Joseph Martin – Page 23

Twitter Is Getting Tough On Apps

August 9, 2018 by Joseph Martin

Twitter has long had a reputation for being at the mercy of bots that have been used to sway public discourse and opinion.

Often, these bots are controlled via Twitter API apps that allow the authors to automate most of their actions, such as tweets, follows, and likes.

In the face of Facebook’s recent grilling before congress, Twitter has decided to take a more proactive stance, and has recently announced major changes to their policies.

The first part of the company’s statement to that effect reads as follows:

“Starting today, all new requests for access to Twitter’s standard and premium APIs are required to go through a new individual approval process.”

In addition to the newly announced approval process, the company moved decisively to cut off more than 143,000 apps they deemed to be in violation of the company’s terms of service.

The more robust approval process requires app developers to provide more information about themselves and the ultimate purpose of the apps they design. Additionally, Twitter has put a hard cap on the number of apps that developers can create and manage, which tops out at ten. If developers need to run more than that, they’ll need special permission from Twitter, and they’ll have to provide a compelling reason to justify the need.

Beginning September 10th, 2018, the company will be placing additional restrictions on every Twitter App which will control their use rates.

The new rate limits (per app) will be:

300 Tweets and Retweets per hour

1,000 likes per 24 hours

1,000 follows per 24 hours

15,000 direct messages per 24 hours

The company reserves the right to either remove or further restrict these limits for legitimate reasons.

On top of all that, Twitter has also modified its Twitter API support page to include an option for reporting “bad apps” that break one of the company’s policies. According to the company, the combined effect of all of these changes should “help cut down on the ability of bad actors to create spam on Twitter via their APIs.”

While it remains to be seen how effective these changes will be, kudos to Twitter for taking action.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Microsoft Working On Delay Feature For Windows 10 Update Installs

August 5, 2018 by Joseph Martin

If you’ve used Windows 10 for any length of time, you’ve probably had this happen to you. You’re right in the middle of working on something important, and all of a sudden, your OS decides it would be a great time to install some updates!

In response to user complaints, Microsoft introduced a “snooze” feature that allowed users to delay the installation of upgrades.

However, this sparked as many complaints as it silenced, because unfortunately, it causes more frequent device reboots. Now, Microsoft is trying again.

According to Dona Sarkar, Window’s Insider Chief:

“We heard you, and to alleviate this pain, if you have an update pending, we’ve updated our reboot logic to use a new system that is more adaptive and proactive.”

The company is using machine learning to accurately predict when the best time to restart the device is.

“We will not only check if you are currently using your device before we restart, but we will also try to predict if you had just left the device to grab a cup of coffee and return shortly after,” Sarkar says.

So far, the company has limited itself to internal testing, but the early results have been promising. As of now, the new model should be available to Windows Insiders (Redstone 5 and 19H1 updates), which will give company engineers a much broader pool of feedback which will allow for additional fine-tuning.

It’s too early to tell if this is indeed the solution to the problem, but if it is, it will finally put an end to one of the most frustrating aspects of using Windows 10. We have to say, we’re impressed with the changes in the company in recent years. Kudos to Microsoft for taking action and being responsive to their user base.

Joseph Martin

E-Mail Is A Big Threat To Your Organization

August 4, 2018 by Joseph Martin

Mimecast’s 2018 “State of Email Security” report is out, and although it’s contents are hardly a surprise, the news it contains is mostly bad.

For starters, it confirms what most IT professionals already know:

Email continues to be a big threat for organizations of all sizes.

Unfortunately, the C-Suite (CEO’s, CIO’s, CFO’s, and the like) are a major part of the problem, representing a significant weak link in Enterprise security. Not only are they a prime target for hackers, but according to the survey, 40 percent of respondents agreed that their organization’s CEO was a painfully “weak link” in their organization’s cyber-security operations.

Just as alarming, 31 percent of respondents said that C-level employees are very likely to have accidentally sent sensitive or proprietary information to the wrong person, a statistic up 9 percent from last year.

In addition to that, email is the primary means by which ransomware winds up getting inside company networks. This comes with a staggering 92 percent of successful ransomware attacks arriving via that channel, resulting in three or more days of downtime for the impacted companies.

Phishing attacks also continue to be a major issue, with 90 percent of respondents reporting an increase in the number of phishing attacks they were subjected to.

In light of these statistics, one would imagine that companies would be devoting significant resources to countering the threat. Unfortunately, that’s just not happening. Sure, money is being spent on infrastructure, but humans are the weakest link in this chain, and not just in the C-Suite. According to the survey, only 11 percent of organizations continuously train their employees on how to spot cyberattacks, and just over half (52 percent) perform training just once a year.

Matthew Gardiner, a cyber-resilience expert at Mimecast, summarizes it this way :

“Security awareness is an important part of any high-functioning security program. But like all security controls, there is no silver bullet solution. The best security programs seek a balance between technical controls, boosting their human firewalls, and having IT enabled business processes that are resilient to failures, whether man-made or caused by technology.”

Indeed.

Joseph Martin

Chrome Now Shows Sites Without SSL as Not Secure

August 2, 2018 by Joseph Martin

There is a small but significant change from Google, with the release of Chrome 68. The updated browser will now prominently notify browsers when they surf their way to non-HTTPS websites, displaying them as “Not Secure.”

This is Google’s latest step in a long campaign to try and make the web a safer and more secure place for internet users around the world.

If you’re not especially tech-savvy, here’s why it matters:

Anything sent over a non-HTTPS connection is in plain text, including sensitive information like credit card payment info and passwords. This makes it a trivial matter for hackers to snoop and/or steal data. The new “Not Secure” message that Chrome displays is a clear indication to browsers that there’s no SSL Certificate to encrypt the connection between your website’s server and the user’s computer.

Non-HTTPS connections have been considered dangerous for a number of years, but as hackers have gained increasing levels of sophistication, the dangers have only grown over time.

Google has intentionally taken a slow, measured approach to making this change in order to give business owners plenty of time to respond. They began the process in January 2017, with the release of Chrome 56, by displaying a subtle “Not Secure” warning in the address bar of any non-secure websites that were collecting passwords and credit card information on their customers.

Then, in October 2017, the company upped the ante with the release of Chrome 62, which saw the browser begin to display the “Not Secure” warning for any HTTP website that had any kind of text input field. This culminated in the release of Chrome 68, which prominently displays the message for all non-secure sites, period.

The bottom line is, the change has been a long time coming, and if your company hasn’t yet enabled HTTPS on your website, the time to do so is now.

Joseph Martin

Bluetooth Vulnerability Allows Hackers To Access Devices

August 1, 2018 by Joseph Martin

There’s a new Bluetooth security vulnerability to be aware of, tracked as CVE-2018-5383, and it’s a nasty one.

It’s a cryptographic vulnerability that affects firmware or operating system software drivers from a number of major vendors, including Qualcomm, Broadcom, Intel and Apple. At this point, the implication of the bug on Linux, Android, and Google are unknown.

The flaw is related to two important Bluetooth features: BR/EDR implementations of Secure Simple Pairing in device firmware and Bluetooth Low Energy (BLE) of Secure Connections Pairing in OS system software.

It was discovered by researchers operating out of Israel’s Institute of Technology. They discovered that the Bluetooth specification recommends (but critically does not mandate) that devices supporting the two features make any effort to validate the public encryption key received during secure pairing.

Since the specification is optional, it’s hardly a surprise that some vendors producing Bluetooth products do not take sufficient steps to validate the parameters used to generate public keys during the exchange.

This allows a would-be hacker the possibility of executing a man-in-the-middle attack to obtain the cryptographic key used by the device. This would give them the opportunity to not only spy on the device’s owner, but also to inject malware that could allow the hacker to take full control over the device.

SIG (the Bluetooth Special Interest Group which maintains the technology), had this to say about the flaw:

“For an attack to be successful, an attacking device would need to be within wireless range of two vulnerable Bluetooth devices that were going through a pairing procedure.

The attacking device would need to intercept the public key exchange by blocking each transmission, sending an acknowledgement to the sending device, and then injecting the malicious packet to the receiving device within a narrow time window. If only one device had the vulnerability, the attack would not be successful.”

Bluetooth SIG has now updated the specification to require products to validate public keys received as part of the public key-based security procedures. Of the manufacturers mentioned above, Apple and Intel have both released patches. Broadcom has made fixes available to its OEM customers who are responsible for providing them to end-users. There has been no word yet from Qualcomm.

Joseph Martin

Girl Scouts Can Now Earn New Badges For High Technical Skills

July 31, 2018 by Joseph Martin

The girl scouts have officially moved into the 21st century.

The Girl Scouts of America recently announced the creation of a whole raft of new badges that address (in the organization’s words) “some of society’s most pressing needs.”

A total of 30 new badges will be available exclusively for girls between the ages of five to eighteen for efforts and advocacy in the following areas:

Computer Science

Cybersecurity

Environment

Robotics

Space Exploration

Badges are awarded on the basis of completing specific tasks. So, for instance, when a girl learns how to code and completes a small project, she could be awarded with the new computer science badge, and when she builds a simple robot, the robotics badge would be awarded.

This is part of an ongoing effort to boost interest and participation in fields where women are generally under-represented.

According to the Girl Scouts USA CEO, Sylvia Acevedo:

“Whether they are fighting cybercrime, exploring how engineers solve problems, or advocating for issues affecting their community, Girl Scouts are learning how to proactively address some of the foremost challenges of today, while also building skills that will set them up for a lifetime of leadership.”

In recent years, the Girl Scouts have struggled to maintain enough membership nationally to remain viable. This is at least one of the reasons why the Boy Scouts of America announced in October 2017 that they would begin accepting girls into their program.

It remains to be seen whether the move to modernize the badges available to girls in the organization will be enough to boost membership and ensure the organization’s long-term viability. Even if it’s not, it’s a fantastic idea and long overdue. Kudos to Girl Scouts’ leadership for taking innovative action, and to all the girls who earn these new badges!

Joseph Martin

Hackers May Set Their Sights On Your GPS Next

July 30, 2018 by Joseph Martin

If you’re like most people, you probably rely heavily on the GPS function of your phone. Type in an address and your phone helpfully guides you, turn by turn, to your destination. It’s one of the most often utilized features of a smartphone, and of course, the hackers are very interested in interfering with it.

Until now though, hackers have been unable to fool humans into driving to the wrong destination by hacking their GPS, because their instructions often make no sense given the prevailing terrain features the humans are seeing on the road. For instance, nobody is going to turn left into a Jiffy Lube parking lot or a corn field just because GPS says to (unless your destination was Jiffy Lube, of course).

That’s changing, thanks to researchers from Virginia Tech and the University of Electronic Science and Technology of China.

The team has devised a way to hack into a GPS system and spoof the results well enough to fool humans, giving bogus driving directions that seem to make sense given local conditions, and as such, don’t raise red flags.

Accomplishing the task was no small feat, involving the creation of an algorithm that works in something close to real time. This along with a portable device for spoofing GPS that can be attached to the car of your target or placed in a trailing car. Its effective range is about fifty meters.

Once the equipment is in place, the algorithm crafts GPS inputs that follow the real world road network, allaying suspicion in 95 percent of the team’s test cases, while still ultimately sending the target to the wrong destination.

There are any number of ways this exotic type of attack could be used, but the two primary use cases would be to intentionally steer the target into hazardous road conditions, or to lure them to an isolated area where a physical attack could be carried out.

Unfortunately, in the months and years ahead, we can probably count on seeing both.

Joseph Martin

New Report Shows 32 Percent Increase In Cyber Attacks

July 28, 2018 by Joseph Martin

Positive Technologies has just released a new report that paints a grim picture for IT professionals. If your sense is that the number of cyberattacks are increasing, you’re not wrong. In fact, it’s probably worse than you realize.

So far this year, we’ve seen a staggering 32 percent increase in the total number of cyberattacks in the first quarter of 2018, compared to the same period last year. Even worse, malware attacks have increased by a mind-bending 75 percent since the first quarter of 2017.

Individuals were far and away the most frequent target (28 percent), but government agencies came in a reasonably close second (16 percent), with business in the healthcare, finance, and IT sectors rounding out the top five (8 percent, 7 percent, and 5 percent, respectively).

Of the malware deployed against targets this year, spyware was by far the most common, with stealth cryptocurrency mining software not far behind.

Leigh-Anne Galloway, the cyber security resilience lead at Positive Technologies explains in more detail:

“Our research shows that 63 percent of attacks included use of malware. Spyware, in particular, is used most often because it allows obtaining not only personal information and corporate secrets, but credentials for the services and systems needed to attack internal corporate infrastructure.”

Long story short, the prevalence of spyware seen in this report is likely to have cast-off effects in the future. Hackers will gain a sufficient level of access and information, courtesy of their successful spyware attacks, to launch even more harmful attacks against both individuals and government/corporate institutions in the future.

Positive Technologies warns that the number of attacks is likely to continue to escalate, and that there’s no clear end in sight.

The report is dark news if you’re in the digital security business. If your business hasn’t been hit yet, it seems that it’s just a matter of time.

Joseph Martin

Survey Shows Businesses Feel Prepared For A Data Breach

July 27, 2018 by Joseph Martin

A majority of business owners from around the world (68 percent) feel that they’re better prepared to ward off a cyberattack and prevent a data breach than their competitors. This is a figure which is up 8 percent over last year’s statistic for the same question. This, according to a recent survey by FICO.

In the US, power and industrial companies were the most confident, with 86 percent of companies from these sectors rating their firms as either above average, or top-tier in terms of their preparedness. The US financial firms were the least confident, with only 60 percent rating their firms as either above average or top-tier.

Telecommunications companies fell somewhere in the middle, with 72 percent of respondents ranking themselves above average or top-tier.

It may be premature to break out the champagne.

Maxine Holt, a research director on the team conducting the survey says:

“IT leaders have greater funding than ever to protect organizations from the continuously evolving threat landscape and meet complex compliance demands.

These same IT leaders are undoubtedly keen to believe that the money being spent provides their organization with a better security posture than any other – but the rapid pace of investment, often in point solutions, rarely takes an organization-wide view of security.”

In short, the increase in confidence might be illusory. The risk is that if too much is read into these numbers, it may lead to overconfidence, which could lead to an under-investment in security in subsequent years. This can ultimately set these companies (or at least some of them) up for failure and disappointment when their expensive security measures prove not to be nearly as effective as they initially believed.

Even if you didn’t participate in the recent survey, it bears asking the question: How would you rate your company’s ability to fend off an attack, relative to your competition?

Joseph Martin

World Cup Avoided Nearly 25 Million Cyber Attacks This Year

July 26, 2018 by Joseph Martin

According to the Kremlin, Russia prevented almost twenty five million cyber-attacks during the World Cup this year.

President Vladimir Putin praised the nation’s digital security forces by saying the following:

“I expect that your close and constructive interaction will continue and will contribute to ensuring the security of our states and our citizens in the future.”

Given the high-profile nature of the event, it was hardly a surprise that it would be a tempting target. In a survey by Lastline, in the weeks leading up to the World Cup, a staggering 72 percent of security professionals believed that an attack was likely.

The Russians took the threat seriously. In addition to beefing up their own security personnel, they also opened a “Cooperation Center” which was staffed by law enforcement officers from 34 different countries.

Some security professionals have cast doubt on the Kremlin’s figures, while others have at least unwillingly admitted that the figures weren’t out of the question.

David Grout (the Southern Europe Technical Director of FireEye) had this to say:

“Vladimir Putin’s statement that government security services have thwarted 25 million cyber-attacks linked to the FIFA World Cup may seem like a surprisingly high number, but not necessarily for those who work in the field. Every major event, whether sporting, political or otherwise, is likely to attract cyber-attacks. The 2018 World Cup is no exception. Before the competition had even started, there was evidence of Phishing attacks.

This included phishing attacks that started several weeks before the tournament and carried on throughout. These campaigns use several levers such as low-cost ticket offers, the chance to win a trip to Russia, promotions for items related to the World Cup (national team jerseys, mugs featuring players etc.). The main goal in this type of attack is to recover your banking information and force you to go through with the transaction to get the card number information, expiration date and also CCV.”

Even if the numbers are somewhat inflated, kudos to Russia for their deft handling of the event!

Joseph Martin

Microsoft Working On Delay Feature For Windows 10 Update Installs

E-Mail Is A Big Threat To Your Organization

Chrome Now Shows Sites Without SSL as Not Secure

Bluetooth Vulnerability Allows Hackers To Access Devices

Girl Scouts Can Now Earn New Badges For High Technical Skills

Hackers May Set Their Sights On Your GPS Next

New Report Shows 32 Percent Increase In Cyber Attacks

Survey Shows Businesses Feel Prepared For A Data Breach

World Cup Avoided Nearly 25 Million Cyber Attacks This Year

Contact Info

Navigation