TABULA ROSA SYSTEMS

Thursday, July 14, 2016

Tabula Rosa Systems - Blog Of 7/14/2016 - What Is The Dark Web?

http://www.ibmbigdatahub.com/

by Tyler Carbone

Chief Operating Officer, Terbium Labs

What is the dark web? Finding consensus on the answer to that question is surprisingly challenging. Typically, studies discussing cyber threat and the dark web focus on sites hosted on hidden services within the Tor network. These sites—accessed by URLs ending in “onion”—are only accessible through Tor, an Internet overlay proxy network that users most frequently access with a special browser called the Tor Browser. Tor hidden services are outside the reach of a standard Internet browser and are set up so that both the hosts and the visitors of those sites are anonymous.

While many measures and discussions of the dark web focus on these hidden services, the dark web is bigger than just hidden services. A large number of sites customers classify as the dark web don’t live on Tor at all; they are hosted on the regular Internet and can be accessed from any browser. Often, these sites are simply hosted in countries where running, for example, a marketplace for stolen credit cards is not grounds to be shut down. For instance, many major fraud markets that claim to provide credit cards or bank accounts live, technically, on the clear web, and popular exploit sites exist steadily on even the most common top-level domains, even dot-coms.

At Terbium, we think about the dark web as anywhere on the Internet that our customers wouldn’t want to see their data appear, either for sale or for vandalism purposes. These locations range from forums on Tor hidden services to clear web carding marketplaces hosted in Eastern Europe to paste sites such as Pastebin that may be used largely for legitimate purposes.

What makes the dark web dark?

Recently, a global poll conducted byIpsos showed that 70 percent of people believe the dark web should be shut down. The idea of shutting down the dark web is likely to struggle to gain traction. Because, at the end of the day, the dark web is simply a series of independent websites hosted on both the clear web and as hidden services within the Tor network. Even if it were possible, or advisable, to shut down Tor entirely, doing so would do little to curb sites that may not even be hiding, except by virtue of being in countries with laws that do not touch them. Thinking of the dark web as a single entity isn’t entirely accurate, and shutting it down is not as simple as flipping a switch.

The issue is further complicated by the ambiguous nature of Tor itself. In addition to hosting a variety of illicit content, the Tor network is also a tool for free speech in regions that may seek to censor citizens. As a result, in addition to a lot of the so-called dark web existing outside the Tor network, much of the activity occurring within the Tor network is largely considered positive.

Criminal activity does occur on the dark web, but it’s hardly as shady or mysterious as it’s often made out to be. The dark web, criminally speaking, is primarily a place of business, and it mirrors traditional ecommerce far more than you might expect. Major markets allow you to browse through subsections of their websites to see what kinds of offers are available. You can filter your search results by vendor rating or sort your results by price. Vendors rely on reputation, advertisements and sales—Black Friday is a big sale day among fraud dealers, while drug dealers favor Halloween or New Year’s Day—just like traditional retailers.

Shining reviews from satisfied customers are a popular way for vendors to promote their shops, and fraudulent transactions—yes, even for fraud purchases—are quickly flagged as scams to warn other customers. Forums discuss the best places to find deals, who you can trust and how satisfied buyers are with their latest orders—not unlike typical forums on the clear web.

MINIMIZE THE THREAT OF THE DARK WEB

The reality is that the dark web—some of it on Tor, some of it on clear web sites—is made up of sites and activities that pretty closely mirror offline crime statistics. The majority of it is drugs, and of what remains, much of it is financial- or fraud-related crime. At times, the dark web is a disappointingly mundane corner of the Internet. Therefore, at Terbium our approach is to provide our customers with an affordable, automated and fully private tool to monitor for the appearance of data or discussions that they wouldn’t want to be public. Precisely because of how routine the transactions on the dark web can be, not ignoring them as well as not overreacting to them is equally important.

What can we do about the dark web?

Nevertheless, the question remains: Should we shut down the dark web? Here are some other questions that will be up for discussion among a panel of experts exploring the dark web, 28 June 2016, at 1 p.m. Eastern:

· Why are deep and dark web actors so much more challenging to identify?

· Can we permanently shut down the dark web? Would we want to? Why or why not?

· What type of illegal activities are conducted on the deep and dark web?

· What challenges does the dark web present for law enforcement agencies?

· What should be the government’s role in policing the dark web?

· What should or can private sector entities do in the deep and dark web?

Attend the live panel discussion for answers to these questions and more.

Host

Bob Stasio is a senior product manager of cyber analysis with IBM i2 Safer Planet. Stasio has nearly 14 years of expertise fighting top-tier malicious actors in the intelligence community, the US military, the National Security Agency (NSA) and the commercial sector. He also served on the initial staff of the US Cyber Command. During the troop surge of 2007, his intelligence unit supported the detainment of more than 450 high-value targets.

Guests

Tyler Carbone is a technology entrepreneur with a business and law background. A graduate of Harvard University and the University of Virginia, Tyler has cofounded and successfully sold two technology companies. He has consulted and advised a variety of clients, ranging from a Fortune 500 financial services company to local start-ups. Tyler currently is COO at Terbium Labs in Baltimore, Maryland.

Scott Dueweke formed Zebryx Consulting in 2015 to provide public and private sector clients an understanding of identities and alternative payment systems—both risks and rewards. Dueweke is an expert on identity and anonymous payments on the Internet, and he regularly advises senior leadership within financial institutions and the US government. He previously provided similar services for Agilex and from 2006–2014 with Booz Allen Hamilton.

Michael Goedeker is an author and researcher at the front end of cyber warfare, espionage and crime and researching academia, press and security professionals globally.

========================================= Good Netiquette And A Green Internet To All!

Special Bulletin - My just released book,

"You're Hired. Super Charge our Email Skills in 60 Minutes! (And Get That Job...)

is now on sales at Amazon.com

Great Reasons for Purchasing Netiquette IQ

· Get more email opens. Improve 100% or more.

· Receive more responses, interviews, appointments, prospects and sales.

· Be better understood.

· Eliminate indecisin.

· Avoid being spammed 100% or more.

· Have recipient finish reading your email content.

· Save time by reducing questions.

· Increase your level of clarity.

· Improve you time management with your email.

· Have quick access to a wealth of relevant email information.

Enjoy most of what you need for email in a single book.

=================================

**Important note** - contact our company for very powerful solutions for IP
management (IPv4 and IPv6, security, firewall and APT solutions:
www.tabularosa.net
==================================================

Another Special Announcement - Tune in to my radio interview, on Rider University's station, www.1077thebronc.com I discuss my recent book, above on "Your Career Is Calling", hosted by Wanda Ellett.

In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” has just been published and will be followed by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:

www.amazon.com/author/paulbabicki

In addition to this blog, I maintain a radio show on BlogtalkRadio and an online newsletter via paper.li.I have established Netiquette discussion groups with Linkedin and Yahoo. I am also a member of the International Business Etiquette and Protocol Group and Minding Manners among others. I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and I have been contributing to the blogs Everything Email and emailmonday . My work has appeared in numerous publications and I have presented to groups such as The Breakfast Club of NJ and PSG of Mercer County, NJ.

I am the president of Tabula Rosa Systems, a “best of breed” reseller of products for communications, email, network management software, security products and professional services. Also, I am the president of Netiquette IQ. We are currently developing an email IQ rating system, Netiquette IQ, which promotes the fundamentals outlined in my book.

Over the past twenty-five years, I have enjoyed a dynamic and successful career and have attained an extensive background in IT and electronic communications by selling and marketing within the information technology marketplace.Anyone who would like to review the book and have it posted on my blog or website, please contact me paul@netiquetteiq.com.
=============================================================

Wednesday, July 13, 2016

Tabula Rosa Systems - A Must Read Blog - Google Testing Post-Quantum Cryptography For Chrome

Informationwekk.com – 7/9/2016

Google Testing Post-Quantum Cryptography For Chrome

Although quantum computers are largely in the experimental phase, Google has started testing cryptography to protect against hackers in the post-quantum era.

Google is testing out post-quantum cryptography in a move to guard against hackers who may one day use quantum computers to break the security protocol used in HTTPS.

Although quantum computers are still small and experimental, Google is looking down the road to a time when quantum computers could be used to break the asymmetric cryptographic primitives that are used in TLS, which when used to secure HTTP constitutes the HTTPS protocol. Cryptographic primitives that can stay secure against quantum computers are known collectively as post-quantum cryptography.

"A hypothetical, future quantum computer would be able to retrospectively decrypt any Internet communication that was recorded today, and many types of information need to remain confidential for decades. Thus even the possibility of a future quantum computer is something that we should be thinking about today," Matt Braithwaite, a Google software engineer, said in a Google Security blog.

In an effort to guard against those potential hacks in the future, Google is now testing out post-quantum cryptography.

The test involves using the current encryption algorithm, an elliptic-curve key-exchange, which is used in Google's desktop Chrome browsers and a second, and experimental, post-quantum key-exchange algorithm.

Google notes that by layering the experimental algorithm over the existing one, if the experiment fails, the older algorithm will still be in place to provide security.

"Alternatively, if the post-quantum algorithm turns out to be secure then it'll protect the connection even against a future quantum computer," Braithwaite said.

Quantum computers are designed to leverage certain aspects of quantum physics to solve problems much faster than a traditional computer. The quantum computers used today are experimental and only use a small number of quantum bits (qubits). Google, with its D-Wave computer, which it operates with NASA, is working on developing a computer that can accommodate a larger number of qubits. Microsoft, IBM, Intel and others are also working on developing larger quantum computers.

Google's D-Wave computer can combine the benefits of digital and analog systems for quantum computing. The digital approach provides robust error correction, however it requires custom algorithms, whereas the analog method can be generalized and deal with various algorithms in an easier fashion. But analog quantum computing is limited by errors accumulating in the system and other factors.

Google is calling its quantum security experiment Chrome Canary. Users curious to know whether it's in use in their browser can check the Chrome menu and go to "developer tools." On the left-hand side, under "Main Origin," users can click on the developers.google.com link. Then, on the right-hand side in the box marked "Connection," users should find the word "Key Exchange" and see if it says "CECPQ1." The CECPQ1 indicates that Google domain is conducting the test.

However, Google notes that not all of its domains have enabled the experiment, and that even those that have done so may experience a fading in and out of the experiment if issues are found.

"Our aims with this experiment are to highlight an area of research that Google believes to be important and to gain real-world experience with the larger data structures that post-quantum algorithms will likely require," Braithwaite said.

Dawn Kawamoto is a freelance writer and editor. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's News.com, TheStreet.com, AOL's DailyFinance, and The ... View Full Bio

========================================== Good Netiquette And A Green Internet To All!

Special Bulletin - My just released book,

"You're Hired. Super Charge our Email Skills in 60 Minutes! (And Get That Job...)

is now on sales at Amazon.com

Great Reasons for Purchasing Netiquette IQ

· Get more email opens. Improve 100% or more.

· Receive more responses, interviews, appointments, prospects and sales.

· Be better understood.

· Eliminate indecisin.

· Avoid being spammed 100% or more.

· Have recipient finish reading your email content.

· Save time by reducing questions.

· Increase your level of clarity.

· Improve you time management with your email.

· Have quick access to a wealth of relevant email information.

Enjoy most of what you need for email in a single book.

=================================

Another Special Announcement - Tune in to my radio interview, on Rider University's station, www.1077thebronc.com I discuss my recent book, above on "Your Career Is Calling", hosted by Wanda Ellett.

Tuesday, July 12, 2016

Tabula Rosa Systems Security Blog - A Compelling Must Read From US CERT

Ransomware has been a topic on this blog several times. It still remains a devastating problem both to large organizations as well as smaller users. The article below is particularly compelling since it does come from US CERT. It is worth your full consideration!

National Cyber Awareness System:

TA16-091A: Ransomware and Recent Variants

03/31/2016 06:00 PM EDT

Original release date: March 31, 2016 | Last revised: July 11, 2016

Systems Affected

Networked Systems

Overview

In early 2016, destructive ransomware variants such as Locky and Samas were observed infecting computers belonging to individuals and businesses, which included healthcare facilities and hospitals worldwide. Ransomware is a type of malicious software that infects a computer and restricts users’ access to it until a ransom is paid to unlock it.
The United States Department of Homeland Security (DHS), in collaboration with Canadian Cyber Incident Response Centre (CCIRC), is releasing this Alert to provide further information on ransomware, specifically its main characteristics, its prevalence, variants that may be proliferating, and how users can prevent and mitigate against ransomware.

Description

WHAT IS RANSOMWARE?

Ransomware is a type of malware that infects computer systems, restricting users’ access to the infected systems. Ransomware variants have been observed for several years and often attempt to extort money from victims by displaying an on-screen alert. Typically, these alerts state that the user’s systems have been locked or that the user’s files have been encrypted. Users are told that unless a ransom is paid, access will not be restored. The ransom demanded from individuals varies greatly but is frequently $200–$400 dollars and must be paid in virtual currency, such as Bitcoin.
Ransomware is often spread through phishing emails that contain malicious attachments or through drive-by downloading. Drive-by downloading occurs when a user unknowingly visits an infected website and then malware is downloaded and installed without the user’s knowledge.
Crypto ransomware, a malware variant that encrypts files, is spread through similar methods and has also been spread through social media, such as Web-based instant messaging applications. Additionally, newer methods of ransomware infection have been observed. For example, vulnerable Web servers have been exploited as an entry point to gain access into an organization’s network.

WHY IS IT SO EFFECTIVE?

The authors of ransomware instill fear and panic into their victims, causing them to click on a link or pay a ransom, and users systems can become infected with additional malware. Ransomware displays intimidating messages similar to those below:

“Your computer has been infected with a virus. Click here to resolve the issue.”
“Your computer was used to visit websites with illegal content. To unlock your computer, you must pay a $100 fine.”
“All files on your computer have been encrypted. You must pay this ransom within 72 hours to regain access to your data.”

PROLIFERATION OF VARIANTS

In 2012, Symantec, using data from a command and control (C2) server of 5,700 computers compromised in one day, estimated that approximately 2.9 percent of those compromised users paid the ransom. With an average ransom of $200, this meant malicious actors profited $33,600 per day, or $394,400 per month, from a single C2 server. These rough estimates demonstrate how profitable ransomware can be for malicious actors.
This financial success has likely led to a proliferation of ransomware variants. In 2013, more destructive and lucrative ransomware variants were introduced, including Xorist, CryptorBit, and CryptoLocker. Some variants encrypt not just the files on the infected device, but also the contents of shared or networked drives. These variants are considered destructive because they encrypt users’ and organizations’ files, and render them useless until criminals receive a ransom.
In early 2016, a destructive ransomware variant, Locky, was observed infecting computers belonging to healthcare facilities and hospitals in the United States, New Zealand, and Germany. It propagates through spam emails that include malicious Microsoft Office documents or compressed attachments (e.g., .rar, .zip). The malicious attachments contain macros or JavaScript files to download Ransomware-Locky files.
Samas, another variant of destructive ransomware, was used to compromise the networks of healthcare facilities in 2016. Unlike Locky, Samas propagates through vulnerable Web servers. After the Web server was compromised, uploaded Ransomware-Samas files were used to infect the organization’s networks.

LINKS TO OTHER TYPES OF MALWARE

Systems infected with ransomware are also often infected with other malware. In the case of CryptoLocker, a user typically becomes infected by opening a malicious attachment from an email. This malicious attachment contains Upatre, a downloader, which infects the user with GameOver Zeus. GameOver Zeus is a variant of the Zeus Trojan that steals banking information and is also used to steal other types of data. Once a system is infected with GameOver Zeus, Upatre will also download CryptoLocker. Finally, CryptoLocker encrypts files on the infected system, and requests that a ransom be paid.
The close ties between ransomware and other types of malware were demonstrated through the recent botnet disruption operation against GameOver Zeus, which also proved effective against CryptoLocker. In June 2014, an international law enforcement operation successfully weakened the infrastructure of both GameOver Zeus and CryptoLocker.

Impact

Ransomware not only targets home users; businesses can also become infected with ransomware, leading to negative consequences, including

temporary or permanent loss of sensitive or proprietary information,
disruption to regular operations,
financial losses incurred to restore systems and files, and
potential harm to an organization’s reputation.

Paying the ransom does not guarantee the encrypted files will be released; it only guarantees that the malicious actors receive the victim’s money, and in some cases, their banking information. In addition, decrypting files does not mean the malware infection itself has been removed.

Solution

Infections can be devastating to an individual or organization, and recovery can be a difficult process that may require the services of a reputable data recovery specialist.
US-CERT recommends that users and administrators take the following preventive measures to protect their computer networks from ransomware infection:

Employ a data backup and recovery plan for all critical information. Perform and test regular backups to limit the impact of data or system loss and to expedite the recovery process. Note that network-connected backups can also be affected by ransomware; critical backups should be isolated from the network for optimum protection.
Use application whitelisting to help prevent malicious software and unapproved programs from running. Application whitelisting is one of the best security strategies as it allows only specified programs to run, while blocking all others, including malicious software.
Keep your operating system and software up-to-date with the latest patches. Vulnerable applications and operating systems are the target of most attacks. Ensuring these are patched with the latest updates greatly reduces the number of exploitable entry points available to an attacker.
Maintain up-to-date anti-virus software, and scan all software downloaded from the internet prior to executing.
Restrict users’ ability (permissions) to install and run unwanted software applications, and apply the principle of “Least Privilege” to all systems and services. Restricting these privileges may prevent malware from running or limit its capability to spread through the network.
Avoid enabling macros from email attachments. If a user opens the attachment and enables macros, embedded code will execute the malware on the machine. For enterprises or organizations, it may be best to block email messages with attachments from suspicious sources. For information on safely handling email attachments, see Recognizing and Avoiding Email Scams. Follow safe practices when browsing the Web. See Good Security Habits and Safeguarding Your Data for additional details.
Do not follow unsolicited Web links in emails. Refer to the US-CERT Security Tip on Avoiding Social Engineering and Phishing Attacks or the Security Publication on Ransomware for more information.

Individuals or organizations are discouraged from paying the ransom, as this does not guarantee files will be released. Report instances of fraud to the FBI at the Internet Crime Complaint Center.
========================================== Good Netiquette And A Green Internet To All!

Special Bulletin - My just released book,

"You're Hired. Super Charge our Email Skills in 60 Minutes! (And Get That Job...)

is now on sales at Amazon.com

Great Reasons for Purchasing Netiquette IQ

· Get more email opens. Improve 100% or more.

· Receive more responses, interviews, appointments, prospects and sales.

· Be better understood.

· Eliminate indecisin.

· Avoid being spammed 100% or more.

· Have recipient finish reading your email content.

· Save time by reducing questions.

· Increase your level of clarity.

· Improve you time management with your email.

· Have quick access to a wealth of relevant email information.

Enjoy most of what you need for email in a single book.

=================================

Another Special Announcement - Tune in to my radio interview, on Rider University's station, www.1077thebronc.com I discuss my recent book, above on "Your Career Is Calling", hosted by Wanda Ellett.

Monday, July 11, 2016

Tabula Rosa Systems Technical Alert - SB16-193: Vulnerability Summary for the Week of July 4, 2016

National Cyber Awareness System:

SB16-193: Vulnerability Summary for the Week of July 4, 2016

07/11/2016 07:40 AM EDT

Original release date: July 11, 2016

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

============================================== Good Netiquette And A Green Internet To All!

Special Bulletin - My just released book,

"You're Hired. Super Charge our Email Skills in 60 Minutes! (And Get That Job...)

is now on sales at Amazon.com

Great Reasons for Purchasing Netiquette IQ

· Get more email opens. Improve 100% or more.

· Receive more responses, interviews, appointments, prospects and sales.

· Be better understood.

· Eliminate indecisin.

· Avoid being spammed 100% or more.

· Have recipient finish reading your email content.

· Save time by reducing questions.

· Increase your level of clarity.

· Improve you time management with your email.

· Have quick access to a wealth of relevant email information.

Enjoy most of what you need for email in a single book.

=================================

Another Special Announcement - Tune in to my radio interview, on Rider University's station, www.1077thebronc.com I discuss my recent book, above on "Your Career Is Calling", hosted by Wanda Ellett.

Pages

Thursday, July 14, 2016

What makes the dark web dark?

What can we do about the dark web?

Host

Guests

Special Bulletin - My just released book,

is now on sales at Amazon.com

=================================

Another Special Announcement - Tune in to my radio interview, on Rider University's station, www.1077thebronc.com I discuss my recent book, above on "Your Career Is Calling", hosted by Wanda Ellett.

Wednesday, July 13, 2016

Special Bulletin - My just released book,

is now on sales at Amazon.com

=================================

Another Special Announcement - Tune in to my radio interview, on Rider University's station, www.1077thebronc.com I discuss my recent book, above on "Your Career Is Calling", hosted by Wanda Ellett.

Tuesday, July 12, 2016

Systems Affected

Overview

Description

WHAT IS RANSOMWARE?

WHY IS IT SO EFFECTIVE?

PROLIFERATION OF VARIANTS

LINKS TO OTHER TYPES OF MALWARE

Impact

Solution

Special Bulletin - My just released book,

is now on sales at Amazon.com

=================================

Another Special Announcement - Tune in to my radio interview, on Rider University's station, www.1077thebronc.com I discuss my recent book, above on "Your Career Is Calling", hosted by Wanda Ellett.

Monday, July 11, 2016

Special Bulletin - My just released book,

is now on sales at Amazon.com

=================================

Another Special Announcement - Tune in to my radio interview, on Rider University's station, www.1077thebronc.com I discuss my recent book, above on "Your Career Is Calling", hosted by Wanda Ellett.