Blog – Page 30

T-Mobile And Sprint To Merge Companies

May 16, 2018 by Joseph Martin

The on-again, off-again talks about a merger between T-Mobile and Sprint is definitely back on, with T-Mobile planning to buy Sprint for a staggering $26 billion.

The deal has been in the works since before Trump was elected President. It died quietly when it became clear that the Obama administration would not allow the deal to go forward, due to concerns that it would leave the US with only three telecom providers, which could harm consumers.

The Trump administration has made it clear that they applaud the move. However, Trump’s Justice Department may be a significant hurdle to clear. Nonetheless, as things stand now, the deal is steaming ahead and the combined company would have a whopping 127+ million customers, putting it not far behind AT&T’s 141.6 million and Verizon Wireless’ 150.5 million customers. T-Mobile’s CEO John Legere would lead the new, larger company.

John had this to say about the planned merger:

“This combination will create a fierce competitor with the network scale to deliver more for consumers and businesses in the form of lower prices, more innovation, and second-to-none network experience – and do it all so much faster than either company could on its own.”

The underlying argument in favor of the merger is that the US is falling behind in terms of network speed. If there is to be any hope of arriving first at a nationwide 5G network, we need bigger, stronger and more robust competitors.

As history shows us clearly though, the regulators of the previous administration have valid concerns about the monopolization of the industry. Any time there are fewer competitors on the board, regardless of the industry, consumers invariably get hit with higher prices. There’s no reason to believe this merger will lead to a different outcome.

Regardless, it now appears that the merger is likely to happen.

Some VW and Audi Cars May Be Hacked Through WiFi

May 15, 2018 by Joseph Martin

Thanks to researchers Daan Keuper and Thijs Alkemade (who work at the Dutch cyber-security firm Computest), newly produced Golf GTE and Audi A3 vehicles are a little bit safer, and a lot less vulnerable to remote hacks.

The duo found that by taking advantage of these vehicles’ WiFi connection, they could access the cars’ IVI, (in-vehicle infotainment system) and from there, gain access to other systems as well.

The researchers had this to say about their work:

“Under certain conditions, attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and conversation history. Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time.”

It gets worse though. Once the researchers had gained access to these systems, they found they could also access the car’s braking and acceleration systems. They stopped short of performing exploits on these for fear of violating Volkswagen’s intellectual property rights. A hacker, however, would not hesitate to do so.

Worse still, the company apparently had no idea there was a problem. In fact, when the researchers presented their findings, they discovered that the company had deployed the IVI system completely untested.

Since bringing the issue to the company’s attention, they have addressed the issue. However, the fix only applies to newly manufactured vehicles. If you purchased either of the models listed above prior to June 2016, your vehicle has not received the fix, and will not get fixed unless you take it back to the dealership. There’s no way for the company to remotely install it. That means there are untold thousands of cars on the road right now that are vulnerable.

Use Caution Traveling, Hackers Now Have Keys To Hotel Rooms

May 14, 2018 by Joseph Martin

Score one for the good guys, but with hesitation. Unfortunately, in today’s fast-moving digital world, even a victory doesn’t mean the end of a problem.

Recently, a pair of researchers (Tomi Tuominen and Timo Hirvonen of F-Secure) released information about a new hack they had discovered. It takes advantage of a critical security flaw in the magnetic VingCard locking systems used in hotel chains around the world.

This particular system produced by Assa Abloy is deployed in more than 42,000 facilities around the world. So in terms of scope and scale, this flaw impacts literally millions of doors.

The security flaw is about as bad as it gets, too. The duo found a way that hackers could turn an old, dead RFID key card into a master key that could be used to unlock any VingCard door. Although the software they used to create the master key card is proprietary, any hacker worth his salt and with a couple hundred dollars to spare for equipment could reproduce the hack on their own, if given time.

Fortunately, long before the pair announced their discovery of the hack, they contacted Assa Abloy privately. They have been working with the company’s R&D department to develop a fix for the security flaw. That fix has now been deployed, and the researchers stress that so far, there is no evidence that the exploit has ever been used in the wild.

Of course, that doesn’t mean that it couldn’t be used, and just because Assa Abloy has released a fix for the flaw doesn’t mean that everyone will promptly install it. So, the risk is still very real. If you’re a frequent traveler, take extra precautions and don’t leave your valuables in plain sight in your room. They may be more vulnerable than you realize.

Apple Will Officially No Longer Sell Routers

May 12, 2018 by Joseph Martin

After more than two decades in the business, Apple is officially going to stop selling routers. The writing has been on the wall for a while now, since the company’s “AirPort” family of products hasn’t received a significant update in more than five years.

When Apple first introduced its AirPort product line, wireless computing was still something of a rarity, and Apple’s offerings were ahead of their time. In the years between then and now though, the market has changed significantly. Unfortunately, Apple’s product line never really changed with it.

These days the competition is fierce with industry giants like Google and Linksys both offering great options for power users. With the rise of mesh networks, the AirPort product line has fallen increasingly behind the times.

The company announced that it would sell its existing AirPort product inventory and support its current user base for the time being, but after that, it would quietly fade away. The company has simply moved on and has redirected its efforts toward other initiatives.

In looking at the broader market, it’s not a huge blow. Of course, if you own and use an AirPort product, now is the time to begin casting about for alternatives. The clock is ticking, and once Apple sheds its existing inventory, we can expect to get an end of support date from them. This will leave any AirPort products still in operation at that point increasingly vulnerable to a variety of hacks.

Even so, given how ubiquitous wireless networking is these days, and how many powerful options are out there, finding a replacement for your AirPort product shouldn’t present too much of a challenge. Just make sure your IT staff knows that the end is nigh, so they can get a replacement in place before the clock runs out.

Hackers Can Use PDF Files To Access Windows Credentials

May 11, 2018 by Joseph Martin

Security researcher Assaf Baharav from Check Point Security has discovered a new twist on an old, fairly well-known attack. He was able to essentially “weaponize” PDFs to steal Windows credentials stored in NTLM hashes. Unfortunately, no action other than simply opening the PDF is required for the hacker to gain access to the information.

Baharav used the same methodology that hackers have used in the past, which amounts to instantiating SMB requests from inside the document. Hackers have already performed these types of attacks from inside web browsers, Windows shortcut files, shared folders, Microsoft Office documents, and Microsoft outlook. Using a PDF to run the exploit is something new.

Baharav had this to say about his research:

“We chose to test these two high profile readers (Adobe Acrobat and the FoxIT reader). Regarding the others, we highly suspect they may be vulnerable as well. We followed a 90 days disclosure policy by notifying only Adobe and Foxit regarding the issues.”

Foxit did not respond to the information Baharav sent, but Adobe did. Unfortunately, their response was not encouraging. They simply announced that they had no plans to address the issue, deferring to Windows OS-level mitigations (reference Microsoft Security Advisory ADV170014).

Microsoft released this advisory to provide instructions on how to disable the NTLM SSO authentication inside the Windows operating system. This is a workable solution, but it has problems.

For starters, it’s not really a patch, but rather the modification of a specific registry key and then the implementation of a network isolation policy. Worse, it’s only applicable to Windows 10 and Windows Server 2016 machines. People who have older systems are simply left vulnerable.

Be on the alert then PDFs can now be used to steal credentials. It appears that every reader is affected and that no help is coming for older systems.

WiFi Sync on iOS Vulnerable To TrustJacking

May 10, 2018 by Joseph Martin

Owners of Apple devices have a new attack vector to worry about, called “TrustJacking.” Symantec researchers recently stumbled across a pair of scenarios that take advantage of Wi-Fi syncing of various Apple devices. These are scenarios that also take advantage of the trust users have in the security of their own devices, allowing hackers to take complete control over those devices.

The flaw is a consequence of the way that iTunes Wi-Fi Sync is designed. The vulnerability manifests when a device is connected and the user selects the “sync” feature. This creates an opening which could potentially allow a hacker to take complete control over the device.

The first issue manifests like this: With the “sync” setting enabled, the device owner has access to both that device and a paired iPhone over a wireless connection, even after the device is disconnected from the syncing service. That sets up part one.

Part two of the first scenario requires a bit of social engineering, where a hacker tries to trick the device owner to click on a malicious link that will install malware of the hacker’s choosing on the vulnerable system.

The second part of the second scenario targets users who are traveling. A hacker could take control of a free airport charging station. In order to make use of those free charging stations, users are required to trust the device. As soon as that happens, the hacker controlling the charging station can remotely issue a command to connect to iTunes, and then enable the sync command.

Once those two steps are completed, even when the victim disconnects from the charging station, the hacker can still access the compromised device remotely, gaining access to most (if not all) of the user’s private information.

Unlike similar, recently discovered vulnerabilities in Apple products, this one distinguishes itself by allowing the hacker permanent access to the device, making it a dangerous vulnerability indeed.

New Malware Takes Screenshots and Steals Your Passwords

May 8, 2018 by Joseph Martin

Recently, a new strain of malware called “SquirtDanger” has been found by researchers at Palo Alto Networks Unit 42, and it’s a particularly nasty one for a couple of reasons. First and foremost, the owner of the malware isn’t orchestrating campaigns himself, but rather, selling his product as a commodity on the Dark Web.

That has troubling implications because the malware is quite advanced, and since it’s being sold to a broad cross-section of hackers, odds are excellent that it will be used in numerous campaigns that could affect a number of industries.

As for the software itself, it gives the hackers who purchase it a vast array of tools. It communicates back to its controller every minute, giving the hackers who use the malware a tremendous amount of useable data.

Among other things, SquirtDanger can take live-action screen shots of an infected device, steal passwords, and send, receive, or delete files on the target system. It can also swipe directory information and drain the contents of cryptocurrency wallets, making it something of a “Jack-of-All-Trades” malware.

Also, there’s no single attack vector being used to infect machines with SquirtDanger. According to the research team, the most common means of infection is that the malware is disguised as a piece of legitimate software and installs when the poisoned executable file is run.

Researchers from Unit 42 had this to say on the matter: “Being infected with any type of malware represents significant danger to an individual or victim. However, because of the large list of capabilities this malware family includes, it would certainly be very bad for the victim.”

At latest count, the researchers have discovered 1,277 unique SquirtDanger samples in the wild, tied to 119 unique command and control servers that were widely geographically dispersed. Odds are, there are many more samples that have yet to be discovered. Be on your guard, it doesn’t appear that this threat will abate anytime soon.

Are Lasers The Answer To Completely Wireless Computing And Charging?

May 7, 2018 by Joseph Martin

Researchers at the University of Washington just might change the face of computers and computing forever. It may seem like the stuff of science fiction, but based on their research, the day may soon be coming when computing devices are completely un-tethered, requiring no wires for either power or recharging.

The team was able to successfully charge a smartphone from across a room using nothing more than lasers. Right now, their approach has an effective range of about forty feet. Devices are detected by way of acoustic “chirps” which occur below the threshold of human hearing. Once a target device is located, the laser charging system sends power to them using laser light, with no damage to the target device.

Right now, the power transfer is limited to just a couple of watts. However, the researchers don’t see any obstacles that would prevent scaling of the power transfer, meaning it could easily be modified to power PCs.

Wireless Power Transfer (WPT) is not a new idea. In fact, it’s in use today in such things as smartphones and electric toothbrushes. The problem, at least until now, has been a matter of range, which has been virtually nonexistent until the University’s game-changing experiments.

The big breakthrough wasn’t in sending power to a device via laser. Scientists have known that was possible for quite some time. The issue though, was that when lasers (or microwaves) were used to send power, they were invariably hazardous to humans in the area. In addition, they often fried the electronics they were attempting to power. The research team seems to have solved for both of those problems.

While the technology is still quite some distance from being commercially available, this is a huge leap forward. This could forever change the way we interact with our computing devices, and that change could come much sooner than anyone ever imagined.

Bank Employee Steals Info On Over A Million Customers

May 5, 2018 by Joseph Martin

Atlanta-based SunTrust Bank is the 12th largest bank in the US. They have a major problem, and so do roughly a million and a half of its customers. According to CEO William Rogers, an unidentified employee of the firm printed a vast amount of private customer information, including their names, addresses, phone numbers and account balance information.

Rogers stressed that social security numbers, account numbers, driver’s license numbers, user IDs, and passwords were not exposed. In a recent press release, he had the following to say:

“In conjunction with law enforcement, we discovered that a former employee while employed at SunTrust may have attempted to print information on approximately 1.5 million clients and share this information with a criminal third party.

We and third parties have done forensic analysis on these accounts and we have not identified significant fraudulent activity regarding the effect of the accounts.”

Even so, this is a blow to the company’s image, and the lost trust won’t be easily regained. It also underscores how vulnerable companies are to internal threats.

In response to the attack, SunTrust is offering ongoing IDnotify identity protection (offered through Experian) to all its current and new clients at no cost.

The company’s handling of the issue so far has been about as good as can be expected. The unfortunate reality is that there aren’t many good ways of stopping a rogue employee from making off with sensitive customer data or proprietary company information. Better auditing protocols and controls can help, but only to a certain extent. While those kinds of policies make it easier to detect when an internal theft has occurred, they do nothing to actually prevent them.

This puts management in a tricky spot. Employees have to be trusted with sensitive data in order to do their work, which also increases risk. There aren’t many good solutions here beyond better vetting of employees, but of course, that is by no means a magic bullet either.

Apple Recall Affects Some Macbook Pro Batteries

May 4, 2018 by Joseph Martin

If you recently bought a 13-inch MacBook Pro (without a Touch Bar), you’ll want to head to Apple’s website. The company didn’t make a big announcement, but they’ve quietly introduced a battery replacement program that impacted what the company described as a “limited number” of laptops.

The company didn’t provide many details, but apparently, on certain machines an unknown component failure can cause the built-in battery to swell. There’s no danger of an explosion and no fire hazard associated with the failure, but the company is playing it safe and offering to replace the batteries on any affected laptop, free of charge.

According to details on Apple’s website, the laptops in question were manufactured between October 2016 and October 2017. If you visit the webpage, you can enter your machine’s serial number to see if your machine is affected, and thus eligible for the free replacement.

At this time, it’s unclear precisely how many machines this issue has impacted. But clearly, Apple wants to put this issue to rest as quickly as possible.

Battery swelling is a strange symptom, but surprisingly, this is not the first time Apple products have suffered from similar issues. Not long ago, Apple’s 42mm Smart Watches suffered a similar problem, prompting the company to issue a similar recall. The company also recently extended their warranty on first-gen Apple Watch models by two years, offering free battery replacements for up to three years after the date of purchase.

These recent moves have caused iPhone owners to cry foul. On the heels of the Apple “Throttling” drama last year, the company offered a discounted battery replacement program to help bring older iPhones with failing batteries back to full speed. While Apple’s $29 discounted battery price is a significant savings over the regular price of $79, some users argue that the batteries should have been free for these products as well.