Hackers Can Now Attack Your PC Even Without Internet!

         Simply removing a malware-infected machine from a network might not be enough to secure other devices, for sophisticated hackers have found an easy way out to bypass the 'air gapping technique'. The technique is used by network admins in building a literal air roadblock that stops malicious computer code from propagating throughout a network.

         Air-gap malware (named after the very technique it bypasses) travels through the air as sound waves to infect machines in the near vicinity without needing Internet. The 'smart' malware can effectively jump an air-gap by converting malicious code into high-frequency sound waves. These sound waves are then transmitted to nearby devices irrespective of any network leading to infection. The malware works in a way modems work and machines communicate over phone lines. "Recently, researchers have started to show proof-of-concept implementations of how malware could leak data from an air-gapped machine using peripheral devices such as microphones and sound cards." Engin Kirda, professor at Northeastern University and a co-founder of Lastline, a company specialising in advanced malware was quoted as saying.

         The startling finding indicates that a computer's sound card is more than sufficient to spread the malware as inaudible sound that could go on and infect other machines. If such is the case, there doesn't seem to be a viable cure or protection against the air-gap malware at least now. However, researchers are of the opinion that it doesn't pose much of a threat to casual computer users since hackers would have to be extremely sophisticated to pull of such an act!

Read More

India Turns Down WTO’s Trade Facilitation Agreement

On August 1, the United States of America Secretary of State, John Kerry met the Indian Prime Minister, Narendra Modi for the fifth India-US strategic dialogue. Kerry appreciated Modi’s agenda of Sabka Saath, Sabka Vikas (cooperation of all,  development for all) but the forty-minutes meeting didn’t turn out the way it was expected.

India vetoed from the World Trade Organisation’s (WTO) Trade Facilitation Agreement (TFA), fearing that the country might have to compromise on its food security. Modi said that the developed countries should understand the problems faced by the developing nations. For instance, India has a challenge of feeding a huge population.
The US secretary of State responded by saying that faliure in signing the agreement has undermined India’s image and it sends a confusing signal.
In December, 2013 a trade agreement, called the Bali Package, was signed among all the WTO members (159 countries) in Bali, Indonesia aiming at lowering global trade barriers.
TFA, which is a part of the Bali Package, aims at reducing the bureaucratic obligations in import-export of goods among the signatories. But the problem with the TFA arises with the clause that restricts the agricultural subsidies to 10 percent of the total agricultural production. If the limit is crossed then other nations can impose a trade penalty for disobeying the rule. This clause is likely to have an adverse effect on food security in developing countries, as there are major issues like that of poverty and over-population.
India’s agreement to the TFA was based on the premise that developing nations would be provided with relief and no tax or penalty would be imposed till 2017. A permanent solution, according to the agreement, was to be later worked out.
India is now against the TFA because the 10 percent limit on subsidy is based on 1986-88 prices when the cost of food grains were much lower. This magnifies the already existing problem of limited subsidy. Also developed countries like US provide huge subsidies to its farmers, but developing countries like India have got restricted permission.
India now demands a permanent solution to the restricted subsidy issue, its stand being supported by China and some southern African countries as well. Whereas according to the WTO, subsidies that require the recipient to meet certain export targets, or to use domestic goods instead of imported good distort the international trade and affect the farmers of other signing countries.
It is well taken that the concerns of the developing nations is a valid one, but they are still forced by developed giants like the US. With India’s initiative of turning down the TFA, other developing countries might also join hands with India in its opposition to the agreement.

Read More

Microsoft issues Emergency Windows Update to Block Fake SSL Certificates

Today, Microsoft has issued an emergency update for almost all versions of Windows and also for Microsoft devices running Windows Phone 8 and 8.1 to secure users from attacks that abuse the latest issued rogue SSL certificates, which could be used to impersonate Google and Yahoo! websites.

A week after the search engine giant Google spotted and blocked unauthorized digital certificates for a number of its domains that could result in a potentially serious security and privacy threat, Microsoft has responded back to block the bogus certificates from being used on its software as well.

"Today, we are updating the Certificate Trust List (CTL) for all supported releases of Microsoft Windows to remove the trust of mis-issued third-party digital certificates," said Dustin Childs, group manager of response communications.

The fake digital certificates, issued by the National Informatics Centre (NIC) of India - a unit of India’s Ministry of Communications and Information Technology, were uncovered at the beginning of this month by Google's security team.

Microsoft officials warned the country's certification authorities as well as Microsoft, because the certificates issued by NIC are included in the Microsoft Root Store and so are trusted by a large number of applications running on Windows, including Internet Explorer and Chrome.

Yet, Microsoft is not aware of any kind of attack leveraging this issue, but millions of websites operated by banks, e-commerce companies and other types of online services make use of such kind of cryptographic credentials to encrypt the web traffic and prove the authenticity of their servers.

"These SSL certificates could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against Web properties," a Microsoft advisory warned. "The subordinate CAs may also have been used to issue certificates for other, currently unknown sites, which could be subject to similar attacks."

The Certificate Trust list (CTL) update has been rolled out to all users who have automatic updates enabled, and for those who do not have the automatic updater of revoked certificates installed, Microsoft has released a patch that can be manually installed.

The emergency update addresses all Microsoft PC operating systems including Windows Vista, Windows version 8, 8.1, RT, RT 8.1, Server 2012, Server 2012 R2, and its Windows Phone 8 software. At this moment, there is no update available for systems running Windows Server 2003 to revoke the fraudulent certificates – Microsoft says it will issue an update as soon as one becomes available. Also Server 2003 support ends next year, but the company will provide a fix before then.

Read More