Hackers get hold of critical Internet flaw

SAN FRANCISCO (AFP) - Internet security researchers on Thursday warned that hackers have caught on to a "critical" flaw that lets them control traffic on the Internet.

An elite squad of computer industry engineers that labored in secret to solve the problem released a software "patch" two weeks ago and sought to keep details of the vulnerability hidden at least a month to give people time to protect computers from attacks.

"We are in a lot of trouble," said IOActive security specialist Dan Kaminsky, who stumbled upon the Domain Name System (DNS) vulnerability about six months ago and reached out to industry giants to collaborate on a solution.

"This attack is very good. This attack is being weaponized out in the field. Everyone needs to patch, please," Kaminsky said. "This is a big deal."

DNS is used by every computer that links to the Internet and works similar to a telephone system routing calls to proper numbers, in this case the online numerical addresses of websites.

The vulnerability allows "cache poisoning" attacks that tinker with data stored in computer memory caches that relay Internet traffic to its destination.

Attackers could use the vulnerability to route Internet users wherever the hackers wanted, no matter what website address is typed into a web browser.

The threat is greatest for business computers handling online traffic or hosting websites, according to security researchers.

The flaw is a boon for "phishing" cons that involve leading people to imitation web pages of businesses such as bank or credit card companies to trick them into disclosing account numbers, passwords and other information.

"I was not intentionally seeking to cause anything that could break the Internet," Kaminsky said Thursday during a conference call with peers and media. "It's a little weird to talk about it out loud."

Kaminsky built a web page, www.doxpara.com, where people can find out whether their computers have the DNS vulnerability. As of Thursday, slightly more than half the computers tested at the website still needed to be patched.

Read the entire article originally published on Yahoo News by Glen Chapman

Unsolicited calls offering Credit Cards, your enhanced rights. Kudos to RBI!

If you receive an unsolicited credit card, you can now make your bank pay for the inconvenience caused to you.

The bank issuing the card will not only have to pay a penalty to the Reserve Bank of India, but also offer monetary compensation to the customer.

The RBI on Thursday issued a circular, which lists out a series of dos and don’ts about the protocol that will have to be maintained in the case of credit cards.

The circular says that if an unsolicited card is issued , activated and billed for without the consent of the customer, the card issuing bank will not only have to reverse the charges, but also pay a penalty amounting to twice the value of the charges reversed.

Additionally, help is also at hand from the banking ombudsman who will determine the amount of compensation payable for the loss of the complainant’s time, expenses incurred, harassment and the mental anguish suffered by him.

The bank will also be held responsible if a card is misused before it reaches the customer. “It is clarified that any loss arising out of misuse of such unsolicited cards will be the responsibility of the card issuing bank only,” the RBI said.

To prevent misuse, banks have been asked to consider issuing cards with photographs of the cardholder, cards with the PIN and signature laminated cards.

As in the case of loans, banks will also have to prescribe a ceiling rate of interest, processing and other charges in the case of credit card dues.

Banks, which offer accidental death and disability insurance on their cards in tie-up with insurers have been asked to obtain in writing the details of the nominees for these benefits.

Customers will also have to be given the option to decide whether they want the bank to share their personal information with other agencies.

The original notice to banks<http://rbidocs.rbi.org.in/rdocs/notification/PDFs/85811.pdf>from
Reserve Bank of India.
--