Blog – Page 25

Americans Want Local Governments To Spend More On Cyber Security

July 16, 2018 by Joseph Martin

While a significant percentage of Americans are suspicious of government spending beyond the essentials, there’s at least one notable exception, according to a recent survey conducted by SecurityFirst.

A majority (74 percent) of Americans want their local governments to spend more money on cybersecurity.

Here are a few of the highlights from the survey:

64 percent believe that a ransomware attack on local government installations could have serious, long-term impacts

Only 33 percent of respondents believe that their local governments are capable of keeping their data safe in the event of an attack

60 percent believe that a cyberattack could jeopardize essential services, and 77 percent fear that fallout from such an attack could hinder first responders

In terms of the biggest concerns of the citizenry, the data broke out as follows:

74 percent cited potential dangers to local utilities

68 percent cited potential dangers to our court system

68 percent cited potential dangers to local schools

Not long ago, the city of Atlanta suffered just such an attack, which cost them millions of dollars and erased several years’ worth of critical data. The city is still working to recover from the incident. It underscores the fact that the concerns brought to light by the survey are all too real, that citizens are right to worry, and they demand more from their local governments.

Unfortunately, in an age where government spending of any kind almost reflexively comes under intense scrutiny and debate, it remains to be seen whether this and similar surveys will provide any traction to the idea of greater government spending on cybersecurity.

If it does not, then we can expect to see more incidents like the unfortunate attack on Atlanta, with similar consequences. If the past is any indication, the survey will generate a few conversations, but not much in the way of action. Sadly, it will probably take a major attack that costs lives before we start getting serious about protecting local governments and critical infrastructure. Here’s hoping it doesn’t come to that.

Apps In Gmail Have Full Access To Read Your Emails

July 14, 2018 by Joseph Martin

File this one away under “watch your permissions.” It’s recently come to light that an unknown number of third party apps have access to read emails sitting in your Gmail account.

While the practice is not new, things like this are coming under increased scrutiny in the wake of Facebook’s Cambridge Analytica incident.

Here are the important details to bear in mind:

Apps that can read your email DO require explicit user permissions. You have to agree to allow these apps access to your Gmail account.

Once you do allow access, you’re giving both humans and computers access to not only read your messages but create new folders and even send emails out using your account. These details are generally buried in the fine print, and most users don’t realize exactly what they’re allowing when they accept.

Google has not made exact figures known, so it’s unclear exactly how many apps on the Play Store currently have this permission, nor is it known how many apps were denied in Google’s vetting process.

Currently, there are no known instances of a third party abusing Gmail permissions and doing anything inappropriate with the data they’re being given access to.

It’s not just Google. Most major free email providers have similar arrangements.

You can check your permissions via your smartphone and revoke access to any app that looks suspicious, or that you’re not comfortable giving that level of permission to. The downside, of course, is that revoking permissions will probably cause the app to stop working.

As ever, ensuring your privacy requires a proactive approach. It’s foolish to assume that a company (any company) will be as careful with your privacy as you would be personally. Be aware and stay vigilant. At the end of the day, that’s the best way to minimize intrusions to your privacy.

Shopped At Adidas Website? Your Info May Have Been Compromised

July 13, 2018 by Joseph Martin

Another week, another high-profile data breach. This time, Adidas and their online store was the target.

The company became aware of the incident on June 26th, and immediately began notifying “certain customers” that their data had been compromised.

The official statement from the company reads in part, as follows:

“Adidas is working with leading data security firms and law enforcement authorities to investigate the issue. According to the preliminary investigation, the limited data includes contact information, usernames and encrypted passwords. Adidas has no reason to believe that any credit card or fitness information of those consumers was impacted.”

At this time, it’s not known exactly how many users were impacted, but the estimates are in the millions. So if you have purchased anything from the Adidas website recently, you should assume that the data referenced above has been compromised.

The company has promised to release additional details as they become available, but for now, the following standard measures should be taken as a precaution:

If you have an account on the Adidas website, change your password immediately.

Although there’s no indication that credit card information was stolen, to be safe, it would be best to monitor the credit card you used to make your purchase for suspicious activity

Unfortunately, 2018 is probably going to be a record-breaking year in terms of high profile data breaches, just as 2017 broke all the records last year. The escalating number of breaches only underscores the point that in the ongoing battle between beleaguered IT staff and hackers around the world, the hackers seem to have the upper hand.

Part of the difficulty lies in the fact that it’s no longer enough to simply fortify your business network, because so much data is shared with so many third parties. All a hacker needs to do is to find and exploit a weakness in any of the systems managed by those third parties, and no matter how robust your own security, your data is suddenly at risk.

Sadly, it’s going to get a lot worse before it starts to get better.

Bug In Facebook May Have Unblocked People You Blocked

July 12, 2018 by Joseph Martin

Facebook recently announced a site bug that impacted the privacy settings of more than 800,000 of its users. If you’re one of the unfortunate souls who has been affected, then people you had formerly blocked may have become unblocked, and can now see your posts.

For many people, that’s not a huge deal. In some cases, say for example, if you blocked your ex-girlfriend, boyfriend, or wife and were impacted, they may be able to see things you don’t want them to.

Facebook’s official statement in response to the matter provided additional details and said that 83 percent of the people who were impacted only had one person on their blocked list temporarily unblocked, and that the situation had been remedied.

Of significance, the bug did not allow unblocked users to see content shared by friends of those who had blocked them, and it did not reinstate a “severed” friendship on the system. In some cases, however, someone who had been blocked may have been able to establish (or attempt to establish) a Facebook Messenger communication with the person who had blocked them.

The bug was active between May 29th and June 5th, and was caused when a small amount of data governing “associations” between users was deleted. When the data was restored, the issue went away on its own.

The number of impacted users may sound grim, but given the legions of people who use Facebook, it’s actually a drop in the bucket. Even so, Facebook’s response was immediate, decisive, and the company took actions to reassure its user base that the issue had been resolved and they would take steps to see that it did not happen again.

Nice words, but given the intense scrutiny Facebook has been under in recent months, blunders like this one only underscore that the company still has a lot of work to do where privacy is concerned.

LTE Networks May Be Vulnerable To Hacking

July 11, 2018 by Joseph Martin

Researchers from Ruhr-Universität Bochum and New York University in Abu Dhabi have discovered serious security flaws in 4G LTE networks that allow hackers to spy on, listen in on, intercept, and disrupt phone calls and text messages.

Given that billions of people rely on 4G LTE networks for cellphone communications, it’s a serious issue, and there are no easy fixes. So, don’t expect these flaws to be patched out of existence any time soon. Worse still, the planned 5G networks currently in development may well suffer from the same (or similar) flaws.

Based on their research, the team was able to develop a trio of new attacks that specifically target weaknesses in the 4G LTE architecture.

One of these, dubbed “aLTEr” is a DNS spoofing attack that allows a hacker to become the “man in the middle,” intercepting communications, and gives them the ability to spoof alerts, texts, and other messages.

All three of the attacks developed by the team take advantage of weaknesses found in “Layer Two” of the LTE network.

This is the data layer that rests atop the physical channel. Its function is to maintain wireless communication between users and the network itself, and has an organizational function that (among other things) manages how users access various resources on the network, helping to protect data via encryption and to correct errors in transmission. Obviously, a hack that can exploit this layer could be devastating indeed.

If there’s a silver lining, it lies in the fact that these three attacks are exotic. It would be difficult for a casual or even a fairly determined hacker to execute to any real effect. Unfortunately, it would be a much easier task for a state-sponsored group to pull off, and that’s the big fear here.

Hopefully, since 5G networks are still in the planning stages, something can be done before they’re rolled out to limit the effectiveness, or perhaps even negate these new types of attacks, but that remains to be seen.

Microsoft Edge Mobile Browser Blocks Android And iOS Ads

July 9, 2018 by Joseph Martin

As most people know, Microsoft Edge was the company’s “reboot.” After trying for years to patch and update their beleaguered Internet Explorer, Microsoft ultimately decided to scrap it and start fresh. Since Edge’s launch, it has struggled to gain traction with users.

Recently, Microsoft has upped the ante, at least where Edge for iOS and Android devices are concerned. A recent update sees the browser outfitted with a built-in ad blocker. Prior to the update, if you wanted an ad blocking solution, you’d have to download and install it separately. This move saves users a step, and gives you one less thing to think or worry about.

It’s a good move, but that alone is unlikely to give Edge the surge in popularity it needs to catch up with other browsers.

To provide some perspective, currently, Microsoft Edge is installed on about five million Android devices, based on stats from the Google Play Store. Contrast that with 100 million installs of Mozilla’s Firefox, and more than a billion Chrome installations.

Those are sobering numbers that underscore just how much ground Edge needs to cover to even be playing in the same league as other popular web browsers on mobile devices. While we don’t have statistics for installs from the Apple Store, it’s hard to imagine that they’d be any better, and, are probably a fair bit lower.

That’s not to say that Microsoft’s move wasn’t good, because it definitely was. Anything that a company can do to cut down the number of unwanted, annoying, and potentially dangerous ads is a very good thing. Odds are that the company’s recently move will be copied by the major players in the browser world. Even if it doesn’t boost Edge’s numbers much, that’s a win for anybody who uses the internet. Kudos to Microsoft for making the change.

Mobile Users Gain Privacy Protection In Supreme Court Ruling

July 7, 2018 by Joseph Martin

There’s some good news from a recent Supreme Court ruling where privacy is concerned, but take it with a grain of salt.

In a recent 5-4 decision, the Supreme Court ruled that law enforcement agencies must obtain a warrant before they can get access to data collected and stored on mobile devices. Of special significance, the court rejected the “third party rule,” which dates back to the 1970’s and asserts that any data collected by third-parties is automatically devoid of Constitutional protection.

The ruling is undeniably good news, and privacy advocates who have been watching the issue closely hail the decision as a victory for individual privacy. However, it should be noted that in the overwhelming majority of cases, “probable cause” is sufficient for most judges to grant a search warrant to law enforcement officials.

The reality is that probable cause is one of those “squishy” words that can mean wildly different things to different people. While it serves as a speed bump to accessing data on mobile devices, it’s a relatively modest one that’s unlikely to prevent many instances of law enforcement getting the information they need during the course of their investigations.

All that to say, it’s a good first step, but this ruling alone isn’t enough. So far, no national government anywhere in the world has been able to craft a set of sensible policies that adequately protect the privacy of individuals on the web. Corporations collect oceans of data on the consuming public, and increasingly, that data is packaged, resold and used for a variety of purposes.

While most of those purposes are fairly harmless and aimed more at marketing than anything else, other purposes border on or are abuses of the public’s trust. There are no easy fixes here, but kudos to the Supreme Court for taking an important first step.

Watch Out For Rise In Microsoft Office Attacks

July 6, 2018 by Joseph Martin

Menlo Security has recently published a new report that will probably dismay you if you’re a business owner.

Microsoft Office has been named as the attack vector of choice for hackers around the world. The most common form of the attack is a malicious Word document or other office document attached to an innocent looking email.

There are, of course, plenty of other ways to take advantage of various security weaknesses in MS Office and Office 365. These include the use of remotely hosted malicious components embedded within documents that deliver zero-day exploits when the document is opened.

The reason MS Office is such a wildly popular choice isn’t because it has an unusual number of security loopholes that can be exploited (although it’s certainly got its share). Rather, it has everything to do with the overwhelming popularity of the office suite. Simply put, lots of people use it on a regular basis, and that means the pool of potential victims is enormous.

As the report explains:

“There is likely to be an increase in attacks via malevolent email attachments using stealthily embedded, remotely hosted malicious components that leverage applications and operating system vulnerabilities, both old and new.

With CVE-2018-8174 and CVE-2018-5002, the attackers leveraged Word as a vector to exploit Adobe Flash Player and Internet Explorer. By using Word as the vector, the attackers were able to exploit a browser, even if it is not the default browser, and exploit Flash, even though Flash is blocked by most enterprises…Microsoft is therefore undoubtedly going to become the platform that attackers leverage most to deliver their zero-day exploits.”

All true, and beyond troubling. If your business uses Microsoft Office or Office 365 (and odds are excellent that it does), continued vigilance is the key.

New SSD Drive Can Hold 8TB of Storage

July 6, 2018 by Joseph Martin

Good news for the business world in general, and the owners of data centers, in particular.

Mass storage is about to get vastly more efficient thanks to Samsung’s recently launched solid state drive, which manages to pack an impressive 8TB of storage into a delightfully small footprint, measuring just 11cm x 3.05cm.

Not only do the new drives deliver twice the storage capacity of the SSDs used in high-end servers and slim line laptops, but it also has an impressive read speed of 3100 MB/s, and write speeds of 2000 MB/s. The read speed of the new drive is five times faster than the speeds you typically get from SATA SSDs, and the write speeds are three times faster.

When hyper-scaled, that means that enterprise server system could perform more than a million IOPS in a 2U rack space, and that translates into a significant ROI for large-scale data centers.

It gets even better. Samsung is planning to release a 512 gigabit version of its 3-bit V-NAND SSD later this year, which will allow significant improvements in processing speeds for big data applications.

What we’re talking about here, ultimately, is storage and processing density. The new SSD is built with 16 512GB NAND package, stacked in sixteen layers of 256 gigabit 3-bit V-NAND chips that were specifically engineered with massive SSDs in mind.

This allows data centers to triple total system density in the same footprint, and allows for a mind-boggling 576 terabytes of storage in 2U rack servers.

This is paradigm shifting and will make cloud-based service providers even more attractive. The most successful of these already have hyper-scale data centers in place, already have a wealth of experience when it comes to handling Very Large Data sets and experience dealing with applications designed to sift through those mountains of data. Enterprise users, rejoice!

Vulnerability In Mac OS Went Unnoticed For Years

July 5, 2018 by Joseph Martin

Researchers at Okta Security have stumbled across something big. Recently, they discovered a flaw in Apple’s OS that would have allowed hackers to completely undermine Apple’s code signing process.

While at first glance that doesn’t sound so bad, the implications are terrifying. In a nutshell, code signing uses cryptographic “signatures” to verify and validate code. If code bears the digital signature, it is considered trusted. If it’s trusted, then it’s given an automatic free pass, straight into the heart of any system.

Unfortunately, this flaw in Apple’s code signing process dates back more than a decade. It was only recently discovered, and purely by chance at that.

An extensive forensic analysis has turned up no evidence suggesting that this exploit was ever used for nefarious purposes, which is the one silver lining in all of this.

Upon discovering the flaw, Okta personnel reached out to Apple and other vendors who could have been impacted by the flaw, including tech giants like Google, Facebook and also smaller players like VirusTotal, Objective Development, Yelp, and Carbon Black.

Apple moved swiftly and has since fixed the issue, so this one can be considered a bullet dodged.

Josh Pitts, an Okta engineer, sums the issue up:

“Different types of tools and products use code signing to implement actionable security; this includes whitelisting, antivirus, incident response and threat hunting products. To undermine a code signing implementation for a major OS would break a core security construct that many depend on for day to day security operations.”

A completely fair assessment. Thankfully (at least in this particular case), although the issue was hiding in plain sight, it does not appear to have been exploited before being fixed. We won’t always be so lucky.