Edward Snowden depicted on a German parade float. The US Senate is set to reconvene on May 31 for a last-minute session regarding an NSA spy program that Snowden revealed in 2013.Thomas Lohnes/Getty Images
The National Security Agency's access to phone-call data may well be cut off -- at least temporarily -- after the US Senate failed to reach a compromise about a controversial NSA surveillance program prior to a crucial deadline.
The Senate failed Saturday to pass an extension of provisions of the USA Patriot Act that expire June 1 and have served as the legal justification for the NSA's current, wholesale collection of telephone data. The spy agency has said such collection is crucial in fighting terrorism.
The US Defense Department is set to announce a new strategy to combat cyberthreats from other countries, according to a report.
US Defense Secretary Ash Carter on Thursday will outline the military's decision to start responding to foreign threats with cyberattacks, Reuters reported after seeing a copy of the strategy. The decision to go public and to use cyberwarfare tactics is designed to deter potential attacks, according to the document. The purpose is not to use cyberwarfare as the first salvo in any battle with another country, the document says, according to Reuters.
Newly passed legislation could lead to improved cybersecurity -- or surveillance, depending on whom you believe.Image by Dennis Skley, CC BY-ND 2.0
The House of Representatives passed bipartisan legislation on Wednesday designed to help companies and the federal government better defend against the growing threat of cyberattacks, despite opposition from privacy advocates.
Passed by a 307-116 vote, the controversial Protecting Cyber Networks Act encourages US companies to share information about security breaches with the federal government by providing them with expanded legal liability protections. Prompted in part by a recent uptick in high-profile data breaches, the legislation would allow companies to share information through a "cyber portal" administered by the Department of Homeland Security.
GitHub CEO and co-founder Chris Wanstrath.Stephen Shankland/CNET
PARIS -- To survive, startups must surmount challenges like product development, funding negotiations and cash flow. GitHub CEO Chris Wanstrath can add a very different challenge to his list: a sustained five-day network attack that some say marked the beginning of a new, more aggressive chapter in China's relations with the outside computing world.
GitHub's business, founded in 2008, is all about letting programmers work together. It offers a place where individual coders can contribute to each other's software projects, and where companies like Google, Facebook and Twitter can share work through the collaborative open-source movement. But on March 26, two organizations with GitHub accounts came under attack.
Attacks on GitHub are common, though it can be nearly impossible to figure out their origins, Wanstrath said during an interview here at the company's Merge conference. Even teenagers flexing their online muscles can launch an attack by buying access to a collection of machines. But this recent GitHub attack one was the worst in the company's history. The company's 20-person infrastructure team worked around the clock in a cat-and-mouse game to keep GitHub running even as the attackers shifted from one type of attack to another.
Those two targeted GitHub sites were GreatFire.org, a nonprofit organization that tries to help people bypass Chinese censorship, and the Chinese New York Times, according to an analysis of the attack by network security software firm Netresec. But it hurt all of GitHub's operations.
That's because it was a distributed denial-of-service (DDOS) attack, where countless computers around the world overwhelmed GitHub's servers to the point where they couldn't provide the online service they're supposed to provide.
Researchers dubbed the attack the Great Cannon. The Great Firewall of China has been around for years, letting the government block access to sites it doesn't want its Chinese residents seeing, but the Great Cannon serves an offensive rather than defense purpose, the researchers at the University of Toronto, University of California and Princeton University wrote.
When people visited innocent Web pages, the attacker's servers would replace website code with malicious code that would direct their browsers to ceaselessly reload the GitHub pages. "The Cannon manipulates the traffic of bystander' systems outside China, silently programming their browsers to create a massive DDOS attack," the researchers said.
The Chinese system could work similarly to one run by the US National Security Agency and its British counterpart, Government Communications Headquarters, according to documents leaked by former NSA contractor Edward Snowden. These programs, called Quantum and Foxacid, appeared to target the anonymous communication technology called Tor and employees at Belgian telecommunications company Belgacom, according to security expert Bruce Schneier and Der Spiegel, a German news publication.
Wanstrath sat down with CNET's Stephen Shankland to discuss the GitHub attack. The following is an edited transcript of their conversation.
What was your first inkling that you were under attack?Wanstrath: A traffic spike. We started to get an unusual amount of traffic. It was coming from all over the world -- were we on Oprah? Then we realized people's phones or computers were getting hijacked to load GitHub. We saw the man-on-the-side attack.
But that was just was the first attack of a series.Wanstrath: Yes. It was a mix of new stuff and boring stuff. The nature of the first attack was novel. After that we saw other attacks that were traditional, like SYN floods. In five days, we saw 18 or 20 attacks.
How often are you attacked ordinarily?Wanstrath: Once a month, if not more. We've got monitoring. We have a good incident response program set up. When there's an attack profile, you get paged. The main event of a DDOS is overwhelming the network with traffic. When you get a million requests from all over the world and they're exactly the same in one second, that's a DDOS. We have automated systems, then an ops team on the network around the clock.
So was somebody trying to send a message?Wanstrath: Of course. I just don't know who the message was for. I'm not even sure the message is to us. You don't need to be a state government to run this sort of attack. Sometimes it's teenagers fighting over message boards.
If it was from China, is there an easier way to target GreatFire and the New York Times than launching a five-day attack?Wanstrath: Sure. That's why it's confusing to conclude it came from China. In China, the New York Times is blocked, the Wall Street Journal is blocked. China blocks [lots] of websites.
And after five days they chose to disengage? Did you vanquish the enemy?Wanstrath: It was an ongoing battle. We successfully mitigated some of their attacks. Even though we were winning, we were fighting the whole time. There was a lot of press about it, which may have contributed to the disengagement. What's frustrating is there was no ransom note -- no request for anything. Just an attack.
What did it do to your business?Wanstrath: The outages are frustrating. We never went totally down, but people had errors. It interrupted people's workflows. At GitHub, people were up all weekend.
So is this a badge of honor? A sign that you've arrived?Wanstrath: It's hard to feel that way when there are real people trying to do real work with GitHub. If this is what arriving is like, this isn't what we signed up for.
We've been attacked for awhile. We have defenses. But GitHub two or three years ago would not have successfully mitigated this attack. You can imagine a smaller company just falling over.
What did you learn? Have you changed any technology or policies?Wanstrath: We learned a lot on a technical level. The DDOS is such a cat-and-mouse game. We can't share broadly with the technology community to say here's how to protect yourselves, though. It's like bacteria. If the attackers know what we do, then they'll stop doing that attack. Now, they don't know what we know.
Did you talk to the US government about the attack?Wanstrath: We can't say it really has a China component because we can't prove anything. We can't really ask for help for anyone. I'm not sure what would have happened if this had lasted a month.
Sony condemns WikiLeaks' republishing of data stolen in a crippling hack last year.AFP/Getty Images
WikiLeaks has republished the data stolen in last year's crippling hack of Sony Pictures Entertainment, making all the documents and emails available in a "fully searchable" format.
Although hackers had released the data in raw, bulk form last fall, WikiLeaks -- best known for the release of classified government and military documents -- announced Thursday it has published the information in a searchable database called "The Sony Archives."
There's great news on the mobile security front: cyberattacks are relatively rare and malware is relatively benign.
As a result, businesses should spend their efforts securing non-mobile infrastructure for now. However, mobile security will matter at some point, most likely when companies button up vulnerabilities elsewhere.
A look at how "Redirect to SMB" could work in one attack method.Cylance
Security research firm Cylance says it's found a vulnerability in Windows that could let hackers steal user names and passwords, but Microsoft isn't so sure it's worth focusing on.
Ninety percent of companies are vulnerable to cyber attacks, security experts say.CNET
The chances of another company suffering the devastating effects of a cyberattack like the one perpetrated on Sony last year are not as remote as we would like to believe, security researchers say.
Given the current security levels for most companies, 90 percent of them would be vulnerable to such an attack, which destroyed 3,000 computers and released sensitive information and proprietary content, security experts tell "60 Minutes." And there is no shortage of technically proficient people willing to launch such an attack, said Jon Miller, a former hacker who now serves as vice president of strategy at Cylance, an antivirus software maker.
Twitter on the Galaxy Note 3Photo by Nicole Cozma/CNET
Hopefully you're in full spring cleaning mode, because it's time to do a bit of optimization -- and possibly deletion -- on your social-media accounts. We'll start with making sure you have a recent password on your account, then unlink some unnecessary apps, and finally cut the cord on services you're no longer using.
From left: Poitras, Snowden and Greenwald. The three talked Thursday about the state of surveillance and about "Citizenfour," Poitras' Oscar-nominated film chronicling their storied secret discussions in a Hong Kong hideout.The New York Times
It was just like old times, sort of.
On Thursday, NSA whistle-blower Edward Snowden got together again with journalist Glenn Greenwald and filmmaker and journalist Laura Poitras to talk surveillance, reliving in a sense their now historic secret meeting two summers ago in a Hong Kong hotel room.
That first time around, Snowden handed the two a huge cache of top secret National Security Agency documents and asked them to let the public know about the NSA's
President Barack Obama on Friday plans to sign an executive order to promote sharing of information on cybersecurity threats between the private sector and government agencies.
The executive order is meant to establish a framework to help businesses and and government organizations "prioritize and optimize" their spending, and quickly identify and protect themselves against cyberattacks, including those in the employ of criminal organizations or foreign nations. The framework will also improve communication across companies and organizations to better manage cyber-risks.
Smile! Your FaceTime log-in procedure just became a bit more secure.Apple
Apple is strengthening the log-in process for its iMessage and FaceTime digital communications services with the aim of preventing hackers from hijacking users' accounts.
Apple announced Thursday it is adding two-step identity verification to users' accounts, stopping unauthorized people from accessing accounts, even if they know the user's password. Apple has been beefing up the security of its Internet products since last year's high-profile breaching of iCloud accounts belonging to celebrities who use the service.
A staggering figure for those who seek greater security for their personal information.Gemalto
Stealing your identity is a key reason hackers break in to corporate networks, according to a new study.
The world was hit by more than 1,500 data breaches in 2014, leading to 975 million data records being lost or stolen during the year, Netherlands-based security firm Gemalto reported on Thursday (PDF). Data breaches were up 49 percent in 2014 versus the prior year, and the number of lost or stolen records was up 78 percent.
Want to take your HTC One M8 or Galaxy S5 to a different carrier? That just got easier.Josh Miller/CNET
The days of carriers locking down devices to keep customers in place are officially dead.
Starting now, all US carriers must comply with requests from postpaid and prepaid customers to unlock their devices, as long as certain parameters are met. The industry group CTIA had committed last year to have all wireless carriers adhering to the regulation by February 11, 2015.
The financial consequences of Anthem's massive data breach could reach beyond the $100 million mark, according to reports.
The US health-insurance provider's own cyberinsurance policy covers losses of up to $100 million. However, when a company has up to 80 million current customers, former customers, employees and investors to notify, this amount may not be enough.
Mark Zuckerberg, CEO of Facebook, which on Wednesday announced its new ThreatExchange website, designed for security experts and companies to collaborate and share information about online threats they're seeing.
Has Anthem been too slow in communicating with those affect by the data breach?CNET
Anthem is under fire from attorneys general across the nation over a failure to communicate.
Last Wednesday, the health insurance provider revealed that it had been the victim of a massive data breach in which hackers broke into servers and stole the personal information of as many as 80 million current and former members and employees. The attack compromised names, birth dates, member IDs, Social Security numbers, addresses, phone numbers, email addresses and employment information, according to CEO Joseph Swedish.
Samsung lets you take control. But is it worth it?Samsung screenshot by Chris Matyszczyk/CNET
Should you have a Samsung Smart TV, you may have been practicing sign language or deep whispering whenever someone was using its voice recognition feature.
After all, last week the company's privacy policy was revealed to read, in part: "Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition."
President Barack Obama in December blamed North Korea for the Sony hack, one of many attacks targeting US businesses. A new agency, set to be announced Tuesday, will oversee the sharing of intelligence on cyberthreats.Getty Images
Cyberterrorism now has the level of attention within the Obama administration as its real-world counterpart.
The US government is set to announce Tuesday the creation of a new agency, called the Cyber Threat Intelligence Integration Center, that will focus on combating virtual threats like massive hacking operations and attacks on US infrastructure, according to a report from The Washington Post.
Apple CEO Tim Cook will speak at a cybersecurity summit on Friday.CBS Interactive
Apple CEO Tim Cook is scheduled to speak at Stanford University on Friday after the White House unveils a cybersecurity initiative, a new report says.
The White House will be hosting the summit at Stanford to outline how President Obama aims to get the US government and technology companies collaborating on issues of national security,according to The Hill. Apple's Cook will speak at that summit, though the iPhone maker has not said what he will address.
