Blog – Page 16

Apple IOS12 Users’ Photos And Contacts May Be Vulnerable

October 13, 2018 by Joseph Martin

Jose Rodriguez, a Spanish Apple enthusiast, has discovered a new security flaw to be aware of. He posted a Proof of Concept video showing the exploit in action.

We’ll say upfront that this is a highly convoluted attack involving more than two dozen discrete steps. A hacker would need to be in possession of the phone to pull it off, so it’s not something that’s likely to become a major threat.

Even so, we’ll provide the details below.

Apple has built in security measures that are designed to prevent someone from tricking Siri into allowing unauthorized access to the phone. Unfortunately, by using a complex series of steps involving both Siri and Apple’s Notes application, it’s possible for a hacker to bypass those security measures, access images stored on the phone, and then change the image associated with a contact or the owner of the phone.

This method is effective on both iOS12 and the iOS 12.1 beta, which means that Apple’s recent patch to their OS does not and will not prevent this exploit from working. Worse, the company has yet to comment on the matter, so at this point, there’s no timetable for a fix.

The independent news site Threatpost has been able to replicate the attack, so we have third-party confirmation.

Fortunately, there’s a simple way to negate the attack entirely while we’re waiting for a patch to close the loophole once and for all. Simply go to Settings – Face ID & Passcode – Touch ID & Passcode, and disable the “Allow access when locked” option for Siri.

Again, it’s important to reiterate that this is a highly complex attack that involves having both physical access to the device and more than two dozen steps, so this is not an issue that’s likely to be widespread. Even so, it pays to take precautions until Apple can roll out a fix.

Microsoft Is Changing How Searches Will Work

October 11, 2018 by Joseph Martin

Change is coming to the way Microsoft handles search across its ecosystem. If you use the home edition of Office, you’re not likely to notice, but if you use Office 365, the changes will be significant.

Here’s what’s happening:

First of all, the search bar will get bigger, taking a more prominent and visible place on your screen’s real estate.

Second, anywhere the company utilizes a search box (from their Bing search engine, to the OS itself, to Teams, Office and more), the plan is to provide a unified and consistent look that is intended to improve the overall user experience.

The box itself is getting a makeover and will soon start offering suggestions based on your previous search behaviors. For instance, it may present you with a list of frequently used email contacts or documents that you’ve recently edited, with the list updating dynamically as you begin typing a term into the search field.

In addition to that, you’ll soon be able to search for commands within a given application, so instead of hunting around on the menu bar for the function you’re looking for, the search box will take you right to it, showing it among the search results.

If you’re signed into your Office 365 account, the search results will also include any documents you have saved in OneDrive or SharePoint and relevant conversations in Yammer and Teams if you use those. It also may feature contacts from your company directory.

Most significantly, since the Bing search engine is itself a search box, those results will be displayed alongside relevant webpages.

If you’re curious to see it in action, it is currently available today as an opt-in beta/preview mode for corporate users. It’s also available in both Outlook and SharePoint mobile apps. The general public will be able to see it in action as soon as the second quarter of 2019, when the new functionality will be expended to Office Home, Office Desktop and Windows 10 itself.

Google May Be Getting Rid Of Google Plus

October 11, 2018 by Joseph Martin

If you’re one of the relatively few people who use Google+ in something other than an Enterprise setting, be advised that the clock is ticking. Google has just announced that they’re sunsetting the service. It will be going offline for consumers at some point over the next ten months.

The reasons for their decision are complex. In part, it stems from the fact that the company readily acknowledges that it has “low usage and engagement,” which is underscored by the fact that 90 percent of Google+ user sessions last less than five seconds.

Another major component driving the decision is that the company suffered serious pushback when it revealed a previously undisclosed security flaw that exposed users’ profile data. The company patched the issue in March of this year (2018), but the company’s long delay in going public with the flaw didn’t sit well with Google+’s user base.

Note that the company plans to continue offering Google+ for Enterprise customers to facilitate intra- and inter-company communications. In fact, they plan to roll out a raft of new features in the year ahead.

Google also recently announced other changes. Pending API changes, one new feature will limit developers’ access to data on Android devices and user Gmail accounts. Also, contact interaction data will soon be off limits, as will call logs and SMS permissions.

There are changes coming to Gmail itself as well, where developers will be sorely limited in how much access they have to user emails.

As Ben Smith (the company’s VP of engineering) explains, “Only apps directly enhancing email functionality–such as email clients, email backup services and productivity services (e.g., CRM and mail merge services)–will be authorized to access this data.”

Any developer who currently has this level of access can expect a security assessment and agree to the company’s new rules. We’ll provide more details as they become available, but broadly speaking, these are good changes that will enhance data security for the company’s legions of users.

Payment Pages Are Being Compromised To Steal Data

October 10, 2018 by Joseph Martin

Symantec’s most recent statistics have revealed a disturbing trend. Malware designed to compromise checkout pages is seeing a big spike in use, with the company reporting a staggering 248,000 attempts since August 13th of this year, with more than a third of them (36 percent) between September 13th through September 20th. As disturbing as those numbers are, that’s just the tip of the iceberg.

As Symantec notes on their website:

“If we compare the week of September 13 to 20 to the same week in August, the number of instances of formjacking attacks blocked by Symantec more than doubled, jumping from just over 41,000 to almost 88.500 – a percentage increase of 117 percent.”

Leading the surge is a particularly nasty strain of malware known as “Magecart.” Magecart campaigns are quite robust that begin by breaching the target website, then injecting malicious scripts into it that are designed to scrape card details and other customer information provided during the checkout process. This is an attack that’s alternately known as formjacking, payment card scraping, and web-based skimming.

Symantec isn’t the only company to take note of the trend. RiskIQ has been sink holing domains associated with Magecart infrastructure for much of the month and alerting companies compromised by Magecart attacks as they find them.

Kevin Beaumont, an independent security researcher, had this to say via Twitter :

“#TrackingMagecart I’ve updated the IoCs to double the number of domains, now tracking over 1000 objects – some of the domains have now been sink holed. Recommend InfoSec vendors block/flag domains.”

Magecart isn’t new. Security researchers have been tracking it since 2015, and independent researcher Willem de Groot has created a malware scanning website called MageReport, which allows business owners to check to see if their Magento-based webshop is vulnerable to this type of attack. If you think you might be, it certainly bears making use of.

At present, the one thing that’s not known is the reason behind the sudden spike. Only that it’s happening.

How Long Before You Experience A Cyber Attack?

October 9, 2018 by Joseph Martin

According to this year’s Traveler’s Risk Index, published by The Traveler’s Indemnity Company, a majority of business owners have a somewhat fatalistic view of hacking and data breaches.

The index includes 52 percent of survey respondents indicating that they believe a cyber-attack is inevitable.

The other statistics in the report paint a grim picture. Here’s a quick overview:

55 percent of business owners say that they have not completed a cyber risk assessment

63 percent say that they have not yet completed a cyber risk assessment on vendors who have access to their data

62 percent indicate that they have not yet developed any kind of business continuity plan, which means they don’t even have the basic outline of the steps they’ll need to take in the face of a successful attack against their company

The number of survey participants saying they have been the victim of a cyber attack has doubled from 10 percent in 2015 to 20 percent in this year’s survey

Yet in spite of this staggering lack of preparation, fully half of all survey respondents say they have cyber insurance.

Tim Francis, the Enterprise Cyber-Lead at Travelers, had this to say about the report:

“Cyber risks carry serious consequences for any business, threatening everything from revenue to operations. These findings reveal some surprising things about how companies view their cyber exposure, their relative confidence in dealing with them and the clear opportunity that exists for them to be better prepared for a cyber-attack.”

It’s a thorny problem, for sure. Most small to medium sized business are strapped for cash and simply can’t dedicate the level of resources they’d like to toward data security.

The good news is that this most recent survey reveals a few simple, low-cost things you could do starting today that would dramatically improve your chances of dealing with a cyber-attack. Given that most people agree it’s inevitable and just a matter of time, that would be an excellent place to start.

Firefox Adds Data Breach Monitoring Service

October 6, 2018 by Joseph Martin

Firefox is upping the ante where digital security is concerned, having just announced the release of a new, free service called ‘Firefox Monitor.’ The new service is designed with one specific goal in mind: To assist users in finding out if their accounts were exposed via a data breach.

It was developed in partnership with Troy Hunt, whose website, “Have I Been Pwned” is one of the most popular destinations on the web for security-minded individuals. This website, in fact, is the driving force behind Mozilla’s new service.

People will be able to engage with the service in two different ways. First, by making a direct inquiry to check the status of their various accounts, passwords, and email addresses that may have been compromised. Or second, by configuring the new subsystem to notify them when their information has been detected by the system.

Nick Nguyen, of Mozilla, had this to say about the new feature:

“It can be hard to keep track of when your information has been stolen, so we’re going to help by launching Firefox Monitor, a free service that notifies people when they’ve been part of a data breach. After testing this summer, the results and positive attention gave us the confidence we needed to know this was a feature we wanted to give to all of our users.”

If you find out via active polling or receive a notification that one of your accounts was compromised, you should take action immediately. You should change the password and audit the account to address instances where you may have used the same password associated with the compromised account in order to minimize your risks.

This is great news, and a fantastic addition by Mozilla. While it’s not a magic bullet that will solve all your security woes, it should help give users greater peace of mind, and it puts a powerful new tool in their hands to monitor the integrity of their own accounts. Kudos to Mozilla!

Windows 10 Adoption Continues To Grow

October 5, 2018 by Joseph Martin

Windows 10 is far and away the fastest growing version of the OS in the company’s history. It recently hit an installation base of a staggering 700 million devices after about three years on the market.

Note that these installation figures include installs not just on PCs, but also on Surface Hubs, Xbox, HoloLenses and smartphones.

Unfortunately, as impressive as that number is, it falls well short of Microsoft’s original estimate of a billion installs in three years.

The smaller than expected number of smartphone installations is the key reason behind the shortfall. Initially, the company had envisioned these devices adding several hundred million installations to the total count. However, when Microsoft switched gears and decided to abandon the smartphone market, it was inevitable that they would fall well short of their original target.

It matters because part of Microsoft’s pitch to developers was the massive (projected) size of the Windows 10 market. Now that the official numbers are in, and the final count is some 30 percent lower than anticipated, part of that appeal is understandably gone.

Even so, a market made up of 700 million devices is certainly nothing to sneeze at and developers are heavily invested in the platform, so it would make little sense for them to abandon it now. Not to mention the fact that the number of installations is expected to continue to grow at a healthy clip for the foreseeable future.

Inside the Windows ecosystem, 43 percent of Windows PCs are currently running Windows 10, with another 45 percent still running Windows 7. Given that support has officially ended for Windows 7, it’s all but guaranteed that Windows 10 will ultimately reach one billion installations. It will probably reach a bit more than that as users continue to slowly migrate away from Windows 7.

At the end of the day then, although Microsoft’s time frame was a bit too aggressive, it looks like they’re going to hit the magic number.

Government Payment Processor Exposes Data On Millions Of Americans

October 4, 2018 by Joseph Martin

If you use the GovPayNet portal, be advised that your personal information is currently at risk. Although at this point, there’s no indication that any hacker has made use of it. The portal is run by Government Payment Service, and is used by many Americans to pay fines, fees and bills generated by more than two thousand different government agencies operating in 35 states.

Unfortunately, the way the website is configured, when it issues a receipt for a payment, it numbers those receipts sequentially. All a hacker would have to do would be to change the receipt number in the URL to see any previous receipts, and all of the information it contains.

When the flaw was discovered by journalist Brian Krebs, more than fourteen million old records were exposed in this manner. He contacted Government Payment Service to inform them of the flaw, and the agency moved quickly to address the issue. They said in a formal statement that they “did not adequately restrict access to only authorized recipients.”

They went on to assure their users that there’s no indication that any data had been improperly accessed. They added that the receipts generated don’t include any information that could be used by a hacker to initiate any type of financial transaction.

Unfortunately, the reality was a bit different. The receipts contain the names, addresses and phone numbers of the person paying the fee in question, along with the last four digits of whatever credit or debit card was used to make payment. That is more than enough information to enable a hacker to initiate a phishing attack to get the rest.

Nick Bilorgoskiy of Juniper Networks had this to say about the matter:

“Online payment providers…should take special care to protect their customers’ receipts by using HTTPS and checking that the user is logged in and has permissions to view them. To avoid information disclosure and directory traversal issues, I also recommend denying anonymous web visitors the ability to read permissions for any unnecessary files from web-accessible directories.”

It’s good advice, and here’s hoping that Government Payment Service will take it. If you use the service, there’s nothing for you to do. You don’t need to change your password, since it was never exposed. Just be mindful that someone may have seen any data your receipts contain before the site was secured.

Google’s Emergency Location Service Improves 911 Response

October 3, 2018 by Joseph Martin

Google is making a small but pivotal change as it relates to calls placed to 911 operators. Having recently finalized a complex partnership with RapidSOS and West (two emergency technology companies) and T-Mobile, Google will now send location data from its “Emergency Location Service” when an Android user places a 911 call.

If the caller is a T-Mobile customer, the information will be passed along via the carrier. Where 911 call centers use RapidSOS, Google will send the location data via the technology company. In the US Virgin Islands, Google has made the same arrangement with the Emergency Tech company, West.

While the announcement may raise some surprised eyebrows, the change has been in the works for more than a year. Google has spent much of that time testing. Their findings were that the location data Google sent over was more accurate and arrived more quickly than the data the 911 call centers had been getting previously.

Not to be outdone, Apple announced in June of this year that it was developing a similar service for iOS users, and that beginning with iOS 12, Apple devices would automatically send location data to emergency call centers when users dial 911.

Even privacy advocates agree that this is generally a good move, and it’s one of the growing number of instances where smart use of technology can save lives. Anything we can do to give our nation’s emergency call centers an edge is an important change. Currently, those call centers take an average of 140,000 calls a day, so this is by no means a trivial issue.

Kudos to both Google and Apple for taking bold action on this issue. While we may not like the idea of having our location data shared, in this particular instance, it certainly seems like a smart play.

G-Suite Users Can View Employee Productivity With Work Insights

October 3, 2018 by Joseph Martin

Google has recently made some changes and improvements to its G-Suite. It introduces new tools designed to allow managers and admins greater visibility into how the people in their organizations use the G-Suite.

Currently, the “Work Insight” tool is available in beta and displays information on how G-Suite is deployed at the team level.

While this will be a boon to all organizations, it will be especially valuable for organizations moving from legacy tools to the G-Suite. It will also serve to shine a light on teams or individual employees who could benefit from additional training on specific applications and provide valuable information on cross-team collaborations.

Where collaboration is concerned, the thinking is that admins would be able to see, for example, how many members of a sales team are working collaboratively with the marketing department. They could also see whether that collaboration is happening via face to face meetings or via co-created documents.

In addition to the Work Insight tool, Google also announced the availability of the G-Suite Security Center, which is an investigative tool that provides admins with a dashboard they can use to monitor a variety of security metrics.

The two big advantages to the new Investigation tool are:

It gives admins the power to scale an incident response as needed, up to and including scaling it across an entire domain

It adds integrated remediation to the detection and prevention capabilities already available to admins in the G-Suite.

Taken together, these changes should make life much easier for both managers and admins, providing better data which can be transformed into hard-hitting business information. If you use the G-Suite at all, be sure to check out these new tools at your next available opportunity. Both are excellent additions.