DXPG

Total Pageviews

Monday, August 26, 2013

Malicious Software Poses as Video from a Facebook Friend

A piece of malicious software masquerading as a Facebook video is hijacking users’ Facebook accounts and Web browsers, according to independent Italian security researchers who have been investigating the situation.

The malware appears as a link in an e-mail or Facebook message telling people that they have been tagged in a Facebook post. When users go to Facebook and click the link, they are sent to a separate Web site and prompted to download a browser extension or plug-in to watch a video, said one of the researchers, Carlo De Micheli, in a telephone interview on Monday.

Once that plug-in is downloaded, the attackers can access everything stored in the browser, including accounts with saved passwords. Many people commonly save e-mail, Facebook and Twitter login data in their browsers, so the attackers can masquerade as the victim and tap those accounts.

Mr. De Micheli said the malicious software has been spreading at a rate of about 40,000 attacks an hour and has so far affected more than 800,000 people using Google’s popular Chrome browser. It is replicating itself primarily by hijacking victims’ Facebook accounts and reaching out to their friends on the social network. A user hit by the malicious software cannot easily remove it, since it blocks access to the browser settings that allow it to be removed and also blocks access to many sites that offer virus removal software.

A spokeswoman for Google, which makes the Chrome browser, said the company was aware of the attack and has already disabled the browser extensions that allowed it.

“When we detect items containing malware or learn of them through reports, we remove them from the Chrome Web Store and from active Chrome instances,” said the spokeswoman, Veronica Navarrete, in a statement. “We’ve already removed several of these extensions, and are continuing to improve our automated systems to help detect them even faster.”

Facebook said that its security systems had also detected the attack and it was working to clear the malicious links.

“In the meantime, we have been blocking people from clicking through the links and have reported the bad browser extensions to the appropriate parties,”  Michael Kirkland, a Facebook spokesman, said in a statement. “We believe only a small percentage of our users were affected by this issue, and we are currently working with them to ensure that they’ve removed the bad browser extension.”

However, Mr. De Micheli said the attackers, who appear to be of Turkish origin based on comments embedded in the software, were adapting the malicious code and had already found a way to target users of Firefox, another popular browser.

This is not the first instance of an attack through a browser extension, which is a bit of software that allows a Web browser to perform specific functions, much like an app does for a smartphone. But this attack appears to be one of the most extensive to use the technology.

“A few years ago, you’d tell your friends, don’t click on attachments,” Mr. De Micheli said. Now, the same advice applies to browser add-ons, he said.

Mr. De Micheli said that browser makers should do a better job of warning users that installing a plug-in, like installing a smartphone app, can give the software access to a wide variety of personal information. “People are used to clicking ‘accept,’” he said.

Mr. De Micheli is an independent security researcher who, along with several other Italian colleagues, has done extensive work tracking unseemly activity on social networks, including the underground market in fake Twitter followers. In the case of the malicious browser extensions, he is working with Andrea Stroppa, Danny di Stefano and Matt Hofman.

Justin O’Kelly, a spokesman for Mozilla, said that users should make sure that they are only installing legitimate software from well-known Web sites that they trust. “Users should be wary of scams or suspicious messages asking them to install software from an unknown site,” he said in a statement.



Video Shows U.N. Inspectors Interviewing Survivors of Suspected Syrian Chemical Attack

Video posted to YouTube by antigovernment activists showed United Nations weapons inspectors arriving at a clinic in the town of Moadamiya, the location of a suspected chemical weapons attack last week.

As my colleagues Michael Gordon, Alan Cowell and Rick Gladstone report, United Nations weapons inspectors visited two hospitals in the Syrian countryside outside of Damascus on Monday to interview survivors of last week’s suspected chemical weapons attack and collect patient samples, despite a volley of sniper fire that disabled the lead vehicle in their convoy.

Antigovernment activists in the Damascus suburb of Moadamiya, southwest of the capital, posted video to YouTube that showed United Nations inspectors in blue helmets and body armor arriving at a cramped rebel clinic, where they interviewed witnesses and survivors of the attack.

A series of videos of the inspectors was posted to YouTube by an account affiliated with antigovernment activists in the town, which was the location of the smaller of two suspected chemical weapons attacks last week. The other location lies to the northeast of Damascus, near the towns of Erbeen, Ein Terma and Zamalka. Activists in those towns posted dozens of graphic videos online in the wake of the attack showing scores of dead bodies, including a large number of children.

Antigovernment activists in Moadamiya appeared to have documented almost every stage of the inspectors’ visit, from their arrival in the town to their departure a little before 5 p.m. local time. One of the first videos posted on Monday showed a small group of fighters from the Free Syrian Army waiting on the side of the road for the United Nations delegation to arrive. A man in civilian clothing stood with them and spoke directly into the camera, saying that he believed the sniper fire that hit the United Nations convoy earlier in the day came from a nearby air force intelligence facility.

Antigovernment activists in Moadamiya posted video to YouTube that showed a small group of Free Syrian Army fighters waiting on the side of the road for the arrival of United Nations weapons inspectors.

When the inspectors arrived in the town, video posted by the same activists showed a young man in green medical scrubs and a surgical mask leading them into an improvised hospital that he described as a “basement.” In the video, the young man in scrubs can be heard telling inspectors that the medical facility is kept underground because they have no way to keep it safe “in a higher place.” The makeshift room is dim and crowded with doctors and patients.

Video posted online Monday showed United Nations weapons inspectors arriving in Moadamiya and being led into a makeshift hospital in a dim basement.

Some of the most jarring images from last week’s suspected chemical attacks showed rooms full of dead bodies, including dozens of children. The video uploaded from Moadamiya, in contrast, showed a clinic that appeared to only treat adults. Two separate videos posted to YouTube showed a United Nations inspector interviewing the same man, who said he believed what he had experienced was a “chemical, chemical” attack.

United Nations inspectors interviewed witnesses and survivors of last week’s suspected chemical attack in video posted to YouTube by antigovernment activists.

A second video posted to YouTube by antigovernment activists showed United Nations inspectors interviewing the same man, who said he survived a “chemical, chemical” attack.

Another video posted online by activists in Moadamiya showed a member of the inspection team photographing and measuring a long metal tube lying on the floor of an outdoor courtyard, which the cameraman described as “a chemical rocket” involved in the suspected attack. There is no indication from the video that the cameraman’s assessment is accurate, nor can we tell what the inspector himself thought of the metal tube lying before him.

A member of the United Nations inspection team examined a metal tube that activists said was a “chemical rocket” involved in the suspected chemical weapons attack in Moadamiya.

Activists kept their cameras rolling even after the inspectors finished their work and prepared to leave the town. One video showed members of the United Nations team packing up a truck, as a young man who awaited their arrival offered a summary of their time in the town. He complained that delegation had run out of time, and was only able to visit two of the seven sites that townspeople had wanted to show them.

In video posted to YouTube, an activist in Moadamiya said that United Nations weapons inspectors did not have time to see all the sites that townspeople wanted to show them.

A second video showed the United Nations convoy leaving Moadamiya at shortly before 5 p.m. local time, speeding through the town’s empty streets and passing buildings devastated by airstrikes and shelling, en route back to Damascus.

Video posted to YouTube shows United Nations weapons inspectors leaving the location of a suspected chemical weapons attack and returning to Damascus.



Wildfire Near Yosemite Destroys Berkeley’s Family Campground

One of the largest wildfires in California history continued to rage Monday near Yosemite National Park, destroying more than 149,000 acres, including the city of Berkeley’s popular Tuolumne Family Camp, officials said.

In an update on Monday, state and federal fire officials said the blaze was 15 percent contained as it burned in Stanislaus National Forest and along the eastern edge into Yosemite. Most of the national park remained open, including its most visited area, Yosemite Valley, which has been untouched by the blaze.

An aerial view of the fire.

Built in 1922 near Groveland, Calif., the Tuolumne Family Camp was a summer vacation destination for generations of Berkeley residents, who turned to Facebook and The East Bay Express to share their memories.

KGO-TV, the ABC News affiliate in San Francisco, broadcast images of the destruction at the camp.

The city-operated camp was evacuated last Tuesday, three days after the fire started on Aug. 17. By the weekend, the fire had spread to the edges of the nearby Camp Mather campground, run by the city of San Francisco, but as of Sunday it had caused only minor damage, according to a statement from city officials.

On Saturday, Vivian Ho, a reporter for The San Francisco Chronicle who is covering the fire, visited the campground and posted a photo on Twitter.

Just a few days ago, people at another nearby camp, Tuolumne Trails, captured video of a plane dropping fire retardant.

Video from the Tuolumne Trails camp showing planes dropping fire retardant.

With steep slopes, rugged terrain and flames leaping from one towering tree to the next, the more than 3,500 firefighters struggling to contain the so-called Rim Fire have faced multiple challenges. The blaze could threaten sources of San Francisco’s water and power supply, as my colleagues Max Whittaker and Maggie Astor reported.

Gov. Jerry Brown, scheduled to visit the area on Monday, extended a state of emergency on Friday to include the county and city of San Francisco as the fire raced toward the Hetch Hetchy reservoir, a major source of drinking water for the city. So far, there has been no impact on the quality of water. The San Francisco Public Utilities Commission has had to shut down two of its three hydroelectric power stations.

The entrance to Yosemite National Park from Highway 120, the Hodgdon Meadow campground and the Hetch Hetchy backpackers’ campground remained closed on Sunday, but most of the park was open. The park’s webcam showed clear skies at Half Dome, a rock formation in Yosemite Valley.

The fire is one of dozens burning in the West, including at least 12 in California.

Karen L. Nyberg, an astronaut at the International Space Station, shared a photo on her Twitter account, @AstroKarenN, of what the fire looked like from her perspective.



How Surveillance Changes Behavior: A Restaurant Workers Case Study

Surveillance is certainly much in the news lately. Most notably, of course, there is the continuing outcry over the National Security Agency’s call-tracking program, disclosed in the documents leaked by Edward Snowden.

But surveillance even surfaced as a subject in last week’s televised debate among the Democratic candidates for mayor in New York. The office seekers were asked whether New York City should have more surveillance cameras. Six of the seven, card-carrying liberals all, replied without hesitation, yes. (Only Anthony Weiner said no.)

Most of the public discussion of surveillance technology and its use revolves around the question: Is it spooky or reassuring?

But another issue is the effect of surveillance on behavior. And a new research paper, published on Saturday, shows in detail how significant the surveillance effect can be.

The paper, “Cleaning House: The Impact of Information Technology Monitoring on Employee Theft and Productivity,” is the work of three academics: Lamar Pierce, an associate professor at the Olin Business School at Washington University in St. Louis; Daniel Snow, an associate professor at the Marriott School at Brigham Young University; and Andrew McAfee, a research scientist at the Sloan School of Management at the Massachusetts Institute of Technology.

The researchers measured the impact of software that monitors employee-level theft and sales transactions, before and after the technology was installed, at 392 restaurants in 39 states. The restaurants were in five “casual dining” chains. The paper does not name the five, but it cites examples of the casual dining category including Applebee’s, Chili’s and Olive Garden.

Employee theft and fraud is a big problem, estimated at up to $200 billion a year across the economy. In the restaurant industry, analysts estimate the losses from employee theft at 1 percent of revenue. That does not seem like a lot, but restaurant profit margins are slender, typically 2 to 5 percent. So cutting down on theft can be an important contributor to a restaurant’s financial health.

Most of the restaurant industry pays its servers low wages and they depend on tips. Employee turnover is high. In that environment, a certain amount of theft has long been regarded as a normal part of the business.

Unethical behavior runs the gamut. There is even a how-to book on the subject, published in 2004, “How To Burn Down the House: The Infamous Waiter and Bartender’s Scam Bible by Two Bourbon Street Waiters.” A simple example is a bartender’s not charging for a round of drinks, and urging the customers to “take care of me” â€" with a large tip. Other tactics are more elaborate.

But monitoring software is now available to track all transactions and detect suspicious patterns. In the new study, the tracking software was NCR’s Restaurant Guard product, and NCR provided the data. The software is intentionally set so that a restaurant manager gets only an electronic theft alert in cases that seem to clearly be misconduct. Otherwise, a manager might be mired in time-consuming detective work instead of running the restaurant.

The savings from the theft alerts themselves were modest, $108 a week per restaurant. However, after installing the monitoring software, the revenue per restaurant increased by an average of $2,982 a week, or about 7 percent.

The impact, the researchers say, came not from firing workers engaged in theft, but mostly from their changed behavior. Knowing they were being monitored, the servers not only pulled back on any unethical practices, but also channeled their efforts into, say, prompting customers to have that dessert or a second beer, raising revenue for the restaurant and tips for themselves.

“The same people who are stealing from you can be set up to succeed,” said Mr. Pierce of Washington University.

In the research, the data sets were sizable. For example, there were more than 630,000 transactions by servers tracked and collected each week over the course of the project.

But more significant, the researchers say, is what the data analysis might contribute to fields of study like social psychology and behavioral economics â€" and the business discipline of human resources management.

In human resources, much emphasis is placed on employee selection: if you pick the right people, they will do the right thing. Instead, this research suggests that the surveillance effect on employee behavior is striking.

“What’s surprising is the weird effectiveness of the intervention, once the monitoring technology is in place,” said Mr. McAfee of M.I.T.

Not surprisingly, NCR is delighted by the results. “It validates the customer data we’ve seen,” said Jeff Hindman, a vice president at NCR. “But this is done by outside experts with the academic standards and statistical rigor they bring to the analysis.”



How Surveillance Changes Behavior: A Restaurant Workers Case Study

Surveillance is certainly much in the news lately. Most notably, of course, there is the continuing outcry over the National Security Agency’s call-tracking program, disclosed in the documents leaked by Edward Snowden.

But surveillance even surfaced as a subject in last week’s televised debate among the Democratic candidates for mayor in New York. The office seekers were asked whether New York City should have more surveillance cameras. Six of the seven, card-carrying liberals all, replied without hesitation, yes. (Only Anthony Weiner said no.)

Most of the public discussion of surveillance technology and its use revolves around the question: Is it spooky or reassuring?

But another issue is the effect of surveillance on behavior. And a new research paper, published on Saturday, shows in detail how significant the surveillance effect can be.

The paper, “Cleaning House: The Impact of Information Technology Monitoring on Employee Theft and Productivity,” is the work of three academics: Lamar Pierce, an associate professor at the Olin Business School at Washington University in St. Louis; Daniel Snow, an associate professor at the Marriott School at Brigham Young University; and Andrew McAfee, a research scientist at the Sloan School of Management at the Massachusetts Institute of Technology.

The researchers measured the impact of software that monitors employee-level theft and sales transactions, before and after the technology was installed, at 392 restaurants in 39 states. The restaurants were in five “casual dining” chains. The paper does not name the five, but it cites examples of the casual dining category including Applebee’s, Chili’s and Olive Garden.

Employee theft and fraud is a big problem, estimated at up to $200 billion a year across the economy. In the restaurant industry, analysts estimate the losses from employee theft at 1 percent of revenue. That does not seem like a lot, but restaurant profit margins are slender, typically 2 to 5 percent. So cutting down on theft can be an important contributor to a restaurant’s financial health.

Most of the restaurant industry pays its servers low wages and they depend on tips. Employee turnover is high. In that environment, a certain amount of theft has long been regarded as a normal part of the business.

Unethical behavior runs the gamut. There is even a how-to book on the subject, published in 2004, “How To Burn Down the House: The Infamous Waiter and Bartender’s Scam Bible by Two Bourbon Street Waiters.” A simple example is a bartender’s not charging for a round of drinks, and urging the customers to “take care of me” â€" with a large tip. Other tactics are more elaborate.

But monitoring software is now available to track all transactions and detect suspicious patterns. In the new study, the tracking software was NCR’s Restaurant Guard product, and NCR provided the data. The software is intentionally set so that a restaurant manager gets only an electronic theft alert in cases that seem to clearly be misconduct. Otherwise, a manager might be mired in time-consuming detective work instead of running the restaurant.

The savings from the theft alerts themselves were modest, $108 a week per restaurant. However, after installing the monitoring software, the revenue per restaurant increased by an average of $2,982 a week, or about 7 percent.

The impact, the researchers say, came not from firing workers engaged in theft, but mostly from their changed behavior. Knowing they were being monitored, the servers not only pulled back on any unethical practices, but also channeled their efforts into, say, prompting customers to have that dessert or a second beer, raising revenue for the restaurant and tips for themselves.

“The same people who are stealing from you can be set up to succeed,” said Mr. Pierce of Washington University.

In the research, the data sets were sizable. For example, there were more than 630,000 transactions by servers tracked and collected each week over the course of the project.

But more significant, the researchers say, is what the data analysis might contribute to fields of study like social psychology and behavioral economics â€" and the business discipline of human resources management.

In human resources, much emphasis is placed on employee selection: if you pick the right people, they will do the right thing. Instead, this research suggests that the surveillance effect on employee behavior is striking.

“What’s surprising is the weird effectiveness of the intervention, once the monitoring technology is in place,” said Mr. McAfee of M.I.T.

Not surprisingly, NCR is delighted by the results. “It validates the customer data we’ve seen,” said Jeff Hindman, a vice president at NCR. “But this is done by outside experts with the academic standards and statistical rigor they bring to the analysis.”



Daily Report: Tech Upstarts Consider Their Mortality

SAN FRANCISCO â€" As a young executive at Microsoft, Steven A. Ballmer helped topple older, slower-moving technology giants like the Digital Equipment Corporation, Wang and Novell. These days, it is Microsoft’s turn to fend off the upstarts as it struggles to compete in a computing world that is increasingly mobile and based in a “cloud” of Internet-connected computers to which many customers gain access at the same time. It is all part of the inevitable life cycle for technology companies, Quentin Hardy reports.

“Getting disrupted is the defining characteristic of this industry,” said Aaron Levie, the chief executive of Box, an online data storage company. “You can even have a near monopoly like Microsoft did, and then everything gets redefined.”

Mr. Ballmer will not have to take Microsoft into the future; on Friday, he announced that he would retire within a year. But young executives like Mr. Levie are not gloating over Mr. Ballmer’s exit. They know well that one day â€" if they are lucky to be as successful as Mr. Ballmer â€" they could face the same problem.

“It just feeds my already-healthy sense of paranoia,” Mr. Levie said.

The rare tech company manages to thrive from one generation of technology to the next. Only a few of the big ones â€" I.B.M., Intel and Apple â€" have done it. And it is not yet clear if Microsoft has a clear path to joining that list of multigeneration kingpins.

Mr. Ballmer was closely identified with the personal computer revolution, and later with corporate software running on computer servers. Those innovations brought Microsoft the cash and talent to adapt to the early Internet with the Explorer browser, and diversify into online gaming.

What it could not buy Mr. Ballmer, the younger generation in tech says, was a clear vision of the future. Apple and Google have led development of smartphones, and a long list of companies like Amazon.com have led the development of cloud computing. Microsoft, meanwhile, has often had to play catch-up.



Daily Report: Tech Upstarts Consider Their Mortality

SAN FRANCISCO â€" As a young executive at Microsoft, Steven A. Ballmer helped topple older, slower-moving technology giants like the Digital Equipment Corporation, Wang and Novell. These days, it is Microsoft’s turn to fend off the upstarts as it struggles to compete in a computing world that is increasingly mobile and based in a “cloud” of Internet-connected computers to which many customers gain access at the same time. It is all part of the inevitable life cycle for technology companies, Quentin Hardy reports.

“Getting disrupted is the defining characteristic of this industry,” said Aaron Levie, the chief executive of Box, an online data storage company. “You can even have a near monopoly like Microsoft did, and then everything gets redefined.”

Mr. Ballmer will not have to take Microsoft into the future; on Friday, he announced that he would retire within a year. But young executives like Mr. Levie are not gloating over Mr. Ballmer’s exit. They know well that one day â€" if they are lucky to be as successful as Mr. Ballmer â€" they could face the same problem.

“It just feeds my already-healthy sense of paranoia,” Mr. Levie said.

The rare tech company manages to thrive from one generation of technology to the next. Only a few of the big ones â€" I.B.M., Intel and Apple â€" have done it. And it is not yet clear if Microsoft has a clear path to joining that list of multigeneration kingpins.

Mr. Ballmer was closely identified with the personal computer revolution, and later with corporate software running on computer servers. Those innovations brought Microsoft the cash and talent to adapt to the early Internet with the Explorer browser, and diversify into online gaming.

What it could not buy Mr. Ballmer, the younger generation in tech says, was a clear vision of the future. Apple and Google have led development of smartphones, and a long list of companies like Amazon.com have led the development of cloud computing. Microsoft, meanwhile, has often had to play catch-up.



Subscribe to: Posts (Atom)