This report describes the details and type of operations carried out by an organized criminal group that focuses on financial industry, such as banks and payment providers, retail industry and news, media and PR companies. […] The organized criminal group backbone are citizens of both Russian and Ukrainian origin. […]

The average sum of theft in the Russian territory and in the post-Soviet space is $2 million per incident. […] To date the total amount of theft is over 1 billion rubles (about 25 million dollars), most of it has been stolen in the second half of 2014. […]

The key is that fraud occurs within the corporate network using internal payment gateways and internal banking systems. Thus money is stolen from the banks and payment systems, and not from their customers. While this is their main and most lucra- tive activity, the gang has also ventured into other areas including the compromise of media groups and other organizations for industrial espionage and likely a trading advantage on the stock market. […]

The average time from the moment of penetration into the financial institutions internal network till successful theft is 42 days.

As a result of access to internal bank networks the attackers also managed to gain access to ATM management infrastructure and infect those systems with their own malicious software that further allows theft from the banks ATM systems on the attackers command. […]

The main steps of the attack progression are the following ones:

1. Primary infection of an ordinary employee computer.
2. Getting a password of a user with administra- tive rights on some computers. For example, a password of a technical support engineer.
3. Gaining legitimate access to one server.
4. Compromising the domain administrator password from the server.
5. Gaining access to the domain controller and compromising of all active domain accounts.
6. Gaining access to e-mail and workflow servers.
7. Gaining access to server and banking system administrator workstations. 

8. Installing the software to monitor activity of interesting system operators. Usually photo and video recording was used.
9. Configuring remote access to servers of inter- est including firewall configuration changes.

{ Group-IB and Fox-IT | PDF }

[Yahoo C.E.O. Marissa] Mayer also had a habit of operating on her own time. Every Monday at 3 p.m. Pacific, she asked her direct reports to gather for a three-hour meeting. Mayer demanded all of her staff across the world join the call, so executives from New York, where it was 6 p.m., and Europe, where it was 11 p.m. or later, would dial in, too. Invariably, Mayer herself would be at least 45 minutes late; some calls were so delayed that Yahoo executives in Europe couldn’t hang up till after 3 a.m. […]

Within weeks of becoming C.E.O., she received an email from Henrique de Castro, the fashionable Portuguese president of Google’s media, mobile and platforms businesses. […] Over dinner, de Castro impressed Mayer with his knowledge of Yahoo’s business and his specific proposals for building it. For several mornings in a row, the two exchanged emails to negotiate de Castro’s salary. Every night, Mayer would make an offer, only to wake up to a reply with a list of more conditions. Eventually de Castro negotiated himself a contract worth around $60 million, depending on the value of Yahoo stock. […] Despite the board’s urging, Mayer opted against vetting Henrique de Castro. As a result, she was unaware that de Castro had a poor reputation among his colleagues in Google’s advertising business. Many had derisively called him the Most Interesting Man in the World, in reference to the satirically fatuous spokesman for Dos Equis beer. […] Advertising revenue declined in every quarter since he was hired. Within a year, Mayer had personally taken control of Yahoo’s ad team. De Castro would leave the company in January 2014. For about 15 months of work, he would be paid $109 million.

{ NY Times | Continue reading }

With the First Amendment, you’re never protecting Jefferson; it’s usually protecting some guy who’s burning a flag or doing something stupid. […]

Here’s the brilliant thing they did. You embarrass them first, so that no one gets on your side. After the Obama joke, no one was going to get on the side of Amy, and so suddenly, everyone ran for the hills.

{ George Clooney/Deadline | Continue reading }

photo { Christopher Morris }

Several weeks ago, Vidra communicated the new vision to the staff in what I am told was an uncomfortable stream of business clichés ungrounded in any apparent strategy other than saying things like “let’s break shit” and “we’re a tech company now.”

{ NY mag | Continue reading | Daily Beast }

[D]etoxing – the idea that you can flush your system of impurities and leave your organs squeaky clean and raring to go – is a scam. It’s a pseudo-medical concept designed to sell you things.

“Let’s be clear,” says Edzard Ernst, emeritus professor of complementary medicine at Exeter University, “there are two types of detox: one is respectable and the other isn’t.” The respectable one, he says, is the medical treatment of people with life-threatening drug addictions. “The other is the word being hijacked by entrepreneurs, quacks and charlatans to sell a bogus treatment that allegedly detoxifies your body of toxins you’re supposed to have accumulated.” […]

In 2009, a network of scientists assembled by the UK charity Sense about Science contacted the manufacturers of 15 products sold in pharmacies and supermarkets that claimed to detoxify. The products ranged from dietary supplements to smoothies and shampoos. When the scientists asked for evidence behind the claims, not one of the manufacturers could define what they meant by detoxification, let alone name the toxins. […]

Then there’s colonic irrigation. Its proponents will tell you that mischievous plaques of impacted poo can lurk in your colon for months or years and pump disease-causing toxins back into your system. Pay them a small fee, though, and they’ll insert a hose up your bottom and wash them all away.[…] No doctor has ever seen one of these mythical plaques, and many warn against having the procedure done, saying that it can perforate your bowel.

{ The Guardian | Continue reading }

“Find your sugar baby,” the site exhorted its users.

This year, Paul Aronson, an 84-year-old from Manhattan, contacted a 17-year-old girl, Shaina Foster, through the site and took her out to dinner. On a second date, Ms. Foster brought along her twin sister, Shalaine.

For a few hours on Oct. 1, the evening looked as if it might turn into an old man’s fantasy. The three dined at an expensive restaurant in Midtown. Then Mr. Aronson invited the teenagers to have a drink with him at the four-story brick townhouse he owns on East 38th Street.

He bought a bottle of raspberry-flavored rum from a liquor store on the way, a defense lawyer said. But instead of receiving caresses or whispered flirtations, Mr. Aronson ended up tied to a coffee table for 20 hours. […]

Prosecutors say the two girls bound him with zip ties, took $470 in cash from his wallet and went on a spending spree with his credit cards, buying makeup and clothes. […]

Before he was tied up, Mr. Aronson had given the teenagers a tour of his townhouse and let them play with his tiny dog, a Yorkshire terrier named Muffins, Mr. Kennedy said. Then he poured them glasses of rum and asked them about their sex lives. […]

“He asked to do things I wasn’t going to do,” she told Detective Darryl Ng at the 17th Precinct after the girls were arrested on Oct. 21. “He is ugly, old and disgusting. I tied him up. I took his money and left. He was starting to creep me out.”

{ NY Times | Continue reading }

The malware, called “Regin”, is probably run by a western intelligence agency and in some respects is more advanced in engineering terms than Stuxnet. […]

Symantec said it was not yet clear how Regin infected systems but it had been deployed against internet service providers and telecoms companies mainly in Russia and Saudi Arabia as well as Mexico, Ireland and Iran. […]

“Nothing else comes close to this . . . nothing else we look at compares,” said Orla Cox, director of security response at Symantec, who described Regin as one of the most “extraordinary” pieces of hacking software developed, and probably “months or years in the making”. […] “Sometimes there is virtually nothing left behind – no clues. Sometimes an infection can disappear completely almost as soon as you start looking at it, it’s gone. That shows you what you are dealing with.”

{ FT | Continue reading }

Crimes such as bribery require the cooperation of two or more criminals for mutual gain. Instead of deterring these crimes, the state should disrupt them by creating distrust among criminals so they cannot cooperate. In a cooperative crime with two criminals, the state should offer amnesty and a bounty to the criminal who first secures punishment of the other criminal. When the bounty exceeds the bribe, a bribed official gains less from keeping the bribe than from confessing and receiving the bounty. Consequently the person who pays the bribe cannot trust the person who takes it. The game’s unique equilibrium is non-cooperative and bribes disappear.

{ Review of Law & Economics }

Miniature “human brains” have been grown in a lab in a feat scientists hope will transform the understanding of neurological disorders.

{ BBC | Continue reading | Thanks Tim }

Leveraging the insight that periods, while a pain, also bring women together, JWT has created an augmented reality app that combines Chinese consumers’ love of technology, cute characters and selfies into a new branded platform for Sofy sanitary pads.

{ Campaign Asia | Continue reading | Thanks Tim }

[T]he Office will refuse to register a claim if it determines that a human being did not create the work. […]

[T]he Office cannot register a work purportedly created by divine or supernatural beings. […]

A musical work created solely by an animal would not be registrable, such as a bird song or whale song. Likewise, music generated entirely by a mechanical or an automated process is not copyrightable. […]

To qualify as a work of authorship a choreographic work must be created by a human being and it must be intended for execution by humans. Dances performed or intended to be performed by animals, machines, or other animate or inanimate objects are not copyrightable and cannot be registered with the U.S. Copyright Office.

{ U.S. Copyright Office /Popular Science | Continue reading }

{ How MH17 Came Apart Over Ukraine }

{ CYNK, a ”social networking” startup that has no assets, no revenue, no members, and one employee, is worth $4.75 billion }

art { Paul Klee }

Does Having Daughters Cause Judges to Rule for Women’s Issues?

Using new data on the family lives of U.S. Courts of Appeals judges, we find that, conditional on the number of children a judge has, judges with daughters consistently vote in a more feminist fashion on gender issues than judges who have only sons. This result survives a number of robustness tests and appears to be driven primarily by Republican judges. More broadly, this result demonstrates that personal experiences influence how judges make decisions, and this is the first article to show that empathy may indeed be a component in how judges decide cases.

{ American Journal of Political Science | Continue reading }

Commercial drone flights are set to become a widespread reality in the United States, starting next year, under a 2012 law passed by Congress. […]

Military drones have slammed into homes, farms, runways, highways, waterways and, in one case, an Air Force C-130 Hercules transport plane in midair. […]

Several military drones have simply disappeared while at cruising altitudes, never to be seen again. […]

The documents describe a multitude of costly mistakes by remote-control pilots. A $3.8 million Predator carrying a Hellfire missile cratered near Kandahar in January 2010 because the pilot did not realize she had been flying the aircraft upside-down.

{ Washington Post | Continue reading }

Yo, the app, has been hacked

Yo is the hottest new app that will leave you scratching your head. The entire premise of the app is to send other users a single word: Yo. […] Without ever having officially launched, co-founder and CEO Or Arbel managed to secure $1.2 million in funding.

{ Tech Crunch | Continue reading }

That $1m funding should cover costs for a year to find out whether Yo really can succeed, Mr Arbel says. […] “It’s not just an app that says Yo,” says Mr Arbel. “It’s a whole new means of communication.”

{ FT | Continue reading }

A quarter of all public company deals may involve some kind of insider trading. […] The study [PDF], perhaps the most detailed and exhaustive of its kind, examined hundreds of transactions from 1996 through the end of 2012.

{ NY Times | Continue reading }

In shopping malls, for instance, a firm called Euclid Analytics collects, in its own words, “the presence of the device, its signal strength, its manufacturer (Apple, Samsung, etc.), and a unique identifier known as its Media Access Control (MAC) address.” In London last year, one start-up installed a dozen recycling bins that sniffed MAC addresses from passers-by, effectively tracking people through the area via their phones. Such companies go to great lengths to explain that such information in not personally identifiable—except that repeated studies have shown that this data can indeed be used to infer a great deal about your life.

At the core of such tracking is the MAC address, a unique identification number tied to each device. Devices looking for a Wi-Fi network send out their MAC address to identify themselves. Wireless routers receive the signals—and addresses—even if a connection is never made. Companies like Euclid or its peer Turnstyle Solutions use the data to track footfall in stores, how people move about in shops, how long they linger in certain sections, and how often they return. Store-owners use the information to target shoppers with offers (paywall) or to move high-value items to highly-trafficked parts of the shop, among other things. […]

Apple’s solution, as discovered by a Swiss programmer, is for iOS 8, the new operating system for iPhones which will be out later this year, to generate a random MAC addresses while scanning for networks. That means that companies and agencies that collect such information will not necessarily know when the same device (i.e., person) visits a store twice, or that the same device pops up in stores across the country or the world, suggesting a much-travelled owner.

{ Quartz | Continue reading }

related { With the launch of a health app and data-sharing platform, Apple is betting that tracking your vital signs via smartphone is about to become a booming industry }