Blog – Page 31

Facebook Is Adding New Features, Including Dating

May 21, 2018 by Joseph Martin

At this year’s F8 Developer’s conference, Facebook announced a raft of changes and updates it will be rolling out later this year. Some are fun, others practical, but they’re all interesting. Here are the highlights:

Get Ready for “FaceDate”

This announcement is interesting. Not so much because the idea of using Facebook to meet someone is new, but because of what the announcement did to the stock prices of existing companies.

The new feature will look and feel a bit like Tinder, with a few important caveats:

Your FaceDate profile will be separate from your Facebook profile

The app will not match you with your existing Facebook friends

Your existing friends will not see, or even know about your FaceDate profile (unless you tell them, of course)

Facebook fanatics will no doubt love this feature, but the news caused the stock prices of two online dating companies to fall sharply. These included Match Group (parent company of Match.com) tumbling 22 percent, and IAC (parent company of both Tinder and Match Group) falling 16 percent.

Third Party App Review Starting Up Again

In the wake of the Cambridge Analytica scandal, the company suspended its third-party app review. That is re-opening starting Tuesday, so by the time you read these words, app review should once again be in full swing. The major change here is that the company will now require business verification for apps that need access to specialized API’s or extended login permissions. Apps asking for basic profile information only will not be subject to this new requirement.

Real Time Language Translations In Messenger

A long-anticipated feature addition, the company is taking a cautious approach here. When the feature is initially rolled out, it will only translate English-Spanish conversations, with additional languages added incrementally. In addition to the translation feature, the messenger interface will also get some tweaks and improvements.

“Clear History” Feature Being Added

This one is aimed specifically at the lingering privacy concerns Facebook’s CEO was recently grilled about when he appeared before Congress. In a bid to increase user privacy, Facebook will now allow its users to see the apps and websites that send Facebook information when in use, and allow users to turn off Facebook’s ability to store that data. It’s a good first step, but it remains to be seen how helpful it will be in terms of increasing user privacy. There’s no good way to know that until we get the opportunity to see the new feature in action.

All in all though, a productive conference, with a number of interesting changes ahead.

Healthcare Sector Facing Rise In Ransomware Attacks

May 19, 2018 by Joseph Martin

The Department of Health and Human services has issued a warning to healthcare providers to be on high alert for the SamSam strain of ransomware, which has been used to attack eight different health care entities so far this year.

SamSam made its first appearance in 2016 and is seeing increasingly widespread use so far this year. Unfortunately, the healthcare industry is considered by most to be a soft target. On the Dark Web, healthcare data has become more highly sought after than credit card data, which is only going to put more healthcare entities at risk.

The most tragic component of this is that when a hospital’s network goes down, they stand to lose more than just money and control over patient data. Lives are also at risk. Although none of the attacks to this point have resulted in patient deaths, it’s statistically inevitable. As these attacks continue to increase in frequency, scope and scale, sooner or later, someone will die because of them.

According to security experts, the root of the problem lies in the fact that guarding against such attacks is seen as fundamentally an IT issue. The truth is that it is an organization-wide issue, and should be treated as such, because attacks like these pose an existential threat. Treating the issue as something for a single department to be responsible for inevitably leads to a lack of funding and an inadequate incident response plan. This leaves most organizations completely unprepared to deal with an attack and its aftermath.

Even more worrisome is the fact that an increasing number of ransomware attacks simply destroy the data. Sure, the ransom note still gets displayed, but the hackers simply have no intentions of unlocking the files, and they build their software accordingly. Most recently, hackers have taken to corrupting encrypted data files, which can cause lingering problems for months or even years after they’re unlocked.

This problem is only going to get worse until we all start taking data security more seriously.

All Twitter Passwords Exposed, Change Your Password Now

May 18, 2018 by Joseph Martin

Twitter shot itself in the foot recently but is working hard to get out in front of the problem. According to a recent blog post, the company experienced an issue with its hashing routine – a process which masks user passwords, making them virtually impossible to crack.

Because of the issue, user passwords were stored as plain text on an internal log file. The company found the bug on its own, conducted an investigation and found no evidence that anyone discovered the log file and appropriated it. Although they gave no indication as to how many user passwords the log file contained, they nonetheless urged all of their 330+ million users to change their passwords immediately as a safety precaution.

This could have been far worse for the company, had the log been discovered by a diligent security researcher, or worse still, by a hacker. Even so, it’s a fairly damaging bit of news that’s sure to cause at least some lost trust with its growing user base.

If you use Twitter, you should definitely take the company’s recommendation to heart and change your password immediately. As ever, when you do, the best thing you can do to help yourself is to be sure you’re not using the same password on Twitter as you use on other websites you frequent. That way, even if your password is compromised, the damage will be limited to your Twitter account only.

An even better solution would be to use a password safe, which securely stores the passwords of the various sites you frequent. Although even this step doesn’t provide bullet-proof protection, as password safes are by no means immune to hacking.

Diligence and vigilance are once again the keys. Keep your passwords secure and change them often.

Windows 10 Gets iTunes App For Apple Users

May 17, 2018 by Joseph Martin

Apple promised that its iTunes app would be available on the Microsoft Store by the end of 2017. The announcement was greeted with enthusiasm, but unfortunately, the company didn’t meet their own deadline. They cited the need for more time to build a more robust user experience for Windows users.

The wait is finally over, and its big news, because some Windows 10 machines can only download apps, and prior to this, iTunes was offered as a standalone download only.

The app is fairly sizeable, weighing in at 476.7MB, and is compatible with both x86 and x64 PCs.

A recent Microsoft blog post had this to say about the announcement:

“Now you can download iTunes from Microsoft Store and easily play your favorite music, movies and more – right from your Windows 10 PC. iTunes is also home to Apple Music, where you can listen ad-free to over 45 million songs and download your favorites to enjoy without using WiFi. iTunes is free to download, and you can try Apple Music free for three months. There’s no commitment, and you can cancel anytime.”

One thing to be aware of is that if you already have an older version of iTunes installed on your machine and you download this app, it will automatically replace your older version. It is recommended, therefore, that you back up your data before downloading the latest. While it does offer a better user experience, it’s not worth the loss of your existing library of files.

Kudos to both Apple and Microsoft here. Apple for bringing an excellent free app to the Microsoft Store, and Microsoft for continuing to play nice with their longtime rival, and allowing their massive user base the pleasure of enjoying a portion of Apple’s wonderfully robust ecosystem.

T-Mobile And Sprint To Merge Companies

May 16, 2018 by Joseph Martin

The on-again, off-again talks about a merger between T-Mobile and Sprint is definitely back on, with T-Mobile planning to buy Sprint for a staggering $26 billion.

The deal has been in the works since before Trump was elected President. It died quietly when it became clear that the Obama administration would not allow the deal to go forward, due to concerns that it would leave the US with only three telecom providers, which could harm consumers.

The Trump administration has made it clear that they applaud the move. However, Trump’s Justice Department may be a significant hurdle to clear. Nonetheless, as things stand now, the deal is steaming ahead and the combined company would have a whopping 127+ million customers, putting it not far behind AT&T’s 141.6 million and Verizon Wireless’ 150.5 million customers. T-Mobile’s CEO John Legere would lead the new, larger company.

John had this to say about the planned merger:

“This combination will create a fierce competitor with the network scale to deliver more for consumers and businesses in the form of lower prices, more innovation, and second-to-none network experience – and do it all so much faster than either company could on its own.”

The underlying argument in favor of the merger is that the US is falling behind in terms of network speed. If there is to be any hope of arriving first at a nationwide 5G network, we need bigger, stronger and more robust competitors.

As history shows us clearly though, the regulators of the previous administration have valid concerns about the monopolization of the industry. Any time there are fewer competitors on the board, regardless of the industry, consumers invariably get hit with higher prices. There’s no reason to believe this merger will lead to a different outcome.

Regardless, it now appears that the merger is likely to happen.

Some VW and Audi Cars May Be Hacked Through WiFi

May 15, 2018 by Joseph Martin

Thanks to researchers Daan Keuper and Thijs Alkemade (who work at the Dutch cyber-security firm Computest), newly produced Golf GTE and Audi A3 vehicles are a little bit safer, and a lot less vulnerable to remote hacks.

The duo found that by taking advantage of these vehicles’ WiFi connection, they could access the cars’ IVI, (in-vehicle infotainment system) and from there, gain access to other systems as well.

The researchers had this to say about their work:

“Under certain conditions, attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and conversation history. Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time.”

It gets worse though. Once the researchers had gained access to these systems, they found they could also access the car’s braking and acceleration systems. They stopped short of performing exploits on these for fear of violating Volkswagen’s intellectual property rights. A hacker, however, would not hesitate to do so.

Worse still, the company apparently had no idea there was a problem. In fact, when the researchers presented their findings, they discovered that the company had deployed the IVI system completely untested.

Since bringing the issue to the company’s attention, they have addressed the issue. However, the fix only applies to newly manufactured vehicles. If you purchased either of the models listed above prior to June 2016, your vehicle has not received the fix, and will not get fixed unless you take it back to the dealership. There’s no way for the company to remotely install it. That means there are untold thousands of cars on the road right now that are vulnerable.

Use Caution Traveling, Hackers Now Have Keys To Hotel Rooms

May 14, 2018 by Joseph Martin

Score one for the good guys, but with hesitation. Unfortunately, in today’s fast-moving digital world, even a victory doesn’t mean the end of a problem.

Recently, a pair of researchers (Tomi Tuominen and Timo Hirvonen of F-Secure) released information about a new hack they had discovered. It takes advantage of a critical security flaw in the magnetic VingCard locking systems used in hotel chains around the world.

This particular system produced by Assa Abloy is deployed in more than 42,000 facilities around the world. So in terms of scope and scale, this flaw impacts literally millions of doors.

The security flaw is about as bad as it gets, too. The duo found a way that hackers could turn an old, dead RFID key card into a master key that could be used to unlock any VingCard door. Although the software they used to create the master key card is proprietary, any hacker worth his salt and with a couple hundred dollars to spare for equipment could reproduce the hack on their own, if given time.

Fortunately, long before the pair announced their discovery of the hack, they contacted Assa Abloy privately. They have been working with the company’s R&D department to develop a fix for the security flaw. That fix has now been deployed, and the researchers stress that so far, there is no evidence that the exploit has ever been used in the wild.

Of course, that doesn’t mean that it couldn’t be used, and just because Assa Abloy has released a fix for the flaw doesn’t mean that everyone will promptly install it. So, the risk is still very real. If you’re a frequent traveler, take extra precautions and don’t leave your valuables in plain sight in your room. They may be more vulnerable than you realize.

Apple Will Officially No Longer Sell Routers

May 12, 2018 by Joseph Martin

After more than two decades in the business, Apple is officially going to stop selling routers. The writing has been on the wall for a while now, since the company’s “AirPort” family of products hasn’t received a significant update in more than five years.

When Apple first introduced its AirPort product line, wireless computing was still something of a rarity, and Apple’s offerings were ahead of their time. In the years between then and now though, the market has changed significantly. Unfortunately, Apple’s product line never really changed with it.

These days the competition is fierce with industry giants like Google and Linksys both offering great options for power users. With the rise of mesh networks, the AirPort product line has fallen increasingly behind the times.

The company announced that it would sell its existing AirPort product inventory and support its current user base for the time being, but after that, it would quietly fade away. The company has simply moved on and has redirected its efforts toward other initiatives.

In looking at the broader market, it’s not a huge blow. Of course, if you own and use an AirPort product, now is the time to begin casting about for alternatives. The clock is ticking, and once Apple sheds its existing inventory, we can expect to get an end of support date from them. This will leave any AirPort products still in operation at that point increasingly vulnerable to a variety of hacks.

Even so, given how ubiquitous wireless networking is these days, and how many powerful options are out there, finding a replacement for your AirPort product shouldn’t present too much of a challenge. Just make sure your IT staff knows that the end is nigh, so they can get a replacement in place before the clock runs out.

Hackers Can Use PDF Files To Access Windows Credentials

May 11, 2018 by Joseph Martin

Security researcher Assaf Baharav from Check Point Security has discovered a new twist on an old, fairly well-known attack. He was able to essentially “weaponize” PDFs to steal Windows credentials stored in NTLM hashes. Unfortunately, no action other than simply opening the PDF is required for the hacker to gain access to the information.

Baharav used the same methodology that hackers have used in the past, which amounts to instantiating SMB requests from inside the document. Hackers have already performed these types of attacks from inside web browsers, Windows shortcut files, shared folders, Microsoft Office documents, and Microsoft outlook. Using a PDF to run the exploit is something new.

Baharav had this to say about his research:

“We chose to test these two high profile readers (Adobe Acrobat and the FoxIT reader). Regarding the others, we highly suspect they may be vulnerable as well. We followed a 90 days disclosure policy by notifying only Adobe and Foxit regarding the issues.”

Foxit did not respond to the information Baharav sent, but Adobe did. Unfortunately, their response was not encouraging. They simply announced that they had no plans to address the issue, deferring to Windows OS-level mitigations (reference Microsoft Security Advisory ADV170014).

Microsoft released this advisory to provide instructions on how to disable the NTLM SSO authentication inside the Windows operating system. This is a workable solution, but it has problems.

For starters, it’s not really a patch, but rather the modification of a specific registry key and then the implementation of a network isolation policy. Worse, it’s only applicable to Windows 10 and Windows Server 2016 machines. People who have older systems are simply left vulnerable.

Be on the alert then PDFs can now be used to steal credentials. It appears that every reader is affected and that no help is coming for older systems.

WiFi Sync on iOS Vulnerable To TrustJacking

May 10, 2018 by Joseph Martin

Owners of Apple devices have a new attack vector to worry about, called “TrustJacking.” Symantec researchers recently stumbled across a pair of scenarios that take advantage of Wi-Fi syncing of various Apple devices. These are scenarios that also take advantage of the trust users have in the security of their own devices, allowing hackers to take complete control over those devices.

The flaw is a consequence of the way that iTunes Wi-Fi Sync is designed. The vulnerability manifests when a device is connected and the user selects the “sync” feature. This creates an opening which could potentially allow a hacker to take complete control over the device.

The first issue manifests like this: With the “sync” setting enabled, the device owner has access to both that device and a paired iPhone over a wireless connection, even after the device is disconnected from the syncing service. That sets up part one.

Part two of the first scenario requires a bit of social engineering, where a hacker tries to trick the device owner to click on a malicious link that will install malware of the hacker’s choosing on the vulnerable system.

The second part of the second scenario targets users who are traveling. A hacker could take control of a free airport charging station. In order to make use of those free charging stations, users are required to trust the device. As soon as that happens, the hacker controlling the charging station can remotely issue a command to connect to iTunes, and then enable the sync command.

Once those two steps are completed, even when the victim disconnects from the charging station, the hacker can still access the compromised device remotely, gaining access to most (if not all) of the user’s private information.

Unlike similar, recently discovered vulnerabilities in Apple products, this one distinguishes itself by allowing the hacker permanent access to the device, making it a dangerous vulnerability indeed.