If you are having trouble viewing this email, click here to view this online

 

VOLUME 56

   ISSUE 56

24 March  2016

Article of the Month Around the World

Blockchain dead?

 

Mike Hearn, a Zurich-based developer and long-time proponent of Bitcoin, surprised many this year when he published a blog calling Bitcoin a "failed" project. This has bought a lot of people wondering, is there any truth to this rumor. And what is Bitcoin.
In the last one day conference held by ISACA Sri Lanka Chapter, for the first time in our emerald island, the pros and cons of this new technology was spoken on.
Bitcoins is a crypto-currency, a system of digitally created and traded tokens to which value is assigned. (http://www.bbc.com/news/technology-35343561) Fundamentally this is an online currency where each Bitcoin is basically a computer file that is stored in a 'digital wallet'. Although most people refer to Bitcoin as a currency, it is worth noting that for regulatory reasons many countries - including the United States - have decided to define it as a commodity instead.
The online ledger book, which maintains the Debit and Credit of each transaction that uses bitcoin, is known as the Blockchain. Computers have to solve cryptographic problems in order to add blocks to the Blockchain - In return, those computers receive bitcoins in a process known as bitcoin "mining". Users have a "bitcoin address", to which bitcoins may be sent or from which they may be used. Addresses are stored online in wallets that function like bank accounts.

 

 

Copies of these ledgers are shared by all the computers that access them, meaning they are distributed across the network, because bitcoin is, at its core is a distributed database. Therefore fundamental to Bitcoin’s security is the ability for any single node to be able to audit everything which is going on by itself, using nothing more than the Blockchain, its own computational power, and a reasonably accurate clock.


Sir Mark Walport has argued that they could be used by government departments as a more secure way of managing data. Because the Blockchain act as permanent records of every time that data is added to them - and because private the Blockchain allow access to specific users only - they are thought to be highly resistant to malicious tampering.(http://www.bbc.com/news/technology-35344843)


The biggest issue most bitcoin users acknowledge is how quickly new transactions can be processed. The size of blocks being added to the Blockchain has been increasing steadily with the rise of Bitcoin. As a result, the rate at which transactions can be processed has been slowing. Indeed, some transactions face significant delays, hampering payments. Some fear the network will eventually become oversaturated and cease to be usable.


The reason for this is that this online ledger book has limit on number of transactions it can process. Currently, each block can be no more than 1MB. (http://www.bbc.com/news/technology-35343561) The supposed founder, Mr. Satoshi Nakamoto (who still remains an enigma), put a cap on the number of transactions that can be processed due to the inherent processing limitation that every standard computer has.


Now few of the core-programmers, of the bitcoin community, wants to remove this temporary ceiling. The reason they state is that it limits the number of transactions that can occur per minute. So they state that if they want Bitcoin to compete with the likes of VISA and MASTER, they feel the limiter should be removed.


The Bitcoin XT version developed by Mr. Hearn, and Bitcoin's chief scientist Gavin Andresen and others offers to increase the block size limit to 8MB


However bulks of the core-programmers do not want it removed. Bitcoin's history as a "decentralised" currency has led to much hesitation over decisions that might change its fundamental nature. Any proposal relating to Bitcoin is likely to encourage fierce debate and, in some cases, stagnation.


There are alternatives, however. Nic Cary, co-founder of Bitcoin start-up Blockchain, points to BitcoinClassic, which would increase the block size limit to 2MB. Mr Cary, says the need to update the block size limit is not as urgent as some say. "This is a matter of perspective," he told the BBC.

"The Bitcoin network has been updated safely dozens of times and will continue to be the most reliable, affordable, and efficient way to send value around the world."


Another school of thought on the reason for not wanting the removal of the limiter is they feel would eventually mean only few people with high processing mechanisms (such as server-farms) would be in control of the processing of bitcoin transactions (this is known as mining). So in return the idea that started the bitcoin, where it will not be controlled by a large corporate, would be doubtful. Thus resulting in few people running the show.
This resulted in the previous set of core-programmers wanting to open this debate to the public miners. Whereas the later set stated that this should have been discussed and settled internally not open to people who do not understand the computer-logic or the intricate understanding of what makes this online ledger a possibility. Because, they say that Bitcoin protocol development must be done with great care. For any widespread change which introduces even a slight incompatibility have a strong chance in resulting in there being two separate and incompatible currencies.


However, there are some who feel that Bitcoin's potential as a currency has already been exhausted.
"I'm sure there are smart people right now working out what the next generation [of Bitcoin] should look like but I have to say I'm not convinced that money or payments is the optimum [use] of the technology," Dave Birch, a director at consultancy firm Consult Hyperion, told the BBC.


So much so UK 's chief scientific adviser has urged the government to adopt the technology that powers crypto-currency Bitcoin to run various public service.
Sir Mark Walport has argued that they could be used by government departments as a more secure way of managing data. Because the Blockchain act as permanent records of every time that data is added to them - and because private the Blockchain allow access to specific users only - they are thought to be highly resistant to malicious tampering.(http://www.bbc.com/news/technology-35344843)
Part of the problem was the lack of consensus over what Bitcoin was and how it should be used, he added.


So what is the conclusion? I think I could not have stated it better than Chris Baraniuk ,a Technology reporter for BBC “ There is still huge interest in developing both the currency and technologies based on the Blockchain idea of recording data. It seems unlikely the currency will collapse overnight. But it certainly looks as though fundamental questions over how Bitcoin works are now coming to a head. Whether the community that uses and supports Bitcoin will be able to come to a consensus on these matters remains to be seen. Mr. Hearn has lost faith in the project, of that there is no doubt. But many others are refusing to throw in the towel just yet.”


But a salient view that cropped up in the ISACA Sri Lanka chapter one day conference, as to the why have countries an issue with welcoming the crypto-currency as a viable option for the mode of currency (such as the case in VISA, MasterCard or even PayPal) is the lack in a single body that acts as a regulator to this new technology. Even though there exist advantage that this form of digital currency has over normal currency, such as theft, hard to forge a transaction and less cost, the deregulatory aspect of this currency still keeps regulators at bay

KUMAR MANTHRI
Assistant Manager – IS Audit
SJMS Associates | Independent Correspondent Firm to Deloitte Touche Tohmatsu



For more information on the crypto-currency event that was organized by ISACA Sri Lanka Chapter please visit www.isaca.lk or the ISACA Sri Lanka Chapter Facebook page at www.facebook.com/isaca.srilanka.  www.facebook.com/isaca.srilanka.
 

 

References

1 Statistics on the Internet growth in Sri Lanka
http://www.trc.gov.lk/images/pdf/
statis_sep_2012.doc
2.The Dragon Research Group (DRG)
http://www.dragonresearchgroup.org/
3.TSUBAME (Internet threat monitoring system) from JPCERT | CC
https://www.jpcert.or.jp/english/tsubame/
4.Shadowserver Foundation
http://www.shadowserver.org/wiki/
5. Team Cymru
http://www.team-cymru.com
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

 
  
 

Documents with malicious macros deliver fileless malware to financial-transaction systems

  

"...Spammed Word documents with malicious macros have become a popular method of infecting computers over the past few months. Attackers are now taking it one step further by using such documents to deliver fileless malware that gets loaded directly in the computer's memory.

Security researchers from Palo Alto Networks analyzed a recent attack campaign that pushed spam emails with malicious Word documents to business email addresses from the U.S., Canada and Europe....."

  Android Marcher now marching via porn sites
   

'...Android Marcher Trojan was first seen in 2013 scamming users for credit card information by prompting fake Google Play store payment page. In subsequent years, Marcher variants also started targeting banking applications by presenting fake login pages to steal user credentials.

Marcher has continued to stay active and was recently covered by phishlabs. In this blog, we will cover a new wave of Marcher Trojan that is active since past one month where the malware arrives as an adobe flash installer package. We have captured over 50 unique payloads from this campaign. Majority of these Marcher payloads are from pornographic sites serving fake adobe flash player for watching porn. The primary goal of this malware is still the same - display a fake Google Play store payment page and steal financial information from the user....'

CLOUD GIANT AMAZON WEB SERVICES TURNS 10

   
  

'....Amazon Web Services launched its first true cloud computing product, Simple Storage Services, 10 years ago today, turning the computing world on its head.

To the company’s early customers, “the cloud” was essentially a way to rent out storage on its data centers, hoping to find business from startups and established companies that found building out scalable data centers cost prohibitive......'

Hacker picks 1-800-FLOWERS' customers credit card info

  

'....In a post-Valentine's Day attack the e-commerce site of 1-800-FLOWERS was accessed by an unauthorized person for more than a day during which time about 7,000 customers placing orders on the site may have had their personal and payment information compromised.

The online flower retailer said in a letter to the California Department of Justice that for a 33-hour period – stretching from the evening of Feb. 15 to early morning on Feb. 17 – an attacker collected the name, address, email address, payment card number along with its expiration date and CVV security code of all those placing or attempting to place orders on the site...'

White Hat Hacks Tesla Firmware, Uncovers Plans for a New Car Model

'...nside the car's firmware update version 2.13.77, Mr. Hughes found a PNG image that depicted the logotype of a car model that Tesla doesn't yet sell, the P100D.

Currently, Tesla provides the P70D, the P85D, and P90D models, which come with 70KWh, 85kWh, and 90kWh batteries.

The logotype Mr. Hughes found inside the most recent firmware image means the company is preparing the car's source code for an upcoming model, one that features a 100kWh battery, and the image that Mr. Hughes found might be used in various sections of the vehicle's on-board digital display.....'

Month in Brief
Facebook Incidents Reported to Sri Lanka CERT|CC in February  2016
 
  
  Hacked
  Fake
  Other
   
  Statistics - Sri Lanka CERT|CC

Announcing SQL Server on Linux

'...It’s been an incredible year for the data business at Microsoft and an incredible year for data across the industry. This Thursday at our Data Driven event in New York, we will kick off a wave of launch activities for SQL Server 2016 with general availability later this year. This is the most significant release of SQL Server that we have ever done, and brings with it some fantastic new capabilities...'

SAMSUNG WINDOWS LAPTOP OWNERS URGED TO DOWNLOAD FIX TO MITM VULNERABILITY

'...Samsung laptop owners are being urged to update their Windows PCs after the discovery of a vulnerability that can allow remote attackers to download files onto a targeted system and gain complete control over the laptop. The flaw is tied to a feature called “Samsung SW Update Tool 2.2.5.16” designed keep Samsung laptop users’ drivers and software up to date. Security researchers at Core Security discovered the vulnerability in November 2015 and disclosed the flaw March 4 after Samsung issued the patch to fix the problem.....'

How cybercriminals evade detection

"...A new report by Damballa highlights not only how cybercriminals can stay under the radar for long periods of time, but also the need for enterprises to reassess existing security tools.

“Its’s no small feat to keep up with how cybercriminals operate. Attackers have an incredibly vibrant underground community where they can buy or rent anything from C&C infrastructure to sophisticated exploit kits to bare metal malware,” said Stephen Newman, CTO of Damballa...."
Surprise! You have mystery PCs

'...Our (Microsoft Windows) computer inventory tools, patching products and security software all rely on one thing: Active Directory. It’s the source of all the information we have about computers on our network, and it controls the security settings on those computers. We have software that installs patches on our computers, and it uses Active Directory to do what it does. Our antivirus product also relies on Active Directory to automatically install and update on our Windows computers. Active Directory is essentially our de facto inventory of Windows PCs. So what happens when we have a computer that’s not on our Active Directory domain? I found out last week..."
Attack on Zygote: a new twist in the evolution of mobile threats

"...The main danger posed by apps that gain root access to a mobile device without the user’s knowledge is that they can provide access to far more advanced and dangerous malware with highly innovative architecture. We feared that Trojans obtaining unauthorized superuser privileges to install legitimate apps and display advertising would eventually start installing malware. And our worst fears have been realized: rooting malware has begun spreading the most sophisticated mobile Trojans we have ever seen..."
OPENSSH PATCHES INFORMATION LEAK FLAW


"...Even with the greater awareness for strong security within organizations—and the high-profile hacks that have contributed to that increased awareness—security executives still encounter significant hurdles in doing their jobs to protect data and systems. Password entry Sample password protection policy The password protection policy of a large financial services institution with more than 5,000 employees. READ NOW Clashes with senior business executives as well as those at lower levels of organizations make it more challenging for CSOs and CISOs to create a secure environment, and yet they continue to happen..."

 
Notice Board
  Training and Awareness Programmes - March  2016
  
DateEventVenue
- 28th February 2016 - 3rd March Orientation programme for newly appointed ICT graduate teachers National Inland fisheries aquaculture training institute
- 29th February 2016 – 04th March
 
Orientation programme for newly appointed ICT NCoE teachers
Training programme for trainers team (80 persons)
ICT Laboratory ,Ministry of Education 
18th March 2016 Monthly Progress Review Meeting for the Provincial ICT coordinators ICT Laboratory ,Ministry of Education
- 21st March 2016 National Software Development workshop ICT branch Laboratory ,Ministry of Education

Brought to you by: