2017 List Of Most Used Passwords Released

January 9, 2018 by Joseph Martin

SplashData has released their latest annual report on the most commonly used passwords. Unfortunately, the more things change, the more they stay the same.

By now, everyone knows that the number of hacking attempts and high-profile data breaches is on the rise. Everyone has heard, on more than one occasion, how important it is to not use the same password across multiple web properties, to enable two-factor authentication if and where it is offered and to use passwords that contain a combination of letters, numbers, and symbols in order to make them more difficult to crack.

Although these are things that everyone knows, the wisdom embedded in the advice above often goes unheeded. According to the data collected by aggregating passwords leaked in data breaches over the past year, the most commonly used password for 2017 is “123456,” followed closely by the ubiquitous “password.” These are unchanged from last year.

The rest of the top 25 list contains a mix of the old and the new, including:

12345678

Qwerty

12345

123456789

Letmein

1234567

Football

Iloveyou

Admin

Welcome

Monkey

Abel123

Starwars

123123

Dragon

Passw0rd

Master

Hello

Freedom

Whatever

Qazwsx

And Trustno1

If you make use of any of these passwords, we urge you to change them immediately. As important as data security is and as much as is at stake, you’re putting yourself, your friends and your co-workers at grave risk by using such easily cracked passwords.

SplashData’s CEO Morgan Slain had this to say on the topic:

“Unfortunately, while the newest episode may be a fantastic addition to the Star Wars franchise, ‘starwars’ is a dangerous password to use. Hackers are using common terms from pop culture and sports to break into accounts online because they know how many people are using those easy-to-remember words.”

Simple Ways to Go Green and Save Green!

January 8, 2018 by Joseph Martin

How Green is Your Business?

In today’s world, everyone is making a stronger effort to recycle and save, both individually and on a business level. The great thing about “Going Green” is that it doesn’t just benefit the environment, but it can also benefit the bottom line for your business. Here are some easy ways your business can go green:

Tune-Up Your Technology

The great thing about computers and technology these days isn’t just their speed and capabilities, but also their power efficiency. Updating your work stations with new technology will not only save you on your utility bill, but it can also save you in the long run on maintenance and updating for your older systems!

Trade in the Paper for Digital Filing

Digital document management systems have come a long way, as well as the benefits they can offer your company when it comes to efficiency and security. Cloud system services and secure servers not only eliminate the cost and waste of paper and ink, but they also offer a faster filing system that is also easier to navigate for employees. Digitally organizing your documents with these services also cuts down on the threat of your files being lost or stolen.

Bring the Office Home

Many businesses are using the abilities of cloud solutions to work remotely from home. This cuts down on several costs and environmental hazards. Along with saving on gas and travel time, this also helps eliminate vehicle emissions. On top of that, companies save a ton of money when it comes to rent, overhead and utilities to operate an office.

Apple Might Be Working On Universal Apps Across Mac, iOS

January 7, 2018 by Joseph Martin

Apple has been quietly working on something called “Project Marzipan” for a couple of years now, and it appears that they’re getting closer to unveiling it.

The company seeks to bring its MacOS and iOS platforms closer together by developing universal apps that will work in either environment. This mirrors Microsoft’s Universal Windows app strategy, where apps can detect the environment they’re running on and adjust their display and navigation accordingly.

Project Marzipan presents some real challenges for Apple because MacOS programs use an entirely different set of development tools, although there is some overlap. The programming language called Swift, for example, can be used to make apps that run in either environment and if the company placed a greater emphasis on it, the process of creating their own universal apps would be greatly simplified.

The thinking behind Marzipan seems to be driven by the company’s desire to breathe new life into the Mac App Store, which hasn’t seen nearly the level of success as their iOS Store. The move would be a boon to developers because creating a common platform would allow Mac app developers to get their product in front of more potential customers.

Another potential reason is that the company may be planning to ultimately merge MacOS and iOS into a singular operating system that runs every Apple product. It’s a compelling theory, but the company has said nothing to confirm it.

In any event, if Apple goes ahead with Marzipan, and at this point, all indications are that they will, then we can expect a public announcement to that effect at next year’s World Wide Developer Conference. The first of the universal apps should appear not long after that, although the process of merging the two app stores and building out a robust collection of universal apps could take more than a year.

Windows 10 Third Party Password Manager Could Have Security Issue

January 6, 2018 by Joseph Martin

Do you use “Keeper?” If you’re not sure what it is, then you probably don’t. It’s a password manager that Microsoft has been bundling with some of its Windows 10 releases. Either way, there’s a serious flaw in its design that you should be aware of.

Earlier in the year, Tavis Ormandy, a researcher on Google’s Project Zero team, discovered a bug that saw Keeper injecting privileged user information into web pages, exposing all manner of private data unnecessarily to website owners.

The potential damage comes from a user being lured onto a hacker-controlled website, whose owner could siphon up the information (including literally every password stored by Keeper) and resell it, or use it to launch a highly targeted attack against a specific user or device.

The bug was reported, and a patch was issued. Then, in a later version, Ormandy found the same bug cropping up again. He had this to say about the matter:

“I’ve heard of Keeper, I remember filing a bug a while ago about how they were injecting privileged UI into pages. I checked and, they’re doing the same thing again with this version.

I think I’m being generous considering this a new issue that qualifies for a ninety-day disclosure, as I literally just changed the selectors and the same attack works. Nevertheless, this is a complete compromise of Keeper security, allowing any website to steal any password.”

Craig Lurey, the CTO of Keeper Security, had this to say when informed of the bug:

“This potential vulnerability requires a Keeper user to be lured to a malicious website while logged into the browser extension, and then fakes user input by using a ‘clickjacking’ technique to execute privileged code within the browser extension.”

The two important takeaways here are as follows:

The company reports that so far as anyone can tell, this flaw has not actually been exploited in the wild.

Keeper Security has issued an emergency patch that has disabled the “Add to Existing” feature, which is where the problem code actually resides.

This temporary measure was implemented as a stop-gap until the bug can be properly patched.

Used with permission from Article Aggregator

Researchers Find Malware Targeting Industrial Systems

January 5, 2018 by Joseph Martin

In the malware ecosystem, few strains are more terrifying than those that target industrial control systems. Think Stuxnet, Industroyer and IronGate. Recently, security researchers from FireEye have identified a new threat in this class of malware. Alternately called “Triton” or “TRISIS,” this new code targets Triconex Safety Instrumented Systems (SIS) controllers, which are manufactured by Schneider Electric. These control systems are found in a wide range of industrial equipment. They are, in effect, the gears that keep the machine of modern industry moving.

So far, there’s suggestive evidence that at least one state-sponsored attack has been carried out using the new strain of malware, although neither the identity of the target of the attack nor the organization responsible for it have been disclosed. All we know for sure is that the attack was launched against an industrial concern in the Middle East.

The code base of the new threat utilizes the TriStation Protocol, which is a proprietary tool used by Triconex SIS products. There is no public documentation available for the protocol, which suggests that the hackers who developed the malware must have reverse engineered it.

A spokesman for FireEye had this to say about the code in general and the recent attack:

“The attacker gained remote access to an SIS engineering workstation and deployed the Triton attack framework to reprogram the SIS controllers. During the incident, some SIS controllers entered a failed safe state, which automatically shut down the industrial process and prompted the asset owner to initiate an investigation.

The attacker deployed Triton shortly after gaining access to the SIS system, indicating that they had pre-built and tested the tool, which would require access to hardware and software that is not widely available.”

The real danger of software like this is that it can reprogram control systems to ignore when equipment begins operating beyond normal operating parameters, which can lead to physical damage to critical infrastructure.

If deployed against a power station, for instance, it could result in widespread blackouts. If deployed against a nuclear installation, it could send the reactor into a meltdown.

Threats like these are becoming more common by the day, and with hundreds of millions of controllers deployed around the world, it’s just a matter of time before the hackers succeed at hitting close to home.

Microsoft Word Gets Update To Disable DDE After Malware Concerns

January 4, 2018 by Joseph Martin

In recent months, Microsoft Word has been getting a fair amount of bad press, thanks to an old-but-still-supported feature called DDE (Dynamic Data Exchange). This is the feature that allows Word to pull data from other MS Office applications. For instance, if you embed a chart into your Word document, each time you open the doc, it will automatically poll the spreadsheet the chart was created from an update it dynamically.

It’s a good feature, but unfortunately, it’s subject to abuse by hackers, who can use it to insert malicious code.

For a long time, Microsoft held the opinion that DDE wasn’t flawed per se, and as such, refused to take any action to try and limit its abuse. The thinking was that the company had already done enough since MS Office is designed to display a warning message before actually opening a file, which gives the user a choice.

Unfortunately, hackers have found ways to game that system as well and get around the warning box, and ultimately, that’s what changed the company’s mind.

Back in October, Microsoft published Security Advisory 4053440, which warned of the potential dangers of DDE and advised users on how to disable the feature in Word, Outlook and Excel. The company has now taken things a step further, disabling the feature inside MS Word in the Office Defense in Depth Update, ADV170021.

In fact, the company now sees the problem as being so severe and pervasive that they took the unusual step of issuing an emergency, out-of-band patch to update Word 2003 and 2007, two versions that Microsoft has officially stopped supporting.

If your employees use MS Office, this most recent patch is of critical importance, so if you’re not getting updates automatically, make sure your team knows to grab and apply this one.

DirecTV Genie DVR May Have A Major Vulnerability

January 3, 2018 by Joseph Martin

If you have a Genie DVR system, you should be aware of a major security flaw in the firmware that could allow a hacker to take complete control over the device.

At issue is the equipment offered by AT&T as part of their free DireTV WVB Kit. Researchers of the ZDI initiative and Trend Micro discovered a zero-day vulnerability in one of the core components of the system, Linksys WVBR0-25, which is a Linux-powered wireless video bridge. It is this bridge that allows customers to connect up to eight Genie client boxes connected to television sets in customers’ homes.

Trend Micro researcher Ricky Lawshae took a deep dive into the firmware and was able to get the Linksys WVBR0-25 to divulge a wealth of information from the device’s web server, without requiring any sort of authentication whatsoever. There wasn’t even a login screen, just a wall of easy-to-access text, which included:

Customer WPS PIN

Connected clients

Processes currently running

And more. Lawshae had this to say after completing his investigation:

“It literally took 30 seconds of looking at this device to find and verify an unauthenticated, remote root command injection vulnerability. It was at this point I became pretty frustrated.

The vendors involved here should have some form of secure development to prevent bugs like this from shipping. More than that, we as security practitioners have failed to affect the changes needed in the industry to prevent simple yet impactful bugs from reaching unsuspecting consumers.”

It gets worse, though. When the ZDI Initiative reported this security flaw to the manufacturer, rather than issuing a patch to correct it, they simply ceased all communication. After more than six months of trying, and getting nowhere, ZDI decided to publicize the vulnerability in the hopes that doing so would finally prompt the company to take action.

Until they do, about your only option (aside from simply canceling your service) is to limit the number of devices that can interact with Linksys WVBR0-25 so as to limit your exposure.

Always Connected Laptops Could Be The Next Generation Of Hardware

January 2, 2018 by Joseph Martin

What’s the next big thing for the PC world? If the industry’s major players have anything to say about it, it will be the “always-on” PC.

Forget about plugging into your company’s network. Forget about free WiFi Hotspots. With an always-on PC, you won’t have to worry about either. If they’re not available, your PC can connect via the same cellular data network your smartphone uses, which means you’ll always be just a few mouse clicks away from your data.

It sounds fantastic, but there is, of course, one giant wrinkle in the equation: cost. More specifically, although several major hardware manufacturers are planning to sell always-on PCs soon, nobody knows how much the data plans will wind up costing in the longer term.

A few telecommunications companies have already given some indications here. T-Mobile has announced that its ONE unlimited service will be available for $20 a month. AT&T’s rates are significantly higher, charging $30 a month for 3GB of DataConnect data, and Verizon is charging $10 a month per gigabyte of data.

Depending on how much data you’re working with, that can get expensive very quickly. You could easily wind up paying more on your data plan than the PC itself set you back, and that’s before taking into account what impact the recent reversal on the Net Neutrality policy may have going forward.

One thing’s for certain: carriers won’t be able to get away with charging too much for the service, or customers will simply opt not to play the game, preferring to continue to flock to free WiFi hotspots as they’re doing now.

The first always-on PCs will start shipping in 2018, at which time we’ll find out how anxious the market is to embrace the new feature, and what kind of premium they’ll be willing to pay for it. Stay tuned.

Are Your Employees Working or Web Surfing?

January 1, 2018 by Joseph Martin

Productivity: Is the Job Really Getting Done?

Surfs Up, Productivity Down?

The growing trend of employees inappropriately using Internet access to check personal email, social media and browse the web is costing local businesses valuable project time, money and overall productivity. In fact, recent studies have shown that as much as 80% of employees are using the Internet at work for purposes that have nothing to do with work.

Browser Blind

A major issue with employees wasting productivity on surfing the Internet comes from businesses not properly monitoring and restricting Internet access. The damage from employees surfing the web is furthered as employees damage the reputation of their employer by browsing inappropriate content or posting damaging information to social media, as well as the threat of downloading harmful viruses and leaving critical business and client information at risk.

The Cost of Time Lost

The age of employees has no affect on the ability to waste time by browsing the web. Studies show that older employees spend work time managing their finances or reading news, while younger employees are distracted by social media. Furthermore, you are the one footing the bill! With the average employee losing 2-3 hours of work time on inappropriate Internet usage, companies are losing thousands of dollars!

How to Elevate Employee Productivity

The combination of an Internet usage policy and a monitoring system is the first step to eliminating inappropriate web surfing. Even with a policy and restrictions in place, it’s not enough. It comes down to enforcing your policy and taking actions to reprimand employees who violate the company policy. The combination of knowing they are monitored and that the consequences of abusing company resources is real, is the best way to ensure your employees are working when they are at work!

How Will the End of Net Neutrality Affect My Small Business?

January 1, 2018 by Joseph Martin

You may not realize it, but the end of net neutrality is a serious concern for small businesses. Larger companies will now have an advantage over small ones.

What is net neutrality?

According to Google, network neutrality is “the principle that Internet service providers should enable access to all content and applications regardless of the source, and without favoring or blocking particular products or websites.”

What does it mean now that net neutrality is dead?

Internet service providers can now decide which websites and apps they will allow access to, as well as, the speed at which they will run. Now, service providers can make companies pay a fee in order for their website to run faster. It turns a level playing field into a skewed one, especially for smaller businesses. Not only will this affect companies, but internet users, as well. It is possible that we might have to pay to use a certain website or to make it speed up.

How will it affect my small business?

Smaller businesses have always had to compete with larger corporations and it hasn’t always been an easy task considering that large corporations have more means. But, they did find relief when it came to the internet because they always had an equal playing field. Now that net neutrality is dead, internet service providers will be charging fees that small businesses just won’t have the money to pay. That means that their websites will run slower than the corporate giants which will result in irritated customers. You have to admit that when your internet is running slow and you’re trying to do some online shopping, most of the time you just throw in the towel. Then, you continue your online shopping at a later date when the internet is back on track. Well, this is how it’s going to be every day for smaller companies. It won’t be as easy to take a quick glance at the menu of your favorite, local restaurant. You won’t be able to as easily buy that product from a mom and pop e-commerce site. The end of net neutrality could have some serious repercussions for small businesses.