(Photo: Talk Android)

Google has applied for a new patent that shows the company is thinking about programming Google Glass to be able to control objects like your garage door and your refrigerator. You'd simply look at your fridge door and superimposed controls would be reflected onto it, telling you you need milk. Uh, want? [Engadget]

This shouldn't come as a surprise to anyone who reads our rumor roundup, but turns out Google chairman Eric Schmidt does indeed prefer his BlackBerry over an Android phone. [The Guardian]

Now Google is building a smartwatch. How many watches can one human need? [The Verge]

If you want to commit cyberwar, you're going to need the manual. [AP]

Virtual currency like Bitcoin is getting money laundering rules that will hold providers accountable in a similar manner to money-order providers like Western Union. Sorry, Silk Road. [Wall Street Journal]

Hackin'

Even as Guccifer goes on a tear, releasing Hova's credit reports and Hillary Clinton's emails, our friends in South Korea are having some computer problems of their own. Earlier today (in the middle of the afternoon, Seoul-time), computer networks at two of the country's banks and three TV stations shut down out of the blue, in what looks like the work of a malicious virus. That'll ruin an IT Department's day, all right.

The BBC reports:

"Staff at the three broadcasters said their computers crashed and could not be restarted, with screens simply displaying an error message, although they have continued to make television broadcasts, our correspondent said.

There were also reports of skulls popping up on some computer screens, which could indicate that hackers had installed malicious code in the networks, the Korean Internet Security Agency said."

A Defense spokesman told the BBC it was too early to point fingers: "We do not rule out the possibility of North Korea being involved, but it's premature to say so." (Just last week, actually, North Korea accused the U.S. of attacking its very, very limited Internet capabilities.) The Guardian says:

"Warnings reportedly appeared on some computer screens from a previously unknown group calling itself the 'WhoisTeam', showing skulls and a message stating it was only the beginning of 'our movement'."

But South Korea's rowdy northern neighbor is blamed for attacks in 2009 and 2011 and tensions are running high right now, so we're just surprised the hack didn't look like this:

(Know Your Meme)

Srs cyber bsns. (Photo: Wikimedia)

With cyber attacks whistling by at an ever-increasing clip, it's not surprising that the Obama administration is hard at work nailing down how to respond. The policies will remain hush-hush once they're finalized, but the New York Times (which previously connected the president to the deployment of Stuxnet) has one juicy tidbit: A classified legal review has found that the president has "broad power to order a pre-emptive strike if the United States detects credible evidence of a major digital attack looming from abroad."

That'll sound familiar to anyone who hasn't entirely repressed the memory of the Bush administration! (Mr. President, a very agitated Colin Powell is on line two. Something about enriched uranium and the U.N.?)

Now, this does not mean that President Obama will be launching the cyber nukes to prevent "routine" attacks, like when some hacktivists wants to DDOS your online banking provider. That's the province of Homeland Security and the F.B.I., because your inability to check your balance? Not actually an imminent national security threat.

But when someone launches an infrastructure-crippling attack on the power grid, for example (it's always the power grid!), it becomes a military concern. In that instance, the president has the authority to act preemptively should he see fit.

However, as rationales go, it's not totally airtight:

Pre-emption in the context of cyberwar raises a potentially bigger quandary, because a country hit by a pre-emptive cyberstrike could easily claim that it was innocent, undermining the justification for the attack. “It would be very hard to provide evidence to the world that you hit some deadly dangerous computer code,” one senior official said.

Glad to know diplomacy in the age of cyberwar hasn't changed that much: It's still mostly just throwing up one's hands and shouting "wasn't me!"

RED OCTOBER

The Russian antivirus firm that first fingered Stuxnet as a state-sponsored cyberattack is outing massive clandestine digital operations once more. This time, Kaspersky Lab says they've uncovered a massive, years-long cyber-espionage campaign. The perpetrators: unknown. Demonstrating a rather charming flare for the dramatic, the Moscow-based researchers have dubbed the network "Red October."

We had long suspected the lads and ladies of Kaspersky were Tom Clancy types.

Researchers announced the discovery in a blog post:

During the past five years, a high-level cyber-espionage campaign has successfully infiltrated computer networks at diplomatic, governmental and scientific research organizations, gathering data and intelligence from mobile devices, computer systems and network equipment.

Whoever it was tipped Kaspersky to the malware "prefers to remain anonymous."

The perpetrators target organizations in the Russian Federation, Eastern Europe, and Central Asia--but North America and Western Europe aren't immune, either. "Hundreds" worldwide have been affected, across categories like military, research institutions, aerospace, oil and gas, and so forth--"all of them in top locations such as government networks and diplomatic institutions."

As for who's behind the network, researchers write that they "strongly believe that the attackers have Russian-speaking origins." However, anybody starts hallucinating the rumbling guns of distant cyberwar:

Currently, there is no evidence linking this with a nation-state sponsored attack. The information stolen by the attackers is obviously of the highest level and includes geopolitical data which can be used by nation states. Such information could be traded in the underground and sold to the highest bidder, which can be of course, anywhere.

Capitalism!

Countries where MiniFlame and Flame have been found. (Kaspersky Lab)

Researchers at Kaspersky Lab have been patiently picking apart the ingenious malware packages that romped through computer networks in the Middle East, sucking up data and destroying Iranian nuclear centrifuges and it seems Kaspersky finds a new addition to the allegedly U.S. and Israeli-sponsored family of cyber-weapons every other month. Monday they announced the discovery of the Flame malware's baby cousin, MiniFlame.

Kaspersky's bug hunters found that MiniFlame's association with Flame and related infections was Transformers-like in nature:

In early July 2012, we discovered a smaller Flame module, which appeared to be able to work by itself. The module had many similarities with Flame, so we thought it might simply be an earlier version. In the months that followed, we not only studied the connection of this malware with Flame, but also came across examples of this module being used concurrently with Gauss and being controlled by the Gauss main module.

Researchers found that MiniFlame was something of a ninja assassin compared to the other programs. Whereas Flame, Duqu and Gauss had large missions to infiltrate multiple computers in countries like Iran, Syria and Lebanon, MiniFlame targeted just a few select victims in what Kaspersky calls "highly targeted attacks." Kaspersky reported that MiniFlame, while rare compared to the more well-known malware packages, was more likely to show up in a variety of countries, including a computer located at the Francois Rabelais University in Tours, France.

Wired also noted that Kaspersky determined that one machine in Lebanon is the lucky recipient of every nasty cyber weapon in the family:

[There] is one machine in Lebanon – what [senior Kaspersky researcher Roel] Schouwenberg calls "the mother of all infections" – which has Flame, Gauss, and miniFlame/SPE on it. "It is like everybody wanted to infect that specific victim in Lebanon for some reason," he says.

Kaspersky knows there are two more malware packages still in the wild, currently code-named only SP and IP. They may function much like the previously known malicious programs, churning through the guts of target computers for sensitive data to send home to their controllers before they execute the final trick in their arsenal, deleting themselves and vanishing from the infected system as if they'd never been there at all, like ghosts. Or ninjas.

THUNDA STRUCK!

Looks like the Iranian nuclear facility at Natanz is, at the very least, 0 for 2 against cyber attacks. First came Stuxnet, which wreaked havoc with the equipment used to purify uranium. And now--at least, if a recent report (via VentureBeat) is true--they are dealing with a malware infestation involving sudden, late-night AC/DC.

F-Secure chief research officer Mikko Hypponen received the following email from someone who claimed to be an Iranian nuclear scientist: 

I am writing you to inform you that our nuclear program has once again been compromised and attacked by a new worm with exploits which have shut down our automation network at Natanz and another facility Fordo near Qom.

According to the email our cyber experts sent to our teams, they believe a hacker tool Metasploit was used. The hackers had access to our VPN. The automation network and Siemens hardware were attacked and shut down. I only know very little about these cyber issues as I am scientist not a computer expert.

There was also some music playing randomly on several of the workstations during the middle of the night with the volume maxed out. I believe it was playing 'Thunderstruck' by AC/DC.

Hypponen was unable to confirm the story--but he was able to confirm the email came from the Atomic Energy Organization of Iran.

Memo to the American cyberweapons program: We're not saying this was you guys, but if it was, you might want to opt for a less obvious calling card in the future.

Let slip the dogs of cyber war. (flickr.com/anhonorablegerman)

Remember last summer, when all anyone could talk about was hacktivists? For a while there, we were living in a William Gibson novel, with hackers wreaking havoc and corporate types running scared. Well, so far, this June is shaping up a little differently, with a wave of state-sponsored attacks straight out of a spy novel.

Much as we love lone teenaged lone wolves typing away in their moms' basements, it's clear they're just the loudest and proudest of hackers. Just because the spies don't have official Twitter accounts and release YouTube videos doesn't mean they're not there, though. The latest two instances come courtesy of Fast Company, which points out that dissidents are increasingly a target of state-sponsored hacks.

For example: Tibetan activists recently received a phishing email, disguised as an official communique regarding a recent European resolution, which takes root in their computers and calls up a server in Hong Kong. Meanwhile, members of the Syrian opposition are being targeted with malware, distributed via Skype, that installs spying software.

Google has even started warning Gmail users when they've been targets of an attempted state-sponsored cyber attack.

This is different from just a couple of months ago, when Stuxnet and Flame looked conveniently aligned with the strategic goals of the U.S. and Israel, but mum was the word as to where the infections came from. Now, thanks to exposes in the New York Times and the Washington Post respectively, we've good as got confirmation they were programs developed by the two nations working in concert to slow Iran's nuclear weapons program.

Nor is the cyber tussle between the U.S. and Iran is over. Just today, an Iranian news agency (described by the AP as "semiofficial") claimed to have fought off another "massive" cyber attack. The expression "can of worms" comes to mind.

LulzSec, we have to say, was a lot more entertaining.

Obama in the Situation Room. (flickr.com/anhonorablegerman)

Gather 'round, readers, it's Friday and that means it's time for a cyberwar spy thriller, courtesy of the New York Times. The paper of record has an excerpt of a new book that offers a thorough history of the top-secret origins of the Stuxnet worm, and it is a corker.

So: Stuxnet, rather than a lone experiment, is actually part of a larger program designed to put a stop to Iran's nuclear work. Dubbed "Olympic Games," work began under George W. Bush and continued under Barack Obama, in partnership with Israel. President Obama not only signed off on the program, but ramped it up. It wasn't supposed to escape Iran's nuclear facilities at Natanz, but escape it did, apparently as the result of some "programming error."

We've seen enough a) virus-infected laptops and b) zombie movies that we could've told the president that would happen.

In case you'd like some context:

“Previous cyberattacks had effects limited to other computers,” Michael V. Hayden, the former chief of the C.I.A., said, declining to describe what he knew of these attacks when he was in office. “This is the first attack of a major nature in which a cyberattack was used to effect physical destruction,” rather than just slow another computer, or hack into it to steal data.

Also, for the love of God, people, adopt better security practices. Re: introducing the worm to Natanz: “It turns out there is always an idiot around who doesn’t think much about the thumb drive in their hand.” And you'd better believe the U.S. isn't immune to these attacks, either:

Mr. Obama has repeatedly told his aides that there are risks to using — and particularly to overusing — the weapon. In fact, no country’s infrastructure is more dependent on computer systems, and thus more vulnerable to attack, than that of the United States. It is only a matter of time, most experts believe, before it becomes the target of the same kind of weapon that the Americans have used, secretly, against Iran.

Quick, someone check on the electric grid.

Chaouki Bekrar, chief executive of VUPEN. (topnews.in)

Some do it for the lulz, others do it for the Benjamins. In a piece published today in Forbes, Andy Greenburg introduces us to VUPEN, a company that is apparently a proponent of the latter. VUPEN sells hacking secrets to government agencies for big bucks, and a host of Internetty folk are terrified of the implications.

VUPEN calls itself the "Leading Provider of Defensive and Offensive Security," and it's that "Offensive" part that has some in a tizzy. The company has become an expert at mining software like Google Chrome for security vulnerabilities, then making crazy amounts of cash selling their hacking secrets to parties willing to shell out a handsome fee.

And usually, people with the cash and desire to purchase hacking secrets aren't exactly the most innocent of characters. "In that shady but legal market for security vulnerabilities, a zero-day exploit that might earn a hacker $2,000 or $3,000 from a software firm could earn 10 or even 100 times that sum from the spies and cops who aim to use it in secret," writes Mr. Greenburg.

Privacy experts are rightly concerned about the havoc VUPEN's transactions could wreak on the Internet. Though VUPEN claims to refuse to sell to "nondemocratic nations," they're essentially playing Russian roulette with backdoor hacks. With so many different clients with opposing interests, and without a way to keep track of where their information goes once an agency pays for it, the whole shebang is bound to implode at some point.

Forbes quotes privacy activist Chris Soghoian with a little more insight: "Vupen is the Snooki of this industry," he said. "They’re the Jersey Shore of the exploit trade."

So VUPEN is a collection of famewhoring orange monsters comprised of 80 percent tequila and 20 percent cheap body glitter? Got it.