Blog – Page 3

Spectre Security Built Into New Intel Chip Hardware

October 17, 2018 by Joseph Martin

By now, almost everyone has heard of the Spectre and Meltdown security flaws that have been making headlines for more than a year. They’re serious flaws with dire implications for tens of millions of users around the world who have an intel-based PC.

The saga surrounding the fixes for these issues has been a long one and filled with twists and turns. Intel originally attempted to push a software fix to protect its chips, but the patch they issued was so flawed that the company requested users not install it and wait for a better, more reliable patch.

In time, that patch was issued, but unfortunately, the protection it offered carried a hefty price in the form of significant system slowdowns.

The longer-term solution was, of course, to re-engineer the chips themselves. Recently, Intel announced that some of their 9th Generation chips will come with built-in fixes to ward against both Spectre and Meltdown. Note the word “some.”

Specifically, the company’s new line of K-series chips, used in gaming CPU’s have been re-engineered to be resistant to those security flaws. Unfortunately, the X-Series (Xeon-class chips) don’t feature those security fixes.

The reason is that they’re based on the older Skylake-X architecture, and given that, the company is relying solely on software updates to protect those chips.

At a recent desktop press event, the company had this to say about the matter:

“…the new desktop processors include protections for the security vulnerabilities commonly referred to as ‘Spectre,’ ‘Meltdown,’ and ‘L1TF.’ These protections include a combination off the hardware design changes we announced earlier this year as well as software and microcode updates.”

Although Intel has been roundly criticized for its handling of the issues surrounding these flaws, this is undeniably a step in the right direction.

Major Facebook Breach May Have Affected Your Account

October 16, 2018 by Joseph Martin

Facebook got hit hard by a currently unknown group of hackers. If you recently found yourself inexplicably logged out of the social media site, Facebook did it in response to the breach.

The breach resulted in the theft of data pertaining to more than fifty million of the site’s users.

Here’s what we know so far about the attack:

The hackers pulled off their heist by taking advantage of three different vulnerabilities.

Facebook detected the breach after spotting an unusual spike in traffic.

Your password has not been compromised, but unfortunately, the hackers don’t need it.

The hackers stole more than fifty million access tokens. These tokens can be used to take over Facebook accounts without passwords, even if you have two-factor authentication enabled.

If you were in the compromised group, the hackers have every scrap of personal information you’ve entered into the social media site.

If you use the “Logged in as Facebook” feature on other websites, those accounts are also at risk. The hackers can use the stolen tokens to access any site you log into with your Facebook credentials.

The reason you got logged out was because Facebook reset access tokens for everyone they suspected may have had their data stolen.

To find out if you’ve been hacked, you can check “Active Sessions” on Facebook. If you see an unknown IP address, or a location in some other country, that’s a sure sign that you’ve been hacked.

This breach is not connected in any way to the hacker who pledged to delete Mark Zuckerberg’s personal Facebook page.

In addition to that, you should know that Facebook is now facing a class-action lawsuit over the hack. The suit alleges that the company failed to protect their personal data from falling into the wrong hands due to the company’s lack of proper security practices.

While the vulnerabilities have been fixed, the class-action lawsuit has a good chance of succeeding. The investigation is still in its early stages, and there may be updates to this story as we learn more.

Apple IOS12 Users’ Photos And Contacts May Be Vulnerable

October 13, 2018 by Joseph Martin

Jose Rodriguez, a Spanish Apple enthusiast, has discovered a new security flaw to be aware of. He posted a Proof of Concept video showing the exploit in action.

We’ll say upfront that this is a highly convoluted attack involving more than two dozen discrete steps. A hacker would need to be in possession of the phone to pull it off, so it’s not something that’s likely to become a major threat.

Even so, we’ll provide the details below.

Apple has built in security measures that are designed to prevent someone from tricking Siri into allowing unauthorized access to the phone. Unfortunately, by using a complex series of steps involving both Siri and Apple’s Notes application, it’s possible for a hacker to bypass those security measures, access images stored on the phone, and then change the image associated with a contact or the owner of the phone.

This method is effective on both iOS12 and the iOS 12.1 beta, which means that Apple’s recent patch to their OS does not and will not prevent this exploit from working. Worse, the company has yet to comment on the matter, so at this point, there’s no timetable for a fix.

The independent news site Threatpost has been able to replicate the attack, so we have third-party confirmation.

Fortunately, there’s a simple way to negate the attack entirely while we’re waiting for a patch to close the loophole once and for all. Simply go to Settings – Face ID & Passcode – Touch ID & Passcode, and disable the “Allow access when locked” option for Siri.

Again, it’s important to reiterate that this is a highly complex attack that involves having both physical access to the device and more than two dozen steps, so this is not an issue that’s likely to be widespread. Even so, it pays to take precautions until Apple can roll out a fix.

Microsoft Is Changing How Searches Will Work

October 11, 2018 by Joseph Martin

Change is coming to the way Microsoft handles search across its ecosystem. If you use the home edition of Office, you’re not likely to notice, but if you use Office 365, the changes will be significant.

Here’s what’s happening:

First of all, the search bar will get bigger, taking a more prominent and visible place on your screen’s real estate.

Second, anywhere the company utilizes a search box (from their Bing search engine, to the OS itself, to Teams, Office and more), the plan is to provide a unified and consistent look that is intended to improve the overall user experience.

The box itself is getting a makeover and will soon start offering suggestions based on your previous search behaviors. For instance, it may present you with a list of frequently used email contacts or documents that you’ve recently edited, with the list updating dynamically as you begin typing a term into the search field.

In addition to that, you’ll soon be able to search for commands within a given application, so instead of hunting around on the menu bar for the function you’re looking for, the search box will take you right to it, showing it among the search results.

If you’re signed into your Office 365 account, the search results will also include any documents you have saved in OneDrive or SharePoint and relevant conversations in Yammer and Teams if you use those. It also may feature contacts from your company directory.

Most significantly, since the Bing search engine is itself a search box, those results will be displayed alongside relevant webpages.

If you’re curious to see it in action, it is currently available today as an opt-in beta/preview mode for corporate users. It’s also available in both Outlook and SharePoint mobile apps. The general public will be able to see it in action as soon as the second quarter of 2019, when the new functionality will be expended to Office Home, Office Desktop and Windows 10 itself.

Google May Be Getting Rid Of Google Plus

October 11, 2018 by Joseph Martin

If you’re one of the relatively few people who use Google+ in something other than an Enterprise setting, be advised that the clock is ticking. Google has just announced that they’re sunsetting the service. It will be going offline for consumers at some point over the next ten months.

The reasons for their decision are complex. In part, it stems from the fact that the company readily acknowledges that it has “low usage and engagement,” which is underscored by the fact that 90 percent of Google+ user sessions last less than five seconds.

Another major component driving the decision is that the company suffered serious pushback when it revealed a previously undisclosed security flaw that exposed users’ profile data. The company patched the issue in March of this year (2018), but the company’s long delay in going public with the flaw didn’t sit well with Google+’s user base.

Note that the company plans to continue offering Google+ for Enterprise customers to facilitate intra- and inter-company communications. In fact, they plan to roll out a raft of new features in the year ahead.

Google also recently announced other changes. Pending API changes, one new feature will limit developers’ access to data on Android devices and user Gmail accounts. Also, contact interaction data will soon be off limits, as will call logs and SMS permissions.

There are changes coming to Gmail itself as well, where developers will be sorely limited in how much access they have to user emails.

As Ben Smith (the company’s VP of engineering) explains, “Only apps directly enhancing email functionality–such as email clients, email backup services and productivity services (e.g., CRM and mail merge services)–will be authorized to access this data.”

Any developer who currently has this level of access can expect a security assessment and agree to the company’s new rules. We’ll provide more details as they become available, but broadly speaking, these are good changes that will enhance data security for the company’s legions of users.

Payment Pages Are Being Compromised To Steal Data

October 10, 2018 by Joseph Martin

Symantec’s most recent statistics have revealed a disturbing trend. Malware designed to compromise checkout pages is seeing a big spike in use, with the company reporting a staggering 248,000 attempts since August 13th of this year, with more than a third of them (36 percent) between September 13th through September 20th. As disturbing as those numbers are, that’s just the tip of the iceberg.

As Symantec notes on their website:

“If we compare the week of September 13 to 20 to the same week in August, the number of instances of formjacking attacks blocked by Symantec more than doubled, jumping from just over 41,000 to almost 88.500 – a percentage increase of 117 percent.”

Leading the surge is a particularly nasty strain of malware known as “Magecart.” Magecart campaigns are quite robust that begin by breaching the target website, then injecting malicious scripts into it that are designed to scrape card details and other customer information provided during the checkout process. This is an attack that’s alternately known as formjacking, payment card scraping, and web-based skimming.

Symantec isn’t the only company to take note of the trend. RiskIQ has been sink holing domains associated with Magecart infrastructure for much of the month and alerting companies compromised by Magecart attacks as they find them.

Kevin Beaumont, an independent security researcher, had this to say via Twitter :

“#TrackingMagecart I’ve updated the IoCs to double the number of domains, now tracking over 1000 objects – some of the domains have now been sink holed. Recommend InfoSec vendors block/flag domains.”

Magecart isn’t new. Security researchers have been tracking it since 2015, and independent researcher Willem de Groot has created a malware scanning website called MageReport, which allows business owners to check to see if their Magento-based webshop is vulnerable to this type of attack. If you think you might be, it certainly bears making use of.

At present, the one thing that’s not known is the reason behind the sudden spike. Only that it’s happening.

How Long Before You Experience A Cyber Attack?

October 9, 2018 by Joseph Martin

According to this year’s Traveler’s Risk Index, published by The Traveler’s Indemnity Company, a majority of business owners have a somewhat fatalistic view of hacking and data breaches.

The index includes 52 percent of survey respondents indicating that they believe a cyber-attack is inevitable.

The other statistics in the report paint a grim picture. Here’s a quick overview:

55 percent of business owners say that they have not completed a cyber risk assessment

63 percent say that they have not yet completed a cyber risk assessment on vendors who have access to their data

62 percent indicate that they have not yet developed any kind of business continuity plan, which means they don’t even have the basic outline of the steps they’ll need to take in the face of a successful attack against their company

The number of survey participants saying they have been the victim of a cyber attack has doubled from 10 percent in 2015 to 20 percent in this year’s survey

Yet in spite of this staggering lack of preparation, fully half of all survey respondents say they have cyber insurance.

Tim Francis, the Enterprise Cyber-Lead at Travelers, had this to say about the report:

“Cyber risks carry serious consequences for any business, threatening everything from revenue to operations. These findings reveal some surprising things about how companies view their cyber exposure, their relative confidence in dealing with them and the clear opportunity that exists for them to be better prepared for a cyber-attack.”

It’s a thorny problem, for sure. Most small to medium sized business are strapped for cash and simply can’t dedicate the level of resources they’d like to toward data security.

The good news is that this most recent survey reveals a few simple, low-cost things you could do starting today that would dramatically improve your chances of dealing with a cyber-attack. Given that most people agree it’s inevitable and just a matter of time, that would be an excellent place to start.

Firefox Adds Data Breach Monitoring Service

October 6, 2018 by Joseph Martin

Firefox is upping the ante where digital security is concerned, having just announced the release of a new, free service called ‘Firefox Monitor.’ The new service is designed with one specific goal in mind: To assist users in finding out if their accounts were exposed via a data breach.

It was developed in partnership with Troy Hunt, whose website, “Have I Been Pwned” is one of the most popular destinations on the web for security-minded individuals. This website, in fact, is the driving force behind Mozilla’s new service.

People will be able to engage with the service in two different ways. First, by making a direct inquiry to check the status of their various accounts, passwords, and email addresses that may have been compromised. Or second, by configuring the new subsystem to notify them when their information has been detected by the system.

Nick Nguyen, of Mozilla, had this to say about the new feature:

“It can be hard to keep track of when your information has been stolen, so we’re going to help by launching Firefox Monitor, a free service that notifies people when they’ve been part of a data breach. After testing this summer, the results and positive attention gave us the confidence we needed to know this was a feature we wanted to give to all of our users.”

If you find out via active polling or receive a notification that one of your accounts was compromised, you should take action immediately. You should change the password and audit the account to address instances where you may have used the same password associated with the compromised account in order to minimize your risks.

This is great news, and a fantastic addition by Mozilla. While it’s not a magic bullet that will solve all your security woes, it should help give users greater peace of mind, and it puts a powerful new tool in their hands to monitor the integrity of their own accounts. Kudos to Mozilla!

Windows 10 Adoption Continues To Grow

October 5, 2018 by Joseph Martin

Windows 10 is far and away the fastest growing version of the OS in the company’s history. It recently hit an installation base of a staggering 700 million devices after about three years on the market.

Note that these installation figures include installs not just on PCs, but also on Surface Hubs, Xbox, HoloLenses and smartphones.

Unfortunately, as impressive as that number is, it falls well short of Microsoft’s original estimate of a billion installs in three years.

The smaller than expected number of smartphone installations is the key reason behind the shortfall. Initially, the company had envisioned these devices adding several hundred million installations to the total count. However, when Microsoft switched gears and decided to abandon the smartphone market, it was inevitable that they would fall well short of their original target.

It matters because part of Microsoft’s pitch to developers was the massive (projected) size of the Windows 10 market. Now that the official numbers are in, and the final count is some 30 percent lower than anticipated, part of that appeal is understandably gone.

Even so, a market made up of 700 million devices is certainly nothing to sneeze at and developers are heavily invested in the platform, so it would make little sense for them to abandon it now. Not to mention the fact that the number of installations is expected to continue to grow at a healthy clip for the foreseeable future.

Inside the Windows ecosystem, 43 percent of Windows PCs are currently running Windows 10, with another 45 percent still running Windows 7. Given that support has officially ended for Windows 7, it’s all but guaranteed that Windows 10 will ultimately reach one billion installations. It will probably reach a bit more than that as users continue to slowly migrate away from Windows 7.

At the end of the day then, although Microsoft’s time frame was a bit too aggressive, it looks like they’re going to hit the magic number.

Government Payment Processor Exposes Data On Millions Of Americans

October 4, 2018 by Joseph Martin

If you use the GovPayNet portal, be advised that your personal information is currently at risk. Although at this point, there’s no indication that any hacker has made use of it. The portal is run by Government Payment Service, and is used by many Americans to pay fines, fees and bills generated by more than two thousand different government agencies operating in 35 states.

Unfortunately, the way the website is configured, when it issues a receipt for a payment, it numbers those receipts sequentially. All a hacker would have to do would be to change the receipt number in the URL to see any previous receipts, and all of the information it contains.

When the flaw was discovered by journalist Brian Krebs, more than fourteen million old records were exposed in this manner. He contacted Government Payment Service to inform them of the flaw, and the agency moved quickly to address the issue. They said in a formal statement that they “did not adequately restrict access to only authorized recipients.”

They went on to assure their users that there’s no indication that any data had been improperly accessed. They added that the receipts generated don’t include any information that could be used by a hacker to initiate any type of financial transaction.

Unfortunately, the reality was a bit different. The receipts contain the names, addresses and phone numbers of the person paying the fee in question, along with the last four digits of whatever credit or debit card was used to make payment. That is more than enough information to enable a hacker to initiate a phishing attack to get the rest.

Nick Bilorgoskiy of Juniper Networks had this to say about the matter:

“Online payment providers…should take special care to protect their customers’ receipts by using HTTPS and checking that the user is logged in and has permissions to view them. To avoid information disclosure and directory traversal issues, I also recommend denying anonymous web visitors the ability to read permissions for any unnecessary files from web-accessible directories.”

It’s good advice, and here’s hoping that Government Payment Service will take it. If you use the service, there’s nothing for you to do. You don’t need to change your password, since it was never exposed. Just be mindful that someone may have seen any data your receipts contain before the site was secured.