Hackers strike Bank of Uganda accounts, try to steal 24,157,808.50 US Dollar

Ugandan government officials and hackers have since last July attempted
four times to siphon USh81 billion (Sh2.45 billion) through the Uganda
central bank. However some monies of the money that had successfully been wired to Hong Kong
and UAE was retrieved through inter-bank procedures, the latest being $8 million (Sh800
million) transferred on February 26, 2016. The accounts targeted were those of the
largest budget holders, among them the Defence, Energy and Agriculture ministries as
well as the Uganda National Roads Authority (UNRA). “The matter is the subject of an active investigation, so until that process ends we are not in a position to offer the details you are requesting for,” said Bank of Uganda communications director Christine Alupo. “Yes, indeed all the funds were recovered from the United Arab Emirates and Hong Kong and are back in the custody of the Bank of Uganda.”
The first attempt aimed at the biggest amount happened in July 2015 and $12 million (Sh1.2 billion) was targeted. The plot was foiled, and the masterminds went below the radar, re-emerging in  December 2015 to try to steal $2 million (Sh200 million). A month later, in January 2016, they made
another attempt to fork out Sh800 million but were detected in time before returning
to compromise the system last month. Although the Ministry of Finance first notified
Uganda Police of the breaches 10 months ago, its detectives did not act immediately,
prompting the military, whose budget was targeted, to swing into action and arrest three
suspects who are in police custody.  Police spokesperson Fred Enanga declined
to comment when asked why the UPDF had taken over the sensitive inquiries amid allegations
that police was compromised. Technocrats stole Ministry of Finance spokesman Jim Mugunga
said: “This is an ongoing investigation and our expectation is that the security agencies
involved are doing their work.” He was non-committal on the reported
past attempts, saying he believes investigators will unearth all breaches.
Government officials are believed to have shared passwords with foreign-based techsavvy
individuals, profiled the accounts with huge credits to stage the theft. All the Integrated Financial Management System transactions originated from the Ministry of Finance and processed through Bank of Uganda and the money was to be wired to fictitious companies in either Hong Kong or the United Arab Emirates. It is unclear how non-existent entities indicated in the documents held accounts, raising suspicion of possible collusion between host banks and the masterminds.
The fraud comes three years after the government instituted new financial integrity
measures to seal loopholes, following the 2012 scandal in which technocrats in the
Office of the Prime Minister stole in excess of USh60 billion (Sh1.8 billion) that development partners had pooled to rebuild war-scarred northern Uganda. HEIST Three suspected hackers arrested, $8m wired to Hong Kong and UAE retrieved.

4 things you should be doing right now so you won't get hacked

Cybercrime is a multi billion-dollar racket that affects corporations and individuals alike, but there are a few simple steps everyone can implement to protect against it.
“If you’re a target, which honestly most companies are, then you really have to depend on taking some basic measures," says Kyle Lady, a research and development engineer with Duo Security.
Tech Insider spoke with Lady recently about how hackers infiltrate systems and what the best methods are for stopping them. Here's what he recommends.

Use passwords with at least 14 characters that can't be found in the dictionary.

The 25 worst passwords of 2015 include entries like "123456," "football," and "password," and these can all be easily guessed by an attacker. And we're not talking about a hacker typing in different passwords until they get it right; most have software that can guess hundreds and thousands of passwords a minute.
So it's best to use something much stronger. "If I can find your password in a dictionary, so can an attacker," Lady says.
Lady recommends using a password with at least 14 characters (he uses at least 24) which has a number of uppercase and lowercase letters, and symbols in it. A password like "SYd#2n3l_!p4ss" — that has no real meaning and plenty of symbols to throw off a hacker — is going to be a lot better to use. But even using a phrase, like "this password security thing works," is going to be stronger than most.
"It’s going to be real hard [for an attacker]," Lady said. "Someone is going to expend a lot of resources just to guess that password by trying over and over."
But there's also a problem for the user: Memorizing that password full of hard-to-remember characters.

Use a password manager so you won't have to remember all of them.

A password manager like LastPass or 1Password can securely store all of your passwords for everything from your email to bank account in one spot, so you don't need to remember each one. Which is great, since Lady recommends using different passwords for your various accounts.
Instead of coming up with a strong password filled with various symbols and letters yourself, most password managers can generate very strong passwords for you, encrypt them, and keep it on file, "so you don’t have to have them written down," Lady says.
Then, you only need to come up with one really strong master password.
LastPass

Turn on two-factor authentication and your account will remain secure even if your password is hacked.

“Even weak passwords aren’t the end of the world, if you’re using two-factor authentication," Lady says.
Two-factor authentication is becoming standard for password security. With two-factor, a user enters their password, then goes through a second round of screening, usually by entering in a code they received in a text message. For the most part, this second step would stop most hackers in their tracks, since they'd have to steal your phone in order to proceed.
“It’s becoming a standard option, but most people don’t enable it," Lady says, noting that most people are too lazy to do so. You can usually find two-step authorization in your account settings. It's available on Facebook, Twitter, Gmail, Snapchat, and a ton of other services — just make sure you actually turn it on.
 
Google A screenshot of Google's two-step authentication

Be especially wary of emails asking you to do something, or phone calls about the security of your accounts.

About 91% of targeted cyber attacks begin with a "spear-phishing" email, a trick designed to get a specific person to click on a link, give up their password, or download malware. These types of emails are designed to look like the real thing, and are really hard to judge at first glance.
A scammer might email saying your PayPal account has been hacked, and you need to update your password. But once you click the link, you are actually giving them your password, not changing it. Lady says the key is to make sure you are on a legitimate page like paypal.com, and not a scam site with an address like www.paypalsecurity.xyz.
"If there’s any doubt in your mind, essentially, trust but verify," Lady said.
The same goes for suspicious phone calls. Hackers often use "social engineering" to convince a person to help them. So it's important to remain skeptical of calls from people claiming to be customer service representatives, since most companies don't call out, and almost all will never ask for passwords.
“I could be tech support with a cell phone in ten minutes and go around asking for passwords," Lady said.

Android: Smartphones hit with Mazar Bot malware that can 'erase everything'

Android has been hit with Mazar Bot malware that gives attackers control over the entire phone Google

Android users are being warned about a new strain of malware called Mazar Bot that is hitting smartphones, giving attackers full administrative rights to monitor and control nearly every aspect of the phone.
The manipulative and persistent piece of malware, found to be in active use by researchers at Heimdal Security, takes hold via a malware-ridden SMS/MMS message that, once clicked, spreads a torrent of alarming exploits such as sending malicious text messages, anonymously accessing the web, putting the phone into sleep mode and even fully erasing all content from the device.
Unlike the typical Android exploit, Mazar Bot targets users with a direct message and is not downloaded through a third-party application store. Until now, the malware was advertised as being for sale on the dark web however this is the first known case of it being exploited in active attacks.
Once on a device, the malware covertly downloads Tor that allows it to connect anonymously to the internet to ping a server that effectively acts like a beacon to alert the attacker that a fresh device has been compromised. What's worse, it can install the Android-based Polipo Proxy application which lets the owner of the malware intercept and spy on all internet traffic passing through the smartphone.
According to Andra Zaharia, security specialist at Heimdal Security, this could lead to Man-in-the-Middle (MITM) attacks which are often used to steal sensitive details such as email account logins, social media credentials and banking information.

Mazar Bot malware hits Android smartphones, giving attackers access to a range of exploits (Pictured)

Who is behind Mazar Bot?
While it's not 100% certain, security experts claim that evidence suggests the attackers operating the malware are Russian. When Mazar Bot was first discovered last year by researchers from Recorded Security, it was revealed the malware was being advertised on a Russian-language dark web-hosted website.
Additionally, the malware is coded not to work on Russian handsets. "Our team was not surprised to observe that the malware cannot be installed on smartphones running Android with the Russian language option," said Zaharia. "Mazar Bot will check the phone to identify the victim's country and this will stop the malicious APK if the targeted phone turns out to be owned by a Russian user."
And unfortunately, according to Heimdal Security, the malware is only likely to evolve in the coming months. "Attackers may be testing this new type of Android malware to see how they can improve their tactics and reach their final goals, which probably is making more money," added Zaharia. "We can expect this malware to expand its reach."
The Android mobile operating system has faced a number of major security concerns over the past 12 months, including the notorious Stagefright malware which at the time was said to have impacted up to 95% of all Android devices.

Google removes 13 Android apps from Play Store infected with Brain Test malware

A variant of the malicious app had 500,000- 1,000,000 downloads with a 4.5 rating Getty Images

The malicious software family — Brain Test — has managed to make a comeback affecting as many as 13 Android apps, with hundreds of thousands of downloads, from the Play Store. Google has removed all the infected apps from its Store.
"On December 29 we confirmed our suspicions that additional apps containing Brain Test malware were in Google Play. We found 13 Brain Test samples in total, written by the same developers. We contacted Google, who promptly removed these 13 apps from the Google Play Store," states cybersecurity firm, Lookout, which reports the return of Brain Test malware in the Play Store.
The infected apps removed from the Play Store are Cake Blast, Jump Planet, Honey Comb, Crazy Block, Crazy Jelly, Tiny Puzzle, Ninja Hook, Piggy Jump, Just Fire, Eat Bubble, Hit Planet, Cake Tower and Drag Box.
The malicious app basically attempts to detect if a device is rooted, and then it copies several files to the/system partition. Performing factory reset is not enough to remove the app from the compromised device, as the process does not clear the/system partition.
The solution
But if your device has been compromised with this malware, the best solution is to first create a backup of all important data of the Android device and then re-flash stock update released by the manufacturer, advises Lookout.
The current version of the Brain Test malware bears features similar to the original version of the malware detected in September 2015. Brain Test was first discovered by cybersecurity firm Check Point in September, which claims the malware was published to Google Play Store twice, with each instance having between 100,000 and 500,000 downloads. The malicious apps that had affected 200,000 to one million users, was later on removed from the Play Store.
The primary goal of this malware is to download and install additional APKs, directed by the C2 server. The developer of the malware uses infected devices to download other malicious software, which in turn boosts the download numbers for each app.
This malware family allows its developers to post positive reviews on their apps. A sample of the malicious software, com.beautiful.caketower had about 10,000 to 50,000 installs with an average rating of 4.5 out of total 23,175 reviews, suggests the Play Store product page of the app. Similarly another sample com.sweet.honeycomb had between 500,000 to 1,000,000 installs with 4.5 rating of total 79,878 reviews.
Lookout states that it took the authors of the malware more than two or three months to explore means to publish the affected apps in the Play Store. A few days before Christmas 2015, the Cake Tower app received an update, which featured a similar functionality found in the initial version of Brain Test, as well as included a new command and control (C2) server.

Kim Jong-Un's Girl Band Is Everything You Thought It Would Be

Members of the North Korean female music group Moranbong Band arrive at a hotel after concert rehearsal on December 11, 2015 in Beijing, China. Photography by ChinaFotoPress via Getty Images

Hit songs include “Do Prosper, Era of the Workers’ Party”

What do you get when you combine South Korea’s pop music with North Korean totalitarian dictatorship? The Moranbong Band, a pop group with striking similarities to a military orchestra (think: absolute structure, harmony, and national anthems).

North Korea’s version of the Spice Girls is a collective of about two dozen female musicians, each of whom wear identical Soviet-style uniforms during performances. Seeing them them on stage is like going back in time to the 80s: a time of bad hair, lots of synth, and, well, communism. Song titles include: “My Country is the Best!”, “Let’s Support Our Supreme Commander in Arms”, and “Do Prosper, Era of the Workers’ Party.”

According to the New York Times, Moranbong is a favorite of North Korea’s leader Kim Jong-un, and each member is rumored to have been handpicked by him. Now, the band is off to Beijing for a weekend of “friendship performances” meant to improve North Korea’s relations with China.

The Times reports that Hua Chunying, a Foreign Ministry spokeswoman, said about the visit: “The good-will visit and performance of Democratic People’s Republic of Korea art groups in China are not within the remit of the Foreign Ministry.” However, she noted that “state-to-state exchanges and cooperation in various forms will help increase mutual understanding and friendship between the peoples.”

See one of the band’s performances below:

Matatu system on Google Maps. Digital Matatu.

Painted with the faces of celebrities like Bob Marley and Tupac Shakur, and furnished with disco balls that lurch and twinkle as they weave through traffic, the thousands of matatus on the roads in Nairobi are bright and loud. Blaring music and honking their way through congestion, these mini-buses are the main mass transit network in the Kenyan capital, and 70 percent of the population uses them to get around. They’re cheap and convenient, filling the public transit void. But the system is chaotic.
Individual matatu buses and routes are privately owned and operated, which means schedules and ticket prices can change at the whim of whoever’s in charge. Even finding the right stop can be tricky. You just kind of have to…know. If you choose the wrong line, you could waste half a day on an already long trip. Since most routes run through the city center before going back out, the roads—not designed for the megacity that Nairobi has become—are flooded with matatu congestion. One or two accidents on the main thoroughfares can shut down traffic for hours.
The situation makes it difficult for riders, who could save time if they knew about better routes, and challenging for major transit projects meant to improve city life. A recent highway project in Nairobi didn’t plan for the matatus, and the informal highway stops they make are dangerous, adding traffic that the planners didn’t anticipate. A full picture of the matatu system would be useful, to say the least.
That picture now exists: In a collaboration called Digital Matatus, researchers from MIT, Columbia University, and the University of Nairobi along with the design firm Groupshot released a map of the entire matatu system last year—a first for a non-formal transit system. And on Wednesday, it became the first informal network to be launched on Google Maps. Just as New York commuters can plot their subway routes on the service, residents of Nairobi can now jack into the matatu system on their smartphones.

Click to Open Overlay Gallery

Route 8 takes people from Kiberia Slum to City Square. Google

“Hats off to Digital Matatus and Google for doing this,” says Robert Cervero, a professor of city and regional planning at the University of California, Berkeley. “This is a very important pilot test demonstration and if the data can be put to good use designing better systems, it can have tremendous benefits.”
The idea to map the matatus began in 2012 when Sarah Williams and Jacqueline Klopp, two researchers working on land use projects in Nairobi, connected with Groupshot co-founder Adam White. “Adam and I started talking about the problem of working on sustainable transportation,” says Klopp, an associate research scholar at the Columbia Center for Sustainable Urban Development. “There were all these transportation projects going on, but there was no basic data about the existing transit system in Nairobi.”
The annals of the city government held some matatu data, but not much. Digital Matatus found records for about 75 percent of the routes, but they only included the start and end points, making it impossible to know how the buses navigated through the city. So armed with smartphones, ten university students spent four months riding the matatus, noting the name and location of each stop in a purpose-built app, which also used GPS to track the route. In dangerous neighborhoods, they followed behind the brightly painted buses in private cars.
By the end, the students recorded almost 3,000 stops on more than 130 routes. Next, all that data needed to be put in a usable format—specifically, a global standard called the General Transit Feed Specification (GTFS), which is compatible with open-source software used to make routing apps like Google Maps. But GTFS, developed in 2005, is geared towards formal transit systems, ones with fixed times and schedules.
That’s when Digital Matatus connected with Google Maps. Along with the rest of the robust GTFS community, Google agreed to update the global standard to make room for flexible transit networks with constantly changing schedules, routes, and stops. Nairobi was a perfect test bed. “In our efforts to expand public transportation on Google Maps, it was a good place to go next because there were people eager and willing to work on it,” said Mara Harris, a Google rep.
In the meantime, the Digital Matatus team turned to the project of visualizing the entire matatu system in one map. When they plotted the GPS coordinates in their software, they generated a neuron-like mass of overlapping routes and colors. Separating and structuring that mass into a formal subway-style map, designers at the MIT Civic Data Design Lab gave each of the main corridors going through the city center a different color, with well-known landmarks such as the Karura Forest and Ngong Road Forest anchoring the map in the city. A little over a year after starting the project, Digital Matatus released the Nairobi Matatu Routes paper map and the free GTFS transit data in January 2014.

Click to Open Overlay Gallery

The official Matatu map of Nairobi developed by the project team. Sarah Williams and Wenfei Xu, MIT Civic Data Design Lab

City officials, who had been passively attending project meetings throughout, finally made it their official transit map. And, crucially, they also started using it as a guide for their evolving mass rapid transit proposals. The strength of an ad-hoc system like the matatus is that over time—over many traffic jams and missed appointments—trial-and-error driving can lead to more efficient, emergent routes.
The tech community pumped out five routing apps for smartphones and old-school feature phones as well as one payment app that calculated actual ticket fares in an effort to combat price fluctuations. Matatu drivers began planning more routes to underserved areas and alternative routes to avoid congestion. And citizens were shocked to see all the routes on the map, said Williams. They could find more efficient routes that they didn’t even know existed. “There were interesting observations from women, especially, who said ‘This is really valuable because at night, I want to make sure I’m on the right matatu,’” said Klopp. “‘I don’t want to get on the wrong one where I don’t feel safe.’”

Click to Open Overlay Gallery

Sarah Williams identifying locations for new Matatu routes with transit stakeholders. Adam White

Launching the matatu routes in Google emphasizes the need to study the informal transit networks that shuttle masses of people around in sub-Saharan Africa, southeast Asia, and south Asia. “You’re saying this is part of the system,” said Klopp. And since the GTFS data structure and the Nairobi data are open source, Digital Matatus gives other groups in Mexico City, Manila, Dhaka, China, and elsewhere a plan to collect and disseminate data on their transit. The collaboration has already received requests from around the world to map their cities.
Digital Matatus has also started talks with four more cities in Africa—Kampala, Accra, Lusaka, and Maputo—to use the same methods to map their informal mass transit systems. “So many of our problems in developing cities where you have extreme poverty and awful environmental conditions—they’re always tied in some way to the transport sector,” said Cervero. “It’s very chaotic and unmanaged, so this is a huge first step towards enhancing those services.”
People in Nairobi still use the paper maps because the matatu routes have not changed since their release, and the ultimate goal is a formal transit system with set maps, times, and prices. But hopefully “formal” will still mean you enjoy your commute with twinkling disco balls and a good beat.

Donald Trump thinks asking Bill Gates to close the internet will defeat Isis

Donald Trump suggests asking Bill Gates to close the internet will stop Isis terror attacks in the USReuters

Republican presidential candidate Donald Trump has called on Bill Gates and other technology figureheads to "close up" the internet. Trump believes this would help prevent Islamic State (Isis) from recruiting Americans.
Speaking at a campaign rally at the USS Yorktown aircraft carrier in South Carolina on 7 December, Trump said he believed that "closing that internet up in some ways" would prevent acts of domestic terrorism in the US. During the same speech, Trump demanded that the US shut its borders to all Muslims.
Trump said: "We're losing a lot of people because of the internet. We have to see Bill Gates and a lot of different people that really understand what's happening. We have to talk to them about, maybe in certain cases, closing that internet up in some ways. Somebody will say, 'Oh freedom of speech, freedom of speech.' These are foolish people."

It is not clear if Trump wants to censor the internet, clamp down on websites and communication networks run by IS (Daesh), or if he lacks a basic understanding of how the internet works. Trump's vision for a closed internet went down well with the crowd of 500 supporters, who cheered him on.
Later in the day, Amazon chief executive Jeff Bezos tweeted to suggest that he send Trump into space on the company's Blue Origin rocket, presumably with a one-way ticket. Trump had earlier criticised Bezos's ownership of the Washington Post newspaper, claiming he bought it "for purposes of keeping taxes down at his no profit company, Amazon".

By Alistair Charlton