China's victory over hackers and spooks

Nick Wigham reports at News.com,

China has scored a victory against hackers and spooks as it surges ahead of other world powers in a new kind of space race.

IN A bid to build an entirely new kind of internet — completely secure and impervious to hackers — China has pulled off a major feat in particle physics.

Chinese scientists have set a new distance record for beaming a pair of entangled particles: photons of light that behave like twins and experience the exact same things simultaneously, even though they’re separated by great distances.

The principle is called quantum entanglement and it’s one of the subatomic world’s weirdest phenomena. And China has smashed the distance record for quantum entanglement.

In a groundbreaking experiment led by Professor Jian-Wei Pan of Hefei University in China, a laser on a satellite orbiting 480 kilometres above the earth produced entangled photons.

They were then transmitted to two different ground-based stations 1200 kilometres apart, without breaking the link between the photons, the researchers said in a report published in the journal Science.

That distance achieved in the experiment is 10 times greater than the previous record for entanglement and is also the first time entangled photons have been generated in space.

“It’s a huge, major achievement,” Thomas Jennewein, physicist at the University of Waterloo in Canada, told Science. “They started with this bold idea and managed to do it.”

China launched its first quantum satellite in August and if all goes according to plan will send up plenty more to create a system of communication which relies on entanglement.

...China has not disclosed how much money it has spent on Quantum research, but funding for basic research which includes quantum physics was $US101 billion in 2015 — an absolutely massive increase from the $US1.9 billion the country spent in 2005.
Scientists in the US, Canada, Europe and Japan are also rushing to exploit the power of particle physics to create secure communication systems, but China’s latest experiment puts the country well ahead of the pack.

Hackers and our elections

John Sexton reports at Hot Air,

Hackers have attempted to enter election systems in at least 20 states. NBC News published this scoop last night:
The “attempted intrusions” targeted online systems like registration databases, and not the actual voting or tabulation machines that will be used on Election Day and are not tied to the Internet.

The DHS official described much of the activity as “people poking at the systems to see if they are vulnerable.”

“We are absolutely concerned,” the DHS official said. “The concern is the ability to cause confusion and chaos.”

Read more here.

"State-sponsored actor"

Nicole Perlroth writes at The New York Times,

SAN FRANCISCO — Yahoo announced on Thursday that the account information of at least 500 million users was stolen by hackers two years ago, in the biggest known intrusion of one company’s computer network.

In a statement, Yahoo said user information — including names, email addresses, telephone numbers, birth dates, encrypted passwords and, in some cases, security questions — was compromised in 2014 by what it believed was a “state-sponsored actor.”

Hackers vs. journalists

Those poor cheaters

Ace of Spades brings us news today about the fact that the dating site Ashley Madison has been hacked. Alex Hern reports at The Guardian,

Hackers have stolen and leaked personal information from online cheating site Ashley Madison, an international dating site with the tagline: “Life is short. Have an affair.”

The site, which encourages married users to cheat on their spouses and advertises 37 million members, had its data hacked by a group calling itself the Impact Team. At least two other dating sites, Cougar Life and Established Men, also owned by the same parent group, Avid Life Media, have had their data compromised.

The Impact Team claims to have complete access to the company’s database, including not only user records for every single member, but also the financial records of ALM and other proprietary information. For now, the group has released just 40MB of data, including credit card details and several ALM documents.

According to the information security journalist Brian Krebs, who broke the news, ALM has confirmed that the hacked material is genuine, and the company is working to remove from the net the material that has already been posted. But the initial leak is just a taster, according to the Impact Team, which accompanied the data with a manifesto threatening release of further information if Ashley Madison and Established Men are not permanently closed.

“Avid Life Media has been instructed to take Ashley Madison and Established Men offline permanently in all forms, or we will release all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails. The other websites may stay online,” the group’s statement reads.

The hackers’ main point of contention is with the fact that Ashley Madison charges users a fee of £15 to carry out a “full delete” of their information if they decide to leave the site. Although users have the option of permanently hiding their profile free of charge, the company’s advertisements claim that the full delete service is the only way to completely remove their information from the servers.

But the hackers say that that claim is “a complete lie”.

“Users almost always pay with credit card; their purchase details are not removed as promised, and include real name and address, which is of course the most important information the users want removed,” they allege.

Read more here.

Target's breach of security

Did Target have warnings before hackers stole 40 million debit and credit cards from its servers? Three WSJ reporters write that

At least one analyst at the Minneapolis-based retailer wanted to do a more thorough security review of its payment system, a request that at least initially was brushed off.

(Photo by Getty images)

The sheer volume of warnings that retailers receive makes it hard to know which to take seriously. Target has an extensive cybersecurity intelligence team, which sees numerous threats each week and could prioritize only so many issues at its monthly steering committee meetings, the former employee said.

The hackers, still unnamed, originally gained access to Target's network by stealing the access credentials of a refrigeration contractor in Pennsylvania. The contractor, Fazio Mechanical Services, has confirmed it was breached and is cooperating with the Secret Service investigation.

The attackers stole not only the card data, but personal information like phone numbers and email addresses for up to 70 million people.