Spyware, viruses, & security forum: NEWS - October 03, 2012

[Screenshot: Google Warning]

In June, many Google users were surprised to see an unusual greeting at the top of their Gmail inbox, Google home page or Chrome browser. "Warning: We believe state-sponsored attackers may be attempting to compromise your account or computer."

On Tuesday, tens of thousands more Google users will begin to see that message. The company said that since it started alerting users to malicious - probably state-sponsored - activity on their computers in June, it has picked up thousands more instances of cyberattacks than it anticipated.

Mike Wiacek, a manager on Google's information security team, said in an interview on Tuesday that since Google started to alert users to state-sponsored attacks three months ago, it had gathered new intelligence about attack methods and the groups deploying them. He said the company was using that information to warn "tens of thousands of new users" that they may have been targets, starting on Tuesday.

Continued : http://bits.blogs.nytimes.com/2012/10/02/google-warns-new-state-sponsored-cyberattack-targets/

MegaDroid: 300,000 Androids clustered together to study network havoc

Anyone who builds an Android app knows that testing on real devices is important. But what if instead of testing on one device at a time, you could test 300,000?

Enter MegaDroid. A project of the US government's Sandia National Laboratories in California, the aptly named MegaDroid has linked 300,000 Android virtual machines together in a testbed for studying all kinds of network disruptions. Researchers could use MegaDroid for anything they can dream of, but the lab says it envisions projects that seek to "understand and limit the damage from network disruptions due to glitches in software or protocols, natural disasters, acts of terrorism, or other causes."

MegaDroid, unveiled on Tuesday, is the third in a series of such projects. The first was MegaTux, which booted 1 million Linux kernels as virtual machines in 2009, and MegaWin, which did the same with 100,000 Windows XP and Windows 7 instances. Fritz and team would like to extend the Mega- projects to iOS, but that would require some cooperation on Apple's part.

For MegaDroid, Sandia built a cluster on 520 nodes, each one a quad-core Intel Core i7 processor (Sandy Bridge) with 12GB RAM (and no disk storage), and a Gigabit Ethernet network. It cost about $500,000, a small amount for government labs accustomed to multimillion dollar supercomputers. Sandia actually specced out the cluster through CostCo, but then bought the hardware through a bidding process.

Continued :http://arstechnica.com/information-technology/2012/10/megadroid-300000-androids-clustered-together-to-study-network-havoc/

Also:
Researchers Link 300,000 Virtual Android Devices To Study Mobile Security
Android Network Used in Malware Propagation Forensics
Sandia builds massive Android network to study security, more

..a 'Success'

When an Illinois fusion center distributed a report last year stating that hackers from Russia had broken into a water district's SCADA system and sabotaged a water pump, the Department of Homeland Security stepped in publicly to denounce the report as false, blaming the regional fusion center for spreading unsubstantiated claims and sowing panic in the industrial control system community.

But while DHS was busy pointing a finger at the fusion center, its own Office of Intelligence and Analysis had been irresponsibly spreading the same false information privately in a report to Congress and the intelligence community, according to a Senate subcommittee investigation released late Tuesday. The DHS report was issued five days after the fusion center report was issued.

Even after the FBI and other investigators concluded a few days later that there was no merit to the hacking claims and that the reports were false, the DHS intelligence unit did not issue a correction to its report or notify Congress or the intelligence community that the information it spread was incorrect.

Continued : http://www.wired.com/threatlevel/2012/10/dhs-false-water-pump-hack/

Also: DHS utility, manufacturing security protection system blasted as useless in Senate report

.. it seriously

The US Government Accountability Office (GAO), prodded by Congress, has put out a new report [PDF] recommending that the US Food and Drug Administration (FDA) start thinking about how to secure insulin pumps and implantable cardioverter defibrillators from being vulnerable from targeted attacks.

As the report states, researchers have recently demonstrated the potential for incidents resulting from intentional threats in the two devices.

One example is the work done by McAfee's Barnaby Jack who, in October 2011, succeeded in overriding an insulin pump's radio control and its vibrating alert safety feature.

Cartridges in such pumps hold up to 300 units of insulin (capacity varies by manufacturer).

That's enough to last a typical diabetic one to two weeks (dosing varies depending on diet, subject weight, and insulin sensitivity), but Jack managed to dump an entire cartridge in one go.

Continued : http://nakedsecurity.sophos.com/2012/10/03/medical-device-hacking-fda-are-told-to-start-taking-it-seriously/