Counterhack Cyber Intelligence

Picture it: you are at a job interview, and the interviewer requests that you log into your Facebook account so they can shoulder surf as you lay bare your profile in its entirety.

Worse, what if they ask you to hand over your Facebook username and password?

You might laugh and say I would never do that, but what if you really, really need a job? Many of us are desperate for work at the moment, so it is no surprise that some feel they must comply to avoid being stricken from the candidates’ list.

In the US, this tactic has been used with people applying for police officer or 911 dispatcher roles, according to an AP article. But the report says that it is happening elsewhere too.

The reason that an increasing number of employers want full access to a Facebook account is perhaps due to more of us hiding information from people we aren’t connected with.

Rob MacLeod was shortlisted for a police job in Baltimore when he was asked for his Facebook password. The Spec reports that:

The question startled MacLeod, now a bylaw enforcement officer in Peel Region. He had a personal policy of not sharing his password, no matter the circumstances. So when the request came, MacLeod offered to log in to his Facebook account and then leave the room so the interviewer could browse his page.

But he says the interviewer remained firm — he wanted the password. After a few minutes, MacLeod gave it to him.

MacLeod says he "felt like I was being pressured into doing it. It felt like if I didn’t do it, he would call the recruiter and say, ‘This guy’s not interested in the job’", he told The Spec.

It is not surprising that this interview technique is riling a number of individuals and groups, including American Civil Liberties Union (ACLU) attorney Catherine Crump, who states:

It’s an invasion of privacy for private employers to insist on looking at people’s private Facebook pages as a condition of employment or consideration in an application process. People are entitled to their private lives. You’d be appalled if your employer insisted on opening up your postal mail to see if there was anything of interest inside. It’s equally out of bounds for an employer to go on a fishing expedition through a person’s private social media account.

And Orin Kerr, Professor of Law at George Washington University, told AP “It’s akin to requiring someone’s house keys… [It’s] an egregious privacy violation.”

One can understand that companies want to do everything they can to ensure that candidates will be a good fit and won’t jeopardize the company, but asking for the keys to their personal Facebook account seems many, many steps too far.

So, if you are out looking for a job, here are some tips to consider:

1. Sanitise your account before you start applying for any jobs. Look for compromising messages, pictures, messages on walls, and remove or hide anything that you wouldn’t want a prospective employer to see
2. You can quote Facebook’s legal terms, which clearly state that
   

   You will not share your password, let anyone else access your account, or do anything else that might jeopardize the security of your account.

   Explain that you are a law-abiding citizen, and you can in no way break this binding contract with Facebook.

3. Hacker Factor author Neal Krawetz provides some advice, including exposing the company by anonymously posting online that they made this request during the interview. He also suggests that you consider suing them if you do not get the job.
4. Tell them you don’t use Facebook. Review your settings on your How You Connect page under Facebook’s ‘Privacy settings’, you can tweak these, as shown below.

   This means that an employer won’t find you during a search. Even friends of friends won’t see you listed. The problem here of course is that you are lying, but my view is that human rights to privacy are a little more important than a white lie.

   

   [Source]

SophosLabs has seen proof-of-concept code on Chinese websites which tries to exploit the recently announced Microsoft RDP vulnerability, causing computers to crash.

The critical vulnerability exists in Windows, and could be exploited to spread a worm automatically between vulnerable computers.

The advice from Microsoft and Sophos is to patch your copies of Windows as soon as possible, and Microsoft warned earlier this week that it expected malicious hackers to exploit the flaw within 30 days.

Well, that’s already happening. The code we’ve seen – in the form of Python scripts – attempts to exploit the MS12-020 RDP vulnerability and causes Windows computers to blue screen. It wouldn’t be a surprise if whoever is writing this code to further develop the attacks to produce a fast-spreading internet worm.

As a result, Windows users should consider themselves on high alert and harden their defences. Microsoft has discussed the patch, and other ways to mitigate the threat, in a blog post.

Sophos is adding detection of the script we have seen as Troj/PyRDP-A.

Fake exploits for the Microsoft RDP vulnerability

Meanwhile, we have also seen what claims to be the Python script of a worm that exploits the RDP exploit.

The script, however, appears to be a hoax. It references a Python module that doesn’t exist (FreeRDP), and claims to be written by sabu@fbi.gov, an obvious reference to the high profile Anonymous hacker who was recently revealed to have been secretly working for the FBI for months.

The code doesn’t exploit the MS12-020 vulnerability.

[Source]

Proceed with caution if you’re thinking of downloading and installing Anonymous OS, the purported new operating system from the Anonymous collective.

More than 20,000 people may have downloaded the Ubuntu Linux image full of hacking tools – but how do they know what the code really does?

When I first heard about Anonymous OS a couple of days ago, I instantly asked myself why would anyone want to put their trust in a piece of unknown software, written by unknown people, promoted on an Anonymous Tumblr webpage that you don’t know is safe or not?

If I were writing a cybercrime thriller, I might dream up a plot where the computer cops – desperate to know the identities of the hacktivists – concocted a plot where they made available software that promised to hide hackers’ identities.. but in fact secretly passed information back to the cops.

Of course, I’m not suggesting that has happened in this case. But stranger things have happened.. (like the prominent leader of LulzSec turning out to have been secretly working for the FBI since the middle of last year..)

Don’t forget, earlier this year, we saw hacktivists tricked into installing a Trojanised version of the Slowloris Denial of Service tool.

In such a climate, it wouldn’t be a surprise if there was a Trojan element sneaked into Anonymous OS too.

We haven’t analysed the Anonymous OS download yet. Frankly, with over a hundred thousand new samples of malware coming into our labs each day we’ve got better things to do with our time.

Anonymous OS isn’t a threat to the average guy in the street or to office workers, the only people who might be impacted by it are those who are foolish enough to knowingly install unknown software onto their computers.

Nevertheless, our advice to folks is clear – be wary!