Blog – Page 26

iOS Adds New Restricted Mode In Latest Update

July 20, 2018 by Joseph Martin

Apple recently released an updated version of iOS, 11.4.1. They did so quietly, and without much fanfare, but the update includes one very powerful and exciting security update that’s deserving of special attention.

Specifically, the new version of iOS introduces what the company is calling “Restricted Mode.”

It was created to protect iPhones against USB devices used by law enforcement to crack your password and get around the encryption used to keep your data secure.

The new feature disables USB access after the phone has been locked for an hour instead of a week, which was the previously used convention.

To access the new, more secure mode, open your Settings app and look under the section labeled “Touch ID” (note: If you have an iPhone X, this will be labeled “Face ID.”) Here, you’ll find a new toggle switch for USB Accessories.

The default mode is to disable USB Accessories, so if you want them enabled, you’ll need to go into this section of Settings to manually turn it on.

This new feature, combined with the toggle switch that automatically erases all data on the phone after ten failed login attempts should serve as a powerful one-two punch that will make iPhones dramatically more secure.

Law enforcement officials have not weighed in on the recent change. This new feature coupled with the recent Supreme Court ruling that requires law enforcement agencies to obtain a warrant prior to attempting to pull data from a smartphone. It is probably not going to sit well. Even so, the change has already won high marks from privacy advocates around the world.

Given how little privacy there is left online, this has to be seen as a positive development, even if it complicates some law enforcement efforts. Kudos to Apple for the enhancement.

Adobe Releases Massive Update To Patch Its Products

July 19, 2018 by Joseph Martin

There’s a lot to like about the contents of Adobe’s most recent “Patch Tuesday” update. It’s well worth downloading and installing, even if you normally take a pass on all but the most critical updates.

Included in this release are security patches for 112 vulnerabilities across four different products, including:

Flash Player

Acrobat and Reader

Experience Manager

Adobe Connect

We’ve provided more details below:

Updates For Flash Player

The security update includes patches for both desktops and browsers, including a patch for one critical issue (CVE-2018-5007). This is a new, worrisome attack vector that exploits “type confusion”, allowing an attacker to execute commands on a targeted system in the context of the current user.

The company also patched a second issue, rated as “Important,” that would have allowed an attacker to access sensitive system information, but Adobe did not provide technical details about the flaw, for fear that hackers would attempt to find a way around the latest patch.

The flaw impacts Flash Player v. 30.0.0.113 and its earlier versions, and:

Window

macOS

Linux

Chrome OS

Google Chrome

Microsoft IE 11

Microsoft Edge

Updates For Acrobat & Reader

Acrobat and Reader were the recipients of the majority of the patches in this cycle, seeing 104 flaws dealt with, and 51 of them rated critical. These issues run the gamut of solving for critical heap overflows, use-after-free, type confusion, untrusted pointer dereference, and buffer error vulnerabilities. Many of these would have allowed hackers to execute commands in the context of the current user.

This update fixes errors in the following versions:

Continuous Track – 2018.011.20040 and earlier

Classic 2017 Track – 2017.011.30080 and earlier

Classic 2015 Track – 2015.006.30418 and earlier

On both Microsoft Windows and macOS.

Updates For Experience Manager

The latest release addresses three Server-Side Request Forgery vulnerabilities in Experience Manager, which is the company’s Enterprise CMS, versions 6.0 – 6.4, on all platforms.

Updates For Adobe Connect

Adobe has patched three security vulnerabilities here, two rated as important, and one rated as moderate, one of which is a privilege escalation issue caused by a library loading in an insecure manner. This patch is valid for Adobe Connect v.9.7.5 and earlier, for all platforms.

The company recommends all administrators and end users install this most recent update as soon as possible.

Facebook Messenger Getting Feature To Help With Fake Accounts

July 18, 2018 by Joseph Martin

It’s no secret that there are legions of scammers and spammers haunting the virtual halls of Facebook. As the world’s largest and most influential social networking site, it’s a natural target, making its masses of users natural targets, too.

Facebook is taking steps to counter the threat posed by these nefarious actors, after being somewhat slow to act initially.

This resulted in a series of Congressional hearings that saw CEO Zuckerberg in the hot seat earlier this year.

While the company has already taken many steps to help bolster the privacy and online safety of their users, their latest announcement is a much larger and more significant step in that direction. The company is currently testing a new feature embedded in Messenger. This is a feature that would identify suspicious accounts sending unwanted messages by informing the recipient of the account’s country of origin via phone number, and listing the date that the account was created.

In its simplest form, this approach has obvious advantages that will help reduce phishing and spam-oriented messages, but based on the screenshots the company published to highlight the new feature in action, it could also be used to detect and identify messages sent by agents whose intentions are to spread misinformation. For instance, users will be notified if they receive a message from an account that is tied to a Russian phone number.

The company is still reeling from the aftermath of Russia’s massive misinformation campaign, which used several social media channels, (but had a heavy presence on Facebook) in an effort to influence the outcome of the 2016 presidential election. To this day, the company is still actively suspending accounts linked to the Internet Research Agency, which is a propaganda outfit with direct ties to the Kremlin.

Whether you agree or disagree that Russia influenced (or attempted to influence) the presidential election, this is a very good move. Misinformation is a cancer. Anything we can do to stop its spread has to be counted as a good thing.

Open Database Exposes Info Of 340 Million People

July 17, 2018 by Joseph Martin

Internet security researcher Vinny Trola recently made a huge and disturbing discovery. A marketing firm called Exactis had left a massive database unsecured, allowing anyone who stumbled across it to access it.

As a marketing firm, Exactis collects simply mind-boggling amounts of data on consumers all over the globe.

The database in question was a staggering two terabytes in size, and contained more than 150 data fields. Social security numbers were not included in the exposed data.

A variety of personal identification was available, including:

Name

Political affiliation

Bank account details (including balances)

Information on other financial accounts, including stock holdings

Political affiliation

Donations to political causes

The number of children living in the person’s home

The ages of those children

In short, it’s more than enough personally identifiable information to make it a casual exercise for a determined hacker to link it back to a person’s social security number. Even if they didn’t want to jump through the hoops to do that, there’s still enough information in the massive data file that it could open the door to all manners of phishing and other scams.

Trola informed Exactis about the exposed database, and the company immediately took steps to secure it. However, it was sitting there completely unguarded and unsecured for more than two months, and there’s no telling how many people may have accessed the data inappropriately.

Exactis has no formal relationship with any of the people they collect data on, so they’re under no obligation to and are unlikely to inform the people in the database that their personal information was exposed. Given that, your best bet is to assume that you were mentioned in the database, and be on the alert for phishing and other scams in the months ahead.

Americans Want Local Governments To Spend More On Cyber Security

July 16, 2018 by Joseph Martin

While a significant percentage of Americans are suspicious of government spending beyond the essentials, there’s at least one notable exception, according to a recent survey conducted by SecurityFirst.

A majority (74 percent) of Americans want their local governments to spend more money on cybersecurity.

Here are a few of the highlights from the survey:

64 percent believe that a ransomware attack on local government installations could have serious, long-term impacts

Only 33 percent of respondents believe that their local governments are capable of keeping their data safe in the event of an attack

60 percent believe that a cyberattack could jeopardize essential services, and 77 percent fear that fallout from such an attack could hinder first responders

In terms of the biggest concerns of the citizenry, the data broke out as follows:

74 percent cited potential dangers to local utilities

68 percent cited potential dangers to our court system

68 percent cited potential dangers to local schools

Not long ago, the city of Atlanta suffered just such an attack, which cost them millions of dollars and erased several years’ worth of critical data. The city is still working to recover from the incident. It underscores the fact that the concerns brought to light by the survey are all too real, that citizens are right to worry, and they demand more from their local governments.

Unfortunately, in an age where government spending of any kind almost reflexively comes under intense scrutiny and debate, it remains to be seen whether this and similar surveys will provide any traction to the idea of greater government spending on cybersecurity.

If it does not, then we can expect to see more incidents like the unfortunate attack on Atlanta, with similar consequences. If the past is any indication, the survey will generate a few conversations, but not much in the way of action. Sadly, it will probably take a major attack that costs lives before we start getting serious about protecting local governments and critical infrastructure. Here’s hoping it doesn’t come to that.

Apps In Gmail Have Full Access To Read Your Emails

July 14, 2018 by Joseph Martin

File this one away under “watch your permissions.” It’s recently come to light that an unknown number of third party apps have access to read emails sitting in your Gmail account.

While the practice is not new, things like this are coming under increased scrutiny in the wake of Facebook’s Cambridge Analytica incident.

Here are the important details to bear in mind:

Apps that can read your email DO require explicit user permissions. You have to agree to allow these apps access to your Gmail account.

Once you do allow access, you’re giving both humans and computers access to not only read your messages but create new folders and even send emails out using your account. These details are generally buried in the fine print, and most users don’t realize exactly what they’re allowing when they accept.

Google has not made exact figures known, so it’s unclear exactly how many apps on the Play Store currently have this permission, nor is it known how many apps were denied in Google’s vetting process.

Currently, there are no known instances of a third party abusing Gmail permissions and doing anything inappropriate with the data they’re being given access to.

It’s not just Google. Most major free email providers have similar arrangements.

You can check your permissions via your smartphone and revoke access to any app that looks suspicious, or that you’re not comfortable giving that level of permission to. The downside, of course, is that revoking permissions will probably cause the app to stop working.

As ever, ensuring your privacy requires a proactive approach. It’s foolish to assume that a company (any company) will be as careful with your privacy as you would be personally. Be aware and stay vigilant. At the end of the day, that’s the best way to minimize intrusions to your privacy.

Shopped At Adidas Website? Your Info May Have Been Compromised

July 13, 2018 by Joseph Martin

Another week, another high-profile data breach. This time, Adidas and their online store was the target.

The company became aware of the incident on June 26th, and immediately began notifying “certain customers” that their data had been compromised.

The official statement from the company reads in part, as follows:

“Adidas is working with leading data security firms and law enforcement authorities to investigate the issue. According to the preliminary investigation, the limited data includes contact information, usernames and encrypted passwords. Adidas has no reason to believe that any credit card or fitness information of those consumers was impacted.”

At this time, it’s not known exactly how many users were impacted, but the estimates are in the millions. So if you have purchased anything from the Adidas website recently, you should assume that the data referenced above has been compromised.

The company has promised to release additional details as they become available, but for now, the following standard measures should be taken as a precaution:

If you have an account on the Adidas website, change your password immediately.

Although there’s no indication that credit card information was stolen, to be safe, it would be best to monitor the credit card you used to make your purchase for suspicious activity

Unfortunately, 2018 is probably going to be a record-breaking year in terms of high profile data breaches, just as 2017 broke all the records last year. The escalating number of breaches only underscores the point that in the ongoing battle between beleaguered IT staff and hackers around the world, the hackers seem to have the upper hand.

Part of the difficulty lies in the fact that it’s no longer enough to simply fortify your business network, because so much data is shared with so many third parties. All a hacker needs to do is to find and exploit a weakness in any of the systems managed by those third parties, and no matter how robust your own security, your data is suddenly at risk.

Sadly, it’s going to get a lot worse before it starts to get better.

Bug In Facebook May Have Unblocked People You Blocked

July 12, 2018 by Joseph Martin

Facebook recently announced a site bug that impacted the privacy settings of more than 800,000 of its users. If you’re one of the unfortunate souls who has been affected, then people you had formerly blocked may have become unblocked, and can now see your posts.

For many people, that’s not a huge deal. In some cases, say for example, if you blocked your ex-girlfriend, boyfriend, or wife and were impacted, they may be able to see things you don’t want them to.

Facebook’s official statement in response to the matter provided additional details and said that 83 percent of the people who were impacted only had one person on their blocked list temporarily unblocked, and that the situation had been remedied.

Of significance, the bug did not allow unblocked users to see content shared by friends of those who had blocked them, and it did not reinstate a “severed” friendship on the system. In some cases, however, someone who had been blocked may have been able to establish (or attempt to establish) a Facebook Messenger communication with the person who had blocked them.

The bug was active between May 29th and June 5th, and was caused when a small amount of data governing “associations” between users was deleted. When the data was restored, the issue went away on its own.

The number of impacted users may sound grim, but given the legions of people who use Facebook, it’s actually a drop in the bucket. Even so, Facebook’s response was immediate, decisive, and the company took actions to reassure its user base that the issue had been resolved and they would take steps to see that it did not happen again.

Nice words, but given the intense scrutiny Facebook has been under in recent months, blunders like this one only underscore that the company still has a lot of work to do where privacy is concerned.

LTE Networks May Be Vulnerable To Hacking

July 11, 2018 by Joseph Martin

Researchers from Ruhr-Universität Bochum and New York University in Abu Dhabi have discovered serious security flaws in 4G LTE networks that allow hackers to spy on, listen in on, intercept, and disrupt phone calls and text messages.

Given that billions of people rely on 4G LTE networks for cellphone communications, it’s a serious issue, and there are no easy fixes. So, don’t expect these flaws to be patched out of existence any time soon. Worse still, the planned 5G networks currently in development may well suffer from the same (or similar) flaws.

Based on their research, the team was able to develop a trio of new attacks that specifically target weaknesses in the 4G LTE architecture.

One of these, dubbed “aLTEr” is a DNS spoofing attack that allows a hacker to become the “man in the middle,” intercepting communications, and gives them the ability to spoof alerts, texts, and other messages.

All three of the attacks developed by the team take advantage of weaknesses found in “Layer Two” of the LTE network.

This is the data layer that rests atop the physical channel. Its function is to maintain wireless communication between users and the network itself, and has an organizational function that (among other things) manages how users access various resources on the network, helping to protect data via encryption and to correct errors in transmission. Obviously, a hack that can exploit this layer could be devastating indeed.

If there’s a silver lining, it lies in the fact that these three attacks are exotic. It would be difficult for a casual or even a fairly determined hacker to execute to any real effect. Unfortunately, it would be a much easier task for a state-sponsored group to pull off, and that’s the big fear here.

Hopefully, since 5G networks are still in the planning stages, something can be done before they’re rolled out to limit the effectiveness, or perhaps even negate these new types of attacks, but that remains to be seen.

Microsoft Edge Mobile Browser Blocks Android And iOS Ads

July 9, 2018 by Joseph Martin

As most people know, Microsoft Edge was the company’s “reboot.” After trying for years to patch and update their beleaguered Internet Explorer, Microsoft ultimately decided to scrap it and start fresh. Since Edge’s launch, it has struggled to gain traction with users.

Recently, Microsoft has upped the ante, at least where Edge for iOS and Android devices are concerned. A recent update sees the browser outfitted with a built-in ad blocker. Prior to the update, if you wanted an ad blocking solution, you’d have to download and install it separately. This move saves users a step, and gives you one less thing to think or worry about.

It’s a good move, but that alone is unlikely to give Edge the surge in popularity it needs to catch up with other browsers.

To provide some perspective, currently, Microsoft Edge is installed on about five million Android devices, based on stats from the Google Play Store. Contrast that with 100 million installs of Mozilla’s Firefox, and more than a billion Chrome installations.

Those are sobering numbers that underscore just how much ground Edge needs to cover to even be playing in the same league as other popular web browsers on mobile devices. While we don’t have statistics for installs from the Apple Store, it’s hard to imagine that they’d be any better, and, are probably a fair bit lower.

That’s not to say that Microsoft’s move wasn’t good, because it definitely was. Anything that a company can do to cut down the number of unwanted, annoying, and potentially dangerous ads is a very good thing. Odds are that the company’s recently move will be copied by the major players in the browser world. Even if it doesn’t boost Edge’s numbers much, that’s a win for anybody who uses the internet. Kudos to Microsoft for making the change.