(252) 565-1235

Carolina IT Group

Call Us (252) 565-1235 Request Support Contact Us

Twitter Is Getting Tough On Apps

by

Twitter has long had a reputation for being at the mercy of bots that have been used to sway public discourse and opinion.

Often, these bots are controlled via Twitter API apps that allow the authors to automate most of their actions, such as tweets, follows, and likes.

In the face of Facebook’s recent grilling before congress, Twitter has decided to take a more proactive stance, and has recently announced major changes to their policies.

The first part of the company’s statement to that effect reads as follows:

“Starting today, all new requests for access to Twitter’s standard and premium APIs are required to go through a new individual approval process.”

In addition to the newly announced approval process, the company moved decisively to cut off more than 143,000 apps they deemed to be in violation of the company’s terms of service.

The more robust approval process requires app developers to provide more information about themselves and the ultimate purpose of the apps they design.  Additionally, Twitter has put a hard cap on the number of apps that developers can create and manage, which tops out at ten.  If developers need to run more than that, they’ll need special permission from Twitter, and they’ll have to provide a compelling reason to justify the need.

Beginning September 10th, 2018, the company will be placing additional restrictions on every Twitter App which will control their use rates.

The new rate limits (per app) will be:

300 Tweets and Retweets per hour

1,000 likes per 24 hours

1,000 follows per 24 hours

15,000 direct messages per 24 hours

The company reserves the right to either remove or further restrict these limits for legitimate reasons.

On top of all that, Twitter has also modified its Twitter API support page to include an option for reporting “bad apps” that break one of the company’s policies.  According to the company, the combined effect of all of these changes should “help cut down on the ability of bad actors to create spam on Twitter via their APIs.”

While it remains to be seen how effective these changes will be, kudos to Twitter for taking action.

Bluetooth Vulnerability Allows Hackers To Access Devices

by

There’s a new Bluetooth security vulnerability to be aware of, tracked as CVE-2018-5383, and it’s a nasty one.

It’s a cryptographic vulnerability that affects firmware or operating system software drivers from a number of major vendors, including Qualcomm, Broadcom, Intel and Apple. At this point, the implication of the bug on Linux, Android, and Google are unknown.

The flaw is related to two important Bluetooth features: BR/EDR implementations of Secure Simple Pairing in device firmware and Bluetooth Low Energy (BLE) of Secure Connections Pairing in OS system software.

It was discovered by researchers operating out of Israel’s Institute of Technology. They discovered that the Bluetooth specification recommends (but critically does not mandate) that devices supporting the two features make any effort to validate the public encryption key received during secure pairing.

Since the specification is optional, it’s hardly a surprise that some vendors producing Bluetooth products do not take sufficient steps to validate the parameters used to generate public keys during the exchange.

This allows a would-be hacker the possibility of executing a man-in-the-middle attack to obtain the cryptographic key used by the device. This would give them the opportunity to not only spy on the device’s owner, but also to inject malware that could allow the hacker to take full control over the device.

SIG (the Bluetooth Special Interest Group which maintains the technology), had this to say about the flaw:

“For an attack to be successful, an attacking device would need to be within wireless range of two vulnerable Bluetooth devices that were going through a pairing procedure.

The attacking device would need to intercept the public key exchange by blocking each transmission, sending an acknowledgement to the sending device, and then injecting the malicious packet to the receiving device within a narrow time window. If only one device had the vulnerability, the attack would not be successful.”

Bluetooth SIG has now updated the specification to require products to validate public keys received as part of the public key-based security procedures. Of the manufacturers mentioned above, Apple and Intel have both released patches. Broadcom has made fixes available to its OEM customers who are responsible for providing them to end-users. There has been no word yet from Qualcomm.

Hackers May Set Their Sights On Your GPS Next

by

If you’re like most people, you probably rely heavily on the GPS function of your phone. Type in an address and your phone helpfully guides you, turn by turn, to your destination. It’s one of the most often utilized features of a smartphone, and of course, the hackers are very interested in interfering with it.

Until now though, hackers have been unable to fool humans into driving to the wrong destination by hacking their GPS, because their instructions often make no sense given the prevailing terrain features the humans are seeing on the road. For instance, nobody is going to turn left into a Jiffy Lube parking lot or a corn field just because GPS says to (unless your destination was Jiffy Lube, of course).

That’s changing, thanks to researchers from Virginia Tech and the University of Electronic Science and Technology of China.

The team has devised a way to hack into a GPS system and spoof the results well enough to fool humans, giving bogus driving directions that seem to make sense given local conditions, and as such, don’t raise red flags.

Accomplishing the task was no small feat, involving the creation of an algorithm that works in something close to real time. This along with a portable device for spoofing GPS that can be attached to the car of your target or placed in a trailing car. Its effective range is about fifty meters.

Once the equipment is in place, the algorithm crafts GPS inputs that follow the real world road network, allaying suspicion in 95 percent of the team’s test cases, while still ultimately sending the target to the wrong destination.

There are any number of ways this exotic type of attack could be used, but the two primary use cases would be to intentionally steer the target into hazardous road conditions, or to lure them to an isolated area where a physical attack could be carried out.

Unfortunately, in the months and years ahead, we can probably count on seeing both.

LTE Networks May Be Vulnerable To Hacking

by

Researchers from Ruhr-Universität Bochum and New York University in Abu Dhabi have discovered serious security flaws in 4G LTE networks that allow hackers to spy on, listen in on, intercept, and disrupt phone calls and text messages.

Given that billions of people rely on 4G LTE networks for cellphone communications, it’s a serious issue, and there are no easy fixes. So, don’t expect these flaws to be patched out of existence any time soon.  Worse still, the planned 5G networks currently in development may well suffer from the same (or similar) flaws.

Based on their research, the team was able to develop a trio of new attacks that specifically target weaknesses in the 4G LTE architecture.

One of these, dubbed “aLTEr” is a DNS spoofing attack that allows a hacker to become the “man in the middle,” intercepting communications, and gives them the ability to spoof alerts, texts, and other messages.

All three of the attacks developed by the team take advantage of weaknesses found in “Layer Two” of the LTE network.

This is the data layer that rests atop the physical channel.  Its function is to maintain wireless communication between users and the network itself, and has an organizational function that (among other things) manages how users access various resources on the network, helping to protect data via encryption and to correct errors in transmission.  Obviously, a hack that can exploit this layer could be devastating indeed.

If there’s a silver lining, it lies in the fact that these three attacks are exotic. It would be difficult for a casual or even a fairly determined hacker to execute to any real effect.  Unfortunately, it would be a much easier task for a state-sponsored group to pull off, and that’s the big fear here.

Hopefully, since 5G networks are still in the planning stages, something can be done before they’re rolled out to limit the effectiveness, or perhaps even negate these new types of attacks, but that remains to be seen.

Microsoft Edge Mobile Browser Blocks Android And iOS Ads

by

As most people know, Microsoft Edge was the company’s “reboot.”  After trying for years to patch and update their beleaguered Internet Explorer, Microsoft ultimately decided to scrap it and start fresh.  Since Edge’s launch, it has struggled to gain traction with users.

Recently, Microsoft has upped the ante, at least where Edge for iOS and Android devices are concerned.  A recent update sees the browser outfitted with a built-in ad blocker.  Prior to the update, if you wanted an ad blocking solution, you’d have to download and install it separately.  This move saves users a step, and gives you one less thing to think or worry about.

It’s a good move, but that alone is unlikely to give Edge the surge in popularity it needs to catch up with other browsers.

To provide some perspective, currently, Microsoft Edge is installed on about five million Android devices, based on stats from the Google Play Store.  Contrast that with 100 million installs of Mozilla’s Firefox, and more than a billion Chrome installations.

Those are sobering numbers that underscore just how much ground Edge needs to cover to even be playing in the same league as other popular web browsers on mobile devices.  While we don’t have statistics for installs from the Apple Store, it’s hard to imagine that they’d be any better, and, are probably a fair bit lower.

That’s not to say that Microsoft’s move wasn’t good, because it definitely was.  Anything that a company can do to cut down the number of unwanted, annoying, and potentially dangerous ads is a very good thing. Odds are that the company’s recently move will be copied by the major players in the browser world.  Even if it doesn’t boost Edge’s numbers much, that’s a win for anybody who uses the internet.  Kudos to Microsoft for making the change.

Mobile Users Gain Privacy Protection In Supreme Court Ruling

by

There’s some good news from a recent Supreme Court ruling where privacy is concerned, but take it with a grain of salt.

In a recent 5-4 decision, the Supreme Court ruled that law enforcement agencies must obtain a warrant before they can get access to data collected and stored on mobile devices.  Of special significance, the court rejected the “third party rule,” which dates back to the 1970’s and asserts that any data collected by third-parties is automatically devoid of Constitutional protection.

The ruling is undeniably good news, and privacy advocates who have been watching the issue closely hail the decision as a victory for individual privacy. However, it should be noted that in the overwhelming majority of cases, “probable cause” is sufficient for most judges to grant a search warrant to law enforcement officials.

The reality is that probable cause is one of those “squishy” words that can mean wildly different things to different people.  While it serves as a speed bump to accessing data on mobile devices, it’s a relatively modest one that’s unlikely to prevent many instances of law enforcement getting the information they need during the course of their investigations.

All that to say, it’s a good first step, but this ruling alone isn’t enough.  So far, no national government anywhere in the world has been able to craft a set of sensible policies that adequately protect the privacy of individuals on the web.  Corporations collect oceans of data on the consuming public, and increasingly, that data is packaged, resold and used for a variety of purposes.

While most of those purposes are fairly harmless and aimed more at marketing than anything else, other purposes border on or are abuses of the public’s trust.  There are no easy fixes here, but kudos to the Supreme Court for taking an important first step.

Contact Info

740 Greenville Blvd. SE., Ste. 400-374
Greenville, NC 27858

Phone: (252) 565-1235