Archives for August 2018

Connecting To Aiport Wi-Fi Puts Your Data At Risk

August 9, 2018 by Joseph Martin

File this away under things you already knew. Coronet recently released a report entitled “Attention All Passengers: Airport Networks Are Putting Your Devices & Cloud Apps At Severe Risk,” and the news is about what you’d expect.

The report was more than five months in the making. The analysts poured over oceans of data on device vulnerabilities and Wi-Fi network risks from more than a quarter of a million consumer and corporate endpoints that passed through the 45 busiest airports in the United States.

The bottom line is simply that airport Wi-Fi is woefully unsafe, especially as compared to most corporate networks, and anyone connecting to those networks is asking for trouble.

Some offenders proved to be worse than others. The report names the San Diego International Airport, John Wayne Airport – Orange County (CA), and the William P. Hobby International Airport (Houston, TX) as being among the least secure in the nation.

The risk is that while traveling, most people don’t think about what network they’re connecting to or how secure it might be. This is an incredible opportunity for hackers, because once an employee’s laptop or mobile device is infected, the integrity of the employers’ cloud-based work apps is jeopardized.

Coronet’s founder, Dror Liwer, had this to say about the findings:

“Far too many US airports have sacrificed the security of their Wi-Fi networks for consumer convenience. As a result, business travelers in particular put not just their devices, but their company’s entire digital infrastructure, at risk every time they connect to Wi-Fi that is unencrypted, unsecured, or improperly configured.

Until such time when airports take responsibility and improve their cybersecurity posture, the accountability is on each individual flyer to be aware of the risks and take the appropriate steps to minimize the danger.”

Be sure your employees are aware of the risks any time they travel. Your company’s future might depend on it.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Twitter Is Getting Tough On Apps

August 9, 2018 by Joseph Martin

Twitter has long had a reputation for being at the mercy of bots that have been used to sway public discourse and opinion.

Often, these bots are controlled via Twitter API apps that allow the authors to automate most of their actions, such as tweets, follows, and likes.

In the face of Facebook’s recent grilling before congress, Twitter has decided to take a more proactive stance, and has recently announced major changes to their policies.

The first part of the company’s statement to that effect reads as follows:

“Starting today, all new requests for access to Twitter’s standard and premium APIs are required to go through a new individual approval process.”

In addition to the newly announced approval process, the company moved decisively to cut off more than 143,000 apps they deemed to be in violation of the company’s terms of service.

The more robust approval process requires app developers to provide more information about themselves and the ultimate purpose of the apps they design. Additionally, Twitter has put a hard cap on the number of apps that developers can create and manage, which tops out at ten. If developers need to run more than that, they’ll need special permission from Twitter, and they’ll have to provide a compelling reason to justify the need.

Beginning September 10th, 2018, the company will be placing additional restrictions on every Twitter App which will control their use rates.

The new rate limits (per app) will be:

300 Tweets and Retweets per hour

1,000 likes per 24 hours

1,000 follows per 24 hours

15,000 direct messages per 24 hours

The company reserves the right to either remove or further restrict these limits for legitimate reasons.

On top of all that, Twitter has also modified its Twitter API support page to include an option for reporting “bad apps” that break one of the company’s policies. According to the company, the combined effect of all of these changes should “help cut down on the ability of bad actors to create spam on Twitter via their APIs.”

While it remains to be seen how effective these changes will be, kudos to Twitter for taking action.

Joseph Martin

Microsoft Working On Delay Feature For Windows 10 Update Installs

August 5, 2018 by Joseph Martin

If you’ve used Windows 10 for any length of time, you’ve probably had this happen to you. You’re right in the middle of working on something important, and all of a sudden, your OS decides it would be a great time to install some updates!

In response to user complaints, Microsoft introduced a “snooze” feature that allowed users to delay the installation of upgrades.

However, this sparked as many complaints as it silenced, because unfortunately, it causes more frequent device reboots. Now, Microsoft is trying again.

According to Dona Sarkar, Window’s Insider Chief:

“We heard you, and to alleviate this pain, if you have an update pending, we’ve updated our reboot logic to use a new system that is more adaptive and proactive.”

The company is using machine learning to accurately predict when the best time to restart the device is.

“We will not only check if you are currently using your device before we restart, but we will also try to predict if you had just left the device to grab a cup of coffee and return shortly after,” Sarkar says.

So far, the company has limited itself to internal testing, but the early results have been promising. As of now, the new model should be available to Windows Insiders (Redstone 5 and 19H1 updates), which will give company engineers a much broader pool of feedback which will allow for additional fine-tuning.

It’s too early to tell if this is indeed the solution to the problem, but if it is, it will finally put an end to one of the most frustrating aspects of using Windows 10. We have to say, we’re impressed with the changes in the company in recent years. Kudos to Microsoft for taking action and being responsive to their user base.

Joseph Martin

E-Mail Is A Big Threat To Your Organization

August 4, 2018 by Joseph Martin

Mimecast’s 2018 “State of Email Security” report is out, and although it’s contents are hardly a surprise, the news it contains is mostly bad.

For starters, it confirms what most IT professionals already know:

Email continues to be a big threat for organizations of all sizes.

Unfortunately, the C-Suite (CEO’s, CIO’s, CFO’s, and the like) are a major part of the problem, representing a significant weak link in Enterprise security. Not only are they a prime target for hackers, but according to the survey, 40 percent of respondents agreed that their organization’s CEO was a painfully “weak link” in their organization’s cyber-security operations.

Just as alarming, 31 percent of respondents said that C-level employees are very likely to have accidentally sent sensitive or proprietary information to the wrong person, a statistic up 9 percent from last year.

In addition to that, email is the primary means by which ransomware winds up getting inside company networks. This comes with a staggering 92 percent of successful ransomware attacks arriving via that channel, resulting in three or more days of downtime for the impacted companies.

Phishing attacks also continue to be a major issue, with 90 percent of respondents reporting an increase in the number of phishing attacks they were subjected to.

In light of these statistics, one would imagine that companies would be devoting significant resources to countering the threat. Unfortunately, that’s just not happening. Sure, money is being spent on infrastructure, but humans are the weakest link in this chain, and not just in the C-Suite. According to the survey, only 11 percent of organizations continuously train their employees on how to spot cyberattacks, and just over half (52 percent) perform training just once a year.

Matthew Gardiner, a cyber-resilience expert at Mimecast, summarizes it this way :

“Security awareness is an important part of any high-functioning security program. But like all security controls, there is no silver bullet solution. The best security programs seek a balance between technical controls, boosting their human firewalls, and having IT enabled business processes that are resilient to failures, whether man-made or caused by technology.”

Indeed.

Joseph Martin

Chrome Now Shows Sites Without SSL as Not Secure

August 2, 2018 by Joseph Martin

There is a small but significant change from Google, with the release of Chrome 68. The updated browser will now prominently notify browsers when they surf their way to non-HTTPS websites, displaying them as “Not Secure.”

This is Google’s latest step in a long campaign to try and make the web a safer and more secure place for internet users around the world.

If you’re not especially tech-savvy, here’s why it matters:

Anything sent over a non-HTTPS connection is in plain text, including sensitive information like credit card payment info and passwords. This makes it a trivial matter for hackers to snoop and/or steal data. The new “Not Secure” message that Chrome displays is a clear indication to browsers that there’s no SSL Certificate to encrypt the connection between your website’s server and the user’s computer.

Non-HTTPS connections have been considered dangerous for a number of years, but as hackers have gained increasing levels of sophistication, the dangers have only grown over time.

Google has intentionally taken a slow, measured approach to making this change in order to give business owners plenty of time to respond. They began the process in January 2017, with the release of Chrome 56, by displaying a subtle “Not Secure” warning in the address bar of any non-secure websites that were collecting passwords and credit card information on their customers.

Then, in October 2017, the company upped the ante with the release of Chrome 62, which saw the browser begin to display the “Not Secure” warning for any HTTP website that had any kind of text input field. This culminated in the release of Chrome 68, which prominently displays the message for all non-secure sites, period.

The bottom line is, the change has been a long time coming, and if your company hasn’t yet enabled HTTPS on your website, the time to do so is now.

Joseph Martin

Bluetooth Vulnerability Allows Hackers To Access Devices

August 1, 2018 by Joseph Martin

There’s a new Bluetooth security vulnerability to be aware of, tracked as CVE-2018-5383, and it’s a nasty one.

It’s a cryptographic vulnerability that affects firmware or operating system software drivers from a number of major vendors, including Qualcomm, Broadcom, Intel and Apple. At this point, the implication of the bug on Linux, Android, and Google are unknown.

The flaw is related to two important Bluetooth features: BR/EDR implementations of Secure Simple Pairing in device firmware and Bluetooth Low Energy (BLE) of Secure Connections Pairing in OS system software.

It was discovered by researchers operating out of Israel’s Institute of Technology. They discovered that the Bluetooth specification recommends (but critically does not mandate) that devices supporting the two features make any effort to validate the public encryption key received during secure pairing.

Since the specification is optional, it’s hardly a surprise that some vendors producing Bluetooth products do not take sufficient steps to validate the parameters used to generate public keys during the exchange.

This allows a would-be hacker the possibility of executing a man-in-the-middle attack to obtain the cryptographic key used by the device. This would give them the opportunity to not only spy on the device’s owner, but also to inject malware that could allow the hacker to take full control over the device.

SIG (the Bluetooth Special Interest Group which maintains the technology), had this to say about the flaw:

“For an attack to be successful, an attacking device would need to be within wireless range of two vulnerable Bluetooth devices that were going through a pairing procedure.

The attacking device would need to intercept the public key exchange by blocking each transmission, sending an acknowledgement to the sending device, and then injecting the malicious packet to the receiving device within a narrow time window. If only one device had the vulnerability, the attack would not be successful.”

Bluetooth SIG has now updated the specification to require products to validate public keys received as part of the public key-based security procedures. Of the manufacturers mentioned above, Apple and Intel have both released patches. Broadcom has made fixes available to its OEM customers who are responsible for providing them to end-users. There has been no word yet from Qualcomm.

Joseph Martin

Connecting To Aiport Wi-Fi Puts Your Data At Risk

Microsoft Working On Delay Feature For Windows 10 Update Installs

E-Mail Is A Big Threat To Your Organization

Chrome Now Shows Sites Without SSL as Not Secure

Bluetooth Vulnerability Allows Hackers To Access Devices

Contact Info

Navigation