Blog – Page 32

Biometric Authentication Seeing Wide Adoption In Businesses

March 23, 2018 by Joseph Martin

According to a new report published by Spiceworks, nearly 90 percent of businesses will use some type of biometric technology for authentication by the year 2020. In fact, some 62 percent of companies already use biometrics in some form, with another 24 percent stating their intention to do so within the next two years.

The particulars break down like this:

57 percent of companies using biometric authentication use fingerprint scanners

14 percent use facial recognition

Five percent make use of hand geometry recognition

Three percent use iris scanners

Two percent use voice recognition

Two percent use palm-vein recognition

There are only a handful of companies that provide biometric solutions. Of those, Apple dominates the space, providing 34 percent of fingerprint scanning solutions and 14 percent of facial recognition solutions.

The rest of the market breaks out as follows:

Lenovo Fingerprint Manager is used by 13 percent of companies that utilize biometrics

Samsung fingerprint readers are used by 13 percent

Microsoft’s Windows Hello (face login) is used by 13 percent

Android’s Face Unlock is used by seven percent

As widespread as biometric adoption has been, only 10 percent of CIOs felt that biometric solutions were secure enough to be the sole means of authentication. IT security professionals have reached largely the same conclusion, with just 23 percent of them thinking that biometrics could replace traditional text-based passwords within the next two years.

The two biggest hurdles they see are the relative lack of transparency provided by biometric solutions providers about flaws and vulnerabilities discovered in their systems, and the lack of transparency around the biometric data collected by vendors.

Peter Tsai, a senior technology analyst at Spiceworks had this to say about the report: “Many IT professionals aren’t convinced biometrics can serve as a secure and reliable replacement for the standard username and password combo. Unless technology vendors can address the security issues and privacy concerns associated with biometrics, the technology will likely be used side-by-side in the workplace with traditional passwords or as a secondary authentication factor for the foreseeable future.”

Windows Media Player May Be Replaced By Microsoft App

March 22, 2018 by Joseph Martin

A Reddit user named “Noam_ha” recently posted a screenshot displaying a popup message when users open the venerable Windows Media Player (WMP), asking users if they would instead like to open the video file with the company’s more modern Movies and TV app.

The popup message touts the Movie and TV app’s advantages, which includes better battery life if running on a phone or laptop, better compatibility with more modern video formats, a mini-view, and support for 360-degree video on Augmented Reality devices.

There are several interesting things to note here:

First, while the new popup message clearly signals Microsoft’s preferences, the reality is that in many ways, the Movie and TV app is a poor substitute for WMP. It only has modest functionality and has a downright awful interface. Even worse, many features found in WMP (like streaming video from online repositories, queuing, and variable play speeds), are simply not present in the new app.

Second, this appears to be a recent shift inside the company, because WMP comes pre-installed on Windows 10.

On the other hand, WMP hasn’t received a significant update since the Movie and TV app was first released with the launch of Windows 7. In that respect, at least, the writing has been on the wall for some time now.

This marks the second beloved app that Microsoft has decided to kill in recent months. Recall that just last year, the company announced the end of Microsoft Paint, a kludgy, barely functional graphics program that was nonetheless, strangely beloved by users. It was retired and replaced with “Paint 3D,” and now, all indications are that Windows Media Player is headed for a similar fate.

That wouldn’t necessarily be a bad thing, but given the condition of the new Movies and TV app, the decision probably isn’t going to win Microsoft any friends.

New And Potentially More Dangerous Intel Vulnerability Discovered

March 21, 2018 by Joseph Martin

The “Spectre” vulnerability that impacts literally every Intel chip made over the last decade keeps finding new ways to make the news. In this instance, researchers at Ohio State University have discovered a new variant of the vulnerability that they have dubbed “SGX Spectre.” To understand how it’s different, a bit of explanation is in order.

SGX stands for “Software Guard eXtensions,” and is a feature only found in the latest Intel processors. It allows applications to create “data enclaves,” which are hardware-isolated portions of a CPU’s processing memory. The purpose of such enclaves is to give applications a secure space to run operations that deal with especially sensitive data, like passwords and encryption keys.

The original Spectre and Meltdown vulnerabilities were unable to extract any data from SGX enclaves, but SGX Spectre can. Even worse, the recent Spectre patches will do nothing to prevent it.

Intel has announced that on March 16, it will release an update for its SGX SDK that adds SGX Spectre mitigations. App developers will need to integrate the update into their SGX-capable apps and issues an update to all users.

The research team had this to say about the recent discovery:

“SgxPectre Attacks can completely compromise the confidentiality of SGX enclaves. Because vulnerable code patterns exist…and are difficult to be eliminated, the adversary could perform SgxPectre Attacks against any enclave programs.

Because there are vulnerable code patterns inside the SDK runtime libraries, any code developed with Intel’s official SGX SDK will be impacted by the attacks. It doesn’t matter how the enclave program is implemented.”

In addition to the discovery of SGX Spectre, the research team discovered new variations of the original security flaws, which they have dubbed MeltdownPrime and SpectrePrime, respectively. Needless to say, more patches will be forthcoming.

Netflix To Release More Parental Controls To Help Parents

March 20, 2018 by Joseph Martin

If you have a Netflix account and children living at home, there’s a reason to cheer about the company’s most recent announcement. They’re rolling out some robust new parental control features that will allow you to exert much more control over what your children are watching.

You can now set content-specific PINs to lock movies or TV shows. So for example, if you don’t want your children watching “Zombeavers” (yes, that’s a real movie, by the way), you could lock that content with a PIN. This is in addition to the existing controls Netflix offers that allow parents to set broad PIN-based protections that block content at specified maturity levels.

Additionally, the company has stated that it will start displaying these maturity level designations at the start of each program to give parents greater awareness of what their children are watching. The changes are slated to be rolled out over the next few months.

It’s probably not a coincidence that the rollout of these changes is slated to coincide with Disney’s planned launch of their own kid-friendly streaming service.

It’s worth noting that Netflix and Disney reached a streaming agreement back in 2012, which didn’t go into effect until 2016. Disney has stated their intention to end the deal beginning with films released in 2019. For their part, Netflix will retain the right to show older Disney films until the end of 2019.

Netflix has been the King of the video streaming hill for a long time, but the company is coming under increasing pressure from a growing number of competitors. The company is fully aware that Disney already has the hearts and minds of millions of children around the world. They realize that unless they do something to bolster their parental controls feature set, they stand to lose ground to this latest entrant in the field of streaming video.

Microsoft To Help Intel With Security Issues

March 19, 2018 by Joseph Martin

By now, you’ve almost certainly heard of the “Spectre” and “Meltdown” security flaws that affect every Intel chip produced in the last decade. Users have been waiting for a fix for both of these since January, when the issues were first discovered.

From the beginning, Microsoft agreed to include the fix for Spectre in its regular software updates but insisted that Intel and PC manufacturers would have to push the Meltdown fix on their own.

Unfortunately, the overwhelming majority of users are still waiting, and in the meantime, untold millions of machines are at risk. Intel’s first attempt at a fix was so spectacularly bad that the company urged users not to install it until a better fix could be rolled out.

Intel has since released an updated fix, but few users have taken advantage of it so far. The reason is because most users simply don’t know how. They’re not aware that they have to go to Intel’s website to manually download and install it, or wait for an OEM push, which could still be months away.

Given this reality and the extreme danger that Spectre poses, Microsoft has reversed course and agreed to make special Windows update releases that include the Spectre fix. The first such update, KB4090007, is now out and available to users.

There are two important caveats to be aware of, however:

These special updates will not be delivered automatically. Users will have to go to the Windows Update Catalog and select the appropriate package, then run it on their computers

The updates are available only for Windows 10, version 1709, and Windows Server, version 1709

The currently available package (KB4090007) is meant for Intel Skylake CPU owners only. Additional packages will be released over the course of the next few months.

Trustico CEO Leaks HTTPS Certificate Keys Through Email

March 17, 2018 by Joseph Martin

The CEO of Trustico, a TLS certificate reseller based in the United Kingdom, finds himself at the center of a controversy that raises a number of disturbing questions about browser-trusted security certificates.

The email in question was sent to Jeremy Rowley, an executive Vice President at DigiCert. The catalyst that prompted the fateful email was that officials at Trustico notified DigiCert that 50,000 certificates originally issued by Symantec and resold by Trustico had been compromised and should be mass revoked due to security concerns.

Mr. Rowley, not wanting to take such drastic action without proof, asked for it. In response, Trustico’s CEO emailed the private keys of 23,000 certificates, an action which drew shocked reactions from security professionals around the world when news of the email became public.

If you’re not familiar with the inner workings of browser-trusted certificates, there are a few problems here. First, there’s no good reason why a reseller should have a copy of the private keys to begin with. Second, even if that were the norm, to simply email them to a third party shows incredibly poor judgement, especially given that there’s no evidence the email in question was encrypted. Third, customers used Trustico’s website to generate their private keys, which is a service that should never even have been offered.

To make matters even worse, not long after news of the email hit the internet, Trustico’s website went dark, when a security expert posted details about a critical vulnerability on the company’s website. The flaw resides in a site feature that allows customers to confirm that certificates are properly installed. Unfortunately, Trustico’s website had been compromised and any time a user would use the feature, the hackers could use the opportunity to run malicious code. It’s a tangled web, and it paints everyone involved in a very bad light.

Another 2.4 Million Users Hacked In Equifax Breach

March 16, 2018 by Joseph Martin

It looks like it’s going to be another bad month for Equifax. The company just can’t seem to get out of its own way.

In 2017, the company announced a massive data breach that (it initially claimed) impacted some 140 million users. Several months after the official announcement, the company was forced to revise the number of impacted users upward, as the forensic investigation into the breach continued.

Now, the company has announced a further upward revision of 2.4 million, bringing the total number of impacted users to slightly more than 148 million.

Equifax CEO Paulino do Rego Barros Jr. had this to say about the announcement, which raised more than a few eyebrows:

“This is not about newly discovered stolen data. It’s about sifting through the previously identified stolen data, analyzing other information in our databases that was not taken by the attackers, making connections that enabled us to identify additional individuals.”

As it did originally, the company has also announced that it would notify the newly identified consumers and offer them free credit monitoring and identity theft protection at no cost.

After last year’s congressional hearings on the matter, this portion of the announcement tends to illicit eyerolls. The company is in the credit monitoring business, and the way the company offers its “free” protection is that at the end of the free period, it automatically rolls into a paid plan unless the user cancels the service.

Of course, as with most such schemes, a high percentage of users won’t think about it until they get their first bill. One of the more acidic comments made during last year’s hearings was that the company actually seems to be profiting from their own data breach. That makes the CEO’s statement that “We are committed to regaining the trust of consumers, improving transparency, and enhancing security across our network” ring a bit hollow.

New Android OS To Improve Lower End Phones

March 15, 2018 by Joseph Martin

Google has another new product out. A slimmed down, streamlined version of the Android OS called “Go.” Unfortunately, it’s release didn’t gather as much press as you’d expect when a new OS is released. The reason for that is simple. The new, slimmer, sleeker Android Go was designed for low-end phones with limited storage capacity, which don’t typically get much press either.

Despite the relative lack of fanfare, Android Go is an interesting app that deserves some attention, even if you don’t own a low-end phone. At first glance, it’s got a lot going for it, although it remains to be seen if users will embrace it and make full use of its capabilities.

The first major noteworthy difference between Go and the standard Android OS is the fact that it doesn’t take up nearly as much space. Counting the OS itself and the Android default apps, the entire package requires just over 3GB, which is a significant space savings. This makes a real difference on low-end phones, which typically have no more than 8GB of storage to begin with.

Second, it comes with an app called “File Go” that offers users suggestions on files that can be moved to the cloud or safely removed altogether. Another app known as “Datally” makes tools available to manage how much data other apps on the phone are using, especially helpful for people who have limited data plans.

Third, there’s a special “YouTube Go” version of the standard YouTube app that gives users three different video streaming options: basic, standard, and high quality. This comes with information about how much data each of the three options will eat up.

In addition to those changes, Google has added a special section to its Play Store, highlighting apps that don’t require a lot of space.

Android Go is aimed specifically at users in developing nations, as this is where the highest concentration of low-end smartphones can be found. As to how successful the new OS will be, only time will tell, but early indications are encouraging.

Mi-Cam Baby Monitor Video Feeds Vulnerable To Hacking

March 14, 2018 by Joseph Martin

Do you have a Mi-Cam in your home? Even if you don’t have kids, you may have one. They’re a highly popular, inexpensive means of keeping tabs on the comings and goings inside your home when you’re not around.

As with so many such devices these days, users have the option of installing either an Android or iOS app on their phones so they can peek in remotely, any time they like, and therein lies the problem.

It’s no secret that the IoT is filled with “smart” devices that don’t live up to their name when it comes to security, and the Mi-Cam is no exception. Security researchers have discovered that the communications between the company’s cloud servers where the video feeds live and the smartphones of the product’s user based are not secure.

So far, six different vulnerabilities have been identified, all of them critical. Any one of them would allow a hacker to hijack the window into your video feed and use that to scroll through literally every video feed on the company’s cloud, regardless of who owns it. All told, that’s more than fifty thousand video feeds, accessible from a single point of entry.

It gets worse. The attack is trivial to perform, because no SSL certificate is needed. All that’s required is a copy of either the Android or iOS mobile app.

The manufacturer of the Mi-Cam has been notified of these critical security flaws, but as of now, none have been addressed. The company has not released any information about when they might be. In light of that, if you have one, your best bet is to simply stop using it until the company can at least employ some rudimentary security protocols.

High Speed Wireless Coming To Laptops Next Year

March 12, 2018 by Joseph Martin

If you’re in the market for a new laptop but can milk a little more life out of the one you’ve got, 2019 will be the year to buy. The reason? 5G. AT&T is slated to become the first carrier to offer 5G network connectivity to small segments of its customer base this year (starting in Atlanta, Dallas, and Waco, and then slowly spreading to other areas).

While they’ll be the first, it’s not hard to imagine that their competitors will be hot on their heels, and all the major PC and laptop manufacturers are keenly aware of this. That’s why Microsoft, Lenovo, HP, Dell, and Intel have all announced that the first 5G-enabled PCs will become available sometime in mid to late 2019, in a bid to take advantage of the awesome new capabilities that 5G promises to make a reality.

While Intel missed the 4G opportunity, the company has every intention of being front and center in the 5G revolution.

In fact, the company had this to say when it made its announcement earlier this week:

“Intel is investing deeply across its wireless portfolio and partners to bring 5G-connected mobile PCs to market, with benefits for users like high quality video on-the-go, high-end gaming, and seamless connections as users traverse WiFi and Cellular networks.”

All true, and a widespread 5G network would truly be a game changer. The problem though, is that 5G has a bit of an image problem. It has long been considered the Holy Grail of wireless networking, and Intel and other companies have been hyping its many advantages for years.

The difference of course is that now, companies have the technical capabilities to make it all real, and have firm timetables in place for a rollout, neither of which were true in the past. Even so, 5G now has to swim against a bit of a tide of its own making as it draws closer to becoming reality.th permission from Article Aggregator