Blog – Page 18

Firefox Adds Data Breach Monitoring Service

October 6, 2018 by Joseph Martin

Firefox is upping the ante where digital security is concerned, having just announced the release of a new, free service called ‘Firefox Monitor.’ The new service is designed with one specific goal in mind: To assist users in finding out if their accounts were exposed via a data breach.

It was developed in partnership with Troy Hunt, whose website, “Have I Been Pwned” is one of the most popular destinations on the web for security-minded individuals. This website, in fact, is the driving force behind Mozilla’s new service.

People will be able to engage with the service in two different ways. First, by making a direct inquiry to check the status of their various accounts, passwords, and email addresses that may have been compromised. Or second, by configuring the new subsystem to notify them when their information has been detected by the system.

Nick Nguyen, of Mozilla, had this to say about the new feature:

“It can be hard to keep track of when your information has been stolen, so we’re going to help by launching Firefox Monitor, a free service that notifies people when they’ve been part of a data breach. After testing this summer, the results and positive attention gave us the confidence we needed to know this was a feature we wanted to give to all of our users.”

If you find out via active polling or receive a notification that one of your accounts was compromised, you should take action immediately. You should change the password and audit the account to address instances where you may have used the same password associated with the compromised account in order to minimize your risks.

This is great news, and a fantastic addition by Mozilla. While it’s not a magic bullet that will solve all your security woes, it should help give users greater peace of mind, and it puts a powerful new tool in their hands to monitor the integrity of their own accounts. Kudos to Mozilla!

Windows 10 Adoption Continues To Grow

October 5, 2018 by Joseph Martin

Windows 10 is far and away the fastest growing version of the OS in the company’s history. It recently hit an installation base of a staggering 700 million devices after about three years on the market.

Note that these installation figures include installs not just on PCs, but also on Surface Hubs, Xbox, HoloLenses and smartphones.

Unfortunately, as impressive as that number is, it falls well short of Microsoft’s original estimate of a billion installs in three years.

The smaller than expected number of smartphone installations is the key reason behind the shortfall. Initially, the company had envisioned these devices adding several hundred million installations to the total count. However, when Microsoft switched gears and decided to abandon the smartphone market, it was inevitable that they would fall well short of their original target.

It matters because part of Microsoft’s pitch to developers was the massive (projected) size of the Windows 10 market. Now that the official numbers are in, and the final count is some 30 percent lower than anticipated, part of that appeal is understandably gone.

Even so, a market made up of 700 million devices is certainly nothing to sneeze at and developers are heavily invested in the platform, so it would make little sense for them to abandon it now. Not to mention the fact that the number of installations is expected to continue to grow at a healthy clip for the foreseeable future.

Inside the Windows ecosystem, 43 percent of Windows PCs are currently running Windows 10, with another 45 percent still running Windows 7. Given that support has officially ended for Windows 7, it’s all but guaranteed that Windows 10 will ultimately reach one billion installations. It will probably reach a bit more than that as users continue to slowly migrate away from Windows 7.

At the end of the day then, although Microsoft’s time frame was a bit too aggressive, it looks like they’re going to hit the magic number.

Government Payment Processor Exposes Data On Millions Of Americans

October 4, 2018 by Joseph Martin

If you use the GovPayNet portal, be advised that your personal information is currently at risk. Although at this point, there’s no indication that any hacker has made use of it. The portal is run by Government Payment Service, and is used by many Americans to pay fines, fees and bills generated by more than two thousand different government agencies operating in 35 states.

Unfortunately, the way the website is configured, when it issues a receipt for a payment, it numbers those receipts sequentially. All a hacker would have to do would be to change the receipt number in the URL to see any previous receipts, and all of the information it contains.

When the flaw was discovered by journalist Brian Krebs, more than fourteen million old records were exposed in this manner. He contacted Government Payment Service to inform them of the flaw, and the agency moved quickly to address the issue. They said in a formal statement that they “did not adequately restrict access to only authorized recipients.”

They went on to assure their users that there’s no indication that any data had been improperly accessed. They added that the receipts generated don’t include any information that could be used by a hacker to initiate any type of financial transaction.

Unfortunately, the reality was a bit different. The receipts contain the names, addresses and phone numbers of the person paying the fee in question, along with the last four digits of whatever credit or debit card was used to make payment. That is more than enough information to enable a hacker to initiate a phishing attack to get the rest.

Nick Bilorgoskiy of Juniper Networks had this to say about the matter:

“Online payment providers…should take special care to protect their customers’ receipts by using HTTPS and checking that the user is logged in and has permissions to view them. To avoid information disclosure and directory traversal issues, I also recommend denying anonymous web visitors the ability to read permissions for any unnecessary files from web-accessible directories.”

It’s good advice, and here’s hoping that Government Payment Service will take it. If you use the service, there’s nothing for you to do. You don’t need to change your password, since it was never exposed. Just be mindful that someone may have seen any data your receipts contain before the site was secured.

Google’s Emergency Location Service Improves 911 Response

October 3, 2018 by Joseph Martin

Google is making a small but pivotal change as it relates to calls placed to 911 operators. Having recently finalized a complex partnership with RapidSOS and West (two emergency technology companies) and T-Mobile, Google will now send location data from its “Emergency Location Service” when an Android user places a 911 call.

If the caller is a T-Mobile customer, the information will be passed along via the carrier. Where 911 call centers use RapidSOS, Google will send the location data via the technology company. In the US Virgin Islands, Google has made the same arrangement with the Emergency Tech company, West.

While the announcement may raise some surprised eyebrows, the change has been in the works for more than a year. Google has spent much of that time testing. Their findings were that the location data Google sent over was more accurate and arrived more quickly than the data the 911 call centers had been getting previously.

Not to be outdone, Apple announced in June of this year that it was developing a similar service for iOS users, and that beginning with iOS 12, Apple devices would automatically send location data to emergency call centers when users dial 911.

Even privacy advocates agree that this is generally a good move, and it’s one of the growing number of instances where smart use of technology can save lives. Anything we can do to give our nation’s emergency call centers an edge is an important change. Currently, those call centers take an average of 140,000 calls a day, so this is by no means a trivial issue.

Kudos to both Google and Apple for taking bold action on this issue. While we may not like the idea of having our location data shared, in this particular instance, it certainly seems like a smart play.

G-Suite Users Can View Employee Productivity With Work Insights

October 3, 2018 by Joseph Martin

Google has recently made some changes and improvements to its G-Suite. It introduces new tools designed to allow managers and admins greater visibility into how the people in their organizations use the G-Suite.

Currently, the “Work Insight” tool is available in beta and displays information on how G-Suite is deployed at the team level.

While this will be a boon to all organizations, it will be especially valuable for organizations moving from legacy tools to the G-Suite. It will also serve to shine a light on teams or individual employees who could benefit from additional training on specific applications and provide valuable information on cross-team collaborations.

Where collaboration is concerned, the thinking is that admins would be able to see, for example, how many members of a sales team are working collaboratively with the marketing department. They could also see whether that collaboration is happening via face to face meetings or via co-created documents.

In addition to the Work Insight tool, Google also announced the availability of the G-Suite Security Center, which is an investigative tool that provides admins with a dashboard they can use to monitor a variety of security metrics.

The two big advantages to the new Investigation tool are:

It gives admins the power to scale an incident response as needed, up to and including scaling it across an entire domain

It adds integrated remediation to the detection and prevention capabilities already available to admins in the G-Suite.

Taken together, these changes should make life much easier for both managers and admins, providing better data which can be transformed into hard-hitting business information. If you use the G-Suite at all, be sure to check out these new tools at your next available opportunity. Both are excellent additions.

Android May Be Coming To More New Cars Soon

October 3, 2018 by Joseph Martin

Google scored a major coup in the auto industry. They just inked a deal that will put the Android OS in every car made by the global auto alliance Renault-Nissan-Mitsubishi. It sold a staggering 10.6 million vehicles around the world last year.

The tech giant has struggled to get its foot in the door, primarily because auto makers have been hesitating on handing over the keys to their Infotainment and other computerized systems, in fear of being shut out of the data collected by those systems.

It’s a fair complaint and a valid concern, but Google has been working hard to build trust in the auto world and has taken a variety of approaches.

Their first move was to build an OS called “Android Auto” which mirrors the functionality of the Android OS but offers scaled down functionality which means it falls well short of “Android running on a car.”

Having gained some ground with that approach, they next introduced Android Automotive, which is essentially the entire Android OS, geared specifically for vehicular use. They showed off their work last year at the 2018 I/O Tech conference, and their persistence paid off.

It’s a big win on all fronts. The automakers win by retaining access to their data, while handing off the software function to a company with a long history of getting it right.

Google wins because it expands the Android ecosystem in a whole new way. Consumers win because it offers a seamless (and improved) user experience and makes it easier for an auto owner to sync their Android device to their car.

Google also wins because they get access to all the data generated by the in-auto OS after gaining permission from the user. Plus, having scored a partnership with one major auto alliance, others will surely follow, which will further expand the tech giant’s footprint.

Data Breach Notifications May Get Standardized

October 2, 2018 by Joseph Martin

A new piece of legislation is making its way through the halls of Congress that could standardize and streamline the data security and breach notification process for financial institutions. This is something that most people in the industry tout as an improvement over the current situation.

The Consumer Information Notification Requirement Act (H. R. 6743) legislation was approved by committee not long after Congress received a letter cosigned by members from the American Bankers Association, the Consumer Bankers Association, the Credit Union National Association, the Independent Community Bankers of America and the National Association of federally-Insured Credit Unions.

The letter read, in part:

“Our existing payments system serves hundreds of millions of consumers, retailers, financial institutions and the economy well. Protecting this system is a shared responsibility of all parties involved and we must work together and invest the necessary resources to combat never-ending threats to the payment system.”

Despite so many influential organizations weighing in, many state regulators are skeptical of the proposed legislation and are actively pushing back against it over concerns that it would undermine state-level authority.

Whether you agree that those are valid concerns or not, the reality is both stark and terrifying. In the first half of 2018, ThreatMatrix recorded more than 81 million cybercrime attacks against financial institutions. 27 million of those targeted the mobile channel, given greater mobile banking adoption rates.

ThreatMatrix weighed in on the debate saying, “Financial services mobile transactions are growing globally, with China, South East Asia and India showing the strongest regional growth. Overall, the biggest threat in financial services comes from device spoofing, as fraudsters attempt to trick banks into thinking multiple fraudulent log-in attempts are coming from new customer devices, perhaps by repeatedly wiping cookies or using virtual machines.”

Clearly, something must be done, and while the politicians debate the issue, the attacks continue unabated.

An Exploited Website Can Cause Apple Products To Crash

September 28, 2018 by Joseph Martin

Users of Apple tech have a new reason to worry. A security researcher named Sabri Haddouche, who works for an instant messaging app called “Wire,” has published a proof of concept web page. It contains a fatal exploit that can crash and restart iPhones, iPads and any Mac.

Essentially then, the entire Apple ecosystem is vulnerable. Worse, the security flaw can be exploited using nothing more than CSS and HTML code. The flaw resides in Apple’s WebKit, which is its web rendering engine used by all apps and browsers running on Apple’s OS.

Haddouche tested the exploit using Chrome, Microsoft Edge, and the Safari web browser. He got the same result each time using both a MacBook Pro and an iPhone X. Apple users are advised to exercise extreme caution when visiting any web page until a patch can be issued.

The company is currently investigating the issue, and to this point has not given their legions of users a timeframe for a possible fix.

Sadly, this isn’t the first time a flaw like this has been discovered, and it’s unlikely to be the last. If there’s a silver lining, it is that Apple has historically been quick to patch flaws of this kind, and it should be noted that Linux and Windows systems are not affected.

It’s especially worrisome for small business owners, and until Apple gives us a time frame for a fix, your best bet is to steer clear of any websites but those that are business critical, and trusted sites that you know to be safe.

Although the exploit was specifically engineered to crash Apple devices, it’s easy enough to envision a nastier implementation which could critically damage the OS, rendering the device targeted by the attack completely inoperable. Stay vigilant, and stay tuned for a fix to what could be a devastating issue.

Popular NAS Device May Easily Be Compromised

September 27, 2018 by Joseph Martin

Western Digital has a big problem, and if you use the company’s “My Cloud” network-attached storage (NAS) storage devices, you’ve got one too. The WD My Cloud service is enormously popular because it’s so convenient, allowing both business owners and individuals to store their files, perform periodic backups, and of course, access their data from anywhere in the world.

Recently, security researchers have discovered an authentication bypass vulnerability that could allow an attacker to gain admin-level control over the device. This means they’d be able to monitor all of the files sent to, opened, or deleted on it, make copies of, or even delete the files found there.

The vulnerability has been given the designation CVE-2018-17153 and is about as serious as it gets. Without going into the technical details, essentially, all a hacker would have to do to take complete control over the device is for the hacker to “tell” the device that he’s an Admin via an uploaded cookie file. The device will accept it with no password required.

When the researchers notified Western Digital of the security flaw, they also released a proof of concept detailing the attack, and disturbingly, it can be executed using just six lines of code.

There is one silver lining in that to make use of the exploit, the hacker would need either local access or an internet connection to a specific WD My Cloud device. But this is a relatively low bar that most any experienced hacker could clear without a trace.

Western Digital has responded quickly, and according to a recent blog post on the company’s website, promises to have a patch that will resolve the issue “within a few weeks.” They also stressed to their customers the importance of ensuring that the firmware on all their products is always up to date and recommended enabling auto updates.

It’s good advice that will simplify your life and ensure you never miss an update, although not always practical for SMBs.

Malware Reports Continue To Rise

September 26, 2018 by Joseph Martin

We’ve known for some time now that the next big crisis the internet will have to come to grips with is the dramatic rise of the Internet of Things (IOT).

The problem isn’t with the devices themselves, which are enormously helpful and rapidly growing in their popularity. Rather, it lies in the fact that the overwhelming majority of IoT manufacturers have been notoriously lax when it comes to building even basic security protocols into the goods they make and sell.

The lack of security and the complete absence of any type of security has made the Internet of Things the new “low hanging fruit” of the internet, and hackers have been happy to take advantage of the incredibly easy access.

Kaspersky Lab has recently given us hard numbers to provide a sense of the scope and scale of the problem.

Last year, the company detected a total of 32,615 malware infections on IoT devices. In just the first six months of this year, the company has spotted 121,588 infections on IoT devices, representing a staggering 273 percent increase.

Far and away, the most commonly compromised devices were routers. Behind them were a whole raft of other IoT devices including smart TVs, refrigerators, DVRs, printers, washing machines and more.

Things have gotten so bad that earlier this year, the FBI issued a public service announcement in a bid to warn users of the dangers of unsecured devices.

These can be slaved by hackers to create enormous botnets like the one that brought down the internet on the entire eastern seaboard earlier this year. However, if they are connected to your home or office network, they provide a perfect launchpad for attacks against other network connected devices.

Sadly, manufacturers to this point have shown little interest in beefing up the security of the devices they sell, so the problem is likely to get much worse before it starts getting better.

Firefox Adds Data Breach Monitoring Service

Windows 10 Adoption Continues To Grow

Government Payment Processor Exposes Data On Millions Of Americans

Google’s Emergency Location Service Improves 911 Response

G-Suite Users Can View Employee Productivity With Work Insights

Android May Be Coming To More New Cars Soon

Data Breach Notifications May Get Standardized

An Exploited Website Can Cause Apple Products To Crash

Popular NAS Device May Easily Be Compromised

Malware Reports Continue To Rise

Contact Info

Navigation