Blog – Page 27

More Bad News From The Equifax Breach

June 2, 2018 by Joseph Martin

The news just keeps getting worse for Equifax. The company has already had to revise their estimates of how many people were impacted by last year’s breach more than once, and now, they’re having to revise their estimate yet again. This latest revision comes after company officials had to testify before Congress, which has been formally investigating the matter.

Prior to the release of Equifax’s latest “statement of record,” here’s a snapshot of how bad the data breach was:

5 million consumers had their Social Security numbers compromised

99 million consumers had address information exposed

3 million consumers had gender information exposed

3 million consumers had their phone numbers exposed

209,000 consumers had their credit card numbers exposed

97,500 consumers had their Tax Identification numbers exposed

Now, in addition to all of that, the company is adding the following:

6 million consumers had their driver’s license numbers exposed

12,000 had their Social Security and Taxpayer ID cards exposed

3200 consumers had their passports exposed

An additional 3000 had other documents, such as military and state ID’s compromised

As bad as it looks that the company has to keep revising their estimates upward, there’s a logical reason for it. The data that was stolen didn’t come from a single database. On top of that, the databases themselves all had highly variable structures, which has made it exceedingly difficult for forensic analysts to accurately assess the extent of the damage. All that to say, since the process is still ongoing, we may see yet another upward revision of the scope and scale of the breach.

Of course, the company is doing what most companies do in cases like these: They’re offering a year’s worth of free credit monitoring to impacted customers. The ironic part of their offer though, is the fact that Equifax is offering their own credit monitoring service free for a year, which converts to a paid monitoring service after the year is up. As Congressional officials rightly pointed out, this means that the company is essentially profiting off of its own breach, which is disturbing to say the least.

New Vulnerability May Expose Encrypted Emails

June 1, 2018 by Joseph Martin

Security researchers at the Electronic Frontier Foundation (EFF) have discovered a dangerous new email vulnerability called “Efail.” Exploiting this new email vulnerability would allow hackers to decrypt emails encrypted with either PGP or S/MIME – including emails that were sent several years earlier. Both of these encryption tools are commonly used by politicians, journalists and other professionals who need a secure means of electronic communication. Since the standards are so well established, they’re used widely and regarded as fool-proof. Sadly, that’s no longer the case.

EFF researchers had this to say about the newly discovered vulnerability:

“In a nutshell, Efail abuses active content of HTML emails (for example, externally loaded images or styles) to exfiltrate plaintext through requested URLs. The attacker changes an encrypted email in a particular way and sends this changed encrypted email to the victim. The victim’s email client decrypts the email and loads any external content, thus exfiltrating the plaintext to the attacker.”

In simpler terms, it’s about as bad as it could possibly get. Once a hacker has access to your email account, they can use the embedded HTML tags inside your mail to force your email system to decrypt those messages so the hackers can see exactly what they contain.

EFF’s recommendation is that if you rely on either PGP or S/MIME for email encryption, your best bet is to simply disable them, and uninstall the tool or tools used to decrypt those messages.

It should be noted however, that there are others in the security community who disagree with this assessment. A spokesman for ProtonMail tweeted out the following response:

“Efail is a prime example of irresponsible disclosure. There is no responsibility in hyping the store to @EFF and mainstream media and getting an irresponsible recommendation published (Disable PGP), ignoring the fact that many (Engimail, etc.) are already patched.”

Despite the divided opinion, if it’s something you’re concerned about, you can neatly side step the problem by simply opting for plain text messages, rather than using HTML-emails.

SSD Drive Makers Adding Features To Reduce Duplicate Data

May 31, 2018 by Joseph Martin

Big changes are in the works in the SSD-based storage ecosystem. It includes three different vendors all making similar announcements regarding designs to help companies that rely on SSD-based storage systems to reduce duplication and control data creep.

It’s not hard to see why they’re scrambling. Although the price of SSD-based storage systems are coming down, it’s a slow process. Currently, a gigabyte’s worth of SSD storage costs about forty cents, versus about five cents per gigabyte of HDD storage. Less data duplication means less data to store, making the SSD drives utilizing the new technology more efficient.

Here’s a quick overview of the solutions offered by the three major vendors in this space:

Hitachi – Hitachi is working to upgrade all-flash F-Series and its hybrid flash/hard disk G-Series of drives, as well as its SVOS operating system. The improvements to the operating system include new AI-based container and operations support and introduced a new feature in the form of the “Hitachi Infrastructure Analytics Advisor.” This provides real-time analysis of your data center optimization across all storage devices, networks, servers and virtual machines in a bit to more efficiently predict data center needs and optimize/troubleshoot data storage.

HPE – The company has upgraded their “Nimble” storage line, which includes an array of all-flash products, a hybrid disk-flash product line and a secondary flash line. The big change here is that the company’s products now support inline, variable block size deduplication. The company claims this change makes their products “the most efficient hybrid arrays in the industry by a wide margin.”

IBM – IBM has issued an upgrade to its Storwize arrays, the first in more than two years. The update improves cloud integration, overall disk performance and an array of enhanced deduplication tools, claiming as much as a 5:1 data reduction while retaining 100 percent data availability (provided you’re using IBM HyperSwap).

How big an impact these changes will have remains to be seen, but kudos to all three companies for taking decisive steps to bolster the performance of their storage devices.

Chili’s Is The Latest To Suffer A Credit Card Breach

May 30, 2018 by Joseph Martin

Brinker International (the parent company of the Chili’s restaurant chain) formally announced that on May 11, they discovered malware on an undisclosed number of their point of sales terminals. Details are sketchy at this point, because the investigation is still ongoing, but the company had the following to say about the incident:

“If you used your payment card at a Chili’s restaurant between March and April 2018, it does not mean you were affected by this incident. However, out of an abundance of caution, we recommend that you remain vigilant and consider taking one or more steps to avoid identity theft, obtain additional information, and protect your personal information.”

Among other things, the company is recommending that all customers who have dined at a Chili’s restaurant during the period when the malware was active should contact one of the national credit reporting agencies and set up a fraud alert or a security freeze. You should, of course, also closely monitor the payment card you used, to be sure that you recognize all of the charges hitting that particular payment card.

At this point, it is unknown exactly how many Chili’s locations were impacted, nor exactly how many customer records were compromised. It could be weeks, or even months before we have those details, so the company’s recommendation is a good one.

So far, Brinker’s handling of the aftermath of the issue has been exemplary, and based on that, we have every reason to expect that they’ll continue to handle well to its conclusion. The problem is that we keep seeing successful breaches like this because the hackers are changing their tactics more quickly than company IT resources can adapt and respond to. Until and unless that changes, we’ll be treated to more reports like this.

Your Kids’ Personal Info May Have Been Compromised

May 29, 2018 by Joseph Martin

An identity threat company called 4iQ has recently published a report called “Identities in the Wild: The Tsunami of Breached Identities Continues.” Unfortunately, the information in the report contains all bad news. Some of the details are simply confirmations of things we already knew, and some are shocking statistics that will leave you feeling dismayed.

For instance:

Cybercriminals and hackers are getting increasingly sophisticated – This isn’t new, but it’s even worse than that. While there are still a few “lone wolf” type hackers, organized syndicates are increasingly coming to the fore. Their collaboration with each other is accelerating the development of ever-more-advanced tactics. New threats are emerging at a much faster pace than data security personnel can respond.

Personal data breaches are now the second most common cybercrime on the planet, with corporate data breaches not far behind. The reason hackers are increasingly gravitating toward hacks of individuals has everything to do with the fact that most people have little to no security. It’s just low-hanging fruit. Corporate hacks are a bit more difficult, but as we’ve seen via the constant parade of headlines, these tend to be more far-reaching, with a scope and scale that can impact tens of millions of users, or more.

There has been a shocking 182 percent increase in the number of identities available on the Darknet belonging to children.

This last point is beyond disturbing. Bad enough that your own personal and confidential data is at risk, but now your kids are increasingly at risk too. Hackers are using their information to apply for credit cards, rent cars and hotels, and more.

In addition to the obvious dangers of hackers around the world knowing everything there is to know about your kids, it can also irreparably damage your kids’ credit, long before they ever have an opportunity to make use of it. A grim report that bears close reading.

Vega Stealer Malware Goes After Your Saved Credentials

May 29, 2018 by Joseph Martin

There’s a new security threat to be worried about, and security professionals are warning that it could be very bad indeed. The new malware is known as the “Vega Stealer,” and is currently being used in a relatively simplistic phishing campaign designed to harvest financial data that has been saved in both Google Chrome and Firefox browsers. Unfortunately, based on an analysis of the code, it could be a much more serious threat.

Vega Stealer isn’t 100 percent original work, but rather, is a variant of another nasty bit of malware known as “August Stealer.” Built on the .NET framework, it’s designed to ferret out and steal cryptocurrency wallets, passwords, cookies, saved credit cards, and more.

If your computer is infected, and you’re using Firefox, Vega Stealer will specifically target the files “key3.db” and “key4.db,” along with “cookies.sqlite” and “logins.json,” which store a variety of keys and passwords.

In addition to that though, it can also take screen captures of your PC and scan for, and steal any file with the following extensions:

.pdf

.xlsx

.xrft

.docx

.doc

Of course, it would be a trivial matter for the owners of the malware to expand this list even further.

As mentioned, the current campaign isn’t terribly sophisticated, relying on emails bearing titles like “Online Store Developer Required.” The emails being sent contain a poisoned file called “brief.doc” which contains macros designed to install the malware.

If the recipient clicks on the word doc, it will install a file named “ljoyoxu.pkzip” in that user’s “Music” directory, and then automatically executes the file so it can begin harvesting.

Researchers from Proofpoint, who found the malware strain had this to say:

“The document macro utilized in this campaign is a commodity macro that we believe is for sale and used by multiple actors, including the threat actor spreading Emotet banking Trojan. However, the URL pattern from which the macro retrieves the payload are the same as those used by an actor we are tracking who distributes the Ursnif banking Trojan, which often downloads secondary payloads such as Nymaim, Gootkit, or IcedID. As a result, we attribute this campaign to the same actor with medium confidence.”

Be on your guard.

Fitbit and Google Partnership May Raise Privacy Concerns

May 26, 2018 by Joseph Martin

Depending on which side of the privacy debate you’re on, you’re either going to love or hate this announcement:

“Fitbit intends to use Google’s new Cloud Healthcare API to help the company integrate further into the healthcare system, such as by connecting user data with electronic medical records.”

Rarely has a single sentence been so fraught with risk, while simultaneously promising such great opportunity.

On the plus side, the potential for innovation is virtually unlimited, and this new partnership will no doubt be a boon for the still-struggling wearables market. There are also potential increases in health care delivery efficiency, but the privacy concerns surrounding the issue are very real.

One has to only think back to the recent Allscripts fiasco, in which some 1,500 healthcare providers found themselves impacted by a nasty ransomware attack.

Google already collects copious amounts of data on its users, and with Fitbit angling to tap into healthcare records, the amount of private and personally identifiable information collected on users is bound to grow exponentially.

In addition to that, depending on exactly what data Fitbit attempts to link, it could very well make them a “business associate” from a HIPAA perspective. This can expose one or both companies to increased liabilities and vastly stricter standards on how the data can be used, and the steps that must be taken to safeguard it.

Right now, those details are very much in the air, and the issue could go either way. But there are some legal experts who believe that Google and Fitbit will be able to skirt the issue sufficiently so that they will not gain the “business associate” classification.

For Fitbit’s part, the company had this to say: “We have a longstanding commitment to privacy and data, and our data practices will continue to be governed by the Fitbit Privacy Policy. We are not sharing our user data with Google, we are partnering with Google to host Fitbit user data, similar to other cloud/hosting service providers. We take our obligation to safeguard users’ personal information very seriously and are committed to protecting the privacy and security of our users, while being transparent about our data practices.”

Comforting words, but they have done little to allay the concerns of privacy advocates, who see any number of negative outcomes associated with the new partnership. This is a debate that will no doubt be continuing for quite some time to come.

Hulu To Soon Offer Episode Downloading and Offline Streaming

May 25, 2018 by Joseph Martin

Hulu recently announced that it would join both Netflix and Amazon Prime in allowing its users to download content to watch offline, but in Hulu’s case, it comes with a twist.

If you subscribe to the $7.99 a month tier, in addition to downloading the content you want to watch, you’ll also be downloading the advertising associated with that content. It’s an important distinction because Hulu is structured quite differently from Netflix and Amazon Prime.

Much of Hulu’s programming is available on regular network television, and often airs the same day it does on the regular networks. Consequently, ads on Hulu tend to command more of a premium than ads on the other two companies.

Combine that with the fact that Hulu gets most of its revenue from advertising, and you begin to see the appeal and the necessity of such a strategy from Hulu’s perspective. Netflix and Amazon prime both have a deep bench of their own, unique programming which acts as a draw. However, Hulu is currently dependent on content licensed from others, which is why ad revenue is of utmost importance to them.

It should be noted that if you subscribe to the company’s $11.99/month plan, you can download ad-free content.

Either way, the ability to watch content offline is a big deal. This is especially important to frequent travelers who often find themselves in places with patchy internet service, or no connectivity at all. In those cases, having access to offline content can be a real godsend that can mean the difference between a tolerable trip and a miserable one.

Kudos to Hulu for joining the ranks of Amazon and Netflix, and although there have been a few grumblings about having to endure ads, it really is a small price to pay for the flexibility and convenience.

Lego and Alexa Team Up For Storytelling Through Device

May 24, 2018 by Joseph Martin

In terms of toys, what could possibly be better than LEGOS? How about LEGOS, combined with Alexa? That’s the latest idea from Amazon, who has paired the unlikely duo in a newly announced service called “LEGO Duplo Stories.” The new service (“skill,” in the parlance of Alexa) will be available on any device that offers Alexa support including Echo Dot and Amazon Echo. It provides a selection of stories with audio prompts that guide children in the construction of something with their LEGO Duplos that ties in with the story being told.

The stories are quite inventive, and change based on the responses of the children listening and interacting. For example, one story involves going on vacation via plane, and based on what the children say they want to pack, the vacation destination will be either to a warm or a cool place, with various build instructions being introduced along the way.

According to the company, the goal is to use these interactive stories as a means of developing color recognition, social, and cognitive skills.

It’s an innovative approach, and an excellent use for a technology that is becoming increasingly common in American homes. To access the stories, simply say “Alexa, open LEGO Duplo Stories,” then follow the prompts to begin the interactive experience.

Currently, the stories span ten different themes and work in tandem with existing Duplo sets. It should be noted that you can still interact with the skill even if you don’t own a set of LEGOS, or don’t have all the required pieces (although obviously this will make it even more interactive).

James Poulter, the Head of emerging Platforms and Partnerships at LEGO, had this to say about the new offering: “Voice is such a powerful tool for play as it is one of the most human ways of interacting. Long before we can type, read or control a device, we listen and speak.”

An exciting development, and it is available right now.

Firefox To Start Showing Ads On Tab Page

May 23, 2018 by Joseph Martin

Before Google released its Chrome browser, Firefox felt pretty good about their arrangement. They got a handsome reward in exchange for making Google.com their default search engine. It was a win-win.

These days though, Firefox’s position is a bit more precious. The Google deal is still the main source of the company’s income, but they’re also in direct competition with Chrome. If Google one day decides to pull the plug on the deal, the company could find itself in dire straits indeed.

That’s why they’ve been casting about for some means of expanding and diversifying their revenue, and the strategy they’ve hit on is advertising.

Don’t worry, you’re not about to be buried under a mountain of annoying ads, but with the release of Firefox 60, any time you open a new tab, you’ll see a listing of recommended links based on your browsing history.

Anytime the conversation turns to “recommended links” it naturally brings privacy concerns to the fore. After all, the only way Firefox can make sensible recommendations you’re likely to be interested in is to track your browsing habits.

Here though, the company has an innovative approach, because all the tracking happens on the client side, so Firefox doesn’t actually store anything. Although they will track how many of the “recommended links” you visit, so they can cull the list and remove any of the ones you don’t bother with, so they don’t keep reappearing.

On balance, it’s a good, even-handed approach that should solve the company’s revenue problems, while treading lightly on the good graces of their user base.

Like it or not, ads are an unavoidable consequence of the internet as it exists today. At the very least though, Firefox deserves credit for not making excessive use of them, and for respecting the privacy of its users by coming up with a non-intrusive method of deciding what links to display