The city of Las Vegas is licking its wounds after suffering a cyber-attack on its computer network.

It is not yet known whether any sensitive information was compromised in the incident, which took place in the early hours of Tuesday morning. 

City spokesperson David Riggleman said that it was likely that the threat actors gained access to the city’s network via a malicious email. 

Riggleman said that the city’s IT department moved fast to counter the invasion and stated that “the city is taking extensive steps to protect its systems.”

City officials were notified after unusual activity occurred at around 4:30 a.m. on Tuesday, but by the evening the full extent of the damage wrought by the incident was yet to be confirmed. Riggleman said a clearer picture is likely to emerge over the next day or two.

According to Riggleman, the City of Lost Wages encounters an average of 279,000 attempts to breach its systems every month. 

He observed: “A lot of people out there . . . are trying to open that cyber door.”

While Las Vegas works out who it was that managed to step over its digital threshold and what they got up to, city residents are likely to experience some disruption. 

Riggleman said that the city’s emails may be affected by system analysts’ ongoing investigation into the breach. He expected any disruption, however, to be “minimal.”

If the breach turns out to be the latest in a string of ransomware attacks on US cities, then it is highly unlikely that Las Vegas will cough up the money. The city’s mayor, Carolyn Goodman, went on record in July as sponsor of a resolution not to pay ransoms in the event of a cybersecurity breach. The resolution was approved by the US Conference of Mayors. 

Given the timing of the attack, some may wonder if it was launched by a vengeful Iran as retaliation for the recent killing of Iranian major general Qassem Suleimani. 

Following the announcement of Suleimani’s death on January 2, the US Department of Homeland Security issued a warning for Americans to be on high alert for cyber-attacks coming from Iran.

Nigerian online betting company SureBet247 has told the public not to be deceived by “false” reports that the firm has suffered a serious data breach.

According to the website iAfrikan.com, over 32GB of SureBet247 data, spread across six databases, has been exposed online. The information affected by the alleged incident includes user profiles, betting slip logs, a list of SureBet247 staff email addresses, and data linked to the company’s website surebet247.com.

The alleged breach came to light after an anonymous source found SureBet247 data online and tipped off Australian security researcher and haveibeenpwned founder Troy Hunt. 

“Within the databases there’s everything from user records to betting histories, the latter consuming more than 100M rows in one of the databases,” said Hunt.

“I’m yet to total the user records, but multiple databases contained hundreds of thousands of user records each, so the number is substantial. Impacted data includes names, email addresses, dates of birth and betting records. It’s not yet clear whether passwords were also compromised, that’s something I’m hoping to clarify with them.”

The anonymous source reached out to Hunt in December 2019 after an attempt to warn SureBet247 of a potential security issue was spurned. Hunt contacted iAfrikan after his own efforts to notify SureBet247 of the alleged breach elicited no response. 

When iAfrikan’s Tefo Mohapi contacted the gambling company to warn them of the alleged breach, he received a suggestion to email technical support and the response that it was SureBet247’s decision whether or not to notify their customers of a possible data breach. 

According to MyNaijaBlog.com, the director-normal of Nigeria’s National Information Technology Development Agency (NITDA) has requested that an investigation into the alleged breach be carried out by the Data Breach Investigation Workforce.

SureBet247 has publicly denied that any data breach has taken place. Earlier today, the company posted the following message on Twitter: “Dont be decieve [sic] by any false info. We weren’t breached on any data. Thanks.”

SureBet247 was founded in 2011 and trades under the name ChessPlus International Limited.

According to Mohapi, other online sports betting operators may have been affected by the alleged security incident. The exposed databases indicate that BetAlfa, BetWay, BongoBongo, and TopBet may have been compromised. 

Google has tweaked its Project Zero disclosure policy in a bid to drive more thorough patch development and improved adoption.

The new direction for 2020 centers around one major change: from January 1 this year the firm will implement a full 90-day disclosure policy regardless of when a vulnerability is fixed by a vendor. In the past, the relevant researchers could decide whether disclosure came at the end of the 90-day period or when a bug was fixed.

Although the rationale for the previous policy was to speed patch development by affected vendors, Google now also wants to focus on additional goals, according to Project Zero manager, Tim Willis.

With 97.7% of issues identified by Project Zero now fixed within the deadline, thoughts moved to improving the underlying principles of simplicity, fairness and consistency, he said.

With that in mind, Google not only wants to continue pursuing faster patch development but also now to improving the thoroughness of patches.

“Too many times, we’ve seen vendors patch reported vulnerabilities by ‘papering over the cracks’ and not considering variants or addressing the root cause of a vulnerability,” explained Willis. “One concern here is that our policy goal of ‘faster patch development’ may exacerbate this problem, making it far too easy for attackers to revive their exploits and carry on attacking users with little fuss.”

Providing a full 90-day window means vendors will therefore have more time to perform root cause and variant analysis.

“We expect to see iterative and more thorough patching from vendors, removing opportunities that attackers currently have to make minor changes to their exploits and revive their zero-day exploits,” said Willis.

Google’s second goal for 2020 is to improve adoption of any patches that arise from Project Zero research.

“End user security doesn’t improve when a bug is found, and it doesn’t improve when a bug is fixed. It improves once the end user is aware of the bug and typically patches their device,” argued Willis.

“To this end, improving timely patch adoption is important to ensure that users are actually acquiring the benefit from the bug being fixed.”

Once again, the 90-day time frame should provide more opportunity and incentive for vendors to encourage installation of their fixes by a larger user population.

Google is also betting that leveling the playing field with a mandatory 90-day window will encourage vendors to work more closely with its researchers on bigger problems.

“We hope this experiment will encourage vendors to be transparent with us, to share more data, build trust and improve collaboration,” Willis concluded.

Global rights groups have joined forces to demand that Google tackles the problem of budget Android smartphones pre-installed with privacy infringing apps that users can’t remove.

Over 50 organizations, including the UK’s Privacy International, today asked the tech giant to stop manufacturers and other Android partners from delivering devices that could undermine user privacy and security.

They argued that because the apps come pre-installed, they can choose which permissions they want — sometimes using the device’s camera, microphone or location without the user’s knowledge.

“The failure of Google to moderate the pre-installed app ecosystem has opened it up to a wild-west of exploitation, putting users’ privacy and security at risk,” argued Privacy International technology lead, Christopher Weatherhead. “Google must act now to deter bad actors who shovel malicious and exploitative apps on individuals’ devices.”

The rights groups called for changes so that users can permanently uninstall any apps on their phones, including related background services that run even if the apps themselves are disabled.

They also want pre-installed apps to stick to the same rules as Play Store apps, especially in relation to custom permissions, and to have some form of update mechanism.

When manufacturers or vendors break these rules, Google should refuse certification for privacy reasons, they added.

The initiative comes after research released last March by Universidad Carlos III de Madrid (UC3M), the IMDEA Networks Institute, the International Computer Science Institute (ICSI) at Berkeley and Stony Brook University of New York.

The first-of-its-kind study covered 82,000 pre-installed Android apps on more than 1700 devices manufactured by 214 brands.

“As we demonstrated in this paper, this situation has become a peril to users’ privacy and even security due to an abuse of privilege or as a result of poor software engineering practices that introduce vulnerabilities and dangerous backdoors,” it concluded.

A Merseyside man has been jailed for two years after using a notorious Remote Access Trojan (RAT) to spy on women via their webcams.

Scott Cowley, 27, of St Helens, was sentenced at Liverpool Crown Court this week after pleading guilty to offences under the UK’s Computer Misuse Act and Sexual Offences Act.

He’s said to have used the Imminent Monitor RAT (IM-RAT) to remotely spy on his victims. According to local reports, arresting officers found three folders on his laptop named after each of his victims. They apparently contained images and videos of the women undressing and of one of them having sex.

Officers from the North West Regional Organised Crime Unit (NWROCU) had little problem in tracking him down as he reportedly used a PayPal account linked to his real name and email address to purchase the malware.

NWROCU’s detective sergeant Steve Frame welcomed the sentencing on Monday.

“This conviction demonstrates that despite the high-tech nature of the Cyber Crime, offenders have no place to hide. We take all reports of cybercrime seriously and are absolutely committed to tackling and undermining this evolving threat,” he added in a statement.

“If you have been the victim of a similar crime, or suspect somebody is involved in committing this type of crime please call 101 and report it to your local police force.”

Cowley was arrested as part of a global crackdown on the RAT at the end of November 2019 led by the Australian Federal Police (AFP) and coordinated internationally by Europol.

Some 13 of the RAT’s “most prolific users” were arrested and 430 devices seized, according to Europol. In the UK alone, 21 search warrants led to the arrest of nine individuals including Cowley, and the recovery of 100 items.

The operation began in June 2019 when warrants were issued to search an alleged employee and developer of the IM-RAT.

The malware is thought to have been used in 124 countries and sold to more than 14,500 buyers, generating huge demand thanks to its ease-of-use and relatively low selling price of just $25.