Adobe-Noida-Buildings

Adobe information stolen in cyber attack on website

News has emerged that software giant Adobe information stolen in cyber attack on website

Adobe has confirmed that 2.9 million customers have had private information stolen during a “sophisticated” cyber attack on its website.

The attackers accessed encrypted customer passwords and payment card numbers, the company said.

But it does not believe decrypted debit or credit card data was removed.

Adobe Icons

Adobe also revealed that it was investigating the “illegal access” of source code for numerous products, including Adobe Acrobat and ColdFusion.

“We deeply regret that this incident occurred,” said Brad Arkin, Adobe’s chief security officer.

“Based on our findings to date, we are not aware of any specific increased risk to customers as a result of this incident,” he said.

But Chester Wisniewski, senior adviser at internet security company Sophos, told the BBC: “Access to the source code could be very serious.

“Billions of computers around the world use Adobe software, so if hackers manage to embed malicious code in official-looking software updates they could potentially take control of millions of machines.

“This is on the same level as a Microsoft security breach,” he added.

Adobe said it had been helped in its investigation by internet security journalist Brian Krebs and security expert Alex Holden.

The two discovered a 40GB cache of Adobe source code while investigating attacks on three US data providers, Dun & Bradstreet, Kroll Background America, and LexisNexis.

Mr Krebs said the Adobe code was on a server he believed the hackers used.

Compromised

Adobe said that it is resetting passwords for the customer accounts it believes were compromised, and that those customers will get an email alerting them to the change.

It is also recommending that, as a precaution, customers affected change their passwords and user information for other websites for which they used the same ID.

For those customers whose debit or credit card information is suspected of being accessed, Adobe is offering a complimentary one-year subscription to a credit-monitoring programme.

Finally, the company said it had notified law enforcement officials and is working to identify the hackers.

Adobe information stolen in cyber attack on website.

This article originally appeared on the BBC News website

Royal Baby Nursery

Royal Baby Malware Attacks

Scammers wasted little time after Prince William and his wife, the former Kate Middleton, announced the birth of their son, who’s now third in line to the British royal throne.

Royal Baby

“Because it is such big news, it didn’t take long for malicious elements to misuse it,” said Kaspersky Lab security researcher Michael Molsner in a Wednesday blog post, noting that the company’s spam traps had already intercepted an email promising regular “Royal Baby” updates.

The message also included a “watch the hospital-cam” link, which appeared to resolve to a legitimate site that had been compromised.

Although the site appears to have since been cleaned, it was serving malicious JavaScript files designed to infect browsers with the Blackhole infection kit.

Irish Web Design –  Royal Baby Malware Attacks

This story appeared on the Information Week Website

kimberley cookies

Irish Cookie Regulations

Irish Cookie Regulations – Update

This article was writted by Philip Nolan, Head of Commercial Law Department and Partner MH & C and Oisin Tobin, trainee, MH & C. Philip Nolan is a Partner in the Commercial Contracts and Outsourcing Department at Mason Hayes & Curran.

kimberley biscuits cookies

The Irish Regulations transposing the new European rules on cookies have come into force. While website operators will need to exercise care to ensure that they are complying with the new regime, these new rules are less onerous and disruptive than originally anticipated.

Cookies, or small items of code placed on a user’s computer by a website, are vital to the functioning of the modern web. Cookies allow website operators to determine how users browse their sites and are a technical prerequisite for the operation of more advanced websites, such as those which require their users to log-in. Cookies can also be used, more controversially, to monitor user behavior for the purpose of targeting advertisements.

The rules governing cookies are being overhauled across Europe at present due to an EU Directive adopted in 2009. While all Member States are obliged to implement the Directive, they are given a certain degree of freedom as to the exact manner in which they chose to do so. The Irish measures which implement the Directive, and which have just come into force, seem to minimize the potential negative impact of the Directive for websites and web businesses based in Ireland.  As a result, it would seem that the new Irish regime may prove to be an additional attraction to international web based businesses considering Ireland as their EU base.

Under the new regime, all websites must have user consent before they place a cookie onto the user’s computer.  The Irish rules do not require that this consent be explicit and therefore, it would seem that consent may be implied.  In addition, they must provide the user with clear, comprehensive, prominently displayed and easily accessible information about the cookie, particularly as to its purpose. While this regime is somewhat tougher than the previous rules, which required that websites give a user the ability to “opt-out” of the cookie being used, these new rules contain a number of provisions which should ensure that websites can become compliant without having to radically overhaul their design.  The regulations note that the methods of providing information and giving consent should be as user friendly as possible. In certain circumstances users may be able to give consent via their browser settings and many consider that the use of browser settings for consent may become a popular means of managing consents. Cookies which are technically required to operate the site are exempt from these new rules.

Notably, a provision in an earlier draft of the Irish regulations, prohibiting the current practice of providing the relevant disclosures about cookie use in a privacy policy, has not made it into the final regulations.   This means that privacy policies may continue to be used, once user friendly and prominently displayed, to provide information about cookies in compliance with the new rules.

In summary, it would seem the Minister for Communications has struck quite an effective balance between the privacy concerns of web users in relation to the use of cookies and the concerns of industry in relation to over-regulation of the internet.

Attribute to Philip Nolan, Head of Commercial Law Department and Partner MH & C and Oisin Tobin, trainee, MH & C. Philip Nolan is a Partner in the Commercial Contracts and Outsourcing Department at Mason Hayes & Curran. For more information, please contact Philip at pnolan@mhc.ie or + 353 1 614 5000. The content of this article is provided for information purposes only and does not constitute legal or other advice. Mason Hayes & Curran (www.mhc.ie) is a leading business law firm with offices in Dublin, London and New York. © Copyright Mason Hayes & Curran 2011. All rights reserved.

Irish Web Design – Irish Cookie Regulations

gangsters

Malware creators go professional

The professionalisation of malware

Fagin the crook

Summary of this article: The high-end of malware is reaching a new level quality that comes from it being written by professional organisations with real budgets and high standards. Be afraid.

For many years, anti-malware companies have been capturing immense numbers of new, malicious code samples every day. The actual number is controversial, but it’s in the hundreds of thousands. Not a typo.

These samples are generated programmatically by malware authors trying, by brute force, to create something that will slip through defenses. Most of them are garbage. Anti-malware programs don’t write signatures specific to them, but recognize them by more general characteristics as part of a malware family.

Roger Thompson of ICSA Labs, a security research group owned by Verizon, calls these ‘AFTs’ for ‘Another Freaking Trojan’. The term is meant to contrast with APT for ‘Advanced Persistent Threat’; there’s no standard definition of APT, but basically it’s a more sophisticated malware program which can hide in a target network and perhaps even defend itself.

I spoke with Thompson, who I have known for a long time from his pioneering work for several companies in the anti-malware industry. In a recent blog entry he notes a clear rise in the quality of malware at the very high end of the APT segment; he calls this Enterprise Malware because it is being written by enterprise-class organizations.

Security companies know from their own forensic examination of attacks that this Enterprise Malware can be traced back often to defense contractors and various branches of various governments. We know, at least since Stuxnet (although any fool knew it was going on before), that western governments were developing attack code. We know of similar activities from the PLA (People’s Liberation Army) in China, and now the FBI (with the possible assistance of the NSA) is using malware to infiltrate criminal activities. For years European governments have been open about their policy to allow police to hack into the computers of suspects without a warrant.

Not to dismiss the talents of the last generation of malware writers, but governments and defense contractors have enough budget to hire professionals; I suspect the pool of such people who are willing to work for government is much larger than the pool willing to work for criminal organizations. And with enough patience and talent, we may start seeing malware techniques which heretofore haven’t been worth the trouble. Thompson is concerned about the development of cross-platform malware. We saw an example of this in Stuxnet, which used Windows computers to find and attack Siemens industrial controllers.

As Thompson, who knows a thing or two about anti-malware technology, says, anti-malware software can find the AFTs a very, very high percentage of the time, but you can’t expect it to find these attacks, at least not when it matters. It’s for threats like these that defense-in-depth and rigorous attention to best practices is necessary. For high-value targets, there are also products and services, Solera Networks’ DeepSee series for example, which specifically attempt to find threats which are laying low in a network.

After digesting this information, I was tempted to think that this is good news for those of you under the radar; if you’re not the sort of operation that is going to merit a high-quality targeted attack, then following best practices — e.g. always updating all software and anti-malware, practicing least privilege, forcing strong passwords — then you should be OK. But that’s nothing new. It was always true. The real news is just how essential it is for those who might be the target of a high-quality, enterprise malware attack to follow those practices. And it’s discouraging to see how many organizations fall short.

This is an edited version of an article by Larry Seltzer

Read the full version of this article here:

Malware creators go professional Irish Web Design – Website Security

Gremlins poster

The dreaded Blackhole Exploit Kit is back

The dreaded Blackhole Exploit Kit is back!

Gremlins attack websites

The last week has seen a resurgence of this malicious software appearing on websites around the globe.

Visitors to the sites who have AVG Anti Virus software installed on their systems receive a warning about the infection.

Website owners who do not act quickly to deal with the infection and clean up their websites may find Google blocking access to their websites.

The Blackhole Exploit Kit and it’s many variations was developed by some of the most skilled computer criminals in the world.

It is thought that these gangs originate in Russia or Eastern Europe.

The Blackhole exploit kit is now the most prevalent web threat globally.

The criminals make the software available as a kit on an outright sale or licence basis and each version is tweaked to suit the ‘end user’ criminal’s particular purposes.

In general, the kit uses hidden code to analyse the software on the computer it attacks to find any vulnerabilities.

When it finds some software which can be exploited, it will then run another piece of software, which often in the form of a pop up window.

This appears to be a warning about a malware or virus infection when in point of fact, it is a malware!

The  computer is now under ‘remote control’ by the hackers, who can return and take over running the machine at any time.

What is particularly worrying about this infection is that there is at present no ‘magic bullet’ or simple cure.

Irish Web Design – the dreaded Blackhole Exploit Kit is back AKA Black hole exploit kit.

microsoft logo as medallions

FBI and Microsoft move in on Internet Criminals

FBI and Microsoft move in on Internet Criminals

american fbi logo

American FBI and Microsoft shut down the €375m theft botnet known as Citadel

The American FBI and Microsoft have cooperated in order to break up a massive network of hijacked home computers that have been responsible for stealing more than €375m from bank accounts around the globe.

The Citadel network was set up by a group of criminal gangs who remotely installed a keylogging program on upwards of five million machines in order to steal data.

About 1,000 of the 1,400 or so networks that made up the Citadel botnet are believed to have been shut down.

Co-ordinated action in 80 countries by police forces, tech firms and banking bodies helped to disrupt the network.

“The bad guys will feel the punch in the gut,” Richard Boscovich, a spokesman for Microsoft’s digital crimes unit said.

Control code

The cybercriminals behind Citadel cashed in by using login and password details for online bank accounts stolen from compromised computers.

This method was used to steal cash from a huge number of banks including American Express, Bank of America, PayPal, HSBC, Royal Bank of Canada and Wells Fargo.

Citadel emerged after core computer code for a widely used cybercrime kit, called Zeus, was released online.

Underground coders banded together to turn that code into a separate cybercrime toolkit that quickly proved popular with many malicious hackers.

In a blogpost detailing its action, Microsoft said Citadel had also grown because malicious code that could take over a PC had been bundled in with pirated versions of Windows.

The millions of PCs in the criminal network were spread around the globe, but were most heavily concentrated in North America, Western Europe, Hong Kong, India and Australia.

Despite the widespread action, which involved seizures of servers that co-ordinated the running of Citadel, the identity of the botnet’s main controller is unknown.

However, Microsoft has started a “John Doe” lawsuit against the anonymous controller, believing him to use the nickname Aquabox and be based in Eastern Europe.

In addition, the FBI is working with Europol and police forces in many other countries to track down and identify the 81 “lieutenants” that helped Aquabox keep Citadel running.

Microsoft has also started action to help people clean up an infected computer.

Typically, it said, machines compromised by Citadel were blocked from getting security updates to ensure those computers stayed part of the botnet.

With the network disrupted, machines should be free to get updates and purge the Citadel malware from their system.

FBI and Microsoft move in on Internet Criminals – Irish Web Design From an article on BBC News

cookie image

Cookies and what you need to know about them

irish web design cookie monster

Cookies and what you need to know about them

This website, as almost all websites do, uses cookies,  to help provide you with the best experience when you visit.

Cookies are simply small text files which are placed on your pc, laptop or mobile phone when you browse a website.

The cookies help us to:

  • Make our website work as you’d expect
  • Save you having to login every time you visit the site
  • Remember your settings during and between visits
  • Offer you free services/content (thanks to advertising)
  • Improve the speed/security of the site
  • Allow you to share pages with social networks like Facebook
  • Personalise our site to you to help you get what you need faster
  • Continuously improve our website for you
  • Make our marketing more efficient (ultimately helping us to offer the service we do at the price we do)

We do not use cookies to:

  • Collect any personally identifiable information (without your express permission)
  • Collect any sensitive information (without your express permission)
  • Pay sales commissions

You can learn more about all the cookies we use below

Granting us permission to use cookies

If the settings on your software that you are using to view this website (your browser) are adjusted to accept cookies we take this, and your continued use of our website, to mean that you are fine with this. Should you wish to remove or not use cookies from our site you can learn how to do this below, however doing so will likely mean that our site will not work as you would expect.

More about our Cookies

Website Function Cookies

Our own cookies

We use cookies to make our website work including:

  • Making our shopping basket and checkout work
  • Determining if you are logged in or not
  • Remembering your search settings
  • Remembering if you have accepted our terms and conditions
  • Showing you which pages you have recently visited
  • Allowing you to add comments to our site
  • Tailoring content to your needs
  • Remembering your preferences such as colours, text size and layout
  • Remembering if we have already asked you certain questions (e.g. you declined to use our app or take our survey)

There is no way to prevent these cookies being set other than to not use our site.

Third party functions

Our site, like most websites, includes functionality provided by third parties. A common example is an embedded YouTube video. Our site includes the following which use cookies:

  • Google
  • Youtube
  • Embedly
  • Twitter
  • Facebook

Disabling these cookies will likely break the functions offered by these third parties

Social Website Cookies

So you can easily ‘Like’? or share our content on the likes of Facebook and Twitter we have included sharing buttons on our site.

Cookies are set by:

  • AddThis – provide us with lots of sharing buttons all in one neat package

The privacy implications on this will vary from social network to social network and will be dependent on the privacy settings you have chosen on these networks.

Site Improvement Cookies

We regularly test new designs or site features on our site. We do this by showing slightly different versions of our website to different people and anonymously monitoring how our site visitors respond to these different versions. Ultimately this helps us to offer you a better website.

We use:

  • Chartbeat.com
  • VisualRevenue.com

We use cookies to compile visitor statistics such as how many people have visited our website, what type of technology they are using (e.g. Mac or Windows which helps to identify when our site isn’t working as it should for particular technologies), how long they spend on the site, what page they look at etc. This helps us to continuously improve our website. These so called “analyticsâ€? programs also tell us if , on an anonymous basis, how people reached this site (e.g. from a search engine) and whether they have been here before helping us to put more money into developing our services for you instead of marketing spend.

We use:

  • Google Analytics
  • chartbeat.com

Advertising Cookies

Cookies are widely used in online advertising. Neither us, advertisers or our advertising partners can gain personally identifiable information from these cookies. We only work with advertising partners who work to accepted privacy standards such as http://www.youronlinechoices.com/uk/iab-good-practice-principles

You can learn more about online advertising at http://www.youronlinechoices.com. You can opt-out of almost all advertising cookies at http://www.youronlinechoices.com/uk/your-ad-choices although we would prefer that you didn’ as ultimately adverts help keep much of the internet free. It is also worth noting that opting out of advertising cookies will not mean you won’t see adverts, just simply that they won’t be tailored to you any longer.

We use:

  • DoubleClick – owned by Google

Banner Adverts

We fund our site by showing adverts as you browse our site. These adverts are usually managed by a partner specialising in providing adverts for multiple sites. Invariably these partners place cookies to collect anonymous data about the websites you visits so they can personalise the adverts to you, ensure that you don’t see the same adverts too frequently and ultimately report to advertisers on which adverts are working. Our partners include:

Remarketing Cookies

You may notice that sometimes after visiting a site you see increased numbers of adverts from the site you visited. This is because advertisers, including ourselves pay for these adverts. The technology to do this is made possible by cookies and as such we may place a so called “remarketing cookieâ€? during your visit. We use these adverts to offer special offers etc to encourage you to come back to our site. Don’t worry we are unable to proactively reach out to you as the whole process is entirely anonymised. You can opt out of these cookies at anytime as explained above.

Turning Cookies Off

You can usually switch cookies off by adjusting your browser settings to stop it from accepting cookies (Learn how here). Doing so however will likely limit the functionality of our’s and a large proportion of the world’s websites as cookies are a standard part of most modern websites

 

This article on the Irish Web Design website called ‘Cookies and what you need to know about them’ contains content that fiest appeared appeared in the Irish Examiner

http://www.irishexaminer.com/info/cookiepolicy/

Plains of Kildare

Grants available for websites

kildare-county-enterprise-board-logo-Grants available for websites

Business Expansion Grants

Grants available for websites for businesses trading more than 18 months

The Business Expansion Grant is designed to assist the business in it’s growth phase after the initial 18 month start-up period. Micro enterprises that have availed of a Priming Grant are ineligible to apply for a Business Expansion Grant until 18 months after the final drawdown date of the Priming Grant, except in exceptional circumstances.

Business Expansion Grants may be awarded to sole traders, partnerships or limited companies that fulfil the following criteria:

  • Located within the CEB’s geographic area;
  • A business, which on growth, may or may not have the capacity to fit the Enterprise Ireland portfolio;
  • A business employing up to 10 employees;
  • A manufacturing or internationally traded service business;
  • A domestically traded service business with the potential to trade internationally.

The maximum Business Expansion Grant payable must not exceed 50% of the investment or €150,000, whichever is the lesser.

Grants over €80,000 and up to €150,000 shall be the exception and shall only apply in the case of projects that clearly demonstrate a potential to graduate to Enterprise Ireland and / or to export internationally.

In all other cases, the maximum grant shall be 50% of the investment of €80,000, whichever is the lesser.

Subject to the 50% limit, a maximum grant of up to €15,000 per full time job created shall apply in respect of any employment support grant aid.

Expenditure may be considered under the following headings:

  • Capital Items: These include fit out of workspace, office equipment, machinery, computer costs, hardware and software etc. (Note acquisition of building and purchase of mobile assets are excluded from grant aid).
  • Salary Costs: For first year of employment. This to be paid out in two instalments. The first instalment at the commencement of employment and the second instalment once the employment has continued in existence for a period of six months. The level of grant support should reflect the salary scale proposed for the employment being generated. It is anticipated that only quality jobs attracting salaries in excess of €40,000 will be eligible for the maximum €15,000 grant support with appropriately scaled back grants offered in accordance with proposed salary for lower paid positions. Staff recruitment costs may also be considered eligible for grant aid.
  • Rental / Accommodation Costs: For first year of project. (Note where rental space is already subsidised by an investment of public funds then grant support should reflect the differential between the market rate and subsidised rate). Rental costs may be paid up front subject to receipt by the Board of signed lease / rental agreements.
  • Utility Costs: These include installation costs for telephone and broadband. (Note mobile phone costs are excluded).
  • Marketing Costs: These include packaging, brochures, business cards, trade fairs, website design and development, and other marketing initiatives.
  • Consultancy Costs: These include design fees, patent costs, architect, accountant and legal fees.
  • Business Specific Training: Costs here refer to specialised management or key personnel training programmes that are required to ensure the growth of the business. Such courses should not be generally available under the Board’s general training programmes.

Grants available for websites

Grants available for websites – Irish Web Design

Captcha Security Check Image 2

Is Captcha security a good idea?

Captcha security test questioned

Is Captcha security a good idea? is a question has been raised as a result of problems with a White House petition.

The fact that Ticketmaster dumped the Captcha from their website casts further doubt on the need for this security measure.

 

Captcha Security Check Image Is Captcha security a good idea?
Captchas can be used in a graphic and in an audio form but both can be difficult to interpret

Is Captcha security a good idea?

The National Federation for the Blind in the USA has stated that its members are unable to sign an e-petition which is collecting support for demands that printed material should be more accessible to those who are visually impaired because of “Captcha” security on the website.

A Captcha is a graphic of a random word or numbers users must key in to show that they are human.

There is an equivalent audio version on most websites that feature the Captcha.

Captcha comes from ‘Completely Automated Public Turing Test to Tell Computers and Humans Apart’, so one could argue its two or three t’s short of an accurate Acronym.

The White House Washington USA Logo

The White House Washington USA Logo

The White House whose website it is says that it complies with official US accessibility standards although it has received just 8,200 signatures.

Chris Danielsen of the American Federation for the Blind said “We had asked people to sign the petition and we’re getting these emails saying that people can’t”

He told the Politico website that he realised there was a problem after he began publicising the petition.

The editor of the BBC’s ‘Ouch’ blog (for people with disabilities) Damon Rose said that “Captcha graphics are a nightmare – visually impaired people use screen readers to interpret their computer rather than their eyes and the screens can’t manage them.

“Ironically if I see an audio capture I tend not to bother with it because it’s usually such a poor experience… some of them sound like aliens talking and they put weird background noises over them. They are a bit of a joke in the blind community. I’ve spent half an hour on some and had to give up.”

Mr Rose added that a result of this was that many visually impaired people found that, on messageboards and blogs they could not contribute to discussion and debate.

ticketmaster logo

ticketmaster logo

Earlier the year Ticketmaster the international event ticket service removed the Captchas from its sales website.

Aaron Young of Bunnyfoot, the user experience consultancy said “It is generally speaking the one of the most hated pieces of user interaction on the web,”

In the view of Irish Web Design it is worth weighing up the value of the added security versus the irritation to users that Captcha causes.

Your business may be losing customers who simply give up when confronted with the frustration of a difficult to read Captcha.

So in response to the question: ‘Is Captcha security a good idea?’ Irish Web Design feels that in many cases it is not necessary, and therefore is not a good idea.

Captcha Cartoon Is Captcha security a good idea?

Captcha Cartoon

This article uses material that originally appeared on the BBC News Website

Is Captcha security a good idea? – Irish Web Design

American Cowboy

Your Domain Name Robbed

Irish Web Design issued a warning this week as yet another client had his preferred domain name robbed from under his nose.

highwayman stand and deliver

We were in the process of securing the preferred .ie, .net and .com domains our client had settled on. It came as a nasty surprise to discover that the rather unusual  .com domain name had been registered just days previously.

It transpired the client had been checking possible names for his new website some days previously and checked the preferred option on one of the many sites that appear at the top of Google.

There are many stories on the internet where people claim that the giant American company godaddy.com engage in this practice.

It appears that as soon as he logged out of the site automated software registered the domain name he was searching for.

The company who registered the site have no use for it, but they now own the name the client wanted.

The domain is available but first the client would need to appoint a company to negotiate for him, which is $69 to start with. Then he has to state in advance how much he is willing to pay. It is not uncommon for companies to demand thousands of Euro in order for them to hand over “your” name. If successful the ‘agent’ then adds another 10% on  top

Back in the days of the James brothers you knew you were dealing with robbing low-life bandits, but this form of robbery is corporate extortion on a massive scale.

You have no idea what the connections are between the agent, the company who registered the site and the company on whose site you first carried out the search.

The only thing you can be certain of is that you have been well and truly screwed.

The moral of the story?

Under no circumstances should you check the availability of domain names unless you know exactly what you are doing.

If you fail to heed this advice it may end up costing you thousands of Euro as you are subjected to information highway robbery.

american bandits

Your Domain Name Robbed an article by Irish Web Design

 

Visit Us On TwitterVisit Us On FacebookCheck Our Feed