnica.com

February 16, 2018 at 08:22AM

Why Sex Scandals Persist In The Humanitarian Aid World

Why Sex Scandals Persist In The Humanitarian Aid World

http://ift.tt/2BwbKVm

An Oxfam sign outside one of its charity shops in central London, where they sell secondhand goods to raise funds.

Alberto Pezzali/NurPhoto via Getty Images


hide caption

toggle caption

Alberto Pezzali/NurPhoto via Getty Images

An Oxfam sign outside one of its charity shops in central London, where they sell secondhand goods to raise funds.

Alberto Pezzali/NurPhoto via Getty Images

It’s a story that has stunned the public.

Last week, a report by The Times of London found that in 2011, the national director for Oxfam in Haiti and senior aid workers hired local sex workers while working in the country. After an internal investigation, the Times reported, Oxfam accepted the resignations of three men and fired four for gross misconduct.

At the time, the charity was providing relief efforts after the 2010 earthquake that killed 220,000 people and left 1.5 million homeless.

Across social media, critics and Oxfam donors expressed their outrage.

For staffers and researchers in the humanitarian sector, the incident in Haiti was disturbing — but not shocking. For decades, there have been reports of relief workers sexually exploiting the very people they are trying to help.

“I wasn’t surprised by the revelations. This is a sector-wide problem,” says Megan Nobert, a human rights lawyer and founder of Report the Abuse, a project that researched sexual offenses by aid staffers from 2015 to 2017. “It’s one that’s affecting not just Oxfam but [also] the U.N. and small NGOs.”

For this reason, most aid groups have ethical codes of conduct that explicitly prohibit sexual exploitation, which the U.N., in their own ethics handbook, calls a “catastrophic failure” to protect those they serve.

In the past, when a scandal like this was exposed, “the world was horrified for a short period of time. Aid groups would say it’s terrible, we’re going to strengthen our systems and everybody is appeased,” says Paula Donovan, head of Code Blue, a campaign to end impunity for sexual exploitation and abuse by U.N. personnel. “Then it happens again.”

Aid observers think that in this era of #MeToo — the movement against sexual assault in the workplace — momentum is finally building for a new commitment in the aid community to zero tolerance.

For this reason, Donovan thinks that the Oxfam incident could trigger real change in the sector. “There’s a perfect storm now,” she says.

A history of sexual exploitation

The reports of sexual abuses in the aid industry cover a variety of victims, behaviors and organizations. Sometimes these incidents involve aid workers assaulting their colleagues. For two years, Nobert collected stories of staffer-on-staffer violence from more than 1,000 individuals for Report the Abuse, published in a report in 2017.

But the Oxfam scandal focuses on a different type of problem: humanitarian workers who sexually assault aid recipients. The workers may be employed by an aid group or be part of the U.N. peacekeeper force.

The forms of exploitation include range from sexual harassment to buying sex and bartering for sex to sex with a minor and rape, according to a document prepared by the U.N. in 2016.

And for aid workers who have wondered whether hiring a sex worker is truly grounds for dismissal, a task force created by the Inter-Agency Standing Committee — whose members include U.N. agencies, the WHO and the World Bank — makes it clear: “In most communities, the vast majority of women in prostitution don’t want to be there,” it states in an FAQ on its website. “Exploitative sex [is] one of the few avenues they have for obtaining money to meet basic needs.”

It’s hard to say how widespread this problem is. “Anecdotally, we know that this happens, though getting exact data collected and published has not always been common protocol,” says Nobert.

In the wake of the Oxfam scandal, however, a number of cases involving some of the major aid agencies have emerged. World Vision told Reuters on Tuesday that there were 10 incidents with volunteers or staff in 2016 “involving either sexual exploitation or abuse of a child involved in one of the charity’s activities.”

There have been incidents reported in the past as well.

In 2002, after mounting concerns about sexual violence by aid workers and U.N. employees against children in West Africa, Save the Children and UNHCR, the U.N. refugee agency, investigated the issue in a report. In a survey of 1,500 adults and children, researchers collected allegations of abuse and exploitation against 67 individuals. They found cases of staffers who traded humanitarian aid, like cooking oil and bulgur wheat for sex with girls under 18.

A few years later, spurred by a high-level U.N. meeting on sexual violence among staffers in 2006, Save the Children conducted another investigation, this time in Haiti, Sudan and the Ivory Coast. It found that aid workers from a number of organizations had asked children for “lesbian sexual displays,” filmed girls engaging in sexual activity in exchange for food rations or U.S. dollars.

Other cases have centered around sexual abuse by U.N. peacekeepers, who travel to disaster and conflict zones to protect civilians. A U.N. report found that in 2014, U.N. peacekeepers in the Central African Republic, largely from a French military force, were sexually abusing children in exchange for food or money. Some of the children were as young as 8 years old.

Donovan says that the peacekeepers also engage in sexual relations with women of child-bearing age — and there’s even a nickname for babies to women who become pregnant: “peacekeeper babies.”

Many Western charities and the U.N. have clear policies in place that prohibit such sexual exploitation. In a 2003 document, the U.N. states that acts of sexual exploitation are grounds for dismissal. Codes of conduct from Western charities like the Danish Refugee Council and the Lutheran World Federation, from 2007 and 2005, respectively, have similar language for its staffers.

Unpunished acts

So then why does this behavior persist?

“We have the guidelines, policies, procedures in place to prevent this. That’s not lacking,” says Judith Greenwood, head of the CHS Alliance, a charity network based in Geneva. In 2016, her group hosted a conference in Bangkok to explore ways that aid groups could improve investigations into allegations of sexual exploitation.

“What’s lacking,” says Greenwood, “is the application.”

Studies and reports have shown that sex offenses committed by staffers often happen without serious consequences to the perpetrators and that justice is rarely brought to victims. A 2015 independent report on the U.N. peacekeepers’ sex crimes, for example, detailed a “gross institutional failure to respond to the allegations in a meaningful way.”

Even Oxfam acknowledges its failings in a February 9 press release: “We have not done enough to change our own culture and to create the strongest possible policies to prevent harassment and protect people we work with around the world.”

Seeking solutions

Even before the Oxfam outrage, there were signs of change. In 2015, Donovan’s campaign, Code Blue, was created to keep up the pressure to end sexual exploitation by U.N. peacekeepers and seek justice for the victims. Its name hearkens to the peacekeepers’ iconic blue helmets.

In January 2017, just days after he took office, U.N. Secretary-General Antonio Guterres created a high-level task force to tackle the peacekeeper problem internally.

Still, more needs to be done, says Greenwood.

For one, aid groups need to do a better job of vetting employees, says Paul Spiegel, who directs the Center for Humanitarian Health at Johns Hopkins University. “Aid workers are recycled among different organizations because people are desperate to find staffers to go to these places at times.”

As for offenders: “Maybe you need to be blackballed in the community,” says Spiegel. “This person could never be hired again.”

Oxfam acknowledges that Roland van Hauwermeiren, the head of mission in Haiti who hired the sex workers in 2011, had also paid for sex while stationed in Chad in 2006. The charity had known about the allegation yet still hired him to work in Haiti four years later.

Since the Oxfam story broke last week, the charity shared how it plans to regain the trust of the people it aims to help. It will hire an independent body to look through past cases of sexual abuse at the charity to see if they can be reopened. It has set up a confidential whistleblowing hotline. It promises to do a better at checking the background of potential hires.

Oxfam’s deputy chief executive, Penny Lawrence, stepped down on Monday, taking “full responsibility” for the Haiti incident, which happened under her watch.

And Winnie Byanyima, executive director of Oxfam International, told NPR that the group will work with local authorities in Haiti to achieve justice for the women who were abused by the staffers. “For some [victims], that might mean helping them find better jobs, or helping them find markets [where they can sell goods],” she says, with the ultimate purpose of “restoring dignity.”

Both Greenwood’s group and Nobert have given credit to Oxfam for the steps it has taken.

Meanwhile, there could be financial consequences, not just for Oxfam but for other British charities. The United Kingdom, which gives $45 million to Oxfam annually, threatened to cut funding to overseas aid agencies if they fail to address sexual exploitation by their employees and volunteers in the field.

“Unless you safeguard everyone your organization comes into contact with, including beneficiaries, staff and volunteers, we will not fund you,” said Penny Mordaunt, U.K. secretary of state for international development at a conference in Stockholm on Wednesday.

These “respectful demands for humanitarian organizations to do better has helped hold us accountable, has helped us move forward,” says Nobert, founder of Report the Abuse.

But even a critic like Nobert, who in 2015, spoke publicly about being drugged and raped by a U.N. supplier while on a mission to South Sudan, stands by the work of these organizations.

“Don’t stop funding these groups. Not every humanitarian is committing acts of sexual abuse,” she says. “The vast majority go to [the field] to alleviate poverty and help people.”

News

via NPR Topics: News http://ift.tt/2m0CM10

February 15, 2018 at 03:27PM

Autonomous vehicle that will run your errands

Autonomous vehicle that will run your errands

http://ift.tt/2EvrdI2

Filed under:
,,


Transcript:
This vehicle runs your errands for you. Nuro is an on-road autonomous vehicle designed to transport goods. Nuro is a California startup founded by former Google engineers Dave Ferguson and Jiajun Zhu. They want the Nuro vehicle to move goods between consumers and businesses. The robot is fully autonomous. In all of Nuro’s footage there is no driver or passengers.
California startup Nuro created an autonomous robotic vehicle. The unnamed was built to move goods between consumers and

Continue reading Autonomous vehicle that will run your errands

Autonomous vehicle that will run your errands originally appeared on Autoblog on Thu, 15 Feb 2018 21:30:17 EST. Please see our terms for use of feeds.

Permalink | 
Email this | 
Comments

Cars

via Autoblog http://www.autoblog.com

February 15, 2018 at 08:43PM

Watch This Human Inkjet Printer Create a Portrait in 300 Hours With 3 Million Hand-Drawn Dots

Watch This Human Inkjet Printer Create a Portrait in 300 Hours With 3 Million Hand-Drawn Dots

http://ift.tt/2Ghgxce

There are a lot of reasons to be impressed with David Bayo’s beautiful Astrée portrait created using a painstaking stipple technique. But what’s more staggering to me than hand-drawing 3 million individual dots is somehow finding enough spare time to dedicate 300 hours to a single work of art. I can’t even find the…

Read more…

Tech

via Gizmodo http://gizmodo.com

February 15, 2018 at 02:42PM

Trump Keeps Loophole That Allows Trucks To Vastly Exceed Emission Standards

Trump Keeps Loophole That Allows Trucks To Vastly Exceed Emission Standards

http://ift.tt/2F6esAT

Here’s a familiar tale if you’ve followed the current administration in the White House. Former President Barack Obama tried to close an absurd loophole in federal law that would allow certain trucks to vastly (and we mean vastly) exceed emission standards. Current President Donald Trump—thanks to political gamesmanship and potentially shoddy academic work—is keeping the loophole alive.

That’s according to a whopper of a story from The New York Times today, which focuses on the sale of the trucks, known as “gliders,” because—as the Times puts it—“they are manufactured without engines and are later retrofitted with the rebuilt ones.” The loophole has been condemned from a vast array of businesses, including Volvo, trucking company Navistar, and UPS:

Gliders are popular among small trucking companies and individual truck owners, who say they cannot afford to buy or operate vehicles with new engines and modern emissions controls.

The trucks, which Fitzgerald claims burn less fuel per mile and are cheaper to repair, have been on the market since at least the 1970s. But after the federal government moved to force improvements in truck emissions, with standards that were first enacted during the Clinton administration and took full effect by 2010, gliders became a way for trucking companies to legally skirt the rules.

The trucks are cheaper to operate, the Times reports, but they “spew 40 to 55 times the air pollution of other new trucks, according to federal estimates, including toxins blamed for asthma, lung cancer and a range of other ailments.”

One major player in the market is a company called Fitzgerald Glider Kits, and Fitzgerald welcomed Trump with open arms during his 2016 presidential campaign. The company even sells “Make Trucks Great Again” hats, the Times notes. But of course.

So what changed? The sort of swampy, insider-y Washington-type stuff that Trump championed so vociferously against during his campaign.

The Fitzgerald family, it turns out, is politically connected. They’re friends with EPA-hater-turned-EPA Administrator Scott Pruitt, Republican congresswoman Diane Black of Tennessee, and Tennessee Technological University.

The University, according to the Times, produced a story which actually minimized pollution problems associated with gliders. How interesting.

The funder of the study? Fitzgerald.

Fitzgerald had not only paid for the study, which has roiled the faculty at Tennessee Tech and is the subject of an internal investigation, but it had also offered to build a new research center for the university on land owned by the company. And in the six weeks before Mr. Pruitt announced in November that he would grant the exemption, Fitzgerald business entities, executives and family members contributed at least $225,000 to Ms. Black’s campaign for governor, campaign disclosure records show.

What’s the upshot? In total, the EPA estimates that “over the life of every 10,000 trucks without modern emissions systems, up to 1,600 Americans would die prematurely, and thousands more would suffer a variety of ailments including bronchitis and heart attacks, particularly in cities with air pollution associated with diesel-powered trains, ships and power plants.”

Superb.

Fitzgerald’s owner, meanwhile, thinks the policy’s fantastic, telling the Times: “I don’t know why anyone would want to kill all these jobs. It does not make any sense.” Maybe he’ll get an idea after reading this piece? Maybe?

Tech

via Gizmodo http://gizmodo.com

February 15, 2018 at 12:24PM

Airbus’ Vahana Makes Its First Flight—And Now Must Defeat Bureaucracy

Airbus’ Vahana Makes Its First Flight—And Now Must Defeat Bureaucracy

http://ift.tt/2HeOR9o

At 8:52 on the morning of January 31, eight buzzing rotors lifted a black bubble of an aircraft off the ground for the first time. About 20 feet from nose to tail and the same from wingtip to wingtip, Vahana spent 53 seconds aloft, under its own power and autonomous control. It reached a height of 16 feet, looming over the runway at Oregon’s Pendleton UAS Test Range like a gigantisized quadcopter drone.

The flight may not sound like much, but the team from Airbus’ Silicon Valley outpost, A^3, and aerospace experts say such flights of experimental aircraft mark the start of a fundamental change in the way we get around.

“The revolution of aviation we see today is comparable to the jet age,” says Jim Gregory, director of the Aerospace Research Center at The Ohio State University.

Alpha One, as this prototype is dubbed, is a full-scale demonstrator of a single-person, vertical take-off and landing aircraft. The idea behind this thing and its many competitors is to remake the way we fly. Instead of piling dozens or hundreds of people into big jets that fly back and forth between airports, these little VTOL aircraft would work much like personal cars, taking a few people (or just one) on short trips in and around cities, making full use of the third dimension to blast traffic jams into the past. (This is why we dig the term “flying car”—even if the things don’t drive on the ground, they serve the function of a car, and they fly.)

Thirty Vahana engineers worked for two years to make their aircraft ready for its January flight. Just after sunrise, about half a dozen people crowded into the control room to watch. “I remember holding my breath for what felt like an eternity, my heart rate must have gone up two or three times,” says project lead Zach Lovering. When the vehicle safely touched down again, it was hugs and cheers all around. “Light aircraft are a bit of a special creature, they require every system to function appropriately to even get off the ground, let alone land safely,” Lovering says—meaning this test was make or break.

A hallmark moment to be sure, but now the Vahana team faces a challenge more beguiling than making this funky thing fly: convincing the bureaucrats to let it loose in American skies.

It’s the job of the Federal Aviation Administration to keep us safe when we fly, and that includes keeping a tight grip over what kinds of machines can be used in commercial service. Right now, Airbus’ Vahana is so different from existing aircraft—it blends aspects of planes and helicopters—the FAA doesn’t have a classification for it. That’s why FAA representatives were in Oregon for the test flight, watching over the engineers’ shoulders. They’re the folks anyone hoping to lift you up and over traffic needs to impress, and everyone moving into this new airspace knows it.

Before it can get to the fun stuff, the Vahana team must work with the FAA to figure out how to get its new aircraft design certified.

A^3

“The next challenge beyond the vehicle design is the way in which any designer or the wider ecosystem can push toward satisfying the certification and regulatory procedures required to enable scaled manufacturing,” Uber wrote in a 2016 white paper that spelled out its plan to launch air taxi networks in Dubai and Dallas as soon as 2020.

And speed is important, if companies want to play a dominant role in a new network of flying cars. Chinese company Ehang is already flying people in its giant drone. Given that some of them are local government officials (according to a video released by the company) it has the support of that country’s administration, which could prove a major advantage in getting to market.

The traditional route to an airworthiness certificate can take years, and that’s for the kind of aircraft the FAA knows intimately. The test and certification program for Boeing’s 787 was supposed to take nine months, that ended up being a year and a half. The process includes thousands of hours in the air, pushing the flight envelope, operating in extreme conditions, including different weather, heavy loads, and simulations of engine or other failures.

Before it can get to all that fun stuff, the Vahana team must work with the FAA to figure out how to get its new aircraft design certified. So it’s a good thing the agency recognizes the problem, and is working to modernize its rules. The most likely route to certification is finding flexibility in the fixed wing (as opposed to rotorcraft) category. In December 2016, the FAA released a rewrite of Part 23, its standards for light aircraft, removing the very rigid design requirements for planes, and replacing them with more creative ways to prove safety, based on rules the community of builders decides on together, with feds’ approval. The point of the process is to get around rules that, for example, insist on doing such and such for liquid fuel storage—in vehicles powered by batteries and motors. The European Aviation Safety Agency is introducing similarly flexible guidelines, to help outfits like Vahana’s German rival, Lilium.

For now, flying car developers start by applying to the FAA for an experimental aircraft certificate. “That’s a relatively quick process,” says Gregory, who’s writing a book on flight testing. Drone and truck builder Workhorse did just that for its electric octocopter SureFly. (It scrubbed its planned demo flight at CES in Las Vegas in January due to bad weather.) An experimental certificate gives engineers permission to fly their aircraft, but not to carry paying passengers.

For Vahana, the certification process in the US is already underway. “You submit a bunch of paperwork,” says Lovering. Then there are meetings, and the witnesses at the first flight. The next step is getting a type certificate, where the FAA says, OK, this vehicle system is definitely airworthy—go for it. That’s much harder. Expect more meetings, and many more test flights.

Still, the progress Vahana and others have made in this new field count as serious progress in a field that has long been slow to embrace change, governed by an FAA that prefers the safety of well-known systems over new technologies.

Meanwhile, the Vahana team is already moving ahead to more—and more impressive—test flights, aiming to prove their built-in safety features work. The next of many milestones for all the companies in the effort to make flying cars real.


Fly-Curious

Tech

via Wired Top Stories http://ift.tt/2uc60ci

February 15, 2018 at 07:12AM

Goodreads Can Tell You When Ebooks Go on Sale

Goodreads Can Tell You When Ebooks Go on Sale

http://ift.tt/2swnfcv

“The Bible’s on sale! Finally, I’ll find out what everyone’s talking about.” (Photo by Jenny Smith)

You can get sale alerts for all the books on your Goodreads “want to read” list. Whenever one of them is discounted on Kindle, iBooks, Nook, Google Play, or Kobo, you’ll get an email. (This only works for ebooks, not physical copies.)

Go to your account settings and click “Deals.” Select “Deals from my Want to Read shelf.” You can also get collections of deals according to author, genre, or popularity, but that can clutter your inbox. With these settings, you’ll just get alerts for the books you explicitly want to buy. I have 157 books on my reading list, and one goes on sale every two or three weeks. It’s so convenient it feels like cheating.

The deals are extreme: I grabbed Terry Pratchett’s Wintersmith for two bucks, A People’s History of the United States for four, and A Wizard of Earthsea for three. Books this cheap might be bad for the industry! But at these coffee-sized prices, you can afford to buy twice as many.

Tech

via Lifehacker http://lifehacker.com

February 15, 2018 at 09:04AM