Identity Theft

Bluetooth Vulnerability Allows Hackers To Access Devices

August 1, 2018 by Joseph Martin

There’s a new Bluetooth security vulnerability to be aware of, tracked as CVE-2018-5383, and it’s a nasty one.

It’s a cryptographic vulnerability that affects firmware or operating system software drivers from a number of major vendors, including Qualcomm, Broadcom, Intel and Apple. At this point, the implication of the bug on Linux, Android, and Google are unknown.

The flaw is related to two important Bluetooth features: BR/EDR implementations of Secure Simple Pairing in device firmware and Bluetooth Low Energy (BLE) of Secure Connections Pairing in OS system software.

It was discovered by researchers operating out of Israel’s Institute of Technology. They discovered that the Bluetooth specification recommends (but critically does not mandate) that devices supporting the two features make any effort to validate the public encryption key received during secure pairing.

Since the specification is optional, it’s hardly a surprise that some vendors producing Bluetooth products do not take sufficient steps to validate the parameters used to generate public keys during the exchange.

This allows a would-be hacker the possibility of executing a man-in-the-middle attack to obtain the cryptographic key used by the device. This would give them the opportunity to not only spy on the device’s owner, but also to inject malware that could allow the hacker to take full control over the device.

SIG (the Bluetooth Special Interest Group which maintains the technology), had this to say about the flaw:

“For an attack to be successful, an attacking device would need to be within wireless range of two vulnerable Bluetooth devices that were going through a pairing procedure.

The attacking device would need to intercept the public key exchange by blocking each transmission, sending an acknowledgement to the sending device, and then injecting the malicious packet to the receiving device within a narrow time window. If only one device had the vulnerability, the attack would not be successful.”

Bluetooth SIG has now updated the specification to require products to validate public keys received as part of the public key-based security procedures. Of the manufacturers mentioned above, Apple and Intel have both released patches. Broadcom has made fixes available to its OEM customers who are responsible for providing them to end-users. There has been no word yet from Qualcomm.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

New Report Shows 32 Percent Increase In Cyber Attacks

July 28, 2018 by Joseph Martin

Positive Technologies has just released a new report that paints a grim picture for IT professionals. If your sense is that the number of cyberattacks are increasing, you’re not wrong. In fact, it’s probably worse than you realize.

So far this year, we’ve seen a staggering 32 percent increase in the total number of cyberattacks in the first quarter of 2018, compared to the same period last year. Even worse, malware attacks have increased by a mind-bending 75 percent since the first quarter of 2017.

Individuals were far and away the most frequent target (28 percent), but government agencies came in a reasonably close second (16 percent), with business in the healthcare, finance, and IT sectors rounding out the top five (8 percent, 7 percent, and 5 percent, respectively).

Of the malware deployed against targets this year, spyware was by far the most common, with stealth cryptocurrency mining software not far behind.

Leigh-Anne Galloway, the cyber security resilience lead at Positive Technologies explains in more detail:

“Our research shows that 63 percent of attacks included use of malware. Spyware, in particular, is used most often because it allows obtaining not only personal information and corporate secrets, but credentials for the services and systems needed to attack internal corporate infrastructure.”

Long story short, the prevalence of spyware seen in this report is likely to have cast-off effects in the future. Hackers will gain a sufficient level of access and information, courtesy of their successful spyware attacks, to launch even more harmful attacks against both individuals and government/corporate institutions in the future.

Positive Technologies warns that the number of attacks is likely to continue to escalate, and that there’s no clear end in sight.

The report is dark news if you’re in the digital security business. If your business hasn’t been hit yet, it seems that it’s just a matter of time.

Joseph Martin

Clinic Employee Learns That Traveling Increases Data Theft Risk

July 25, 2018 by Joseph Martin

On May 14th, the Billings Clinic in Montana issued a breach notification statement, which explained that they detected unusual activity within one of its employee’s email accounts.

The employee in question was traveling overseas on a medical mission when the email account was compromised.

“As a result of the forensics investigation, we learned that an unauthorized individual had access to emails and attachments within that one account, some of which included patient information.”

As for scope and scale, information on more than 8,400 individuals was exposed. While the data varied from one patient to the next, the data included patient names, dates of birth, contact information, medical record numbers, internal financial control numbers, diagnoses, and some information about medical services received.

The incident highlights a common, but often overlooked problem.

As analyst Rebecca Herold explains:

“It is very common for data and devices to be hacked while traveling and for those who were hacked to not even realize it. People are often unaware of what is going on around them when they are travelling. They are using any charger station they can find, they speak loudly, and they use free Wi-Fi.

Shoulder surfing is also still very common; it’s a decades-old tactic that still works effectively today. The skimmers on charging stations are increasing in use. Don’t think that if you are in a frequent flyer lounge that these things do not happen there; they happen in those exclusive lounge areas possibly more than in other places.”

The bottom line is, any time your employees are away from your office, the risks of hacking increase. While there are no simple solutions, it bears making your employees aware of the added risks any time they’re travelling. It’s far from a perfect solution, but it’s a good place to start.

Joseph Martin

Thermal Imaging Could Help Thieves Steal Your Passwords

July 24, 2018 by Joseph Martin

As if there weren’t enough ways for hackers to steal your passwords, now, there’s thermal imaging. If that sounds like something straight out of a science fiction movie, think again.

Researchers from the University of California at Irvine recently discovered and demonstrated a technique that involves the use of a thermal imaging camera to capture heat traces left by human fingertips as they type passwords into a keyboard. In fact, their technique is effective for up to thirty seconds after the user removes his hands from the keyboard.

Per the researchers, “Although thermal residue dissipates over time, there is always a certain time window during which thermal energy readings can be harvested from input devices to recover recently entered, and potentially sensitive information.”

The team tested their technique using off the shelf technologies, and on four different keyboards. Their findings indicated that a full password could be obtained by scanning for thermal residues on those keyboards, provided that the scan was taken within thirty seconds of the first key being pressed. After a full minute, it was still possible to obtain partial passwords.

They used an FLIR camera on a tripod set two feet from the keyboards being tested, and the results of their findings were published in a paper called simply, “Thermanator.”

FLIR makes a number of different camera models that can capture heat. Their most basic model, the FLIR One Pro is a $400 accessory available as a smartphone attachment. Some phones (like the CAT S61) ship with the FLIR module embedded in the technology.

The team noted that the ease with which a password could be detected in this manner had a lot to do with the typing style of the target being monitored. Passwords entered by “hunt and peck” typists could be gleaned between 19.5 and 31 seconds, while passwords entered by touch typists took upwards of 50 seconds to be gleaned.

Obviously, this is a fairly exotic form of attack. Although it utilizes off the shelf technology, it would require an extraordinary level of access to set the equipment up, and an extraordinary lack of vigilance on the part of security personnel not to detect the equipment in relatively short order. Even so, it’s certainly within the realm of possibility, and one more thing to be on guard against.

Joseph Martin

Open Database Exposes Info Of 340 Million People

July 17, 2018 by Joseph Martin

Internet security researcher Vinny Trola recently made a huge and disturbing discovery. A marketing firm called Exactis had left a massive database unsecured, allowing anyone who stumbled across it to access it.

As a marketing firm, Exactis collects simply mind-boggling amounts of data on consumers all over the globe.

The database in question was a staggering two terabytes in size, and contained more than 150 data fields. Social security numbers were not included in the exposed data.

A variety of personal identification was available, including:

Name

Political affiliation

Bank account details (including balances)

Information on other financial accounts, including stock holdings

Political affiliation

Donations to political causes

The number of children living in the person’s home

The ages of those children

In short, it’s more than enough personally identifiable information to make it a casual exercise for a determined hacker to link it back to a person’s social security number. Even if they didn’t want to jump through the hoops to do that, there’s still enough information in the massive data file that it could open the door to all manners of phishing and other scams.

Trola informed Exactis about the exposed database, and the company immediately took steps to secure it. However, it was sitting there completely unguarded and unsecured for more than two months, and there’s no telling how many people may have accessed the data inappropriately.

Exactis has no formal relationship with any of the people they collect data on, so they’re under no obligation to and are unlikely to inform the people in the database that their personal information was exposed. Given that, your best bet is to assume that you were mentioned in the database, and be on the alert for phishing and other scams in the months ahead.

Joseph Martin

Americans Want Local Governments To Spend More On Cyber Security

July 16, 2018 by Joseph Martin

While a significant percentage of Americans are suspicious of government spending beyond the essentials, there’s at least one notable exception, according to a recent survey conducted by SecurityFirst.

A majority (74 percent) of Americans want their local governments to spend more money on cybersecurity.

Here are a few of the highlights from the survey:

64 percent believe that a ransomware attack on local government installations could have serious, long-term impacts

Only 33 percent of respondents believe that their local governments are capable of keeping their data safe in the event of an attack

60 percent believe that a cyberattack could jeopardize essential services, and 77 percent fear that fallout from such an attack could hinder first responders

In terms of the biggest concerns of the citizenry, the data broke out as follows:

74 percent cited potential dangers to local utilities

68 percent cited potential dangers to our court system

68 percent cited potential dangers to local schools

Not long ago, the city of Atlanta suffered just such an attack, which cost them millions of dollars and erased several years’ worth of critical data. The city is still working to recover from the incident. It underscores the fact that the concerns brought to light by the survey are all too real, that citizens are right to worry, and they demand more from their local governments.

Unfortunately, in an age where government spending of any kind almost reflexively comes under intense scrutiny and debate, it remains to be seen whether this and similar surveys will provide any traction to the idea of greater government spending on cybersecurity.

If it does not, then we can expect to see more incidents like the unfortunate attack on Atlanta, with similar consequences. If the past is any indication, the survey will generate a few conversations, but not much in the way of action. Sadly, it will probably take a major attack that costs lives before we start getting serious about protecting local governments and critical infrastructure. Here’s hoping it doesn’t come to that.

Joseph Martin

Shopped At Adidas Website? Your Info May Have Been Compromised

July 13, 2018 by Joseph Martin

Another week, another high-profile data breach. This time, Adidas and their online store was the target.

The company became aware of the incident on June 26th, and immediately began notifying “certain customers” that their data had been compromised.

The official statement from the company reads in part, as follows:

“Adidas is working with leading data security firms and law enforcement authorities to investigate the issue. According to the preliminary investigation, the limited data includes contact information, usernames and encrypted passwords. Adidas has no reason to believe that any credit card or fitness information of those consumers was impacted.”

At this time, it’s not known exactly how many users were impacted, but the estimates are in the millions. So if you have purchased anything from the Adidas website recently, you should assume that the data referenced above has been compromised.

The company has promised to release additional details as they become available, but for now, the following standard measures should be taken as a precaution:

If you have an account on the Adidas website, change your password immediately.

Although there’s no indication that credit card information was stolen, to be safe, it would be best to monitor the credit card you used to make your purchase for suspicious activity

Unfortunately, 2018 is probably going to be a record-breaking year in terms of high profile data breaches, just as 2017 broke all the records last year. The escalating number of breaches only underscores the point that in the ongoing battle between beleaguered IT staff and hackers around the world, the hackers seem to have the upper hand.

Part of the difficulty lies in the fact that it’s no longer enough to simply fortify your business network, because so much data is shared with so many third parties. All a hacker needs to do is to find and exploit a weakness in any of the systems managed by those third parties, and no matter how robust your own security, your data is suddenly at risk.

Sadly, it’s going to get a lot worse before it starts to get better.

Joseph Martin

LTE Networks May Be Vulnerable To Hacking

July 11, 2018 by Joseph Martin

Researchers from Ruhr-Universität Bochum and New York University in Abu Dhabi have discovered serious security flaws in 4G LTE networks that allow hackers to spy on, listen in on, intercept, and disrupt phone calls and text messages.

Given that billions of people rely on 4G LTE networks for cellphone communications, it’s a serious issue, and there are no easy fixes. So, don’t expect these flaws to be patched out of existence any time soon. Worse still, the planned 5G networks currently in development may well suffer from the same (or similar) flaws.

Based on their research, the team was able to develop a trio of new attacks that specifically target weaknesses in the 4G LTE architecture.

One of these, dubbed “aLTEr” is a DNS spoofing attack that allows a hacker to become the “man in the middle,” intercepting communications, and gives them the ability to spoof alerts, texts, and other messages.

All three of the attacks developed by the team take advantage of weaknesses found in “Layer Two” of the LTE network.

This is the data layer that rests atop the physical channel. Its function is to maintain wireless communication between users and the network itself, and has an organizational function that (among other things) manages how users access various resources on the network, helping to protect data via encryption and to correct errors in transmission. Obviously, a hack that can exploit this layer could be devastating indeed.

If there’s a silver lining, it lies in the fact that these three attacks are exotic. It would be difficult for a casual or even a fairly determined hacker to execute to any real effect. Unfortunately, it would be a much easier task for a state-sponsored group to pull off, and that’s the big fear here.

Hopefully, since 5G networks are still in the planning stages, something can be done before they’re rolled out to limit the effectiveness, or perhaps even negate these new types of attacks, but that remains to be seen.

Joseph Martin

Turn Cortana Off At Lock Screen To Avoid Potential Hack

July 4, 2018 by Joseph Martin

Do you use Cortana? It’s a handy virtual assistant (like Siri) built into Windows 10. Unfortunately, as useful as she is, there’s a problem. Even if you don’t use Cortana yourself, take heed: Microsoft has recently issued a security update based on findings by McAfee researchers.

It turns out that Cortana can be “summoned” from the lock screen of your PC and used to execute attacks by tricking the ever-helpful Cortana into indexing files from a USB drive, then executing them.

To accomplish the attack, the hacker would need physical access to the PC. Once they had that, they could easily execute Powershell scripts to reset your Windows 10 password, which would then give them unfettered access.

The vulnerability takes advantage of two things: First, Cortana “listens” for commands, even while the PC is locked. Then, the OS indexes files constantly so that they’re ready to use at a moment’s notice. Put those two elements together and you have the makings of a disaster.

Microsoft has rushed a patch out the door to address the issue. For now, the company is advising users to simply disable Cortana on the lock screen, so that your PC has to be unlocked in order for her to be active. It’s probably good advice, given that not all companies update their OS as soon as patches are available, and this one is important.

To be safe, even if you don’t use Cortana, go into settings and disable the virtual assistant on the lock screen. Then, when you’re away from your PC, at least that’s one less thing you have to worry about.

Unfortunately, this isn’t the first Cortana-related security issue we’ve seen, and it’s not likely to be the last. As useful as the feature is, it does open the door to a number of other (potential) problems. Stay vigilant.

Joseph Martin

Majority Of Web Apps Found To Have Security Vulnerabilities

June 29, 2018 by Joseph Martin

How many web apps do you have on your phone? Probably a ton. Here’s something you likely didn’t know. Based on the latest research from Positive Technologies, nearly half of them (48 percent) are vulnerable to unauthorized access.

As bad as that is, it’s just the tip of the proverbial iceberg.

Here are some additional disturbing stats from their report :

44 percent of the apps with vulnerabilities place the user’s personal data at risk

70 percent are prone to leak critical information stored on the device

96 percent of them contain flaws that would allow any malicious actor to exploit them to launch an attack on the target device

Of those, one in six (17 percent) has a flaw severe enough that it would allow an attacker to assume complete control over the app, and from there, the device itself

The majority of these flaws (some 65 percent) are the result of simple coding errors, with improper configuration of web servers being the most common of these.

There is one bright spot in the otherwise dismal report, though. The percentage of apps with critical vulnerabilities has declined slightly, down from 52 percent last year, and 59 percent the year before. So the numbers, while frustratingly large, are trending in the right direction.

Ed Keary, the CEO of Edgescan had this to say on the topic:

“DevSecOps needs to be embraced such that security is throughout the development pipeline. Application component security management (software components used by developers) is still not commonplace in terms of supporting frameworks and software components and is a common source of vulnerability.”

If your firm designs such applications, pay special attention to this report and review your code base at the earliest opportunity. Even if you don’t, it pays to be mindful of the percentages, because odds are that your employees have several at-risk apps on the devices they’re connecting to your network.

Joseph Martin

Bluetooth Vulnerability Allows Hackers To Access Devices

New Report Shows 32 Percent Increase In Cyber Attacks

Clinic Employee Learns That Traveling Increases Data Theft Risk

Thermal Imaging Could Help Thieves Steal Your Passwords

Open Database Exposes Info Of 340 Million People

Americans Want Local Governments To Spend More On Cyber Security

Shopped At Adidas Website? Your Info May Have Been Compromised

LTE Networks May Be Vulnerable To Hacking

Turn Cortana Off At Lock Screen To Avoid Potential Hack

Majority Of Web Apps Found To Have Security Vulnerabilities

Contact Info

Navigation