{"id":2179,"date":"2018-06-02T07:11:49","date_gmt":"2018-06-02T07:11:49","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/a-spectre-solution-a-very-brief-cloudflare-outage-a-bank-heist-in-canada-and-more\/"},"modified":"2018-06-02T07:11:49","modified_gmt":"2018-06-02T07:11:49","slug":"a-spectre-solution-a-very-brief-cloudflare-outage-a-bank-heist-in-canada-and-more","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/a-spectre-solution-a-very-brief-cloudflare-outage-a-bank-heist-in-canada-and-more\/","title":{"rendered":"A Spectre solution, a (very) brief Cloudflare outage, a bank heist in Canada, and more"},"content":{"rendered":"
<\/div>\n

Roundup<\/strong> While we were busy chasing SpamCannibals<\/a>, jailing Yahoo hackers<\/a>, and blaming North Korea<\/a> for everything else, there was some interesting security news going on.<\/p>\n

Let’s have a look at some of the stories that didn’t quite make Reg<\/em> headlines.<\/p>\n

Boffins float a (sort of) fix for Spectre bug<\/span><\/h3>\n

A group of researchers from TU Dresden in Germany have outlined a mitigation<\/a> for one of the more daunting engineering problems associated with the Spectre-class of processor chip vulnerabilities.<\/p>\n

The group explains how its fix could address the Bounds Check Bypass<\/a> (aka Variant 1) issue in Spectre while still maintaining some decent performance on the patched CPU.<\/p>\n

The researchers say that, rather than serializing all instructions, they have a method to flag and delay certain instructions that could be vulnerable to exploitation, while continuing to process other instructions as before.<\/p>\n

By doing so, the researchers claim, they can remedy the Variant 1 vulnerability by merely slowing down performance by about 60 per cent. That’s not great, but it’s better than the possible 440 per cent increase in processing time that could be caused by fully serializing the chips.<\/p>\n

Bank hackers grab financial data on 90,000 Canadians<\/span><\/h3>\n

About 90,000 of America’s polite upstairs neighbors have had the misfortune of getting their banking information lifted by hackers.<\/p>\n

The CBC reports<\/a> that hackers were able to get into the networks of two major Canadian banks and pilfer tens of thousands of customer records, including account numbers, balances, passwords, and social insurance numbers.<\/p>\n

Both Simplii and Bank of Montreal were targeted in a ransomware attack. When the banks refused to pay the $1m cryptocoin bounty, the hackers went public and provided the information to the press.<\/p>\n

While the banks have vowed to cover any losses customers incur from the hack, the entire incident has some in Canada questioning<\/a> the security infrastructure for all banks in the country at a time when many are reporting record profits.<\/p>\n

Cloudflare DNS takes a couple minutes off<\/span><\/h3>\n

It’s not exactly a major outage, but it should be noted that, for a very brief time earlier this week, Cloudflare’s DNS service was offline.<\/p>\n

The edge network specialist says that<\/a> it was not an attack that brought down its 1.1.1.1 service for a whopping 17 minutes on Thursday, but rather a false alarm that triggered its Gatebot security tool into thinking something was wrong.<\/p>\n

Apparently, Cloudflare explained, Gatebot wasn’t able to properly handle requests in the range of its DNS service.<\/p>\n

“The effect was that, after pushing the new code release, our systems interpreted the resolver traffic as an attack,” Cloudflare explained.<\/p>\n

“The automatic systems deployed DNS mitigations for our DNS resolver IP ranges for 17 minutes, between 1758 and 1813 May 31st UTC. This caused 1.1.1.1 DNS resolver to be globally inaccessible.”<\/p>\n

Cloudflare says the issue should now be fixed, so nobody else will be getting a very short vacation from the internet any time soon.<\/p>\n

Also, earlier this week, a BGP leak affected<\/a> the 1.1.1.1 service. The hijack lasted for about a minute, no DNS lookups were lost or affected, we’re told, and it was probably a typo: an engineer used 1.1.1.1 as a placeholder and crashed into Cloudflare’s systems.<\/p>\n

SEC looks to bust up $21m ICO outfit on scam charges<\/span><\/h3>\n

Stop us if you’ve heard this one: an initial coin offering is suspected of just being a massive scam.<\/p>\n

This time it’s Titanium Blockchain Infrastructure Services that finds itself in the crosshairs of SEC \u2013 America’s financial watchdog. The regulator said it had obtained an emergency order to halt the company’s ICO as the agency pursues charges of fraud.<\/p>\n

The SEC claims that the company’s president, a self-described “blockchain evangelist” named Michael Stollaire, had been drumming up hype for the coin offering by lying about the company having the backing of the Federal Reserve as well as corporate giants like Verizon, Disney, and Boeing.<\/p>\n

The ICO had hoped to bring the company about $21m in proceeds from coin sales. That offering, however, is now on hold.<\/p>\n

“This ICO was based on a social media marketing blitz that allegedly deceived investors with purely fictional claims of business prospects,” said SEC Enforcement Division chief Robert Cohen.<\/p>\n

“Having filed multiple cases involving allegedly fraudulent ICOs, we again encourage investors to be especially cautious when considering these as investments.”<\/p>\n

\n

Quick links<\/span><\/h3>\n